Method and system for distributing cryptographic keys in a hierarchized network

A method is presented for distributing cryptographic keys in a hierarchized network including at least one device in charge of a higher group of devices, wherein at least one of the devices of the higher group of devices is also in charge of a lower group of devices. The method includes the steps of: a) storing a set of identifiers particular to the higher group, an identifier particular to the device in charge, an identifier per device in charge of a lower group, each identifier being unique; storing a root cryptographic key; c) providing a root cryptographic key to each device in charge of a lower group using a first non-reversible cryptographic function; d) providing at least one transport cryptographic key to each member of said higher group of devices using a second non-reversible cryptographic function.

PRIORITY CLAIM

This application is a 371 filing from PCT/FR2008/052037 (WO 2009/068815) which claims priority from French Application for Patent No. 07 07972 filed Nov. 13, 2007, the disclosures of which are hereby incorporated by reference.

TECHNICAL FIELD

The present invention relates to a method and a system for distributing cryptographic keys in a hierarchized network. It also relates to a device and a computer program for applying the method.

BACKGROUND

When considering the communication networks used by organizations that have to intervene in difficult environments such as the fire and rescue service, the civil defense service, the police or the army, they are characterized by an organization structured hierarchically in groups. Within one group, all the users communicate freely, but it is necessary to introduce partitioning between users of different groups. Specifically, experience shows that, in a broadcast communication mode, that is to say that each user communicates with all of the users of the group, the multiplication, in particular, of the oral interventions associated with stress situations generates a noise which prevents the transmission of pertinent information when the group exceeds about ten users.

Partitioning can be created by the use of different transmission channels for each group. But it is also possible to combine this approach by encrypting each communication channel with a different group key in order to ensure the seal between the groups also making it possible to maintain the confidentiality of certain information.

The only communications that can be decrypted by a terminal of the group are those generated for which the terminal has a cryptographic key which is itself attached to a group.

The use of encrypted communications also makes it possible to maintain confidentiality of the interchanges and is therefore particularly preferred by the military and the public safety professionals who have a need to maintain confidentiality of information.

In the prior art, the generation of the cryptographic keys is carried out by a central machine, called a key-distribution server or station, and each terminal of the network receives its cryptographic key or keys from this central machine before deployment on the ground.

This centralized management of the cryptographic keys has the drawback of greatly limiting the possibilities of reorganization and restructuring of the network if the link with this central machine should be lost thus depriving the group organization of all impetus.

Therefore, if, for any reason, the terminal of the group responsible for maintaining the communication link between the group and the higher hierarchy becomes unavailable, just as does any possible backup solution such as the use of a second terminal, the group is then cut off from all communication with the rest of the structure. It then becomes necessary for this group to return to a location such as a base camp or quarters where it can be reorganized and obtain new cryptographic keys allowing it to reintegrate the communication network of the structure.

Likewise the merging of two groups will require return to a location where the provision of new keys can be carried out whereas the constraints of the situation may require that the merger is carried out immediately, on the site of the action while maintaining the confidentiality of the previous interchanges.

It would then be particularly advantageous to produce a management of the cryptographic keys that is particularly robust to withstand an accident and which allows a rapid reorganization of the network.

SUMMARY

To respond to this need, according to one aspect of the invention, the proposal is for a method for managing cryptographic keys in a hierarchized network comprising at least one device responsible for a higher group of devices, at least one of the devices of said group of devices also being responsible for a lower group of devices, characterized in that it comprises the steps, at the device responsible for the higher group, of:

a. storageof a set of identifiers specific to the higher group,of an identifier specific to the responsible device,of an identifier for each device responsible for a lower group,

each identifier being unique inside the hierarchized network,

b. storage of a root cryptographic key,

c. supply of a root cryptographic key to each device responsible for a lower group by derivation from the root key and from the identifier of said device responsible for the lower group by a first, nonreversible cryptographic function,

d. supply of at least one transport cryptographic key to each member of said higher group of devices by derivation from the root key and from an identifier belonging to the set of identifiers specific to said group by a second, nonreversible cryptographic function.

