JP2005020105A - Communication unit, information communication system, and information communication method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent leakage of data and falsification of data in a communication unit at a data transmission side or a communication unit at a data receiver side. <P>SOLUTION: The communication unit includes: an HD 170 for storing received encrypted data; an HD 160 for storing the transmitted encryption data; an information processing apparatus 110 for writing the received encrypted data in the HD 170 and for reading the encrypted data being a transmission object from the HD 160; an information processing apparatus 120 for reading the encrypted data stored in the HD 170 and decrypting the encrypted data by using a private key; an authentication means 130 for authenticating a password attached to the data decrypted by the information processing apparatus 120 and a password transmitted in advance; an information processing apparatus 130 for reading the encrypted data which are stored in the HD 170 and the password of which is confirmed for the coincidence with the password transmitted in advance by the authentication means 130, and writing the encrypted data being the transmission object to the HD 160; and a reset means 123 for resetting the encrypted data read by the information processing apparatus 120. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
[Technical field to which the invention belongs]
The present invention relates to a communication unit, an information communication system, and an information communication method, and more particularly, to a communication unit, an information communication system, and an information communication method for encrypting and transmitting data.
[0002]
[Prior art]
Conventionally, in order to maintain the confidentiality of data to be transmitted during data communication, encrypted data is exchanged with other communication units connected to the network prior to data transmission / reception. The public key for decryption is exchanged, the encrypted data is transmitted from the data transmission side, and the data transmitted on the data reception side is decrypted using the public key.
[0003]
A data transfer method employing such a method is described in Patent Document 1. In Patent Document 1, a transmission unit delivers a public key to a reception unit of a communication device on the other side. Then, the communication message is transmitted after being encrypted with the public key of the receiving communication device. It is described that the receiving unit that has received the communication message decrypts the communication message with the private key of the communication device on the receiving side.
[0004]
[Patent Document 1]
JP 09-093240 A [Problems to be solved by the invention]
However, in the conventional technology, although the confidentiality of data is maintained in the network connecting the communication unit on the data transmission side and the communication unit on the data reception side, in the communication unit on the data transmission side or the communication unit on the data reception side, Data confidentiality may not be maintained due to hacking or the like, and data may leak. In addition, the leaked data was sometimes falsified.
[0005]
Accordingly, an object of the present invention is to prevent data leakage and data tampering in a data transmission side communication unit or a data reception side communication unit.
[0006]
[Means for Solving the Problems]
In order to solve the above-mentioned problems, the present invention exchanges a public key for encrypting data with another communication unit connected to a network before transmitting / receiving data, and Before receiving the data for the first time, a password to be added to the data is sent to the other communication unit through a route that maintains confidentiality, and the data to be transmitted is sent to the other communication unit. Prompt to create encrypted data that is encrypted using its own public key after adding the password, and use the encrypted data actually transmitted from the other communication unit as its own public key The corresponding secret key is used for decryption, and at the time of data transmission, the route is kept confidential from the other communication unit before the transmission. A communication unit that transmits encrypted data created by encrypting data to be transmitted with the received password added using the public key of the other communication unit to the other communication unit, A first storage unit that stores encrypted data transmitted from the other communication unit, a second storage unit that stores encrypted data transmitted to the other communication unit, and a transmission from the other communication unit A first information processing apparatus that writes the encrypted data to the first storage unit and reads encrypted data to be transmitted to the other communication unit from the second storage unit; and A second information processing device that reads out the stored encrypted data and decrypts it using the private key of the device; and the data decrypted by the second information processing device Authentication means for authenticating the added password and the password sent to the other communication unit in advance, and the encryption stored in the first storage unit when the mutual match of the password is confirmed by the authentication means And a third information processing device that obtains data obtained by decrypting the encrypted data and writes the encrypted data to be transmitted to the other communication unit in the second storage unit.
[0007]
The authentication means is any one of a display, a printer, a speaker, and a filter that passes the password.
[0008]
Furthermore, the information communication system of the present invention includes a plurality of the communication units, and the communication units are connected to each other via a network.
