JP2003167784A - Peripheral equipment, control device, control method, and storage medium with controlling program stored therein - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enhance the secrecy by setting the authority of decoding processing of the data exchanged between peripheral equipment and a client PC through a network and to allow the use limitation every part of the data or by a more detailed condition such as permission of the use of two or more public keys. <P>SOLUTION: A control device for forming data by use of a computer or the like and transmitting it to peripheral equipment comprises a means for receiving two or more public keys transmitted from the peripheral equipment; a means for receiving the authority information of secret key use transmitted from the peripheral equipment; a means for selecting a public key allowed to be used by a user to be permit to decode the formed data from the received public keys, and a means for encrypting the data by use of the selected public key. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a peripheral device for performing data transmission / reception processing by applying public key cryptography, a control device, a control method, and a medium storing a control program.

[0002]

2. Description of the Related Art Conventionally, in a peripheral device and a client PC that exchange data using a network, the peripheral device and the client PC use public key cryptography to maintain the confidentiality of data and There was no need to set usage rights.

Regarding public key cryptography, "Network Security" (Charlie Kaufman, Ladeia Perlman, Mike Svesiner, Keiichiro Ishibashi,
Hiroaki Kikuchi, Aya Matsui, Yusuke Doi, Prentice Hall, Inc.).

[0004]

However, a peripheral device or a client PC is used before the received data is used.
If the key is held in, the key usage authority was not set for each user, so it was not possible to restrict the users who can decrypt the data and allow the usage, and the confidentiality was low. In addition, it has not been possible to restrict the use of each part of data or the condition that the use of a plurality of public keys must be permitted.

When the received data is stored in the peripheral device or the client PC before being used, the confidentiality is protected, the use is restricted for each part of the data, and the use of a plurality of public keys is restricted. , It is intended to enable the use of multiple public keys to be restricted on the condition that they must be authorized.

[0006]

Therefore, in the present invention, a medium storing a peripheral device, a control device, a control method, or a program to be controlled, which is described in any of the following items (1) to (12). It is intended to achieve the above-mentioned object by providing.

(1) A control device for creating data using a computer or the like and transmitting the data to a peripheral device, and a means for receiving a plurality of public keys transmitted from the peripheral device, and a device transmitting the public key from the peripheral device. A means for receiving private key usage authority information, and a means for referencing the private key usage authority information and selecting a public key that is permitted to be used by a user who wants to permit decryption of the created data from the received public keys. And a means for encrypting data using the public key thereof.

(2) A means for dividing the created data into several parts and a secret key use authority information are referred to, and the respective parts obtained by dividing the created data from the received public key are allowed to be decrypted. The user has a means for selecting a public key that the user wants to use, and a means for encrypting each part obtained by dividing the data by using the public key. Control device.

(3) A means for selecting a plurality of public keys permitted to be used by a user who wants to permit the decryption of the created data from the received public keys by referring to the secret key use authority information, and a plurality of the means. The control device according to (1) or (2) above, further comprising means for encrypting data using the public key.

(4) A peripheral device for receiving and analyzing data transmitted from a client, which holds a plurality of public keys and private keys in public key cryptography, and holds the held public key to the client. A means for transmitting, a means for authenticating the user, a means for registering / holding secret key use authority information which is information that sets which secret key is permitted to be used for each user, and the created secret key use The means for sending authority information to the client, the means for holding the data in the peripheral device in the encrypted state when the data encrypted by the public key sent to the client is sent, and the user When trying to use the data that is kept encrypted from the peripheral device,
A control device comprising means for referring to the private key usage authority information and performing decryption using only the private key available to the user.

(5) When the user tries to use the data held encrypted from the peripheral device, the target data is composed of a plurality of parts, each of which is encrypted with a different secret key. In the case where the private key use authority information is referred to, there is provided means for respectively decrypting each divided part of the data by using only the private key that can be used by the user. The control device according to 4).

(6) When the user tries to use the data that is kept encrypted from the peripheral device, if the target data is encrypted with a plurality of secret keys, secret key use authority information The control device according to (4) or (5) above, further comprising means for performing decryption using only a plurality of secret keys available to the user.

(7) A control method for creating data using a computer or the like and transmitting the data to a peripheral device, which includes a means for receiving a plurality of public keys transmitted from the peripheral device and a method for transmitting the public key from the peripheral device. Refer to the private key usage authority information and the private key usage authority information, and select the public key that is permitted to be used by the user who wants to permit the decryption of the created data from the held public keys. And a means for encrypting data by using the public key thereof.

(8) The means for dividing the created data into several parts, and the private key utilization authority information are referred to, and the data created from the held public key is decrypted into each part. In the above (7), there is provided means for selecting a public key which is permitted to be used by a user who wants to authorize the user, and means for respectively encrypting each part obtained by dividing the data by using the public key. The described control method.

(9) A means for selecting a plurality of public keys permitted to be used by a user who wants to permit the decryption of the created data from the received public keys by referring to the private key utilization authority information, and a plurality of the means. 9. The control method according to (7) or (8) above, further comprising means for encrypting data by using the public key.

