JP2007298847A - In-program data protection device, protection method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an in-program data protection device eliminating the need for a private key, reducing decline of performance efficiency, and capable of enhancing safety. <P>SOLUTION: Following steps are carried out in an arbitrary order: a step to perform bijective replacement arithmetic processing in bytes to an arbitrary character string of in-program data transferred between functions of a program; a step to perform bijective stirring arithmetic processing in bytes to an arbitrary character string of in-program data; and a step to perform rotation arithmetic processing to rotate an arbitrary character string of in-program data by the arbitrary number of bits to the left in arbitrary order. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to an in-program data protection device, a protection method, and a program that make it difficult for a third party to analyze data passed between program functions.

In general, the program data is likely to contain information that should be kept secret from the user. For this reason, when such information to be kept secret is stored in a program or a process of passing between functions is performed, it is required to take some measures against indefinite analysis. Conventionally, a method for protecting data by encrypting data in a program has been proposed (for example, see Non-Patent Document 1).
Federal Information Processing Standards Publication 197, “ADVANCED ENCRYPTION STANDARD (AES)”, November 26, 2001

  However, the method for protecting data in a program by encryption has the following problems. That is, first, since the encryption and decryption processes increase, the efficiency may decrease. Second, encryption requires a key and must be managed reliably. One of the methods is to hide the key in the program itself. In this case, the information to be hidden only changes from the original data to the key, so it cannot be an essential solution. There is a problem. As another method, there is a method of storing the key in hardware outside the program. In this case, however, there is a problem that the management cost of the key becomes extremely high.

  Therefore, the present invention has been made in view of the above-described problems, and it does not require a secret key, has a small decrease in execution efficiency, and can protect the in-program data protection device, protection method, and The purpose is to provide a program.

The present invention proposes the following matters in order to solve the above problems.
(1) The present invention provides byte replacement means (for example, the byte replacement unit 20 in FIGS. 1 and 2) that performs bijective replacement processing in units of bytes for an arbitrary character string of data in a program. Bite agitating means (for example, equivalent to the bite agitation unit 30 in FIGS. 1 and 2) that performs bijective agitation calculation processing in byte units for an arbitrary character string of data in the program A data protection device for a program characterized by comprising:

  According to the present invention, the byte replacement means performs bijective replacement calculation processing in bytes for an arbitrary character string of data in the program, and the byte agitation means performs an arbitrary character string of the data in the program. On the other hand, a bijection agitation calculation process in byte units is performed. As a result, it is possible to achieve a very high execution efficiency while improving safety compared to the prior art.

  (2) The present invention provides an operation bit rotation means for performing rotation operation processing for rotating an arbitrary character string of data in a program left by an arbitrary number of bits with respect to the in-program data protection device of (1) A device for protecting data in a program is further proposed, further comprising (for example, equivalent to the arithmetic bit rotation unit 10 in FIGS. 1 and 2).

  Further, according to the present invention, the calculation bit rotation means performs rotation calculation processing for rotating an arbitrary character string of data in the program to the left by an arbitrary number of bits, thereby realizing very high execution efficiency. However, very high safety can be achieved.

  (3) The present invention relates to a byte replacement reverse operation means (for example, the byte replacement reverse operation section 32 in FIG. 2) that performs reverse operation processing of the replacement operation processing in the byte replacement means in the in-program data protection device of (1). And a bite agitation reverse calculation means (e.g., equivalent to the bite agitation reverse operation unit 31 in FIG. 2) for performing a reverse calculation process of the agitation calculation process in the bite agitation means. A protection device for in-program data is proposed.

  According to the present invention, the byte replacement inverse calculation means performs the reverse calculation process of the substitution calculation process in the byte replacement means, and the bite stirring reverse calculation means performs the reverse calculation process of the stirring calculation process in the bite stirring means. If the original input value is required in other functions, the original input value can be obtained for the data passed in, and in addition, the safety is improved and the execution efficiency is very high. Can be realized.

  (4) The present invention relates to an operation bit rotation reverse operation means (for example, the operation bit rotation reverse operation of FIG. 2) for performing the reverse operation processing of the rotation operation processing in the operation bit rotation means in the in-program data protection device of (2). A device for protecting data in a program is further provided, which further includes an operation unit 33).

  According to this invention, since the operation bit rotation reverse operation means performs the reverse operation process of the rotation operation process in the operation bit rotation means, the original input value within the other function can be obtained for the data passed between the functions. The original input value can be obtained when necessary, and in addition, a very high safety can be realized while realizing a very high execution efficiency.

