JPH07134548A - Data ciphering system - Google Patents

Abstract

PURPOSE:To provide the data ciphering system capable of maintaining the security of data and reducing the cost required for maintaining the security. CONSTITUTION:This data ciphering system has a computer 1, an external memory device 2 and a portable device 7 which is freely attachably and detachably connected to the external memory device 2 and inputs secrete information to the external memory device 2. A data key forming means 12 forms a key for ciphering and decoding of the data in accordance with the secret information from the portable device 7. A data ciphering means 11 ciphers and decodes the data by using the key formed by the data key forming means 12.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a data encryption system for encrypting and decrypting data stored in an external storage medium of a computer system.

[0002]

2. Description of the Related Art In recent years, as computer systems have become OA and electronic, many users have come to access one computer system. Therefore, there is a possibility that the confidential data may be leaked to another person when the confidential data is transmitted and received. Therefore, when storing confidential data in the external storage medium, it is necessary to retain the confidential data by encryption.

As a data encryption system for encrypting data stored in such an external storage medium, for example,
There is JP-A-3-261798. In this system, a data key generation circuit provided in a computer generates only a key for encrypting and decrypting data. Then, this key is sent to the data encryption circuit and the data decryption circuit in the external storage device. Further, the data encryption circuit and the data decryption circuit perform encryption and decryption of the data, so that the data transfer capability (throughput) between the computer and the external storage device is not reduced.

[0004]

As described above, in the conventional encryption system, the data key generation circuit for generating the key for the data encryption and the data encryption and the data encryption for the data encryption and the data decryption. It was equipped with a conversion circuit. These data key generation circuit and data encryption circuit need to be configured to withstand external attacks in order to maintain the confidentiality of data. Therefore, the cost of these circuits becomes a problem.

For example, when a large computer is used, the cost of the circuit is low, but when a small computer such as a workstation or a personal computer is used, the cost of the circuit is considerable.

Further, there is an overhead that the data key generation circuit in the computer must generate the key and then send the key to the data encryption circuit in the external storage device. Furthermore, in the case of a small computer, the soft access control is weaker than that of a large computer. For this reason, it has been desired that the secret information for generating the key is not stored in the data key generation circuit in the computer but is carried by an individual and the secret information is input only when necessary.

Further, as a data encryption system for encrypting data stored in an external storage medium, there is, for example, Japanese Patent Laid-Open No. 55-32074, and its configuration is shown in FIG. In the encryption system shown in FIG. 8, a key for generating an encryption key is set as a fixed secret key in the encryption processing device 3a. Then, the key is encrypted with a fixed secret key and stored in the external storage medium 6.

However, this known example has the following problem because a fixed key is set in the encryption processing device 3a. When the device becomes large, the external storage medium 6
There was a problem of how to deliver the key when the key was applied to the device at another place.

If the device is small, there is a risk that the device as a whole will be stolen. Further, since the encrypted key is stored in the external storage medium 6, the damage is great when the private key is decrypted.

The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a data encryption system capable of keeping the confidentiality of data and reducing the cost required for keeping the confidentiality. To provide.

[0011]

The present invention has the following constitution in order to solve the above problems. FIG. 1 shows the principle of the present invention.

The data encryption system of the present invention is connected to the computer 1 for processing data, the external storage device 2 for exchanging data with the computer 1, and the external storage device 2 in a detachable manner, and secret information. The portable storage device 7 for inputting to the external storage device 2 is provided.

The external storage device 2 is provided with an external storage medium such as a magnetic disk, a magnetic tape, or a magneto-optical disk. The external storage device 2 is provided with a data key generation means 12 and a data encryption means 11.

The data key generation means 12 generates a key for encrypting and decrypting the data based on the secret information from the portable device 7. The data encryption means 11 uses the key generated by the data key generation means 12 to encrypt and decrypt the data.

Here, the portable device 7 is, for example,
Examples include smart cards and IC memory cards. The portable device 7 includes a password storage unit 21, a password input circuit 22, a comparator 23, a storage unit 24, and an access control unit 25.

The password storage unit 21 stores a predetermined password. The password input circuit 22 inputs an arbitrary password. The comparator 23 compares the predetermined password with the entered password.

The storage unit 24 stores secret information. The access control unit 25 reads secret information from the storage unit 24 to the data key generation unit 12 when the input password matches a predetermined password.

Further, the external storage device 2 stores the secret information from the portable device 7 in the data key generation means 12.
May be provided with a portable device interface 13 that supplies

The data encryption key may be variable depending on the header of the data to be encrypted.

