KR20180015986A - Data encryption management apparatus for supporting life-cycle management of the encryption key and operating method thereof - Google Patents

Abstract

Disclosed are a data encryption management apparatus to support the lifecycle management of an encryption key and an operating method thereof. The data encryption management apparatus according to the present invention includes: a key storage unit which mutually matches and stores information about a predetermined effective use period in order to be used for data encryption about each of a plurality of encryption keys and the plurality of encryption keys; a database which stores a plurality of encryption data generated as encryption is performed with an encryption key stored in response to information about the effective use period where a time point, where a plurality of plain text data are inputted, belongs to in the key storage unit among the plurality of encryption keys about the plurality of plain text data; an encryption key extracting unit which extracts a first encryption key corresponding to information about the effective use period where a time point, where the first plain text data is inputted, belongs to from the key storage unit by confirming time information about the time point where the plain text data are inputted when first plain text data and a data storage command about the first plain text data are inputted; and a data storage unit which stores first encryption data in the database after generating the first encryption data by performing encryption about the first plain text data based on the extracted first encryption key.

Description

TECHNICAL FIELD [0001] The present invention relates to a data encryption management apparatus and a data encryption management apparatus that support lifecycle management of an encryption key and a data encryption /

The present invention relates to techniques for protecting security threats from exposure to data in a system for encrypting and storing a plurality of plaintext data in a database.

Recently, with the widespread use of the Internet and the like, users are increasingly shopping through e-commerce sites or using web-based financial transactions such as Internet banking.

In general, users need to register as a member of a web site because of security concerns in order to use these web-based services.

Also, in recent years, most web sites have been encouraging users to join as members, limiting their access to all the information and functions provided by the website.

Generally, in general websites, personal information such as users' resident registration numbers are collected at the time of membership. The collected personal information is stored and managed in the personal information database of each site operator.

Due to this, in recent years, personal information is leaked due to increasingly advanced hacking techniques such as keylogging, sniffing, phishing, etc., resulting in economic and social damages. The need is increasing.

Accordingly, in order to prevent leakage of personal information of members stored in the personal information database, the operator of each site often encrypts the personal information of members using various encryption techniques and stores the personal information in a personal information database.

As a typical technique for encrypting, storing and managing a large amount of data, there is a method of generating a predetermined encryption key, encrypting the plaintext data using the encryption key, and storing the encrypted data in a database .

However, this data encryption management method has a security vulnerability in that data stored in the database can be easily exposed to a third party when an encryption key is exposed.

Therefore, in order to minimize the possibility of exposure of the encrypted data stored in the database, it is not necessary to encrypt and manage all plaintext data with one encryption key, but rather to encrypt the encryption key used for encryption of plaintext data with the previous encryption key It is necessary to adopt a data encryption management technique capable of enhancing security by performing a renewal operation of using a different encryption key and encrypting the already encrypted data with an encryption key different from the previous encryption key Do.

In order to minimize the possibility of exposure of encrypted data stored in a database, the present invention is not limited to encrypting and managing all plaintext data with one encryption key, To provide a data encryption management technique capable of enhancing security by performing a renewal operation of using a different encryption key and encrypting the already encrypted data with an encryption key different from the previous encryption key do.

The data encryption management apparatus according to an embodiment of the present invention includes a key storage unit for storing a plurality of encryption keys and information on effective usable periods predetermined for use in data encryption for each of the plurality of encryption keys, , Encryption is performed on the plurality of plaintext data with the encryption key stored corresponding to the information on the validity period of time at which the plurality of plaintext data is input on the key storage unit of the plurality of encryption keys When the data storage command for the first plain text data and the first plain text data is input, the time information for the time when the first plain text data is input, And the first plaintext data is input from the second plaintext An encryption key extracting unit for extracting a first encryption key corresponding to information about the container and a second encrypting unit for encrypting the first plain text data based on the extracted first encryption key to generate first encrypted data, 1 < / RTI > encrypted data in the database.

Also, an operation method of a data encryption / management device according to an embodiment of the present invention is a method of encrypting and decrypting a plurality of encryption keys and a plurality of encryption keys, And storing the plurality of plaintext data in association with the information on the validity period of time at which the plurality of plaintext data is input on the key storage unit of the plurality of encryption keys with respect to the plurality of plaintext data The method comprising the steps of: maintaining a database in which a plurality of encrypted data generated according to encryption performed with an encryption key is stored; when the first plaintext data and a data storage command for the first plaintext data are inputted, From the key storage unit, Extracting a first encryption key corresponding to information on a valid period of use in which the first plaintext data is input, and encrypting the first plaintext data based on the extracted first encryption key And storing the first encrypted data in the database after generating the first encrypted data.

The data encryption management apparatus and the method of operating the same according to the present invention are characterized in that when new plaintext data to be stored in a database is input, the plaintext data is encrypted with an encryption key corresponding to a time point of inputting the plaintext data, The security of the data is improved as compared with the data encryption management method that performs data encryption management in a lump.

