JP2013042330A - Unidirectional communication system, method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a unidirectional communication system, method, and program capable of verifying the validity of the other communication party in unidirectional communication.SOLUTION: A server 10 and a terminal 20 pre-share a terminal ID. The server 10 includes: a hash calculation part 112 for calculating a first hash value on the basis of a data string including the terminal ID; a scramble calculation part 113 for calculating a scramble value on the basis of the exclusive OR of a first message and the first hash value; and a transmission part 114 for transmitting a packet where specific data that is obtained by removing the terminal ID from the data string is connected to the scramble value to the terminal 20. The terminal 20 includes: a separation part 211 for separating the specific data and the scramble value from the packet; a hash calculation part 212 for calculating a second hash value on the basis of the data string including the specific data and the terminal ID; and a message acquisition part 213 for acquiring a second message on the basis of the exclusive OR of the scramble value and the second hash value.

Description

  The present invention relates to a one-way communication system, method, and program for transmitting a message from a server to a terminal.

  Conventionally, mutual authentication is often performed between a server that transmits data and a terminal that receives data in order to ensure the reliability of data communication. In other words, a server that sends a message to a terminal authenticates that the destination is a specific terminal and then sends a message, and a terminal that receives the message authenticates that the source is a specific server. And then receive a message.

  For this mutual authentication, various methods have been proposed according to the communication device and communication type (see, for example, Patent Documents 1, 2, and 3).

JP-A-11-306296 JP-A-8-130536 No. 2008/044298

  By the way, between a server that transmits a message and a terminal that receives the message, in order to suppress load concentration on the server, one-way communication that does not have an uplink from the terminal to the server may be used. The one-way communication is used in push-type services such as broadcast (broadcast), multicast, C2DM (Cloud to Device Messaging), SMS (Short Message Service), and the like.

  In this one-way communication, the server designates a terminal that is a transmission destination and transmits a message, but the transmission destination terminal is registered in advance and transmits a message according to the registration information. Therefore, even if there is no trust relationship between the server and the terminal, if the terminal is already registered in the server, messages can be transmitted and received. Then, for example, personal information may be collected from the flowing packets, or a large amount of copies of the obtained packets may be sent, resulting in a man-in-the-middle attack.

  In addition, when the above-described mutual authentication is used, an uplink from the terminal to the server is required at the time of authentication, so that it is difficult to apply to one-way communication.

  An object of the present invention is to provide a one-way communication system, method, and program capable of verifying the validity of a communication partner in one-way communication.

  The present invention provides the following solutions.

  (1) A one-way communication system having a server for transmitting a message and a terminal for receiving the message, wherein the server and the terminal share the identification data of the terminal in advance, A scramble by a server-side hash calculator that calculates a first hash value by a one-way hash function from a data string including at least the identification data, and an exclusive OR of the first message and the first hash value A scramble calculation unit that calculates a value; and a transmission unit that transmits to the terminal a packet in which unique data obtained by removing the identification data from the data string and data based on the scramble value are concatenated to the terminal. A separation unit that separates the unique data and the data based on the scramble value from the packet; and the separation Obtained from the data string composed of the unique data and the identification data obtained by the terminal-side hash computation unit that computes a second hash value by the one-way hash function, and the data separated by the separation unit A message acquisition unit that acquires a second message based on an exclusive OR of the scrambled value obtained and the second hash value obtained by the terminal-side hash calculation unit.

  According to such a configuration, in the one-way communication system, the first message is the first message only in the legitimate terminal where the first hash value and the second hash value are equal, that is, the identification data shared in advance is equal. A second message equal to is restored and not restored at the unauthorized terminal. Therefore, the server can verify the legitimacy of the terminal that is the communication partner and transmit the message while guaranteeing the reliability of the terminal, while performing the one-way communication.

  (2) The one-way communication system according to (1), wherein the unique data is data including a random number.

  According to such a configuration, in the one-way communication system, since the server scrambles the message including the random number in the unique data, the confidentiality of the message can be improved.

  (3) The one-way communication system according to (1) or (2), wherein the unique data includes a message management code in the terminal.

  According to such a configuration, in the one-way communication system, the server includes the management code of the message in the terminal, for example, the counter value or time information, in the unique data. Therefore, the terminal uses this management code as a replay attack prevention code, confirms the validity of the received message, eliminates illegal messages, and further reduces the amount of stored messages to reduce the management load. Can be reduced.