[0009]
Furthermore, the present invention exchanges a public key for encrypting data between the communication units connected to the network before transmitting / receiving data, and transmits data before transmitting / receiving the data for the first time. A password to be added to the data is sent from the previous communication unit to the data transmission source communication unit through a confidential route, and the transmission target data to which the password is added is transmitted by the data transmission source communication unit. The encrypted data created by encrypting using the public key of the data transmission destination communication unit is transmitted to the data transmission destination communication unit, and at the data transmission destination communication unit, the data The encrypted data transmitted from the communication unit of the transmission source is stored in the secret key corresponding to its own public key. The data transmission source communication unit uses the first information processing apparatus to transmit encrypted data to be transmitted to the data transmission destination communication unit with a first storage unit. The encrypted data stored in the first storage unit is read out by the second information processing apparatus directly connected to the network and the data transmission destination communication unit is directly connected to the network. The encrypted information transmitted from the data transmission source communication unit is written to the second storage unit by the third information processing apparatus, and the fourth information processing apparatus stores the encrypted data in the second storage unit. The stored encrypted data is decrypted, and the password added to the data decrypted by the fourth information processing apparatus and the previously sent password are sent. When the word and match, the fifth information processing apparatus, to acquire the decrypted data encrypted data stored in the second storage unit.
[0010]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments for carrying out the present invention will be described with reference to the drawings.
[0011]
(Embodiment 1)
FIG. 1 is a block diagram showing a schematic configuration of the information communication system according to the first embodiment of the present invention.
[0012]
In FIG. 1, a communication unit 100 and a communication unit 200 described below are connected to the Internet, an analog telephone line, an ISDN telephone line, DSL, CATV, optical fiber, ether-Net, 10BASE-T, 100BASE-T, infrared, and wireless. Are connected through a network 300 such that data communication can be performed with each other.
[0013]
The information processing apparatus 130 and the information processing apparatuses 140 and 150 are connected to each other via a local area network (hereinafter referred to as “LAN”) 180 or an intranet so that data can be input and output.
[0014]
Between the communication unit 100 side and the communication unit 200 side, a pair of a public key and a secret key are created before data transmission / reception. The public key is used when encrypting data, and the secret key is used when decrypting encrypted data. Public keys are exchanged with each other.
[0015]
When both of the communication units 100 and 200 are data transmission sources, encrypted data created by encrypting data to be transmitted and a password to be described later using the other party's public key is transmitted as data. It transmits with respect to the communication unit 200,100 which is a tip. On the other hand, when both the communication units 100 and 200 are data transmission destinations, the communication units 200 and 100 receive the encrypted data transmitted from the communication units 100 and 200 and use their own secret keys. Decrypt. Thus, data leakage on the network 300 is prevented.
[0016]
Furthermore, in this embodiment, for example, when data is transmitted from the communication unit 100 to the communication unit 200, the data is added to the transmission target data from the communication unit 200 to the communication unit 100 through a route that maintains confidentiality. I send a password to make it.
[0017]
Specifically, prior to sending and receiving the first data, the password is sent from the data receiving communication unit to the data sending communication unit. Examples of routes that maintain confidentiality include routes by mail via a storage medium, and routes by a network such as the network 300 and other telephone lines.
[0018]
Alternatively, for example, the communication unit 100 may lock the password for the communication unit 200 with the public key of the communication unit 200 and send the password to the communication unit 200 by mailing to the communication unit 200. Further, when the communication unit 100 has a home page, a password locked with the public key of the communication unit 200 may be posted on the home page. <B>
</ B>
[0019]
The communication unit 100 includes information processing apparatuses 110 to 130 described below, hard disks (hereinafter referred to as “HD”) 160 and 170, and a password pass filter 190.
[0020]
The information processing apparatus 110 writes encrypted data transmitted from the communication unit 200 to the HD 170 and reads encrypted data to be transmitted to the communication unit 200 from the HD 160.
[0021]
The information processing apparatus 120 reads the encrypted data stored in the HD 170, decrypts the encrypted data with its own secret key, and outputs the decrypted data and password to the password path filter 190.
[0022]
The information processing apparatus 130 authenticates the password associated with the encrypted data read by the information processing apparatus 120 and the password sent to the communication unit 200 in advance, and the transmission source of the encrypted data is the communication unit 100. Is read out, the data stored in the HD 170 is read out, and the encrypted data to be transmitted to the communication unit 200 is written into the HD 160.
