JPH0777933A - Network data ciphering device - Google Patents

Abstract

PURPOSE:To provide the network data ciphering device which is fast in process speed and securely keeps secrecy. CONSTITUTION:Plural computer systems 2, 3, and 4 are connected by a communication line 1. On the computer systems 2, 3, and 4, data ciphering parts 5, data multiplication parts 6, key ciphering parts 7, key multiplication parts 8, communication control parts 9, and common key generation parts 10 are provided. An open key data base 11 in which an open key PK for ciphering a key CK is stored is connected to each key ciphering part 7. A private key data base 12 in which data on a private key SK corresponding to each computer system is connected to its key multiplication part 7.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network data encryption device for encrypting and transmitting data between computer systems constituting a computer network and decrypting the received data.

[0002]

2. Description of the Related Art When transmitting and receiving important data between computer systems on a computer network, a method of encrypting and transmitting the data is generally used so that the contents of the data cannot be read by a third party. The destination computer system can obtain the original data by decrypting the received encrypted data.
For encryption and decryption, data called a key that is smaller than the data to be transmitted / received is usually used. The encryption method of such transmission / reception data can be roughly classified into a conventional encryption method and a public key encryption method depending on the properties of the keys used for encryption and decryption.

First, the conventional encryption method is a method in which the same key is used for encryption and decryption, and generally the processing speed of encryption and decryption is high. Therefore, it is suitable for handling large-scale data.

On the other hand, the public encryption method is a method using different keys for encryption and decryption. In this way, the encryption key is in a widely known state, so that anyone can use the key to encrypt data from other computer systems.
However, the key used to decrypt the encrypted data is kept secret. In this way, the user only needs to keep the key used for the decryption secret, so that the key can be easily managed even in a large network.

[0005]

However, when the above-mentioned conventional encryption method is used alone, there are the following problems, respectively. That is, according to the conventional encryption method, the same key is managed by the computer system on the data transmission side and the computer system on the data reception side, which is likely to be known to a third party. Especially,
In a large network, many computer systems are connected, and it is difficult to conceal and manage the key from a third party.

On the other hand, the public key encryption method uses different keys for encryption and decryption, so it is easy to keep secret, but the processing speed is slower than that of the conventional encryption method, so that large scale data can be stored. Is unsuitable for dealing with.

The present invention has been proposed in order to solve the above-mentioned problems of the conventional example, and an object thereof is to provide a network data encryption device which has a high processing speed and can securely maintain confidentiality. It is to be.

[0008]

In order to solve the above problems, the invention according to claim 1 connects a plurality of computer systems by a communication line, and the computer systems are mutually encrypted. Data encryption means for encrypting the data to be transmitted using the first key, and key encryption means for encrypting the first key using the second key Is provided in the computer system on the transmitting side, and the first key encrypted with the second key is decrypted with the key decryption means for decrypting with the third key, and with the third key. Further, the network data encryption device is characterized in that the data encryption means for decrypting the data encrypted by the first key using the first key is provided in the receiving side computer system.

According to a second aspect of the present invention, in the network data encryption apparatus according to the first aspect, the data encryption means and the data decryption means perform encryption and decryption by a conventional encryption method. The key encryption means and the key decryption means are for performing encryption and decryption by a public key encryption method.

Further, the invention according to claim 3 is the same as claim 2
In the network data encryption device described above, the third key is set so that it can be used only in the receiving computer system.

[0011]

The operation of the present invention having the above construction is as follows. That is, according to the first aspect of the invention, in the data encryption means, the first data to be transmitted is transmitted.
Encrypt with the key of. Also, the key encryption means encrypts the first key using the second key. And
The sending computer system sends the encrypted data and the encrypted key to the receiving computer system.

In the key decryption means of the computer system on the receiving side, the received key is decrypted using the third key to obtain the first key. Then, the data decryption means decrypts the received encrypted data using the first key to obtain the data.

According to the second aspect of the invention, since the data encryption and decryption by the data encryption means and the data decryption means are based on the conventional encryption method using the same key for encryption and decryption, The processing speed is fast. Since the encryption and decryption of the key by the key encryption means and the key decryption means is based on the public key encryption method using different keys for encryption and decryption, the certainty of confidentiality is increased. The public key encryption method has a low processing speed, but since the key is a small-scale data, there is no significant delay.

In the third aspect of the invention, since the third key can be used only in the receiving computer system, it is possible to ensure the confidentiality.

[0015]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of a network data encryption device according to the present invention will be described below with reference to the drawings. In addition,
FIG. 1 is a block diagram showing the configuration of the entire network, FIG. 2 is a flowchart showing the procedure of encryption and decryption according to the embodiment, and FIG. 3 is a diagram showing the data flow in the embodiment.

(1) Configuration of Embodiment An embodiment corresponding to the inventions of claims 1 and 2 will be described below. The data encryption means according to claim 1 is a data encryption part, the first key is a conventional key CK, the second key is a public key PK, the key encryption part is a key encryption part, and the key decryption part is The key decryption unit, the third key is the private key SK, and the data decryption means is the data decryption unit. The computer system according to the present embodiment has both transmission and reception.

First, the structure of this embodiment will be described below.
That is, in this embodiment, as shown in FIG.
Is configured by connecting a plurality of computer systems 2, 3, and 4. A data encryption unit 5, a data decryption unit 6, a key encryption unit 7, a key decryption unit 8, a communication control unit 9, and a conventional key generation unit 10 are provided on each of the computer systems 2, 3 and 4. The respective units are connected by a predetermined line (not shown). The data encryption unit 5 and the data decryption unit 7 use the conventional key CK generated by the conventional key generation unit 10 to encrypt and decrypt data by a conventional encryption method.

