JP2004030099A - Equipment and method for preventing information leakage - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent information leakage by allowing to change a key for reading an encoded file (application data) for every file or for every user to increase concealment and safety. <P>SOLUTION: A capsule generation means 1 generates a capsule 23 containing encoding application data 28 encoded application data 27 by means of a key 22 generated for every capsule 23 and an encoding key 29 encoded by means of the key 22 by means of the publication key 25 of a user. A capsule processing means 50 decodes the encoding key 29 by means of the secret key 26 of the user to form a second decoded key and decodes the encoding application data by means of the second decoded key to deliver the encoding application data to an application program 2. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an information leakage prevention device that safely controls the disclosure of data to be operated by a computer or other application on a computer or the like by using encryption processing to prevent information from being illegally leaked. Things.
[0002]
[Prior art]
FIG. 8 is a block diagram of a conventional information leakage prevention device disclosed in, for example, Japanese Patent Application Laid-Open No. Hei 10-301856, wherein 1001 denotes an application for requesting input / output to an external storage device, and 1002 denotes a user based on a user ID and a password. A user authentication unit for performing authentication; 1003, a file system that instructs a driver 1004 to perform input / output processing in response to an input / output request from the application 1001; 1004, a driver that performs various types of file processing; Open means 1006, reading means 1006 for reading a file, writing means 1007 for writing a file, closing means 1008 for closing a file, 1009 reading data from a file in an external storage device 1010. Write out That I / O unit, 1010 denotes an external storage device for storing data.
[0003]
Next, the operation will be described.
FIG. 9 is a flowchart showing the data reading operation in the prior art shown in FIG. 8. In step S1001, the application 1001 issues a reading request to the driver 1004 through the file system 1003. In step S102, the user authentication unit 1002 performs user authentication. Step S1003 is a step in which the user authentication unit 1002 determines an authentication result. Step S1004 is a step in which data is read from the external storage device 1010.
[0004]
First, the application 1001 issues a read request to the file system 1003 driver 1004 (step S1001). Next, the user authentication unit 1002 authenticates the user who has issued the read request using the user ID and the password (step S1002). Next, the driver 1004 opens the target file by the opening means 1005, and when the target data is encrypted, the driver 1004 determines whether or not the user can access the target file according to its own rules. It is determined whether or not is possible (step S1003). If access is possible as a result of the determination, the read means 1006 reads the requested data from the external storage device 1010 through the I / O means 1009, and if the data is encrypted, decrypts it using its own decryption key. Then, it returns to the application 1001 (step S1004).
[0005]
When writing data to the external storage device 1010, in response to a write request from the application 1001, the writing unit 1007 encrypts the target data with its own encryption key, and then writes the data to the external storage device via the I / O unit 1009. Write to 1010.
[0006]
According to this conventional technology, when an application uses an encrypted file, the existing application is not used and the application is used without creating a work file that once decrypts all the data in the file. It is intended to enhance the confidentiality of data by making it possible to encrypt data and writing the data to an external storage device after encrypting the data.
[0007]
[Problems to be solved by the invention]
This conventional technique is configured as described above, so that a key for decrypting data must be fixedly held in the system, and thus has a problem in security.
That is, the key for decrypting data cannot be changed for each file or for each user, and there is a problem that the leakage of one key makes it possible to decrypt all data.
[0008]
In addition, the above-described conventional technology performs user authentication completely independently of data encryption and decryption processing. Therefore, if authentication processing fails or the authentication processing is tampered with, unauthorized user data There is a problem that decoding becomes possible.
[0009]
SUMMARY OF THE INVENTION The present invention has been made to solve the above-described problems, and it is possible to prevent information leakage by enabling a key for reading an encrypted file (application data) to be changed for each file or each user. The purpose is to prevent and increase confidentiality and security.
[0010]
[Means for Solving the Problems]
An information leakage prevention device according to the present invention is an information leakage prevention device that prevents leakage of application data disclosed only to a specific user, and includes a capsule generation unit, a capsule processing unit, and a storage unit. The capsule generation means generates a first key for encrypting arbitrary data and a second key for decrypting data encrypted with the first key, and encrypts the application data with the first key. Generating a capsule including the encrypted encrypted application data and an encrypted second key obtained by encrypting the second key with the public key of the user; And obtains the encrypted application data contained in the obtained capsule in the storage means, and obtains the usage corresponding to the user's public key from the user. And decrypts the encrypted second key contained in the capsule with the acquired user's private key to obtain a decrypted second key, reads the encrypted application data from the storage means, The read encrypted application data is decrypted with the decrypted second key, and the storage means stores the encrypted application data written by the capsule processing means.
[0011]
In the information leakage prevention device according to the present invention, the first key and the second key are the same, and are keys of a common key system.
[0012]
Further, in the information leakage prevention device according to the present invention, the capsule generated by the capsule generating means further includes application information for specifying an application program using the application data, and the capsule processing means further includes: The application information is acquired, an application program corresponding to the application information is started, and it is determined whether the started application program is to be managed by the capsule processing means. If it is determined that the encrypted application data is to be managed by the means, the encrypted application data read and decrypted from the storage device in response to the read request issued by the started application program is executed. It was one in which was to be passed to the application program.
