JP2001217822A - Encipherig recorder - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an enciphering recorder capable of eliminating information leakage and information forging as much as possible even in information exchange through a rewritable recording medium. SOLUTION: This recorder is provided with a 1st recording means which enciphers plaintext information with a randomly generated shared-key and records the plaintext information on a recording medium and a 2nd recording means which enciphers the shared-key used to encipher the plaintext information by the 1st recording means with a public-key recorded at a specified position of the recording medium and records the shared-key on the recording medium.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an optical disk, an optical disk device, and a file system of a secondary recording device, and more particularly, to preventing leakage of information on a recording medium and preventing unauthorized alteration of information. The present invention relates to a format of a recording medium for encrypting information on the recording medium, an optical disk device, and a file system.

[0002]

2. Description of the Related Art As is well known, a DVD (Digital Versat
A large-capacity optical disk such as an ile disc) -RAM (random access memory) is capable of easily rewriting and erasing a large amount of data, and has high compatibility guaranteed between different devices. Therefore, it is a recording medium that is optimal for applications such as exchange and backup of large amounts of data, and is indispensable for comfortable use of computers.

Normally, when information is recorded on these exchangeable media, data is written according to a format of a common standard or a widely used specification. Therefore, at least the same type of OS (Operating Sysyem) is installed,
If the computer is equipped with a disk device having read compatibility, such information can be easily read. This is a great advantage, but the information
It is inconvenient if you do not want others to know.

[0004] In a certain kind of OS, as the attribute information of a file, the owner of the file, the user or the group who can access the file can be restricted.
In such a system, information that a third party does not want to know can be protected to some extent from a negligible third party's negligence.

However, even in such a system,
The system administrator can easily change the access information of the file and obtain the information that he or she wants to keep secret. Further, when the recording medium is passed to a malicious third party, the recorded information itself is raw, so that the information can be basically obtained only by directly controlling the hardware.

Further, if the recording medium is returned without being noticed, the information leakage itself is not recognized. Similarly, it is easy to rewrite information by a malicious third party, and it is not so difficult to perform tampering so that tampering is not found.

[0007] When a replaceable medium is used exclusively for an individual, it is possible to prevent information leakage and falsification by encrypting the file with conversion software or the like. However, when exchanging information between users having a trust relationship, a "shared key" commonly used for encryption and decryption is securely transferred separately from the recording medium, and strict Must be kept in

A public key method is an encryption method that does not require strict handling of a key to be transferred. However, a calculation load for encryption / decryption is greater than that of a shared key method. Therefore, there is a method of encrypting the data itself with a shared key and encrypting the shared key with a public key. However, since the public key should basically be considered available to anyone, even if the data is tampered with as it is, the information receiving side cannot detect it. Therefore, the data is subjected to a hash function to obtain a hash value, and this value is encrypted with the secret key of the information provider and transmitted at the same time, thereby preventing tampering.

[0009]

Conventionally, when confidential information is exchanged via a replaceable recording medium, an encryption program is started to generate encrypted data, a key, a hash value, etc. Had to be recorded as a file. The recipient of the information will receive the encrypted data,
A key, a hash value, and the like have to be read from the user file, a decryption program has to be started, and information has to be extracted, and the processing procedure is complicated.

[0010] In this case, when encryption is performed by software on a computer, a private key is held in the form of a file. However, in the case of an electronic file, plagiarism or copying is easy. It is very dangerous. Once stolen, its use cannot be restricted.

Normally, in the public key method, a malicious third party may substitute the public key and impersonate the information recipient to obtain the information illegally. Therefore, the public key must be handed directly or to a certificate authority. You need to get it by inquiry.

Therefore, the present invention has been made in consideration of the above circumstances, and even when information is transmitted and received via a rewritable recording medium, information leakage and tampering can be minimized. It is an object of the present invention to provide a very good encrypted recording device that can be used.

[0013]

According to the present invention, there is provided an encryption recording apparatus comprising: first recording means for encrypting plaintext information with a randomly generated shared key and recording the same on a recording medium; And a second recording means for encrypting the shared key used for encrypting the plaintext information with the public key recorded at a specific position on the recording medium and recording the encrypted shared key on the recording medium. .

[0014] Further, the encryption recording device according to the present invention comprises:
In the above configuration, a calculating means for calculating a hash value of the plaintext information, and a hash value calculated by the calculating means,
A third recording means for encrypting the data with a secret key owned by the information provider and recording the encrypted data on a recording medium is provided.

Further, in the encryption recording apparatus according to the present invention, in the above configuration, the hash value of the public key owned by the certifier is encrypted with the secret key owned by the public certification authority, and the encrypted information is And a fourth recording unit for recording the hash value of the public key possessed by the user as a digital signature together with the public key possessed by the authenticator with a secret key possessed by the authenticator. And a fifth recording means for recording the information as an electronic signature together with the public key possessed by the user on a recording medium.

