JP2007027814A - Encryption data decoding device, system method, and program, authentication device and key, and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To secure high security when decoding encryption data that are stored and passed from an authentication device to an authentication key by an encryption data decoding device. <P>SOLUTION: A photo viewer storage 1 generates a cipher key and a decipher key based on the fingerprint information of a user, encrypts CH data for ad hoc based on the cipher key, and stores the encryption data and CH data for authentication at an authentication key 3. The authentication key 3 is passed to the side of a digital camera 2. The digital camera 2 reads the CH data for authentication from the authentication key 3, establishes communication by a channel for authentication, and sends the fingerprint information of the user acquired at the side of the digital camera 2 to the photo viewer storage 1. The photo viewer storage 1 authenticates the digital camera 2 based on both the fingerprint information, and sends the decipher key to the digital camera 2. The digital camera 2 decodes the encryption data by the decipher key, and establishes communication by the channel for ad hoc at an area to the photo viewer storage 1. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an encrypted data decryption device and an authentication device for decrypting encrypted data by sending a decryption key via a communication from a device that authenticates the device to a device that decrypts the encrypted data. The present invention relates to an authentication key, an encrypted data decryption system, an encrypted data decryption method, an encrypted data decryption program, and a recording medium.

  There are an infrastructure mode and an ad hoc mode as a form of a network constructed using a wireless communication technology such as a wireless LAN (Local Area Network) such as the IEEE802.11x standard or Bluetooth (registered trademark). In the infrastructure mode, communication between devices is performed via a base station or an access point. On the other hand, in the ad hoc mode, devices directly communicate with each other without using a base station or an access point.

  In an ad-hoc mode network, authentication and communication establishment processing is required between a device that sends information related to authentication and communication establishment by broadcast communication called broadcast and a device that responds to the broadcast communication. And a network is built. Therefore, any device that exists in an area where broadcast communication can be reached can participate in the network. Therefore, when there are a plurality of devices within the reachable area of the broadcast communication, it is difficult to construct a network by selecting only specific devices.

  In addition, there is a problem that security is lowered due to the fact that information necessary for authentication is transmitted by broadcasting, and the initialization vector in encryption is reduced in order not to reduce communication efficiency. As a technique related to such a problem, a method of recognizing a communication partner by encrypting terminal-specific information on the client side and decrypting the encryption on the server side is known (for example, see Patent Document 1). ). For example, a communication method and an encryption key are generated at a terminal serving as a server and stored in an authentication key. The user manually inserts the authentication key into the client terminal.

  Thereby, the client side encrypts the terminal unique information for identifying its own device by using the encryption key of the authentication key, and transmits the encrypted terminal unique information by the designated communication method in the authentication key. On the server side, the terminal-specific information sent is decrypted. If it can be decrypted, it can be recognized that the other party that has transmitted the terminal-specific information is a legitimate communication party, so that secure communication can be established. According to this method, after the authentication key is inserted into the client side device, the terminal identification is performed using the terminal specific information of the client, so that unauthorized access is prevented even if the authentication key is passed to a third party. Can do.

JP 2004-304315 A

  However, in the method disclosed in Patent Document 1, when an authentication key before being inserted into the client side device is stolen by a third party, the third party illegally accesses using the stolen authentication key. There is a problem that cannot be prevented. In the case of a network in the infrastructure mode, an ESSID (Extended Service Set ID) is transmitted from an access point. As a result, even if the communication method is not specified, communication is possible in the default state, which is problematic in terms of security.

  The present invention eliminates the problems caused by the prior art described above, and can prevent unauthorized access due to authentication key theft, encrypted data decryption apparatus, authentication apparatus, authentication key, encrypted data decryption system, encrypted data decryption It is an object to provide a method, an encrypted data decryption program, and a recording medium. The present invention also provides an encrypted data decryption device, an authentication device, an authentication key, an encrypted data decryption system, an encrypted data decryption method, an encrypted data decryption program, and an encrypted data decryption device capable of ensuring high security in a network based on an infrastructure mode. An object is to provide a recording medium.

  In order to solve the above-described problem, an encrypted data decryption device according to the present invention sends a decryption key from an authentication device that authenticates the encrypted data decryption device to the encrypted data decryption device via communication. An encrypted data decryption device used in a system for decrypting encrypted data stored in an authentication key, wherein the authentication data is stored in an attachment unit to which the authentication key is attached, and an authentication key attached to the attachment unit. An authentication information control unit for transmitting user-specific authentication information to the authentication device using communication established with the authentication device according to the communication conditions, and sent from the authentication device in response to the transmission of the authentication information. And a data decryption unit for decrypting the encrypted data stored in the authentication key attached to the attachment unit based on the decryption key.

  According to the encrypted data decryption apparatus of the present invention, when a valid user (encrypted data decryption apparatus) sends authentication information, a decryption key is sent from the authentication apparatus. Only the user (encrypted data decryption device) can decrypt the encrypted data. Therefore, high security can be ensured when decrypting encrypted data.

  An authentication device according to the present invention sends a decryption key via communication from an authentication device that authenticates the device to an encrypted data decryption device, and decrypts the encrypted data stored in the authentication key in the encrypted data decryption device. An authentication device used in a system for performing authentication, a mounting unit to which an authentication key is mounted, a storage unit storing communication conditions with other devices, and registering user-specific authentication information in the storage unit An authentication information registration unit; a key generation unit that generates an encryption key and a decryption key based on the authentication information; a data encryption unit that encrypts predetermined data based on the encryption key generated by the key generation unit; A data input / output control unit for storing the communication conditions stored in the storage unit and the data encrypted by the data encryption unit in the authentication key mounted in the mounting unit, and the authentication key stored in the authentication key The Comparing the information sent from the encrypted data decryption device using the communication established with the encrypted data decryption device according to the communication conditions, and the authentication information registered in the storage unit, An authentication unit that sends the decryption key to the encrypted data decryption device when both pieces of information match.