[0013]
Also, in the information leakage prevention device according to the present invention, the capsule processing means may determine whether the activated application program is to be managed by the capsule processing means. A read request for the data by the activated application program is used.
[0014]
Further, in the information leakage prevention device according to the present invention, the capsule processing means includes a capsule executing means and a driver, and the capsule executing means acquires the capsule generated by the capsule generating means, and stores the capsule in the acquired capsule. Instructing the driver to write the included encrypted application data into the storage means, obtaining the user's secret key from the user, and using the obtained user's secret key to obtain the encrypted The second key is decrypted to obtain a decrypted second key, the application information is obtained from the capsule, and an application program corresponding to the application information is started. The application program that has been started is If it is determined that the application data is to be managed by the driver, the encrypted application data is read from the storage device in response to the read request issued by the activated application program, and the read encrypted application data is executed by the capsule. The means decrypts the decrypted second key and passes it to the application program.
[0015]
Also, in the information leakage prevention device according to the present invention, the capsule executing means may be such that the computer acquires the capsule generated by the capsule generating means and writes the encrypted application data included in the obtained capsule to the storage means. Instruct the driver to obtain the user's secret key from the user, and decrypt the encrypted second key contained in the capsule with the obtained user's secret key to obtain a decrypted second key. , Is obtained by acquiring application information from the capsule and executing a program for starting an application program corresponding to the application information.
[0016]
Also, in the information leakage prevention device according to the present invention, the driver may be configured such that the computer determines whether the application program started by the capsule executing means is a management target of the driver, and the started application program If it is determined that the application data is to be managed, the encrypted application data is read from the storage device in response to the read request issued by the activated application program, and the read encrypted application data is stored in the capsule execution unit. Is executed by executing a program decrypted with the decrypted second key and passed to the application program.
[0017]
Further, in the information leakage prevention device according to the present invention, when the driver determines whether the activated application program is a management target of the driver, the driver activates the encrypted application data stored in the storage unit. A read request by the application program is used.
[0018]
In the information leakage prevention device according to the present invention, the first key and the second key are the same, and are keys of a common key system.
[0019]
Further, in the information leakage prevention device according to the present invention, the driver acquires the decrypted second key from the capsule execution unit, and stores the decrypted second key in the storage unit of the application data received and used by the application program in response to the read request. Is issued, the application data is encrypted with the decrypted second key and written to the storage means.
[0020]
Further, in the information leakage prevention device according to the present invention, the first key is a public key of the capsule, and the second key is a secret key corresponding to the public key of the capsule.
[0021]
Further, in the information leakage prevention device according to the present invention, the capsule generated by the capsule generating means further includes the first key, the capsule executing means obtains the first key from the obtained capsule, and the driver Acquiring the first key from the capsule executing means, and when the application program issues a write request to the storage means for the application data received and used in response to the read request, In this case, the data is encrypted with one key and written to the storage means.
[0022]
Also, in the information leakage prevention device according to the present invention, the capsule execution means includes a driver monitoring means and a first application control means, and the driver monitoring means operates the driver and alters the driver. The first application control unit is instructed to stop the application program if it is verified that there is no application program.
[0023]
Also, in the information leakage prevention device according to the present invention, the driver includes a driver monitoring unit monitoring unit and a second application control unit, and the driver monitoring unit monitoring unit is configured to execute the driver monitoring unit when the driver monitoring unit is operating. The monitoring means verifies that the data has not been tampered with. If the verification cannot be performed, the second application control means is instructed to stop the application program.
[0024]
In the information leakage prevention device according to the present invention, the first key and the second key are generated for each capsule.
[0025]
Further, the information leakage prevention device according to the present invention uses a user key, which is a key of a common key system applicable to encryption and decryption of arbitrary data, instead of the user's public key and the user's secret key. It is intended to be used.
[0026]
Further, an information leakage prevention method according to the present invention is directed to an information leakage prevention apparatus that includes a capsule generation unit, a capsule processing unit, and a storage unit and that prevents leakage of application data disclosed only to a specific user. A method comprising the following steps.
(1) a key generation step in which the capsule generation means generates a first key for encrypting arbitrary data and a second key for decrypting data encrypted with the first key;
(2) Encapsulation means for encrypting the application data with the first key and encrypting the application data, and encrypting the second key with a public key of the user and an encrypted second key. A capsule generating step of generating a capsule including:
(3) an encryption application data writing step in which the capsule processing means obtains the capsule generated by the capsule generation means in the capsule generation step, and writes the encrypted application data included in the obtained capsule into the storage means;
(4) The capsule processing means obtains the user's private key corresponding to the user's public key from the user, and the encrypted second key included in the capsule with the obtained user's private key. A key decryption step for decrypting the second key as a decrypted second key;
(5) Encryption in which the capsule processing means reads the encrypted application data written in the storage means in the encrypted application data writing step from the storage means and decrypts the read encrypted application data with the decrypted second key. Application data decryption step.