[0023]
The HD 160 stores encrypted data to be transmitted to the communication unit 200.
[0024]
The HD 170 stores the encrypted data transmitted from the communication unit 200.
[0025]
The HDs 160 and 170 are examples of storage media, and a storage medium called an external storage device such as a DVD-RAM or a semiconductor disk may be used.
[0026]
The password pass filter 190 passes only the password and does not pass data of other attributes so that the authentication of the password can be performed by the information processing apparatus 130. The password pass filter 190 is connected to, for example, a printer port or a USB port provided in the information processing apparatuses 120 and 130.
[0027]
Instead of the password pass filter 190, a password, such as a display, a printer, a speaker, etc., that can notify the password of the communication unit to the user of the communication unit by visual, audible, etc. is provided. You may make it perform. As the password pass filter 190, for example, a character pass filter that passes only character data can be used.
[0028]
The communication unit 200 includes information processing apparatuses 210 to 230 corresponding to the information processing apparatuses 110 to 130, HDs 260 and 270 corresponding to HDs 160 and 170, and a password path filter 290 corresponding to the password path filter 190, respectively. Yes.
[0029]
FIG. 2 is a block diagram showing a schematic internal configuration of the communication unit 100 shown in FIG. Note that the communication unit 200 has the same configuration as the communication unit 100.
[0030]
As shown in FIG. 2, the information processing apparatus 130 includes a CPU 131, a memory 132, a password receiving unit 133, a password updating unit 134, a reset command unit 135, an authentication unit 136, a USB port 137, which will be described below. A first head 138 and a second head 139 are provided.
[0031]
The CPU 131 controls the operation of the main body of the information processing apparatus 130 by executing various operations including decryption processing of encrypted data read from the HD 170.
[0032]
The memory 132 stores programs and data mainly executed by the CPU 131.
[0033]
[0034]
The password receiving unit 133 receives a password attached to the encrypted data transmitted from the communication unit 200 and output from the information processing apparatus 120 side.
[0035]
The password updating unit 134 updates the encrypted data transmitted to the communication unit 200 using, for example, a random number. The password is updated every time the encrypted data is exchanged or periodically in order to cope with, for example, an internal crime, that is, a leakage of the password due to an unauthorized operation of the information processing apparatus 130 main body. .
[0036]
The reset command unit 135 reads the encrypted data transmitted from the communication unit 200 by the second head 139 and then the encrypted data from the communication unit 200 and the decrypted data read by the information processing device 120. This command instructs to reset the password or reboot the information processing apparatus 120.
[0037]
The authentication unit 136 authenticates whether the password sent to the communication unit 200 in advance matches the password input by the password receiving unit 133.
[0038]
As described above, the USB port 137 is a port for connecting the password pass filter 190 and the information processing apparatus 130 main body.
[0039]
The first head 138 is a head that can write encrypted data to be transmitted to the communication unit 200 to the HD 160. In response to a command from the CPU 131, the encrypted data to be transmitted to the communication unit 200 is written to the encrypted data writing position. The first head 138 may be a dedicated head that writes encrypted data to be transmitted to the communication unit 200 in hardware to the HD 160, or an encryption that is transmitted to the communication unit 200 by controlling a general-purpose head in software. It is also possible to exclusively write the digitized data to the HD 160.
[0040]
The second head 139 is a head capable of erasing or reading encrypted data transmitted from the communication unit 200 and stored in the HD 170. On the condition that the authentication means 136 determines that the passwords match each other, the encrypted data transmitted from the communication unit 200 is sought in accordance with a command from the CPU 131 and sought to the erasure position or read position of the encrypted data. The erasure data is erased or read out. The second head 139 may be a dedicated head for erasing or reading the encrypted data transmitted from the communication unit 200 and stored in the HD 170, or the general-purpose head may be controlled by software to control from the communication unit 200. The encrypted data transmitted and stored in the HD 170 may be dedicated to erasure or read-only.
[0041]
The information processing apparatus 110 includes a CPU 111, a memory 112, a first head 113, and a second head 114 described below.
[0042]
The CPU 111 controls the operation of the information processing apparatus 110 main body by executing various calculations.