(10) A medium storing a control program for creating data using a computer or the like and transmitting the data to a peripheral device, and a means for receiving a plurality of public keys transmitted from the peripheral device, and the peripheral device. A public key that can be used by a user who wants to permit the decryption of the data created from the received public key by referring to the means for receiving the transmitted private key usage authority information and the secret key usage authority information. A medium storing a control program, characterized in that it has a means for selecting and a means for encrypting data using its public key.

(11) A means for dividing the created data into several parts and each part obtained by dividing the created data from the received public key by referring to the secret key use authority information.
(10) A means for selecting a public key that a user who wants to permit decryption is permitted to use, and a means for encrypting each part obtained by dividing the data using the public key are provided. A medium storing the control program described in (1).

(12) A means for selecting a plurality of public keys permitted to be used by a user who wants to permit the decryption of the created data from the received public keys by referring to the secret key utilization authority information, and a plurality of the means. (10) or (1) characterized by having means for encrypting data using the public key of
A medium storing the control program described in 1).

[0019]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described in detail below with reference to the drawings. (Embodiment) In a system which is an example of the present invention, public key cryptography is used for data exchange.

FIG. 1 shows a system configuration which is an example of the present invention. Client PC 1 which is an example of a data creation / transmission processing control device or a data reception / analysis processing control device
01 to 104, 113 to 115, a printer 106 which is an example of a data receiving / analyzing peripheral device, a scanner 107 which is an example of a data creating / transmitting peripheral device, and a FAX 108 which is an example of a data creating / transmitting / receiving / analyzing peripheral device. Network interface cable Ether
They are connected via a net interface cable 109 and constitute a system capable of mutual communication processing. Also connected to this network system is a key server machine 105 that holds a key and has the ability to distribute the key to the request source if there is a request. In addition, the printer 106,
The scanner 107 and the FAX 108 are client PCs 113, 114 and 115, and an IEEE1284 or IEEE1394 interface cable 110 and 1, respectively.
They are connected via 11, 112 and can perform communication processing. Each peripheral device is connected to a client PC
The functions and data are analyzed according to the requests and the functions are realized according to the requests.

FIG. 2 is an example of a block configuration diagram of a data creation / transmission processing control device, a data reception / analysis processing control device, or a key server machine constituting the system of the present invention.

Unless otherwise specified, these devices are implemented by the following methods.

In the computer, the CPU 201 has a RAM 202, a ROM 203, a user command input device 204, a display 205, an external storage device 206, an HD drive 207, and an Ethernet via a main bus 210.
Interface 208, IEEE1284 or IE
The EE1394 interface 209 is controlled and implemented. The user command input device 204 is specifically a mouse, a keyboard, etc., and the external storage device 206 is a floppy (registered trademark) disk drive, MO disk drive, CD-ROM drive, IC memory card drive, or the like.

This control device is provided with a basic I / O program, O
It operates by the CPU 201 executing S, the data creation / transmission processing control program, the data reception / analysis processing control program, or the key server program. The basic I / O program is written in the ROM 203, and the OS and the data creation / transmission processing control program, the data reception / analysis processing control program, or
The key server program is stored in the HD 207. When the power of the control device is turned on, the basic I / O
The OS is transferred from the HD 207 to the RAM 202 by the IPL (Initial Program Loading) function in the O program.
And the operation of the OS is started.

In the case of the present embodiment, the OS and the data creation / transmission processing control program, the data reception / analysis processing control program, or the key server program is a floppy disk, MO disk, CD-ROM, IC memory card. It may be recorded in an external storage medium (medium storing a control program) 211 such as.
The OS and data creation / transmission processing control program, data reception / analysis processing control program, or key server program recorded in the external storage medium 211 are shown in FIG.
It can be loaded into this computer system through an external storage device 206 as shown in FIG. When this external storage medium 211 is set in the external storage device 206, O
Under the control of the S and basic I / O programs, the OS and the data creation / transmission processing control program, the data reception / analysis processing control program, or the key server program are read from the external storage medium 211 and loaded into the RAM 202. It becomes operable.

The OS and the data creation / transmission processing control program, the data reception / analysis processing control program, or the key server program are the Ethernet interface 208, the IEEE1284 or the IEEE13.
The configuration may be such that it is loaded into the RAM 202 via the 94 interface 209 and becomes operable.

Further, the present data creation / transmission processing control program, data reception / analysis processing control program, or key server program is recorded in the ROM 203, and is configured to be a part of the memory map. ,
It is also possible to directly execute it by the CPU 201.

FIG. 4 shows a memory map in a state in which the data creation / transmission processing control program, the data reception / analysis processing control program, or the key server program is loaded into the RAM 202 and becomes executable.

FIG. 5 is an example of a block diagram of the data creation / transmission peripheral device or the data reception / analysis peripheral device of the present invention.

Unless otherwise specified, these peripheral devices are implemented by the following methods.

Inside the peripheral device, the CPU 501 has a RAM 502, a ROM 503, a user command input device 504, a display 505, an HD drive 506, an Ethernet interface 50 via a main bus 510.
7. IEEE 1284 or IEEE 1394 interface 508, print engine or scanner engine or FAX engine 509 is controlled and implemented.

