WO2005013552A1

WO2005013552A1 - Vpn communication system

Info

Publication number: WO2005013552A1
Application number: PCT/JP2004/011415
Authority: WO
Inventors: Nagaaki Oyama; Atsunori Higashikawa; Shuichiro Yamamoto
Original assignee: Ntt Data Corporation
Priority date: 2003-08-04
Filing date: 2004-08-03
Publication date: 2005-02-10
Also published as: JP2005057479A; KR20060059993A; KR100754556B1; JP4467923B2

Abstract

A device registration process registers e-Key chips (6a-6f) provided in user terminals (5a-5f) with a chip management center (2). A VPN service download process downloads a VPN service application soft from a VPN service provider center (3) and installs it into the e-Key chips (6a-6f). A VPN key producing or sharing process stores a VPN key in the e-Key chips (6a-6f). Among the user terminals (5a-5f) belonging to the same VPN, the VPN key stored in the e-Key chips (6a-6f) is used to establish a VPN connection. This arrangement allows a client to communicate with other clients belonging to the same VPN regardless of the operation of a VPN server.

Description

Specification

TECHNICAL FIELD The present invention relates to a VPN communication system in which a plurality of VPNs (Virtual Private Networks) are constructed on a network with which terminals can communicate with each other and only communication between users belonging to the same VPN is performed.

This application claims the priority of Japanese Patent Application No. 2003-285944 filed on Aug. 4, 2003, the content of which is incorporated herein by reference. 2. Description of the Related Art Conventionally, a VPN communication system includes a plurality of clients and a management server that distributes a communication encryption key for performing communication in the VPN between the clients via a communication network. The management server manages which VPN the client belongs to using the IP (Internet Protocol) address used by the client.

Alternatively, as an improvement on this, the user can use any V

Whether the user belongs to the PN is managed using the user ID of the user (for example, see Japanese Patent Application Laid-Open No. 2000-059357).

In these, the dedicated software (VPN server software) is installed, the management server (VPN server, etc.) that has been pre-configured, the dedicated software (VPN software) is installed, and the pre-configuration of the dedicated software is performed. This is achieved by executing a secure cryptographic communication protocol between the performed clients. However, (1) If the management server is not running at the time of VPN connection, the VPN connection Can not do. (2) The management server must also install and configure the software to communicate with the dedicated software. (3) If a legitimate user uses a VPN with another client, the other client must install and configure the dedicated software. (4) Since the dedicated software must be set for the specified VPN server, it is not possible to immediately change the communication partner to a client belonging to another VPN.

(5) Since client authentication is provided by a different method, the only way to determine whether another client is a legitimate terminal is whether or not there is dedicated software. Disclosure of the invention

Therefore, the present invention can communicate with other clients belonging to the same VPN regardless of whether or not the VPN server is operating, and the work load related to software installation and setting on the VPN server and the client. The present invention relates to a VPN communication system that can reduce the amount of traffic. In a first aspect of the present invention, a VPN communication system is a VPN communication system including: a communication terminal equipped with a secure chip; and a chip management center that manages the secure chip. A registration information signing means for signing registration information including the chip information of the secure chip and the public key of the secure chip using the secret key of the chip, and a public key of a chip manager of the chip management center. A registration information encryption unit for encrypting the registration information signed by the registration information signature unit into encrypted registration information; and encrypting the encrypted registration information obtained by encryption by the registration information encryption unit. Means for transmitting encrypted registration information to the chip management center; and a chip public key for receiving a chip public key certificate from the chip management center. Key certificate receiving means, chip public key certificate confirming means for confirming the validity of the chip public key certificate received by the chip public key certificate receiving means, A chip public key certificate storage unit that stores the chip with a chip public key certificate storage unit, wherein the chip management center receives the encryption registration information from the communication terminal, and Registration information decryption means for decrypting the encrypted registration information received by the encryption registration information receiving means into the signed registration information using a secret key of a chip manager of the management center. Registration information signature verification means for verifying a signature of the registration information obtained by decryption by the registration information decryption means using a public key of the secure chip included in the registration information; and A chip public key certificate creating means for creating a chip public key certificate including a public key of the secure chip to be transmitted to a terminal, and registering the registration information obtained by decryption by the registration information decryption means in a chip database. Registration information registering means, and a chip public key certificate for transmitting the chip public key certificate created by the chip public key certificate creating means to the communication terminal. And signal means, and further comprising a.

In a second aspect of the present invention, a VPN communication system is a VPN communication system comprising: a communication terminal equipped with a secure chip; and a VPN service providing center that provides the communication terminal with VPN service application software. The communication terminal, using a secret key of the secure chip, a service providing request signing means for signing a service providing request for requesting the VPN service providing center to provide application software for VPN service; and Providing a service for transmitting, to the VPN service providing center, a service providing request signed by the service providing request signing means and a chip public key certificate stored in the secure chip and including a public key of the secure chip. Request means; and the chip public information received by the service provision request receiving means. Chip public key certificate verifying means for verifying the key certificate; service receiving means for receiving the VPN service application software from the VPN service providing center; and the VPN service application software received by the service receiving means. Service installation means for installing the secure chip on the secure chip, wherein the VPN service providing center receives the signed service providing request and the chip public key certificate from the communication terminal. A service providing request received by the service providing request receiving means using a public key of the secure chip included in the chip public key certificate received by the service providing request receiving means; Request signature verification to verify the signature of the service hand And service transfer means for transferring the VPN service application software to the communication terminal.

In a third aspect of the present invention, in the VPN communication system, a communication encryption key for performing communication between a communication terminal equipped with a secure chip and the communication terminal belonging to the same VPN is generated and transmitted to the communication terminal. A VPN communication system comprising: a service providing center for delivery; and wherein the communication terminal uses a secret key of a VPN service application stored in the secure chip to provide a communication encryption key to the service providing center. An encryption key generation request signing means for signing an encryption key generation request requesting the generation of the service provider center; and a signature signed by the encryption key generation request signature means using a public key of a service provider managing the service providing center. An encryption key generation request encrypting means for encrypting the encryption key generation request into an encryption encryption key generation request; and encryption by the encryption key generation request encryption means. (C) an encryption key generation request transmitting means for transmitting an encryption key generation request obtained by the client and a public key certificate of a VPN service application stored in the secure chip to the service providing center; Generating key information receiving means for receiving encrypted generated encryption key information signed by the service provider; and using the public key of the service provider, the encryption generating information received by the generated encryption key information receiving means. Generating encryption key information signature verification means for verifying the signature of the encryption key information, and a communication encryption key and an identifier of the communication encryption key using the secret key of the VPN service application. A generated encryption key information decrypting means for decrypting the generated encryption key information into a generated encryption key information including the generated encryption key information. Means for installing encryption key information on the security chip, wherein the service providing center transmits the encryption encryption key generation request from the communication terminal and publishes the VPN service application. An encryption key generation request receiving means for receiving a key certificate; a service public key certificate verification means for verifying a public key certificate of the VPN service application received by the encryption key generation request receiving means; An encryption key generation request decryption unit decrypts the encrypted encryption key generation request received by the encryption key generation request reception unit into the signed encryption key generation request using the secret key of a service provider. Means and the VPN service application A generation request signature verification unit for verifying a signature of the encryption key generation request obtained by decryption by the encryption key generation request decryption unit using a public key of a case; and distributing the signature to the communication terminal. Communication encryption key generation means for generating a communication encryption key; and group information storage for registering the communication encryption key generated by the communication encryption key generation means and an identifier of the communication encryption key in a group information database. Means for encrypting generated encryption key information including the communication encryption key generated by the communication code key generation means and an identifier of the communication encryption key using a public key of the VPN service application. Using a generated encryption key information encrypting means for encrypting the generated encryption key information, and a secret key of the service provider, obtained by encryption by the generated encryption key encrypting means. Generated encryption key information signing means for signing the encrypted generated encryption key information, and generated encryption key information for transmitting the encrypted generated encryption key information signed by the generated encryption key information signature means to the communication terminal. And transmitting means.