  (4) The server-side hash calculation unit calculates a third hash value from the value obtained by concatenating the unique data and the first message using the one-way hash function, and the transmission unit includes the unique data. , Transmitting the packet based on the scramble value and the third hash value concatenated to the terminal, and the separation unit transmits, from the packet, the specific data, the data based on the scramble value, and the third The hash value is separated, and the terminal-side hash calculation unit uses the one-way hash function to calculate a fourth value from the unique data obtained by the separation unit and the second message obtained by the message acquisition unit. By calculating a hash value, the terminal determines whether or not the third hash value and the fourth hash value match. One-way communication system according to any one of comprising a verification unit (1) (3) that the second message and verifies whether matches the first message.

  According to such a configuration, in the one-way communication system, if the third hash value and the fourth hash value match, it is guaranteed that the first message and the second message are the same. The message is restored correctly on the terminal. That is, the second message is restored only at legitimate terminals with the same identification data, and it is further guaranteed that the restored message is the same as the first message. On the other hand, at least the same message is not restored in an unauthorized terminal. Therefore, the server can verify the legitimacy of the terminal that is the communication partner and can transmit a correct message while guaranteeing the reliability of the terminal, while performing the one-way communication.

  (5) The server and the terminal share a secret key in advance, and the server includes an encryption unit that encrypts the scramble value using the secret key and obtains an encrypted message, The transmission unit transmits the unique data and the packet concatenated with the encrypted message to the terminal, the separation unit separates the unique data and the encrypted message from the packet, and the terminal The one-way communication system according to any one of (1) to (4), further comprising a decryption unit that decrypts the encrypted message using the secret key and obtains the scramble value.

  According to such a configuration, in the one-way communication system, since the server further encrypts and transmits the scramble value, the confidentiality of the message can be improved.

  (6) The encryption unit obtains the encrypted message by exclusive OR with a value of the keyed hash function using the secret key, and the decryption unit acquires the value of the keyed hash function. The one-way communication system according to (5), wherein the scramble value is acquired by performing an exclusive OR with:

  According to such a configuration, since the one-way communication system performs encryption and decryption using a keyed hash function, it can be easily realized by the same processing as the message scrambling, and the processing load is reduced. Is done.

  (7) A communication method in a one-way communication system including a server that transmits a message and a terminal that receives the message, wherein the server and the terminal share the identification data of the terminal in advance, A server-side hash calculation step in which a server calculates a first hash value from a data string including at least the identification data by a one-way hash function; an exclusive OR of the first message and the first hash value; The scramble calculation step for calculating a scramble value, and the transmission step for transmitting to the terminal a packet concatenating the unique data excluding the identification data from the data string and the data based on the scramble value are performed. The terminal determines from the packet based on the unique data and the scramble value. A separation step of separating data, and a terminal-side hash calculation step of calculating a second hash value by the one-way hash function from the data string including the unique data and the identification data obtained in the separation step; Message acquisition for acquiring a second message by exclusive OR of the scramble value obtained from the data separated in the separation step and the second hash value obtained in the terminal-side hash calculation step And a communication method for executing the step.

  According to such a configuration, the same effect as in (1) can be expected when the one-way communication system executes the communication method.

  (8) A communication program executed by a one-way communication system having a server that transmits a message and a terminal that receives the message, wherein the server and the terminal share the identification data of the terminal in advance. And a server-side hash calculation step of calculating a first hash value by a one-way hash function from a data string including at least the identification data to the server, exclusive of the first message and the first hash value A scramble calculation step of calculating a scramble value by logical sum, and a transmission step of transmitting to the terminal a packet concatenating the unique data excluding the identification data from the data string and the data based on the scramble value. Causing the terminal to execute the unique data and the scramble from the packet. A separation step of separating data based on values, and a terminal-side hash that calculates a second hash value by the one-way hash function from the data string composed of the unique data and the identification data obtained in the separation step A second message is obtained by an exclusive OR of the calculation step, the scramble value obtained from the data separated in the separation step, and the second hash value obtained in the terminal-side hash calculation step. And a message acquisition step to execute the communication program.

  According to such a configuration, the same effect as in (1) can be expected by causing the communication program to be executed by the one-way communication system.

  According to the present invention, the validity of a communication partner is verified in one-way communication.