[0043]
The memory 112 mainly stores programs and data executed by the CPU 111.
[0044]
The first head 113 is a head that can read encrypted data stored in the HD 160 and transmitted to the communication unit 200. In response to a command from the CPU 111, seek to the read position of the encrypted data and read of the encrypted data transmitted to the communication unit 200.
[0045]
The second head 114 is a head that can write the encrypted data transmitted from the communication unit 200 to the HD 170. In response to a command from the CPU 111, the second head 114 is sought to the data write position, and the encrypted data transmitted from the communication unit 200 is written.
[0046]
Note that the first head 113 and the second head 114 may be realized in hardware or in software, like the first head 138 and the second head 139, respectively.
[0047]
The information processing apparatus 120 includes a CPU 121, a memory 122, a reset unit 123, a password output unit 124, a printer port 128, and a head 129 described below.
[0048]
The CPU 121 controls the operation of the main body of the information processing apparatus 120 by executing various operations including the decryption process of the encrypted data read from the HD 170.
[0049]
The memory 122 stores programs and data mainly executed by the CPU 121.
[0050]
The reset unit 123 resets the encrypted data from the communication unit 200 and the decrypted data and password read from the HD 170 according to the command from the reset command unit 135, or reboots the information processing apparatus 120 main body. Is. In place of the reset unit 123 and the reset command unit 135, the information processing device 120 voluntarily receives information in accordance with detection by the information processing device 130 and detection by the detection unit. Means for rebooting the processing device 120 main body may be provided.
[0051]
The password output means 124 is for outputting a password accompanying the encrypted data transmitted from the communication unit 200.
[0052]
The printer port 128 is a port for connecting the password pass filter 190 and the information processing apparatus 120 main body as described above.
[0053]
The head 129 is a head that can read the encrypted data transmitted from the communication unit 200 and stored in the HD 170. In response to a command from the CPU 121, seek to the read position of the encrypted data and read of the encrypted data transmitted from the communication unit 200 is performed. The operation by the head 129 may be realized by hardware or software, similarly to the first head 138, the second head 139, and the like.
[0054]
The first head 113 and the head 129 access the HD 160 and 170 every few seconds to determine whether or not encrypted data is written, and when encrypted data is written, I read it. Alternatively, for example, a light emitter that emits light triggered by the completion of writing of encrypted data by the second head 114 and the first head 138, and a light injector at a position where the light emitted from the light emitter can be received. As described above, the encrypted data is read out by the first head 113 and the head 129 on condition that the light is detected by the light injector. Alternatively, by providing a status register in which the flag is rewritten with the completion of writing of the encrypted data by the second head 114 and the first head 138 as a trigger, and accessing the status register every few seconds on the first head 113 and head 129 side Then, it is determined whether or not the encrypted data is written. If the encrypted data is written, it is read out.
[0055]
In this manner, the encrypted data can be read after the writing of the encrypted data of the HDs 160 and 170 is completed without connecting the CPUs 111 and 131 to each other.
[0056]
FIG. 3 is an explanatory diagram of the operation of the information communication system shown in FIGS. Here, the operation will be described using an example in which data is transmitted from the information processing apparatus 150 to the information processing apparatus 240. A connection line illustrated by a bold line indicates a data flow.
[0057]
First, as described above, a mutual public key is exchanged between the communication units 100 and 200, and a password is transmitted from the communication unit 200 to the communication unit 100.
[0058]
In this state, the information processing apparatus 150 outputs the transmission target data to the information processing apparatus 130 via the LAN 180.
[0059]
The information processing apparatus 130 adds the password obtained from the communication unit 200 to the transmission target data output from the information processing apparatus 150 by the CPU 131 or the like. Then, these are encrypted using the public key on the communication unit 200 side to create encrypted data. The created encrypted data is written to the HD 160 using the CPU 131, the first head 138, and the like.
[0060]
In the second and subsequent data transmission / reception, the password is added to the transmission target data, or the password updated by the password update unit 134 is added to the transmission target data.
[0061]
Incidentally, the password sent from the communication unit 200 is output to the information processing apparatuses 140 and 150, and the public key of the communication unit 200 is stored on the information processing apparatuses 140 and 150, so that the information processing apparatus The encrypted data may be created on the 140 and 150 sides, and the encrypted data may be output from the information processing apparatuses 140 and 150 to the information processing apparatus 130.