In a fourth aspect of the present invention, the VPN communication system manages a communication encryption key for performing communication between a communication terminal equipped with a secure chip and the communication terminal belonging to the same VPN, and A VPN providing a service providing center for delivery, wherein the communication terminal uses a secret key of a VPN service application stored in the secure chip to provide a communication encryption to the service providing center. An encryption key sharing request signing means for signing an encryption key sharing request for requesting key sharing, and a signature being signed by the encryption key sharing request signing means using a public key of a service provider managing the service providing center. Encryption key sharing request encrypting means for encrypting the attached encryption key sharing request into an encrypted encryption key sharing request; and encryption by the encryption key sharing request encrypting means. An encryption key sharing request transmitting means for transmitting, to the service providing center, an encryption key sharing request obtained by the above and a public key certificate of a VPN service application stored in the secure chip; A shared encryption key information receiving means for receiving a signed encrypted shared encryption key information from a service providing center; and the shared encryption key information receiving means using a public key of the service provider. A shared encryption key information signature verifying means for verifying a signature of the encrypted shared encryption key information; and a secret key of the VPN service application. A shared encryption key information decryption unit that decrypts the encrypted shared encryption key information into shared encryption key information including a communication encryption key and an identifier of the communication encryption key using the shared encryption key information decryption unit; A shared encryption key information installation means for installing the shared encryption key information obtained by decryption by the means into the secure chip, wherein the service providing center comprises: An encryption key sharing request receiving means for receiving the public key certificate of the VPN service application; and a service disclosure for verifying the public key certificate of the VPN service application received by the encryption key sharing request receiving means. Using a public key of the service provider, a key certificate verification unit, and the encryption key sharing request receiving unit. Encryption key sharing request decrypting means for decrypting the encrypted encryption key sharing request into the signed encryption key sharing request; and decrypting the encryption key sharing request using the service provider's secret key. Sharing request signature verification means for verifying the signature of the encryption key sharing request obtained by decryption by means; communication encryption key search means for searching for a communication encryption key to be distributed to the communication terminal; A group information additional registration unit for additionally registering the user information of the terminal in the group information database; and the communication encryption key search unit using the public key of the VPN service application. A shared encryption key information encrypting means for encrypting shared encryption key information including a key and an identifier of the communication encryption key into encrypted shared encryption key information; and a secret key of the service provider. And a shared encryption key information signing means for signing the encrypted shared encryption key information obtained by the encryption by the shared encryption key encryption means; and the cipher signed by the shared encryption key information signing means. And shared encryption key information transmitting means for transmitting encrypted shared encryption key information to the communication terminal.

In a fifth aspect of the present invention, in the VPN communication system including a communication terminal equipped with a secure chip, the communication terminal uses a communication encryption key stored in the secure chip. And perform encrypted communication with other communication terminals belonging to the same VPN. Brief Description of Drawings

FIG. 1 is a diagram showing an outline of a VPN communication system according to an embodiment of the present invention.

FIG. 2 is a diagram showing a configuration related to a device registration process of the VPN communication system. FIG. 3 is a diagram showing a procedure of a device registration process of the VPN communication system.

FIG. 4 is a diagram showing a configuration related to the VPN service download processing of the VPN communication system.

FIG. 5 is a diagram showing a procedure of a VPN service download process of the VPN communication system.

FIG. 6 is a diagram showing a configuration related to the VPN key generation processing of the VPN communication system.

FIG. 7 is a diagram showing a procedure of a VPN key generation process of the VPN communication system.

FIG. 8 is a diagram showing a configuration related to the VPN key sharing process of the VPN communication system.

FIG. 9 is a diagram showing a procedure of a VPN key sharing process in the VPN communication system.

FIG. 10 is a diagram showing a procedure of a VPN construction process of the VPN communication system.

FIG. 11 is a diagram showing a configuration related to the VPN key invalidation processing of the VPN communication system.

FIG. 12 is a diagram showing a procedure of a VPN key invalidation process in the VPN communication system. BEST MODE FOR CARRYING OUT THE INVENTION Preferred embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 is a diagram showing an outline of a VPN communication system according to an embodiment of the present invention. The VPN communication system 1 has a chip management center 2 having a chip information database, a VPN service providing center having a user information database (for example, users have registered their user information in advance) and a group information database. 3, a personal identification service center 4, and a user terminal equipped with an e-Key chip (corresponding to a secure chip) 6a to 6mm (equivalent to a communication terminal) 5a to 5f Each is connected to the Internet. In the VPN communication system 1, device registration processing (processing of registering e-Key chips in the chip management center), VPN service download processing (processing of downloading VPN service application software to communication terminals), VPN key generation processing (new VPN key generation processing (processing to share a VPN key with multiple communication terminals), VPN construction processing (processing to establish a VPN connection between communication terminals belonging to the same VPN group), VPN Key invalidation processing (processing to invalidate the VPN key at the user terminal) is executed. Hereinafter, various processes will be described in order. The communication terminal includes a personal computer, a mobile phone, a portable information terminal, and the like.

《Device registration processing》

FIG. 2 is a diagram showing a configuration related to a device registration process of the 'VPN communication system. Note that the e_Key chip 6a to 6f before the device registration process includes the public key of the e_Key chip 6a to 6f (hereinafter referred to as chip public key) and the secret key (hereinafter referred to as chip secret). Key) and the public key of the chip manager of the chip management center 2 (hereinafter referred to as the chip manager public key).

) Is stored at least.

