JP2002099456A - Encryption apparatus, encryption method and record medium recorded program for the apparatus - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce an operation load on an creation of encryption files. SOLUTION: In an encryption/decryption system, encryption target drives or folders are preset. It is detected periodically whether plain text files are in existence in the preset drives or folders (step 35, 36). If detected in existence (YES at step 36), the encryption files are created from the plain text files with using an encryption key to encrypt the files (step 37).

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an encryption device, an encryption method, and a recording medium storing a program for the encryption device.

[0002]

BACKGROUND OF THE INVENTION In an encryption device for encrypting plaintext, it is common to specify a file to be encrypted (plaintext file). That is, when a user of the encryption apparatus intends to obtain an encrypted file, the user specifies in advance a plaintext file to be encrypted. Since a plaintext file must be specified each time encryption is performed, the operation of specifying a plaintext file may be troublesome.

[0003]

DISCLOSURE OF THE INVENTION An object of the present invention is to reduce the operation burden on a user of an encryption device for generating an encrypted file from a plaintext file.

[0004] An encryption device according to the present invention comprises a setting means for setting a drive or folder to be encrypted, and a first determination for determining whether a plaintext file belongs to the drive or folder to be encrypted set by the setting means. Means, and when the first determination means determines that the plaintext file belongs to the drive or folder to be encrypted, the encrypted file is converted from the plaintext file using an encryption key for encrypting the plaintext file. Is provided.

[0005] The present invention also provides an encryption method suitable for the above-described encryption device. In this encryption method, a drive or folder to be encrypted is set, it is determined whether a plaintext file belongs to the set drive or folder to be encrypted, and the plaintext file belongs to the drive or folder to be encrypted. If it is determined,
An encrypted file is generated from the plaintext file using an encryption key for encrypting the plaintext file.

According to the present invention, encryption processing is performed on a plaintext file belonging to the drive or folder to be encrypted, and an encrypted file is created from the plaintext file. Since encryption processing is performed on plaintext files belonging to the drive or folder to be encrypted, files created by application software (programs), utility software, etc. (application files, utility files, etc.)
If the storage destination of the file is a drive or folder to be encrypted, a plaintext file created by such software can be an encrypted file without performing a special encryption operation. Since it is not necessary to specify each plaintext file to be encrypted, the operation burden on the user of the encryption device can be reduced.

[0007] In one embodiment, the encryption device includes a storage means for storing user identification information provided corresponding to each of the plurality of encryption keys, an input means for receiving an input of information, and A second determination unit is provided for determining whether the input information matches the user identification information stored in the storage unit. When it is determined by the second determination means that the user identification information corresponding to the information input from the input means is stored in the storage means, an encryption key corresponding to the user identification information is used. The plaintext file is encrypted. This is so-called user authentication (key authentication), and when it is determined that the user is a user (registered user) of the encryption device, an encryption process using the encryption key of the user is performed. The plaintext file is encrypted into an encrypted file using the encryption key corresponding to the input information (user identification information). The user identification information includes an ID, a password, and various other types of information that can identify the user who is using the encryption device.

Preferably, the setting means sets an encryption target drive or folder for each encryption key used in the encryption means. A plurality of encryption target drives or folders can be set corresponding to each of the plurality of encryption keys. Since the drive or folder to be encrypted is set for each encryption key, even if multiple users use one encryption device, it is possible to reduce the risk of the encrypted file being decrypted by a third party. it can.

[0009] In one embodiment, the first determining means includes:
This is to determine whether a plaintext file belongs to the drive or folder to be encrypted at regular intervals. If the determination time interval is made longer, the number of times of accessing the drive or folder to be encrypted for the determination is reduced, so that the monitoring load on the drive or folder to be encrypted by the encryption device can be reduced. By shortening the determination time interval, the encryption device can be controlled such that the plaintext file is immediately encrypted into the encrypted file as soon as the plaintext file belongs to the drive or folder to be encrypted.

Needless to say, a means for decrypting the encrypted file to obtain the original plaintext file can be added to the encrypting device. In this case, the encryption device includes a decryption unit that decrypts the encrypted file into a plaintext file using a decryption key for decrypting the encrypted file generated by the encryption unit.
And deleting means for deleting the plaintext file obtained by the decryption by the decryption means based on the given processing end instruction. Since the decrypted plaintext file does not remain in the encryption device, the confidentiality of the contents of the plaintext file is improved.

The present invention also provides a recording medium on which a program for operating the encryption device as described above is recorded. The recording medium includes a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, and the like.

[0012]

DESCRIPTION OF THE PREFERRED EMBODIMENTS FIG. 1 is a block diagram showing an electrical configuration of an encryption / decryption system.