[0062]
Here, in this embodiment, the first head 113 periodically accesses the HD 160 to determine whether or not encrypted data is written. Here, the encrypted data is written to the HD 160. Therefore, this encrypted data is read by the first head 113. Then, the read encrypted data is transmitted from the communication unit 100 side to the communication unit 200 side through a transmission unit (not shown) and the network 300.
[0063]
On the communication unit 200 side, the encrypted data from the communication unit 100 side is received by the information processing device 210 and written to the HD 270.
[0064]
Subsequently, when the information processing apparatus 220 detects the completion of writing of the encrypted data to the HD 270, the information processing apparatus 220 reads the encrypted data. The read encrypted data is decrypted using its own secret key. In this way, the data and password transmitted from the information processing apparatus 150 are acquired. Subsequently, the information processing apparatus 220 outputs the acquired data and password to the password pass filter 290 via the printer port 128 or the like.
[0065]
When the data and password output from information processing device 220 are input, password pass filter 290 outputs the password to information processing device 230 by removing data with attributes other than character data.
[0066]
When the information processing device 230 receives the password output from the password pass filter 290, the authentication unit 136 authenticates the password and the password sent to the communication unit 100 in advance.
[0067]
If the passwords do not match as a result of the authentication, the encrypted data written in the HD 270 is not required and may contain, for example, a virus. Deletes the encrypted data stored in the information processing apparatus 220 and issues a delete instruction to the information processing apparatus 220 such as the encrypted data read from the HD 270. Note that the notification unit (not shown) may notify the user of the communication unit 200 that the encrypted data is not required.
[0068]
On the other hand, if the passwords match, the encrypted data written in the HD 270 is necessary, so the information processing device 230 reads the encrypted data from the HD 270 and uses its own private key. Decrypt by.
[0069]
In consideration of the fact that the encrypted data has already been decrypted by the information processing device 220 and that the number of channels used by the HD 270 can be reduced from 3 channels to 2 channels, the route including the password path filter 290 is included. In parallel with the information processing apparatuses 220 and 230, another route that can be directly connected is provided, and the information processing apparatus 230 physically opens another route only when the passwords match each other. The data decrypted at 220 may be input via another route. In this way, data from the communication unit 100 side can be acquired by the information processing device 230 while preventing the information processing device 230 from entering from the outside of the network 300.
[0070]
Thereafter, the information processing device 230 outputs the decrypted data to the information processing device 240 via the LAN 280. Then, it instructs the information processing apparatus 220 to reset the encrypted data or the like. Furthermore, by updating the password, a password to be used for the next data communication is prepared, and the updated password and the password before the update are transmitted to the information processing apparatus 130.
[0071]
The information processing device 220 resets the encrypted data read from the HD 270 in accordance with an instruction from the information processing device 230, and enables the input of the encrypted data transmitted from the communication unit 100 next time.
[0072]
In addition, when the information processing apparatus 130 receives the password before and after the update, the information processing apparatus 130 rewrites the password before the update with the password after the update, and adds the updated password when transmitting data from the next time. Enable authentication when receiving data.
[0073]
As described above, in this embodiment, when various types of data are transmitted and received between the communication units 100 and 200, entry to the information processing apparatuses 130 and 230 from the outside is prevented.
[0074]
(Embodiment 2)
As a second embodiment of the present invention, the case where the information communication system shown in FIG. 1 is used for maintenance / management of a membership homepage will be described as an example. This membership system home page contains an email address on the administrator side of the home page, so that emails can be sent and received between the member and the administrator side.
[0075]
When the information communication system shown in FIG. 1 is used, for example, for maintenance and management of a membership system homepage, the public key is exchanged between the system administrator of the membership website and the member, and system management of the membership website is performed. The password is sent from the subscriber to the member.
[0076]
Then, the system administrator of the membership system home page encrypts the information etc. and writes it on the HD 160 by the first head 138 so that the members can browse the information etc. posted on the membership system home page.
[0077]
A member who wants to browse this home page accesses the communication unit 100 via the network 300. As a result, the information processing apparatus 110 reads the information written in the HD 160 with the first head 113 and transmits it to the member side. The member can browse the information and the like by decrypting the information and the like transmitted from the communication unit 100 using his / her private key.
