JP2005223569A - Encryption unit and recording system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To encipher data and to record it into a general-purpose recording medium by using a host device which does not have an encryption/decoding means or which has difficulty in having it. <P>SOLUTION: At the time of recording data, data from the host device 130 is enciphered by the encryption/decoding means 102 by an encryption key which a control means 101 creates based on an inherent identification number which a first recording medium 110 has. Then, the data is recorded in a second recording medium 120 through a general-purpose interface and the created encryption key is recorded in the first recording medium 110. At the time of reading data, the data which is read from the second recording medium 120 is read from the first recording medium 110 by using the encryption key corresponding to a file where the data is stored. The encryption/decoding means 102 decodes the data and it is outputted to the host device 130. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to an encryption apparatus and a recording system using a recording medium having a copyright protection function.

  A recording system having a function of protecting digital data is shown in FIG. The recording system 300 includes a control unit 301, a first recording medium 303, a second recording medium 302, and a host device 310. When writing data, an encryption key for encrypting the data is generated and recorded on the first recording medium 303 having a copyright protection function. Then, after transmitting the encryption key to the host device 310, the host device 310 encrypts the data using the encryption key and records it on the second recording medium 302. When reading data, the encryption key read from the first recording medium 303 and the encrypted data read from the second recording medium 302 are given to the host device 310. Then, the host device 310 decrypts the encrypted data. Such a recording system is disclosed in Patent Document 1, for example.

The operation of the recording system 300 will be described more specifically. The host device 310 performs mutual authentication with the first recording medium 303 via the control unit 301 and generates an encryption key for data encryption. Then, the host device 310 records the encryption key on the first recording medium 303, encrypts the data to be stored, and records it on the second recording medium 302. The host device 310 performs mutual authentication with the first recording medium 303 via the control unit 301 using the encryption key recorded on the first recording medium 303, and is stored in the second recording medium 302. The encryption key for decrypting the encrypted data is read out. Then, the host device 310 reads the encrypted data from the second recording medium 302 and decrypts it.
JP 2000-341265 A

  However, in order to record data to be stored in the second recording medium 302 or to read out data stored in the second recording medium 302, a dedicated encryption having a mutual authentication function on the host device 310 side. -It is necessary to have a decoding means. In a device that is difficult to provide such encryption / decryption means, for example, an embedded device, there is a problem that a recording system for protecting data cannot be easily constructed.

  The present invention has been made in view of such conventional problems, and can be easily applied to general-purpose devices even if hardware or software having a dedicated encryption / decryption function is not constructed on the host device side. The purpose is to make it possible to apply the encryption / decryption function to the.

  In order to solve this problem, an encryption apparatus according to the present invention includes a first recording medium having a copyright protection function for recorded data, and the first recording medium by encrypting data input from an external device. Recording encrypted data on a second recording medium different from the above, and at the time of encrypting the data, encryption / decryption means for reading the encrypted data from the second recording medium and performing decryption processing, After generating the encryption key and mutual authentication with the first recording medium, the generated encryption key is recorded on the first recording medium, and the encryption key is given to the encryption / decryption means and input Data is encrypted and controlled to be recorded on the second recording medium, and when the data is decrypted on the second recording medium, the first recording medium is authenticated after mutual authentication with the first recording medium. Read the encryption key from the recording medium Then, the control unit for controlling the decryption of the data in the second recording medium by giving the encryption key to the encryption / decryption unit, and the data transfer between the external device and the encryption device are possible. And a general-purpose interface.

  Here, the first recording medium may be detachable from the encryption apparatus main body.

  Here, the first recording medium may have a unique identification number.

  Here, the control means reads the file system information from the second recording medium connected via the first general-purpose interface, and sets the second general-purpose interface to the area where the file system information is stored. The encryption / decryption process is not performed when accessed from a host device connected via the network, and the encryption / decryption process is performed when an area other than the file system information is stored is accessed. The conversion / decoding means may be controlled.

  When the file system information is in the FAT format, a master boot record, a partition boot sector, a partition table, a file allocation table, and a root directory entry table may be included.