This advantageously provides a decentralized management of the cryptographic keys which respects the hierarchical structure of the organization. In this way, the distribution of the keys can be carried out as close as possible to the locations where the users are engaged. For example, a user who is isolated because he has lost his group can join another group simply by acquiring, from the head of this group, the transport cryptographic key or keys that are or will be used by this group.

According to another aspect of the invention, the proposal is for a method for distributing cryptographic keys in a hierarchized network comprising at least one device responsible for a higher group of devices, said method being applied by a device of said group of devices also responsible for a lower group of devices, characterized in that it comprises the steps of:

a. storage of a root cryptographic key,

b. storage of an identifier that is specific thereto and is unique in the hierarchized system,

c. generation of a transport cryptographic key by derivation from the root cryptographic key and from one of the identifiers of the set of identifiers specific to the group,

d. distribution of the transport cryptographic key to the devices that are members of the group.

According to another aspect of the invention, a computer program is proposed comprising instructions for the application of one of the methods when said instructions are executed on a computer.

According to another aspect of the invention, a system for distributing cryptographic keys in a hierarchized network is proposed comprising at least one device responsible for a higher group of devices, at least one of the devices of said group of devices also being responsible for a lower group of devices, characterized in that it comprises:

a. means for defining, for each group, a set of identifiers that is specific thereto, and, for each device responsible for a group, a responsible-device identifier that is specific thereto and unique in the hierarchized network.

b. means for installing a root cryptographic key in the device responsible for the higher group.

c. first means for supplying a root cryptographic key to each device responsible for a lower group by derivation from the root key of the device responsible for the higher group and from the identifier of said device responsible for the lower group by a first, nonreversible cryptographic function.

d. for each group of devices, second means for supplying at least one transport cryptographic key to each member of said group of devices by derivation from the root key of the device responsible for said group and from an identifier belonging to the set of identifiers of said group by a second, nonreversible cryptographic function.

According to another aspect of the invention, a device responsible for a group of devices in a hierarchized network is also proposed, characterized in that it comprises:

a. first means for storage of a root cryptographic key,

b. second means for storage of an identifier that is specific thereto and is unique in the hierarchized system and of a set of identifiers specific to the group,

c. means for generating a transport cryptographic key by derivation from the root cryptographic key and from one of the identifiers of the set of identifiers specific to the group,

d. means for distributing the transport cryptographic key to the member devices of the group.

Other features and embodiments are described in the dependent claims.

DETAILED DESCRIPTION OF THE DRAWINGS

With reference toFIG. 1, a hierarchized network consists of groups G1, G11, G12, G111, G113and G122symbolized inFIG. 1by closed dashed lines. These groups form a hierarchy in which the group G1is the higher-level group, the groups G11, G12are intermediate-level groups and the groups G111, G113, G122are the lower-level groups.

A device belonging to the intermediate hierarchy of the network therefore has two roles symbolized by two reference numbers, a first reference number indicating that it belongs as a member of the group of level n and a second reference number indicating its role as being responsible for the group of the lower level n−1. For example, the device RG11/MG11has a reference number MG11as a member of the group G1with a rank1and a reference RG11as a device responsible for the group G11.

Each responsible device RGiof group Gicomprises, inFIG. 2, means10for storage of a root cryptographic key RKi, a set of identifiers IGik, k=1 . . . n specific and unique to the group, and unique identifiers IRIof the responsible devices RGIof the groups GIof the level below the group Gi, which devices are also members of the group Gi, and are also called subordinate responsible devices.

The responsible devices RGialso comprise first means12for generating root keys RKIof their subordinate responsible devices RGIby diversification of their own root cryptographic key RKiand of the identifier IRIof the subordinate responsible device by a first, nonreversible cryptographic function F1.

They comprise, connected to the first generation means12, means14for supplying root cryptographic keys RKIthus generated to the subordinate responsible devices RGI.

The devices RGialso comprise second means16for generating transport cryptographic keys TKikby diversification of their own root cryptographic key RKiand of one of the identifiers IGikof the set of identifiers of the group Giby a second, nonreversible cryptographic function F2.

The transport cryptographic keys are used to encrypt communications between all the members of the group.

They comprise, connected to the second means16for generating means18for supplying transport cryptographic keys TKikto each device MGijthat is a member of the group Gi.

