JP2010109919A - Information processing apparatus, encryption/decryption system, and encryption/decryption method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To surely change a key encrypting key for decrypting an encrypted key obtained by encrypting a key used for encrypting data. <P>SOLUTION: An information processing apparatus includes: a data encrypting module 103 for encrypting a plain text 121A using a disc key; a disc key encrypting module 102 for acquiring key encrypting keys 63A, 63B from key managing virtual machines 60A, 60B to encrypt a disc key 120A using the respective encrypting keys 63A, 63B; a key encrypting key acquisition module 104 for selecting a key management server capable of communication from a plurality of key management servers to acquire a key encrypting key from the selected key management server; a disc key decrypting module 105 for decrypting encrypted disc keys 124A, 124B using the acquired key encrypting key; and a data decrypting module 106 for decrypting an encrypted text 122 using a disc key 120B. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an information processing apparatus, an encryption / decryption system, and an encryption / decryption method.

  Conventionally, in a system for exchanging keys from a key management server and encrypting / decrypting data in a personal computer, when multiple key management servers are provided to increase system availability, key management is performed between the key management servers. A method of synchronizing data was taken.

Patent Document 1 discloses that a data key is encrypted with a plurality of unique encryption keys (for each user) to create a plurality of encrypted data keys, and a decryption key corresponding to any one of the plurality of encryption keys. Is input, the data key is decrypted from the corresponding encrypted data key and output to the data encryption / decryption unit.
JP 2008-53767 A

  By the way, in the method of synchronizing data keys between multiple key management servers, if a failure occurs, such as key data synchronization failure between key management servers, the data on the PC will be decrypted if a key data mismatch occurs. Since it was impossible, it was necessary to keep the server running at all times to ensure data synchronization.

  An object of the present invention is to perform key encryption for securely decrypting an encryption key obtained by encrypting a key used for data encryption even in an environment in which a server that manages keys cannot always communicate. An information processing apparatus, an encryption / decryption system, and an encryption / decryption method capable of exchanging keys are provided.

  An information processing apparatus according to an example of the present invention includes a second network controller for performing communication via a network, means for encrypting data using a first key, and encrypted data obtained by encrypting the data. A storage device to store; a key encryption unit that obtains a key encryption key from each of a plurality of key management servers; and encrypts the first key using each key encryption key; and the plurality of key managements Selecting a key management server capable of communicating via the network from the server, obtaining means for obtaining a key encryption key from the selected key management server, and a key encryption key obtained by the obtaining means An encryption key decrypting unit for decrypting the encrypted first key using the first key decrypted by the encryption key decrypting unit, and decrypting the encrypted data stored in the storage device using the first key decrypted by the encryption key decrypting unit Possibly , Characterized by comprising a data decoding means for calculating the data.

  An encryption / decryption system according to an example of the present invention includes a plurality of key management servers each having a first network controller for performing communication via a network and key management means for managing key encryption keys, A second network controller for performing communication via the network; means for encrypting data using a first key; a storage device for storing encrypted data obtained by encrypting the data; and a plurality of key managements A key encryption unit that obtains a key encryption key from each server and encrypts the first key using each key encryption key, and communicates through the network from among the plurality of key management servers Selecting a key management server that can perform the acquisition, acquiring a key encryption key from the selected key management server, and using the key encryption key acquired by the acquisition unit By decrypting the encrypted data stored in the storage device using the encryption key decrypting means for decrypting the encoded first key and the first key decrypted by the encryption key decrypting means, And an information processing device having data decoding means for calculating the data.

  According to the present invention, even in an environment in which a key management server cannot always communicate, key encryption for securely decrypting an encryption key obtained by encrypting a key used for data encryption It becomes possible to exchange keys.

  Embodiments of the present invention will be described below with reference to the drawings.

  FIG. 1 is a diagram showing a configuration of an encryption / decryption system according to an embodiment of the present invention. As shown in FIG. 1, a plurality of notebook personal computers 10A, 10B, 10C, 20A, and 20B are connected to an in-house LAN. Each of the computers 10A, 10B, 10C, 20A, and 20B can be driven by a battery and may be used in a state of being detached from the in-house LAN.

  In the computers 20A and 20B, a plurality of virtual machines operate simultaneously, and one of them operates as a key encryption key management server. The configuration of the computers 20A and 20B will be described with reference to FIG. FIG. 2 is a diagram illustrating a configuration of an information processing apparatus having a virtual machine that operates as a key management server.