[0027]
Further, in the information leakage prevention method according to the present invention, the capsule generated by the capsule generating means in the capsule generating step further includes application information for specifying an application program using the application data, and the capsule processing means further includes: The following operation is performed. .
(6) an application program starting step of obtaining the application information from the obtained capsule and starting an application program corresponding to the application information;
(7) an application program determining step of determining whether the application program started in the application program starting step is to be managed by the capsule processing means;
(8) In the application program determining step, when it is determined that the activated application program is to be managed by the capsule processing means, the storage device corresponds to a read request issued by the activated application program. Reading the decrypted encrypted application data from the application program to the activated application program.
[0028]
Further, the information leakage prevention method according to the present invention includes a user key, which is a key of a common key system applicable to encryption and decryption of arbitrary data, instead of the user's public key and the user's secret key. It is intended to be used.
[0029]
BEST MODE FOR CARRYING OUT THE INVENTION
Embodiment 1 FIG.
Embodiment 1 of the present invention will be described with reference to FIGS.
FIG. 1 is a block diagram of an information leakage prevention device according to this embodiment, FIG. 2 is a diagram showing a configuration of a capsule and a system including a capsule generation server, and FIG. 4 is a flowchart for explaining the operation at the time of reading.
[0030]
In FIG. 1, reference numeral 1 denotes capsule executing means for processing the capsule shown in FIG. 2, 2 denotes an existing application program using application data, and 3 denotes input / output means 9 in response to a request from the application program 2. A driver for inputting and outputting data to and from the external storage device 10, a writing unit 4 for writing data to the external storage device 10 using the input / output unit 9 in response to a request from the application program 2, a key management unit 5 Is encryption means for encrypting the data given from the writing means 4 using the key given from the key management means 5 in accordance with the instruction of the key management means 5, and 7 is the key management means 5 in accordance with the instruction of the key management means 5. Decrypting means for decrypting the data provided from the reading means 8 using the key provided from the application program 2; Reading means for reading data from the external storage device 10 using the input / output means 9 in response to the read request from the external storage device 9, and input / output means 9 for writing / reading data to / from the external storage device 10 according to a request from the driver 3. Reference numeral 10 denotes an external storage device such as a hard disk drive or a flexible disk drive for storing application data. Reference numeral 50 denotes a capsule processing unit including the capsule execution unit 1 and the driver 3.
[0031]
FIG. 2 is a diagram illustrating a configuration of a capsule and a configuration of a system including a capsule generation server that generates a capsule.
In the figure, 21 is a capsule generation server that generates a key Ka22 and a capsule 23, and 24 is a user of this system, and holds a public key Kp25 and a secret key Kq26, which are a public key pair. The secret key 26 is different for each user, and is stored in, for example, an unillustrated hardware such as an IC card which cannot be analyzed or tampered with. The key Ka22 is generated for each capsule.
27 is application data used by the application 2; 28 is encrypted application data obtained by encrypting the application data with the key Ka22; 29 is encrypted data obtained by encrypting the key Ka22 with the public key 18 of the user The key Kac, 30 is application information for starting the application 2 using the application data 19.
[0032]
The capsule generation server 21 of FIG. 2 is managed by the same system administrator as the administrator (not shown) that manages the information leakage prevention device shown in FIG. The user 24 submits his / her public key Kp25 to the system administrator and applies for a license. The system administrator applies the public key Kp25 only to the user 24 who is permitted to view the application data 27. Encrypts the key Ka22 to generate the capsule 23.
The capsule 23 has identification information added so that the capsule 23 can be specified by designating the user 24 and the application data 27.
[0033]
The capsule executor 1 and the driver 3 each include a CPU and a RAM as a working memory, and operate according to an information leakage prevention program, which is software stored in a storage (not shown).
The external storage device 10 is a storage unit in the present invention, and the capsule generation server 21 is a capsule generation unit in the present invention. Further, here, the key Ka22 is the first key and the second key which are the same in the present invention, and the first key and the second key, that is, the key Ka22 are keys of the common key system.
The encryption key Kac29 is the second encrypted key in the present invention.
Further, the operation in which the capsule generation server 21 generates the key Ka22 is a key generation step in the present invention, and the operation in which the capsule generation server 21 generates the capsule 23 is a capsule generation step in the present invention.
[0034]
Next, the operation will be described.
First, the initial processing at the time of executing the capsule will be described with reference to the flowchart shown in FIG.
First, when the user 24 designates the capsule 23 including the application data 27 to be viewed, the capsule executing means 1 extracts the encrypted application data 28, the encryption key Ka29, and the application information 30 from the designated capsule 23 (step S1). ). The method by which the capsule executing means 1 acquires the capsule 23 is arbitrary, and may use a network or may move from the capsule generation server 21 to the capsule executing means 1 by using a portable storage medium.
