JP4835206B2 - Information processing device - Google Patents

Description

  The present invention relates to an information processing apparatus that includes an information recording apparatus that records information in a freely readable manner, and that inputs and outputs information to and from the information recording apparatus.

Recently, when exchanging information such as documents, images, sounds, and videos between information processing devices, encryption technology to prevent unauthorized reading of information and whether the information has been tampered with. A security technique called electronic signature for detection has been widely adopted. For example, to verify the validity of the information, determine control information about the digital media file, calculate a known hash value that uniquely identifies the digital media file, and thereby generate an analyzed digital media file An analysis module calculates a verification hash value from the analyzed digital media file and compares the verification hash value with a known hash value to determine whether the analyzed digital media file is legitimate information. An information validity verification system to be verified is disclosed (for example, see Patent Document 1).
JP 2002-358011 A (pages 2 to 4)

  In order to realize the verification system disclosed in Patent Document 1, it is necessary to provide security means with high security strength such as a hash value generation circuit in the information processing apparatus. Such security processing means can be configured by software or hardware. However, when high throughput is required for security processing, information to be processed is recorded on the information recording device. The speed of information acquisition from storage and information recording devices inevitably increases. Security such as information encryption and electronic signature generation accompanying information storage, and information decryption and electronic signature verification accompanying information acquisition Since each process accompanying the execution of the process also needs to be performed at high speed, it is necessary to configure the security means with hardware advantageous for high-speed processing.

  However, if an advanced security processing means such as the above-described hash value generation circuit is configured only by hardware, there is a problem that the scale of the hardware is inevitably increased, leading to an increase in cost.

  In view of the above circumstances, an object of the present invention is to provide an information processing apparatus with a small hardware scale and high security strength.

An information processing apparatus of the present invention that achieves the above object is
In an information processing apparatus that includes an information recording device that records information in a readable manner, and that inputs and outputs information to and from the information recording device,
Based on the information, the CRC value generator for generating a CRC value corresponding to the information,
A random number storage unit for storing a plurality of random numbers associated with a value derived from the CRC value ;
The CRC value generation unit generates a first CRC value corresponding to the information recorded in the information recording device, takes out a first random number corresponding to the first CRC value from the random number storage unit, and A first signature based on the first random number is generated, and the CRC value generation unit is caused to generate a second CRC value corresponding to the information received from the information recording device, and the second random number storage unit generates the second signature. A signature generation unit that extracts a second random number corresponding to the CRC value of the first and generates a second signature based on the second random number;
A signature verification unit for verifying the first signature and the second signature generated by the signature generation unit is provided.

  According to the information processing apparatus of the present invention, an information processing apparatus having an advanced security function can be obtained without using large-scale hardware such as a hash value generation circuit.

  According to the present invention, it is possible to realize an information processing apparatus with a small hardware scale and high security strength.

  Embodiments of the present invention will be described below with reference to the drawings.

  FIG. 1 is a schematic configuration diagram of an information processing apparatus according to an embodiment of the present invention.

  FIG. 1 shows a schematic configuration of an information processing apparatus 1 according to the present embodiment.

  The information processing apparatus 1 includes an information recording apparatus 2 that records information in a freely readable manner, and inputs / outputs information to / from the information recording apparatus 2, and corresponds to the information based on the information. An information recording device includes a shortened information generating unit 3 that generates shortened information, a random number storage unit 4 that stores a plurality of random numbers associated with values derived from the shortened information, and a shortened information generating unit 3. First shortened information corresponding to the information recorded in 2 is generated, a first random number corresponding to the first shortened information is extracted from the random number storage unit 4, and first based on the first random number And the shortened information generating unit 3 generates the second shortened information corresponding to the information received from the information recording device 2, and corresponds to the second shortened information from the random number storage unit 4. The second random number to be extracted and the second signature based on the second random number It includes a signature generation unit 5 for generating, a signature verification unit 6 for matching first signature and a second signature generated by the signature generation unit 5 a.

  The shortened information generating unit 3 may generate a CRC value corresponding to the information based on the information.

  FIG. 2 is a diagram illustrating a more detailed configuration of the information processing apparatus according to the present embodiment.

  An information processing apparatus 1 according to the present embodiment is, for example, a large computer, a workstation, or a personal computer. As shown in FIG. 2, a CPU (Central Processing Unit) 11 that is the center of processing of the entire information processing apparatus, and an apparatus An internal interface (I / F) 12 responsible for information transmission, a main memory 13 for storing information, a control panel 14 for communicating with an operator, and a network control unit 15 for controlling communication with an external network A hard disk 16 that records information in a readable manner, a security processing unit 17 that performs information security processing, an internal I / F control unit 18 that handles input and output of information between the CPU 11 and the security processing unit 17, Information between the security processing unit 17 and the hard disk 16 And an information recording device I / F control unit 19 for inputting and outputting information.

