JP2009302869A - Encryption program, decryption program, encryption device, and encryption method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an encryption program which allows appropriate determination of the number of times of encryption, a decryption program, an encryption device, and an encryption method. <P>SOLUTION: A computer is made to function as: a data encryption means for generating encrypted data by encrypting data a plurality of times; a hash value generation means for generating a hash value of the data; and a recording means for recording the encrypted data and the hash value in a storage means by associating them with each other. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an encryption program, a decryption program, an encryption device, and an encryption method.

Conventionally, encryption technology has been used for the purpose of improving security in data transfer over a network. In this case, the data can be encrypted a plurality of times to secure stronger security. The number of times of encryption processing is preferably determined arbitrarily on the transmission side rather than being fixed. This is because the number of encryption processes can be changed each time data is transferred.
Japanese Patent Laid-Open No. 10-333568

  However, when the number of times of encryption processing is arbitrary, it is necessary to notify the data reception side of the number of times of encryption. However, if the number of times of encryption processing is transmitted together with the data, there is a problem that the meaning of performing multiple times of encryption is reduced. This is because when data is wiretapped, the number of times of encryption processing may be wiretapped.

  The present invention has been made in view of the above points, and an object thereof is to provide an encryption program, a decryption program, an encryption device, and an encryption method capable of appropriately determining the number of times of encryption. And

  Therefore, in order to solve the above problem, an encryption program includes a data encryption unit that generates encrypted data by encrypting data a plurality of times, and a hash value generation unit that generates a hash value of the data. The encrypted data and the hash value are associated with each other and recorded as a recording unit in the storage device.

  With such an encryption program, it is possible to appropriately determine the number of times of encryption.

  According to the present invention, it is possible to provide an encryption program, a decryption program, an encryption device, and an encryption method that can appropriately determine the number of times of encryption.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a diagram showing an example of a system configuration in the embodiment of the present invention. In the figure, the encryption device 10 and the decryption device 20 are connected via a network 30 (regardless of wired or wireless) such as a LAN (Local Area Network) or the Internet.

  The encryption device 10 is a computer that encrypts data (electronic data) and transmits the encrypted data (encrypted data) to the decryption device 20. The decryption device 20 is a computer that receives and decrypts encrypted data.

  FIG. 2 is a diagram illustrating a hardware configuration example of the encryption device according to the embodiment of the present invention. The encryption device 10 in FIG. 2 includes a drive device 100, an auxiliary storage device 102, a memory device 103, a CPU 104, an interface device 105, a display device 106, and an input device, which are mutually connected by a bus B. 107.

  A program for realizing processing in the encryption device 10 is provided by a recording medium 101 such as a CD-ROM. When the recording medium 101 on which the program is recorded is set in the drive device 100, the program is installed from the recording medium 101 to the auxiliary storage device 102 via the drive device 100. However, the program need not be installed from the recording medium 101 and may be downloaded from another computer via a network. The auxiliary storage device 102 stores the installed program and also stores necessary files and data.

  The memory device 103 reads the program from the auxiliary storage device 102 and stores it when there is an instruction to start the program. The CPU 104 realizes functions related to the encryption device 10 in accordance with a program stored in the memory device 103. The interface device 105 is used as an interface for connecting to a network. The display device 106 displays a GUI (Graphical User Interface) or the like by a program. The input device 107 includes a keyboard and a mouse, and is used for inputting various operation instructions.

  The decoding device 20 also has a hardware configuration as shown in FIG.

  Hereinafter, processing procedures executed by the encryption device 10 and the decryption device 20 will be described. FIG. 3 is a flowchart for explaining a processing procedure by the encryption apparatus. The process shown in FIG. 6 is a program that the program installed in the encryption apparatus 10 causes the CPU 104 to execute.

  For example, when data D (file) to be transferred is selected by the user via the input device 107 and an encryption instruction for the data D is input, the encryption device 10 uses the common key C (encryption of the common key cryptosystem). Key) is randomly generated (S101). Although the random generation method is not limited to a predetermined method, for example, the common key C may be generated using a random number. Subsequently, the encryption device 10 generates (calculates) a hash value H of the data D based on a predetermined hash function (S102). Subsequently, the encryption device 10 encrypts the data D with the common key C (S103). The encrypted data D is hereinafter referred to as “encrypted data”. Data encryption is executed a desired number of times using the same common key C (S104). That is, further encryption is repeated for the encrypted data. Note that the desired number of times may be specified by the user, or the encryption device 10 may determine it randomly.