As shown in FIG. 2, the user terminals 5a to 5f are: card transmitting / receiving means 51a, transmitting / receiving means (encryption registration information transmitting means, chip public key certificate receiving means) 5lb, registration information signature means 51c. It has a registration information encryption means 51d, a chip public key certificate confirmation means 51e, and a chip public key certificate storage means 51f. The card transmitting / receiving means 51a transmits the cryptographic registration information to the personal identification IC card 7 and receives the personal identification signed cryptographic registration information from the personal authentication IC card 7. The transmission / reception means 51b transmits the encrypted registration information with the personal signature to the chip management center 2, and sends the chip public key certificate (certificate that the chip public key is correct) from the chip management center 2. ) Is received.

The registration information signing means 51c uses the chip secret key stored in the e-Key chip 6a to 6f to register the registration information (e_Key chip 6) to be registered in the chip management center 2. Sign the chip information of a to 6 f and the chip public key stored in e-Key chip 6 a to 6 f. The registration information encryption unit 51 d uses the chip administrator public key stored in the e-Key chip 6 a to 6 f to register the registration information signed by the registration information signing unit 51 c. Encrypt the information into encrypted registration information.

The chip public key certificate confirming means 51e confirms the validity of the chip public key certificate received by the transmitting / receiving means 51b. This confirmation is performed using the chip administrator public key stored in the e-Key chip 6a to 6f, and using the signature (chip administrator private key (hereinafter referred to as chip management) included in the chip public key certificate. This is done by verifying a signature created using a private key. The chip public key certificate storage means 51 f stores the chip public key certificate validated by the chip public key certificate confirmation means 51 e in the e_Key chips 6 a to 6 f. .

As shown in FIG. 2, the chip management center 2 includes transmitting / receiving means (encrypted registered information receiving means, chip public key certificate transmitting means) 21a, registered information decrypting means 21b, registered information signature verifying means 2 1 c, chip public key certificate creation means 21 d, and registration information registration means 21 e. The transmission / reception means 21a receives the encrypted registration information with the personal signature from the user terminals 5a to 5f, and transmits the chip public key certificate to the user terminals 5a to 5f. In addition, it transmits an identification request to the identification service center 4 and receives the identification result from the identification service center 4. The registration information decrypting means 21b decrypts the encrypted registration information received by the transmission / reception means 21a into the signed registration information using the chip manager private key. The registration information signature verification unit 21c verifies the signature of the registration information using the chip public key included in the registration information with the signature obtained by the decryption by the registration information decryption unit 21b. The chip public key certificate creation means 2 1d, when the registration information signature verification means 21c determines that the signature is correct, the chip included in the registration information obtained by decryption by the registration information decryption means 21b. Create a chip public key certificate including a public key. However, the chip public key certificate includes a signature created using the chip administrator private key. When the registration information signature verification unit 21c determines that the signature is correct, the registration information registration unit 21e registers the registration information (chip information and chip information) obtained by decryption by the registration information decryption unit 21b. Public key) is stored in the chip information database. FIG. 3 is a diagram showing a procedure of a device registration process in the VPN communication system. In the user terminals 5a to 5f, the registration information signing means 51c uses the chip secret key to register the registration information of the e_Key chip 6a to 6f (e-key chip 6a to 6f). Sign the chip information and the chip public key stored in the e-Key chip 6a to 6f (S101).

Subsequently, the registration information encrypting means 51d encrypts the registration information with the signature obtained in S101 using the chip manager public key into the encryption registration information (S10). 2). Then, the encrypted registration information obtained in S102 from the card transmitting / receiving means 51a is transmitted to the personal identification IC card 7 (S103).

Upon receiving the encrypted registration information from the user terminals 5a to 5f, the personal identification IC card 7 signs the encrypted registration information using the IC card private key (S104). Then, the encrypted registration information with the personal signature obtained in S104 is transmitted to the user terminals 5a to 5f (S105). In each of the user terminals 5a to 5f, when the encrypted registration information with the personal signature is received by the card transmitting / receiving means 51a, the encrypted registration information with the personal signature is transmitted to the user terminal by the transmitting / receiving means 51b. The data is sent from 5 a to 5 f to the chip management center 2 (S 106).

At the chip management center 2, when the encrypted registration information with the personal signature is received by the transmission / reception means 21a, the ID information registration information signed by the transmission / reception means 21a is transmitted to the IC card identity verification service. It is transmitted to the center 4 and makes an identification request to the IC card identification service center 4 (S107). At the IC card identity verification service center 4, which is required to verify the identity, the identity signature (signature of S104) is verified using the IC card public key, and the identity is verified. Sent to 2 (S108).

When the chip management center 2 is notified that the user is the principal, the registration information decryption means 21 b uses the chip manager private key to encrypt the registration information received by the transmission / reception means 21 a. The information is decrypted into the registered information with a signature (S109). Subsequently, the registration information signature verification unit 21c uses the chip public key included in the signed registration information obtained in S109 to sign the registration information (signature of S101). Is verified (S110). And if the signature is determined to be correct, the chip public key certificate The creating unit 21d creates a chip public key certificate including the chip public key included in the registration information obtained in S109 (S111). Subsequently, the registration information registration means 21e stores the chip information and the chip public key included in the registration information obtained in S109 in the chip information database (S112). Then, the chip public key certificate created in S111 from the transmitting / receiving means 21a is transmitted to the user terminals 5a to 5f (S113).

In each of the user terminals 5a to 5f, when the chip public key certificate is received by the transmission / reception means 51b, the chip public key certificate confirmation means 51e confirms the validity of the chip public key certificate (S1). 14). Then, when it is confirmed that the chip public key certificate is valid, the chip public key certificate storage unit 51f stores the chip public key certificate received by the transmission / reception unit 51b in an e-Key chip 6 Stored in a to 6 f (SI 15).

In the device registration process, personal identification is performed using an IC card for personal authentication.However, the user is not limited to this, and the user inputs authentication information directly at the user terminals 5a to 5f, It may be transmitted to the chip management center 2 together with the registration information. If security is not an issue, the encryption registration information may be transmitted from the transmission / reception means 51b, except for the processing for performing personal authentication (S104, S107, S108). Further, information of the user who has performed the registration process may be registered together in the chip information database.

《VPN service download processing》

FIG. 4 is a diagram showing a configuration related to a VPN service download process of the VPN communication system. Before starting the VPN service download process, the e-Key chips 6a to 6f contain the chip public key, chip secret key, chip administrator public key, and chip public key certificate (stored by device registration process). ) Are stored at least.

As shown in FIG. 4, the user terminals 5a to 5f include transmitting / receiving means (service providing means, service receiving means) 52a, service providing request signing means 52b, service installing means 52c, and personalizing means 52. equipped with d. Transmission / reception means 5 2a is a service download request with a signature (equivalent to a service provision request). The ) And a chip public key certificate including the chip public key stored in the e-Key chip 6a to 6f to the VPN service providing center 3, and the VPN service providing center 3 sends the VPN service. Application software (software for securing memory in e_Key chips 6a to 6f). The service provision request signing means 52b uses the chip secret key stored in the e_Key chip 6a to 6f to sign a service download request for requesting the download of the VPN service application software. The service installation means 52c installs the VPN service application software received by the transmission / reception means 52a to the e-Key chips 6a to 6f. The personalizing means 52d personalizes with the personalized data encrypted using the chip public key and the service provider private key (generates a key on the service application).