[0035]
Next, the capsule executing means 1 obtains the user's secret key Kq26, and decrypts the encrypted key Kac29 with the secret key Kq26 to obtain the key Ka22 (step S2).
As described above, the secret key Kq26 is different for each user, and is stored and distributed in hardware such as an IC card which cannot be analyzed or tampered with. By encrypting the key Ka22 with the public key Kq25 of the user, the user who can decrypt the encrypted key Kac29 and obtain the key Ka22 can be strictly specified.
The decrypted key Kac22 is the decrypted second key in the present invention, and step 2 is a key decryption step in the present invention.
[0036]
Next, the capsule executing means 1 requests the driver 3 to write the encrypted application data 28 to the external storage device 10 as it is. The driver 3 writes the encrypted application data 28 to the external storage device 10 through the input / output unit 9 by the writing unit 4 (step S3). At this time, the capsule execution unit 1 obtains a reference destination (information on a storage location on the external storage device 1) of the application data 28 from the input / output unit 9 via the driver 3.
Step 3 is the step of writing the encrypted application data in the present invention.
[0037]
Next, the capsule executing means 1 starts the application program 2 based on the application information 30, and obtains a handler (for example, a process ID) for identifying the application program 2 (Step S4).
Step S4 is an application program starting step in the present invention.
Next, the capsule execution unit 1 passes the handler of the application program 2, the key Ka22 decrypted in step S2, and the reference destination of the encrypted application data 28 in the external storage device 10 to the key management unit 5 of the driver 3, 5 stores them in association with each other (step S5).
Next, the capsule executing means 1 notifies the application 2 of the reference destination of the encrypted application data 28 stored in the external storage device 10 (Step S6).
[0038]
By the above operation, the key management means 5
・ Application program handler
・ Decrypted key Ka22
Reference of the encrypted application data in the external storage device 10 (this reference is referred to as R1)
Is passed, and the key management unit 5 stores these pieces of information in association with each other, and recognizes the application program identified by the handler as an application program to be managed.
Also, application program 2
Reference destination of the encrypted application data in the external storage device 10
Is passed,
The external storage device 10
-Encrypted application data 28
Has been passed.
The above initial processing needs to be executed every time at least one of the user and the application data changes.
[0039]
Next, an operation of reading application data by the application program 2 will be described with reference to a flowchart shown in FIG.
The application program 2 issues a request to read application data from the external storage device 10 to the driver 3 (Step S7). This read request includes information specifying the application program of the request source and a reference destination of the application data on the external storage device 10.
[0040]
Next, the key management unit 5 in the driver 3 determines whether the request source of the read request is an application program to be managed and whether the data to be read is a management target based on the information stored in association with itself. It is verified (determined) whether the data is application data (step S8).
Step 8 is an application program determining step in the present invention.
The verification of the application program is performed by checking whether an application program specified by the information specifying the application program included in the read request matches the application program specified by the handler. It is verified whether the reference destination R1 held by the management unit 5 matches the reference destination included in the read request.
[0041]
It is determined whether both are to be managed (step S9). If both are to be managed, the key management means 5 gives the decrypted key Ka22 managed by itself to the reading means 8, and the reading means 8 Extracts the requested encrypted application data 28 from the external storage device 10 using the input / output means 9, decrypts the encrypted application data 28 with the decrypted key Ka22, and returns it to the application program 2 (step S10).
Step 10 is the encrypted application data decryption step and the application data read step in the present invention.
[0042]
Next, an operation of writing application data by the application program 2 will be described.
When the application 2 issues a write request for application data to the driver 3, the key management unit 5 verifies whether or not the request source of the write request is the application to be managed, based on the information stored in association with itself. If the data is to be managed, the application data is encrypted with the decrypted key Ka22 managed by the key management means, and written to the external storage device 10 using the input / output means 9.
[0043]
As described above, the key (key Ka) for decrypting the encrypted application data is encrypted with the user's public key and encapsulated, and is decrypted when the user reads the application data, and the key management is performed. Since it is passed to the means, there is an effect that application data can be more securely concealed without being fixedly embedded in the system.
[0044]
In addition, the encrypted application data and the key for decrypting the encrypted application data (key Ka22) are handled integrally, that is, the encrypted application data and the encrypted key Kac29 obtained by encrypting the key Ka in one capsule. Is stored, the encryption can be performed with a different key for each application data and each user, and the application data can be more securely concealed.
[0045]
Further, since the key Ka for decrypting the application data can be decrypted and obtained only with the secret key of the user, the success / failure of the user authentication matches the possibility of obtaining the decryption key. And the application data can be more securely concealed.
[0046]
Further, since not only files and folders but also application programs are managed, it is possible to prevent writing of plaintext data to unmanaged files and folders by the application programs.
[0047]
In the above description, the key Ka22 is generated for each capsule. However, the key Ka22 may be generated differently for each user or each application data.