  In order to solve this problem, a recording system of the present invention includes a host device having a general-purpose interface, a recording medium having a general-purpose interface, and data encryption / decryption processing between the host device and the recording medium. And the encryption device according to any one of claims 1 to 5.

  In order to solve this problem, a recording system of the present invention includes a first host device having a general-purpose interface, a second host device having a general-purpose interface, a recording medium having a general-purpose interface, and the first When there is a data writing instruction from one host device, the data is encrypted and recorded on the recording medium, and when there is a data reading instruction from the second host device, the data is decrypted from the recording medium. And the encryption device according to any one of claims 1 to 5 to be read out.

  The recording system of the present invention does not have or has an encryption / decryption means by installing an encryption device between the host device and the data recording medium via the same interface as the connection. Data protection can be easily realized by using a host device and a general-purpose recording medium that are difficult to perform.

(Embodiment 1)
The encryption apparatus and recording system in Embodiment 1 of this invention are demonstrated using FIG. FIG. 1 is a configuration diagram of a recording system including an encryption device. This recording system includes an encryption device 100 to which a first recording medium 110 can be attached and detached, a second recording medium 120, and a host device 130. The encryption apparatus 100 includes a control unit 101, an encryption / decryption unit 102, and a first recording medium 110. The second recording medium 120 has a non-encrypted data recording area 121 and an encrypted data recording area 122. The encryption device 100 and the second recording medium 120 are connected via a first general-purpose interface (for example, USB), and the encryption device 100 and the host device 130 that is an external device are similar to the second general-purpose interface. Connected via the interface.

  In the encryption apparatus 100, the control unit 101 is connected to the second recording medium 120 when the power is turned on while the second recording medium 120 is connected via the first general-purpose interface or in the operating state. At this time, the file system information of the second recording medium 120 is read, the file system information is handled as information in the non-encrypted data recording area 121, and the other information is handled as information in the encrypted data recording area 122. The file system information is information recorded in the file system area, and is information such as a master boot record, a partition boot sector, a partition table, a file allocation table, and a root directory entry.

  When receiving a data write request from the host device 130, the control unit 101 generates an encryption key for encrypting data using a unique identification number of the first recording medium 110. Further, when the host device 130 accesses the second recording medium via the encryption device 100 in order to write data, the control unit 101 accesses the file system information area, which is the non-encrypted data recording area 121 in detail. When doing so, the control means 101 flows the data in plain text. Further, when accessing the encrypted data recording area 122 where the actual data is written, the control means 101 controls the encryption / decryption means 102 to encrypt the data and write it to the second recording medium 120. Then, the control unit 101 performs mutual authentication with the first recording medium 110 and writes the encryption key to the first recording medium 110 together with information for identifying the written data, for example, identification information related to the file name.

  Conversely, when there is a data read request from the host device 130, the control unit 101 encrypts the target data based on information for identifying the data to be read, for example, identification information related to the file name. The key is read from the first recording medium 110. Then, the control unit 101 gives the read data from the encrypted data recording area 122 to the encryption / decryption unit 102, and controls to decrypt the data and output the data to the host device 130.

  When the host device 130 can control the encryption device 100, the non-encrypted data recording area 121 and the encrypted data recording area 122 can be set from the host device 130.

  Information recorded on the second recording medium 120 in this way cannot be decrypted without the encryption key recorded on the first recording medium 110. For this reason, when the second recording medium 120 is not used, the information recorded on the second recording medium 120 can be protected by removing the first recording medium 110 from the encryption apparatus 100.

  As described above, since data is encrypted / decrypted in the encryption apparatus 100, a data protection function using a host device and a general-purpose recording medium that does not have or is difficult to have encryption / decryption means. You can build a recording system with

  Also, since the encryption key for encryption is created based on the unique identification number of the first recording medium 110, the data can be decrypted only using the encryption key of the first recording medium 110. It becomes possible. Even if the data is recorded on the second recording medium 120 of the same specification, the data encrypted using the encryption key in the specific first recording medium 110 is the other first of the same specification. Even if the recording medium 110 is attached to the encryption device 100, data cannot be decrypted. This makes it possible to protect data according to the user and application.