As shown in FIG. 4, the VPN service providing center 3 includes a transmitting / receiving means 32a, a service providing request signature verifying means 32b, and a transferability determining means 32c. The transmission / reception means 32a is a user terminal.A signed service down request and chip public key certificate are received from 5a to 5f, and application software for VPN service is transmitted to the user terminals 5a to 5f. Transfer to f. In addition, it transmits a download permission request to the chip management center 2 and receives a result of the determination as to whether the download is permitted from the chip management center 2. The service provision request signature verification unit 32b uses the chip public key included in the chip public key certificate received by the transmission / reception unit 32a to sign the service download request signature received by the transmission / reception unit 32a. Verify. The transfer permission / non-permission determining means 32c determines whether or not the transfer of the VPN service application software to the user terminals 5a to 5f is possible in consideration of the situation of the user so far.

FIG. 5 is a diagram showing a procedure of a VPN service download process in the VPN communication system.

In the user terminals 5a to 5f, the service provision request signing means 52b signs the service download request using the chip secret key (S201). Then, the service download request signed with S201 in transmitting / receiving means 52a is required. The request and the chip public key certificate are sent to the VPN service providing center 3 (S202).

In the VPN service providing center 3, when the signed service download request and the chip public key certificate are received by the transmitting / receiving means 32a, the service providing request signature verifying means 32b is included in the chip public key certificate. The signature of the service download request (signature of S201) is verified using the chip public key (S203). If it is determined that the signature is correct, the transmission / reception means 32a transmits a download permission request to the chip management center 2 (S204). In the chip management center 2, when there is a download permission request from the VPN service providing center 3, the e-Key chips 6a to 6f of the user terminals 5a to 5f that made the service download request are registered in the chip information database. It determines whether or not the VPN service application software can be downloaded based on the status, and notifies the VPN service providing center 3 of whether or not the download is possible (S205).

In the VPN service provider center 3, when the chip management center 2 is notified of the download permission, transfer possibility determination unit 32 c determines whether the download application Chillon software for VPN service (S 206) ₀ The down hole When the mode is permitted, the VPN service application software is transferred from the transmission / reception means 32a to the user terminals 5a to 5f by encrypted communication (S207).

When the VPN service application software is received by the transmission / reception means 52a at the user terminals 5a to 5f, the service installation means 52c sends the VPN service application software to the e-Key chip 6a. Install it at ~ 6f (S208).

Subsequently, the personalizing means 52d personalizes with the personalized data encrypted using the chip public key and the service provider private key (S209). Note that the VPN service download processing may be created so as not to include the processing of S209. In addition, you may verify that the application software itself is correct before installation. Furthermore, the result of the installation and personalization may be notified to the VPN service providing center.

《VPN key generation processing》 FIG. 6 is a diagram showing a configuration related to a VPN key generation process of the VPN communication system. Before starting the VPN key generation process, the e-Key chip 6a to 6f contains the chip public key and chip secret key, chip administrator public key, service AP public key and service AP. The private key, the public key of the VPN service provider who manages the administrator of the VPN service center (public key of the service provider), and the public key certificate of the service AP are all stored. However, the service AP public key, service AP private key, service provider public key, and service AP public key certificate are stored in the e-Key chips 6a to 6f as appropriate after the VPN service download processing. The service AP public key certificate includes the service AP public key and a private key of the VPN service provider or a third party private key recognized by the VPN service provider (hereinafter referred to as a service provider private key). There is a signature made by.

As shown in FIG. 6, the user terminals 5a to 5f transmit / receive means (encryption key generation request transmission means, generated encryption key information receiving means) 53a, encryption key generation request signature means 53b, and encryption key generation. A request encryption unit 53c, a generated encryption key information signature verification unit 53d, a generated encryption key information decryption unit 53e, and a generated encryption key information installation unit 53f are provided. The transmitting / receiving means 53a requests the VPN service providing center 3 to generate an encryption encryption key, the service AP public key certificate stored in the e-Key chip 6a to 6f, and the use permission condition (expiration date, The number of times of use, etc.), and the signed encryption / encryption key information including the VPN key, the VPN key identifier (key ID), and the expiration date information are received. The encryption key generation request signing means 53b uses the service AP secret key stored in the e-Key chip 6a to 6f to send a VPN key (VPN encryption key) to the VPN service providing center 3. Signs an encryption key generation request that requests generation of a key. The encryption key generation request encrypting means 53c is signed by the encryption key generation request signing means 53b using the service provider public key stored in the e-Key chip 6a-6. The generated encryption key generation request is encrypted into an encryption key generation request.

The generated encryption key information signature verification unit 53 d uses the service provider public key stored in the e-Key chip 6 a to 6 f and receives the encrypted generated encryption key received by the transmission / reception unit 53 a. Verify the signature of the information. The generated encryption key information decryption means 53 e If the signature is determined to be correct by the generated cryptographic key information signature verification means 53 d, the transmission / reception means 53 a uses the service AP secret key stored in the e-Key chip 6a to 6f. The received encryption key information is decrypted into the generated encryption key information including the VPN key, key ID, and expiration date information. The generated encryption key information installation means 53 f uses the generated encryption key information (VPN key, key ID, expiration date information, etc.) obtained by the decryption by the generated encryption key information decrypting means 53 e to e—K ey Install on chips 6a-6f.

As shown in Fig. 6, the VPN service providing center 3 transmits / receives (encryption key generation request receiving means, generated encryption key information transmitting means) 33a, service AP public key certificate verification means (service public key certificate) Verification means) 3 3 b, key generation possible verification means 3 3 c, encryption key generation request decryption means 33 d, generation request signature verification means 33 e, communication encryption key generation means 33 f, addition means 33 g, group information storage means 33 h, generated encryption key information encryption means 33 i, and generated encryption key information signature means 33 j.

The transmission / reception means 33a transmits to the user terminals 5a to 5f the signed encryption / encryption key information including the VPN key, the identifier (key ID) of the VPN key, and the expiration date information, and the like. , A request to generate an encryption key from the user terminal 5 a-5 f, the service AP public key certificate stored in the e_Key chip 6 a-6 f, and the conditions for using the license (expiration date, use Number of times). The service AP public key certificate verification means 3 3b verifies the validity of the service AP public key certificate (performs user authentication). Specifically, this is performed by verifying the signature of the service AP public key certificate using the service provider public key. The key generation possibility verification means 33c determines whether or not the user can generate a key based on the use permission condition. The encryption key generation request decryption means 33d uses the service provider private key to decrypt the encryption encryption key generation request received by the transmission / reception means 3.3a into a signed encryption key generation request. Become The generation request signature verification means 33 e verifies the signature of the encryption key generation request obtained by the decryption by the encryption key generation request decryption means 33 d using the service AP public key.