  According to the authentication device of the present invention, a decryption key can be sent only to a legitimate user (encrypted data decryption device), and therefore, using the decryption key, other than a legitimate user (encrypted data decryption device) Can prevent the third party from decrypting the encrypted data. Therefore, high security can be ensured when decrypting encrypted data.

  In the authentication device of the present invention, the data encrypted by the authentication device, stored in the authentication key and decrypted by the encrypted data decryption device is authenticated by the authentication device by the authentication data decryption device. It is data obtained by encrypting communication conditions for newly establishing communication between the authentication device and the encrypted data decryption device after completion.

  In this case, by setting the communication condition obtained by decrypting the encrypted data as a condition capable of establishing a communication with higher secrecy than the communication when authenticating the encrypted data decryption apparatus, the encrypted data decryption apparatus After the authentication, a highly confidential communication can be established between the encrypted data decryption device and the authentication device. In addition, the encrypted data decryption apparatus can be easily set up for establishing highly confidential communication.

  In the authentication device according to the present invention, the authentication information is a part of a user's biological body, and is input to the authentication device or the encrypted data decryption device via the authentication key. .

  Thus, by using biometric information such as a fingerprint, palm print, voice print, or iris as authentication information, unauthorized access by a third party can be further prevented. However, the authentication information is not limited to biometric information, and may be a password combining arbitrary characters, symbols, and numbers. When a password is used as the authentication information, a device for reading biometric information is not necessary, so that the device can be simplified.

  The encrypted data decryption system according to the present invention sends a decryption key via communication from an authentication device that authenticates the device to the encrypted data decryption device, and the encryption data stored in the authentication key in the encrypted data decryption device An encrypted data decryption system that decrypts data, generates an encryption key and a decryption key based on user-specific authentication information, encrypts predetermined data based on the encryption key, and is a detachable authentication key Storing the encrypted data and communication conditions for another device to establish communication with the own device, and using the communication established with the other device according to the communication condition. An authentication device that sends the decryption key to the other device when the information sent from the device matches the authentication information, and communication established by the communication conditions stored in the removable authentication key. Use Encryption that sends user-specific authentication information to the authentication device and decrypts the encrypted data stored in the authentication key based on the decryption key sent from the authentication device using the communication A data decryption device, data attached to the authentication device or the encrypted data decryption device and encrypted by the authentication device, and communication between the authentication device and the encrypted data decryption device And an authentication key for storing communication conditions.

  According to the encrypted data decryption system of the present invention, the decryption key is transmitted from the authentication device only to an authorized user (encrypted data decryption device) whose authentication information is registered in advance in the authentication device. Therefore, the third party steals the authentication key before being attached to the encrypted data decryption device, attaches the authentication key to the device used by the third party, and transmits the third party authentication information to the authentication device. Even so, since the authentication information of the third party is not registered in the authentication apparatus, the third party cannot receive the decryption key from the authentication apparatus. In other words, unauthorized access by a third party using the stolen authentication key can be prevented. This is the same even when the ESSID is transmitted in the network in the infrastructure mode, and since the encrypted data cannot be decrypted unless the authentication information matches in the authentication device, high security can be ensured.

  In the encrypted data decryption system according to the present invention, the encrypted data decryption device is a digital camera, and the authentication device is a photo viewer storage that displays and records image data captured by the digital camera. It is characterized by.

  According to this configuration, when the digital camera is authenticated by the photo viewer storage, the image data obtained by photographing with the digital camera can be sent to the photo viewer storage. Further, since unauthorized access to the photo viewer storage by a third party can be prevented, image data and the like can be prevented from being stolen from the photo viewer storage.

  Further, in the encrypted data decryption system of the present invention, the data encrypted by the authentication device, stored in the authentication key and decrypted by the encrypted data decryption device is the image data taken by the digital camera. It is the data which contains.

  According to this configuration, the image data obtained by photographing with the digital camera can be encrypted and sent to the photo viewer storage, so that it is possible to prevent the image data from being stolen from the photo viewer storage.

  The authentication key according to the present invention sends a decryption key via communication from an authentication device that authenticates the device to the encrypted data decryption device, and the encrypted data decryption device stores the encrypted data stored in the authentication key. An authentication key used in a system for performing decryption, wherein a user inputs specific authentication information to the authentication unit or the encrypted data decryption device and a mounting unit attached to the authentication device or the encrypted data decryption device An input unit for performing communication, a communication condition for establishing communication between the encrypted data decryption device and the authentication device, and a storage unit for storing data encrypted by the authentication device It is characterized by.

  According to the authentication key of the present invention, since authentication information is not stored in the authentication key itself, even if a third party steals the authentication key, the authentication device cannot be accessed. Therefore, the third party cannot obtain the decryption key for decrypting the encrypted data stored in the authentication key, and therefore cannot decrypt the encrypted data.