[0048]
In the above description, an example is shown in which the user's public key Kp25 and the user's secret key Kq26 are used, but the user 24 holds the public key Kp25 and the user's secret key Kq26 instead of the user's public key Kp25. However, a user key which is a key of a common key system applicable to encryption and decryption of arbitrary data may be used. This user key differs for each user similarly to the user's secret key Kq26, and is stored and distributed in hardware such as an IC card which cannot be analyzed or tampered with. Thus, by encrypting the key Ka22 with the user key of the user who permits the use of the application data, the user who can decrypt the encrypted key Kac29 and obtain the key Ka22 can be strictly specified. Can be.
[0049]
Further, the user key may be generated by the capsule executing means 1 and the capsule generation server 21 from the user's unique information such as the user's password.
In this case, the capsule execution means 1 and the capsule generation server 21 have the same user key generation means including a key generation algorithm using a hash function, for example. At times, each user is prompted to input unique information, and a common user key is generated from the input unique information by using the user key generating means.
The key generation algorithm is configured such that the user key uniquely corresponds to the user's unique information. Therefore, the capsule execution means 1 and the capsule generation server 21 can generate the user key from the unique information input by the user without obtaining the user key itself from the user, and can also generate the user key from the user. It corresponds to acquiring.
If the user key is generated from the unique information of the user in this manner, the user does not need to use an IC card or the like, and there is an effect that the operability is improved.
[0050]
Embodiment 2 FIG.
Embodiment 2 will be described with reference to FIGS.
In the first embodiment, an example has been described in which the key Ka generated by the capsule generation server 21 is a key of a common key system used for encryption and decryption of application data. An example in which the generation server 21 generates a public key pair will be described.
[0051]
In FIG. 5, reference numerals 41 and 42 denote a secret key Kx generated by the capsule generation server 21 and a corresponding public key Ky, respectively. Reference numeral 43 denotes an encryption obtained by encrypting the secret key Kx41 with the user's public key Kp25. The secret key Kxc. The encrypted application data 28 is obtained by encrypting the application data 27 with the public key Ky42.
The capsule generation server 21 generates a capsule 44 including the encrypted application data 28, the encrypted secret key Kxc, the application information 30, and the public key Ky42.
In addition, the same or corresponding portions as those in the configuration of FIG. 2 described in the first embodiment are denoted by the same reference numerals, and description thereof is omitted.
The block diagram of the information leakage prevention device using the capsule 44 is the same as that of FIG. 1 described in the first embodiment.
The public key Ky42 is the first key in the present invention, and the secret key Kx41 is the second key in the present invention.
[0052]
Next, the operation will be described. In this embodiment, the operation according to the flowcharts of FIGS. 3 and 4 described in the first embodiment is performed.
First, the initial processing at the time of executing the capsule will be described with reference to the flowchart shown in FIG.
First, the capsule executing means 1 acquires the capsule 44 of FIG. 5, and extracts the encrypted application data 28, the encrypted private key Kxc43, the application information 30, and the public key Ky42 from the capsule 44 (step S1).
[0053]
Next, the capsule executing means 1 obtains the user's secret key Kq26, and decrypts the encrypted secret key Kxc43 with the secret key Kq26 to obtain a secret key Kx41 (step S2).
[0054]
Next, the capsule executing means 1 requests the driver 3 to write the encrypted application data 28 to the external storage device 10 as it is. The driver 3 writes the encrypted application data 28 to the external storage device 10 through the input / output unit 9 by the writing unit 4 (step S3). At this time, the capsule executing means 1 obtains a reference destination of the application data (information on a storage location on the external storage device 1) from the input / output means 9 via the driver 3.
[0055]
Next, the capsule executing means 1 starts the application program 2 based on the application information 30, and obtains a handler (for example, a process ID) for identifying the application program 2 (Step S4).
Next, the capsule executing means 1 passes the handler of the application, the secret key Kx41 decrypted in step S2, the reference destination of the encrypted application data 28 in the external storage device 10, and the public key Ky42 to the key managing means 5 of the driver 3, The key management means 5 stores them in association with each other (step S5).
Next, the capsule executing means 1 notifies the application 2 of the reference destination of the encrypted application data 28 stored in the external storage device 10 (Step S6).
[0056]
By the above operation, the key management means 5
・ Application program handler
・ Decrypted secret key Kx41
・ Public key Ky42
Reference of the encrypted application data in the external storage device 10 (this reference is referred to as R1)
Is passed, and the key management unit 5 stores these pieces of information in association with each other, and recognizes the application program identified by the handler as an application program to be managed.
Also, application program 2
Reference destination of the encrypted application data in the external storage device 10
Is passed,
The external storage device 10
-Encrypted application data 28
Has been passed.
[0057]
Next, an operation of reading application data by the application program 2 will be described with reference to a flowchart shown in FIG.
This operation is also the same as in the first embodiment, and the application program 2 issues a request to read application data from the external storage device 10 to the driver 3 (Step S7). This read request includes information specifying the application program of the request source and a reference destination of the application data on the external storage device 10.
[0058]
Next, the key management means 5 in the driver 3 determines whether the request source of the read request is an application program to be managed, and determines whether the data to be read is It is verified whether the data is application data (step S8).