[0020]

According to the present invention, the external storage device 2 is provided with the data key generating means 12 and the data encrypting means 11, and the data key generating means 12 provides a key for encrypting and decrypting data for the computer 1. To generate. Since the data encryption means 11 uses the key generated by the data key generation means 12 to encrypt and decrypt the data, for example, the data transfer speed to the external storage medium is not sacrificed and the external storage medium Data confidentiality can be secured. Further, even in a small computer system, the confidentiality of the data encryption key can be maintained at low cost.

Further, it is not necessary for the computer 1 to encrypt the data key and transfer it to the external storage device 2. Further, since the portable device 7 is detachably connected to the data key generating means 12 and the secret information is inputted from the portable device 7 to the data key generating means 12 only when necessary, the key can be moved when the file is moved. It is possible to eliminate the problem of sharing the source and destination computer systems.

[0022]

DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the data encryption system of the present invention will be described below. FIG. 2 is a configuration block diagram of an embodiment of the data encryption system of the present invention. The system shown in FIG. 2 is an example in which a key for encryption and decryption of data is generated in an external storage device. <Structure of Embodiment> In FIG. 2, an external storage device 2 for exchanging data with the computer 1 is connected to the computer 1 for processing data. The external storage device 2 is, for example, a magnetic tape, a magnetic disk, a magneto-optical disk, or the like.

To the external storage device 2, a portable device 7 and an external storage medium 6 which can be carried by a person are connected. The external storage device 2 includes an encryption processing device 3, a computer interface control unit 4, and an external storage medium interface control unit 5.

The computer interface control unit 4 is connected to the computer 1 and controls input / output between the computer 1 and the external storage device 2. The encryption processing device 3 is connected to the computer interface control unit 4.

The encryption processing device 3 is for encrypting and decrypting data for the computer 1, and comprises a data encryption circuit 11, a data key generation circuit 12, a portable device interface 13 and a control circuit 14. ing.

The portable device interface 13 is connected to the portable device 7, and the portable device 7 and the external storage device 2 are connected.
It controls input and output between and. Mobile device interface 13
The data key generation circuit 12 is connected to.

The data key generation circuit 12 generates a key for encrypting and decrypting data according to the secret information sent from the portable device interface 13. The data encryption circuit 11 is connected to the data key generation circuit 12.

The data encryption circuit 11 uses the data from the computer interface control unit 4 as the data key generation circuit 12
It is encrypted according to the data encryption key from. Further, the data encryption circuit 11 converts the encrypted data from the external storage medium interface control unit 5 into the data key generation circuit 12
Decrypt according to the data encryption key from.

The control circuit 14 is composed of, for example, a microprocessor and controls the data encryption circuit 11, the data key generation circuit 12, and the portable device interface 13.

The external storage interface controller 5 controls input / output between the encryption processing device 3 and the external storage medium 6.
The external storage medium 6 stores a program to be controlled by the control circuit 14 and also stores encrypted data.

The portable device 7 is, for example, a smart card or an IC memory card. The portable device 7 also controls access by a password so that it cannot be used by anyone other than the owner.

FIG. 6 shows an example of the portable device 7. The portable device 7 includes a password register 21, a password input circuit 22, a comparator 23, and an access control circuit 2.
5 and.

The password register 21 stores a predetermined password. Password input circuit 22
Is a keypad, for example, for a user to input a password.

The comparator 23 compares the password value stored in the password register 21 with the password value input to the password input circuit 22. When these password values match, the access control circuit 25 reads the secret information 24 and sends it to the mobile device interface 13. <Operation of Embodiment> FIG. 3 is a diagram showing a detailed configuration of the encryption processing device. FIG. 6 is a flowchart showing the data storage process of the embodiment. The operation of the embodiment will be described with reference to the drawings. (Data Storage) First, the case where the data from the computer 1 is encrypted and stored in the external storage medium 6 will be described.

First, the computer 1 instructs the external storage device 2 to store data via the computer interface control unit 4 (step 101). In the encryption processing device 3, the portable device 7 is the portable device interface 1
It is checked whether or not it is connected to No. 3 (step 102).

Here, when the portable device 7 is not connected to the portable device interface 13, the computer 1
A set request message for the portable device 7 is displayed on the screen (step 103).

On the other hand, when the portable device 7 is connected to the portable device interface 13, the portable device interface 13 reads the secret information from the portable device 7 in the encryption processing device 3 (step 104).