This control device is provided with a basic I / O program, O
It operates by the CPU 501 executing S, the data creation / transmission processing control program, and the data reception / analysis processing control program. Basic I / O program, O
The S, data creation / transmission processing control program, and data reception / analysis processing control program are written in the ROM 503.

The RAM 502 is a data storage area with no usage restrictions, and is an area used for data expansion and the like.

The engine 509 creates data to be transmitted and processes the analysis result of the received data.

As an example of the processing, an image reading processing or a printing processing can be considered.

FIG. 6 shows data encryption / reception of a client PC which is an example of the data creation / transmission processing control device of the present invention.
7 is a schematic flow chart at the time of transmission, FIG. 7 is a schematic flow chart at the time of data reception / decoding of a peripheral device which is an example of the data reception / analysis processing peripheral device of the present invention, and FIG. It is a schematic diagram.

Peripheral device 106 in the system of the present invention
~ 108 holds their own public key and private key. Each client PC 101-104 and 113-115
When a public key is required, such as when transmitting data to the peripheral devices 106 to 108, the peripheral devices 106 to 108 are requested to transmit the public key (602, 603). Peripherals 106-1
08 is each client PC 101-104 according to a request
And send the public key to 113-115 (702, 70).
3). Client PCs 101-104 and 113-11
5 encrypts the data using the received public key (60
4, 605), and the peripheral devices 106 to 1 used for encryption.
The information that the public key of 08 is attached to the data (6
After that, the encrypted data is transmitted to the peripheral devices 106 to 108 (607). The peripheral devices 106 to 108 confirm the public key used to encrypt the received data (704)
Then, the data is decrypted using the corresponding private key (705, 706).

Further, the peripheral devices 106 to 108 may hold a plurality of sets of public keys and secret keys (FIG. 8) and use them for data processing for each level set for each user. In that case, a secret key that can be used for each user is set in advance in the user authentication system of the peripheral devices 106 to 108. The private key usage authority information (FIG. 9) indicating who can use which private key is stored in each client PC 101.
~ 104 and 113-115, the client P
C101 to 104 and 113 to 115 hold secret key use authority information (FIG. 9). FIG. 11 shows data encryption / transmission of a client PC which is an example of the data creation / transmission processing control device of the present invention when the peripheral device holds a plurality of pairs of public keys and secret keys and uses the secret key use authority information. 12 is a schematic flow chart of a peripheral device which is an example of the data receiving / analyzing peripheral device of the present invention when the peripheral device holds a plurality of pairs of public keys and secret keys and uses the secret key use authority information. FIG. 1 is a schematic flow chart when receiving / decoding data.
3 is a schematic diagram of the flow of the above-mentioned processing.

Client PCs 101 to 104 and 11
When transmitting data to the peripheral devices 106 to 108, reference numerals 3 to 115 are public keys corresponding to the private keys to which the user who wants to use the data in the peripheral device of the transmission destination is authorized to use. From the private key usage authority information (FIG. 9) (1102 to 1104), and requests the peripheral devices 106 to 108 to transmit the resulting public key (1105). The peripheral devices 106 to 108 send the public key to the client PCs 101 to 104 and 113 in response to the request.
To the client PCs 101 to 104 and 113 using this public key.
~ 115 encrypts the data (1106, 1107),
Information that the public key of the peripheral device 106 to 108 is used for encryption is attached to the data (1108), and then the data is transmitted to the peripheral device 106 to 108 (110).
9). The peripheral devices 106 to 108 do not immediately execute processing such as decryption of received data and print processing, and retain the data in the HD drive 506 or the like as it is (12
04, 1205). The user again performs an operation for executing processing of the data held in the peripheral devices 106 to 108. At this time, the user may be the person who created the data, or may be another user. The user can only use the private key that has been authenticated again by the peripheral devices 106 to 108 and that the user is authorized to use in advance. Peripheral devices 106-108
Confirms the public key used for encryption from the information attached to the data, and if the public key that encrypted the data that the user is trying to perform corresponds to the private key that the user can use, the data will be Decryption and processing can be executed.

For example, the client PCs 101 to 104
And from 113 to 115, use is permitted only to the user corresponding to UserID1 in FIG. 9, and UserID2 and U
When transmitting data to the peripheral device that the user corresponding to serID3 does not want to use, the client PC refers to the private key usage authority information (FIG. 9), and UserID1
It can be used by users corresponding to UserID2 and U
The key of ID4 or 7 is searched as a key that cannot be used by the user corresponding to serID3. Client PC 101-
104 and 113 to 115 request the peripheral devices 106 to 108 to transmit the public key of ID4 or 7, and use the public key transmitted in response to the request to encrypt the data and to encrypt the respective data. Information about what public key is used is attached to the data and then transmitted to the peripheral devices 106 to 108.