  The encrypted data decryption method according to the present invention is a method in which a decryption key is sent via communication from an authentication device that authenticates the device to the encrypted data decryption device, and the encryption data stored in the authentication key in the encrypted data decryption device In decrypting data, a first step of attaching an authentication key to the authentication device and a second step of inputting user-specific authentication information to the authentication device via the authentication key attached in the first step And a third step in which the authentication device generates an encryption key and a decryption key based on the authentication information input in the second step, and encrypts predetermined data based on the generated encryption key. Step, the authentication device includes the authentication key attached to the data encrypted in the third step, and communication conditions for another device to establish communication with the authentication device. A fourth step of removing the authentication key from the authentication device, a sixth step of attaching the authentication key removed from the authentication device to the encrypted data decryption device, and a sixth step of A seventh step of inputting user-specific authentication information to the encrypted data decryption device via the authentication key attached in step S7, and the encrypted data decryption device is input to the authentication device in the seventh step. An eighth step of transmitting the authentication information using communication established between the encrypted data decryption device and the authentication device based on the communication condition stored in the authentication key in the fourth step; The authentication device transmits the authentication device via the authentication information to be compared sent from the encrypted data decryption device in the eighth step and the authentication key attached to the authentication device. And the ninth step of comparing the original authentication information input to the encrypted data decryption device with the decryption key when the two authentication information matches as a result of the comparison in the ninth step. A tenth step of sending using the communication established between the encrypted data decrypting device and the authenticating device in the step, and the encrypted data decrypting device from the authenticating device in the tenth step. An eleventh step of decrypting the encrypted data stored in the authentication key in the fourth step based on the sent decryption key.

  According to the encrypted data decryption method of the present invention, the decryption key is transmitted from the authentication device only to a legitimate user (encrypted data decryption device) whose authentication information is registered in advance in the authentication device. Therefore, the third party steals the authentication key before being attached to the encrypted data decryption device, attaches the authentication key to the device used by the third party, and transmits the third party authentication information to the authentication device. Even so, since the authentication information of the third party is not registered in the authentication apparatus, the third party cannot receive the decryption key from the authentication apparatus. In other words, unauthorized access by a third party using the stolen authentication key can be prevented.

  In the encrypted data decryption method of the present invention, communication is established between the authentication device and the encrypted data decryption device based on the data decrypted in the eleventh step under new communication conditions. A twelfth step is included.

  In this case, by setting the communication condition obtained by decrypting the encrypted data as a condition capable of establishing a communication with higher secrecy than the communication at the time of authenticating the encrypted data decryption apparatus, A highly confidential communication can be established between the encrypted data decryption device and the authentication device after the authentication of the decryption device.

  The encrypted data decryption method according to the present invention is a method in which a decryption key is sent via communication from an authentication device that authenticates the device to the encrypted data decryption device, and the encryption data stored in the authentication key in the encrypted data decryption device When decrypting data, the authentication device generates an encryption key and a decryption key based on user-specific authentication information input via an authentication key attached to the authentication device, and the generated encryption key A first step of encrypting predetermined data based on the data, the authentication device encrypting the authentication key attached to the authentication device with the data encrypted in the first step, and another device A second step of storing communication conditions for establishing communication with the authentication device; and after the authentication key is removed from the authentication device, the authentication device sends the encrypted data from the encrypted data decryption device. The authentication information to be compared is compared with the original authentication information input in the first step, and when the authentication information matches, the decryption key is sent to the encrypted data decryption device. And a third step of sending using the communication established between the encrypted data decryption device and the authentication device based on the communication condition stored in the authentication key in the step of .

  According to the encrypted data decryption method of the present invention, a decryption key can be sent only to a legitimate user (encrypted data decryption apparatus). It is possible to prevent a third party other than the device from decrypting the encrypted data. Therefore, high security can be ensured when decrypting encrypted data.

  The encrypted data decryption method according to the present invention is a method in which a decryption key is sent via communication from an authentication device that authenticates the device to the encrypted data decryption device, and the encryption data stored in the authentication key in the encrypted data decryption device When performing data decryption, the encrypted data decryption device stores, in the authentication device, user-specific authentication information input to the authentication device via an authentication key attached to the encrypted data decryption device. A first step of sending using communication established between the encrypted data decryption device and the authentication device based on the communication condition being set, and the encrypted data decryption device in the first step The encryption stored in the authentication key based on the decryption key sent from the authentication device using communication established between the encrypted data decryption device and the authentication device Characterized in that it comprises a second step of decoding over data, the.

  According to the encrypted data decryption method of the present invention, when a valid user (encrypted data decryption device) sends authentication information, a decryption key is sent from the authentication device. Only the user (encrypted data decryption device) can decrypt the encrypted data. Therefore, high security can be ensured when decrypting encrypted data.

  An encrypted data decryption program according to the present invention causes a computer to execute the above-described encrypted data decryption method.

  In this case, by executing the encrypted data decryption program of the present invention, the operation obtained by the above-described encrypted data decryption method is realized by a computer. Thereby, the various effects acquired by implementation | achievement of the encryption data decoding method mentioned above can be show | played.

  Furthermore, the recording medium according to the present invention records the above-described encrypted data decryption program in a computer-readable manner.

  Accordingly, various operations obtained by executing the above-described encrypted data decryption program are realized by causing the computer to read and execute the recorded encrypted data decryption program. As a result, various effects obtained by executing the above-described encrypted data decryption program can be obtained.

  Exemplary embodiments of an encrypted data decryption device, an authentication device, an authentication key, an encrypted data decryption system, an encrypted data decryption method, an encrypted data decryption program, and a recording medium according to the present invention are described below with reference to the accompanying drawings. A form is demonstrated in detail. Here, as an example, the authentication device and the encrypted data decryption device of the present invention are applied to a photo viewer storage and a digital camera, respectively, and a network in an ad hoc mode is established between the photo viewer storage and the digital camera using radio. The case where it will be described.

(Appearance of photo viewer storage, digital camera and authentication key)
FIG. 1 is a perspective view showing an example of the appearance of the photo viewer storage. As shown in FIG. 1, a photo viewer storage 1 as an authentication device includes a mounting unit 11 for mounting, for example, a card-like authentication key and a mounting unit 12 for mounting, for example, a card-like wireless communication device (wireless communication card). I have. The photo viewer storage 1 also includes a display screen 13 made up of a liquid crystal display panel, for example, an input means 14 made up of a cross-shaped button, a speaker 15, a power button 16, and various operation buttons not shown. The detailed configuration inside the photo viewer storage 1 will be described later.