In addition, the data encryption management device and the method of operating the same according to the present invention are characterized in that, when an encryption key update command is input for a plurality of encrypted data stored in a database by an administrator, Only the encrypted data whose encryption has been performed with the encryption keys having the previous valid period of use, which is not the encryption key having the latest effective use period predetermined in advance so as to enable the encrypted data to be encrypted, By performing encryption again with the key, the risk of exposure of the plaintext data due to the update of the encrypted data can be minimized even if the encryption keys with the previous validity period are exposed.

In addition, the data encryption management device and the method of operating the same according to the present invention may be configured such that when an encryption key partial updating command for a plurality of pieces of encrypted data stored in a database is input by an administrator, Only the encrypted data whose encryption has been performed with the encryption key having passed the predetermined expiration date is extracted and the extracted encryption data is encrypted again with the encryption key having the latest validity period so that the encryption keys whose expiration date has expired are exposed The risk of exposing plaintext data due to the update of the encrypted data can be minimized.

1 is a block diagram illustrating a data encryption management apparatus according to an embodiment of the present invention.
2 is a diagram for explaining the operation of the data encryption management apparatus according to an embodiment of the present invention.
3 is a flowchart illustrating an operation method of a data encryption management apparatus according to an embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. Like reference numerals are used for like elements in describing each drawing.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the terms "comprises" or "having" and the like are used to specify that there is a feature, a number, a step, an operation, an element, a component or a combination thereof described in the specification, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted as either ideal or overly formal in the sense of the present application Do not.

Hereinafter, embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram illustrating a data encryption management apparatus according to an embodiment of the present invention.

1, the data encryption management device 110 according to an exemplary embodiment of the present invention includes a key storage unit 111, a database 112, an encryption key extraction unit 113, and a data storage unit 114 do.

The key storage unit 111 stores a plurality of encryption keys and information on effective usable periods predetermined for use in data encryption with respect to each of the plurality of encryption keys in association with each other.

In the database 112, a plurality of plaintext data are stored in the key storage unit 111 of the plurality of encryption keys in association with the information on the validity period to which the plurality of plaintext data is input, A plurality of generated encrypted data is stored as the encryption is performed with the key.

When the data storage command for the first plain text data and the first plain text data is inputted, the encryption key extracting unit 113 checks the time information about the input time of the first plain text data and outputs the time information to the key storage unit 111 And extracts a first encryption key corresponding to information on a valid period of use in which the first plaintext data is input.

The data storage unit 114 encrypts the first plaintext data based on the extracted first encryption key to generate first encrypted data, and then stores the first encrypted data in the database 112.

According to an embodiment of the present invention, the data encryption management device 110 includes an encryption key verification unit 115, an encryption key identification unit 116, an encrypted data selection unit 117, a decryption unit 118, An encryption key extracting unit 119 and a data updating unit 120. [

When an encryption key update command for the plurality of pieces of encrypted data is input, the encryption key verification unit 115 receives from the key storage unit 111 information corresponding to the latest validity period of the plurality of encryption keys And confirms the stored second encryption key.

The encryption key identification unit 116 extracts the plurality of encrypted data from the database 112 and identifies an encryption key used for encryption of each of the plurality of encrypted data with respect to each of the plurality of encrypted data.

When the identification of the encryption key used for encryption of each of the plurality of pieces of encrypted data is completed, the encrypted data selection unit 117 selects at least one of the plurality of pieces of encrypted data, which is not encrypted with the second encryption key, Select the encryption data.

The decryption unit 118 extracts the encryption key used for encryption of each of the at least one second encrypted data from the key storage unit 111 and decrypts the at least one second encrypted data based on the extracted encryption key And generates at least one second plaintext data.

The update encryption key extracting unit 119 extracts the second encryption key stored from the key storage unit 111 in correspondence with the latest effective period of use of the plurality of encryption keys.

The data updating unit 120 encrypts each of the at least one second plaintext data based on the second encryption key and transmits the at least one second encrypted data stored in the database 112 to the at least one 2 plaintext data is replaced with data encrypted with the second encryption key.

According to an embodiment of the present invention, an index value for identifying each of the plurality of encryption keys may be additionally stored in the key storage unit 111 in correspondence with each of the plurality of encryption keys, Data constituting an index value for an encryption key used for encrypting each of the plurality of encrypted data may be combined with each of the plurality of encrypted data stored in the plurality of encrypted data.

When the data storage command for the first plaintext data and the first plaintext data is inputted, the encryption key extracting unit 113 checks the time information about the input time of the first plaintext data, 111) extracts the first encryption key corresponding to the information on the valid period of use in which the first plaintext data is input and the first index value stored corresponding to the first encryption key Can be extracted.

The data storage unit 114 encrypts the first plaintext data based on the extracted first encryption key to generate the first encrypted data, and the first index And then stores the first encryption data combined with the data constituting the first index value in the database 112. [

According to an embodiment of the present invention, the encryption key identifying unit 116 may include an index checking unit 121 and an identifying unit 122.

