JPH09204360A - Method for protecting confidential data - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent confidential data from being left decoded by a user and secrets from leaking. SOLUTION: The new generation of a confidential file, a ciphering command, a deciphering command and the occurrence of a specified event are checked in this order. In the case of the new generation of the confidential file, the set of the confidential data is updated and the present states (ciphered/non- ciphered states) are set (S11 and S12). In the case of the ciphering/diciphering commands, object data are ciphered/deciphered and the present state is updated at the time (S13-S16). In the case that the specified event occurs, based on the present states of the respective confidential data, a ciphering protective processing for ciphering the confidential data in the non-ciphered state and eliminating original non-ciphered data is executed (S17 and S18).

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for protecting confidential data which is used in all fields where encryption is effective as a countermeasure against secret leakage when handling confidential data in a digital computer.

[0002]

2. Description of the Related Art Conventionally, when handling confidential data with a digital computer, it has been practiced to encrypt the data as one of countermeasures against leakage of secret. This is to encrypt and store confidential data according to a predetermined rule.

In order to confirm the content of the encrypted data, it is necessary to decrypt the data and restore the original state. As a result, it is possible to prevent a person other than the person himself / herself from easily confirming the content of the data, and to maintain the confidentiality of the data.

[0004]

As described above, conventionally, when confidential data is handled by a digital computer, the confidentiality is maintained by encrypting the data. However, when using encryption technology as a measure against secret leakage, when decrypting the data, keep the state as it is, that is, save the data without encrypting it again, or forget to erase it after decrypting it. Is a problem.

Incidentally, for example, an encryption tool PGP (prettygood private) which is widely used all over the world.
cy) has the option to erase the original data when encrypting. However, there is no function for preventing the user from forgetting to delete the decrypted data or forgetting to encrypt it.

The present invention has been made in view of the above points, and provides a method of protecting confidential data which can prevent the confidential data from being leaked by a user while the confidential data is left decrypted. The purpose is to provide.

[0007]

A method for protecting confidential data according to the present invention stores a set of confidential data and state information indicating that the current state of the confidential data is an encrypted state or a non-encrypted state. When the encryption command or the decryption command is executed, the above status information is updated, and the occurrence of a pre-specified event is used as a trigger to encrypt the confidential data in the non-encrypted status based on the above status information, The encryption protection process is performed to delete the original non-encrypted data.

According to such a method, the current state (encrypted / non-encrypted state) of each confidential data is updated when the encryption command or the decryption command is executed, and the power supply is designated in advance, for example. When the generated event occurs, the encryption protection processing is executed based on the state information of each confidential data. As a result, the confidential data in the non-encrypted state is automatically encrypted, and the original non-encrypted data is deleted at that time.

[0009]

BEST MODE FOR CARRYING OUT THE INVENTION

(First Embodiment) First, a method for protecting confidential data according to a first embodiment of the present invention will be described.

The confidential data is data which is not desired to be left unencrypted here. Normally, the user himself / herself determines whether or not the given data is confidential data.

In the initial state (the state where there is no data in the system), the confidential data set is an empty set,
It is also not necessary to store state information indicating whether their current state is an encrypted state or a non-encrypted state. Note that the collection of confidential data does not have to be one in the system. It may exist for each user as will be described in later embodiments.

FIG. 1 is a flow chart for explaining a method of protecting confidential data according to the first embodiment. Here, ・ Create a new confidential file ・ Encryption command ・ Decryption command ・ Check the occurrence of specified events in order.

A. Processing when newly creating or introducing a confidential file When newly creating confidential data, or when introducing confidential data via a network or a floppy disk (step S11), a set of confidential data is updated and Current state (encrypted / unencrypted state)
Is set (step S12). Specifically, for example,
The following implementation methods are possible.

Here, the confidential data set is updated and the current state is set. The two processes will be described separately. <Method of updating confidential data set> (1) When data is introduced into a local storage device via a network or a floppy disk, the user inputs whether the data is confidential data. The current state of the data also follows the user's input. In this case, the data itself may be confidential / non-sensitive data, encrypted /
If attribute information indicating the non-encrypted state is added, an automatic registration method can be considered.