  FIG. 2 is a perspective view showing an example of the appearance of the digital camera. As shown in FIG. 2, a digital camera 2 as an encrypted data decryption device includes a mounting unit 21 for mounting a card-like authentication key and a mounting unit for mounting a card-like wireless communication device (wireless communication card), for example. 22 is provided. In addition, the digital camera 2 includes a display screen 23 (on the back) made of a liquid crystal display panel, an optical system 24 made of optical lenses, a viewfinder 25, a shutter button 26, a power button 27, various operation buttons not shown, and the like. ing. The detailed configuration inside the digital camera 2 will be described later.

  FIG. 3 is a perspective view showing an example of the appearance of the authentication key. As shown in FIG. 3, an authentication key 3 as an authentication key card (setting config) includes a mounting unit 31 mounted on the mounting unit 11 of the photo viewer storage 1 or the mounting unit 21 of the digital camera 2, and a user-specific An input unit 32 for inputting authentication information is provided. By mounting the mounting unit 31 on the mounting unit 11 of the photo viewer storage 1 or the mounting unit 21 of the digital camera 2, an electrical circuit inside the authentication key 3 and an electrical circuit inside the photo viewer storage 1 or the digital camera 2 are installed. Are electrically connected. In the present embodiment, since a part of the user's biological information (hereinafter referred to as BM information), for example, fingerprint information, is used as the authentication information, the input unit 32 is configured by a known device capable of reading the fingerprint. ing. Further, the authentication key 3 has a built-in storage unit described later.

  The digital camera 2 records the image data on a built-in memory or a memory card of various standards that is detachably attached to the digital camera 2. In general, the capacity of these memories is not enough, so if you have a large number of shots, move the image data from the built-in memory to another storage to increase the free space in the built-in memory, or replace it with a memory card with more free space. It is necessary to do. Further, since the display screen (LCD) 23 of the digital camera 2 is small, it is difficult to check the focus state by looking at the image displayed on the display screen (LCD) 23.

  Therefore, the image data and audio data are transferred from the digital camera 2 to the photo viewer storage 1 having a display screen 13 larger than the display screen 23 of the digital camera 2 and a large capacity storage, and the image is displayed on the display screen 13. At the same time, it is convenient to record image data and audio data in the storage. At that time, it is more convenient to connect the photo viewer storage 1 and the digital camera 2 to each other by wireless communication in an ad hoc mode, and transfer image data and audio data every time the digital camera 2 takes a picture or at an arbitrary timing. is there. However, when building a network using wireless communication, it is necessary to ensure high security in order to prevent unauthorized access. In the present embodiment, high security is ensured by means as described below.

(Configuration of photo viewer storage, digital camera and authentication key)
FIG. 4 is a block diagram illustrating an example of the configuration of the photo viewer storage, the digital camera, and the authentication key. In addition to the above-described configuration, the photo viewer storage 1 includes a CPU (Central Processing Unit) 101, a RAM (Random Access Memory) 102, a speaker output circuit 103, an HDD (Hard Disk Drive) 104, a card interface, as shown in FIG. 105, 106, other interface 107, television output circuit 108, and display controller 109. Each unit constituting the photo viewer storage 1 is connected to each other via a bus 110 or the like.

  The HD (Hard Disk) as a storage unit built in the HDD 104 stores authentication CH data and ad hoc CH data. The authentication CH data is a communication channel used when the photo viewer storage 1 authenticates another device (for example, the digital camera 2) that desires to establish a network with the own device (photo viewer storage 1). This data defines various conditions (hereinafter referred to as an authentication channel). The ad hoc CH data is a condition of a communication channel (hereinafter referred to as an ad hoc channel) used when the photo viewer storage 1 and other devices (for example, the digital camera 2) exchange data via the network in the ad hoc mode. It is data that prescribes.

  That is, the photo viewer storage 1 constructs a network with another device by using two channels, that is, an authentication channel and an ad hoc channel. The HD (Hard Disk) is also used for storing BM information data (hereinafter referred to as BM registration data), encryption key data, and decryption key data. The card interfaces 105 and 106 are interfaces with a communication card (wireless) (hereinafter referred to as “wireless communication card”) 4 and the authentication key 3, respectively. The CPU 101 includes a ROM (Read Only Memory) 111, a DSP (Digital Signal Processor) 112, an audio processing unit 113, and an image processing unit 114.

  The CPU 101 also has a data input / output control unit 115 that realizes a function for controlling data input / output, and an encryption key / decryption key that realizes a function as a key generation unit that generates an encryption key and a decryption key based on BM information. A generation unit 116, a BM data registration unit 117 that realizes a function as an authentication information registration unit that registers BM information in the HD of the HDD 104, an authentication unit 118 that realizes a function of authenticating other devices, and a predetermined value based on an encryption key A data encryption unit 119 that realizes a function of encrypting the data of the data, and a CH setting unit 120 that realizes a function of setting and switching the authentication channel and the ad hoc channel. Each of these functions may be realized by a hardware configuration, or may be realized by the CPU 101 executing software that realizes the function of each unit stored in the ROM 111 or the HD of the HDD 104, for example.

  In the present embodiment, the data encryption unit 119 encrypts, for example, ad hoc CH data. Then, the data input / output control unit 115 causes the authentication key 3 to store unencrypted CH data for authentication and encrypted CH data for ad hoc. The authentication unit 118 uses the authentication channel established between the photo viewer storage 1 and the digital camera 2 and the BM information sent from the digital camera 2 and the BM information registered in the HD of the HDD 104. When the two information match, the decryption key is sent to the digital camera 2 using the authentication channel.