[0016]

Embodiments of the present invention will be described below in detail with reference to the drawings. First, referring to FIG. 1, the process on the information provider side will be schematically described. That is, the plaintext information is encrypted with a randomly generated (disposable) shared key and written to the medium.

The shared key used to encrypt the plaintext information is encrypted with the public key read from the medium and written to the medium. In order to prevent tampering of the information, a hash value of the plaintext information is calculated, and this value is encrypted with the secret key of the information provider and written to the medium. The secret key of the information provider is stored together with the encryptor in an IC (Integrated Circuit) card, so that the key itself cannot be read out.

The processing on the information receiver side will be schematically described. That is, the encrypted shared key is read from the medium, decrypted with the secret key of the information recipient, and the shared key for decrypting the information is extracted. The secret key of the information recipient is also stored in the IC card together with the encryptor, so that the key itself cannot be read out.

The encrypted information file is read from the medium, and the original plaintext information is extracted by using the shared key extracted and decrypted. Read the encrypted hash value from the media, decrypt it with the information provider's public key, compare it with the hash value calculated from the retrieved plaintext information,
Check for tampering.

Next, a method of generating key information on a medium will be schematically described with reference to FIG. That is, the hash value of the public key of the first certifier is encrypted with the secret key of the public certificate authority, and this is recorded on the medium together with the public key as an electronic signature for the public key of the first certifier. It is assumed that the secret key of the public certification organization is strictly managed and it is difficult for a third party to obtain it.

When the public key of the user 1 is recorded on the medium, the hash value of the public key of the user 1 is given to the first authenticator who is the owner of the public key with the digital signature. And encrypts it with the public key as a digital signature for the public key of the user 1. The public signature of the public key of the user 1 may be requested to a public certification authority, but it is considered that handling is easier if the request is made to the first certifier who seems to exist nearby.

When the public key of the user 2 is recorded on the medium, the hash value of the public key of the user 2 is given to the user 1 who is the owner of the public key with the digital signature, using the private key of the user 1. It is encrypted and recorded on a medium together with the public key as an electronic signature for the public key of the user 2. Note that the electronic signature of the public key of the user 2 may be requested to the first certifier.

A method of verifying key information on a medium will be schematically described. First, in order to verify whether the public key of the user 2 recorded on the medium has been tampered with, a hash value calculated from the public key itself and an electronic signature for the public key of the user 2 are signed by the signer. It is checked whether the hash value obtained by decrypting with the public key of the user 1 matches.

Further, it is checked by a similar procedure that the public key of the user 1 used for decrypting the electronic signature for the public key of the user 2 is not falsified. That is, it is determined whether or not the hash value calculated from the public key itself matches the hash value obtained by decrypting the electronic signature for the public key of the user 1 with the public key of the first authenticator who is the signer.

Further, it is checked whether the public key of the first authenticator used for decrypting the electronic signature for the public key of the user 1 has not been falsified. That is, it is determined whether the hash value calculated from the public key itself matches the hash value obtained by decrypting the electronic signature for the public key of the first certifier with the public key of the public certificate authority that is the signer. Find out. The public key of the public certification body is publicly known to the public and can be easily obtained from the Web if necessary.

Next, FIG. 3 shows an optical disk drive described in this embodiment. That is, when data is recorded, write information sent from a higher-level device such as a personal computer (not shown) is transmitted to the encryption processor 1 through the higher-level device interface 101.
02. Information that needs to be encrypted is processed by the encryption processing unit 102.

The recording data processing unit 103 has an ECC (Error Correcting Cod
e) Add information, modulate the write code, etc. The input to the recording data processing unit 103 is the output of the encryption processing unit 102 when the information requires data encryption.
In the case of information that does not require encryption, the information is data from the higher-level device interface 101.

When reproducing data, the reproduction signal processing unit 104 performs demodulation of a modulation code, error correction processing, and the like, similarly to a conventional optical disk drive. If the read data is unencrypted information, the data is sent to the host device such as a personal computer through the host device interface 101 as it is. If the read data is encrypted information, the data is decrypted by the decryption processing unit 105 and then transmitted to a higher-level device such as a personal computer via the higher-level device interface 101.

The secret key IC card 106 is a detachable card enclosing a public key necessary for encryption / decryption processing, an encryptor, a decryptor, and the like. For example, as shown in FIG. 4, this card is inserted into a secret key IC card mounting window 201 provided on the front panel of an optical disk drive to record or reproduce information, and after use, pulled out and stored in a safe place. I do.

FIG. 5 shows an example of information recorded on a recording medium (optical disk) in order to perform encrypted recording with this optical disk drive. That is, a public key recording area 301 shown in FIG. 5A and a recording data section 304 shown in FIG. 5B are formed on the recording medium.

The public key recording area 301 is formed, for example, in an administrative area adjacent to the area where the defect exchange information is recorded on the recording medium, and corresponds to the public key 303 for each user. A plurality of combinations of the user identifiers 302 are recorded.