The computation and distribution of the keys is carried out according to the following method,FIG. 3.

For each group Gi, in the step20, a first identifier is defined IRiassociated with the device responsible for the group Giand a set of identifiers IGik, k varying between 1 and n. During this step for defining identifiers, a check is made to ensure that each one is unique in the network. This step is carried out, for example, by an operation of random selection without duplicate, or else by taking consecutive series of whole numbers.

Each device RGiresponsible for the group Gireceives and stores, in step22, the identifier IRiand the identifiers IGikfor its group and the identifiers IRIfor the subordinate responsible devices MGi/RGi.

A root cryptographic key RK1is stored, in step24, in the device RG1of the first higher group G1. It should be noted that, by its hierarchical position, the device RG1is a subordinate member of no group. This installation can be carried out, for example, according to a method of the prior art for access to a central server or else may correspond to the generation of the key in the device RG1, for example by generation of a random number.

The steps20and22for defining and distributing identifiers, and the step24for storing the root cryptographic key RK1are preferably carried out before the structure is engaged in operation.

It should be noted that, although described consecutively, these steps may be carried out in a different order or in parallel.

In a step26, the root cryptographic key RK1is diversified with each identifier IRIof each subordinate responsible device RGIby using the nonreversible cryptographic algorithm F1, for example the SHA algorithm. The result of the diversification operation is transferred, in step28, by the responsible device RGIand becomes the root key RKIof the responsible device.

The steps26and28for diversification and transfer are repeated by each responsible device following the hierarchical tree structure of the network corresponding to the broadcast of the root cryptographic keys until all of the responsible devices of the network have their root cryptographic key.

Inside each group Gi, the responsible device RGidiversifies, in step30, its root cryptographic key RKiwith one of the identifiers IGikof the group by using a second, nonreversible cryptographic algorithm F2. According to the security constraints of the system, the algorithms F1and F2may be the same or different.

The result of the diversification operation is transferred, in step32, to each device MGijthat is a member of the group Gi in order to become a transport cryptographic key TKik.

This transport key TKikis used, in step34, to encrypt the communications inside the group. Preferably it corresponds to a symmetrical encryption algorithm key such as DES or AES.

Preferably, the steps30and32are repeated for all the identifiers IGik of the group. Thus each member of the group has a set of transport cryptographic keys, which makes it possible easily, either manually or automatically, to modify the transport cryptographic key used whenever necessary. For example, in an environment requiring great security of communications, the transport cryptographic key can be modified according to a variable timing rate, for example, in a random manner.

In a particular embodiment, each identifier IGik, and therefore each transport cryptographic key TKikgenerated from this identifier, has a reference number, which can be the identifier itself. This reference number is concatenated in clear with each message encrypted with the corresponding transport cryptographic key TKik. Therefore, the device receiving the message easily knows the transport cryptographic key to be used to decrypt the message.

This reference number also advantageously makes it possible to carry out subsequent analyses of the interchanged messages.

Specifically, in a particular embodiment, all of the messages encrypted and concatenated with the reference number are recorded and stored on a network server. Similarly, all of the identifiers used in the network and the root key RK1are stored in a central device outside of the hierarchized network.

By using the method described, the staff personnel who therefore know all of the identifiers used in the network and the root key RK1are capable of reconstructing all of the transport keys used in the network with their reference number.

Therefore, these personnel are capable of decrypting the recorded encrypted communications in order, for example, to carry out a post mortem analysis of the events.

The method and the system of distributing cryptographic keys can be combined with other cryptographic techniques known to those skilled in the art in order to strengthen its security.

For example, it is possible to use automatic authentication cryptographic techniques or techniques combining a manual authentication with an automatic authentication in order to verify and validate the distribution of the keys to approved devices.

What has been described therefore is a method and a system for distributing cryptographic keys in a hierarchized network which advantageously allows a decentralized management of the cryptographic keys while respecting the hierarchical structure of the network. Because of this, the distribution of the keys can be carried out as close as possible to the locations where the users are engaged. Therefore, the network can be reconfigured or devices can be added to a group simply by being authenticated with the device responsible for the group.