  When the encryption for the desired number of times is completed, the encryption device 10 encrypts the common key C with the public key P (public key of the public key cryptosystem) (S105). The common key C encrypted with the public key P is hereinafter referred to as “encrypted common key”. The public key P is stored in the auxiliary storage device 102 in advance. Subsequently, the encryption device 10 generates transfer data including the encryption common key, the hash value H, the data length L of the data D before encryption, and the encryption data, and records the data in the memory device 103 (S106). ).

  FIG. 4 is a diagram illustrating a configuration example of transfer data. In the figure, the transfer data 50 includes a management unit 51 and a real data unit 52. The management unit 51 stores a hash value H, an encryption common key, a data length L, and the like. The actual data part 52 stores encrypted data. As described above, in this embodiment, the information (hash value H, encrypted common key, data length L, and encrypted data) is associated with each other by being stored in the same data (transfer data 50). Is realized. However, the association of each information may be realized by other forms. For example, the association may be realized by adding a common identifier to each information. Subsequently, the encryption device 10 transmits the generated transfer data 50 to the decryption device 20 (S107).

  Subsequently, a processing procedure by the decoding device 20 will be described. FIG. 5 is a flowchart for explaining a processing procedure by the decoding apparatus. The process in FIG. 6 is a program that the program installed in the decryption device 20 causes the CPU of the decryption device 20 to execute.

  When receiving the transfer data 50 transmitted from the encryption device 10 (S210), the decryption device 20 receives information (hash value H, encrypted common key, and data) stored in the management unit 51 of the transfer data 50. Length L) is acquired (S202). Subsequently, the decrypting device 20 obtains the common key P by decrypting the encrypted common key with the private key R (the private key of the public key cryptosystem) (S203). The secret key R is a secret key that is paired with the public key P in the encryption device 10 and is stored in advance in the auxiliary storage device of the decryption device 20.

  Subsequently, the decryption device 20 decrypts the encrypted data once with the common key P (S204), and generates a hash value Hα of the decrypted encrypted data by the same predetermined hash function as that of the encryption device 10 (S205). ). Subsequently, the decryption device 20 compares the data length Lα of the decrypted encrypted data with the data length L (S206). When the data length Lα and the data length L are the same (Yes in S206), the decryption device 20 compares the hash value Hα and the hash value H (S207). When the hash value Hα and the hash value H match (Yes in S207), the decryption device 20 determines that the data D has been decrypted, and stores the data D in the auxiliary storage device of the decryption device 20, for example.

  On the other hand, when the data length Lα and the data length L do not match (No in S206), or when the hash value Hα and the hash value H do not match (No in S207), the decoding device 20 determines that the data length and the hash value are The decryption of the encrypted data using the common key P (S204) and the generation of the hash value Hα of the decrypted data (S205) are repeated until they match.

  As described above, according to the present embodiment, even when the number of times of encryption is not notified to the decryption destination, it is possible to appropriately detect the completion of decryption of the encrypted data encrypted at the decryption destination multiple times. it can.

  The data length L is not necessarily included in the transfer data 50. In this case, the decoding device 20 may determine whether or not the decoding is complete based on the comparison between the hash value Hα and the hash value H without comparing the data length Lα and the data length L.

  Further, the data D may be encrypted based on a public key cryptosystem instead of a common key cryptosystem. In this case, the encryption device 10 does not generate the common key C, and may encrypt the data D with the public key P a desired number of times. Therefore, it is not necessary to include the common key C in the transfer data 50. The decryption device 20 may decrypt the encrypted data with the secret key R repeatedly (multiple times).

  Further, the encryption and decryption method of the present embodiment is effective not only for data transferred using a network but also for data stored in a storage device in one computer. is there. That is, when the data D is encrypted a plurality of times when stored in the storage device, the encrypted data is stored in association with the hash value H of the data D. At the time of reading (loading) from the storage device, the completion of decryption of the encrypted data may be determined based on the hash value H.

  Next, an example in which the secure transfer method for data D described above is applied to an actual business environment will be described. FIG. 6 is a diagram for explaining an example in which the present embodiment is applied to a business environment.

  In the figure, a customer environment E1 and a support environment E2 are shown. The customer environment E <b> 1 is an environment in a customer who uses a certain computer system, and includes a support information transmission device 11. The support information 11 is a computer that transmits support information to the support environment E2, and corresponds to the encryption device 10 in FIG. The support information refers to information that is a clue when analyzing the cause of a failure or the like, such as log information in a computer system. The support information may include confidential information in the customer environment E1. Therefore, it is necessary to ensure security appropriately for network transfer of support information. There may be a plurality of customer environments E1.