The index checking unit 121 extracts the plurality of pieces of encrypted data from the database 112, and checks data constituting an index value associated with each of the plurality of pieces of the encrypted data.

The identification unit 122 identifies the index value corresponding to each of the plurality of encryption keys stored in the key storage unit 111 based on the data constituting the index value coupled to each of the plurality of encrypted data And identifies an encryption key used for encrypting each of the plurality of encrypted data.

Also, according to an embodiment of the present invention, the key storage unit 111 may further store information on expiration dates for holding the plurality of encryption keys for each of the plurality of encryption keys in association with each other .

At this time, if the encryption key partial update command for the plurality of pieces of encrypted data is received, the encryption key validation unit 115 checks the information about the current time set in the data encryption management unit 110, 111) of at least one of the plurality of encryption keys stored in association with the information on the expiration date past the expiration date to which the current time belongs.

At this time, the encryption key identifying unit 116 extracts the plurality of encrypted data from the database 112, and identifies an encryption key used for encryption of each of the plurality of encrypted data with respect to each of the plurality of encrypted data When the identification of the encryption key used to encrypt each of the plurality of pieces of encrypted data is completed, the encrypted data selection unit 117 selects at least one of the plurality of pieces of encrypted data, It is possible to select one third encrypted data.

At this time, the decryption unit 118 extracts the encryption key used for encrypting each of the at least one third encrypted data from the key storage unit 111, and extracts the at least one third encrypted data based on the extracted encryption key And the update encryption key extracting unit 119 may generate at least one third plain text data from the key storage unit 111 and store it in correspondence with the latest effective use period information among the plurality of encryption keys And the data updating unit 120 encrypts each of the at least one third plain text data based on the second encryption key, The at least one third plaintext data may replace at least one third encrypted data with data encrypted with the second encryption key.

Hereinafter, the operation of the data encryption management device 110 according to an embodiment of the present invention will be described in detail with reference to FIG.

First, the encryption key 1 (211), the encryption key 2 (212), the encryption key 3 (213), and the encryption key 4 (214) are stored in the key storage unit (111) For each of the encryption keys 211, 212, 213, and 214, information on the validity period preliminarily designated to be usable for data encryption and information on validity periods for maintaining the encryption keys 211, 212, 213, Information is stored in association with each other, and at the same time, an index value previously allocated to each of the encryption keys 211, 212, 213, and 214 is stored.

2, 3, 4, 5, 6, 7, 8, 9, 10 (221, 222, 223, 224, 225, 226, 227, 228, 229, and 230 are stored.

At this time, the encrypted data 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 (221, 222, 223, 224, 225, 226, 227, 228, 229, 230) When each plaintext data is input to the data encryption management device 110 with the encryption data corresponding to each of the plaintext data 110, 3, 4, 5, 6, 7, 8, 9 and 10, It is assumed that the data is encrypted with the encryption key stored corresponding to the information on the effective use period to which the data is input.

For example, when the plaintext data 1 is input to the data encryption management device 110 on May 31, 2013, the encrypted data 1 (221) is the data that is generated by encrypting the plaintext data 1 with the encryption key 1 (211) have.

When the first clear-text data is input to the data encryption management device 110 under the above-mentioned circumstances, when the data storage command for the first plain-text data is inputted, the encryption key extraction unit 113 extracts the first plain- It is possible to extract the first encryption key corresponding to the information on the effective use period to which the first plaintext data is input from the key storage unit 111 by checking the time information on the time.

If the first plaintext data is input on 2016.06.07, the encryption key extracting unit 113 extracts the encryption key from the key storage unit 111 as shown in reference numeral 210, The encryption key 4 (214) stored in correspondence with "2016.01.01 ~ 2016.12.31" can be extracted by the first encryption key.

Then, the data storage unit 114 encrypts the first plaintext data with the encryption key 4 (214), which is the extracted first encryption key, to generate first encrypted data, And may be newly stored on the database 112 as shown at 220.

In this way, when the new plaintext data to be stored in the database 112 is input, the data encryption management device 110 encrypts the plaintext data with the encryption key corresponding to the input time of the plaintext data, In addition, since the plaintext data is not encrypted using the same encryption key, security is enhanced compared to a data encryption management method that performs data encryption management in a lump using an existing one encryption key.

In this case, when extracting the encryption key 4 (214) from the key storage unit 111, the encryption key extraction unit 113 extracts the encryption key 4 (214) corresponding to the encryption key 4 (214) Value "4" can be extracted together.

At this time, the data storage unit 114 encrypts the first plaintext data with the encryption key 4 (214) to generate the first encrypted data, and after storing the first encrypted data in the database 112 The data composing the index value "4 " may be combined with the first encryption data, and the first encryption data combined with the data constituting the index value" 4 " may be stored in the database 112.

In this case, if the first plaintext data is data having a size of 16 bytes, the data storage unit 114 encrypts the first plaintext data having the size of 16 bytes with the encryption key 4 (214) Quot; 4 "is made up of data having a size of 2 bytes (by treating" 4 "as a number, an index value" 4 " The data constituting the index value "4" having the size of 2 bytes is combined with the first encrypted data having the size of 16 bytes , It is possible to generate encrypted data having a size of 18 bytes.