[0078]
In this case, since the first head 113 is a read-only head, the information written in the HD 160 is not falsified from a third party including members, that is, from the outside.
[0079]
In addition, when an e-mail is to be transmitted from a member to an e-mail address attached to the information processing apparatus 110 posted on the member system homepage, an E with a password sent from the communication unit 100 side added. The mail information is encrypted with the public key of the communication unit 100 and transmitted to the communication unit 100 via the network 300.
[0080]
In the subsequent processing, as described in the first embodiment, the information processing apparatus 110 performs writing of the transmitted e-mail to the HD 170, and decrypts the e-mail written to the HD 170 by the information processing apparatus 120. The information processing device 130 authenticates the decrypted password and the sent password, and decrypts the e-mail written in the HD 170 on the condition that the authentication has been confirmed. To do. For this reason, the content of the e-mail is not exposed to the outside and is not falsified.
[0081]
Further, in the present embodiment, the case where the membership system homepage is used for maintenance / management has been described as an example, but the present invention can also be applied to a case where, for example, bidding for public works is performed online. In this case as well, the bidding situation does not leak to the outside and is not falsified.
[0082]
(Embodiment 3)
FIG. 4 is a block diagram showing a schematic configuration of the information communication system according to the third embodiment of the present invention. In FIG. 4, the same parts as those shown in FIG.
[0083]
As shown in FIG. 4, in this embodiment, HD 200 is provided instead of HD 160, 170 shown in FIG. 1 and the like, and head 210 is provided instead of first head 138 and second head 139, and first head 113 and A head 220 is provided instead of the second head 114.
[0084]
In the HD 200, a first area 201 corresponding to the HD 160 and a second area 202 corresponding to the HD 170 are formed.
[0085]
The head 210 is a head that can write information in the first area 201 and can read information from the second area 202.
[0086]
The head 220 is a head that can read information from the first area 201 and can write information to the second area 202.
[0087]
The head 129 is a head that can read information from the second region 202.
[0088]
The heads 210, 220, and 129 may realize their dedicated functions in hardware or in software.
[0089]
In the present embodiment, the HD 200 and the heads 210 and 220 are provided, and the information processing apparatuses 110 and 130 perform time multiplexing control on the heads 210 and 220, thereby reducing the number of components while maintaining the above-described effects. This makes it possible to reduce the size and cost of information communication systems.
[0090]
(Embodiment 4)
In the fourth embodiment of the present invention, an information communication system that provides the same effects as the information communication system of the first embodiment without forming the first area 201 and the second area 202 in the HD 200 described in the third embodiment will be described. To do.
[0091]
In the information communication system of the present embodiment, flags for specifying files that can be handled by the heads 210, 220, and 129 are set in all the files stored in the HD 200, and files are stored in the HD 200 by the heads 210, 220, and 129. It is assigned when writing.
[0092]
As these flags, for example, flags A to C are prepared and assigned as follows. The number of flags to be prepared is not limited to three, and the specific requirements of the files that can be handled by each head 210, 220, 129 may be subdivided to be four or more.
[0093]
As described above, the head 220 can read only the file to which the flag A is assigned. When writing, a flag B is assigned to the file.
[0094]
The head 210 can read any file to which any flag is assigned. In writing, any of the flags A to C can be assigned to a file.
[0095]
Furthermore, the head 210 can also change the flag assigned to the existing file. For example, the information processing apparatus 110 reads the file written after assigning the flag B and writes it to the HD 200 again. Can be written to the HD 200 after the flag C is assigned.
[0096]
The head 129 can read only the file to which the flag C is assigned.
[0097]
The heads 210, 220, and 129 may realize their dedicated functions in hardware or in software.
[0098]
In this embodiment, not only the information communication system is reduced in size and cost by reducing the number of parts, but also the information communication system is further reduced in price by providing a general-purpose HD such as HD200.
[0099]
As described above, in each embodiment of the present invention, the information communication systems 100 and 200 including the plurality of information processing apparatuses 110 to 130 and the like have been described as examples. However, the information communication systems 100 and 200 are formed as semiconductors, for example. Also good.