  (5) The present invention includes a step (for example, equivalent to step S103 in FIG. 4) of performing a bijection replacement processing in units of bytes for an arbitrary character string of data in the program, In a program characterized in that a step of performing bijection agitation calculation processing in byte units (for example, corresponding to step S104 in FIG. 4) is performed in an arbitrary order on an arbitrary character string of data Proposes data protection methods.

  According to the present invention, a bijection permutation calculation process in byte units and a bijection agitation calculation process in byte units are performed on an arbitrary character string of data in a program in an arbitrary order. For this reason, it is possible to achieve very high execution efficiency while improving safety compared to the prior art.

  (6) The present invention includes a step (for example, equivalent to step S103 in FIG. 4) of performing a bijection replacement processing in units of bytes for an arbitrary character string of data in the program, A step of performing bijection agitation calculation processing in byte units for an arbitrary character string of data (for example, equivalent to step S104 in FIG. 4), and for an arbitrary character string of data in the program, Proposing a method for protecting data in a program, characterized in that a step of performing rotation calculation processing for rotating to the left by an arbitrary number of bits (for example, corresponding to step S102 in FIG. 4) is executed in an arbitrary order Yes.

  According to the present invention, for an arbitrary character string of data in a program, in a random order, a bijective permutation calculation process in byte units and a bijection agitation calculation process in byte units and to the left Since the rotation calculation process for rotating by an arbitrary number of bits is performed, it is possible to realize very high safety while realizing very high execution efficiency.

  (7) The present invention includes a step (for example, equivalent to step S103 in FIG. 4) of performing a bijection replacement processing in units of bytes for an arbitrary character string of data in the program, A program for causing a computer to execute a step (for example, equivalent to step S104 in FIG. 4) of bijection agitation calculation processing in byte units for an arbitrary character string of data and an arbitrary order is suggesting.

  According to the present invention, a bijection permutation calculation process in byte units and a bijection agitation calculation process in byte units are performed on an arbitrary character string of data in a program in an arbitrary order. For this reason, it is possible to achieve very high execution efficiency while improving safety compared to the prior art.

  (8) The present invention includes a step (for example, equivalent to step S103 in FIG. 4) of performing a bijection replacement processing in units of bytes for an arbitrary character string of data in the program, A step of performing bijection agitation calculation processing in byte units for an arbitrary character string of data (for example, equivalent to step S104 in FIG. 4), and for an arbitrary character string of data in the program, A program is proposed for causing a computer to execute a rotation calculation process for rotating to the left by an arbitrary number of bits (e.g., corresponding to step S102 in FIG. 4) and an arbitrary order.

  According to the present invention, for an arbitrary character string of data in a program, in a random order, a bijective permutation calculation process in byte units and a bijection agitation calculation process in byte units and to the left Since the rotation calculation process for rotating by an arbitrary number of bits is performed, it is possible to realize very high safety while realizing very high execution efficiency.

According to the present invention, it is possible to minimize a decrease in execution efficiency by using only high-speed operation bit rotation, byte replacement, and byte agitation processing.
In addition, according to the present invention, since processing without using an encryption key can be realized, it is possible to provide a method that is less costly and less likely to reduce execution efficiency.
Furthermore, there is an effect that high security can be realized by combining the processing in bit units and the processing in byte units.

Hereinafter, embodiments of the present invention will be described in detail with reference to FIGS. 1 to 5.
Note that the constituent elements in the present embodiment can be appropriately replaced with existing constituent elements and the like, and various variations including combinations with other existing constituent elements are possible. Therefore, the description of the present embodiment does not limit the contents of the invention described in the claims.

  The in-program data protection apparatus according to the present embodiment protects data in the program when the data in the program is transferred between functions such as function 1, function 2, and function 3, as shown in FIG. is there. In FIG. 3, the upper diagram shows how data is transferred between conventional functions, and the lower diagram shows how data is transferred between functions when the present invention is applied.

  Here, the configuration of the in-program data protection device corresponding to the function 1 includes an arithmetic bit rotation unit 10, a byte replacement unit 20, and a byte agitation unit 30, as shown in FIG.

  The operation bit rotation unit 10 performs an operation to rotate the character string A by n bits to the left. Hereinafter, this calculation is abbreviated as R (A, n). Specifically, when an operation for rotating the character string “10101101” by 3 bits to the left is performed, the character string becomes “01101101”. This is expressed as R (0b10101101, 3) = 01101101.

  The byte replacement unit 20 performs an operation for performing bijection replacement on the character string A in byte units. Hereinafter, this calculation is abbreviated as S (A). Specifically, “00” is “F4”, “01” is “92”, “02” is “3E”, “03” is “A8”, “FE” is “21”, and “FF” is “ The replacement is executed based on the data table storing the information to be replaced in units of bytes. Therefore, when a substitution operation is performed on the character string “00010203”, “F4923EA8” is obtained. This is expressed as S (0x00010203) = 0xF4923EA8.