Then, the data storage unit 114 performs predetermined post-processing such as performing base64 encoding on the encrypted data having the size of 18 bytes, and finally, combining the data constituting the index value "4 " And store the first encrypted data in the database 112.

In this manner, the encrypted data 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 (221, 222, 223, 224, 225, 226, 227, 228, 229, and 230 of the first to fourth embodiments of the present invention include encrypted data 1, 2, 3, 4, 5, 6, 7, 8, 9 and 10 (221, 222, 223, 224, 225, 226, 227, 228, The data constituting the index value for the encryption key used for encryption may be combined.

For example, when the encrypted data 1 (221) is data encrypted with the encryption key 1 (211), an index value of "1" which is an index value corresponding to the encryption key 1 (211) Data may be combined.

The encrypted data 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 (221, 222, 223, 224, 225, 226, 227, 228, 229, 230) 2, 3, 4, 5, 6, 7, 8, 9, 10 (221, 222, 223, 224, 225, 226, 227, The encryption key verification unit 115 reads the encryption key 1 from the key storage unit 111 through the encryption key 1 211, the encryption key 2 212 and the encryption key 3 213), and the encryption key 4 (214), which is an encryption key stored in association with information on the most recent valid period of use among the encryption key 4 (214).

2, 3, 4, 5, 6, 7, 8, 9, 10 (221, 222) from the database 112. In this case, 2, 3, 4, 5, 6, 7, 8, 9, 10 (221, 222, 223, 224, 223, 224, 225, 226, 227, 228, 229, 230) 225, 226, 227, 228, 229, and 230, respectively.

The identification unit 122 identifies the encrypted data 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 (221, 222, 223, 224, 225, 226, 227, 228, 229, 230) Encryption key 2 (212), encryption key 3 (213), encryption key 4 (214) stored in the key storage unit (111) based on the data constituting the index value 224, 225, 226, 227, 228, 229, 226, 227, 228, 229, 230 can identify the encryption key used for each encryption.

5, 6, and 7 (224, 224) are combined with the data constituting the index value "1" for the encrypted data 1, 2, 3, 4 Data constituting an index value of "2" is associated with the encrypted data 8, 9 (228, 229) 2, 3, and 4 (221, 222, 223, and 224) are associated with the data constituting the index value "4 " 5, 6, 7 (224, 225, 226, 227) can be identified as the encryption key 1 211, which is the encryption key corresponding to the index value " It is possible to identify that the encryption key 2 212, which is the encryption key corresponding to the index value "2 ", is the encryption key used for data encryption , It is possible to identify the encryption key 3 (213), which is an encryption key corresponding to the index value "3 ", to the encrypted data 8 and 9 (228 and 229) Quot ;, the encryption key 4 (214), which is an encryption key corresponding to the index value "4 ", can be identified as the encryption key used for data encryption.

In this way, it is possible to encrypt the encrypted data 1, 2, 3, 4, 5, 6, 7, 8, 9 and 10 (221, 222, 223, 224, 225, 226, 227, 228, 229, When the identification of the encryption key is completed, the encrypted data selection unit 117 transmits the encrypted data 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 (221, 222, 223, 224, 225, 226, 224, 227, 228, 229, and 230, which are stored in association with the information on the latest validity period.

In this embodiment, among the encrypted data 1, 2, 3, 4, 5, 6, 7, 8, 9 and 10 (221, 222, 223, 224, 225, 226, 227, 228, 229, 230) 2, 3, 4, 5, 6, 7, 8, 9, 10 (221, 222, 223), since the encrypted data selector 230 is assumed to have been encrypted with the encryption key 4 (214) 2, 3, 4, 5, 6, 7, 8, 9 (221, 222, 223, 224, 225, 226, 227) among the encrypted data 1, 2, 3, , 228, 229).

Then, the decryption unit 118 decrypts the encrypted data 1, 2, 3, 4, 5, 6, 7, 8, 9 (221, 222, 223, 224, 225, 226, 227, 2, 3, 4, 5, 6, 7, 8, and 9 (221, 222, 223, 224, and 228) based on the extracted encryption keys after extracting the encryption keys used in the encryption, 2, 3, 4, 5, 6, 7, 8, and 9 by decrypting the plaintext data 225, 226, 227, 228,

The update encryption key extracting unit 119 extracts the latest validity of the encryption key 1 211, the encryption key 2 212, the encryption key 3 213 and the encryption key 4 214 from the key storage unit 111 The encryption key 4 214 corresponding to the information on the use period can be extracted and the data updating unit 120 can extract the plaintext data 1, 2, 3 2, 3, 4, 5, 6, 7, 8, 9 (221, 222, 223) stored in the database 112 after encrypting each of the encrypted data 1, 2, 2, 3, 4, 5, 6, 7, 8, 9 can be replaced with data encrypted with the encryption key 4 (214) have.