  The above-mentioned CH data for authentication or ad hoc includes, for example, data for specifying a radio wave channel to be used, IP address of its own device, default gateway or DNS (Domain Name System) server, and TCP / IP (such as a subnet mask). Data related to settings of Transmission Control Protocol / Internet Protocol, and data related to security such as ESS-ID, WEP (Wired Equivalent Privacy), and WPA (Wi-Fi Protected Access) are included.

  FIG. 5 is a diagram illustrating an example of a communication condition setting screen. These data are set in advance by the user operating the input means 14 on a setting screen as shown in FIG. 5 displayed on the display screen 13 of the photo viewer storage 1. Note that the IP address is automatically set by the DHCP server if a DHCP (Dynamic Host Configuration Protocol) server is enabled. The authentication CH data and ad hoc CH data may be the same, or a part or all of them may be different. In the screen example of FIG. 5, the MAC address of a device permitted to participate in the network by MAC (Media Access Control) address filtering is also displayed. This MAC address can also be set by the user operating the input means 14.

  A normal function of the photo viewer storage 1, that is, a function of displaying an image and a function of recording data in the storage are an audio processing unit 113, an image processing unit 114, a speaker output circuit 103, a speaker 15, a television output circuit 108, a display The controller 109, the display screen 13, and the HD of the HDD 104 that stores image data and audio data are realized. Since this normal function is known and is not the gist of the present invention, the description thereof is omitted here.

  In addition to the configuration described above, the digital camera 2 includes an image sensor such as a CPU / control unit 201, a ROM / RAM 202, card interfaces 203 and 204, other interfaces 205, and a CCD (Charge Coupled Device) 206, as shown in FIG. Further, an input unit 207 such as various operation buttons and an LED 208 that is lit or blinks in accordance with the operation state of the digital camera 2 are provided. Each part constituting the digital camera 2 is connected to each other via a bus 209 or the like.

  The ROM / RAM 202 stores data (CH data) defining various conditions of communication channels established with other devices. This CH data is, for example, data corresponding to the above-described authentication CH data when communication with the photo viewer storage 1 is established, and when communication using the ad hoc channel is established. This is data corresponding to the above-described ad hoc CH data. The ROM / RAM 202 is also used for storing moving image and still image data. The card interfaces 203 and 204 are interfaces with the wireless communication card 5 and the authentication key 3, respectively.

  The CPU / control unit 201 includes an image data creation unit 210, an image data output unit 211, a moving image display control unit 212, and a storage medium control unit 213. Further, the CPU / control unit 201 uses the authentication channel established with the photo viewer storage 1 to send the user's BM information input on the digital camera 2 side to the photo viewer storage 1. BM data control unit 214 that realizes a function as a unit, a function for decrypting encrypted data stored in the authentication key 3 based on a decryption key sent from the photo viewer storage 1 using an authentication channel And a data decoding unit 215 for realizing the above and a CH setting unit 216 for realizing the function of setting and switching the authentication channel and the ad hoc channel.

  Each of these functions may be realized by a hardware configuration, or may be realized by the CPU / control unit 201 executing software that realizes the function of each unit, for example, stored in the ROM / RAM 202. Good. The normal functions of the digital camera 2, that is, the functions of taking a still image or a moving image and recording the data or outputting the data to the outside are an image data creation unit 210, an image data output unit 211, a storage medium control unit 213, a display This is realized by the screen 23, the optical system 24, the CCD 206, and the ROM / RAM 202 for storing image data and audio data. Since this normal function is known and is not the gist of the present invention, the description thereof is omitted here.

  As shown in FIG. 4, the authentication key 3 includes the input unit 32 and a storage unit 33 made of a rewritable nonvolatile memory such as an EEPROM. The storage unit 33 stores authentication CH data that has not been encrypted by the photo viewer storage 1 and encrypted ad hoc CH data. The photo viewer storage 1 and the digital camera 2 perform data transmission / reception via an authentication channel or an ad hoc channel via the wireless communication cards 4 and 5 attached to the photo viewer storage 1 and the digital camera 2, respectively.

(Procedure for decrypting encrypted data using photo viewer storage, digital camera, and authentication key)
FIG. 6 is a flowchart showing an example of a decryption process procedure of encrypted data by the photo viewer storage 1, the digital camera 2, and the authentication key 3 in this embodiment. When a certain user (user A) joins the digital camera 2 to a wireless LAN managed by the photo viewer storage 1 functioning as an authentication server, the user A first attaches the authentication key 3 to the photo viewer storage 1 (Step S1).

  In this state, the user A causes the input unit 32 of the authentication key 3 to read his / her fingerprint as BM information. The BM information of the user A input from the authentication key 3 is registered in the HD of the HDD 104 by the BM data registration unit 117 (step S2). When the BM information of the user A is already registered in the photo viewer storage 1, step S2 can be omitted. Next, the encryption key / decryption key generation unit 116 creates an encryption key and a decryption key based on the BM information of the user A, and stores the encryption key and the decryption key in the HD of the HDD 104 in association with the BM information of the user A. . Further, the data encryption unit 119 reads the ad hoc CH data from the HD of the HDD 104, and encrypts the ad hoc CH data based on the encryption key associated with the BM information of the user A (step S3).

  Next, the data input / output control unit 115 reads the authentication CH data from the HD of the HDD 104, and uses the authentication CH data and the encrypted data of the ad hoc CH data encrypted by the data encryption unit 119 as the authentication key 3. Is stored in the storage unit 33 (step S4). If the BM information is registered in the photo viewer storage 1 and the authentication CH data and the encrypted data of the ad hoc CH data are stored in the authentication key 3 at the above stage, the registration of the BM information is performed. Processing, encryption key creation processing, decryption key creation processing, encryption key storage processing, decryption key storage processing, ad hoc CH data encryption processing, authentication CH 3 authentication CH data storage processing and authentication key 3, the processing order of the storage processing of the encrypted data of the ad hoc CH data to 3 may be changed.