  The bite agitation unit 30 performs an operation for performing bijective agitation on the character string A in byte units. Hereinafter, this calculation is abbreviated as M (A). Specifically, when the character string is “82F31CB7”, and “82” is A, “F3” is B, “1C” is C, and “B7” is D in bytes, M (A‖ When stirring such that B な る C‖D) = B‖A‖D‖C is executed, the character string becomes “F382B71C”. This is expressed as M (0x82F31CB7) = F382B71C.

  On the other hand, as shown in FIG. 2, the configuration of the in-program data protection device corresponding to the function 2 includes an operation bit rotation unit 10, a byte replacement unit 20, a byte agitation unit 30, and a byte agitation inverse operation unit 31. , A byte replacement inverse operation unit 32 and an operation bit rotation inverse operation unit 33. Note that the arithmetic bit rotation unit 10, the bite replacement unit 20, and the bite stirring unit 30 are the same as those already described, and thus detailed description thereof is omitted.

  The bite agitation reverse calculation unit 31 is an inverse operation of the bite agitation calculation. Hereinafter, this calculation is abbreviated as IM (A). Specifically, when the bite stirring reverse operation is performed on the character string “F382B71C”, the character string becomes “82F31CB7”. This is expressed as IM (0xF382B71C) = 0x82F31CB7.

  The byte replacement inverse operation unit 32 is an inverse operation of the byte replacement operation. Hereinafter, this operation is abbreviated as IS (A). Specifically, when the byte replacement inverse operation is performed on the character string “F4923EA8”, the character string becomes “00010203”. This is expressed as IS (0xF4923EA8) = 0x00010203.

  The calculation bit rotation reverse calculation unit 33 is a reverse calculation of the calculation bit rotation calculation. Hereinafter, this calculation is abbreviated as R (A, -n). Specifically, when a reverse operation is performed by rotating the character string “01101101” 3 bits to the right, the character string becomes “10101101”. This is expressed as R (0b01101101, -3) = 10101101.

Next, the processing operation in the protection device for in-program data corresponding to function 1 in FIG. 3 will be described with reference to FIG.
First, the in-program data protection apparatus inputs data including, for example, a character string “10101101” as data from an input unit (not shown) (step S101). The input data is transmitted to the operation bit rotation unit 10, and for example, an operation for rotating the input character string by 3 bits to the left is performed to obtain a character string of R (0b10101101, 3) = 0101101 S102).

  The character string “01101101” subjected to arithmetic processing in the arithmetic bit rotation unit 10 is transmitted to the byte replacement unit 20, and for example, a character string of S (0x01101101) = F429F992 is obtained by byte replacement processing (step S103).

  The character string “F429F992” calculated by the byte replacement unit 20 is transmitted to the bite agitation unit 30 and, for example, a character string of M (0xF429F992) = 29F492F9 is obtained by the byte agitation processing (step S104). The character string obtained in this way is output to the function 2 (step S105). That is, data = R (M (S (output), n)) is obtained by these processes.

Next, the processing operation in the protection apparatus for in-program data corresponding to the function 2 in FIG. 3 will be described with reference to FIG.
First, the in-program data protection device inputs data consisting of, for example, a character string “29F492F9” as data from an input unit (not shown) (step S201). The input data is transmitted to the bite agitation reverse calculation unit 31, and a character string of IM (0x29F492F9) = F429F992 is obtained by the bite agitation reverse calculation process (step S202).

  The character string “F429F992” subjected to the reverse operation processing in the byte agitation reverse operation unit 31 is transmitted to the byte replacement reverse operation unit 32, and a character string of IS (0xF429F992) = 0101101101 is obtained by the byte replacement reverse operation processing (step S203). ).

  The character string “01101101” subjected to the reverse operation processing in the byte replacement reverse operation unit 32 is transmitted to the operation bit rotation reverse operation unit 33, and a character string of R (0b01101101, −3) = 10101101 is obtained by the operation bit rotation reverse operation. Obtain (step S204). The original input value can be obtained by the processing so far.

  Next, the character string “10101101” subjected to the inverse operation processing in the operation bit rotation inverse operation unit 33 is transmitted to the operation bit rotation unit 10, and for example, an operation for rotating the input character string by 3 bits to the left is performed. And a character string of R (0b10101101, 3) = 0101101 is obtained (step S205).