As a result, the data encryption management device 110 according to the present invention, when an encryption key all-update command for a plurality of encrypted data stored in the database 112 is input by an administrator, Only the encrypted data whose encryption has been performed with the encryption keys having the previous valid period of use, which is not the encryption key having the latest effective use period predetermined in advance so as to be usable for the latest valid period of use The risk of exposing the plaintext data due to the updating of the encrypted data can be minimized even if the encryption keys having the previous validity period are exposed.

Up to now, it has been possible for the administrator to determine the number of encrypted data 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 (221, 222, 223, 224, 225, 226, 227, 228, 229, 230) The encrypted data 1, 2, 3, 4, 5, 6, 7, 8, 9 and 10 (221, 222, 223, 224, 225, 226, 227, 228, 229, 230, which is not the encryption key having the latest effective use period, extracts only the encrypted data that has been encrypted with the encryption keys having the previous effective period of use and extracts the extracted encrypted data with the encryption key having the latest effective use period An example of performing encryption again has been described.

2, 3, 4, 5, 6, 7, 8, 9, 10 (221, 222, 223, 224, 225, 226, 227, 228, 229, and 230, the encryption key verification unit 115 checks the information about the current time set in the data encryption management device 110, 111 corresponding to the information on the expiration date in the past that is the expiration date to which the current time belongs among the encryption key 1 (211), the encryption key 2 (212), the encryption key 3 (213), and the encryption key 4 (214) It is possible to confirm at least one encryption key stored.

For example, if the current time is confirmed to be 2016.04.15, the encryption key validation unit 115 receives the encryption key 1 211, the encryption key 2 212, the encryption key 3 213, 2015.01.01 ~ 2016.05.31 "and" 2016.01.01 ~ 2017.05.31 ", which are the valid period of the current time (2016.04.15) among the key 4 (214) 2014.05.31 "and" 2014.01.01 to 2015.05.31 ", the encryption key 1 (211) and the encryption key 2 (212) can be confirmed with the encryption key stored.

2, 3, 4, 5, 6, 7, 8, 9, 10 (221, 222, 223, 224, 225, 226, 227, 228, 229, 230), and then extracts the encrypted data 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 (221, 222, 223, 224, 225, 226, 227, 2, 3, 4, 5, 6, 7, 8, 9, 10 (221, 222, 223) Stored in the key storage unit 111 on the basis of the data constituting the index values respectively associated with the encryption keys 1, 224, 225, 226, 227, 228, 229, 2, 3, 4, 5, 6, 7, 8, 9, 10 (221, 222) , 223, 224, 225, 226, 227, 228, 229, 230).

At this time, the encrypted data selection unit 117 selects the encrypted data 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 (221, 222, 223, 224, 225, 226, 227, 228, 229, 2, 3, 4, 5, 6, 7, 8, 9, 10 (221, 222, 223, 224, 225, 226, 227, 228) , 229 and 230 can select at least one piece of encrypted data that has been encrypted with the encryption key 1 (211) and the encryption key 2 (212).

In the above-described embodiment, the data constituting the index value "1" is combined with the encrypted data 1, 2, 3, 4 (221, 222, 223, 224) 2, 3, 4, 5, 6, and 7, since the data constituting the index value "2" is concatenated with the encrypted data 224, 225, 226, At least one encryption key 1 (211) and encryption key 2 (212) among the encryption keys 1, 2, 7, 8, 9 and 10 (221, The encrypted data 1, 2, 3, 4, 5, 6, 7 (221, 222, 223, 224, 225, 226, 227) can be selected as the encrypted data.

Then, the decryption unit 118 decrypts the encrypted data 1, 2, 3, 4, 5, 6, 7 (221, 222, 223, 224, 225, 226, 227) from the key storage unit 111 2, 3, 4, 5, 6, 7 (221, 222, 223, 224, 225, 226, 227) on the basis of the extracted encryption key to extract plaintext data 1 , 2, 3, 4, 5, 6, 7 can be generated.

At this time, the update encryption key extracting unit 119 extracts the latest validity of the encryption key 1 211, the encryption key 2 212, the encryption key 3 213, and the encryption key 4 214 from the key storage unit 111 The data update unit 120 can extract the encryption key 4 214 stored in correspondence with the information on the use period and the data update unit 120 can extract the plaintext data 1, 2, 3, 4, 5 2, 3, 4, 5, 6, 7 (221, 222, 223, 224, 225, 226, 227) stored in the database 112, 1, 2, 3, 4, 5, 6, 7 can be replaced with data encrypted with the encryption key 4 (214).

As a result, the data encryption management device 110 according to the present invention, when an encryption key partial update command for a plurality of encrypted data stored in the database 112 is input by an administrator, By extracting only the encrypted data whose encryption has been performed with the encryption key that has passed the predetermined expiration date and encrypting the extracted encrypted data by using the encryption key having the latest effective use period, The exposure of the plaintext data due to the update of the encrypted data can be minimized.