It is a block diagram which shows the function structure of the one-way communication system which concerns on 1st Embodiment. It is a sequence diagram which shows the process which transmits the message which concerns on 1st Embodiment. It is a block diagram which shows the function structure of the one-way communication system which concerns on 2nd Embodiment. It is a sequence diagram which shows the process which transmits the message which concerns on 2nd Embodiment. It is a block diagram which shows the function structure of the one-way communication system which concerns on 3rd Embodiment. It is a sequence diagram which shows the process which transmits the message which concerns on 3rd Embodiment. It is a block diagram which shows the function structure of the one-way communication system which concerns on 4th Embodiment. It is a sequence diagram which shows the process which transmits the message which concerns on 4th Embodiment.

<First Embodiment>
The first embodiment of the present invention will be described below.
The one-way communication system 1 according to the present embodiment includes a server 10 and a terminal 20 and transmits a message from the server 10 to the terminal 20 in one direction.

  FIG. 1 is a block diagram illustrating functional configurations of a server 10 and a terminal 20 included in the one-way communication system 1 according to the present embodiment.

  The server 10 includes a control unit 11, a storage unit 12, and a communication unit 13, and further includes various hardware such as an operation unit and a display unit to operate as an information processing device (not illustrated). .

  The control part 11 is a part which controls the whole server 10, and implement | achieves the various functions in this embodiment by reading and executing the various programs memorize | stored in the memory | storage part 12 suitably. The control unit 11 may be a CPU (Central Processing Unit). In addition, the function of each part with which the control part 11 is provided is mentioned later.

  The storage unit 12 is a storage area for various programs and various data for causing the hardware group to function as the server 10, and may be a ROM, a RAM, a flash memory, or a hard disk (HDD). Specifically, the storage unit 12 stores a terminal ID 121 that is identification data of the terminal 20 in addition to a program that causes the control unit 11 to execute various functions of the present embodiment.

  The communication unit 13 is a network adapter that performs data communication with an external device using a predetermined protocol (for example, a wireless communication protocol) via a network. The communication unit 13 establishes communication with the terminal 20 and transmits packet data.

  The control unit 11 includes a unique data generation unit 111, a hash calculation unit 112 (server-side hash calculation unit), a scramble calculation unit 113, and a transmission unit 114.

  The unique data generation unit 111 generates a random number (R) having a predetermined number of digits and a management code (D) of the message (M) in the terminal 20 every time the message (M) is transmitted. The management code is a code for preventing replay attack, and is preferably either a counter value or time information, or both.

The hash calculation unit 112 is unidirectional from a data string including at least the terminal ID 121 (ID), specifically, a data string (R‖D‖ID) including a random number (R), a management code (D), and a terminal ID. The first hash value (H1 = H (R‖D‖ID)) is calculated by the sex hash function (H).
The symbol “‖” is a binary operator that concatenates preceding and following values.

The scramble calculation unit 113 calculates a scramble value (M1 + H (R‖D‖ID)) by exclusive OR of the first message (M1) and the first hash value (H (R‖D‖ID)). To do.
The symbol “+” is a binary operator that calculates an exclusive OR of the preceding and succeeding values.

  The transmission unit 114 includes a packet (P) in which the unique data (R and D) obtained by removing the terminal ID 121 (ID) from the data string (R‖D‖ID) and the scramble value (M1 + H (R‖D‖ID)) are concatenated. = R‖D‖ (M1 + H (R‖D‖ID))) is transmitted to the terminal 20 via the communication unit 13.

  The terminal 20 includes a control unit 21, a storage unit 22, and a communication unit 23. Further, although not illustrated, the terminal 20 includes various hardware such as an operation unit and a display unit in order to operate as an information processing apparatus. .

  The control unit 21 is a part that controls the entire terminal 20, and implements various functions in the present embodiment by appropriately reading and executing various programs stored in the storage unit 22. The control unit 21 may be a CPU (Central Processing Unit). In addition, the function of each part with which the control part 21 is provided is mentioned later.

  The storage unit 22 is a storage area for various programs and various data for causing the hardware group to function as the terminal 20, and may be a ROM, a RAM, a flash memory, or a hard disk (HDD). Specifically, the storage unit 22 stores a message (M) received from the server 10 in association with a corresponding management code (D) in addition to a program that causes the control unit 21 to execute various functions of the present embodiment. To do.

  In addition, the storage unit 22 stores a terminal ID 221 that is identification data of the terminal 20. Here, it is assumed that the terminal ID 221 is managed as an identification code of a predetermined hardware component in an area that cannot be known by a user operation. The terminal ID 221 is the same as the terminal ID 121 stored in the storage unit 12 of the server 10.