The recording data section 304 is a minimum unit block in which the optical disk drive records data, and attribute information 305 to 308 of the encrypted information in the block.
And the entity 309 of the encrypted information.

The minimum unit block for recording data is:
It may be one sector of 2048 bytes, an ECC block of 32 kbytes, or another value.
If the block length of the minimum unit is short, the overhead for the attribute information of the encrypted information in the block increases. In addition, when the minimum unit block length is long, fragmentation due to information of fraction bytes smaller than the unit length increases. Therefore, an appropriate length is determined based on these trade-offs.

The attribute information of the encrypted information in the block includes the identifier 305 of the information provider, the identifier 306 of the person who receives the information, and the shared key used to encrypt the information with the public key of the receiver. It is composed of encrypted key information 307 and information 308 obtained by encrypting the hash value of the data with the secret key of the provider.

In the encryption using the public key method, since it takes time to perform encryption / decryption, in this embodiment, the data itself is encrypted using the shared key method, and the shared key is encrypted using the recipient's public key. To prevent the information from being decrypted due to the leakage of the key.

Since the public key of the information recipient is not secret,
A malicious third party other than the information provider can impersonate the information provider and switch to falsified information. To prevent this, a hash value of the data is calculated by a one-way hash function and recorded together with the data. Since the hash value will be different if the data is changed even a little, and it is virtually impossible to change the data so that it has the same hash value, the hash value of the data is calculated on the receiving side and recorded together. By comparing the hash value with the hash value, it is possible to detect whether the data has been tampered with.

However, if the hash value is recorded as it is, it will be rewritten together with the data. Therefore, the hash value is encrypted with the secret key of the information provider. Since the private key can only be owned by the information provider, the information recipient decrypts the hash value with the information provider's public key and, if the hash value matches the hash value calculated from the data, provides the information. It can be verified that the data from the user has not been tampered with.

FIG. 6 is a block diagram of the encryption processing unit 102 shown in FIG.
An example is shown. FIG. 7 is a flowchart for explaining an encrypted data writing operation centering on the processing of the encryption processing unit 102.

That is, the encryption processing unit 102 is to encrypt data in accordance with a control signal from the host device interface 101 or a control signal from the drive control unit 107 which has received a control command through the host device interface 101. It is determined whether or not there is.

In this case, a system for encrypting all of the information to be written may be used. However, if the encryption information and the plaintext information can be mixed, the file management information of the system such as the directory and the file allocation table is written in plaintext. It needs to be recorded as it is.

Since the optical disk drive itself cannot determine whether the information content is system information or user data, it must be notified from the host system by a control line or a control command.

Also, for example, the attribute information in the data block in which the plaintext information is recorded can be determined so as to determine whether the block is the block in which the encrypted information is recorded or the block is the plaintext information. Information provider identifier 30
5 records a special identifier such as NULL or -1.

Here, when the data to be encrypted is input, a shared key is generated by the shared key generator 406. It is desirable that the shared key be a different random number every time in order to reduce the risk of leakage. The input data is encrypted with the shared key generated by the shared key encryptor 404 and written to the recording medium.

At the same time, the data input to the encryption processing unit 102 is input to the hash value calculation unit 407, and the hash value is calculated. The calculated hash value is the secret key I
The information is encrypted by the encryptor 603 using the secret key of the information provider in the C card 106 and written on the recording medium.

The public key of the recipient corresponding to the identifier of the recipient is read from the recording medium, and the public key encryptor 405 is read.
With the use of the information recipient's public key, the shared key used to encrypt the data is encrypted and written to the recording medium.

The public key recording area 301 of the recording medium is read, and if the public key of the information provider is not registered,
The information provider's public key is read from the secret key IC card 106 and recorded in the public key recording area 301 of the recording medium together with the information provider's identifier.

[0047] The identifier of the information provider and the identifier of the information receiver are converted into the attribute information 3 of the encrypted information in the data block.
05 to 308 are recorded in the identifier 305 of the information provider and the identifier 306 of the receiver of the information in the recording data section 304.

FIG. 8 shows an example of the secret key IC card 106. That is, the public key memory 601 stores
The public key has been written. Since the public key is not secret information, it does not need to be in the secret key IC card 106.

A secret key is written in the secret key memory 602. After the secret key is written, the secret key memory 602 reads from the outside of the secret key IC card 106,
It is desirable that the structure be neither readable nor writable, so that copying and tampering are not possible.

The encryptor 603 is used for performing a digital signature by encrypting a hash value with a secret key. The decryptor 604 is used to decrypt the shared key encrypted with the public key with the private key.

FIG. 9 shows another example of the secret key IC card 106. That is, the secret key IC shown in FIG.
The card 106 is the same as a mechanical key, and implies that the person who owns the key is the key owner. Therefore, even the person who picks up or steals the secret key IC card 106 can decrypt the encrypted information.