In either method, if it is determined that the data is confidential, the data is added to the set of confidential data. (2) In the case of creating new data, the user inputs whether the data is confidential data or the current state. Also in this case, if it is determined that the data is confidential, the data is added to the set of confidential data.

<Setting of current state of each confidential data> The user inputs whether the confidential data is in the encrypted state or not.
In this case, there may be a case where the encryption operation is performed multiple times from the non-encrypted state. It is assumed that the user can know this number. Normally, the user knows this number of times when newly creating data. When data is introduced, this number can be known in advance, or by executing the decoding command and checking how many times it becomes meaningful data. This number of times is called the encryption level.

Therefore, when a confidential file is newly created or introduced, the current state of data can be set by user input. The encryption level is also stored here.

B. Processing at the time of executing encryption (decryption) command When executing an encryption command or a decryption command (steps S13 and S15), if the command is an encryption command, the target data is encrypted, and if it is a decryption command. For example, while decrypting the target data, the current state of each confidential data is updated as follows (step S
14, S16).

Here, it is realized by using integer data called encryption level. The encryption level can be calculated as follows. If it is encryption, set the encryption level of the target file to 1
Just raise. If it is decryption, the encryption level of the target file is lowered by 1. As a result, the encryption level is "0".
, It is possible to determine that it is in the non-encrypted state, and otherwise it is in the encrypted state, and it is clear that the current state can be updated in response to the execution of the encryption (decryption) command.

The method for updating the current state at the time of executing the encryption / decryption command will be described in more detail. There are the following two methods. (1) A method of calculating the encryption level as a side effect of the encryption / decryption command as described above. To calculate the encryption level as a side effect of a command means that the encryption / decryption command has a function to calculate the encryption level in advance, and the encryption level is calculated when the command is executed. is there.

(2) A method in which a task for monitoring whether or not an encryption (decryption) command is executed is run, and the task calculates the encryption level by the above method. This can be realized only in a multitasking system that performs a plurality of tasks at one time on one computer system.

C. Processing when designated event occurs For example, when a previously designated event such as power-off occurs (step S17), the encryption protection processing is performed as follows (step S18). The event detection method differs depending on what kind of event is focused on.

<Encryption Protecting Operation> Since a set of confidential data is stored, the current state of each confidential data is checked, and the data in the non-encrypted state is encrypted. At that time, all the original data is deleted.

As described above, while the current state is updated when the encryption / decryption command is executed, the occurrence of a predetermined event is used as a trigger to perform non-encryption based on the current state of each confidential data. Encrypt sensitive data that is in a state,
By deleting the original non-encrypted data, it is possible to prevent the confidential data from being left as it is and being leaked.

Although FIG. 1 shows an example in which the conditions are sequentially judged and realized, it is also clear that an event-driven method can be realized. The event-driven realization method is to detect the occurrence of encryption / non-encryption while a certain process is running, and update the current state of each confidential data.

Next, description will be made on a case where the apparatus is realized. FIG. 2 is a block diagram showing a configuration when the above-described method of protecting confidential data is implemented as a device. FIG.
In the figure, 11 is a central processing unit, which executes a series of processes for protecting confidential data. Here, the command interpreting unit 11a and the confidential data managing unit 11b are used.
Having.

The command interpreter 11a interprets a command input by a user or a command by internal processing of the device. The confidential data management unit 11b performs processing such as updating the current state of the confidential data according to the command interpreted by the command interpretation unit 11a.

Reference numeral 12 denotes a storage device, which comprises, for example, an FDD (floppy disk device), an HDD (hard disk device), etc., and here, a confidential data management information storage section 12a for storing confidential data management information, and confidential data. It has a confidential / non-confidential data storage unit 12b for storing non-confidential data. The confidential data management information indicates a set of confidential data and their current state (encrypted / non-encrypted).

An event detector 13 detects the occurrence of a predetermined event, such as the pressing of a switch for turning off the power, and informs the central processing unit 11 of it.