  The communication unit 23 is a network adapter that performs data communication with an external device using a predetermined protocol (for example, a wireless communication protocol) via a network. The communication unit 23 establishes communication with the server 10 and receives packet data.

  The control unit 21 includes a separation unit 211, a hash calculation unit 212 (terminal-side hash calculation unit), and a message acquisition unit 213.

  The separation unit 211 separates the unique data (R and D) and the scramble value (M1 + H (R‖D‖ID)) from the packet (P) received from the server 10 via the communication unit 23.

  The hash calculation unit 212 uses the unique data obtained by the separation unit 211 and the data string (R‖D‖ID) made up of the terminal ID 221 stored in the storage unit 22 to calculate the first hash function (H). 2 hash values (H2 = H (R‖D‖ID)) are calculated.

  The message acquisition unit 213 uses the scramble value (M1 + H (R‖D‖ID)) obtained from the data separated by the separation unit 211, and the second hash value (H (R‖) obtained by the hash calculation unit 212. The second message (M2 = M1 + H (R‖D‖ID) + H (R‖D‖ID) = M1) is acquired by the exclusive OR of D‖ID)).

  Here, if the first hash value is equal to the second hash value, “M2 = M1” is obtained, and the terminal 20 correctly restores the message. That is, the first message (M1) is restored only in the legitimate terminal 20 in which the terminal ID 121 and the terminal ID 221 are equal, and is not restored in the unauthorized terminal. Therefore, the server 10 can transmit a message while guaranteeing the reliability of the terminal 20 while performing one-way communication.

  Further, the control unit 21 stores the message obtained by the message acquisition unit 213 in the storage unit 22 in association with the management code (D) obtained by the separation unit 211.

At this time, when the management code (D) is a counter value, if the same counter value is already stored, the control unit 21 can exclude the obtained message as an illegal one. In addition, when the number or capacity | capacitance of a message exceeds predetermined number, it is good also as deleting sequentially from an old message.
When the management code (D) is time information indicating an expiration date, the control unit 21 may store only messages up to the expiration date in the storage unit 22 and delete the expired message. .

  FIG. 2 is a sequence diagram illustrating a process of transmitting a message from the server 10 to the terminal 20 in the one-way communication system 1 according to the present embodiment.

  First, as advance preparation, the terminal ID 221 (ID) of the terminal 20 is registered in the server 10 in step S1. The advance preparation is performed by secure communication (channel) such as local communication or offline. Thereby, the server 10 and the terminal 20 share the terminal ID 221 (ID) of the terminal 20.

  In step S11, the server 10 (unique data generation unit 111) generates a random number (R) and a management code (D).

  In step S12, the server 10 (hash calculation unit 112) calculates a first hash value (H1 = H (R‖D‖ID)).

  In step S13, the server 10 (scramble calculation unit 113) calculates a scramble value (M + H1).

  In step S <b> 14, the server 10 (transmission unit 114) transmits the packet (P = R‖D‖ (M + H1)) to the terminal 20.

  In step S15, the terminal 20 (separating unit 211) separates the random number (R), the management code (D), and the scramble value (M + H1) from the packet (P) received in step S14.

  In step S16, the terminal 20 (hash calculation unit 212) calculates a second hash value (H2 = H (R‖D‖ID)).

  In step S17, the terminal 20 (message acquisition unit 213) uses the exclusive OR (M + H1 + H2) of the scramble value (M + H1) acquired in step S15 and the second hash value (H2) acquired in step S16. (M) is acquired.

Second Embodiment
Hereinafter, a second embodiment of the present invention will be described.
The present embodiment is a configuration for more strictly checking the packet (P) of the first embodiment. In addition, the same code | symbol is attached | subjected to the structure similar to 1st Embodiment, and description is abbreviate | omitted or simplified.

FIG. 3 is a block diagram illustrating functional configurations of the server 10a and the terminal 20a included in the one-way communication system 1a according to the present embodiment.
The one-way communication system 1a differs from the first embodiment in the functions of the hash calculation unit 112a and the transmission unit 114a of the control unit 11a, and the functions of the separation unit 211a and the hash calculation unit 212a of the control unit 21a. The control unit 21a of the terminal 20a includes a verification unit 214.

  The hash calculation unit 112a calculates the first hash value (H (R‖D‖ID)) and determines the unidirectionality from the value obtained by connecting the unique data (R and D) and the first message (M1). A third hash value (H3 = H (R‖D‖M1)) is calculated using the hash function (H).