The communication encryption key generation means 33 f is a user who can determine that the service AP public key certificate is correct by the service AP public key certificate verification means 33 and can generate a key by the key generation possible verification means 33 c. It is determined that there is a Generates a VPN key if the signature is determined to be correct. The adding means 33g includes, in the VPN key generated by the communication encryption key generating means 33f, the identifier (key ID) of the VPN key and the expiration date information included in the use permission conditions from the user terminals 5a to 5f. And additional information such as information. The group information storage unit 33h stores the group information (the VPN key generated by the communication encryption key generation unit 33f, the additional information added to the VPN key by the addition unit 33g, and the user information database. The information of the user who made the encryption key generation request) is registered in the group information database. The generated encryption key information encrypting means 33i uses the service AP public key included in the service AP public key certificate to generate a VPN key (generated encryption key) to which additional information has been added by the adding means 33g. Key information) is encrypted into encryption-generated encryption key information. The generated encryption key information signing means 33j signs the encrypted generated encryption key information obtained by the generated encryption key information encryption means 33i using the service provider private key.

FIG. 7 is a diagram showing a procedure of a VPN key generation process in the VPN communication system. In each of the user terminals 5a to 5f, the encryption key generation request signing means 53b signs the encryption key generation request using the service AP private key (S301). Subsequently, the encryption key generation request encrypting means 53c encrypts the signed encryption key generation request obtained in S301 into the encrypted encryption key generation request using the service provider public key ( S 302). Then, the encrypted encryption key generation request, the service AP public key certificate, and the use permission condition obtained in S302 from the transmission / reception means 53a are transmitted to the VPN service providing center 3 (S303).

In the VPN service providing center 3, when an encryption / encryption key generation request is received by the transmission / reception means 33a, the service AP public key certificate verification means 33b verifies the service AP public key certificate and the key. The generation possibility verification unit 33c determines whether or not the user can generate a key (S304). Subsequently, the encryption key generation request decrypting means 33d decrypts the encrypted encryption key generation request into a signed encryption key generation request using the service provider private key (S305). Subsequently, the generation request signature verification unit 33e verifies the signature (signature of S301) of the encryption key generation request using the service AP public key (S306). The service AP public key certificate is valid, the user can generate the key, and the signature of the encryption key generation request is correct. Then, the communication encryption key generation means 33f generates a VPN key (S307). Subsequently, the adding unit 33g adds additional information (key ID, expiration date information, etc.) to the VPN key generated in S307 (S308). Subsequently, the group information storage unit 33h registers the group information (the VPN key, the additional information, and the user information) in the group information database (S309). Further, the generated encryption key information encrypting means 33 i encrypts the generated encryption key information including the VPN key and the additional information into the encrypted generated encryption key information using the service AP public key (S310). . Subsequently, the generated encryption key information signing means 33j signs the encrypted generated encryption key information obtained in S310 using the service provider private key (S311). Then, the transmission / reception means 33a transmits the encryption generation encryption key information signed by S311 to the user terminals 5a to 5f (S312).

In each of the user terminals 5a to 5f, when the transmission / reception unit 53a receives the signed encryption key generated encryption key information by the transmission / reception unit 53a, the generated encryption key information signature verification unit 53d uses the service provider public key. To verify the signature of the encryption-generated encryption key information (signature of S311) (S313). If the signature is determined to be correct, the generated encryption key information decrypting means 53e decrypts the encrypted generated encryption key information into the generated encryption key information using the service AP private key (S314). Subsequently, the generated encryption key information installation means 53f transmits the generated encryption key information (VPN key, key ID, expiration date information, etc.) obtained by the decryption in S314 to an e-Key chip 6a to 6 Install on f (S315).

《V PN key sharing process》

FIG. 8 is a diagram showing a configuration related to the VPN key sharing process of the VPN communication system. The e-Key chips 6a to 6f before starting the VPN key sharing process are substantially the same as the state before starting the VPN key generation process, except for the VPN key and information related thereto. is there.

As shown in FIG. 8, the user terminals 5a to 5f include transmitting / receiving means (encryption key sharing request transmitting means, shared encryption key information receiving means) 54a, search requesting means 54b, and encryption key sharing request signing means. 54c, encryption key sharing request encryption means 54d, shared encryption key information signature verification means 54e, shared encryption key information decryption means 54f, and shared encryption key information installation Equipped with 54 g

The transmission / reception means 54a transmits the encryption key sharing request, the service AP public key certificate stored in the e-Key chip 6a to 6f, and the key ID to the VPN service providing center 3, and transmits the VPN. Search results that include the key ID of the VPN you want to join from the service provider center 3, and the VPN key, the identifier of the VPN key (key ID), and the signed shared encryption key that includes the expiration date information Receive information. The search requesting means 54b requests the VPN service providing center 3 to search for a VPN that the user wants to participate in. The encryption key sharing request signing means 54c uses the service AP secret key stored in the e-Key chip 6a to 6f to share the VPN key with the VPN service providing center 3 using the service AP secret key. Sign the requested encryption key sharing request. The encryption key sharing request encryption means 54d uses the service provider public key stored in the e-Key chip 6a to 6f, and uses the encryption key sharing request signing means 54c to sign the encryption. Encrypt the key sharing request into an encrypted encryption key sharing request.

The shared encryption key information signature verification unit 54e verifies the signature of the encrypted shared encryption key information using the service provider public key stored in the e-Key chip 6a to 6f. When the shared encryption information signature verifying means 54 e determines that the signature is correct, the shared encryption key information decryption means 54 f extracts the service AP private key stored in the e-Key chip 6 a to 6 f. Used to decrypt the encrypted shared encryption key information into shared encryption key information including the VPN key, key ID, and expiration date information. The shared encryption key information installation means 54g uses the shared encryption key information (VPN key, key ID, expiration date information, etc.) obtained by decryption by the shared encryption key information decryption means 54f as an e-Key chip. Install on 6a to 6f.