The encrypted data update process according to the partial update command of the encryption key is advantageous in that it can process the encrypted data update process more quickly since the amount of the encrypted data to be updated is smaller than the encrypted data update process according to the previously described encryption key update command have.

According to an embodiment of the present invention, the data encryption management device 110 may be configured such that when an administrator manually applies an associated command, the data encryption management device 110 updates the encrypted data according to the encryption key all- However, it may be configured such that the encrypted data update process is performed automatically when the date is automatically set in accordance with the data update process schedule preset by the administrator.

3 is a flowchart illustrating an operation method of a data encryption management apparatus according to an embodiment of the present invention.

In step S310, the key storage unit stores a plurality of encryption keys and a key storage unit in which pieces of information on effective usable periods predetermined for use in data encryption are stored in association with each other.

In step S320, the plurality of plaintext data are encrypted with the encryption key stored in correspondence with the information on the effective period of time at which the plurality of plaintext data is input on the key storage unit of the plurality of encryption keys. And stores a plurality of generated encrypted data in a database.

In step S330, when a data storage command for the first plaintext data and the first plaintext data is inputted, the time information on the time when the first plaintext data is input is checked and the first plaintext data And extracts the first encryption key corresponding to the information on the effective use period to which the point in time at which the input key is input belongs.

In step S340, the first encryption unit 110 encrypts the first plaintext data based on the extracted first encryption key to generate first encrypted data, and then stores the first encrypted data in the database.

According to an embodiment of the present invention, the operation method of the data encryption management apparatus further includes a step of, when the encryption key update command for the plurality of pieces of encrypted data is input, The method comprising the steps of: identifying a second encryption key stored in association with information on an effective period of use of the plurality of encrypted data; extracting the plurality of encrypted data from the database; The method comprising the steps of: identifying an encryption key used for encryption; when identification of an encryption key used for encryption of each of the plurality of pieces of encrypted data is completed, at least one of the plurality of encrypted data, Selecting the second encrypted data from the key storage unit, Extracting an encryption key used for encrypting each of the one second encrypted data and decrypting the at least one second encrypted data based on the extracted encryption key to generate at least one second plaintext data, Extracting the second encryption key stored in association with information on the latest valid period of use of the plurality of encryption keys from the second encryption key, and extracting the second encryption key from the at least one second plaintext data And replacing the at least one second encrypted data stored in the database with the data encrypted with the second encryption key by the at least one second plaintext data.

According to an embodiment of the present invention, an index value for identifying each of the plurality of encryption keys may be additionally stored in the key storage unit in association with each of the plurality of encryption keys, The stored plurality of encrypted data may be combined with data constituting an index value for an encryption key used for encrypting each of the plurality of encrypted data.

At this time, if a data storage command for the first plaintext data and the first plaintext data is input in step S330, time information on the time when the first plaintext data is input is checked, Extracting the first encryption key corresponding to information on a valid period of use at which the first plaintext data is input and extracting a first index value stored corresponding to the first encryption key, In operation S340, the first encrypted data is generated by performing encryption on the first plain text data based on the extracted first encryption key, and the first index value is constructed with respect to the first encrypted data After the data is combined, the first encryption data combined with the data constituting the first index value may be stored in the database.

In this case, according to an embodiment of the present invention, the step of identifying the encryption key may include extracting the plurality of pieces of encrypted data from the database, and then checking data constituting an index value coupled to each of the plurality of pieces of encrypted data And an index value corresponding to each of the plurality of encryption keys stored in the key storage unit based on data constituting an index value coupled to each of the plurality of encrypted data, And identifying the encryption key used for each encryption.

According to an embodiment of the present invention, the key storage unit may further store information on expiration dates for holding the plurality of encryption keys for each of the plurality of encryption keys, respectively.

In this case, when the partial update of the encryption key for the plurality of pieces of encrypted data is applied, the method for operating the data encryption management device checks information on the current time set in the data encryption management device, Identifying at least one third encryption key stored in association with information on a validity period that is earlier than an expiration date to which the current time belongs among the plurality of encryption keys, extracting the plurality of encrypted data from the database Identifying an encryption key used to encrypt each of the plurality of pieces of encrypted data with respect to each of the plurality of pieces of encrypted data, and if the identification of the encryption key used to encrypt each of the plurality of pieces of encrypted data is completed, Wherein the at least one third encryption Selecting at least one third encrypted data that has been encrypted with a key, extracting an encryption key used to encrypt each of the at least one third encrypted data from the key storage unit, And a second encryption key generation step of generating at least one third plaintext data by decoding one piece of the third encryption data to generate at least one third plaintext data, Encrypting each of the at least one third plaintext data based on the second encryption key, and transmitting the at least one third encrypted data stored in the database to the at least one third plaintext And replacing the data with data encrypted with the second encryption key .

The operation of the data encryption management apparatus according to the embodiment of the present invention has been described above with reference to FIG. Here, the operation method of the data encryption management apparatus according to an embodiment of the present invention may correspond to the operation of the operation of the data encryption management apparatus 110 described with reference to FIGS. 1 and 2, Is omitted.