  The transmitting unit 114a connects the unique data (R and D), the scramble value (M1 + H (R‖D‖ID)) and the third hash value (H (R‖D‖M1)) (P = R‖). D‖ (M1 + H (R‖D‖ID)) ‖H (R‖D‖M1)) is transmitted to the terminal 20a via the communication unit 13.

  The separation unit 211a uses the unique data (R and D), the scramble value (M1 + H (R‖D‖ID)), and the third hash value (H) from the packet (P) received from the server 10a via the communication unit 23. (R‖D‖M1)).

  The hash calculation unit 212a calculates the second hash value (H (R‖D‖ID)) and the unique data (R and D) obtained by the separation unit 211a and the message acquisition unit 213. The fourth hash value (H4 = H (R‖D‖M2)) is calculated from the message (M2) 2 by the one-way hash function (H).

  The verification unit 214 determines whether the third hash value (H (R （D‖M1)) and the fourth hash value (H (R‖D‖M2)) match, thereby determining the second It is verified whether the message (M2) matches the first message (M1).

  Here, if the third hash value and the fourth hash value are equal, it is guaranteed that “M2 = M1”, and the message is correctly restored in the terminal 20a. That is, the second message (M2) is restored only at the legitimate terminal 20a in which the terminal ID 121 and the terminal ID 221 are equal, and further, it is guaranteed that the restored message is the same as the first message (M1). . On the other hand, at least the same message is not restored in an unauthorized terminal. Accordingly, the server 10a can transmit a correct message while guaranteeing the reliability of the terminal 20a while performing one-way communication.

  FIG. 4 is a sequence diagram showing processing for transmitting a message from the server 10a to the terminal 20a in the one-way communication system 1a according to the present embodiment.

  First, as advance preparation, in step S1, the terminal ID 221 (ID) of the terminal 20a is registered in the server 10a. The advance preparation is performed by secure communication (channel) such as local communication or offline. Thereby, the terminal ID 221 (ID) of the terminal 20a is shared by the server 10a and the terminal 20a.

  In step S21, the server 10a (unique data generation unit 111) generates a random number (R) and a management code (D).

  In step S22, the server 10a (hash calculation unit 112a) calculates a first hash value (H1 = H (R‖D‖ID)).

  In step S23, the server 10a (scramble calculation unit 113) calculates a scramble value (M + H1).

  In step S24, the server 10a (hash calculation unit 112a) calculates a third hash value (H3 = H (R‖D‖M)).

  In step S25, the server 10a (transmission unit 114a) transmits the packet (P = R‖D‖ (M + H1) ‖H3) to the terminal 20a.

  In step S26, the terminal 20a (separator 211a) obtains a random number (R), a management code (D), a scramble value (M + H1), and a third hash value (H3) from the packet (P) received in step S25. To separate.

  In step S27, the terminal 20a (hash calculation unit 212a) calculates a second hash value (H2 = H (R‖D‖ID)).

  In step S28, the terminal 20a (message acquisition unit 213) uses the exclusive OR (M + H1 + H2) of the scramble value (M + H1) acquired in step S26 and the second hash value (H2) acquired in step S27. (M) is acquired.

  In step S29, the terminal 20a (hash calculation unit 212a) uses the random number (R) and the management code (D) acquired in step S26 and the message (M) acquired in step S28 to generate a fourth hash value ( H4 = H (R‖D‖M)) is calculated.

  In step S30, the terminal 20a (verifying unit 214) verifies whether or not the third hash value (H3) acquired in step S26 matches the fourth hash value (H4) calculated in step S29. To do.

<Third Embodiment>
Hereinafter, a third embodiment of the present invention will be described.
The present embodiment is a configuration for transmitting the message (M) of the first embodiment with higher confidentiality. In addition, the same code | symbol is attached | subjected to the structure similar to 1st Embodiment, and description is abbreviate | omitted or simplified.

  FIG. 5 is a block diagram illustrating functional configurations of the server 10b and the terminal 20b included in the one-way communication system 1b according to the present embodiment.

  The one-way communication system 1b differs from the first embodiment in the function of the transmission unit 114b in the control unit 11b and the function of the separation unit 211b in the control unit 21b. Further, the server 10b control unit 11b includes an encryption unit 115, and the control unit 21b of the terminal 20b includes a decryption unit 215.