  The hard disk 16 shown in FIG. 2 corresponds to the information recording apparatus 2 shown in FIG. 1, that is, the information recording apparatus according to the present invention. The information recording apparatus according to the present invention is not limited to a hard disk, and includes, for example, an information recording apparatus such as a flash memory, a magnetic tape storage apparatus, and an optical disk storage apparatus, and an information recording medium used for the information recording apparatus. .

  1 is formed in the information recording apparatus I / F control unit 19 in FIG. 2, and the random number storage unit 4 shown in FIG. 1 is stored in the main memory 13 in FIG. The signature generation unit 5 and signature verification unit 6 shown in FIG. 1 are formed in the security processing unit 17 in FIG.

  FIG. 3 is a circuit diagram of the main part of the information processing apparatus of this embodiment.

  3 shows the main memory 13, the internal I / F control unit 18, the security processing unit 17, the information recording device I / F control unit 19, the information recording device I / I of the information processing apparatus 1 (see FIGS. 1 and 2). F20 and hard disk 16 are shown.

  In the main memory 13, for example, an information storage area 13a for storing information received from the outside via the network control unit 15 (see FIG. 2) and a random number storage area 13b for storing a predetermined random number sequence are formed. Yes. The random number storage area 13b corresponds to the random number storage unit 4 shown in FIG.

  The internal I / F control unit 18 is formed with a DMA (Direct Memory Access) control unit 18a responsible for data transfer between devices in the apparatus.

  The security processing unit 17 includes a signature generation / verification unit 17a and an encryption / decryption unit 17b.

  The information recording device I / F control unit 19 includes a CRC generation unit 19a, a header addition / removal unit 19b, a CRC addition / verification unit 19c, and a transmission encoding / decoding unit 19d.

  The signature generation / verification unit 17a in the present embodiment corresponds to the signature generation unit (see FIG. 1) and the signature verification unit (see FIG. 1) according to the present invention, and the CRC generation in the present embodiment. The unit 19a corresponds to the shortened information generating unit (see FIG. 1) referred to in the present invention.

  The operation of the information processing apparatus of this embodiment configured as described above will be described below.

  First, the operation when the security processing of information stored in the information storage area 13a of the main memory 13 (see FIG. 3) is performed and then the security-processed information is stored in the hard disk 16 will be described.

  FIG. 4 is a flowchart showing an operation of storing information on the hard disk in the information processing apparatus of this embodiment, and FIG. 5 is a diagram showing a transition state of the information main body in the information processing apparatus of this embodiment. FIG. 6 is a diagram illustrating a transition state of signatures corresponding to information in the information processing apparatus according to the present embodiment.

  As shown in FIG. 4, information PD1 to be processed is read from the main memory 13 to the security processing unit 17 via the internal I / F 12 by the DMA control unit 18a (step S01), and the read information PD1 is Then, the encryption / decryption unit 17b in the security processing unit 17 sequentially performs encryption processing and outputs the encrypted information PD2 (see FIG. 5) to the information recording device I / F control unit 19 (step S02). .

  The encrypted information PD2 input to the information recording apparatus I / F control unit 19 is added with a header for transmission by the header addition / removal unit 19b to become encrypted information PD3 with header (see FIG. 5), and CRC The data are sequentially output to the generation unit 19a and the CRC addition / collation unit 19c (step S03).

  The CRC generation unit 19a sequentially obtains a CRC value from the input header-encrypted information PD3, and when the calculation of the CRC value for the entire header-encrypted information PD3 is completed, the CRC value PC1 is obtained. The data is output to the CRC addition / verification unit 19c and the signature generation / verification unit 17a in the security processing unit 17 (step S04).

  The CRC adding / collating unit 19c sequentially outputs the input header-added encrypted information PD3 as it is to the transmission encoding / decoding unit 19d, and at the end of the header-added encrypted information PD3, the CRC generating unit A CRC value output from 19a is added to generate header-CRC value-added encrypted information PD4 (see FIG. 5) (step S05).

  The transmission encoding / decoding unit 19d performs transmission encoding processing on the header / CRC value-added encrypted information PD4 output from the CRC adding / verifying unit 19c, and the transmission encoded header / CRC value Attached encrypted information PD5 is generated (step S06), and it is written to the hard disk 16 via the information recording device I / F 20 (step S07).

  Thus, the storage of the information body in the hard disk 16 is completed.