The method for operating the data encryption management apparatus according to an embodiment of the present invention may be implemented by a computer program stored in a storage medium for execution through a combination with a computer.

In addition, the method of operating the data encryption management apparatus according to an embodiment of the present invention may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks, and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

As described above, the present invention has been described with reference to particular embodiments, such as specific elements, and specific embodiments and drawings. However, it should be understood that the present invention is not limited to the above- And various modifications and changes may be made thereto by those skilled in the art to which the present invention pertains.

Accordingly, the spirit of the present invention should not be construed as being limited to the embodiments described, and all of the equivalents or equivalents of the claims, as well as the following claims, belong to the scope of the present invention .

110: Data encryption management device
111: Key storage unit 112: Database
113: encryption key extracting unit 114:
115: encryption key verification unit 116: encryption key identification unit
117: Encrypted data selection unit 118: Decryption unit
119: update encryption key extracting unit 120:
121: Index check unit 122: Identification unit

Claims (12)

A key storage unit in which a plurality of encryption keys and information on a validity period predetermined for use in data encryption are stored in association with each other for each of the plurality of encryption keys;
The encryption is performed with the encryption key stored corresponding to the information on the effective period of time at which the plurality of plaintext data is input on the key storage unit of the plurality of encryption keys, A database in which a plurality of pieces of encrypted data are stored;
When a data storage command for the first plain text data and the first plain text data is input, the time information for the time when the first plain text data is input is checked and the time point at which the first plain text data is input from the key storage unit An encryption key extracting unit for extracting a first encryption key corresponding to information on a valid period of use; And
Encrypting the first plaintext data based on the extracted first encryption key to generate first encrypted data, and storing the first encrypted data in the database,
The data encryption management apparatus comprising: The method according to claim 1,
And a second encryption key stored in association with information on the latest valid period of use among the plurality of encryption keys, from the key storage unit, when a command to update all of the plurality of encrypted data is input An encryption key verification unit;
An encryption key identifying unit for extracting the plurality of pieces of encrypted data from the database and identifying an encryption key used for encrypting each of the plurality of pieces of encrypted data with respect to each of the plurality of pieces of encrypted data;
When the identification of the encryption key used for encrypting each of the plurality of pieces of encrypted data is completed, selecting at least one second encrypted data that is not encrypted with the second encryption key among the plurality of pieces of encrypted data part;
Extracts an encryption key used for encryption of each of the at least one second encrypted data from the key storage unit, decrypts the at least one second encrypted data based on the extracted encryption key, A decoding unit for generating a decoding signal;
An update encryption key extraction unit for extracting the second encryption key stored in association with information on the most recent valid period of use among the plurality of encryption keys from the key storage unit; And
Encrypting each of the at least one second plaintext data based on the second encryption key and transmitting the at least one second encrypted data stored in the database to the second encryption key using the second encryption key The data updating unit replaces the encrypted data with the encrypted data.
Further comprising: 3. The method of claim 2,
The key storage unit
An index value for identifying each of the plurality of encryption keys is additionally stored corresponding to each of the plurality of encryption keys,
Wherein each of the plurality of encrypted data stored in the database is combined with data constituting an index value for an encryption key used for encrypting each of the plurality of encrypted data,
The encryption key extracting unit
When a data storage command for the first plaintext data and the first plaintext data is input, checks the time information about the time when the first plaintext data is input, Extracts the first encryption key corresponding to the information on the effective period of use and extracts the first index value stored corresponding to the first encryption key,
The data storage unit
Encrypting the first plaintext data based on the extracted first encryption key to generate the first encrypted data, combining the data constituting the first index value with the first encrypted data, And stores the first encrypted data combined with the data constituting the first index value in the database. The method of claim 3,
The encryption key identifying unit
An index check unit for extracting the plurality of encrypted data from the database and checking data constituting an index value coupled to each of the plurality of encrypted data; And
And an index value corresponding to each of the plurality of encryption keys stored in the key storage unit based on data constituting an index value coupled to each of the plurality of encrypted data, An identification unit for identifying an encryption key used for encryption
The data encryption management apparatus comprising: 3. The method of claim 2,
The key storage unit
Information about a validity period for holding the plurality of encryption keys is additionally stored corresponding to each of the plurality of encryption keys,
The encryption key verification unit
Wherein when a partial update of an encryption key for the plurality of pieces of encrypted data is applied, information on a current time set in the data encryption management device is checked and then the current time among the plurality of encryption keys belongs At least one third encryption key stored in correspondence with the information on past validity period,
The encryption key identifying unit
Extracts the plurality of encrypted data from the database, identifies an encryption key used for encryption of each of the plurality of encrypted data for each of the plurality of encrypted data,
The encrypted data selection unit
When the identification of the encryption key used for encrypting each of the plurality of pieces of encrypted data is completed, selects at least one third encrypted data that has been encrypted with the at least one third encryption key among the plurality of pieces of encrypted data,