  When data is stored in the authentication key 3, the user A removes the authentication key 3 from the photo viewer storage 1 (step S5). Up to this point, the process is performed on the photo viewer storage side, and from here on, the process is performed on the digital camera side. The user A attaches the authentication key 3 to the digital camera 2 that participates in the wireless LAN managed by the photo viewer storage 1 (step S6). Then, the user A causes the input unit 32 of the authentication key 3 to read his / her fingerprint as BM information, and inputs the BM information (step S7).

  Further, the CH setting unit 216 reads the authentication CH data from the authentication key 3 and sets the setting for establishing communication with the photo viewer storage 1 through the authentication channel based on the authentication CH data. This is automatically performed for the (digital camera 2), and communication with the photo viewer storage 1 is established using an authentication channel. The photo viewer storage 1 is normally in a mode in which communication using an ad hoc channel is performed based on ad hoc CH data, but is switched to a mode in which communication using an authentication channel is performed for a certain period at a certain timing.

  For example, the photo viewer storage 1 is switched to the authentication channel for several milliseconds to several seconds per minute. Alternatively, after the photo viewer storage 1 transfers the data to the authentication key 3, it may be switched to the authentication channel for about one minute, for example. If there is an access from the digital camera 2 using the authentication channel during the period when the photo viewer storage 1 is switched to the mode for performing communication using the authentication channel, communication using the authentication channel is established between them. When communication using the authentication channel is established, the BM data control unit 214 uses this channel to input the BM information of the user A input to the photo viewer storage 1 via the wireless communication cards 5 and 4 on the digital camera side. (Step S8).

  From here, the process is performed again on the photo viewer storage 1 side. When the photo viewer storage 1 receives the BM information of the user A from the digital camera 2, the authentication unit 118 reads the BM information of the user A from the HD of the HDD 104 and sends the BM information read from the HD and the digital camera 2. The obtained BM information is compared (step S9). As a result, if the BM information matches (step S9: Yes), authentication of the digital camera 2 is established. Therefore, the authentication unit 118 reads the decryption key associated with the BM information of the user A from the HD of the HDD 104, and uses the decryption key to the digital camera 2 via the wireless communication cards 4 and 5 using the authentication channel. Send (step S10). Note that the encryption key / decryption key generation unit 116 may create a decryption key when the digital camera 2 is authenticated.

  On the other hand, when both BM information does not correspond in step S9 (step S9: No), a process is complete | finished here. Also, when the BM information of user A is not registered in the HD of the HDD 104, the process is terminated here. When it is determined that the BM information of the user A is not registered, the authentication key 3 is reattached to the photo viewer storage 1, and the user A inputs the BM information from the input unit 32, whereby the digital camera 2 may be established, and the subsequent processing may be continued. In that case, it is necessary to reattach the authentication key 3 to the digital camera 2 after the authentication of the digital camera 2 is established.

  From here, the processing is performed again on the digital camera side. When the digital camera 2 receives the decryption key from the photo viewer storage 1, the data decryption unit 215 reads the encrypted data of the ad hoc CH data from the authentication key 3, and decrypts the encrypted data based on the decryption key. Thereby, the digital camera 2 acquires the ad hoc CH data for constructing the ad hoc mode network with the photo viewer storage 1 (step S11).

  Then, the CH setting unit 216 automatically sets the setting for establishing communication with the photo viewer storage 1 using the ad hoc channel based on the ad hoc CH data to the own apparatus (digital camera 2). And the photo viewer storage 1 is accessed using communication using the ad hoc channel. At this point, since the photo viewer storage 1 has returned to the mode for performing communication using the ad hoc channel based on the ad hoc CH data, communication using the ad hoc channel is possible between the photo viewer storage 1 and the digital camera 2. Establish (step S12).

  Then, the photo viewer storage 1 and the digital camera 2 decrypt the encrypted ad hoc CH data, automatically set communication conditions for performing communication using the ad hoc channel, and build a network in the ad hoc mode. The series of processes to be completed is terminated. After the network in the ad hoc mode is established, image data and audio data may be transferred from the digital camera 2 to the photo viewer storage 1 every time the digital camera 2 takes a picture or at an arbitrary timing.

  As described above, according to the embodiment of the present invention, the photo viewer storage 1 is used only when a legitimate user whose BM information is registered in the photo viewer storage 1 uses the digital camera 2 in advance. A decryption key is transmitted to the digital camera 2. Accordingly, the third party steals the authentication key 3 before being attached to the digital camera 2, attaches the authentication key 3 to the device used by the third party, and stores the BM information of the third party in the photo viewer storage 1. Is transmitted, the third party cannot receive the decryption key from the photo viewer storage 1 because the BM information of the third party is not registered in the photo viewer storage 1.

  That is, it is possible to prevent a third party from illegally accessing the photo viewer storage 1 by using the stolen authentication key 3, so that the photo viewer storage 1 is illegally used or image data from the photo viewer storage 1. Can be prevented from being stolen. This is the same even when ESSID is transmitted in the network in the infrastructure mode, and unless the BM information matches in the photo viewer storage 1, the decryption key is not sent to the user. That is, since the third party who has stolen the authentication key 3 cannot decrypt the data obtained by encrypting the infrastructure CH data corresponding to the above-described ad hoc CH data, high security can be ensured.