[0059]
It is determined whether or not both are to be managed (step S9). If both are to be managed, the key management unit 5 gives the decrypted secret Kxc 43 managed by itself to the reading unit 8, and the reading unit 8 Extracts the requested encrypted application data 28 from the external storage device 10 using the input / output means 9, decrypts the encrypted application data 28 with the decrypted secret key Kx41, and returns it to the application program 2 ( Step S10).
[0060]
Next, an operation of writing application data by the application program 2 will be described.
When the application 2 issues a write request for application data to the driver 3, the key management unit 5 verifies whether or not the request source of the write request is the application to be managed, based on the information stored in association with itself. If it is a management target, the application data is encrypted with the decrypted public key Ky42 managed by the key management means, and written to the external storage device 10 using the input / output means 9.
[0061]
As described above, the key (private key Kx41) for decrypting the encrypted application data is encrypted and encapsulated with the user's public key, and is decrypted and read when the user reads the application data. Since it is passed to the management means, there is an effect that application data can be more securely concealed without being fixedly embedded in the system.
[0062]
Also, the encrypted application data and the key for decrypting the encrypted application data (private key Kx41) are handled integrally, that is, the encrypted application data and the private key Kx41 are encrypted and encrypted in one capsule. Since the secret key Kxc is stored, encryption can be performed with a different key for each application data and each user, and the application data can be more securely concealed.
[0063]
In addition, since the key Kx for decrypting the application data can be decrypted and obtained only with the secret key possessed by the user, the success / failure of the user authentication matches the possibility of obtaining the decryption key. And the application data can be more securely concealed.
[0064]
Further, since not only files and folders but also application programs are managed, it is possible to prevent writing of plaintext data to unmanaged files and folders by the application programs.
[0065]
In the above description, an example is shown in which the user's public key Kp25 and the user's secret key Kq26 are used, but the user 24 holds the public key Kp25 and the user's secret key Kq26 instead of the user's public key Kp25. However, a user key which is a key of a common key system applicable to encryption and decryption of arbitrary data may be used. This user key differs for each user similarly to the user's secret key Kq26, and is stored and distributed in hardware such as an IC card which cannot be analyzed or tampered with. Thereby, by encrypting the key x41 with the user key of the user who permits the use of the application data, the user who can decrypt the encrypted secret key Kxc43 and obtain the secret key Kx41 is strictly determined. Can be identified.
[0066]
The user key may be generated by the capsule executing means 1 and the capsule generation server 21 from the user's unique information using the same user key generation means as described in the first embodiment. Often, the same effects as described in the first embodiment can be obtained.
[0067]
Embodiment 3 FIG.
Embodiment 3 will be described with reference to FIG.
In the above-described first embodiment, it is not possible to cope with a situation in which the encryption means of the driver is avoided during the writing process of the application data. However, this embodiment can cope with such a situation. Such an embodiment will be described.
[0068]
FIG. 6 is a block diagram showing the configuration of this embodiment.
In the figure, the same or corresponding parts as those in FIG.
Reference numeral 15 denotes driver monitoring means for monitoring the activation status and authenticity of the driver 3, and 16 denotes application control means for forcibly terminating the application.
This application control means 16 is the first application control means in the present invention.
[0069]
Next, the operation will be described.
The capsule executing means 1 repeatedly verifies that the driver 3 is activated by the driver monitoring means 15 while the capsule executing means 1 is activated. In addition, the authenticity of the driver 3 (that the driver 3 is not falsified) is calculated as a hash value or a size of a driver program which is a part of the information leakage program and realizes the driver 3, and the calculated value is used as the driver monitoring means 15. Is verified as to whether it is equal to the correct value given in advance. If any of the verifications fails, that is, if it is not possible to verify that the driver 3 is operating and that the driver 3 has not been tampered with, the application control unit 16 of the capsule execution unit 1 uses the target application program. Terminate 2 forcibly.
Other operations are the same as the operations described in the first or second embodiment.
[0070]
As described above, since the capsule execution unit verifies the activation status and authenticity of the driver and forcibly terminates the application when an abnormal state of the driver is detected, the application performs the process of storing the application data. Occasionally, encryption processing can be avoided to prevent application data from being written to an external storage device in plain text.
[0071]
In the above example, the driver monitoring unit 15 monitors the driver 3. However, in case that the driver monitoring unit 15 is avoided or a failure occurs, the driver 3 executes the capsule execution as shown in FIG. A means monitoring means 17 and an application control means 18 (second application control means) for forcibly terminating the application program 2 in response to an instruction from the capsule execution monitoring means 17 may be provided.
[0072]
The driver 3 repeatedly verifies that the capsule executing means 1 is activated by the capsule executing means monitoring means 17 while the driver 3 is activated. Further, the authenticity of the capsule execution unit 1 (that the capsule execution unit 1 is not falsified) is calculated by calculating a hash value, a size, and the like of the capsule execution program that is a part of the information leakage program and realizes the capsule execution unit 1. It is verified whether the value is equal to a correct value given to the capsule executing means monitoring means 17 in advance. If any of the verifications fails, the application control unit 18 of the driver 3 forcibly terminates the target application 2.
