Communication network system, transmission node, reception node, and message checking method

Patent metadata

Field	Value
Publication number	US-2017195878-A1
Application number	US-201515315084-A
Country	US
Kind code	A1
Filing date	Jun 5, 2015
Priority date	Jun 5, 2014
Publication date	Jul 6, 2017
Grant date	—

Abstract

In a communication network system connected between a transmission node and a reception node, both the transmission node and the reception node store the same secret information with their secret information storage units. The transmission node includes a counter configured to increase its transmission count value by 1 for transmitting each message, wherein a MAC generator generates MAC based on secret information, transmission data, and its transmission count value, thus transmitting a message including transmission data and MAC. The reception node includes a counter configured to increase a reception count value by 1 for receiving each message, wherein a MAC checking part generates MAC based on secret information, reception data, and its reception count value, obtained from the received message, thus checking whether the generated MAC matches the MAC obtained from the received message.

First claim

1 . A communication network system connecting a transmission node configured to transmit a message and a reception node configured to receive the message,
wherein the transmission node includes a transmission counter holding a transmission count value being increased by a predetermined count value upon transmitting each message, a secret information storage unit configured to store secret information, a message authentication code generator configured to generate a message authentication code based on transmission data stored in a data section of the message, the transmission count value, and the secret information, and a transmitter configured to transmit the message including the transmission data and the message authentication code, and wherein the reception node includes a reception counter configured to increase a reception count value being increased by the predetermined count value upon receiving each message, a secret information storage unit configured to store the secret information, and a message authentication code checking part configured to generate a message authentication code based on reception data, obtained from a data section of a received message, the reception count value, and the secret information, thus checking whether the message authentication code matches the message authentication code obtained from the received message.

2 . The communication network system according to claim 1 , wherein the message authentication code generator solely uses extracted upper bits, corresponding to a predetermined number of bits extracted from a bit string of the transmission count value, in order to generate the message authentication code,
wherein the transmitter solely stores one portion of a bit string of the message authentication code, specified by a value of lower bits other than the extracted upper bits within the bit string of the transmission count value, in a transmitting message, and wherein the message authentication code checking part solely uses the extracted upper bits, corresponding to the predetermined number of bits extracted from the bit string of the reception count value, in order to generate the message authentication code so as to solely use one portion of the bit string of the message authentication code, specified by a value of lower bits other than the extracted upper bits within the bit string of the reception count value, subjected to checking whether to match the message authentication code obtained from the received message.

3 . The communication network system according to claim 2 , wherein the message authentication code checking part solely uses one portion of the bit string, specified by a value of lower bits in the reception count value being increased by the predetermined count value, subjected to rechecking when a checking result indicates unmatched.

4 . The communication network system according to claim 3 , wherein the reception counter sets the value of lower bits, whose rechecking result indicates a match, to a value of lower bits in the reception count value being held thereby.

5 . The communication network system according to claim 1 , wherein the message authentication code generator solely uses the extracted upper bits, corresponding to the predetermined number of bits extracted from the bit string of the transmission count value, in order to generate the message authentication code,
wherein the transmitter stores one portion of the bit string of the message authentication code, specified by the value of lower bits other than the extracted upper bits within the bit string of the transmission count value, and positional information representing one portion of the bit string located in the bit string of the message authentication code in a transmitting message, and wherein the message authentication code checking part solely uses the extracted upper bits, corresponding to the number of bits extracted from the bit string of the reception count value, in order to generate the message authentication code so as to solely use one portion of the bit string of the message authentication code, based on the positional information obtained from a received message, subjected to checking whether to match the message authentication code obtained from the received message.

6 . A transmission node adapted to a communication network system connecting the transmission code configured to transmit a message and a reception node configured to receive the message, comprising:
a secret information storage unit configured to store secret information identical to secret information held by the reception node; a transmission counter configured to hold a transmission count value being increased by a predetermined count value for transmitting each message; a message authentication code generator configured to generate a message authentication code based on transmission data stored in a data section of the message, the transmission count value, and the secret information; and a transmitter configured to transmit the message including the transmission data and the message authentication code.

7 . A reception node adapted to a communication network system connecting a transmission node configured to transmit a message and the reception node configured to receive the message, comprising:
a secret information storage unit configured to store secret information identical to secret information held by the transmission node; a reception counter configured to hold a reception count value being increased by a predetermined count value, corresponding to a predetermined count value used in the transmission node, for receiving each message; and a message authentication code checking part configured to generate a message authentication code based on reception data, obtained from a data section of a received message, the reception count value, and the secret information so as to check whether the message authentication code matches an message authentication code obtained from the received message.

8 . A message checking method adapted to a communication network system connecting a transmission node configured to transmit a message and a reception node configured to receive the message, comprising:
storing, by the transmission node and the reception node, same secret information as the reception node; holding, by the transmission node, a transmission count value being increased by a predetermined count value for transmitting each message; generating, by the transmission node, a message authentication code based on transmission data, stored in a data section of the message, the transmission count value, and the secret information; transmitting, by the transmission node, the message including the transmission node and the message authentication code; holding, by the reception node, a reception count value being increased by the predetermined count value for receiving each message; generating, by the reception node, a message authentication code based on reception data, obtained from a data section of a received message, the reception count value, and the secret information; and checking whether the message authentication code matches the message authentication code obtained from the received message.

9 . A non-transient computer-readable storage medium storing a computer program causing a computer of a transmission node, adapted to a communication network system connecting the transmission node configured to transmit a message and a reception node configured to receive the message, to implement the steps of:
storing secret information identical to secret information held by the reception node; holding a transmission count value being increased by a predetermined count value for transmitting each message;

Assignees

• Kddi Corp

Inventors

• Takemori Keisuke
• Kawabata Hideaki

Classifications

• H04L9/3242 Primary

  involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC · CPC title

• H04W12/04 Primary

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04L2209/72

  Signcrypting, i.e. digital signing and encrypting simultaneously · CPC title