  In addition, by setting the ad hoc CH data (or infrastructure CH data) as a condition for establishing a communication with higher secrecy than the communication using the authentication channel, the digital camera 2 and the photo are authenticated after the digital camera 2 is authenticated. Communication with higher confidentiality can be established with the viewer storage 1. In addition, since the setting by the ad hoc CH data (or infrastructure CH data) is automatically performed in the digital camera 2, it is generally possible to easily perform complicated communication settings.

  Also, by making biometric information such as fingerprints into BM information, unauthorized access by a third party can be further prevented. The BM information is not limited to fingerprints, but may be information such as palm prints, voice prints, and irises. In this case, the input unit 32 of the authentication key 3 is configured to be able to acquire each BM information, but since the configuration thereof is publicly known, description thereof is omitted. In addition to the BM information, a password combining arbitrary characters, symbols, and numbers can be used as the authentication information. In that case, a device for reading the BM information or the like is not necessary, so that the system can be simplified.

  In addition, since BM information is not stored in the authentication key itself, even if a third party steals the authentication key 3 and accesses the photo viewer storage 1, the photo viewer storage 1 does not accept it. Accordingly, since the third party cannot obtain the decryption key, the encrypted data of the ad hoc CH data (or infrastructure CH data) stored in the authentication key 3 cannot be decrypted. That is, high security can be ensured.

  As described above, the present invention is not limited to the above-described embodiment, and various modifications can be made. For example, the authentication CH data may be encrypted and stored in the authentication key 3, and the encrypted data of the authentication CH data may be decrypted on the digital camera side. In this case, for example, a public key may be used. The authentication device and the encrypted data decryption device are not limited to the photo viewer storage 1 and the digital camera 2. In particular, the same can be realized by using a personal computer or the like instead of the photo viewer storage 1.

  When the network constructed between the authentication device and the encrypted data decryption device is in the ad hoc mode, a personal computer or the like having a wireless LAN function can be used as the authentication device. In the infrastructure mode, a personal computer or the like having an access point function can be used as the authentication device. Further, the data encrypted by the authentication device and decrypted by the encrypted data decryption device is not limited to the ad hoc CH data.

  For example, when the authentication device is a digital camera and the encrypted data decryption device is a photo viewer storage, the image data obtained by photographing with the digital camera is encrypted and stored in the authentication key 3. Data obtained by encrypting image data or the like by passing to the photo viewer storage may be passed to the photo viewer storage and decrypted by the photo viewer storage. The authentication device (photo viewer storage 1) and the encrypted data decryption device (digital camera 2) may have a built-in wireless function. Further, the authentication device (photo viewer storage 1) and the encrypted data decryption device (digital camera 2) may be connected by a wired LAN or the like. Further, a plurality of authentication devices and encrypted data decryption devices may exist in the same wireless communication reachable area.

  In addition, when each function of the photo viewer storage 1 or the digital camera 2 described above is realized by executing software, the program is a DVD (Digital Versatile Disk), a CD (Compact Disk), a CD-ROM (CD-R, CD). -RW), MO (Magneto-Optical disk), and a computer-readable recording medium such as a memory card. In addition, this program may be distributed to the photo viewer storage 1 and the digital camera 2 via a network such as the Internet.

The perspective view which shows an example of the external appearance of the photo viewer storage of embodiment. 1 is a perspective view illustrating an example of an appearance of a digital camera according to an embodiment. The perspective view which shows an example of the external appearance of the authentication key of embodiment. FIG. 3 is a block diagram illustrating an example of a configuration of an embodiment. The figure which shows an example of the setting screen of the communication conditions in embodiment. The flowchart which shows an example of the encryption data decoding process procedure of embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Photo viewer storage (authentication apparatus), 2 Digital camera (encryption data decryption apparatus), 3 Authentication key (authentication key card), 11 Mounting part, 21 Mounting part, 31 Mounting part, 32 Input part, 33 Storage part, 104 HDD, 115 data input / output control unit, 116 encryption key / decryption key generation unit, 117 BM data registration unit, 118 authentication unit, 119 data encryption unit, 214 BM data control unit, 215 data decryption unit

Claims (14)