  On the other hand, the support environment E <b> 2 is an environment in an organization that supports the computer system used in the customer environment E <b> 1 (such as failure handling), and includes a support information receiving device 21 and a support device 22. The support information receiving device 21 is a computer that collectively receives support information transmitted from the support information transmitting device 11. The support device 10 is a computer that analyzes support information, and is installed for each person in charge in the support environment E2. The support information receiving device 21 and the support device 22 correspond to the decoding device 20 in FIG.

  Hereinafter, the processing procedure in FIG. 6 will be described. First, the support information transmitting apparatus 11 randomly generates a common key C (S301). Subsequently, the support information transmitting apparatus 11 generates a hash value H of the support information I (S303). Subsequently, the support information transmitting apparatus 11 repeatedly encrypts the support information I a desired number of times with the common key C (S303). Subsequently, the support information transmitting apparatus 11 encrypts the common key C with the public key P stored in advance, and generates an encrypted common key (S304). Subsequently, the support information transmitting apparatus 11 generates support information I transfer data 50 (S305). Here, the management unit 51 of the transfer data 50 stores a hash value H, an encryption common key, a data length L of the support information I before encryption, and the like. In addition, encrypted data is stored in the actual data portion 51 of the transfer data 50. It should be noted that the generation date of the transfer data may be included in the management unit 51 as necessary for operation. Subsequently, the support information transmitting apparatus 11 transmits the transfer data 51 to the support information receiving apparatus 21 (S306). Transmission of the transfer data 51 may be performed using electronic mail, or may be performed based on FTP (File Transfer Protocol), HTTP (HyperText Transfer Protocol), or the like.

  When the support information receiving device 21 receives the transfer data 50, the support information receiving device 21 stores the transfer data 50 in the auxiliary storage device of the support information receiving device 21. When the acquisition request (download request) for the transfer data 50 is received from the support information receiving device 21 or the support device 20 of a certain person in charge, the processing is started. First, the support information transmitting apparatus 11 obtains the encrypted common key from the transfer data 50, and decrypts the encrypted common key with the private key R stored in the support information receiving apparatus 21 in advance to obtain the common key C. Obtain (S401). Subsequently, the support information transmitting apparatus 11 encrypts the common key C with the public key Pa corresponding to the support apparatus 20 (person in charge) related to the acquisition request for the transfer data 50 (S402). Along with the encryption, the support information transmitting apparatus 11 replaces the encrypted common key in the transfer data 50 with an encrypted common key (hereinafter referred to as “per person-in-charge encrypted common key”). As a result, the common key C cannot be decrypted unless it is a legitimate person in charge. The association between the support device 20 (person in charge) and the public key Pa may be realized, for example, by storing the public key Pa in association with the identifier (IP address or the like) of the support device 20. Subsequently, the support information transmitting apparatus 11 transmits the transfer data 50 to the support apparatus 22 related to the acquisition request (S403).

  Subsequently, when receiving the transfer data 50, the support device 20 extracts the hash value H, the person-in-charge encryption common key, the data length L, and the like from the transfer data 50, and the person-in-charge encryption common key is secretly stored. The common key C is obtained by decrypting with the key Ra (S404). The secret key Ra is stored in advance in each support device 20. Subsequently, the support device 20 repeatedly performs decryption of the encrypted data using the common key C (S405) and check of completion of decryption (S406). Here, the decoding completion check is the processing described in steps S205 to S207 in FIG. Therefore, if the data length Lα after decryption matches the data length L and the hash value Hα of the decrypted data matches the hash value H, the support device 20 determines that the decryption is complete, and is decrypted. The support information I is stored (S407).

  As described with reference to FIGS. 3 and 5, the data length L may not be included in the transfer data 50 in the process of FIG. 6. Further, the encryption of the support information I may be performed by a public key cryptosystem.

  As mentioned above, although the Example of this invention was explained in full detail, this invention is not limited to such specific embodiment, In the range of the summary of this invention described in the claim, various deformation | transformation・ Change is possible.