The decoding unit
Extracting an encryption key used for encrypting each of the at least one third encrypted data from the key storage unit, decrypting the at least one third encrypted data based on the extracted encryption key, Generate,
The update encryption key extracting unit
Extracts, from the key storage unit, the second encryption key stored in association with the latest effective period of use of the plurality of encryption keys,
The data updating unit
Encrypting each of the at least one third plaintext data based on the second encryption key, and then transmitting the at least one third encrypted data stored in the database to the at least one third plaintext data using the second encryption key A data encryption management device that replaces encrypted data. The method comprising: maintaining a key storage unit in which a plurality of encryption keys and information on a validity period predetermined for use in data encryption for each of the plurality of encryption keys are stored corresponding to each other;
The encryption is performed with the encryption key stored corresponding to the information on the effective period of time at which the plurality of plaintext data is input on the key storage unit of the plurality of encryption keys, Maintaining a database in which a plurality of encrypted data are stored;
When a data storage command for the first plain text data and the first plain text data is input, the time information for the time when the first plain text data is input is checked and the time point at which the first plain text data is input from the key storage unit Extracting a first encryption key corresponding to information on a valid period of use; And
Encrypting the first plaintext data based on the extracted first encryption key to generate first encrypted data, and storing the first encrypted data in the database
The data encryption management apparatus comprising: The method according to claim 6,
And a second encryption key stored in association with information on the latest valid period of use among the plurality of encryption keys, from the key storage unit, when a command to update all of the plurality of encrypted data is input step;
Extracting the plurality of encrypted data from the database and identifying an encryption key used for encryption of each of the plurality of encrypted data with respect to each of the plurality of encrypted data;
Selecting at least one second encrypted data that is not encrypted with the second encryption key among the plurality of encrypted data when identification of the encryption key used to encrypt each of the plurality of encrypted data is completed;
Extracts an encryption key used for encryption of each of the at least one second encrypted data from the key storage unit, decrypts the at least one second encrypted data based on the extracted encryption key, ;
Extracting, from the key storage unit, the second encryption key stored in association with information on the latest valid period of use of the plurality of encryption keys; And
Encrypting each of the at least one second plaintext data based on the second encryption key, and transmitting the at least one second encrypted data stored in the database to the second encryption key using the second encryption key Replacing with encrypted data
Further comprising the steps of: 8. The method of claim 7,
The key storage unit
An index value for identifying each of the plurality of encryption keys is additionally stored corresponding to each of the plurality of encryption keys,
Wherein each of the plurality of encrypted data stored in the database is combined with data constituting an index value for an encryption key used for encrypting each of the plurality of encrypted data,
The step of extracting the first encryption key
When a data storage command for the first plaintext data and the first plaintext data is input, checks the time information about the time when the first plaintext data is input, Extracts the first encryption key corresponding to the information on the effective period of use and extracts the first index value stored corresponding to the first encryption key,
The step of storing the first encrypted data in the database
Encrypting the first plaintext data based on the extracted first encryption key to generate the first encrypted data, combining the data constituting the first index value with the first encrypted data, And storing the first encrypted data combined with the data constituting the first index value in the database. 9. The method of claim 8,
Wherein identifying the encryption key comprises:
Extracting the plurality of encrypted data from the database, and checking data constituting an index value coupled to each of the plurality of encrypted data; And
And an index value corresponding to each of the plurality of encryption keys stored in the key storage unit based on data constituting an index value coupled to each of the plurality of encrypted data, Identifying the encryption key used for encryption
The data encryption management apparatus comprising: 8. The method of claim 7,
The key storage unit
Information about a validity period for holding the plurality of encryption keys is additionally stored corresponding to each of the plurality of encryption keys,
The operation method of the data encryption /
Wherein when a partial update of an encryption key for the plurality of pieces of encrypted data is applied, information on a current time set in the data encryption management device is checked and then the current time among the plurality of encryption keys belongs Identifying at least one third encryption key stored in association with information on a past expiration date that is earlier than the expiration date;
Extracting the plurality of encrypted data from the database and identifying an encryption key used for encryption of each of the plurality of encrypted data with respect to each of the plurality of encrypted data;
Selecting at least one third encrypted data that has been encrypted with the at least one third encryption key among the plurality of encrypted data when the identification of the encryption key used to encrypt each of the plurality of encrypted data is completed ;
Extracting an encryption key used for encrypting each of the at least one third encrypted data from the key storage unit, decrypting the at least one third encrypted data based on the extracted encryption key, ; And
Extracting, from the key storage unit, the second encryption key stored in association with information on the latest valid period of use of the plurality of encryption keys; And
Encrypting each of the at least one third plaintext data based on the second encryption key and encrypting the at least one third encrypted data stored in the database with the second encryption key Replacing with encrypted data
Further comprising the steps of: A computer-readable recording medium recording a program for performing the method according to any one of claims 6 to 10. 11. A computer program stored in a storage medium for executing the method of any one of claims 6 to 10 through a combination with a computer.

Images