The key encryption unit 7 is for encrypting the data of the conventional key CK by the public key encryption method. The key encryption unit 7 is connected to a public key database 11 that stores a public key PK for encrypting the conventional key CK. The public key PK of this public key database can be referenced from any computer system.

Furthermore, a private key database 12 storing data of private keys SK corresponding to the respective computer systems is connected to the key decoding section 7. The private key SK is kept secret only by the user of the computer system to which the private key database 12 in which the private key SK is stored is connected.

(2) Operation of the Embodiment The operation of this embodiment having such a configuration will be described with reference to an example of transmission / reception between computer systems. In this example, the computer system 2 encrypts and transmits the data X, and the destination computer system 3 receives the data X and then decrypts the encrypted data to obtain the original data. Note that, for example, data obtained by encrypting the data M using the key K will be expressed as {M} K.

First, as shown in FIG. 2, the transmitting user who uses the computer system 2 determines whether the conventional key generation unit 10
At, the conventional key CK used in the conventional encryption method is arbitrarily generated (step 201). The data X is encrypted by the conventional encryption method using the conventional key CK in the data encryption unit 5 to generate the data {X} CK (step 202). At the same time, the transmitting user acquires the public key PK corresponding to the computer system 3 of the transmission destination (step 203). The conventional key CK is encrypted in the key encryption unit 7 by the public key encryption method using the public key PK to generate the key {CK} PK (step 20).
4).

Next, the generated data {X} CK and key {CK} PK are sent to the computer system 3 through the communication line 1 by the communication control unit 9 (step 205).

Then, the computer system 3 receives the transmitted data (step 206), and the receiving user receives the received data (the computer system 2).
First, the key {CK} PK is extracted from the (transmission data from). Further, the receiving user acquires the private key SK used in the public key encryption method from the private key database 12 (step 207). The key {CK} PK is decrypted in the key decryption unit 8 by the public key encryption method using the private key SK, and the original conventional key CK is generated (step 20).
8).

Further, in the data decoding section 6, the data {X} CK which is the rest of the received data is decoded by the conventional encryption method using the restored common key CK to obtain the data X (step 209). . As described above, the data X
When the transmission / reception of is completed, the conventional key CK of the conventional encryption method is discarded (step 210).

(3) Effects of the Embodiment The effects of this embodiment as described above are as follows.
That is, unless the private key SK is known, the key {CK} PK cannot be compounded to obtain CK. If the key {CK} PK cannot be obtained, the data X cannot be combined from the data {X} CK. Therefore, if only the private key SK is kept secret from a third party, the confidentiality of the data is surely maintained. Moreover, since the conventional key CK is discarded after the data X is combined, the certainty of confidentiality is increased.

Further, the large-scale data X is encrypted and decrypted at a high processing speed because a high-speed conventional encryption method is used. On the other hand, for the encryption and decryption of the conventional key, a public key encryption method with high confidentiality is used. The public key encryption method is slow, but the scale of the conventional key is small, so the processing speed does not decrease as much as the entire data X is processed by the public key encryption method. Therefore, the confidentiality of the confidentiality is high and the processing speed is high in the entire processing of this embodiment.

(4) Other Embodiments The present invention is not limited to the above embodiments. For example, an embodiment corresponding to the invention of claim 3 will be described below. That is, the configuration of each unit is the same as that of the above embodiment, and the private key SK is set so that it can be used only by the computer system to which the private key database 12 in which the private key SK is stored is connected. Then, since the private key SK can be used only by the receiving computer system, even if the private key SK is leaked, the key {CK} can be used in another computer system.
The PK cannot be compounded and the data {X} CK cannot be compounded, so the certainty of confidentiality increases.

Further, the number of each component and the like can be changed appropriately. For example, any number of computer systems may be connected.

[0029]

As described above, according to the present invention, a network data encryption apparatus which has a high processing speed and can securely perform confidentiality is provided by providing a key encryption means and a key decryption means in a computer system. Can be provided.

[Brief description of drawings]

FIG. 1 is a block diagram showing the configuration of an embodiment of the present invention.

FIG. 2 is a flowchart showing a processing procedure of encryption and decryption according to an embodiment of the present invention.

FIG. 3 is an explanatory diagram showing a data flow in one embodiment of the present invention.

[Explanation of symbols]

 1 ... Communication line 2, 3, 4 ... Computer system 5 ... Data encryption unit 6 ... Data decryption unit 7 ... Key encryption unit 8 ... Key decryption unit 9 ... Communication control unit 10 ... Conventional key generation unit 11 ... Public Key database 12 ... Private key database 201 and later ... Each step of the procedure

Claims (3)

[Claims] 1. A computer network comprising a plurality of computer systems connected by a communication line and capable of transmitting and receiving mutually encrypted data between the computer systems, wherein the data to be transmitted is encrypted using a first key. A data encryption means for encrypting and a key encryption means for encrypting the first key with the second key are provided in the computer system on the transmitting side, and the first key encrypted with the second key is provided. , Using the key decryption means for decrypting using the third key and the first key decrypted using the third key, decrypting the data encrypted by the first key A network data encryption device, characterized in that data decryption means is provided in a receiving computer system. 2. The data encryption means and the data decryption means perform encryption and decryption by a conventional encryption method, and the key encryption means and the key decryption means are public key encryption. 2. The network data encryption device according to claim 1, wherein the network data encryption device performs encryption and decryption by an encryption method. 3. The network data encryption device according to claim 2, wherein the third key is set so that it can be used only in the receiving computer system.