Method and system for managing shared information

• US 7,734,757 B2
• Filed: 12/13/2007
• Issued: 06/08/2010
• Est. Priority Date: 12/19/2006
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Tajima, Akio, Tanaka, Akihiro, Maeda, Wakako, Takahashi, Seigo
• Primary Examiner(s): SALAD, ABDULLAHI ELMI
• Application Number:
  US12/000,471
• Publication Number:
  US 20080147820A1
• Time in Patent Office: 908 Days
• Field of Search: 709/223, 709/229, 713/171, 713/182, 726/18, 380/277
• US Class Current: 709/223
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 9/0858 Details about key distillation or coding, e.g. reconciliation, error correction, privacy amplification, polarisation coding or phase coding

Abstract

A method and system for allowing communication devices to synchronously manage shared information are provided. A sender sends single-photon pulses modulated with original random numbers to a receiver and also sends frame pulses by using ordinary optical pulses. Bit comparison and basis reconciliation are performed by the frame which is defined by the frame pulses, whereby sifted keys, which are aggregated as a file, are generated by the sender and the receiver individually. The sifted keys are subjected to error correction, privacy amplification, and file sharing processing by the file, whereby common cryptographic keys are synchronously stored in the sender and the receiver individually. The generated cryptographic keys are managed as encryption keys and decryption keys separately. A newly generated key is preferentially placed in the encryption keys or decryption keys that have a smaller stored amount.

Claims

1. A method for managing shared information which is generated between first and second communication devices in a communication system, comprising:

generating the shared information at each of the first and second communication devices;

transmitting identifying information from the first communication device to the second communication device, wherein the identifying information identifies a piece of the shared information generated in the first communication device;

making an association between same pieces of the shared information generated at respective ones of the first and second communication devices based on the identifying information; and

storing associated pieces of the shared information at respective ones of the first and second communication devices,

wherein the shared information is generated at each of the first and second communication devices by;

transmitting original information in first data processing units from one of the first and second communication devices to the other communication device by using a low power channel and a normal power channel that defines beginning and ending points of separate frames of the original information being transmitted; and

generating the shared information in second data processing units at each of the first and second communication devices based on information which was received in the first data processing units by the other communication device by using a normal power channel, wherein the shared information in the second data processing units is stored in a first storage section,

wherein the associated pieces of the shared information at respective ones of the first and second communication devices are stored in a second storage section.

2. The method according to claim 1, further comprising:

when a communication is performed between the first and second communication devices, consuming at least one associated piece of the shared information stored at each of the first and second communication devices.

3. The method according to claim 2, further comprising:

managing a stored amount of the shared information based on generated amount and consumed amount of the shared information at each of the first and second communication devices.

4. The method according to claim 1, wherein when the communication system starts up, one of the first and second communication devices determines whether a piece of the shared information is associated with that of the other communication device.

5. The method according to claim 1, wherein when the communication system is shut down, the shared information stored in each of the first and second communication devices is entirely deleted.

6. The method according to claim 1, wherein one of the first and second communication devices notifies the other that an associated piece of the shared information is used as a selected one of an encryption key and a decryption key, whereby the piece of the shared information is used as the encryption key at the one and as the decryption key at the other.

7. The method according to claim 6, wherein an encryption key and a decryption key are separately managed at each of the first and second communication devices.

8. The method according to claim 7, wherein at each of the first and second communication devices,

monitoring stored amounts of respective ones of the encryption key and the decryption key;

and

providing a newly generated piece of the shared information preferentially in which one of the encryption and decryption keys has a smaller stored amount.

9. The method according to claim 8, wherein at each of the first and second communication devices, the piece of the shared information once used as the encryption key or the decryption key is never used again.

10. The method according to claim 1, wherein one of the first and second communication devices notifies the other that an associated piece of the shared information is used as a selected one of an encryption key and a decryption key, whereby the piece of the shared information is used as the encryption key at the one and as the decryption key at the other.

11. The method according to claim 10, wherein an encryption key and a decryption key are separately managed at each of the first and second communication devices.