As shown in Fig. 8, the VPN service providing center 3 transmits / receives means (encryption key sharing request receiving means, shared encryption key information transmitting means) 34a, participating VPN search means 34b, service AP public key certificate verification means (Service public key certificate verification means) 34 c, encryption key sharing request decryption means 34 d, sharing request signature verification means 34 e, participation target VPN search means 34 f, sharability verification means 34 g, user information additional registration means 34h, a common encryption key information encryption means 34i, and a common encryption key information signature means 34j are provided. The transmission / reception means 34 a includes search results including a key ID of a VPN that the user terminal has requested to participate in the user terminals 5 a to 5 f, a VPN key, an identifier (key ID;) of the VPN key, and expiration date information. to together sending with encrypted shared secret information with the signature, including, search request or VPN from the user terminal _{5 a} ~ 5 f, encrypted encryption key sharing request, participate subject VPN key ID and, The service AP public key certificate stored in the e_Key chip 6a to 6f is received. The participation desired VPN search means 3 4 b searches for the VPN that the user terminal wishes to join by referring to the group information database, and transmits the search result such as the key ID to the user terminal 5 a through the transmission / reception means 34 a. 5 Pass to f. The service AP public key certificate verification means 3 4 c verifies the validity of the service AP public key certificate using the same method as the service AP public key certificate verification means 3 3 b (performs user authentication). . The encryption key sharing request decrypting means 3 4 d decrypts the encrypted encryption key sharing request received by the transmitting / receiving means 34 a into a signed encryption key sharing request using the service provider secret key. . The shared request signature verifying means 34 e uses the service AP public key included in the service AP public key certificate to perform the encryption key sharing request obtained by decryption by the encryption key sharing request decrypting means 34 d. Verify your signature. The participation target VPN search means 3 4 f determines that the service AP public key certificate is correct by the service AP public key certificate verification means 3 4 c and determines that the signature is correct by the shared request signature verification means 34 e. Then, the group information is searched in the group information database based on the key ID received by the transmitting / receiving means 34a. The sharability verifying means 34g verifies whether the VPN key can be shared, for example, by checking whether the expiration date has passed. If the user information additional registration means 34h is determined to be sharable by the sharability verification means 34g, the user information requesting means 34h is associated with the key ID received by the transmission / reception means 34a, and the user requesting the VPN key sharing User information (user information stored in the user information database) is additionally registered in the group information database.

The shared encryption key information encryption means 3 4 i uses the service AP public key to encrypt the shared encryption key information stored in the group information database, including the VPN key, key ID, expiration date information, etc. Encrypt to shared encryption key information. The shared encryption key information signing means 3 4 j uses the service provider secret key to encrypt the shared encryption key information encryption means 3 4 j Signs the encrypted shared encryption key information obtained by i.

FIG. 9 is a diagram showing a procedure of a VPN key sharing process in the VPN communication system. It is assumed that the user terminal 5a requests the sharing of the VPN key, and the user terminal 5b participates in the VPN of the requested VPN key.

In the user terminal 5a, the search request means 54b requests the VPN service providing center 3 to search for a VPN that the user wants to participate in (S401). On the other hand, in the VPN service providing center 3, the participation desired VPN search means 34b searches for the VPN to which the user wishes to participate, and sends the search result including the key ID and the like to the user terminal 5a ( S 402). Then, in the user terminal 5a, when the search result is received by the transmission / reception means 54a, the encryption key sharing request signing means 54c signs the encryption key sharing request using the service AP secret key (S403). . Subsequently, the encryption key sharing request encryption means 54d encrypts the signed encryption key sharing request obtained in S403 into the encrypted encryption key sharing request using the service provider public key (S 404). Then, the encrypted encryption key sharing request obtained in S404 from the transmitting / receiving means 54a, the key ID notified as a search result, and the service AP public key certificate are transmitted to the VPN service providing center 3 (S 405).

In the VPN service providing center 3, when the transmission / reception means 34a receives an encryption key sharing request or the like, the service AP public key certificate verification means 34c verifies the service AP public key certificate (S406). ). Next, the decryption means 34d decrypts the encrypted encryption key sharing request received by the transmission / reception means 34a into a signed encryption key sharing request using the service provider secret key. Decryption is performed (S407). Subsequently, the sharing request signature verifying means 34e verifies the signature (signature of S403) of the encryption key sharing request using the service AP public key (S408). If the service AP public key certificate is valid and the signature of the encryption key sharing request is correct, the participation target VPN search means 34f searches for the participation target VPN (S409). Subsequently, the sharability verification unit 34g verifies whether the VPN key can be shared (S410). Then, when sharing is permitted, the user information additional registration unit 34h registers the user information in the group information database (S411). The shared encryption key information encryption means 34 i uses the service AP public key to Then, the shared encryption key information including the password and the additional information is encrypted into the encrypted shared encryption key information (S412). Subsequently, the shared encryption key information signing means 34j signs the encrypted shared encryption key information obtained in S412 using the service provider private key (S413). Then, the transmission / reception means 34a transmits the encrypted shared encryption key information signed in S413 to the user terminal 5a (S414). At the same time, a new participant is notified to the user terminal 5b (S418).

In the user terminal 5a, when the encrypted shared encryption key information signed by the transmission / reception means 54a is received, the shared encryption key information signature verification means 54e encrypts using the service provider public key. The signature of the shared encryption key information (signature of S413) is verified (S415). If the signature is determined to be correct, the shared encryption key information decryption means 5

4f decrypts the encrypted shared encryption key information into the shared encryption key information using the service AP secret key (S416). Subsequently, the shared encryption key information installation means 54 g

The shared encryption key information (VPN key, key ID, expiration date information, etc.) obtained by the decryption in 5416 is installed in the e-Key chip 6a (S417).

《V PN construction processing》

In the VPN construction process of the VPN communication system, communication is performed between the user terminals 5a to 5f in which the same VPN keys are stored in the e_Key chips 6a to 6f. At this time, the attributes (expiration date, number of times of use, etc.) of the VPN key are verified in the user terminals 5a to 5f.

FIG. 10 is a diagram showing a procedure of a VPN construction process in the VPN communication system. It is assumed that communication is performed between the user terminal _5a and the user terminal 5b.

In each of the user terminal 5a and the user terminal 5b, the attributes of the VPN key to be used (such as the number of times of use and the expiration date) are verified (S501, S502). If both the user terminal 5a and the user terminal 5b can use the VPN key, encrypted communication is performed using the VPN key defined between the user terminal 5a and the user terminal 5b. (S503).

《V PN key invalidation processing》

FIG. 11 is a diagram showing a configuration related to the VPN key invalidation processing of the VPN communication system. Before starting the VPN key invalidation process, the e_Key chips 6a to 6f have Contains at least the chip public key and chip private key, chip administrator public key, service AP public key and service AP private key, service provider public key, service AP public key certificate, and information related to the VPN key. ing.

As shown in FIG. 11, the user terminals 5a to 5f transmit / receive means 56a, attribute verification means 56b, encryption key deletion means 56c, information deletion request signature means 56d, and judgment notification information signature verification Means 56e are provided. The transmission / reception means 56a transmits an information deletion request and the service AP public key certificate stored in the e-Key chips 6a to 6f to the VPN service providing center 3 and determines from the VPN service providing center 3. Receive notification information. The attribute verification means 56b verifies the attributes (expiration date, etc.) of the VPN key to be used. If the attribute verification unit 56b determines that the encryption key deletion unit 56c is unusable (such as after the expiration date), the VPN key verified from the e-Key chip 6a to 6f Remove. If the information deletion request signing means 56d is determined to be unusable by the attribute verifying means 56b, e-K using the service AP private key stored in the e-Key chip 6a to 6f. Signs the key IDs stored in the ey chips 6a to 6f and an information deletion request that requests the VPN service providing center 3 to delete user information. The decision notification information signature verification means 56e verifies the signature of the decision notification information received by the transmitting / receiving means 56a using the service provider public key stored in the e_Key chip 6a to 6f. .