[0013] The encryption / decryption system is constituted by a computer system. The encryption / decryption system includes a processing device 1, a display device 2 for displaying data and the like on the processing device 1, an input device (keyboard, mouse, etc.) for receiving input of data and the like, and storing data and the like. Storage device (hard disk, etc.) 4, CD-RO
CD-ROM for reading data etc. recorded on M7
A drive 5 and an FD drive 6 that reads data and the like recorded on a floppy disk (FD) 8 and records data and the like on the FD 8 are connected.

The storage device 4 stores an encryption / decryption program. By executing the encryption / decryption program, the above-described computer system performs encryption / decryption.
Functions as a decryption system. The encryption / decryption program can be recorded on a portable recording medium such as the CD-ROM 7 or the FD 8. The encryption / decryption program is CD-RO
When recorded in M7, the encryption / decryption program is generally installed in the storage device 4 via the CD-ROM drive 5 and the processing device 1.

The processing device 1 includes a timer 9.
The timer 9 has a clock function and can be used for measuring a predetermined elapsed time.

FIG. 2 shows an example of a data structure (drive structure) of the computer system.

In a computer system, a device connected to the processing device 1 is sometimes called a drive. The type of the drive is identified by an alphabet such as the A drive, the B drive, and the C drive.

More than one drive may be assigned to a device. For example, when the storage area of the hard disk is divided into two areas, two drives are allocated to one hard disk. For example, in one hard disk, the first storage area is called a C drive, and the second storage area is called a D drive.

In a storage device such as a hard disk, a plurality of folders can be created so as to have a tree structure. By creating a folder, files (program files, data files, setting files, etc.) stored in the storage device can be organized. In the example shown in FIG. 2, folder A, folder B, folder C and folder D, and file a and file b belong to drive C. The folder B further includes a folder G and a folder H. File c in folder A, file g in folder G, folder H
File h and file i, folder C file d and file e, folder D file f,
Belong to each.

In the encryption / decryption system, as will be described later, a file (plaintext file) belonging to a drive or folder which is set in advance as a drive or folder to be encrypted is operated by a user of the encryption / decryption system in a special operation. The encrypted file is created without going through the process. When a plaintext file is obtained by decrypting the encrypted / decrypted file, the plaintext file is deleted from the storage device 4 when the encryption / decryption system ends (the encryption / decryption program ends).

FIG. 3 is a flowchart showing the flow of a process for setting a drive or folder to be encrypted, which is one of the processes of the encryption / decryption system. FIG. 4 is a flowchart showing the flow of an encryption process which is one of the processes of the encryption / decryption system. FIG. 5 is a flowchart showing a flow of a decryption process which is one of the processes of the encryption / decryption system.

In operation of the encryption / decryption system, first, a drive or folder to be encrypted is set.

Referring to FIG. 3, when the encryption / decryption program is executed, the computer system starts up as an encryption / decryption system (step 21).

First, a key authentication process is performed (step 22). In the key authentication processing, the user of the encryption / decryption system performs encryption processing (processing of encrypting a plaintext file to create an encrypted file) and decryption processing (decryption of the encrypted file to obtain a plaintext file). ) Is a process for authenticating whether or not the person has a key (encryption key, decryption key) to be used for the key. For example, an ID unique to each user of the encryption / decryption system in advance
And the password and the encryption key / decryption key unique to the user are stored in the storage device 4 in association with each other. The user is informed of the ID and password. When the system is started, an input of an ID and a password is required. If the ID and the password input from the input device 3 match the ID and the password stored in the storage device 4, the process proceeds to the next process (step 23). YE
S). If they do not match, the encryption target drive or folder setting process ends (NO in step 23). Instead of the key authentication process, a process of storing an encryption key / decryption key for the user in the storage device 4 (key registration process) may be performed.

From among a plurality of icons displayed on the display screen of the display device 2, an icon for starting the process of setting the drive or folder to be encrypted is selected and clicked. The process of setting the drive or folder to be encrypted is started.

In the process of setting the drive or folder to be encrypted, one of the above-mentioned drives or folders is selected by the user. A plurality of drives or folders may be selectable. As described below,
The plaintext file belonging to the drive or folder set here is encrypted by the encryption / decryption program.

A file (setting file) for specifying the drive or folder selected as the drive or folder to be encrypted is created (step 24).
The created setting file is stored and stored in the storage device 4 (step 25). The process of setting the drive or folder to be encrypted ends.

Next, an encryption process for encrypting a plaintext file will be described.

Referring to FIG. 4, when the encryption / decryption program is executed, the computer system starts up as an encryption / decryption system (step 31).