In the secret key IC card 106 shown in FIG. 9, a pattern for authenticating ownership is written in an owner authentication pattern memory 706 in order to enhance security.
This pattern is compared with a pattern input from the outside by a comparator 705, and only when the patterns match, the gates 701 to
704 is opened so that the private key IC card 106 can be accessed.

The pattern for authenticating possession may be a pattern showing physical characteristics such as a fingerprint pattern or a retina pattern of the eye, or more simply, a conventional password.
FIG. 4 shows an example in which a fingerprint pattern reading window 202 for authenticating the owner of the secret key IC card 106 is provided.

The secret key IC card 106 shown in FIG.
If the owner authentication patterns match, the information in the memory can be rewritten. However, in order to avoid the risk of being copied, the contents of the secret key memory 602 and the owner authentication pattern memory 706 cannot be read.

FIG. 10 shows still another example of the secret key IC card 106. In this example, key encryption is also used to identify the owner. That is, the random number generator 802 generates a random number pattern for a challenge. The key owner encrypts the challenge pattern and returns it to the secret key IC card 106 by, for example, inputting a secret key pattern for authentication from the keyboard of a host device such as a personal computer.

The decryptor 803 reads out the owner authentication public key from the memory 804 and uses it to decrypt the returned encrypted pattern. Comparator 801 authenticates the owner by comparing the initially generated random number pattern with the decrypted pattern.

In FIG. 6, the hash value of the public key of the information recipient read from the recording medium is calculated by a hash value calculation unit 401 using a one-way hash function. Since the public key is not secret information, it is easy to replace the key. Therefore, it is always important in public key cryptography to check whether the public key is genuine.

In the encryption processing unit 102 shown in FIG. 6, the hash value of the public key recorded on the recording medium obtained by the hash value calculation unit 401 and the hash value of the public key obtained from another route (finger Print) and the comparator 402
Thus, the validity of the public key recorded on the recording medium can be verified.

FIG. 11 is a block diagram showing the decryption processing unit 10 shown in FIG.
5 shows an example. FIG. 12 is a flowchart illustrating an operation of reading encrypted data centering on the processing of the decryption processing unit 105.

That is, if the identifier of the information provider in the attribute information of the data block to be read in the recording data section 304 is a special identifier such as NULL or -1, the data block is encrypted. Since the data has not been converted, the data is sent to a higher-level device such as a personal computer via the higher-level device interface 101 without passing through the decryption processing unit 105 as in the related art.

If the identifier 306 of the information receiver in the attribute information of the data block does not exist, the process is terminated because it cannot be decoded.

The shared key encrypted with the recipient's public key in the attribute information of the data block is read and sent to the secret key IC card 106, and the secret key decryptor 604 in the card 106 is read.
To decrypt. The shared key decryption unit 907 decrypts the data 309 read from the recording medium and encrypted with the shared key, using the decrypted shared key. The decrypted plaintext data is sent to a host device such as a personal computer via the host device interface 101.
At the same time, the hash value calculation unit 906 calculates a hash value of the data.

The public key recording area 301 on the recording medium is searched based on the identifier 305 of the information provider, and the public key of the information provider is read. Hash value 3 of the data encrypted with the secret key of the information provider in the attribute information of the data block
08 is read and decrypted by the public key decryption unit 904 using the public key of the information provider. Hash value calculation unit 9
06 and the public key decryptor 90
4 is compared with the hash value decrypted by the comparator 905,
Check whether the data has been tampered with.

The decryption processing unit 105 shown in FIG. 11 can confirm whether the public key of the information provider is genuine by the same method as the encryption processing unit 102 shown in FIG. In the decryption processing unit 105 shown in FIG. 11, the hash value of the public key recorded on the recording medium obtained by the hash value calculation unit 901 and the hash value (fingerprint) of the public key obtained from another route To the comparator 902
Then, the validity of the public key recorded on the recording medium is verified.

In both the encryption processing unit 102 shown in FIG. 6 and the decryption processing unit 105 shown in FIG. 11, in order to check whether the public key recorded on the recording medium has been falsified, it is necessary to obtain the public key through another route. The hash value of the public key was needed. FIGS. 13A and 13B show another example of information to be recorded on a recording medium in order to perform encrypted recording by the optical disk drive shown in this embodiment in order to save this trouble.

In the configuration of the information recorded on the recording medium shown in FIG. 5, it is not known even if the public key of a certain user is rewritten. In the example shown in FIG. 13, the public key of user 4 is recorded in 1102 together with the identifier 1101 as in FIG. However, a digital signature for proving that the key is valid is added thereafter. FIG.
In the example shown in FIG. 3, in order to prove the validity of the public key of the user 4, the user 2 together with the identifier 1103 of the user 2 and the user 4 encrypted with the secret key of the user 2
Is recorded on the recording medium.

A method of verifying a public key will be described with reference to FIG. FIG. 14 illustrates an example of the encryption processing unit 102 corresponding to the configuration of information to be recorded on the recording medium illustrated in FIG. That is, it is assumed that the information receiver is the user 4 and the validity of the public key is to be verified.