As shown in FIG. 11, the VPN service providing center 3 includes a transmitting / receiving unit 36a, a service AP public key certificate verifying unit 36b, a deletion request signature verifying unit 36c, and a deletion target VPN search unit 36d. , Availability determining means 36e, group information updating means 36f, and determination notification information signing means 36g. The transmitting / receiving means 36a receives the information deletion request from the user terminals 5a to 5f and transmits the judgment notification information to the user terminals 5a to 5f. The service AP public key certificate verification unit 36b performs substantially the same processing as the service AP public key certificate verification unit 33b to verify the service AP public key certificate (performs device authentication). . If the service AP public key certificate verification unit 36b determines that the service AP public key certificate is correct, the deletion request signature verification unit 36c uses the service AP public key to transmit and receive Verifies the signature of the key ID and the information deletion request received by. When the deletion request signature verification unit 36c determines that the signature is correct, the deletion target VPN search unit 36d searches the information group database for the VPN to be deleted based on the key ID received by the transmission / reception unit 36a. Search for. The usability judging means 36e checks the expiration date of the VPN searched by the deletion target VPN searching means 36d, and judges the usability. The group information updating means 36f deletes the user information included in the VPN group information retrieved from the group information database when the use is disabled by the availability judging means 36e. The judgment notification information signing means 36g uses the VPN service provider private key to sign the judgment notification information including the fact that the user information is determined to be unusable and that the user information has been deleted and the key ID.

FIG. 12 is a diagram illustrating a procedure of a VPN key invalidation process in the VPN communication system. It is assumed that the user terminal 5a makes a deletion request and that the user terminal 5b participates in the VPN for which the deletion request is made.

In the user terminal 5a, the attribute verification means 56b verifies the attribute of the VPN key to be used (S601). If the VPN key cannot be used, the encryption key deleting means 56c deletes the VPN key from the e_Key chip 6a (S602). Subsequently, the information deletion request signing means 56d signs the key ID and the information deletion request using the service AP private key (S603). Then, the signed information deletion request, the key ID, and the service AP public key certificate are transmitted from the transmitting / receiving means 56a to the VPN service providing center 3 (S604).

At the VPN service providing center 3, when the transmission / reception means 36a receives the signed information deletion request and the key ID and the service AP public key certificate from the user terminal 5a, the service AP public key certificate verification means 36b Verifies the service AP public key certificate (S605). Subsequently, when it is determined that the service AP public key certificate is correct, the deletion request signature verification unit 36c verifies the signature of the information deletion request (signature of S603) using the service AP public key. (S606). Further, when it is determined that the signature is correct, the deletion target VPN search means 36d searches for a deletion target VPN (S607). Subsequently, the usability determining unit 36e determines whether the VPN key is usable (S608). Then, if it is determined that it cannot be used, the group The information updating unit 36f deletes the user information from the group information database (S609). Further, the judgment notification information signing means 36g signs the judgment notification information using the service provider private key (S610). Then, the signed decision notification information is transmitted to the user terminal 5a by the transmission / reception means 36a (S611), and the VPN key is invalidated for the other user terminals 5b belonging to the VPN to be deleted. Notify the member who has become (S613).

In the user terminal 5a, when the judgment notification information is received by the transmission / reception means 56a, the judgment notification information signature verification means 56e uses the service provider public key to sign the judgment notification information (signature of S610). Is verified (S612). Thereafter, by analyzing the judgment notification information, it is possible to know that the user information has been deleted from the group information database of the VPN service providing center 3.

By performing the VPN key generation processing or the VPN key sharing processing a plurality of times, a plurality of different VPN keys can be stored in the e-ey chips 6a to 6f. According to the embodiment described above, the VPN service providing center operates because the VPN connection is established using the VPN keys stored in the e-Key chips 6a to 6f. Without this, a VPN connection can be established between user terminals belonging to the same VPN. Also, the load on user terminals during VPN connection is reduced (there is no need to request an encryption key from the center every time a VPN connection is made), so it is possible to handle VPN connections of many user terminals.

In addition, a network infrastructure that provides various services that require a secure information service mechanism (such as membership services, content distribution, and remote maintenance of information devices) can be built. In addition, since users and the like are managed by the VPN service providing center, for example, a service for charging the user and the like can be realized.

Note that the procedure executed by each means constituting each device described in the device registration process, VPN service download process, VPN key generation process, VPN key sharing process, VPN construction process, and VPN invalidation process is described in the form of a program. The program is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read and executed by a computer so that each device of the present invention is realized. May be. Then, each of the above-described processes may be executed using each of the devices realized as described above. Here, the computer-readable recording medium refers to a magnetic disk, a magneto-optical disk, a CD_ROM, a DVD-ROM, a semiconductor memory, or the like. Further, the computer program may be distributed to a computer via a communication line, and the computer that has received the distribution may execute the program.

As described above, the preferred embodiments of the present invention have been described. However, the present invention is not limited to the above-described embodiments, and various design changes can be made within the scope of the claims. ing. Industrial potential

Advantageous Effects of Invention According to the present invention, it is possible to communicate with other clients belonging to the same VPN irrespective of the presence or absence of operation of a VPN server, and to reduce the workload of installing and setting software on the VPN server and clients. be able to.

Claims

The scope of the claims

1. A VPN communication system including a communication terminal equipped with a secure chip, and a chip management center for managing the secure chip,

The communication terminal,

A registration information signing unit for signing registration information including chip information of the secure chip and a public key of the secure chip using a secret key of the secure chip; and using a public key of a chip manager of the chip management center. Registration information encryption means for encrypting the registration information signed by the registration information signing means into encrypted registration information;

Encryption registration information transmitting means for transmitting the encrypted registration information obtained by encryption by the registration information encryption means to the chip management center;

Chip public key certificate receiving means for receiving a chip public key certificate from the chip management center,

Chip public key certificate confirmation means for confirming the validity of the chip public key certificate received by the chip public key certificate reception means,

Chip public key certificate storage means for storing the chip public key certificate in the secure chip,

With

The chip management center comprises:

Using an encryption registration information receiving means for receiving the encryption registration information from the communication terminal; and a secret key of a chip manager of the chip management center, the cipher received by the encryption registration information receiving means. Registration information decoding means for decoding the encrypted registration information into the registration information with the signature,

A registration information signature verification unit that verifies a signature of the registration information obtained by decryption by the registration information decryption unit using a public key of the secure chip included in the registration information;