In this case, the data of one job may be divided into a plurality of pieces and each divided data piece may be encrypted by using a different public key. For example, in FIG. 14, the print job data is divided into four parts, and the public keys Kpu1 and Kpu transmitted from the peripheral device 106 by issuing a request.
2, Kpu4, Kpu7 are used to encrypt the data by the client PCs 101 to 104 and 113 to 115, and the public key information used to encrypt the data is attached to each data and then transmitted to the peripheral devices 106 to 108. ,
It is held as encrypted in the peripheral device 106. For this data, UserID1, UserID2, U
When a user corresponding to serID3 performs a print process, a portion where the user does not have permission to use the private key corresponding to the public key that encrypts each portion of the data cannot be decrypted. The print result is obtained.

Further, one data may be encrypted by using a plurality of public keys.

Further, the client PCs 101 to 104 and 113 to 115 in the system of the present invention may hold a public key and a secret key. FIG. 18 shows a client P which is an example of the data creation / transmission processing control device of the present invention.
19 is a schematic flow of C data encryption / transmission, and FIG.
FIG. 20 is a schematic flow of data reception / decoding of a peripheral device, which is an example of the data reception / analysis processing peripheral device of the present invention, and FIG. 20 is a schematic diagram of the above-described process flow. The client PCs 101 to 104 and 113 to 115 sign and encrypt data using their own private keys (1802, 1
803) After attaching the information indicating which client PC the secret key used to encrypt the data belongs to the data (1804), the information is transmitted to the peripheral devices 106 to 108 (1805). The peripheral devices 106 to 108 determine the transmission source of the received data from the information attached to the data (190
2, 1903), the client PC 1 of the data transmission source
01-104 and 113-115 are requested to transmit the public key (1904). The client PCs 101 to 104 and 113 to 115 transmit the public key in response to the request (18
06, 1807), the peripheral devices 106-108 perform decryption using the received public key (1905, 1906),
It is confirmed that the sender information attached to the data matches the signature information (1907).

Further, in this case, the set of the public key and the secret key is not held for each of the client PCs 101 to 104 and 113 to 115, but is set to the client PCs 101 to 104.
And 113 to 115 are held by the client PCs 101 to 104 and 113 to 115 for each user, and may be used in the same manner as in the case of being held by each of the client PCs 101 to 104 and 113 to 115.

Further, when the peripheral devices 106 to 108 have a printing function and execute the printing process, if the signature is confirmed, the client PCs 101 to 104 and 113 to 115 or the user's signature is confirmed in the print image. You may add and print a proof image that you did. The certification image is written in the header part or the footer part (Fig. 2
1, FIG. 22), or a low-density image printed as wallpaper on the entire printed matter (FIG. 23). Figure 24 shows
FIG. 25 is a schematic flow of data encryption / transmission of a peripheral device which is an example of the data creation / transmission processing peripheral device of the present invention. FIG. 25 shows a client PC which is an example of the data reception / analysis process control device of the present invention. FIG. 26 is a schematic flow when receiving / decoding data, and FIG. 26 is a schematic diagram of the flow of the above-described processing.

Client P in the system of the present invention
When the C 101 to 104 and 113 to 115 hold the public key and the private key, the peripheral devices 106 to 108 transfer the data to the client PCs 101 to 104 and 113 to 115.
When sending to the client PC 101 to 10 of the destination
4 and 113-115 are requested to transmit the public key (240
2, 2403), and the client PCs 101 to 104 and 113 to 115 transmit the public key in response to the request (250
2, 2503), and the peripheral devices 106 to 108 encrypt the data using the received public key (2404, 2405),
Information that the public keys of the client PCs 101 to 104 and 113 to 115 are used for encryption is attached to the data (2406), and then the client PCs 101 to 1
04 and 113-115, the encrypted data is transmitted (2407), and the client PCs 101-104 and 1
13 to 115 may confirm the public key used for encrypting the received data (2504, 2505) and then decrypt the data using the corresponding private key (2506).

Further, in this case, the set of the public key and the secret key is not held for each of the client PCs 101 to 104 and 113 to 115, but to the client PCs 101 to 10.
4 and 113 to 115 may be held by the client PCs 101 to 104 and 113 to 115 for each user, and may be used similarly to the case of holding the client PCs 101 to 104 and 113 to 115.

FIG. 27 is a schematic flow chart of data encryption / transmission of a peripheral device which is an example of the peripheral device of data creation / transmission processing of the present invention, and FIG.
30 is a schematic flow when data is received / decoded by a client PC that is an example of an analysis processing control device, and is a schematic diagram of the flow of the above-described processing in FIG. 29.

Furthermore, when the peripheral devices 106 to 108 in the system of the present invention hold the public key and the secret key,
Each of the peripheral devices 106 to 108 signs / encrypts the data using its own private key (2702, 2703) and attaches to the data information indicating which peripheral device the private key used to encrypt the data belongs to. After that (2704), it is transmitted to the client PCs 101 to 104 and 113 to 115 (27
05), client PCs 101-104 and 113-
115 determines the transmission source of the received data from the information attached to the data (2802, 2803), and requests the peripheral devices 106 to 108 of the transmission source of the data to transmit the public key (2
804), the peripheral devices 106 to 108 transmit the public key in response to the request (2706, 2707), and the client PC
101 to 104 and 113 to 115 perform decryption using the received public key (2805, 2806), and also confirm that the sender information attached to the data and the signature information match (2807). good.