  The storage unit 12b of the server 10b stores a secret key 122, and the storage unit 22b of the terminal 20b stores a secret key 222. These are the same secret key (Key) shared by the server 10b and the terminal 20b, and are used for message encryption and decryption.

The encryption unit 115 encrypts the scramble value (M + H1) using the secret key 122, and obtains an encrypted message (Enc (Key, M + H1)).
“Enc (a, b)” is a function for encrypting b (= M + H1) with a key a (= Key).

  Further, simply, the encryption unit 115 may acquire the encrypted message by exclusive OR with the value of the keyed hash function using the secret key 122 and the random number R1 (Enc (a, b) = KeyedHash (a, R1) + b = b ′). Thereby, processing load is reduced.

  The transmission unit 114b transmits the packet (P = R‖D‖Enc (Key, M + H1)) obtained by connecting the unique data (R and D) and the encrypted message (Enc (Key, M + H1)) via the communication unit 13. To the terminal 20b.

  The separation unit 211b separates the unique data (R and D) and the encrypted message (Enc (Key, M + H1)) from the packet (P) received from the server 10b via the communication unit 23.

The decryption unit 215 decrypts the encrypted message (Enc (Key, M + H1)) using the secret key 222 (Dec (Key, Enc (Key, M + H1)) = M + H1) and obtains the scramble value (M + H1). To do.
Note that “Dec (a, b ′)” is a function for decrypting b ′ with the key a, and is paired with “Enc (a, b)”.

  In addition, when the keyed hash function is used by the encryption unit 115, the decryption unit 215 similarly decrypts the encrypted message by exclusive OR with the value of the keyed hash function to obtain the scramble value. Obtain (Dec (a, b ′) = b ′ + KeyedHash (a, R1) = b). Thereby, processing load is reduced.

  FIG. 6 is a sequence diagram showing processing for transmitting a message from the server 10b to the terminal 20b in the one-way communication system 1b according to the present embodiment.

First, as advance preparation, in step S1, the terminal ID 221 (ID) of the terminal 20b is registered in the server 10b. In step S2, a secret key common to the server 10b and the terminal 20b is notified and stored in both.
The advance preparation is performed by secure communication (channel) such as local communication or offline. Thereby, the server 10a and the terminal 20b share the terminal ID 221 (ID) and the secret key (Key) of the terminal 20b.

  In step S31, the server 10b (unique data generation unit 111) generates a random number (R) and a management code (D).

  In step S32, the server 10b (hash calculation unit 112) calculates a first hash value (H1 = H (R‖D‖ID)).

  In step S33, the server 10b (scramble calculating unit 113) calculates a scramble value (M + H1).

  In step S34, the server 10b (encryption unit 115) encrypts the scramble value and calculates an encrypted message (Enc (Key, M + H1)).

  In step S35, the server 10b (transmission unit 114b) transmits the packet (P = R‖D‖Enc (Key, M + H1)) to the terminal 20b.

  In step S36, the terminal 20b (separator 211b) separates the random number (R), the management code (D), and the encrypted message (Enc (Key, M + H1)) from the packet (P) received in step S35.

  In step S37, the terminal 20b (decryption unit 215) decrypts the encrypted message (Dec (Key, Enc (Key, M + H1))), and calculates a scramble value (M + H1).

  In step S38, the terminal 20b (hash calculation unit 212) calculates a second hash value (H2 = H (R‖D‖ID)).

  In step S39, the terminal 20b (message acquisition unit 213) uses the exclusive OR (M + H1 + H2) of the scramble value (M + H1) acquired in step S37 and the second hash value (H2) acquired in step S38. (M) is acquired.

<Fourth embodiment>
The fourth embodiment of the present invention will be described below.
This embodiment is a configuration for more strictly confirming the packet (P) of the third embodiment, similarly to the second embodiment. In addition, the same code | symbol is attached | subjected to the structure similar to 2nd Embodiment or 3rd Embodiment, and description is abbreviate | omitted or simplified.

FIG. 7 is a block diagram illustrating functional configurations of the server 10c and the terminal 20c included in the one-way communication system 1c according to the present embodiment.
The one-way communication system 1c is different from the third embodiment in the functions of the hash calculation unit 112c and the transmission unit 114c of the control unit 11c, and the functions of the separation unit 211c and the hash calculation unit 212c of the control unit 21c. The control unit 21c of the terminal 20c includes a verification unit 214 similar to that in the second embodiment.