Encryption used for a system that sends a decryption key via communication from an authentication device that authenticates the device to the encrypted data decryption device, and decrypts the encrypted data stored in the authentication key in the encrypted data decryption device A data decoding device comprising:
A mounting part to which the authentication key is mounted;
An authentication information control unit that sends user-specific authentication information to the authentication device using communication established with the authentication device according to the communication conditions stored in the authentication key attached to the mounting unit;
A data decryption unit for decrypting encrypted data stored in the authentication key attached to the attachment unit, based on a decryption key sent from the authentication device in response to transmission of authentication information;
An encrypted data decryption device comprising: Authentication device used in a system for sending a decryption key via communication from an authentication device that authenticates the device to the encrypted data decryption device, and decrypting the encrypted data stored in the authentication key in the encrypted data decryption device Because
A mounting part to which the authentication key is mounted;
A storage unit storing communication conditions with other devices;
An authentication information registration unit for registering user-specific authentication information in the storage unit;
A key generation unit that generates an encryption key and a decryption key based on the authentication information;
A data encryption unit that encrypts predetermined data based on the encryption key generated by the key generation unit;
A data input / output control unit for storing the communication condition stored in the storage unit and the data encrypted by the data encryption unit in the authentication key mounted on the mounting unit;
Information sent from the encrypted data decryption device using communication established with the encrypted data decryption device according to the communication conditions stored in the authentication key, and authentication registered in the storage unit An authentication unit that compares the information and sends the decryption key to the encrypted data decryption device when both pieces of information match.
An authentication device comprising:   The data encrypted by the authentication device, stored in the authentication key, and decrypted by the encrypted data decryption device is stored in the authentication device and the encrypted data after the authentication device has authenticated the encrypted data decryption device. 3. The authentication apparatus according to claim 2, wherein the authentication apparatus is data obtained by encrypting communication conditions for newly establishing communication with the encrypted data decryption apparatus.   4. The authentication according to claim 2, wherein the authentication information is a part of information of a user's biological body and is input to the authentication device or the encrypted data decryption device via the authentication key. apparatus. An authentication key used in a system that sends a decryption key via communication from an authentication device that authenticates the device to the encrypted data decryption device and decrypts the encrypted data stored in the authentication key in the encrypted data decryption device Because
A mounting unit mounted on the authentication device or the encrypted data decryption device;
An input unit for a user to input unique authentication information to the authentication device or the encrypted data decryption device;
A communication condition for establishing communication between the encrypted data decryption device and the authentication device, and a storage unit for storing data encrypted by the authentication device;
An authentication key comprising: An encrypted data decryption system that sends a decryption key via communication from an authentication device that authenticates the device to the encrypted data decryption device, and decrypts the encrypted data stored in the authentication key in the encrypted data decryption device. There,
An encryption key and a decryption key are generated based on user-specific authentication information, predetermined data is encrypted based on the encryption key, the encrypted data is attached to a removable authentication key, and another device The communication conditions for establishing the communication of the other device, and the information sent from the other device using the communication established with the other device according to the communication condition and the authentication information An authentication device that sends the decryption key to the other device when they match, and
A user-specific authentication information is sent to the authentication device using communication established by communication conditions stored in a removable authentication key, and the decryption key sent from the authentication device using the communication An encrypted data decryption device for decrypting encrypted data stored in the authentication key,
Attached to the authentication device or the encrypted data decryption device and stores data encrypted by the authentication device and a communication condition for establishing communication between the authentication device and the encrypted data decryption device An authentication key,
An encrypted data decryption system comprising:   7. The encryption according to claim 6, wherein the encrypted data decryption device is a digital camera, and the authentication device is a photo viewer storage that displays and records image data captured by the digital camera. Data decryption system.   7. The data encrypted by the authentication device, stored in the authentication key, and decrypted by the encrypted data decryption device is data including image data photographed by the digital camera. Or the encrypted data decryption system according to 7; In transmitting the decryption key via communication from the authentication device that authenticates the device to the encrypted data decryption device, and decrypting the encrypted data stored in the authentication key in the encrypted data decryption device,
A first step of attaching an authentication key to the authentication device;
A second step of inputting user-specific authentication information to the authentication device via the authentication key attached in the first step;
A third step in which the authentication device generates an encryption key and a decryption key based on the authentication information input in the second step, and encrypts predetermined data based on the generated encryption key;
A fourth step in which the authentication device stores the data encrypted in the third step in the authentication key attached, and a communication condition for another device to establish communication with the authentication device; ,
A fifth step of removing an authentication key from the authentication device;
A sixth step of attaching an authentication key removed from the authentication device to the encrypted data decryption device;
A seventh step of inputting user-specific authentication information to the encrypted data decryption device via the authentication key attached in the sixth step;
The encrypted data decryption device receives the authentication information input to the authentication device in the seventh step based on the communication condition stored in the authentication key in the fourth step and the encrypted data decryption device An eighth step of sending using communication established with the authentication device;
The authentication device receives the comparison target authentication information sent from the encrypted data decryption device in the eighth step and the original input to the authentication device via the authentication key attached to the authentication device. A ninth step of comparing the authentication information;
As a result of the comparison in the ninth step, a decryption key is established between the encrypted data decryption device and the authentication device in the eighth step when both authentication information matches. A tenth step of sending using the transmitted communication;
An eleventh step in which the encrypted data decryption device decrypts the encrypted data stored in the authentication key in the fourth step based on the decryption key sent from the authentication device in the tenth step. When,
An encrypted data decryption method comprising:   The method further includes a twelfth step of establishing communication between the authentication device and the encrypted data decryption device under new communication conditions based on the data decrypted in the eleventh step. Item 10. The encrypted data decryption method according to Item 9. In transmitting the decryption key via communication from the authentication device that authenticates the device to the encrypted data decryption device, and decrypting the encrypted data stored in the authentication key in the encrypted data decryption device,
The authentication device generates an encryption key and a decryption key based on user-specific authentication information input via an authentication key attached to the authentication device, and generates predetermined data based on the generated encryption key. A first step of encryption;
The authentication device stores the data encrypted in the first step in the authentication key attached to the authentication device, and communication conditions for another device to establish communication with the authentication device. Two steps,
After the authentication key is removed from the authentication device, the authentication device compares the authentication information to be compared sent from the encrypted data decryption device with the original authentication information input in the first step. When the authentication information matches, the decryption key is stored in the encrypted data decryption device, and the encrypted data decryption device and the authentication device are based on the communication conditions stored in the authentication key in the second step. A third step of sending using communication established between;
An encrypted data decryption method comprising: In transmitting the decryption key via communication from the authentication device that authenticates the device to the encrypted data decryption device, and decrypting the encrypted data stored in the authentication key in the encrypted data decryption device,
The encrypted data decryption device receives the user-specific authentication information input to the authentication device via the authentication key attached to the encrypted data decryption device based on the communication conditions stored in the authentication key. A first step using a communication established between the encrypted data decryption device and the authentication device;
The encrypted data decryption device is based on a decryption key sent from the authentication device using communication established between the encrypted data decryption device and the authentication device in the first step, A second step of decrypting the encrypted data stored in the authentication key;
An encrypted data decryption method comprising:   An encrypted data decryption program for causing a computer to execute the encrypted data decryption method according to claim 11 or 12. A computer-readable recording medium on which the encrypted data decryption program according to claim 13 is recorded.

Images