FIGS. 30 to 32 show the data creation and
FIG. 2 is a schematic diagram of a flow of data encryption / transmission / reception / decryption processing of a client PC that is an example of a transmission processing control device, a peripheral device that is an example of a data reception / analysis processing peripheral device, and a key server machine. is there.

The public keys of the peripheral devices 106 to 108 or the private key use authority information are held in the key server machine 105, and the client PCs 101 to 104 and 1 are used.
Reference numerals 13 to 115 request the key server machine 105 to transmit the public key or private key usage authority information when the public keys of the peripheral devices 106 to 108 or private key usage authority information are required (3002, 3102, 3107, 320
7) and obtain (3005, 3105, 3110, 321)
0), use (3006, 3106, 3111, 32
It may be 11). In this case, the key server machine 105
And client PCs 101 to 104 and 113 to 115
May hold a public key and a private key and send each public key to the other party, so that it is possible to perform secure communication.

FIG. 33 and FIG. 34 show the data creation / production of the present invention.
A peripheral device that is an example of a transmission processing peripheral device, and a client P that is an example of a data reception / analysis processing control device
FIG. 9 is a schematic diagram of a flow of data encryption / transmission / reception / decryption processing of C and the key server machine. Client PC
The public keys 101 to 104 and 113 to 115 are held in the key server machine 105, and the peripheral devices 106 to 1
08 is client PC 101-104 and 113-1
When 15 public keys are required, the key server machine 105 is requested to transmit the public key (3302, 3407), acquired (3305, 3410), and used (3306, 341).
It may be 1). In this case, the key server machine 105 and the peripheral devices 106 to 108 hold the public key and the secret key, and transmit the respective public keys to the other party, so that secure communication is possible. Further, the system may have a certification authority that issues certificates. The certificate is the ID of the client PCs 101 to 104 and 113 to 115, the user and the peripheral devices 106 to 108, and the public key corresponding to the ID, signed and encrypted by the private key created by the certification authority by the certification authority. is there. The certification authority does not have to be on the network. The public key of the certification authority is the client PCs 101 to 104 and 113 to 115 and the peripheral device 10.
6 to 108, and each client PC 10
1 to 104 and 113 to 115 and peripheral devices 106 to 10
Reference numeral 8 decrypts the certificate using the public key of the certification authority and authenticates the signature, thereby confirming that the combination of the ID included in the certificate and the public key is a correct combination.

[0053]

In order to solve the above problems, the control device according to claim 1 of the present invention is a control device for creating data using a computer or the like and transmitting the data to the peripheral device. Means for receiving multiple public keys, the means for receiving private key usage authority information sent from the peripheral device, and the method for referring to the private key usage authority information and creating the data created from the received public keys. A means for selecting a public key that the user who wants to permit decryption is permitted to use,
By having a means to encrypt data using the public key, when transmitting the data held in the peripheral device in an encrypted state, the peripheral device decrypts the data and permits the use. It is possible to restrict the users who are allowed to access the data and increase the confidentiality of the data.

In the control device according to claim 2 of the present invention,
The control device according to claim 1, wherein the created data is divided into several parts, and the private key usage authority information is referred to, and the created data is divided into each part obtained from the received public key. By having a means to select a public key that the user who wants to authorize is allowed to use and a means to encrypt each part that divides the data using the public key, When transmitting the data held in the peripheral device, you can restrict the users who are permitted to decrypt the data on the peripheral device and use it for each part of the data, and set detailed security conditions with one data item. It becomes possible to do.

In the control device according to claim 3 of the present invention,
The control device according to claim 1 or 2, wherein the private key utilization authority information is referred to, and a plurality of public keys permitted to be used by a user who wants to permit decryption of the created data from the received public keys are selected. And by having a means for encrypting data using the plurality of public keys, when transmitting the data held in the peripheral device in the encrypted state,
It can be restricted by the condition that the user who decrypts the data on the peripheral device and permits the use must be allowed to use multiple public keys, and can set detailed security conditions with one data. Is possible.

In the peripheral device according to claim 4 of the present invention,
A peripheral device for receiving and analyzing data transmitted from a client, a means for holding a plurality of public keys and private keys in public key cryptography, a means for transmitting the held public key to a client, and a user. Authentication method, a method of registering and holding private key usage authority information that is information that sets which private key is allowed to be used for each user, and sends the created private key usage authority information to the client Means to keep the data encrypted in the peripheral device when the data encrypted by the public key sent to the client is sent, and the user encrypts the data from the peripheral device. When attempting to use the data that is held as it is, refer to the private key usage authority information and use only the private key that can be used by the user to decrypt. By including the, when the transmitted data is stored in the peripheral device in an encrypted state, it is possible to decrypt the data on the peripheral device and restrict the users who are permitted to use the data. It is possible to increase the confidentiality of.