  The hash calculation unit 112c calculates a first hash value (H1) and calculates a first hash value (H) from a value obtained by concatenating the unique data (R and D) and the first message (M1). 3 hash values (H3 = H (R‖D‖M1)) are calculated.

  The transmission unit 114c transmits a packet (P = R‖D‖Enc (Key, M + H1)) in which the unique data (R and D), the encrypted message (Enc (Key, M + H1)), and the third hash value (H3) are concatenated. ‖H3) is transmitted to the terminal 20c via the communication unit 13.

  The separation unit 211c extracts the unique data (R and D), the encrypted message (Enc (Key, M + H1)), and the third hash value (H3) from the packet (P) received from the server 10c via the communication unit 23. Isolate.

  The hash calculation unit 212c calculates the second hash value (H2), and from the unique data (R and D) obtained by the separation unit 211c and the second message (M2) obtained by the message acquisition unit 213. Then, a fourth hash value (H4 = H (R‖D‖M2)) is calculated by the one-way hash function (H).

  The verification unit 214 determines whether or not the third hash value (H3) and the fourth hash value (H4) match, whereby the second message (M2) becomes the first message (M1). Verify whether they match.

  FIG. 8 is a sequence diagram showing processing for transmitting a message from the server 10c to the terminal 20c in the one-way communication system 1c according to the present embodiment.

First, as advance preparation, in step S1, the terminal ID 221 (ID) of the terminal 20c is registered in the server 10c. In step S2, a common secret key is notified between the server 10c and the terminal 20c and stored in both.
The advance preparation is performed by secure communication (channel) such as local communication or offline. Thereby, the terminal ID 221 (ID) and the secret key (Key) of the terminal 20c are shared by the server 10c and the terminal 20c.

  In step S41, the server 10c (unique data generation unit 111) generates a random number (R) and a management code (D).

  In step S42, the server 10c (hash calculation unit 112c) calculates a first hash value (H1 = H (R‖D‖ID)).

  In step S43, the server 10c (scramble calculation unit 113) calculates a scramble value (M + H1).

  In step S44, the server 10c (encryption unit 115) encrypts the scramble value and calculates an encrypted message (Enc (Key, M + H1)).

  In step S45, the server 10c (hash calculation unit 112c) calculates a third hash value (H3 = H (R‖D‖M)).

  In step S46, the server 10c (transmission unit 114c) transmits the packet (P = R‖D‖Enc (Key, M + H1) ‖H3) to the terminal 20c.

  In step S47, the terminal 20c (separating unit 211c) determines the random number (R), the management code (D), the encrypted message (Enc (Key, M + H1)) and the third from the packet (P) received in step S46. The hash value (H3) is separated.

  In step S48, the terminal 20c (decryption unit 215) decrypts the encrypted message (Dec (Key, Enc (Key, M + H1))), and calculates a scramble value (M + H1).

  In step S49, the terminal 20c (hash calculation unit 212c) calculates a second hash value (H2 = H (R‖D‖ID)).

  In step S50, the terminal 20c (message acquisition unit 213) uses the exclusive OR (M + H1 + H2) of the scramble value (M + H1) acquired in step S48 and the second hash value (H2) acquired in step S49. (M) is acquired.

  In step S51, the terminal 20c (hash calculation unit 212c) uses the random number (R) and the management code (D) acquired in step S47 and the message (M) acquired in step S50 to generate a fourth hash value ( H4 = H (R‖D‖M)) is calculated.

  In step S52, the terminal 20c (verification unit 214) verifies whether or not the third hash value (H3) acquired in step S47 matches the fourth hash value (H4) calculated in step S51. To do.

  As mentioned above, although embodiment of this invention was described, this invention is not restricted to embodiment mentioned above. Further, the effects described in the present embodiment are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the present embodiment.

  The server 10 and the terminal 20 described above are examples of devices that transmit and receive messages, and may be various information processing devices (computers) such as a server device, a PC (Personal Computer), or a mobile terminal. Realized by software. When realized by software, a program constituting the software is installed in the information processing apparatus. These programs may be recorded on a removable medium such as a CD-ROM and distributed to the user, or may be distributed by being downloaded to the user's computer via a network.

  In addition to the terminal ID 221, the identification data of the receiving device shared between the transmitting device (server 10) and the receiving device (terminal 20) includes the user ID of the user of the terminal 20, fingerprint data, and the like. Various data are available.