  The character string “01101101” subjected to arithmetic processing in the arithmetic bit rotation unit 10 is transmitted to the byte replacement unit 20, and for example, a character string of S (0x01101101) = F429F992 is obtained by byte replacement processing (step S206).

  The character string “F429F992” calculated by the byte replacement unit 20 is transmitted to the bite agitation unit 30 and, for example, a character string M (0xF429F992) = 29F492F9 is obtained by the byte agitation processing (step S207). The character string thus obtained is output to the function 2. That is, output = IS (IM (R (data, −n))) is obtained by these processes.

  Therefore, in the present embodiment, in order to protect the data passed between the functions of the program, three processes of the arithmetic bit rotation process, the byte replacement process, and the byte agitation process are performed. As compared with the conventional method, the decrease in execution efficiency can be reduced and the safety can be improved. In particular, for data that requires safety, the method in the present embodiment is effective, and by applying both bit-wise stirring and bit-by-bit stirring, it is possible to achieve unprecedented high safety. it can.

  In addition, by using the conversion in the present embodiment, the value of data exchanged between functions is disturbed, and an immediate value given as an input can be concealed.

  In the present embodiment, an example in which three processing operations, that is, an arithmetic bit rotation process, a byte replacement process, and a byte agitation process are performed has been described. However, when priority is given to execution efficiency, a process in units of bytes, that is, byte replacement is performed. Only the processing and the bite stirring processing may be executed. In this case, since these operations can be realized only by operations in byte units, very high efficiency can be obtained.

  In this embodiment, the method of performing processing in the order of the operation bit rotation processing, the byte replacement processing, and the byte agitation processing is illustrated, but this is merely an example, and the three processings are performed in different procedures. May be.

  It should be noted that the hash function processing device of the present invention can be realized by recording a program describing the above processing contents on a computer-readable recording medium and executing the program recorded on the recording medium. The computer system here includes an OS and hardware such as peripheral devices.

  Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used. The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.

  The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

  The embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the embodiments, and includes designs and the like that do not depart from the gist of the present invention.

It is a block diagram of the protection apparatus of the data in the program which concerns on this embodiment. It is a block diagram of the protection apparatus of the data in the program which concerns on this embodiment. It is the figure which illustrated the difference of the process of a prior art example and this embodiment regarding the application to a program. It is a processing flow figure of the protection device of the data in a program concerning this embodiment. It is a processing flow figure of the protection device of the data in a program concerning this embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 10 ... Operation bit rotation part, 20 ... Byte replacement part, 30 ... Byte stirring part, 31 ... Byte stirring reverse operation part, 32 ... Byte replacement reverse operation part, 33 ... Calculation Bit rotation reverse operation part

Claims (8)

Byte replacement means for performing bijective replacement operation processing in bytes for an arbitrary character string of data in the program,
A byte agitation means for performing bijection agitation calculation processing in byte units for an arbitrary character string of data in the program,
A device for protecting data in a program, comprising:   2. The program bit data according to claim 1, further comprising calculation bit rotation means for performing a rotation calculation process for rotating an arbitrary character string of data in the program to the left by an arbitrary number of bits. Protective device. Byte replacement reverse operation means for performing reverse operation processing of replacement operation processing in the byte replacement means;
Bite stirring reverse calculation means for performing reverse calculation processing of stirring calculation processing in the bite stirring means,
The in-program data protection device according to claim 1, further comprising:   3. The in-program data protection device according to claim 2, further comprising an operation bit rotation reverse operation means for performing reverse operation processing of rotation operation processing in the operation bit rotation means. A step of performing bijective substitution operation processing in bytes on an arbitrary character string of data in the program;
A step of performing bijection agitation calculation processing in bytes for any character string of data in the program,
Are executed in an arbitrary order. A method for protecting data in a program. A step of performing bijective substitution operation processing in bytes on an arbitrary character string of data in the program;
A step of performing bijection agitation calculation processing in bytes for any character string of data in the program,
A step of performing rotation calculation processing for rotating an arbitrary number of bits to the left with respect to an arbitrary character string of data in the program;
Are executed in an arbitrary order. A method for protecting data in a program. A step of performing bijective substitution operation processing in bytes on an arbitrary character string of data in the program;
A step of performing bijection agitation calculation processing in bytes for any character string of data in the program,
A program that causes a computer to execute in a random order A step of performing bijective substitution operation processing in bytes on an arbitrary character string of data in the program;
A step of performing bijection agitation calculation processing in bytes for any character string of data in the program,
A step of performing rotation calculation processing for rotating an arbitrary number of bits to the left with respect to an arbitrary character string of data in the program;
A program that causes a computer to execute in a random order

Images