Key sharing device, key sharing method, and computer program product
In an embodiment, a key sharing device connects to external devices with paths, and includes a key storage unit, a determining unit, a first generating unit, an encrypting unit, and a first transmitting unit. The key storage unit stores cryptographic keys to be shared. The determining unit determines a path for reaching a first device via a second device when a number of the cryptographic keys out of the cryptographic keys stored in the key storage unit is a predetermined threshold or smaller. The first generating unit generates an initial key that is a new cryptographic key to be shared with the first device. The encrypting unit encrypts the initial key by using the cryptographic key. The first transmitting unit transmits the encrypted initial key to the second device with addressing the first device as destination.
1. A key sharing device connected to a plurality of external devices through one or more paths, the plurality of external devices including a first device and a second device, the first device being directly connected to the key sharing device via a first path, the key sharing device comprising:
a key storage unit configured to store cryptographic keys to be shared with the external devices;
a determining unit configured to determine a second path for reaching the first device via the second device when a number of the cryptographic keys to be shared with the first device out of the cryptographic keys stored in the key storage unit is a predetermined threshold or smaller;
a first generating unit configured to generate an initial key that is a new cryptographic key to be shared with the first device;
an encrypting unit configured to encrypt the initial key by using the cryptographic key shared with the second device; and
a first transmitting unit configured to transmit the encrypted initial key to the second device with addressing the first device as destination through the second path instead of the first path.
2. The key sharing device according to claim 1 , further comprising a path storage unit configured to store path information representing paths to/from the external devices, wherein
the determining unit determines the second path for reaching the first device via the second device on the basis of the path information.
3. The key sharing device according to claim 2 , wherein the path storage unit stores the path information received from a server device having a function of distributing the path information.
4. The key sharing device according to claim 1 , wherein the first generating unit generates any one of the cryptographic keys shared with the second device as the initial key.
5. The key sharing device according to claim 1 , wherein a plurality of key storage units are provided in association with the plurality of external devices, respectively.
6. The key sharing device according to claim 1 , wherein the key storage unit stores identification information of the external devices and the cryptographic keys to be shared with the external devices in association with one another.
7. A key sharing method performed by a key sharing device that connects to a plurality of external devices through one or more paths, the key sharing device including a key storage unit configured to store cryptographic keys to be shared with the external devices, the plurality of external devices including a first device and a second device, the first device being directly connected to the key sharing device via a first path, the method comprising:
determining a second path for reaching the first device via the second device when a number of the cryptographic keys to be shared with the first device out of the cryptographic keys stored in the key storage unit is a predetermined threshold or smaller;
generating an initial key that is a new cryptographic key to be shared with the first device;
encrypting the initial key by using the cryptographic key shared with the second device; and
transmitting the encrypted initial key to the second device with addressing the first device as destination through the second path instead of the first path.
8. A non-transitory computer-readable medium including programmed instructions for a computer that connects to a plurality of external devices through one or more paths, the plurality of external devices including a first device and a second device, the first device being directly connected to the key sharing device via a first path, wherein the instructions, when executed by the computer, cause the computer to function as:
a key storage unit configured to store cryptographic keys to be shared with the external devices;
a determining unit configured to determine a second path for reaching the first device via the second device when a number of the cryptographic keys to be shared with the first device out of the cryptographic keys stored in the key storage unit is a predetermined threshold or smaller;
a first generating unit configured to generate an initial key that is a new cryptographic key to be shared with the first device;
an encrypting unit configured to encrypt the initial key by using the cryptographic key shared with the second device; and
a first transmitting unit configured to transmit the encrypted initial key to the second device with addressing the first device as destination through the second path instead of the first path.