First, the information provider side public key register 403
The switch 1204 is set to the register 403 in order to determine the hash value of the public key of the user 4 stored in the. The hash value calculated by the hash value calculation unit 1206 is input to the comparator 1205.

On the other hand, the public key of the user 2 who digitally signs the public key of the user 4 is read from the recording medium, sent to the decryptor 1201, and stored in the public key register for verification 1203. Decoder 1201
Decrypts the hash value of the public key of the user 4 encrypted using the public key of the user 2.

The switch 1202 is connected to the decoder 120
1 is set to be input to the comparator 1205. If the hash values compared by the comparator 1205 are equal, the verification is continued. If they are not the same, it notifies the host device that it has been tampered with.

At this stage, if the public key of the user 2 is genuine, the public key of the user 4 when the user 2 digitally signs is equal to the public key recorded on the recording medium (falsification). Is not verified).

Next, the validity of the public key of the user 2 must be verified. That is, the switch 1204 is set to the verification target public key register 1203, and the user 2
The hash value of the public key is calculated by the hash value calculation unit 1206 and used as one input of the comparator 1205.

In the example shown in FIG. 13, it is the first authenticator that digitally signs the public key of the user 2. Therefore, the public key of the first authenticator is read from the recording medium, sent to the decryptor 1201, and stored in the public key register for verification 1203. Decoder 1201
Decrypts the hash value of the public key of the user 2 encrypted using the public key of the first authenticator.

The switch 1202 is connected to the decoder 120
1 is set to be input to the comparator 1205. If the hash values compared by the comparator 1205 are equal, the verification is continued. If they are not the same, it notifies the host device that it has been tampered with.

If the public key of the first authenticator is genuine, the public key of user 2 when the first authenticator digitally signs is equal to the public key recorded on the recording medium (falsification). Is not verified).

The first certifier is a public certification organization or a certification department in a company, and the public key and the hash value of the public key are widely known in the world. In the case of employing the configuration of the information to be recorded on the recording medium shown in FIG. 13, at least one trusted person has the public key digitally signed by the public first authenticator.

That is, the hash value of the public key is encrypted with the secret key of the first authenticator. In the example of FIG. 13, two users, user 1 and user 2, correspond to this. Users 1 and 2 having a digital signature on the public key can additionally record a new public key of another known user together with their digital signature.

The hash value of the public key of the first authenticator is also calculated by the hash value calculation unit 1206 in the same manner as described above. However, the comparison target of the comparator 1205 is to switch the switch 1202 and input from the outside.

In the method shown in FIG. 13, by following the chain of digital signatures recorded in the public key recording area 301 on the recording medium, only the hash value of the public key of the first authenticator is known. Then, the validity of all public keys on the recording medium can be verified. The first certifier must always be the same, so every time the fingerprint (public key hash value)
There is no need to ask for Also, the chain of the digital signature recorded in the public key recording area 301 on the recording medium can be used by copying it to another recording medium without any problem. You can use it with peace of mind.

FIG. 15 shows an example of the decoding processing unit 105 corresponding to the configuration of information to be recorded on the recording medium shown in FIG. The configuration and procedure for verifying the public key are the same as those of the encryption processing unit 102 shown in FIG.

FIG. 16 shows an example of a means for writing a new public key in the information structure to be recorded on the recording medium shown in FIG. The configuration shown in FIG.
And can be shared by actual devices.

First, the public key itself and the identifier of the certifier of the public key, together with the user identifier of the newly recorded public key, are stored in plain text in the public key recording area 301 on the recording medium shown in FIG. 1101, 1102 and 11 in
Write to the position 03 respectively.

Next, the hash value of the newly recorded public key is obtained by the hash value calculation section 407, and the result is sent to the secret key encryptor 603 in the secret key IC card 106 for encryption. The encrypted hash value of the newly recorded public key is recorded as a digital signature at the position 1104 of the public key recording area 301 on the recording medium shown in FIG.

FIG. 17 shows another example of means for writing a new public key in the information structure to be recorded on the recording medium shown in FIG. In the case of the configuration shown in FIG. 16, it is also possible for a person who is not qualified as an authenticator to write a new public key by mistake, or for a third party impersonating the authenticator to write a new public key. .

In this case, if the authentication chain on the recording medium is verified, unauthorized writing can be detected. However, the configuration shown in FIG. 17 prevents unauthorized writing of the public key itself. It has become.

The structure of the means for writing the public key shown in FIG. 17 is different from the structure of the means for writing the public key shown in FIG. 1201 to 1206, except for the switch 120
4 is replaced with a switch 1501).

That is, the public key read from the public key memory 601 (FIG. 8) in the secret key IC card 106 is
In the same manner as the public key verification procedure by the public key verification part of the encryption processing unit 102 shown in FIG. 14, the verification is performed by repeating the authentication chain on the recording medium. Therefore, it becomes possible for the owner of the unauthenticated public key to refuse to record a new public key.