  On the other hand, in the signature generation / verification unit 17a in the security processing unit 17, a part of the random number sequence stored in advance on the main memory 13 is stored in the main memory using the CRC value PC1 generated in step S04 as a key. 13, the signature is generated from the read random number value (step S08), and is output to the encryption / decryption unit 17b as the signature PS1 (see FIG. 6) for the information PD1 (step S09).

  The input signature PS1 is encrypted by the encryption / decryption unit 17b to become an encrypted signature PS2 (see FIG. 6), and is output to the information recording device I / F control unit 19 (step S10).

  The information recording device I / F control unit 19 adds a header and a CRC value to the input encrypted signature PS2 and performs transmission encoding as in the case of the information body (steps S11, S12, S13, S14) The transmission-encoded header / CRC-encrypted signature PS5 (see FIG. 6) thus obtained is output to the hard disk 16 via the information recording device I / F 20 (step S15).

  In this way, storing of the signature for the information on the hard disk 16 is completed.

  Next, an operation for reading information stored in the hard disk 16 to the main memory 13 (see FIG. 3) will be described.

  FIG. 7 is a flowchart showing an information reading operation from the hard disk in the information processing apparatus of this embodiment.

  First, the header / CRC value-encrypted signature GS1 (see FIG. 6) encoded from the hard disk 16 via the information recording device I / F 20 is transmitted to the transmission code in the information recording device I / F control unit 19. The data is input to the encoding / decoding unit 19d (S101).

  The transmission encoding / decoding unit 19d performs transmission decoding processing, and the header / CRC value-added signature GS2 subjected to the transmission decoding processing is sequentially output to the CRC generation unit 19a and the CRC addition / verification unit 19c (S102). .

  The CRC generation unit 19a sequentially obtains a CRC value from the input header / CRC value-added signature GS2, and outputs the CRC value GCl to the CRC addition / collation unit 19c when the calculation of the CRC value is completed (S103).

  The CRC addition / collation unit 19c outputs the header / CRC value-added signature GS2 from which the CRC value portion GC2 has been removed (the header-added signature GS3) as it is to the header addition / removal unit 19b.

  The CRC addition / collation unit 19c collates with the CRC value portion GC2 removed earlier when the CRC value GC1 is input from the CRC generation unit 19a (S104), and the collation result (S105) matches. If not, a transmission error is notified to the system (S120).

  As a result of the collation (S105), if they match, the header addition / removal unit 19b removes the header portion from the input header-added signature GS3 and sequentially removes the removed one (encrypted signature GS4). 17 (S106).

  The encrypted signature GS4 output from the information recording device I / F control unit 19 is decrypted by the encryption / decryption unit 17b in the security processing unit 17 (GS5) and stored in the signature generation / verification unit 17a. (S107).

  In this way, signature acquisition from the hard disk 16 is completed.

  Next, transmission-encoded encrypted information GD1 with a header and a CRC value is read from the hard disk 16 via the information recording device I / F 20 and input to the information recording device I / F control unit 19 ( S108). The transmission encoding / decoding unit 19d of the information recording device I / F control unit 19 performs transmission decoding (S109), CRC value generation (S110), and CRC value collation (S111) as in the case of the signature. As a result of the collation (S112), if they do not match, a transmission error is notified to the system (S120).

  As a result of the collation (S112), if they match, header removal (S113) is performed, and the encrypted information GD4 and the generated CRC value are output to the security processing unit 17.

  The encrypted information GD4 output from the information recording device I / F control unit 19 is decrypted by the encryption / decryption unit 17b in the security processing unit 17 (GD5) (S114), and the internal I / F control is performed. The data is output to the DMA control unit 18a in the unit 18.

  The DMA controller 18a sequentially writes information to the information storage area 13a of the main memory 13 via the internal I / F 12 (S115).

  In this way, acquisition of the information body from the hard disk 16 is completed.

  On the other hand, the signature generation / verification unit 17a in the security processing unit 17 uses a CRC value in the information recording device I / F control unit 18 as a key and a part of the random number sequence stored in the main memory 13 in advance. Read from the main memory 13 (S116), generate a signature from the read random number value (S117), collate with the signature GS5 acquired from the hard disk 16 (S118), and if the collation results do not match (S119), the system Is notified of a signature error (S121). If the collation results match, the process ends normally.

  Here, the signature value, CRC value, and random number value in the present embodiment will be described.

  FIG. 8 is a diagram illustrating an example of generating a signature value from a CRC value and a random number sequence in the present embodiment.

  As shown in FIG. 8, when the upper 16 bits 81 of the 32-bit CRC value 80 is “m” and the lower 16 bits 82 are “n”, the random number sequence A83 stored in the main memory is Of the 32-bit random value 84 (“RAVn”) with index: “n” and the random number sequence B85 stored in the main memory 13 (see FIG. 3), the 32-bit random value 86 with index: “m” (“ 64-bit signature value 87 (“RAVn” + “RBVm”) is generated from the RBVm ”).