The reading of the secret information from the portable device 7 at this time will be described in detail below. First, in the portable device 7 shown in FIG. 5, first, a power source (not shown) is operated to activate the circuit. Next, an arbitrary password is input from the password input circuit 22. Then, the predetermined password value is read from the password register 21. It is compared by the comparator 23.

When these values match, the control circuit 14 shown in FIG. 3 follows the data storage instruction from the computer interface and the portable device interface 1
3, the secret information for key generation is read from the secret information register 24 through the access control circuit 25 in the portable device 7.

Next, the portable device interface 13
According to a control signal from the control circuit 14, a random number such as a file name or date is sent to the data key generation circuit 12 together with the secret information. That is, a file name or a random number such as a date is added to the header portion of the file as the information of the generated key.

The data key generation circuit 12 uses the secret information,
A data encryption key is generated based on the file name (step 105). This data encryption key is sent to the data encryption circuit 11 according to the control signal of the control circuit 14.

Further, the control circuit 14 sends a ready signal for transferring data from the computer 1 (step 1
06). Since the computer 1 receives the ready signal and transfers the data, the data is sent from the computer 1 to the data encryption circuit 11 through the computer interface control unit 4. The data is processed by the data encryption circuit 11.
It is encrypted according to the data encryption key from the data key generation circuit 12 (step 107).

Further, this encrypted data is stored in the external storage medium 6 via the external storage medium interface control section 5 (step 108). Here, what is stored in the storage medium 6 is a file name or the like, and the encrypted encryption key is not stored.

As an example of the generation algorithm of the data encryption key generation circuit, the DE using the built-in secret key is shown in FIG.
S (Data Encryp-tion Standard) is shown. DE
S is a block cipher that inputs a 64-bit plaintext (ciphertext) and outputs a 64-bit ciphertext (plaintext) under the control of a 56-bit key.

DES encrypts and decrypts in units of 64-bit data blocks. The key length is 56 bits (8
It is 64 bits when the parity bit of the bits is added. Cryptographic algorithms are based on transposition and substitution. In the DES encryption, a process in which these transpositions and substitutions are appropriately combined is repeated to stir the bit patterns of plaintext and convert them into ciphertexts that do not make sense. Further, in the decryption, the original plaintext is decrypted by reversely stirring.

In the example shown in FIG. 4, first, the DES 32
By encrypting the secret information (plaintext) stored in the secret information register 24 using the built-in secret key, the ciphertext Ku
To generate. Further, the DES 34 encrypts the file name with the generated ciphertext Ku to generate a data encryption key. A data encryption key can also be generated using such a DES. (Reading of Data) Next, a case of reading the encrypted data from the external storage medium 6 to the computer 1 will be described. FIG. 7 is a flowchart showing the data read processing of the embodiment.

First, the computer 1 issues a data read instruction to the external storage device 2 via the computer interface control unit 4 (step 201). Then, the encryption processing device 3 checks whether or not the portable device 7 is connected to the portable device interface 13 (step 202).

Here, when the portable device 7 is not connected to the portable device interface 13, the computer 1
A set request message for the portable device 7 is displayed on the screen (step 203).

On the other hand, when the portable device 7 is connected to the portable device interface 13, the portable device interface 13 reads the secret information from the portable device 7 in the encryption processing device 3 (step 204).

The control circuit 14 reads the secret information for key generation from the secret information register 24 through the access control circuit 25 in the portable device 7 through the portable device interface 13 according to the data read instruction from the computer interface.

Next, the portable device interface 13
This secret information is sent to the data key generation circuit 12 according to the control signal from the control circuit 14. Data key generation circuit 12
Generates a data decryption key based on the secret information (step 205). This data decryption key is sent to the data encryption circuit 11 according to the control signal of the control circuit 14.

Further, the control circuit 14 sends a ready signal for transferring data to the computer 1 (step 20).
6). After that, the data sent from the external storage medium 6 through the external storage interface control unit 5 is decrypted by the data encryption circuit 11 according to the data decryption key sent from the data key generation circuit 12 (step 207). .

The decrypted data is sent to the computer 1 through the computer interface control unit 4 (step 2).
08). Here, in the data encryption circuit 11, as the target key number, for example, the DES or the high-speed data encryption algorithm, that is, FEAL (Fast DataEncip
When using herment Algorithm-8) etc., the data encryption key and the data decryption key have the same value.