FIG. 18 shows still another example of a means for writing a new public key to the information recorded on the recording medium shown in FIG. In the case of the means for writing the public key shown in FIG. 17, it is possible to prevent negligence of a person who possesses the authorized private key IC card 106, but, for example, a public key qualified as an authenticator does not correspond to the public key. If the unauthorized secret key IC card 106 in which the secret key is written is falsified, writing of a new public key becomes possible.

In this case as well, if the chain of authentication on the recording medium is verified, unauthorized writing can be detected. However, the configuration shown in FIG. 18 verifies a secret key unknown to a third party. By doing so, unauthorized writing of the public key itself can be prevented.

In the configuration of the means for writing a public key shown in FIG. 18, first, the challenge pattern generator 1601 generates a random number in order to verify that the card is the authorized private key IC card 106 of the authenticated person. This random number is the secret key IC
The data is encrypted by the secret key encryptor 603 in the card 106.
The public key of the authenticated person is stored in the public key recording area 3 on the recording medium.
Since the public key must exist on the authentication chain of 01, the public key is read and sent to the decryptor 1602.

The decryptor 1602 decrypts the encrypted challenge pattern using the read public key. The challenge pattern decoded by the comparator 1603 is compared with the original challenge pattern.
Since the secret key should not be leaked, the secret key IC card 106 has been verified as the authorized private key IC card 106 of the authenticated person.

FIGS. 19A to 19C show another example of the structure of information to be recorded on the recording medium shown in FIG. In the configuration shown in FIG.
Is a minimum unit block in which data is recorded by the optical disc drive, and is composed of attribute information 305 to 308 of encrypted information in the block and an entity 309 of encrypted information.

In this case, since the attribute information of the encrypted information exists in the block of the minimum unit for recording data, the amount of data that can be recorded is reduced by that amount, and the data length of the unit block is reduced to the conventional value. The value will be odd compared to that.

On the other hand, in the configuration shown in FIG. 19, the attribute information 1701 of the encrypted information in the block records, for example, defect exchange information of the recording medium as in the case of the public key recording area 301. It is recorded in the area in an administrative manner, such as adjacent to the area. Then, the recording data block 1706 is recorded in the user data area.

FIG. 20 shows an example of a personal computer corresponding to the encrypted file system in the embodiment described here. Secret key IC card 18
03 is the same as that shown in FIG.
Any of the configurations shown in FIGS. 8 to 10 may be used.

The internal configuration of the encryption processing unit 1801 is shown in FIG.
14 and the configuration shown in FIG. Further, the encryption procedure may be the same as the processing in the encryption processing unit 102 shown in FIG. However, the encryption processing unit 102 shown in FIG. 3 inputs data from the higher-level device interface 101 and outputs encrypted data and attribute information and public key information necessary for encryption recording to the recording data processing unit 103. Also, while the public key information is input from the reproduction signal processing unit 104, the encryption processing unit 1801 shown in FIG.
Is different in that all input and output are performed through a peripheral device BUS (PCI BUS in FIG. 20) under the control of the processor.

The internal configuration of the decryption processing unit 1802 is as shown in FIG.
1 and the configuration shown in FIG. Also, the decoding procedure may be the same as the processing in the decoding processing unit 105 shown in FIG. However, the decryption processing unit 105 shown in FIG. 3 inputs the encrypted data and the attribute information and the public key information necessary for the encryption recording from the reproduction signal processing unit 104 and outputs the data to the host device interface 101. In contrast, the decoding processing unit 1802 shown in FIG.
All of the inputs and outputs are controlled by the processor and the peripheral device B
The difference is that the operation is performed through the US (PCI BUS in FIG. 20).

FIGS. 21A to 21C show still another example of the configuration of information recorded on a recording medium in the file system for performing the encryption recording described in this embodiment.

The public key recording area 301 shown in FIG. 13 as an example of the logical format of the encryption-compatible medium and the public key recording area 1901 shown in FIG. 21 as an example of the file system of the encryption-compatible recording apparatus are the same. Configuration.

However, the public key recording area 3 shown in FIG.
01 is recorded in an administrative area for drive control adjacent to the area where the defect replacement information is recorded in the recording medium, whereas the public key recording area 1901 shown in FIG. In the same manner as the directory information and the file allocation table, they are recorded in the management area used by the file system of the operating system.

The attribute information area 1701 of the recording data block shown in FIG. 19 as another example of the logical format of the encryption-compatible medium, and the recording data file shown in FIG. 21 as an example of the file system of the encryption-compatible recording apparatus. Attribute 1902 has the same configuration.

However, the attribute information area 1701 of the recording data block shown in FIG. 19 is also recorded in an administrative area for drive control such as adjacent to the area where the defect replacement information is recorded on the recording medium. Figure 2
1 of the recording data file shown in FIG.
Is recorded as file attribute information in the file directory information, similarly to file attributes such as read-only and hidden files.