Other operations are the same as the operations described in the first or second embodiment.
[0073]
In this case, the application is forcibly terminated when the driver detects an abnormal state of the capsule execution unit. Therefore, the capsule execution unit cannot detect the abnormal state of the driver, and as a result, the application saves the application data. When the processing is performed, the encryption processing can be avoided and the application data can be prevented from being written out to the external storage device as plain text.
[0074]
The capsule executing means monitoring means 17 and the application control means 18 may be provided separately from the driver 3.
[0075]
【The invention's effect】
As described above, according to the present invention, there is an effect that application data can be more securely concealed.
[Brief description of the drawings]
FIG. 1 is a block diagram of an information leakage prevention device according to Embodiments 1 and 2 of the present invention.
FIG. 2 is a diagram showing a configuration of a capsule and a configuration of a system including a capsule generation server according to the first embodiment of the present invention.
FIG. 3 is a flowchart illustrating an operation of an initial process at the time of executing a capsule according to the first and second embodiments of the present invention.
FIG. 4 is a flowchart illustrating an operation at the time of reading in the first and second embodiments of the present invention.
FIG. 5 is a diagram showing a configuration of a capsule and a configuration of a system including a capsule generation server according to the second embodiment of the present invention.
FIG. 6 is a block diagram of an information leakage prevention device according to a third embodiment of the present invention.
FIG. 7 is a block diagram showing another embodiment of the information leakage prevention device according to the third embodiment of the present invention.
FIG. 8 is a block diagram of a conventional information leakage prevention device.
FIG. 9 is a flowchart illustrating an operation at the time of reading in a conventional information leakage prevention device.
[Explanation of symbols]
1 capsule execution means, 2 application program, 3 driver, 4 writing means, 5 key management means, 6 encryption means, 7 decryption means, 8 reading means, 9 input / output means, 10 external storage device, 15 driver monitoring means, 16 Application control means, 17 capsule execution means monitoring means, 18 application control means, 21 capsule generation server, 22 key Ka, 23 capsules, 24 users, 25 public key Kp, 26 secret key Kq, 27, application data, 28 encryption Application data, 29 encrypted key Kac, 30 application information, 41 secret key Kx, 42 public key Ky, 43 encrypted secret key Kxc, 43 capsules, 50 capsule processing means, 1001 application, 1002 user authentication means 1003 file system, 1004 drivers, 1005 open means, 1006 read means, 1007 write means, 1008 closed unit, 1009 I / O unit, 1010 an external storage device.

Claims (19)

It is an information leakage prevention device that prevents leakage of application data disclosed only to specific users,
Capsule generation means, capsule processing means, and storage means,
The capsule generation means,
An encryption application that generates a first key for encrypting arbitrary data and a second key for decrypting data encrypted with the first key, and encrypts the application data with the first key; Generating a capsule including data and an encrypted second key obtained by encrypting the second key with the public key of the user;
The capsule processing means includes:
Obtaining the capsule generated by the capsule generating means, writing the encrypted application data included in the obtained capsule to the storage means, and obtaining the user's private key corresponding to the user's public key from the user And decrypting the encrypted second key included in the capsule with the obtained user's private key to obtain a decrypted second key;
Reading the encrypted application data from the storage means, decrypting the read encrypted application data with the decrypted second key,
An information leakage prevention device, wherein the storage means stores the encrypted application data written by the capsule processing means. 2. The information leakage prevention device according to claim 1, wherein the first key and the second key are the same and are keys of a common key system. The capsule generated by the capsule generating means further includes application information for specifying an application program using the application data,
The capsule processing means further comprises:
Acquiring the application information from the acquired capsule and starting an application program corresponding to the application information;
Determining whether the started application program is a management target of the capsule processing means,
If it is determined that the activated application program is to be managed by the capsule processing means, the encrypted application data read and decrypted from the storage device in response to the read request issued by the activated application program is stored in the storage device. 2. The information leakage prevention device according to claim 1, wherein the information is passed to a started application program. The capsule processing means includes:
When determining whether the started application program is managed by the capsule processing unit,
4. The information leakage prevention device according to claim 3, wherein a read request for the encrypted application data stored in the storage means by the activated application program is used. The capsule processing means includes a capsule execution means and a driver,
The capsule executing means includes:
Obtaining the capsule generated by the capsule generation means, instructing the driver to write the encrypted application data included in the obtained capsule to the storage means, obtaining the secret key of the user from the user, The encrypted second key included in the capsule is decrypted with the obtained user's secret key to obtain a decrypted second key, application information is obtained from the capsule, and an application program corresponding to the application information is started. And
The above driver is
Determine whether the started application program is managed by the driver,
When it is determined that the started application program is managed by the driver, the encrypted application data is read from the storage device in response to a read request issued by the started application program, and the read application program is read. 4. The information leakage prevention device according to claim 3, wherein the encrypted application data is decrypted with the decrypted second key decrypted by the capsule executing means and passed to the application program. The capsule executing means includes:
Computer