Whether or not encryption and decryption are performed is determined by the header of the file. As described above, according to this embodiment, the external storage device 2 is provided with the data key generation circuit 12 and the data encryption circuit 11, and the data key generation circuit 12 is a key for encrypting and decrypting data for the computer 1. To generate.

Then, the data encryption circuit 11 uses the key generated by the data key generation circuit 12 to encrypt and decrypt the data. Therefore, for example, the external storage medium 6
The confidentiality of the data in the external storage medium 6 can be ensured without sacrificing the data transfer speed to the. Further, when the present invention is applied to a medium-sized or small-sized computer system, the cost can be further reduced and the demand for encryption in the medium-sized or small-sized computer system is expanded.

Further, there is no need for the computer 1 to encrypt the data key and transfer it to the external storage device 2. Furthermore, since the portable device 7 is detachably connected to the data key generation circuit 12 and the secret information for generating the key from the portable device 7 is input to the data key generation circuit 12 only when necessary,
It is possible to eliminate the problem of how to share a key between the source and destination computer systems when moving a file.

For example, in comparison with the conventional example shown in FIG. 8, this embodiment has the following effects. In the embodiment, since the key is generated by using a highly secure portable device 7 such as a smart card, the problem of key delivery is eliminated. In addition, even if both the storage medium and the portable device are stolen, the data cannot be used and the security is secured unless the owner's password is known.

Further, the key is made variable by using a part of the header of the file, and the information regarding the key does not exist in the encrypted form in the external storage medium 6, so that the security is secured.

[0059]

According to the present invention, the external storage device is provided with the data key generating means and the data encrypting means, and the data key generating means generates the key for encrypting and decrypting the data for the computer, The data encryption means encrypts and decrypts the data using the generated key.

Therefore, the confidentiality of the data in the external storage device can be secured without sacrificing the data transfer speed to the external storage device, and the security is improved. Further, when the present invention is applied to a medium-sized or small-sized computer system, the cost can be further reduced and the demand for encryption in the medium-sized or small-sized computer system is expanded.

Further, according to the present invention, by storing the information as the source of the key in the portable device, the problem of how to share the key between the source and destination computer systems when the file is moved. Can be eliminated.

[Brief description of drawings]

FIG. 1 is a principle diagram of the present invention.

FIG. 2 is a configuration block diagram of an embodiment of the present invention.

FIG. 3 is a configuration block diagram of an encryption processing device.

FIG. 4 is a diagram showing an example of data key generation.

FIG. 5 is a configuration block diagram of a portable device.

FIG. 6 is a flowchart showing a data storage process according to the embodiment.

FIG. 7 is a flowchart showing a data read process of the embodiment.

FIG. 8 is a configuration diagram showing an example of a conventional data encryption system.

[Explanation of symbols]

 1 ... Computer 2 ... External storage device 3 ... Encryption processing device 4 ... Computer interface control unit 5 ... External storage medium interface control unit 6 ... External storage medium 7 ... Portable device 11 ... Data encryption Circuit 12 ... data key generation circuit 13 ... portable device interface 14 ... control circuit 21 ... password register 22 ... password input circuit 23 ... comparator 24 ... secret information register 25 ... access control unit

 ─────────────────────────────────────────────────── ─── Continued Front Page (72) Inventor Ryota Akiyama 1015 Kamiodanaka, Nakahara-ku, Kawasaki-shi, Kanagawa Fujitsu Limited

Claims (4)

[Claims] 1. A computer (1) for processing data, an external storage device (2) for exchanging data with the computer (1), and a detachable connection to the external storage device (2). A portable device (7) for inputting confidential information to the external storage device (2), wherein the external storage device (2) stores the data based on the confidential information from the portable device (7). Data key generation means (12) for generating a key for encryption and decryption, and data encryption for performing encryption and decryption of the data using the key generated by the data key generation means (12) A data encryption system comprising means (11). 2. The portable device (7) according to claim 1, wherein the portable device (7) stores a predetermined password and a password input circuit (2) for inputting an arbitrary password.
2), a comparator (23) for comparing a predetermined password with an input password, a storage unit (24) for storing the secret information, and the input password matches the predetermined password. At this time, the access control unit (2) for reading the secret information from the storage unit (24) to the data key generation means (12)
5) A data encryption system comprising: 3. The external storage device (2) according to claim 1 or 2, wherein the secret information from the portable device (7) is stored in the data key generation means (12).
A data encryption system comprising a portable device interface (13) to be supplied to the device. 4. The data encryption system according to claim 1 or 2, wherein the data encryption key is variable depending on a header of data to be encrypted.