1, 1a, 1b, 1c One-way communication system 10, 10a, 10b, 10c Server 20, 20a, 20b, 20c Terminal 111 Specific data generation unit 112, 112a, 112c Hash calculation unit 113 Scramble calculation unit 114, 114a, 114b, 114c Transmission unit 115 Encryption unit 211, 211a, 211b, 211c Separation unit 212, 212a, 212c Hash operation unit 213 Message acquisition unit 214 Verification unit 215 Decryption unit

Claims (8)

A one-way communication system having a server for transmitting a message and a terminal for receiving the message,
The server and the terminal share the identification data of the terminal in advance,
The server
A server-side hash calculator that calculates a first hash value by a one-way hash function from a data string including at least the identification data;
A scramble calculating unit for calculating a scramble value by exclusive OR of the first message and the first hash value;
A transmission unit that transmits, to the terminal, a packet in which unique data excluding the identification data from the data string and data based on the scramble value are concatenated,
The terminal
A separation unit that separates the unique data and the data based on the scramble value from the packet;
A terminal-side hash calculation unit that calculates a second hash value by the one-way hash function from the data sequence including the unique data and the identification data obtained by the separation unit;
A message acquisition unit that acquires a second message by exclusive OR of the scramble value obtained from the data separated by the separation unit and the second hash value obtained by the terminal-side hash calculation unit A one-way communication system comprising:   The one-way communication system according to claim 1, wherein the unique data is data including a random number.   The one-way communication system according to claim 1, wherein the specific data includes a message management code in the terminal. The server-side hash calculation unit calculates a third hash value from the value obtained by concatenating the unique data and the first message by the one-way hash function,
The transmission unit transmits a packet obtained by concatenating the unique data, data based on the scramble value, and the third hash value to the terminal,
The separation unit separates the unique data, the data based on the scramble value, and the third hash value from the packet,
The terminal-side hash calculation unit calculates a fourth hash value by the one-way hash function from the unique data obtained by the separation unit and the second message obtained by the message acquisition unit,
The terminal verifies whether or not the second message matches the first message by determining whether or not the third hash value and the fourth hash value match. The one-way communication system of any one of Claims 1-3 provided with a part. The server and the terminal share a secret key in advance,
The server includes an encryption unit that encrypts the scramble value using the secret key and obtains an encrypted message;
The transmitting unit transmits the unique data and the packet concatenated with the encrypted message to the terminal,
The separation unit separates the unique data and the encrypted message from the packet,
The one-way communication system according to any one of claims 1 to 4, wherein the terminal includes a decryption unit that decrypts the encrypted message using the secret key and obtains the scramble value. The encryption unit obtains the encrypted message by exclusive OR with a value of a keyed hash function using the secret key,
The one-way communication system according to claim 5, wherein the decryption unit acquires the scramble value by exclusive OR with a value of the keyed hash function. A communication method in a one-way communication system having a server for transmitting a message and a terminal for receiving the message,
The server and the terminal share the identification data of the terminal in advance,
The server is
A server-side hash calculation step of calculating a first hash value by a one-way hash function from a data string including at least the identification data;
A scramble calculating step of calculating a scramble value by exclusive OR of the first message and the first hash value;
A transmission step of transmitting to the terminal a packet concatenated with the unique data excluding the identification data from the data string and the data based on the scramble value, and
The terminal is
A separation step of separating the unique data and the data based on the scramble value from the packet;
A terminal-side hash calculation step of calculating a second hash value by the one-way hash function from the data string composed of the unique data and the identification data obtained in the separation step;
A message acquisition step of acquiring a second message by exclusive OR of the scramble value obtained from the data separated in the separation step and the second hash value obtained in the terminal-side hash calculation step. And a communication method to execute. A communication program executed by a one-way communication system having a server for transmitting a message and a terminal for receiving the message,
The server and the terminal share the identification data of the terminal in advance,
To the server,
A server-side hash calculation step of calculating a first hash value by a one-way hash function from a data string including at least the identification data;
A scramble calculating step of calculating a scramble value by exclusive OR of the first message and the first hash value;
Transmitting the packet concatenating the unique data excluding the identification data from the data string and the data based on the scramble value to the terminal; and
In the terminal,
A separation step of separating the unique data and the data based on the scramble value from the packet;
A terminal-side hash calculation step of calculating a second hash value by the one-way hash function from the data string composed of the unique data and the identification data obtained in the separation step;
A message acquisition step of acquiring a second message by exclusive OR of the scramble value obtained from the data separated in the separation step and the second hash value obtained in the terminal-side hash calculation step. And a communication program for executing.

Images