Obtaining the capsule generated by the capsule generation means, instructing the driver to write the encrypted application data included in the obtained capsule to the storage means, obtaining the secret key of the user from the user, The encrypted second key included in the capsule is decrypted with the obtained user's secret key to obtain a decrypted second key, application information is obtained from the capsule, and an application program corresponding to the application information is started. The information leakage prevention device according to claim 5, wherein the information leakage prevention device is realized by executing a program that performs the information leakage. The above driver is
Computer
It is determined whether the application program started by the capsule execution unit is managed by the driver. If the started application program is determined to be managed by the driver, the started application program is A program for reading the encrypted application data from the storage device in response to the issued read request, decrypting the read encrypted application data with the decrypted second key decrypted by the capsule executing means, and passing the decrypted encrypted application data to the application program 6. The information leakage prevention device according to claim 5, wherein the information leakage prevention device is realized by executing the following. The above driver is
When determining whether the started application program is managed by the driver,
6. The information leakage prevention device according to claim 5, wherein a read request for the encrypted application data stored in the storage unit by the activated application program is used. The information leakage prevention device according to any one of claims 3 to 8, wherein the first key and the second key are the same and are keys of a common key system. The above driver is
Obtaining a decrypted second key from the capsule execution means;
When the application program makes a request to write the received and used application data to the storage means in response to the read request, the application program encrypts the application data with the decrypted second key and writes it to the storage means. The information leakage prevention device according to claim 9, wherein: 9. The method according to claim 3, wherein the first key is a public key of the capsule, and the second key is a secret key corresponding to a public key of the capsule. Information leakage prevention device as described. The capsule generated by the capsule generating means further includes the first key,
The capsule executing means obtains the first key from the obtained capsule,
The above driver is
Obtaining the first key from the capsule executing means;
When the application program makes a request to write application data received and used in response to the read request to the storage means, the application data is encrypted with the first key and written to the storage means. The information leakage prevention device according to claim 11, wherein The capsule execution means includes a driver monitoring means and a first application control means,
The driver monitoring means verifies that the driver is operating and that the driver has not been tampered with,
6. The information leakage prevention device according to claim 5, wherein when the verification fails, the first application control unit is instructed to stop the application program. The driver includes a driver monitoring unit monitoring unit and a second application control unit,
The driver monitoring means monitoring means verifies that the driver monitoring means is operating and that the driver monitoring means has not been tampered with,
14. The information leakage prevention device according to claim 13, wherein when verification cannot be performed, the second application control unit is instructed to stop the application program. The information leakage prevention device according to any one of claims 1 to 14, wherein the first key and the second key are generated for each capsule. 2. The method according to claim 1, wherein a user key, which is a key of a common key system applicable to encryption and decryption of arbitrary data, is used in place of the user's public key and the user's secret key. Item 16. The information leakage prevention device according to any one of items 15. An information leakage prevention method for an information leakage prevention device that includes a capsule generation unit, a capsule processing unit, and a storage unit and that prevents application data disclosed only to a specific user from leaking, including the following steps: Information leakage prevention method.
(1) a key generation step in which the capsule generation means generates a first key for encrypting arbitrary data and a second key for decrypting data encrypted with the first key;
(2) Encapsulation means for encrypting the application data with the first key and encrypting the application data, and encrypting the second key with a public key of the user and an encrypted second key. A capsule generating step of generating a capsule including:
(3) an encryption application data writing step in which the capsule processing means obtains the capsule generated by the capsule generation means in the capsule generation step, and writes the encrypted application data included in the obtained capsule into the storage means;
(4) The capsule processing means obtains the user's private key corresponding to the user's public key from the user, and the encrypted second key included in the capsule with the obtained user's private key. A key decryption step for decrypting the second key as a decrypted second key;
(5) Encryption in which the capsule processing means reads the encrypted application data written in the storage means in the encrypted application data writing step from the storage means and decrypts the read encrypted application data with the decrypted second key. Application data decryption step. 18. The information leakage prevention method according to claim 17, wherein the capsule generated by the capsule generation unit in the capsule generation step further includes application information for specifying an application program using the application data,
The method for preventing information leakage, wherein the capsule processing means further performs the following operation.
(6) an application program starting step of obtaining the application information from the obtained capsule and starting an application program corresponding to the application information;
(7) an application program determining step of determining whether the application program started in the application program starting step is to be managed by the capsule processing means;
(8) In the application program determining step, when it is determined that the activated application program is to be managed by the capsule processing means, the storage device corresponds to a read request issued by the activated application program. Reading the decrypted encrypted application data from the application program to the activated application program. 18. The method according to claim 17, wherein a user key, which is a key of a common key system applicable to encryption and decryption of arbitrary data, is used instead of the user's public key and the user's secret key. Item 19. An information leakage prevention method according to Item 18.

Images