In the peripheral device according to claim 5 of the present invention,
In the control device according to claim 4, when the user tries to use the data held encrypted from the peripheral device, the target data is composed of a plurality of parts, each of which has a different secret key. When encrypted, the private key usage authority information is referred to, and only the private key that can be used by the user is used to decrypt each divided part of the data. When the received data is stored in the peripheral device in an encrypted state, it is possible to decrypt the data on the peripheral device and restrict the users who are permitted to use it for each part of the data. This makes it possible to set detailed security conditions.

In the peripheral equipment according to claim 6 of the present invention,
In the control device according to claim 4 or 5, when a user tries to use data that is kept encrypted from a peripheral device, if the target data is encrypted with a plurality of secret keys, the secret By having the means to refer to the key usage authority information and perform the decryption using only the multiple secret keys that can be used by the user, the transmitted data is stored in the encrypted state in the peripheral device. In this case, it is possible to limit the security on the condition that the user who decrypts the data on the peripheral device and permits the use must be permitted to use multiple public keys. It is possible to set the conditions.

In the control method according to claim 7 of the present invention,
A control method for creating data using a computer or the like and transmitting the data to a peripheral device, including a means for receiving a plurality of public keys transmitted from the peripheral device and secret key use authority information transmitted from the peripheral device. A means for receiving, a means for referring to the private key usage authority information, a means for selecting a public key that is permitted to be used by a user who wants to permit the decryption of the created public key from the held public keys, and the disclosure thereof. By having means for encrypting data using a key, when transmitting data held in the peripheral device in an encrypted state,
It is possible to limit the users who are permitted to use the data by decrypting the data on the peripheral device, and it is possible to improve the confidentiality of the data.

In the control method according to claim 8 of the present invention,
The control method according to claim 7, wherein the created data is divided into several parts, and each part obtained by dividing the created data from the held public key by referring to the secret key use authority information The state of being encrypted by having a means to select a public key that the user who wants to permit decryption is allowed to use and a means to encrypt each part of the data that has been divided using the public key. When transmitting data stored in a peripheral device, users can decrypt the data on the peripheral device and restrict the users who are permitted to use it for each part of the data. It becomes possible to set.

In the control method according to claim 9 of the present invention,
9. The control method according to claim 7, wherein the secret key use authority information is referred to, and a plurality of public keys permitted to be used by a user who wants to permit decryption of the created data from the received public keys are selected. And by having a means for encrypting data using the plurality of public keys, when transmitting the data held in the peripheral device in the encrypted state,
It can be restricted by the condition that the user who decrypts the data on the peripheral device and permits the use must be allowed to use multiple public keys, and can set detailed security conditions with one data. Is possible.

A medium storing a control program according to claim 10 of the present invention is a medium storing a control program for creating data using a computer or the like and transmitting the data to a peripheral device, and has been transmitted from the peripheral device. A means for receiving a plurality of public keys, a means for receiving private key usage authority information transmitted from a peripheral device, and a reference to the private key usage authority information to decrypt the data created from the received public keys Data that is held in the peripheral device in an encrypted state by having a means for selecting a public key that the user who wants to authorize use and a means for encrypting the data using the public key When transmitting a message, it is possible to decrypt the data on the peripheral device and restrict the users who are permitted to use the data, and it is possible to increase the confidentiality of the data.

In the medium storing the control program according to claim 11 of the present invention, means for dividing the created data into several parts and secret key utilization authority information in the medium storing the control program according to claim 10 are provided. Refer to, the method of selecting the public key that the user who wants to permit decryption is permitted to use for each part that divides the data created from the received public key, and the data using that public key. A user who has a means for encrypting each of the divided parts to decrypt the data on the peripheral device and permit the use when transmitting the data held in the peripheral device in the encrypted state. Can be restricted for each part of the data, and detailed security conditions can be set for one data.

In the medium storing the control program according to claim 12 of the present invention, the secret key utilization authority information is referred to in the medium storing the control program according to claim 10 or 11, and the medium is created from the received public keys. The encrypted state is provided by having a means for selecting a plurality of public keys that the user who wants to allow the decrypted data to use and a means for encrypting the data using the plurality of public keys. When sending data held by a peripheral device, the user can decrypt the data on the peripheral device and authorize the use of the data, but the user must be allowed to use multiple public keys. It is possible to set detailed security conditions with one data.

[Brief description of drawings]

FIG. 1 is an example of a system configuration diagram including a client PC and peripheral devices according to the present invention.

FIG. 2 is an example of a block configuration diagram of a data creation / transmission processing control device, a data reception / analysis processing control device, or a key server machine according to the present invention.

FIG. 3 is an example of a diagram showing that a data creation / transmission processing control program, a data reception / analysis processing control program, or a key server program according to the present invention is supplied from a medium to a computer system.

FIG. 4 is an example of a memory map when the data creation / transmission processing control program, the data reception / analysis processing control program, or the key server program according to the present invention operates.

FIG. 5: Peripheral device for data creation / transmission related to the present invention,
Alternatively, an example of a block diagram of the data receiving / analyzing peripheral device

FIG. 6 is an example of a schematic flow of data encryption / transmission of a data creation / transmission processing control device according to the present invention.

FIG. 7 shows an example of a schematic flow of data reception / analysis processing peripheral device data reception / decoding according to the present invention.