A key authentication process is performed (step 32).
The key authentication process is a process of authenticating whether the user of the encryption / decryption system is a person having the encryption key (owner of the encryption key stored in the storage device 4).
For example, as in the authentication process (step 22) in the process of setting the drive or folder to be encrypted (FIG. 3), the authentication is performed using the ID and password for each user of the encryption / decryption system. If the authentication is not successful, the encryption process ends (NO in step 33).

It is authenticated that the user is a user of the encryption / decryption system (YES in step 33), and the encryption process is selected from among a plurality of icons displayed on the display screen of the display device 2. When an icon for starting is selected and clicked, the encryption process is started.

The setting file stored in the storage device 4 is read (step 34). As described above, the setting file describes data for specifying the drive or folder to be encrypted. Every time a predetermined time elapses, encryption processing is performed on files belonging to the encryption target drive or folder specified by the setting file.

That is, the encryption / decryption program monitors the timer 9 and checks the contents of the drive or folder to be encrypted every time a predetermined time elapses (steps 35 and 36).
If a plaintext file belongs to the drive or folder to be encrypted (the display screen of the display device 2 displays as if the plaintext file is stored in the drive or folder to be encrypted) (YES in step 36) ), The encryption / decryption program encrypts the plaintext file using the encryption key of the user (the encryption key used for encryption is specified by the ID and the password).
An encrypted file is created (step 37). The encrypted file is stored in the storage device 4 so as to belong to the drive or folder to be encrypted. The plaintext file does not remain in the storage device 4 but is stored as an encrypted file.

Whether or not the plaintext file exists in the drive or folder to be encrypted can be determined by, for example, the extension added to the file name. If a specific extension is added to the encrypted file created by the encryption process, it can be understood that the file with an extension other than the extension is a plaintext file.

Until the execution of the encryption / decryption program ends, the encryption / decryption program periodically determines whether a plaintext file belongs to the drive or folder to be encrypted (NO in step 38, step 3).
5, step 36). When an instruction to end the encryption / decryption program is given from the input device 3, the operation of the computer system as the encryption / decryption system ends (YES in step 38). Through such encryption processing, for example, if folder H is set as an encryption target folder in the data structure (drive structure) shown in FIG. 2, files h and file i belonging to folder H are encrypted. So that it belongs to folder H,
The encrypted file h and the encrypted file i are stored. File h and file i are in folder H
Does not remain.

Generally, in word processing software (program), spreadsheet software, other application software, utility software, etc., files created using the software are stored in any drive or folder in the storage device 4. Whether to remember so that it belongs to (so-called storage destination)
Can be set in advance. For this reason, if a drive or folder to be encrypted is set as a storage destination of a file (plain text file) created by application software or the like, a user of the encryption / decryption system does not need to perform any special operation. An encrypted file obtained by encrypting the plaintext file can be obtained. Since the plaintext file does not remain in the storage device 4, the confidentiality of the created file contents is high. Preferably, the above-described routine for the encryption process is executed in cooperation with the above-described application software and utility software. When a file (plaintext file) is created and saved by application software or the like, it is saved as an encrypted file.

Next, a decryption process for decrypting an encrypted file to obtain a plaintext file will be described.

Referring to FIG. 5, when the encryption / decryption program is executed, the computer system starts up as an encryption / decryption system (step 41).

A key authentication process is performed (step 42).
This key authentication process is a process for authenticating whether or not the user of the encryption / decryption system has a decryption key. For example, an I / O unique to the user input from the input device 3 by the user of the encryption / decryption system
Authentication processing is performed based on D and the password. If the authentication is not successful, the decryption process ends (step 43).
NO).

It is authenticated that the user is a user of the encryption / decryption system (YES in step 43), and the user starts the decryption process from among a plurality of icons displayed on the display screen of the display device 2. When the icon is selected and clicked, the decoding process starts.

The user uses the input device 3 to select an encrypted file to be decrypted (step 4).
Four).

The decryption process is performed on the selected encrypted file. The plaintext file (decrypted plaintext file) based on the encrypted file using the user's decryption key
(Step 45). The key (decryption key) used for decryption is the same key (common key) as the encryption key used for encryption
Or different keys (for example, a pair of public key and secret key are prepared, and a public key is used for encryption and a secret key is used for decryption). Also preferably, a plaintext file obtained by decryption (decrypted plaintext file)
Are stored in the storage device 4 so as to belong to a preset decryption folder.

When an instruction to end the processing of the encryption / decryption program is input (step 46), the encryption / decryption program deletes the decrypted plaintext file belonging to the decryption folder from the storage device 4 (YES in step 46, Step 47).
No plaintext file remains in the decryption folder. Thereafter, the operation of the computer system as an encryption / decryption system ends.

