Communication terminal using a temporary network key for assembling a secure communication frame

• US 20110188654A1
• Filed: 01/31/2011
• Published: 08/04/2011
• Est. Priority Date: 02/01/2010
• Status: Active Grant

• Current Assignee: OKI Electric Industry Company Limited
• Original Assignee: OKI Electric Industry Company Limited
• Inventors: Nakashima, Jun, Fukui, Kiyoshi, Yao, Taketsugu
• Granted Patent: US 9,059,839 B2
• Time in Patent Office: Days
• US Class Current: 380/255
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04W 12/041 Key generation or derivation

Abstract

A communication terminal generates a temporary network key based on a managed master network key and on key identification used for security processing on a communication frame. The security processing is performed on the communication frame using the temporary network key. A secure communication frame is produced in which the identification of the key is indicated.

Claims

1. A communication terminal comprising:

a receiver for receiving a communication frame from another communication terminal over a telecommunications network;

a long-time key acquirer for obtaining a master network key and a key identification of the master network key from the communication frame;

a long-time key manager for managing the master network key;

a key identification manager for managing the key identification;

a short-time key acquirer for using the master network key and the key identification to generate a temporary network key;

a communication frame assembler for using the temporary network key to perform security processing on the communication frame, and inserting the key identification into the communication frame to assemble a secure communication frame; and

a transmitter for sending the secure communication frame to another communication device.

2. The communication terminal in accordance with claim 1, further comprising a long-time key updater for updating the master network key managed by said long-time key manager to a master network key that has been obtained by receiving the master network key over the network.

3. The communication terminal in accordance with claim 1, wherein the key identification managed by said key identification manager is updated at arbitrary timing.

4. A communication terminal comprising:

a long-time key manager for managing a master network key;

a receiver for receiving a secure communication frame from another communication terminal over a telecommunications network;

a key identification acquirer for obtaining a key identification from the secure communication frame;

a short-time key acquirer for using the key identification and the master network key to generate a temporary network key; and

a communication frame acquirer for using the temporary network key to perform security processing on the secure communication frame to obtain a communication frame.

5. The communication terminal in accordance with claim 4, further comprising a long-time key updater for updating the master network key managed by said long-time key manager to a master network key that has been obtained by receiving the master network key over the network.

6. The communication terminal in accordance with claim 4, wherein the key identification managed by said key identification manager is updated at arbitrary timing.

7. A communication terminal comprising:

a long-time key manager for managing a master network key;

a key identification manager for managing a key identification of keys;

a short-time key acquirer for using the master network key and the key identification to generate a temporary network key;

a communication frame assembler for using the temporary network key to perform security processing, and inserting the key identification to assembling a secure communication frame;

a transmitter for sending the secure communication frame to another communication terminal;

a receiver for receiving the secure communication frame from the other communication terminal over a telecommunications network;

a key identification acquirer for obtaining a key identification from the secure communication frame; and

a communication frame acquirer for using the temporary network key to perform security processing on the received secure communication frame to obtain a communication frame.

8. The communication terminal in accordance with claim 7, further comprising a long-time key updater for updating the master network key managed by said long-time key manager to a master network key that has been obtained by receiving the master network key over the network.

9. The communication terminal in accordance with claim 7, wherein the key identification managed by said key identification manager is updated at arbitrary timing.

10. The communication terminal in accordance with claim 7, wherein when the key identification inserted in the secure communication frame received by said key identification acquirer is newer than the key identification managed by said key identification manager, said key identification manager manages the key identification inserted in the communication frame received this time as a newest key identification.

11. The communication terminal in accordance with claim 10, wherein said key identification includes information on a count value indicating a serial number of the temporary network key,

said key identification manager making a decision as to whether or not the key identification is newest according to a magnitude indicated by the information on the count value.

12. The communication terminal in accordance with claim 10, wherein the key identification includes information indicating a serial number of the master network key and information on a count value indicating a serial number of the temporary network key,

said key identification manager making a decision as to whether or not the key identification is newest according to a magnitude indicated by the information on the count value indicating the serial number of the temporary network key as long as the information indicating the serial number of the master network key remains a same.

13. The communication terminal in accordance with claim 7, further comprising a key identification acquirer for asking another communication terminal for the key identification managed by the other communication terminal, or for sending back the key identification managed by said key identification manager of the subject terminal in response to a request from the other communication terminal,

said key identification manager using the key identification obtained by said key identification acquirer to manage or update the key identification of its own.

14. The communication terminal in accordance with claim 13, wherein said key identification manager manages or updates a key identification determined to be newer than the key identification obtained by said key identification acquirer as its own key identification.

15. A secure communication system for encrypting and authenticating a communication frame by utilizing a key shared across a telecommunications network, said secure communication system comprising a plurality of communication terminals, each of said plurality of communication terminals comprising:

a receiver for receiving a communication frame from another of the plurality of communication terminals over the telecommunications network;

a long-time key acquirer for obtaining a master network key and a key identification of the master network key from the communication frame;

a long-time key manager for managing the master network key;

a key identification manager for managing the key identification;

a short-time key acquirer for using the master network key and the key identification to generate a temporary network key;

a communication frame assembler for using the temporary network key to perform security processing on the communication frame, and inserting the key identification into the communication frame to assemble a secure communication frame; and

a transmitter for sending the secure communication frame to another communication device.

16. A secure communication system for encrypting and authenticating a communication frame by utilizing a key shared across a telecommunications network, said secure communication system comprising a plurality of communication terminals, each of said plurality of communication terminals comprising:

a long-time key manager for managing a master network key;

a receiver for receiving a secure communication frame from another of the plurality of communication terminals over the telecommunications network;

a key identification acquirer for obtaining a key identification from the secure communication frame;

a short-time key acquirer for using the key identification and the master network key to generate a temporary network key; and

a communication frame acquirer for using the temporary network key to perform security processing on the secure communication frame to obtain a communication frame.

17. A secure communication system for encrypting and authenticating a communication frame by utilizing a key shared across a telecommunications network, said secure communication system comprising a plurality of communication terminals, each of said plurality of communication terminals comprising:

a long-time key manager for managing a master network key;

a key identification manager for managing a key identification of keys;

a short-time key acquirer for using the master network key and the key identification to generate a temporary network key;

a communication frame assembler for using the temporary network key to perform security processing, and inserting the key identification to assembling a secure communication frame;

a transmitter for sending the secure communication frame to another of the plurality of communication terminals;

a receiver for receiving the secure communication frame from the other communication terminal over the telecommunications network;

a key identification acquirer for obtaining a key identification from the secure communication frame; and

a communication frame acquirer for using the temporary network key to perform security processing on the received secure communication frame to obtain a communication frame.