FIG. 8 is an example of a schematic diagram of the flow of data encryption / transmission of the data creation / transmission processing control device according to the present invention, and data reception / decryption processing of data reception / analysis processing peripheral devices.

FIG. 9 is an example of a list of private keys held by a peripheral device according to the present invention.

FIG. 10 is an example of private key usage authority information held by a peripheral device according to the present invention.

FIG. 11: Data encryption / transmission of the data creation / transmission processing control device when a plurality of pairs of public keys and private keys are held in the data reception / analysis processing peripheral device according to the present invention and private key usage authority information is used Of the general flow of time

FIG. 12: Data reception / decryption of data reception / analysis processing peripheral device when a plurality of sets of public keys and secret keys are held in the data reception / analysis processing peripheral device according to the present invention and secret key use authority information is used Of the general flow of time

FIG. 13: Data encryption / transmission of the data creation / transmission processing control device when a plurality of sets of public keys and private keys are held in the data reception / analysis processing peripheral device according to the present invention and private key usage authority information is used And an example of a schematic diagram of the flow of data reception / decoding processing of peripheral equipment

FIG. 14 is an example of a data structure of a print job divided into four parts according to the present invention and encrypted using different public keys.

FIG. 15 is an example of a result when a print job having the structure of FIG. 14 according to the present invention is decrypted / printed by an operation of a user who has the authority to decrypt all parts.

FIG. 16 is an example of a result when a print job having the structure of FIG. 14 according to the present invention is decrypted / printed by an operation of a user who has the authority to decrypt two parts.

FIG. 17 is an example of a result of decrypting / printing a print job having the structure of FIG. 14 according to the present invention by an operation of a user who has the authority to decrypt one part.

FIG. 18 is an example of a schematic flow of data encryption / transmission of the data creation / transmission processing control device according to the present invention

FIG. 19 shows an example of a schematic flow of data reception / analysis processing peripheral devices according to the present invention at the time of data reception / decoding.

FIG. 20 is an example of a schematic diagram of a flow of data encryption / transmission of the data creation / transmission processing control device according to the present invention, and data reception / decryption processing of the data reception / analysis processing peripheral device;

FIG. 21: When the peripheral device for data reception / analysis processing according to the present invention has a printing function and executes the printing process, a proof image that the user's signature is confirmed is added to the header part and the printing process is performed. Example of print result when

FIG. 22: When the peripheral device for data reception / analysis processing according to the present invention has a printing function and executes the printing process, the proof image that the user's signature is confirmed is added to the footer part to perform the printing process. Example of print result when

FIG. 23: A wallpaper image is added to the entire printed matter as a low-density proof image that the user's signature is confirmed when the peripheral device for data reception / analysis processing according to the present invention has a printing function and executes printing processing. Example of print result when printing process is performed

FIG. 24 is an example of a schematic flow of data encryption / transmission of peripheral devices for data creation / transmission processing according to the present invention

FIG. 25 is an example of a schematic flow of data reception / decoding of the data reception / analysis processing control device according to the present invention.

FIG. 26 is an example of a schematic diagram of a flow of data encryption / transmission of peripheral devices for data creation / transmission processing and data reception / decryption processing of a data reception / analysis processing control device according to the present invention;

FIG. 27 is an example of an outline flow of data encryption / transmission of data creation / transmission processing peripheral device according to the present invention

FIG. 28 is an example of a schematic flow of data reception / decoding of the data reception / analysis processing control device according to the present invention.

FIG. 29 is an example of a schematic diagram of a flow of data encryption / transmission of peripheral devices for data creation / transmission processing and data reception / decryption processing of a data reception / analysis processing control device according to the present invention;

FIG. 30: Data encryption / transmission of data creation / transmission processing control device according to the present invention, data reception / decryption processing of data reception / analysis processing peripheral device, and disclosure of data reception / analysis processing peripheral device An example of a schematic diagram of the process in which the key server machine distributes the key

FIG. 31: Data encryption / transmission of the data creation / transmission processing control device when a plurality of sets of public keys and private keys are held in the data reception / analysis processing peripheral device according to the present invention and private key usage authority information is used, An example of a schematic diagram of the flow of the data reception / analysis processing peripheral device data reception / decryption processing, and the process of the key server machine distributing the public key of the data reception / analysis processing peripheral device

FIG. 32: Data encryption / transmission of data creation / transmission processing control device according to the present invention, data reception / analysis processing, data reception / decryption processing of peripheral devices, and disclosure of data creation / transmission processing control device An example of a schematic diagram of the flow of processing in which a key server machine distributes a key

FIG. 33 shows the data encryption / transmission of the data creation / transmission processing peripheral device according to the present invention, the data reception / decryption processing of the data reception / analysis processing control device, and the disclosure of the data reception / analysis processing control device. An example of a schematic diagram of the flow of processing in which a key server machine distributes a key

FIG. 34: Data encryption / transmission of data creation / transmission processing peripheral device according to the present invention, data reception / decryption process of data reception / analysis process control device, and data creation / transmission processing peripheral device disclosure An example of a schematic diagram of the flow of processing in which a key server machine distributes a key