  Also, since the encrypted data cannot be decrypted without the first recording medium 110 having the encryption key corresponding to this data, the second recording medium 120 can be stored without any special processing. It can be safely disposed of.

(Embodiment 2)
Next, an encryption apparatus and a recording system according to Embodiment 2 of the present invention will be described with reference to FIG. FIG. 2 is a configuration diagram of a recording system according to the second embodiment. In FIG. 2, the constituent elements numbered from 100 to 130 are the same as those described in the first embodiment, and thus detailed description thereof is omitted. The second host device 131 is a host device different from the first host device 130. The interface that connects the host device 130 and the encryption device 100 and the interface that connects the encryption device 100 and the second host device 131 are realized by general-purpose interfaces such as USB.

  As shown in FIG. 2, it is assumed that the host device 130 is disconnected from the encryption device 100 and a second host device 131 having a similar interface is connected to the encryption device 100. Through the encryption device 100, the data recorded on the second recording medium 120 can be seen in plain text from the second host device 131. Therefore, the encrypted data recorded on the second recording medium 120 by the method described in the first embodiment can be easily used by the second host device 131. For example, it is assumed that a standard has been established in which image data taken with a digital camera is directly recorded on a recording medium using a general-purpose interface such as a USB. In this case, by interposing the encryption device 100, the image data can be easily encrypted and recorded, and the recorded encrypted image data can be enjoyed by another viewer device or the like.

  The recording system of the present invention can be suitably used for a purpose of providing a data protection function using a general-purpose host device that does not have or is difficult to have encryption / decryption means and a general-purpose recording medium.

It is a block diagram of the recording system in Embodiment 1 of this invention. It is a block diagram of the recording system in Embodiment 2 of this invention. It is a block diagram of the conventional recording system.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Encryption apparatus 101 Control means 102 Encryption / decryption means 110 First recording medium 120 Second recording medium 121 Non-encrypted data recording area 122 Encrypted data recording area 130 First host device 131 Second host device

Claims (7)

A first recording medium having a copyright protection function for recorded data;
Data input from an external device is encrypted and the encrypted data is recorded on a second recording medium different from the first recording medium, and the encrypted data is read from the second recording medium and decrypted. Encryption / decryption means to perform;
When encrypting the data, an encryption key is generated, and after mutual authentication with the first recording medium, the generated encryption key is recorded on the first recording medium, and the encryption key is stored. The input data is encrypted by being supplied to the encryption / decryption means and controlled to be recorded on the second recording medium, and when the data is decrypted on the second recording medium, the first recording is performed. Control for reading out the encryption key from the first recording medium after mutual authentication with the medium and giving the encryption key to the encryption / decryption means to perform decryption of the data in the second recording medium Means,
A general-purpose interface that enables data transfer between the external device and the encryption device.   2. The encryption apparatus according to claim 1, wherein the first recording medium is detachable from the encryption apparatus main body.   The encryption apparatus according to claim 1, wherein the first recording medium has a unique identification number.   The control means reads file system information from the second recording medium connected via the first general-purpose interface, and sends the file system information to the area storing the file system information via the second general-purpose interface. The encryption / decryption process is not performed when accessed from a connected host device, and the encryption / decryption process is performed when an area other than the file system information is stored is accessed. 2. The encryption apparatus according to claim 1, wherein the decryption means is controlled.   5. The encryption apparatus according to claim 4, wherein when the file system information is in the FAT format, the file system information includes a master boot record, a partition boot sector, a partition table, a file allocation table, and a root directory entry table. A host device with a general-purpose interface;
A recording medium having a general-purpose interface;
6. A recording system comprising: the encryption apparatus according to claim 1 that performs data encryption / decryption processing between the host device and the recording medium. A first host device having a general-purpose interface;
A second host device having a general-purpose interface;
A recording medium having a general-purpose interface;
When there is an instruction to write data from the first host device, the data is encrypted and recorded on the recording medium, and when there is an instruction to read data from the second host device, the data is decrypted from the recording medium An encryption apparatus according to any one of claims 1 to 5, wherein the recording system comprises the recording system.

Images