In such a configuration, the command interpreting unit 11a of the central processing unit 11 interprets the user's command or the command by the internal processing of the device. The process at the time of newly creating or introducing a file is exactly the same as the above A.

When the encrypted command is issued (or when the decrypted command is issued), the command interpreting section 11a passes control to the confidential data managing section 11b. At this time, the confidential data management unit 11b performs the processing described in B above.

The event may be, for example, pressing a switch for turning off the power or resuming. Here, it is assumed that the power-off switch is pressed. When this switch operation is performed,
A signal is sent to the event detector 13, and the event detector 13 sends an interrupt signal to the central processing unit 11. As a result, the central processing unit 11 performs encryption protection processing on the confidential data stored in the storage device 12.

For such an operation, the same function can be realized at the software level by executing a command before the user turns off the power. However, it is considered to be safer to implement the operation at the hardware level as described here because it is possible to prevent the user from forgetting to input a command.

Further, if only the operation when the power is turned off is used as a trigger, it is conceivable that confidential data will remain when the power is turned off due to a power failure or the like. Considering such a case, it is also effective to use an operation at the time of power input as a trigger.

Such a device is effective as part of measures against theft of a portable PC (personal computer), for example. (Second Embodiment) Next, a second embodiment of the present invention will be described. Since the basic processing flow is the same as that in FIG. 1, the description will be omitted by omitting the drawing.

In the second embodiment, a multi-user system such as UNIX is assumed. A multi-user system is a system in which one information resource can be used by a plurality of users at the same time. Here, data that has been encrypted once or data that has been decrypted is defined as confidential data.

That is, the encryption level is calculated as a side effect when executing the encryption / decryption command. As a side effect of encryption / decryption, the confidential data set is checked to see if the data already exists. If not, the data is added to the confidential data set.

The process described in the first embodiment may be performed when a new file is created or introduced, but it is not performed here. This may not correctly indicate how many times the encryption level calculated above has been encrypted from the "true non-encrypted state". However, by calculating the encryption level (that is, the current state) approximately, it is possible to save the user's input work.

Further, it is assumed that when a user logs out, the unencrypted file is encrypted. That is, triggered by the logout of a certain user, the confidential data in the non-encrypted state is encrypted according to the state information of each data, and the encryption protection process of deleting the original non-encrypted data is executed. In UNIX, this can be realized by describing the command to be executed at the time of logout in the logout file.

As described above, even in the multi-user system, the current state is updated when the encryption / decryption command is executed, and the encryption protection process is performed when the user logs out, so that the confidential data can be protected. It is possible to prevent the secret from being leaked and the secret being leaked.

(Third Embodiment) Next, a third embodiment of the present invention will be described. Since the basic processing flow is the same as that in FIG. 1, the description will be omitted by omitting the drawing.

In the third embodiment, a multitask system such as UNIX is assumed. The multi-task system is a system that performs a plurality of tasks (tasks) at once on one computer system.

In a multitasking system, a process is run to monitor each user's encryption / decryption. Similar to the examples so far, the update of the current state (encrypted / non-encrypted state) is realized by calculating the encryption level for each confidential data. At this time, in this example, this calculation is not performed as a side effect of the command, but is performed by the monitoring process. That is, a certain task updates the current state while monitoring the issuance of the encryption / decryption command.

Further, it is conceivable to collectively erase the non-encrypted confidential data at various timings. Here, the encryption protection operation of the confidential file is performed by the monitoring process monitoring the behavior of the system. Various level values are possible, but in the following, the OS (operatin)
An example of implementation at the g system level is shown.

With respect to the swap operation managed by the OS, it is monitored whether or not the confidential data in the non-encrypted state is saved in the swap area, and the encryption and erasing operations are performed to perform the swap (here, The operation is a cryptographically protected operation).
In this case, a decryption operation is added when returning from the swap area to the real memory. This is to prevent sensitive data from being stored in the swap area in a readable format. The realization is obviously possible if the OS can be modified.