Chip public key certificate creation means for creating a chip public key certificate including a public key of the secure chip to be transmitted to the communication terminal; Registration information registration means for registering the registration information obtained by decoding by the registration information decoding means in a chip database,

A chip public key certificate transmitting unit that transmits the chip public key certificate created by the chip public key certificate creating unit to the communication terminal,

A VPN communication system comprising:

2. A VPN communication system comprising: a communication terminal equipped with a secure chip; and a VPN service providing center for providing application software for a VPN service to the communication terminal,

The communication terminal is

Service providing request signing means for signing a service providing request for requesting the VPN service providing center to provide the VPN service application software using the secret key of the secure chip;

A service providing request for transmitting a service providing request signed by the service providing request signing means and a chip public key certificate including a public key of the secure chip stored in the secure chip to the VPN service providing center. Means and

Service receiving means for receiving the VPN service application software from the VPN service providing center;

Service installation means for installing the VPN service application software received by the service receiving means on the secure chip;

With

The VPN service providing center includes:

Service providing request receiving means for receiving the signed service providing request and the chip public key certificate from the communication terminal;

Chip public key certificate verification means for verifying the chip public key certificate received by the service provision request reception means,

The chip public key certificate received by the service provision request receiving means; Service providing request signature verifying means for verifying a signature of a service providing request received by the service providing request receiving means using a public key of the included secure chip;

Service transfer means for transferring the VPN service application software to the communication terminal;

A VPN communication system comprising:

3. A VPN communication system that includes a communication terminal equipped with a secure chip and a service providing center that generates a communication encryption key for performing communication between the communication terminals belonging to the same VPN and distributes the communication encryption key to the communication terminal. So,

The communication terminal,

An encryption key generation request signing means for signing an encryption key generation request for requesting the service providing center to generate a communication encryption key, using a secret key of the VPN service application stored in the secure chip;

An encryption key generation request encryption for encrypting the encryption key generation request signed by the encryption key generation request signing means into an encryption encryption key generation request using a public key of a service provider managing the service providing center. Means,

A request for generating an encryption key obtained by encryption by the encryption key generation request encryption means and a public key certificate of the VPN service application stored in the secure chip are transmitted to the service providing center. Means for transmitting an encryption key generation request

Generating encryption key information receiving means for receiving a signed encryption key information from the service providing center,

A generated encryption key information signature verification unit that verifies a signature of the encrypted generated encryption key information received by the generated encryption key information reception unit, using a public key of the service provider;

Generating encryption key information decrypting means for decrypting the encryption generated encryption key information into a generated encryption key information including a communication encryption key and an identifier of the communication encryption key using a secret key of the VPN service application; Generating encryption key information installing means for installing the generated encryption key information obtained by decryption by the generated encryption key information decrypting means on the secure chip,

The service providing center comprises:

Encryption key generation request receiving means for receiving the encryption key generation request from the communication terminal and the public key certificate of the VPN service application;

A service public key certificate verifying unit for verifying a public key certificate of the VPN service application received by the encryption key generation request receiving unit; and a cryptographic key generation using a private key of the service provider. Encryption key generation request decryption means for decrypting the encrypted encryption key generation request received by the request reception means into the encryption key generation request with the signature;

A generation request signature verification unit that verifies a signature of the encryption key generation request obtained by the decryption by the 喑 key generation request decryption unit, using a public key of the VPN service application;

A communication encryption key generation means for generating a communication encryption key to be distributed to the communication terminal; a group information database storing the communication encryption key generated by the communication encryption key generation means and an identifier of the communication encryption key; Means for storing group information to be registered in

Using the public key of the VPN service application, encrypts generated encryption key information including the communication encryption key generated by the communication encryption key generation unit and an identifier of the communication encryption key. Generating encryption key information encryption means for encrypting information;

Generating encryption key information signing means for signing the generated encryption key information obtained by encryption by the generated encryption key encryption means, using a secret key of the service provider;

Generating encryption key information transmitting means for transmitting the encrypted generated encryption key information signed by the generated encryption key information signing means to the communication terminal;

A VPN communication system comprising:

4. A VPN communication system that includes a communication terminal equipped with a secure chip and a service providing center that manages a communication encryption key for performing communication between the communication terminals belonging to the same VPN and distributes the communication key to the communication terminal. And

The communication terminal,

An encryption key sharing request signing means for signing an encryption key sharing request for requesting the service providing center to share a communication encryption key, using a secret key of the VPN service application stored in the secure chip;

An encryption key sharing request encryption for encrypting the encryption key sharing request signed by the encryption key sharing request signing means into an encryption encryption key sharing request using a public key of a service provider managing the service providing center. Means,

A request for encryption key sharing obtained by encryption by the encryption key sharing request encryption means and a public key certificate of a VPN service application stored in the secure chip are transmitted to the service providing center. Means for transmitting an encryption key sharing request

Shared encryption key information receiving means for receiving the encrypted shared encryption key information with a signature from the service providing center,

A shared encryption key information signature verification unit that verifies a signature of the encrypted shared encryption key information received by the shared encryption key information reception unit, using a public key of the service provider;

A shared encryption key information decrypting unit for decrypting the encrypted shared encryption key information into shared encryption key information including a communication encryption key and an identifier of the communication encryption key using a secret key of the VPN service application;

A shared encryption key information installation means for installing shared encryption key information obtained by decryption by the shared encryption key information decryption means in the secure chip,

The service providing center comprises:

An encryption key sharing request receiving unit that receives the encryption key sharing request from the communication terminal and the public key certificate of the VPN service application;

The VPN service application received by the encryption key sharing request receiving means A service public key certificate verification unit for verifying a public key certificate of the application, and using the public key of the service provider, the encryption key sharing request received by the encryption key sharing request receiving unit. Encryption key sharing request decryption means for decrypting the signed encryption key sharing request;

Sharing request signature verification means for verifying the signature of the encryption key sharing request obtained by decryption by the encryption key sharing request decryption means, using the service provider's secret key;

A communication encryption key search means for searching for a communication encryption key to be distributed to the communication terminal; a group information addition registration means for additionally registering user information of the user terminal in a group information database;

Using the public key of the VPN service application, the shared encryption key information including the communication encryption key searched by the communication encryption key search means and the identifier of the communication encryption key is encrypted. A shared encryption key information encryption means for encrypting information;

A shared encryption key information signing means for signing the encrypted shared encryption key information obtained by encryption by the shared encryption key encryption means, using a secret key of the service provider;

A shared encryption key information transmitting unit that transmits the encrypted shared encryption key information signed by the shared encryption key information signature unit to the communication terminal;

A VPN communication system comprising:

5. In a VPN communication system including a communication terminal equipped with a secure chip, the communication terminal performs encrypted communication with another communication terminal belonging to the same VPN using a communication encryption key stored in the secure chip. and performing a VPN communication system _n