The recording data file 1903 shown in FIG.
Are recorded as user data, similarly to a conventional binary data file.

FIGS. 22A to 22C show still another example of the structure of information recorded on a recording medium in the file system for performing the encryption recording described in this embodiment.

A public key recording area 1901 shown in FIG. 21 as an example of a file system of an encryption-compatible recording apparatus,
It has the same configuration as the public key file 2001 shown in FIG. Further, the attribute 1902 of the recording data file shown in the example of the file system of the encryption-compatible recording device in FIG. 21 and the attribute 2002 of the recording data file shown in FIG. 22 have the same configuration. further,
The recording data file 1903 shown in FIG. 21 as an example of the file system of the encryption-compatible recording device is the same as the recording data file shown in FIG.

The public key recording area 1901 shown in FIG. 21 as an example of the file system of the encryption-compatible recording device is
In the same way as the directory information and the file allocation table, the file is recorded in the management area used by the file system of the operating system. Key file 2001).

The attribute 1902 of the recording data file shown in the example of the file system of the encryption-compatible recording apparatus in FIG. 21 is attribute information of the file in the file directory information as well as file attributes such as read-only and hidden files. However, in FIG. 22, the attribute 2002 of the recording data file is also recorded as user data in the same manner as a normal file. The recording data file 1903 shown in FIG. 22 is the same as that of FIG. 21, and is recorded as user data, similarly to a conventional binary data file.

23A to 23C, a pointer 2201 to a recording data block having an encrypted file is added to the attribute information area 1701 shown in FIG. In the configuration shown in FIG. 19, it is assumed that the attribute information area and the recording data block have a one-to-one correspondence, and the corresponding recording data block is determined from the position (order) of the entry in the attribute information area. It is not necessary to have a pointer to the recording data block since

In the case where the same information is to be distributed to a plurality of recipients on the same medium with the configuration shown in FIG. 19, a set of a plurality of attribute information area entries and recording data blocks is required. However, assuming only one encrypted file, the shared key used for encryption
If encrypted by the recipient's public key and distributed, the reuse of the shared key lowers the security level, but saves the storage medium capacity and the encryption time.

FIG. 23 shows a format in which the same information is distributed to a plurality of recipients on the same medium. In this case, the identifier 1703 of the information recipient
And an entry (1702) in the attribute information area 2101 in which the contents of the shared key 1704 encrypted with the recipient's public key are different.
~ 1705, 2102) for the number of information receivers of the same information, and the respective attribute information areas 2101
Pointer 21 to the recording data block in the entry of
02 indicates the same recording data block.

In the file system shown in FIG. 21, as in the case of FIG. 23, the same information may be distributed to a plurality of recipients on the same medium. In this case, a link pointing to the same file
As many as the number of recipients of the same information exist in the file directory information, the identifier of the information recipient corresponding to multiple recipients and the shared key encrypted with the recipient's public key are recorded as attributes of each link It should be done.

In the file system shown in FIG. 22, as in the case of FIG. 23, when the same information is to be distributed to a plurality of recipients on the same medium, FIGS. As shown in), there are attribute files 2201 in which the content of the shared key encrypted with the identifier of the information recipient and the public key of the recipient are different for the number of information recipients of the same information. The pointer 2202 to the encrypted recording data file in 2201 points to the same recording data.

As described above, the recording device itself described in the present embodiment or the recording device interface of a higher-level device such as a personal computer performs the recording and reproduction of information using encryption in an equivalent manner. Therefore, the user does not feel complicated to operate by encrypting the information.

Further, since the encryption and decryption means of the public key system are used in combination, there is no need for special consideration for preventing leakage or theft of the key as in the case of only the shared key system.
The burden on the user is significantly reduced.

Since the secret key is built in the IC card which is physically enclosed, and the encryption and decryption by the secret key is performed in the card, and there is no means for reading the secret key information itself out of the card. Don't worry about secret keys being duplicated.

Further, in order to validate the operation itself, this IC card has a password protection, a pattern of physical characteristics such as a fingerprint and a pupil, or a means for authenticating a user by responding to a challenge. Therefore, there is little fear of being used by others due to loss or theft.

In the recording apparatus described in this embodiment or a higher-level apparatus of the recording apparatus corresponding to the file system, when encrypting and recording information, the public key is encrypted in order to encrypt the data by the shared key method. Processing can be performed faster than when used.

Since the shared key obtained by encrypting the data is encrypted by the public key read from the recording medium and recorded in the header of the data area, there is no fear of information leakage due to the key being stolen.

Further, by calculating a hash value of the data,
Since this is encrypted with the secret key of the information provider and recorded in the header of the data area, even if the data is tampered with, it can be easily detected.

In the area where the public key is recorded on the recording medium, the digital signature of the authenticator who has confirmed and recorded the public key is recorded together with the public key in order to guarantee the secure distribution of the public key. . For this reason, it is possible to easily detect whether the public key recorded in the public key recording area has been tampered with.