12. The method according to claim 11, wherein at each of the first and second communication devices,

monitoring stored amounts of respective ones of the encryption key and the decryption key;

and

providing a newly generated piece of the shared information preferentially in which one of the encryption and decryption keys has a smaller stored amount.

13. The method according to claim 12, wherein at each of the first and second communication devices, the shared information is used in the second data processing units for one-time pad encryption.

14. A system for managing shared information which is shared between communication devices in a communication system, wherein each of the communication devices comprises:

a shared information generator for generating the shared information;

a memory for storing the shared information;

a manager for communicating identifying information with another communication device to make an association with same piece of the shared information generated in the other communication device, wherein the identifying information identifies said piece of the shared information; and

a storage section for storing associated pieces of the shared information,

wherein the shared information is generated at each of the communication devices by;

original information being transmitted in first data processing units from one of the communication devices to the other communication device by using a low power channel and a normal power channel that defines beginning and ending points of separate frames of the original information being transmitted; and

the shared information being generated in second data processing units at each of the communication devices based on information which was received in the first data processing units by the other communication device by using a normal power channel, wherein the shared information in the second data processing units is stored in the storage section of the other communication device,

wherein the associated pieces of the shared information at respective ones of the communication devices are stored in the respective storage sections of the communication devices.

15. The system according to claim 14, wherein when communicating with the other communication device, the manager consumes at least one associated piece of the shared information stored in the storage section.

16. The system according to claim 15, wherein the manager manages a stored amount of the shared information based on generated amount and consumed amount of the shared information stored in the storage section.

17. The system according to claim 14, wherein one of the communication devices notifies the other that an associated piece of the shared information is used as a selected one of an encryption key and a decryption key, whereby the piece of the shared information is used as the encryption key at the one and as the decryption key at the other.

18. The system according to claim 17, wherein an encryption key and a decryption key are separately managed at each of the communication devices.

19. The system according to claim 18, wherein the manager monitors stored amounts of respective ones of the encryption key and the decryption key, and provides a newly generated piece of the shared information preferentially in which one of the encryption and decryption keys has a smaller stored amount.

20. The system according to claim 19, wherein the manager never uses again the piece of the shared information once used as the encryption key or the decryption key.

21. A communication device for managing shared information which is shared with another communication device, comprising:

a shared information generator for generating the shared information;

a memory for storing the shared information;

a manager for communicating identifying information with another communication device to make an association with same piece of the shared information generated in the other communication device, wherein the identifying information identifies said piece of the shared information, the identifying information indicating which bits of a plurality of bits of the shared information were successfully received over a low power channel; and

a storage section for storing associated pieces of the shared information, the associated pieces of the shared information including bit levels of a plurality of bits of the shared information that were not successfully received over the low power channel and that are sent over a normal power channel.

22. A computer readable medium storing a program for instructing a computer to manage shared information which is shared with another communication device, comprising:

storing the shared information in a memory;

communicating identifying information with another communication device through a communication section to make an association with same piece of the shared information generated in the other communication device, wherein the identifying information identifies said piece of the shared information, the identifying information indicating which bits of a plurality of bits of the shared information were successfully received over a low power channel; and

storing associated pieces of the shared information in a storage section, the associated pieces of the shared information including bit levels of a plurality of bits of the shared information that were not successfully received over the low power channel and that are sent over a normal power channel.

23. A communication system for secret communication between first and second communication devices, wherein

the first communication device comprises:

a first generator for generating secret information to be shared with the second communication device;

a first memory for storing the secret information;

a first manager for transmitting identifying information to the second communication device to make an association with same piece of the secret information generated in the second communication device, wherein the identifying information identifies said piece of the secret information; and

a first storage section for storing associated pieces of the secret information, and

the second communication device comprises;

a second generator for generating the secret information to be shared with the second communication device;

a second memory for storing the secret information;

a second manager for using the identifying information received from the first communication device to make an association with the same piece of the secret information generated in the first communication device, the identifying information indicating which bits of a plurality of bits of the shared information were successfully received over a low power channel; and

a second storage section for storing associated pieces of the secret information, the associated pieces of the secret information including bit levels of a plurality of bits of the shared information that were not successfully received over the low power channel and that are sent over a normal power channel.