[0100]
HD160, HD170, HD260, HD270, and HD200, and their heads, can realize their dedicated functions by adding, for example, a time multiplexing control base having a plurality of input / output channels to an existing one-head hard disk. Good.
[0101]
【The invention's effect】
As described above, according to the present invention, after the information transmitted through the network is written in the storage unit provided in the communication unit on the data transmission side or the communication unit on the data reception side, the information is connected to the network. Since data is not read from an external communication unit, data leakage and data tampering can be prevented.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a schematic configuration of an information communication system according to a first embodiment of the present invention.
FIG. 2 is a block diagram showing a schematic internal configuration of the communication unit 100 shown in FIG.
3 is an explanatory diagram of the operation of the information communication system shown in FIGS. 1 and 2. FIG.
FIG. 4 is a block diagram showing a schematic configuration of an information communication system according to a third embodiment of the present invention.
[Explanation of symbols]
110-150, 210-250 Information processing device 160, 170, 260, 270 HD
190, 290 Password path filter 111, 121, 131 CPU
112, 122, 132 Memory 123 Reset means 124 Password output means 128 Printer port 133 Password receiving means 134 Password update means 135 Reset command means 113, 138 First head 114, 139 Second head 136 Authentication means 137 USB port

Claims (4)

Prior to sending and receiving data, a public key for encrypting data is exchanged with other communication units connected to the network,
At the time of data reception, before receiving the data for the first time, a password to be added to the data is sent to the other communication unit through a route that maintains confidentiality, and the data to be transmitted to the other communication unit To create encrypted data that is encrypted using its own public key after adding the password to the encrypted public data, and transmits the encrypted data actually transmitted from the other communication unit to its own public key. Decrypt using the private key corresponding to
By encrypting the data to be transmitted to which the password transmitted from the other communication unit is transmitted through the route that keeps the confidentiality before the transmission using the public key of the other communication unit. A communication unit that transmits the created encrypted data to the other communication unit,
A first storage unit that stores encrypted data transmitted from the other communication unit;
A second storage unit for storing encrypted data to be transmitted to the other communication unit;
A first information processing apparatus that writes encrypted data transmitted from the other communication unit to the first storage unit and reads encrypted data to be transmitted to the other communication unit from the second storage unit;
A second information processing apparatus that reads out the encrypted data stored in the first storage unit and decrypts the encrypted data using the private key;
Authentication means for authenticating the password added to the data decrypted by the second information processing apparatus and the password sent to the other communication unit in advance;
When the authentication means confirms that the passwords match each other, the encrypted data that is obtained by decrypting the encrypted data stored in the first storage unit and is transmitted to the other communication unit is obtained. A communication unit comprising: a third information processing device that writes to the second storage unit. The communication unit according to claim 1, wherein the authentication unit is any one of a display, a printer, a speaker, and a filter that passes the password. An information communication system comprising a plurality of communication units according to claim 1 or 2, wherein the communication units are connected to each other via a network. Prior to data transmission / reception, a public key for data encryption is exchanged between communication units connected to the network, and data is transmitted from the data transmission destination communication unit before the first data transmission / reception. Send a password to be added to the data through a route that maintains confidentiality to the original communication unit,
In the communication unit of the data transmission source, the encrypted data created by encrypting the data to be transmitted with the password added using the public key of the communication unit of the data transmission destination is used as the communication of the data transmission destination. Send to the unit,
An information communication method for decrypting encrypted data transmitted from the data transmission source communication unit using a secret key corresponding to its own public key in the data transmission destination communication unit,
The communication unit of the data transmission source is
The first information processing device writes the encrypted data to be transmitted to the data transmission destination communication unit in the first storage unit,
Read the encrypted data stored in the first storage unit by the second information processing apparatus directly connected to the network,
The data transmission destination communication unit is:
Write the encrypted data transmitted from the data transmission source communication unit to the second storage unit by the third information processing apparatus directly connected to the network,
The fourth information processing device decrypts the encrypted data stored in the second storage unit,
When the password added to the data decrypted by the fourth information processing apparatus matches the password sent in advance, the fifth information processing apparatus stores the password in the second storage unit. An information communication method characterized by acquiring data obtained by decrypting encrypted data.

Images