Regarding the above description, the following items are further disclosed.
(Appendix 1)
Computer
Data encryption means for generating encrypted data by encrypting data multiple times;
Hash value generation means for generating a hash value of the data;
An encryption program for causing the encrypted data and the hash value to be associated with each other and recorded in a storage device.
(Appendix 2)
The encryption means encrypts the data with a common key,
Causing the computer to function as key encryption means for generating an encrypted common key by encrypting the common key with a public key;
The encryption program according to appendix 1, wherein the recording unit records the encrypted data, the hash value, and the encrypted common key in association with each other in the storage device.
(Appendix 3)
The encryption program according to appendix 2, which causes the computer to function as a common key generation unit that randomly generates the common key.
(Appendix 4)
Computer
Data decryption means for performing decryption processing a plurality of times on encrypted data obtained by encrypting data a plurality of times;
A hash value generating means for generating a hash value of the decrypted data decrypted for each decryption process;
A decryption program for functioning as a determination unit that determines completion of the decryption process according to a comparison between the hash value and a hash value of the data associated with the encrypted data.
(Appendix 5)
Causing the computer to function as key decryption means for decrypting an encrypted common key associated with the encrypted data with a secret key;
The decryption program according to appendix 4, wherein the data decryption means executes the decryption process on the encrypted data using the decrypted common key.
(Appendix 6)
Data encryption means for generating encrypted data by encrypting data multiple times;
Hash value generation means for generating a hash value of the data;
An encryption device comprising recording means for associating the encrypted data and the hash value with each other and recording them in a storage device.
(Appendix 7)
Data decryption means for performing decryption processing a plurality of times on encrypted data obtained by encrypting data a plurality of times;
A hash value generating means for generating a hash value of the decrypted data decrypted for each decryption process;
And a determination unit configured to determine completion of the decryption process according to a comparison between the hash value and a hash value of the data associated with the encrypted data.
(Appendix 8)
An encryption method executed by a computer,
A data encryption procedure for generating encrypted data by encrypting the data multiple times;
A hash value generation procedure for generating a hash value of the data;
An encryption method comprising: a recording procedure that records the encrypted data and the hash value in association with each other in a storage device.
(Appendix 9)
A decryption method executed by a computer,
A data decryption procedure for performing decryption processing multiple times on encrypted data obtained by encrypting data multiple times;
A hash value generation procedure for generating a hash value of the decrypted data decrypted for each decryption process;
And a determination procedure for determining completion of the decryption process according to a comparison between the hash value and the hash value of the data associated with the encrypted data.

It is a figure which shows the system configuration example in embodiment of this invention. It is a figure which shows the hardware structural example of the encryption apparatus in embodiment of this invention. It is a flowchart for demonstrating the process sequence by an encryption apparatus. It is a figure which shows the structural example of the data for transfer. It is a flowchart for demonstrating the process sequence by a decoding apparatus. It is a figure for demonstrating the example which applied this Embodiment to business environment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Encryption apparatus 11 Support information transmission apparatus 20 Decryption apparatus 21 Support information reception apparatus 22 Support apparatus 30 Client apparatus 100 Drive apparatus 101 Recording medium 102 Auxiliary storage apparatus 103 Memory apparatus 104 CPU
105 interface device 106 display device 107 input device B bus

Claims (7)

Computer
Data encryption means for generating encrypted data by encrypting data multiple times;
Hash value generation means for generating a hash value of the data;
An encryption program for causing the encrypted data and the hash value to be associated with each other and recorded in a storage device. The encryption means encrypts the data with a common key,
Causing the computer to function as key encryption means for generating an encrypted common key by encrypting the common key with a public key;
The encryption program according to claim 1, wherein the recording unit records the encrypted data, the hash value, and the encrypted common key in association with each other in the storage device.   The encryption program according to claim 2, wherein the computer is caused to function as a common key generation unit that randomly generates the common key. Computer
Data decryption means for performing decryption processing a plurality of times on encrypted data obtained by encrypting data a plurality of times;
A hash value generating means for generating a hash value of the decrypted data decrypted for each decryption process;
A decryption program for functioning as a determination unit that determines completion of the decryption process in accordance with a comparison between the hash value and a hash value of the data associated with the encrypted data. Causing the computer to function as key decryption means for decrypting an encrypted common key associated with the encrypted data with a secret key;
The decryption program according to claim 4, wherein the data decryption unit performs the decryption process on the encrypted data using the decrypted common key. Data encryption means for generating encrypted data by encrypting data multiple times;
Hash value generation means for generating a hash value of the data;
An encryption device comprising recording means for associating the encrypted data and the hash value with each other and recording them in a storage device. An encryption method executed by a computer,
A data encryption procedure for generating encrypted data by encrypting the data multiple times;
A hash value generation procedure for generating a hash value of the data;
An encryption method comprising: a recording procedure that records the encrypted data and the hash value in association with each other in a storage device.

Images