[Explanation of symbols]

101, 102, 103, 104 Client PC 105 Key server machine 106 Printer 107 Scanner 108 FAX 109 Ethernet interface cable 110, 111, 112 IEEE1284 or IE
EE1394 interface cables 113, 114, 115 Client PC 201 CPU 202 RAM 203 ROM 204 User command input device 205 Display 206 External storage device 207 HD drive 208 Ethernet interface 209 IEEE 1284 or IEEE 1394 interface 210 Main bus 211 External storage medium 501 CPU 502 RAM 503 ROM 504 User command input device 505 Display 506 HD drive 507 Ethernet interface 508 IEEE1284 or IEEE1394 interface 509 Engine 510 Main bus 2101, 2201, 301 Certification image 2102 Printing of signature on header 2202 Footer part Signature printing of which has been made to made the signature of printing 2302 wallpaper-like

   ─────────────────────────────────────────────────── ─── Continued front page    F-term (reference) 5B017 AA03 BA06 BA07 BA10 BB06                       CA16                 5J104 AA16 DA02 JA21 PA07

Claims (12)

[Claims] 1. A control device for creating data using a computer or the like and transmitting the data to a peripheral device, a means for receiving a plurality of public keys transmitted from the peripheral device, and a secret transmitted from the peripheral device. A means for receiving the key usage authority information, and a means for referring to the private key usage authority information and selecting a public key which is permitted to be used by the user who wants to permit the decryption of the created data from the received public keys. , A control device having means for encrypting data using the public key. 2. A means for dividing the created data into several parts and a secret key use authority information is referred to, and it is desired to permit decryption to each divided part of the data created from the received public key. 2. The control device according to claim 1, further comprising means for selecting a public key that the user is allowed to use, and means for encrypting each part obtained by dividing the data using the public key. . 3. A means for selecting a plurality of public keys permitted to be used by a user who wants to permit the decryption of the created data from the received public keys by referring to the private key use authority information, and a plurality of the means. The control device according to claim 1 or 2, further comprising means for encrypting data using a public key. 4. A peripheral device for receiving and analyzing data transmitted from a client, means for holding a plurality of public keys and private keys in public key cryptography, and transmitting the held public key to the client. Means, a means for authenticating the user, a means for registering and holding private key usage authority information, which is information that sets which private key is allowed to be used for each user, and the created private key usage authority. The means for sending information to the client, the means for holding the data in the peripheral device in the encrypted state when the data encrypted by the public key sent to the client is sent, and the user When attempting to use the data that is kept encrypted from the device, refer to the private key usage authority information and use only the private key that the user can recover. A control device having means for performing encoding. 5. When the user tries to use the data that is kept encrypted from the peripheral device, the target data is composed of multiple parts, each of which is encrypted with a different secret key. In this case, there is provided means for referring to the private key usage authority information and decrypting each of the divided parts of the data by using only the private key available to the user. The control device according to 1. 6. When the user tries to use the data that is kept encrypted from the peripheral device, if the target data is encrypted with a plurality of secret keys, the secret key use authority information is displayed. 6. The control device according to claim 4, further comprising means for performing decryption by using only a plurality of secret keys that the user can refer to. 7. A control method for creating data using a computer or the like and transmitting the data to a peripheral device, comprising means for receiving a plurality of public keys transmitted from the peripheral device and a secret transmitted from the peripheral device. Refer to the private key usage authority information and the method for receiving the key usage authority information, and select the public key that is permitted to be used by the user who wants to permit the decryption of the created data from the held public keys. A control method comprising means and means for encrypting data using the public key thereof. 8. A means for dividing the created data into several parts, and a method of referring to the secret key usage authority information, and decrypting each part of the created data divided from the held public key. 8. The device according to claim 7, further comprising: a means for selecting a public key that the user who wants to use is allowed to use, and a means for encrypting each part obtained by dividing the data by using the public key. Control method. 9. A means for selecting a plurality of public keys permitted to be used by a user who wants to permit the decryption of the created data from the received public keys by referring to the private key use authority information, and a plurality of the means. 9. The control method according to claim 7, further comprising means for encrypting data using a public key. 10. A medium storing a control program for creating data using a computer or the like and transmitting the data to a peripheral device, and means for receiving a plurality of public keys transmitted from the peripheral device, and transmitting from the peripheral device. Refer to the private key usage authority information that has been received and the private key usage authority information, and specify the public key that the user who wants to permit decryption of the data created from the received public key is allowed to use. A medium storing a control program, which has a means for selecting and a means for encrypting data using the public key thereof. 11. A means for dividing the created data into several parts and a secret key use authority information is referred to, and it is desired to permit decryption to each part of the received public key created by dividing the created data. 11. The control program according to claim 10, further comprising means for selecting a public key that the user is allowed to use, and means for encrypting each part obtained by dividing the data using the public key. The medium that stores the. 12. A means for selecting a plurality of public keys permitted to be used by a user who wants to permit the decryption of the created data from the received public keys by referring to the private key use authority information, and a plurality of the means. The medium storing the control program according to claim 10 or 11, further comprising means for encrypting data using a public key.