Terminal device, group management server, network communication system, and method for generating encryption key

• US 7,978,858 B2
• Filed: 03/31/2008
• Issued: 07/12/2011
• Est. Priority Date: 06/26/2007
• Status: Expired due to Fees

• Current Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Original Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Inventors: Suzuki, Akira, Ogishima, Shinji, Osajima, Ikuko, Ikeda, Nobuyuki
• Primary Examiner(s): JUNG, DAVID YIUK
• Application Number:
  US12/059,183
• Publication Number:
  US 20090060189A1
• Time in Patent Office: 1,198 Days
• Field of Search: 380/277, 380/278, 380/279, 713/162
• US Class Current: 380/277
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A network communication system has terminal devices belonging to a group, the terminal devices generating, if there is a leaving terminal device leaving from the group, an updated group encryption key corresponding to a new group encryption key, from a deletion key corresponding to the leaving terminal device and a group encryption key, and, after the leaving terminal device leaves the group, communicating by using the updated group encryption key; and a group management server generating the updated group encryption key corresponding to the new group encryption key from the deletion key corresponding to the leaving terminal device and the group encryption key, and, after the leaving terminal device leaves the group, communicating by using the updated group encryption key.

Claims

1. A terminal device capable of transmitting and receiving information encrypted with other terminal devices that belong to one group, comprising:

a key storage unit storing a group encryption key and deletion keys, the group encryption key for encrypting and decrypting information transmitted and received with other terminal devices that belong to the group, and the deletion keys corresponding to each of the other terminal devices; and

an update unit generating, if there is a leaving terminal device among the other terminal devices that belong to the group, an updated group encryption key corresponding to a new group encryption key, from the deletion key corresponding to the leaving terminal device and the group encryption key stored in the key storage unit.

2. The terminal device according to claim 1, wherein:

the update unit generates a first value from the existing group encryption key by using a predetermined function, generates a second value from the deletion key corresponding to the leaving terminal device by using a predetermined function, and generates the updated group encryption key from the first value and the second value by using a predetermined function.

3. A group management server capable of transmitting a group encryption key and deletion keys to terminal devices, the group encryption key for use in encryption of a communication with other terminal devices that belong to the group, and the deletion keys corresponding to the terminal devices that belong to the group, the server comprising:

a key storage unit storing the deletion keys corresponding to the terminal devices that belong to the group, and the group encryption key; and

an update unit generating, if a terminal device leaves the group, an updated group encryption key corresponding to a new group encryption key, from the deletion key corresponding to the leaving terminal device and the group encryption key stored in the key storage unit.

4. The server according to claim 3, wherein:

the update unit generates a first value from the existing group encryption key by using a predetermined function, generates a second value from the deletion key corresponding to the leaving terminal device by using a predetermined function, and generates the updated group encryption key from the first value and the second value by using a predetermined function.

5. The server according to claim 4, wherein:

the server further has a transmission unit transmitting to the terminal devices a new group encryption key generated upon subscription of a new terminal device to the group and a deletion key for the new terminal device, and

the transmission unit does not transmit the updated group encryption key to any of the terminal devices.

6. The server according to claim 5, further comprising:

a first generation unit generating a new group encryption key when a new terminal device is subscribed to the group; and

a second generation unit generating a deletion key corresponding to that terminal device when a new terminal device is subscribed to the group.

7. A network communication system comprising:

terminal devices belonging to a group, the terminal devices generating, if there is a leaving terminal device leaving from the group, an updated group encryption key corresponding to a new group encryption key, from a deletion key corresponding to the leaving terminal device and a group encryption key, and, after the leaving terminal device leaves the group, communicating by using the updated group encryption key; and

a group management server generating the updated group encryption key corresponding to the new group encryption key from the deletion key corresponding to the leaving terminal device and the group encryption key, and, after the leaving terminal device leaves the group, communicating by using the updated group encryption key.

8. The network communication system according to claim 7, wherein:

each of the terminal devices and the group management server generate a first value from the existing group encryption key by using a predetermined function, generates a second value from a deletion key corresponding to the leaving terminal device by using a predetermined function, and generate a updated group encryption key corresponding to a new group encryption key from the first value and the second value by using a predetermined function.

9. A method for generating an encryption key in a group including a plurality of terminal devices where a communication is encrypted with a group encryption key with other terminal devices within the group, and if there is a leaving terminal device that leaves the group, an updated group encryption key corresponding to a new group encryption key is generated, the method comprising the steps of:

generating a first value from the existing group encryption key by using a predetermined function;

generating a second value from the deletion key corresponding to the leaving terminal device by using a predetermined function; and

generating the updated group encryption key corresponding to a new group encryption key, from the first value and the second value by using a predetermined function.