The public key authentication relationship is in a chain.
It starts with the public key of the first certifier, which is the first entry in the public key recording area. For this reason, when the recording device is introduced, a first certifier such as a public certificate authority requests and obtains a digital signature for the public key of the user or a directly accessible user. There is no need to make inquiries to bureaus.

The present invention is not limited to the above-described embodiment, but can be variously modified and implemented without departing from the spirit and scope of the invention.

[0123]

As described in detail above, according to the present invention,
It is possible to provide an extremely good encrypted recording apparatus that can minimize leakage or falsification of information even when information is exchanged via a rewritable recording medium.

[Brief description of the drawings]

FIG. 1 shows an embodiment of an encryption recording apparatus according to the present invention, and is a diagram schematically illustrating processing on an information provider side and an information receiver side.

FIG. 2 is an exemplary view schematically illustrating a method for generating key information on a medium according to the embodiment.

FIG. 3 is an exemplary block configuration diagram for explaining an optical disk drive compatible with encryption according to the embodiment;

FIG. 4 is an exemplary front view shown for explaining the front panel of the optical disk drive in the embodiment;

FIG. 5 is an exemplary view for explaining an example of a logical format of a medium corresponding to encryption in the embodiment.

FIG. 6 is a block diagram for explaining an example of an encryption processing unit corresponding to encryption in the embodiment;

FIG. 7 is a flowchart illustrating an encryption processing operation of the optical disc drive according to the embodiment;

FIG. 8 is a block diagram showing an example of a secret key IC card according to the embodiment;

FIG. 9 is a block diagram showing another example of the secret key IC card according to the embodiment;

FIG. 10 is a block diagram showing another example of the secret key IC card according to the embodiment;

FIG. 11 is a block diagram showing an example of a decryption processing unit corresponding to encryption in the embodiment;

FIG. 12 is a flowchart shown to explain the decryption processing operation of the optical disc drive in the embodiment.

FIG. 13 is an exemplary view showing an example of a logical format of a medium having an authentication chain of a public key corresponding to encryption in the embodiment.

FIG. 14 is a block diagram illustrating an example of a decryption processing unit that can verify an authentication chain of a public key corresponding to encryption in the embodiment.

FIG. 15 is a block diagram for explaining another example of the decryption processing unit that can verify the authentication chain of the public key corresponding to the encryption in the embodiment.

FIG. 16 is a block diagram showing an example of a public key recording unit corresponding to encryption in the embodiment;

FIG. 17 is a block diagram for explaining another example of the public key recording means corresponding to encryption in the embodiment.

FIG. 18 is a block diagram for explaining still another example of a public key recording unit corresponding to encryption in the embodiment.

FIG. 19 is an exemplary view for explaining another example of the logical format of the medium having the authentication chain of the public key corresponding to the encryption in the embodiment.

FIG. 20 is a block configuration diagram for explaining a higher-level device of a recording device of a file system compatible with encryption in the embodiment.

FIG. 21 is an exemplary view for explaining an example of a file system corresponding to encryption in the embodiment.

FIG. 22 is an exemplary view for explaining another example of a file system corresponding to encryption in the embodiment.

FIG. 23 is an exemplary view for explaining an example of a format assuming a case where the same information is distributed to a plurality of recipients on the same medium in the embodiment.

FIG. 24 is a view for explaining another example of a format in the same embodiment assuming a case where the same information is distributed to a plurality of recipients on the same medium.

[Explanation of symbols]

 101: Host device interface 102: Encryption processing unit 103: Recorded data processing unit 104: Reproduction signal processing unit 105: Decryption processing unit 106: Private key IC card 107: Drive control unit

──────────────────────────────────────────────────続 き Continued on the front page (51) Int.Cl. ⁷ Identification symbol FI Theme coat ゛ (Reference) H04L 9/00 675D

Claims (3)

[Claims] 1. A first recording means for encrypting plaintext information with a randomly generated shared key and recording it on a recording medium, and a shared key used for encrypting the plaintext information by the first recording means. And a second recording unit for encrypting the data with a public key recorded at a specific position on the recording medium and recording the encrypted data on the recording medium. 2. A calculating means for calculating a hash value of the plaintext information, and a third means for encrypting the hash value calculated by the calculating means with a secret key owned by an information provider and recording the encrypted hash value on the recording medium. 2. The encryption recording apparatus according to claim 1, further comprising recording means. 3. A method for encrypting a hash value of a public key possessed by a certifier with a private key possessed by a public certification authority, and recording the encrypted information together with a public key possessed by the certifier as an electronic signature. Fourth recording means for recording on a medium, encrypting a hash value of a public key owned by the user with a secret key owned by the authenticator, and using the encrypted information as an electronic signature owned by the user. 3. The encryption recording apparatus according to claim 2, further comprising: a fifth recording unit that records the public key and the public key on the recording medium.