In a situation where a plaintext file is obtained by decrypting an encrypted file, for example, when the contents of the plaintext file are changed, such as by processing or correcting a sentence or the like represented by the plaintext file, or when the plaintext file is used. There is a case where a sentence or the like to be represented is printed using a printing device and output. In any case, the plaintext file obtained by decryption is not always necessary thereafter.
When a new plaintext file is obtained by changing the contents of the plaintext file, a new encrypted file may be created by performing the above-described encryption process on the newly obtained plaintext file. That is, if the storage destination of the new plaintext file is the drive or folder to be encrypted, as described above, the encrypted file is created without the user of the encryption / decryption system being particularly conscious, and the encryption target is created. The data can be stored in the storage device 4 as belonging to a drive or a folder. Even if the contents of the plaintext file are not changed, if the plaintext file is created from the encrypted file and the original encrypted file is saved as it is in the drive or folder to be encrypted, the result is obtained by decryption. Even if the plaintext file is deleted, the same plaintext file can be obtained again by decrypting the stored encrypted file. In any case, since the plaintext file does not remain in the storage device 4, the confidentiality of the contents of the plaintext file is high.

In the above embodiment, the key (encryption / decryption key) is stored in the storage device 4 in advance.
The encryption / decryption key may be recorded in advance in D, and the encryption / decryption key recorded in the FD may be read from the FD using the FD drive 6 and used for the encryption / decryption processing. In this case, it is not always necessary to store the encryption / decryption key in the storage device 4 in advance.

The drive or folder to be encrypted may be set for each encryption / decryption key. For example, when a plurality of users use one computer system as an encryption / decryption system, a drive or folder to be encrypted can be set for each user. Of course, a plurality of drives or folders to be encrypted may be set for one user.

[Brief description of the drawings]

FIG. 1 is a block diagram showing an electrical configuration of an encryption / decryption system.

FIG. 2 shows an example of a data structure (drive structure) of the computer system.

FIG. 3 is a flowchart showing a flow of a setting process of a drive or a folder to be encrypted.

FIG. 4 is a flowchart illustrating a flow of an encryption process.

FIG. 5 is a flowchart illustrating a flow of a decoding process.

[Explanation of symbols]

 Reference Signs List 1 processing device 2 display device 3 input device 4 storage device 5 CD-ROM drive 6 FD drive 7 CD-ROM 8 FD 9 timer

Claims (8)

[Claims] A setting unit for setting a drive or folder to be encrypted; a first determining unit for determining whether a plaintext file belongs to the drive or folder to be encrypted set by the setting unit; Encrypting means for generating an encrypted file from the plaintext file using an encryption key for encrypting the plaintext file when it is determined by the determining means that the plaintext file belongs to the drive or folder to be encrypted , An encryption device comprising: 2. A storage means for storing user identification information provided corresponding to each of the plurality of encryption keys, an input means for receiving an input of information, and information input from the input means being stored in the storage means. A second determining means for determining whether the information matches the user identification information stored in the storage means. The second determination means stores the user identification information matching the information input from the input means in the storage means. 2. The encryption device according to claim 1, wherein when it is determined that the plaintext file is stored, the plaintext file is encrypted using an encryption key corresponding to the user identification information. 3. The encryption device according to claim 1, wherein the setting unit sets an encryption target drive or folder for each encryption key used in the encryption unit. 4. The apparatus according to claim 1, wherein the first determination means determines whether a plaintext file belongs to a drive or a folder to be encrypted at regular time intervals. Encryption device. 5. A decryption unit for decrypting an encrypted file into a plaintext file using a decryption key for decrypting the encrypted file generated by the encryption unit, and the decryption based on a given processing end instruction. 5. The encryption device according to claim 1, further comprising a deletion unit that deletes a plaintext file obtained by decryption by the unit. 6. A drive or folder to be encrypted is set, and it is determined whether a plaintext file belongs to the set drive or folder to be encrypted, and it is determined that a plaintext file belongs to the drive or folder to be encrypted. And an encryption method for generating an encrypted file from the plaintext file using an encryption key for encrypting the plaintext file when the file is encrypted. 7. An encryption target drive or folder is set based on given setting data, it is determined whether a plaintext file belongs to the set encryption target drive or folder, and the encryption target drive or folder is set to the encryption target drive or folder. When it is determined that the plaintext file belongs, a program for controlling the computer to generate an encrypted file from the plaintext file using an encryption key for encrypting the plaintext file is stored. Possible recording medium. 8. An encrypted file to be decrypted is specified based on the given selection data, and the specified encrypted file to be decrypted is converted into a plaintext file using a decryption key for decrypting the encrypted file. 8. The recording medium according to claim 7, wherein a program for controlling a computer to decrypt and delete a plaintext file obtained by decryption based on a given processing end instruction is stored.