  Here, as the random number, a random number obtained from existing hardware (such as an information recording device) disclosed in the random number generator [RFC1750] can be used. In order to detect transmission path data errors using random numbers as described above as information identifiers (signatures) necessary for digital signature generation and verification processing for each piece of information stored in an information recording device such as a hard disk. The data is stored in the main memory in association with the output value of the CRC value generation unit, which is originally installed in the information recording apparatus I / F unit (or the final data value of the encrypted stream, etc.).

  The 32-bit CRC value 80 in the present embodiment corresponds to the first or second shortened information referred to in the present invention, and the 32-bit random value 84 (“RAVn”) and 32 in the present embodiment. The bit random number 86 (“RBVm”) corresponds to the first or second random number referred to in the present invention, and the 64-bit CRC value 87 in the present embodiment is the first or second random number referred to in the present invention. It is equivalent to a signature.

  As described above, according to the information processing apparatus of the present embodiment, as described above, an information processing apparatus with high security strength can be obtained without requiring security processing means having a large hardware scale such as a hash value generation circuit. On the other hand, in the prior art, it is necessary to implement a hash value generation circuit configured by hardware as shown below.

  FIG. 9 is a circuit diagram of a main part of a conventional information processing apparatus in which a hash value generation circuit is mounted.

  Differences between the configuration of the information processing apparatus according to the present embodiment and the configuration of the conventional information processing apparatus will be described while comparing FIG. 9 and FIG. As shown in FIG. 9, the hash value generation circuit 17c is mounted in the security processing unit 17 ′ of the conventional information processing apparatus, whereas the security processing of the information processing apparatus (see FIG. 3) of the present embodiment. There is no part 17 corresponding to the hash value generation part 17c.

  Thus, according to the present invention, it is possible to realize an information processing apparatus with low cost and high security strength without mounting a hash value generation circuit which is a large-scale hardware as in the prior art.

It is a schematic block diagram of the information processing apparatus of one Embodiment of this invention. It is a figure which shows the further detailed structure of the information processing apparatus of this embodiment. It is a circuit diagram of the principal part of the information processing apparatus of this embodiment. It is a flowchart which shows the storage operation | movement to the hard disk of the information in the information processing apparatus of this embodiment. It is a figure which shows the condition of the transition of the information main body in the information processing apparatus of this embodiment. It is a figure which shows the condition of the transition of the signature corresponding to the information in the information processing apparatus of this embodiment. It is a flowchart which shows the information read-out operation | movement from the hard disk in the information processing apparatus of this embodiment. It is a figure which shows an example which produces | generates a signature value from the random number sequence and CRC value which were memorize | stored in the main memory. It is a circuit diagram of the principal part of the conventional information processing apparatus by which the hash value generation circuit was mounted.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Information processing apparatus 2 Information recording apparatus 3 Abbreviated information generation part 4 Random number memory | storage part 5 Signature generation part 6 Signature collation part 11 CPU
12 Internal I / F
13 Main memory 13a Information storage area 13b Random number storage area 14 Control panel 15 Network control unit 16 Hard disk 17, 17 'Security processing unit 17a Signature generation / verification unit 17b Encryption / decryption unit 17c Hash value generation circuit 18 Internal I / F Control unit 18a DMA control unit 19 Information recording device I / F control unit 19a CRC generation unit 19b Header addition / removal unit 19c CRC addition / verification unit 19d Transmission encoding / decoding unit 20 Information recording device I / F
80 32-bit CRC value 81 Upper 16 bits 82 Lower 16 bits 83 Random number sequence A
84,86 32-bit random value 85 Random number sequence B
87 64-bit signature value

Claims (1)

In an information processing apparatus that includes an information recording device that records information in a readable manner, and that inputs and outputs information to and from the information recording device,
Based on the information, the CRC value generator for generating a CRC value corresponding to the information,
A random number storage unit for storing a plurality of random numbers associated with the value derived from the CRC value ;
The CRC value generation unit generates a first CRC value corresponding to the information recorded in the information recording device, takes out a first random number corresponding to the first CRC value from the random number storage unit, and A first signature based on the first random number is generated, and the CRC value generation unit is caused to generate a second CRC value corresponding to the information received from the information recording device, and the second random number storage unit generates the second signature. A signature generation unit that extracts a second random number corresponding to the CRC value of the first and generates a second signature based on the second random number;
An information processing apparatus comprising: a signature verification unit that verifies the first signature and the second signature generated by the signature generation unit.

Images