As described above, even in the multi-task system, a certain task updates the current state while monitoring the issuance of the encryption / decryption command, and the occurrence of a predetermined event also occurs in that task or another task. Monitored by the task of
If that phenomenon occurs, encryption protection processing can be performed to prevent confidential data from being left as it is and being decrypted.

(Fourth Embodiment) Next, a fourth embodiment of the present invention will be described. Since the basic processing flow is the same as that in FIG. 1, the description will be omitted by omitting the drawing.

In the fourth embodiment, a multitask system such as UNIX is assumed as in the third embodiment, but here, the operation of encrypting and erasing a confidential file is monitored by the behavior of the system. It is characterized in that it is carried out at random or at regular time intervals instead of being carried out at random.

That is, a certain task updates the current state while monitoring the issuance of the encryption / decryption command, encrypts confidential data in the non-encrypted state according to the current state at random or at regular intervals, and Execute the encryption protection process to delete the non-encrypted data of.

As described above, in the multitasking system, even if the encryption protection process is performed at random or at regular intervals, it is possible to prevent the confidential data from being left as it is and being leaked. .

[0051]

As described above, according to the present invention, encryption /
Update the current status (encrypted / non-encrypted status) when executing the decryption command, and execute the encryption protection processing based on the status information for each confidential data when a predetermined event occurs. Therefore, the confidential data in the non-encrypted state can be automatically encrypted, and the original non-encrypted data can be deleted at that time. As a result, when confidential data is handled by a digital computer, it is possible to prevent the confidential data from being left undecrypted and leaked, and to keep the confidentiality.

[Brief description of drawings]

FIG. 1 is a flowchart illustrating a method of protecting confidential data according to an exemplary embodiment of the present invention.

FIG. 2 is a block diagram showing a configuration in the case of realizing the above-mentioned confidential data protection method as an apparatus.

[Explanation of symbols]

 11 ... Central processing unit 11a ... Command interpreting unit 11b ... Confidential data management unit 12 ... Storage device 12a ... Confidential data management information storage unit 12b ... Confidential / non-confidential data storage unit 13 ... Event detection unit

Claims (5)

[Claims] 1. A set of confidential data and state information indicating that the current state thereof is the encrypted state or the non-encrypted state are stored, and when an encrypted command or a decrypted command is executed. Update the above status information, and use the occurrence of a pre-specified event as a trigger to encrypt confidential data that is in the non-encrypted state based on the above status information, and at that time, delete the original non-encrypted data. A method of protecting confidential data, which is characterized by the above. 2. In a multi-user system, a set of confidential data common to each user and status information indicating that the current status thereof is an encrypted status or a non-encrypted status are stored. When the encryption command or the decryption command is executed, the above status information is updated, and when a user logs out, the confidential data that is in the non-encrypted state is encrypted based on the above status information. A method of protecting confidential data, characterized by deleting encrypted data. 3. A multitask system stores a set of confidential data and state information indicating that the current state of the confidential data is an encrypted state or a non-encrypted state. The above status information is updated while monitoring the issuing of the decryption command, and the occurrence of a predetermined event is also monitored by that task or another task, and if that event occurs, it is determined based on the above status information. A method of protecting confidential data, which is characterized by encrypting confidential data that is in an encrypted state and deleting the original non-encrypted data at that time. 4. A multi-task system stores a set of confidential data and state information indicating that the current state of the confidential data is an encrypted state or a non-encrypted state. The above status information is updated while monitoring the issuance of the decryption command, and the confidential data that is in the non-encrypted state is encrypted based on the above status information at random or at regular intervals, and the original non-encrypted data is A method of protecting confidential data, which is characterized by being deleted. 5. A set of confidential data and state information indicating that their current state is an encrypted state or a non-encrypted state are stored, and the current state information is stored in an encryption / decryption command. It has a function to update, updates the above status information as a side effect of executing the command, and triggers the occurrence of a pre-specified event to generate confidential data that is in non-encrypted status based on the above status information. A method for protecting confidential data, characterized in that the original non-encrypted data is deleted at that time.