  The computers 20A and 20B are provided with an environment for executing a virtualization technology (Virtual Monitor) provided by, for example, XEN or VMWARE.

  The computers 20A and 20B include a hardware layer 30, a virtual machine monitor (monitoring means) 40, a user virtual machine 50, a key management virtual machine (key management server) 60, and the like.

  The hardware layer 30 includes a network interface card (NIC) 31, a display, a hard disk drive (HDD), a keyboard, a mouse, and the like. The network interface card 31 is a controller for performing communication via a network.

  The virtual machine monitor 40 manages the hardware layer 30 and allocates resources to the virtual machines 50 and 60. The virtual machine monitor 40 distributes the execution schedule of the virtual machine and the I / O request from the virtual machine to the hardware layer 30.

  The user virtual machine 50 includes a user operating system (user OS) 51, a user application program (user APP) 52, and the like. The user operating system 51 is an operating system for providing an environment generally used by a user. In general, a Windows (registered trademark) operating system is used as the user operating system 51. The user application program 52 is application software that runs on the user operating system 51. For example, a word processor, a spreadsheet, presentation material creation software, a mailer, a Web browser, and the like.

  The key management virtual machine 60 includes a service operating system (service OS) 61, a key management application program (key management APP) 62, and the like. The service operating system 61 is an operating system for operating the key management application program 62. For example, Linux (registered trademark) is used as the service operating system 61. The key management application program 62 manages a key encryption key (KEK) stored in the disk space allocated to the key management virtual machine 60. Note that the operating system 51, the application 52, and the like operating in the user virtual machine 50 cannot directly access data in the disk space allocated to the key management virtual machine 60.

  Each of the computers 10A, 10B, and 10C has a disk key that is used for encryption / decryption of the data that the computer 10A, 10B, and 10C has, and the disk is encrypted by using the key encryption key managed by each of the key management virtual machines 60 of the computers 20A and 20B Encrypt the key to keep the disc key secret. When decrypting data encrypted using the disk key, a key encryption key is obtained from the key management virtual machine 60 of at least one of the computers 20A and 20B, and encryption is performed using the obtained key encryption key. The disk key is obtained by decrypting the converted disk key, and the data is decrypted using the disk key.

  Next, the configuration of the computers 10A, 10B, and 10C that encrypt and decrypt data using a disk key will be described with reference to FIG. FIG. 3 is a block diagram showing the configuration of the computers 10A, 10B, and 10C that encrypt and decrypt data using a disk key according to an embodiment of the present invention.

  As shown in FIG. 3, the computers 10A, 10B, and 10C include a disk key generation module 101, a disk key encryption module 102, a data encryption module 103, a key encryption key acquisition module 104, a disk key decryption module 105, data A decryption module 106, a hard disk drive (HDD) 110, a network interface card (NIC) 130, and the like are provided. The disk key generation module 101, the disk key encryption module 102, the data encryption module 103, the key encryption key acquisition module 104, the disk key decryption module 105, and the data decryption module 106 are respectively the computers 10A, 10B, and 10C. Is program software executed by a processor of the computer.

  The network interface card 130 is a controller for performing communication via a network. The computers 10A, 10B, and 10C communicate with devices connected to the network using the network interface card 130.

  The disk key generation module 101 generates a disk key 120A using, for example, a random number. As shown in FIG. 4, the data encryption module 103 encrypts the plaintext 121A using the disk key 120A, and stores the encrypted ciphertext 122 in the hard disk drive 110.

  The disk key encryption module 102 acquires the key encryption keys 63A and 63B from the key management application programs 62A and 62B operating in the key management virtual machines 60A and 60B, respectively. For example, the key management application programs 62A and 62B and the disk key encryption module 102 exchange key encryption keys 63A and 63B using an AKE (Authenticated Key Exchange) procedure.

  As shown in FIG. 4, the disk key encryption module 102 encrypts the disk key 120A using the key encryption key 63A, and stores the first encrypted disk key 124A obtained by encrypting the disk key 120A in the hard disk drive 110. To do. As shown in FIG. 4, the disk key encryption module 102 encrypts the disk key 120A using the key encryption key 63B, and stores the second encrypted disk key 124B obtained by encrypting the disk key 120A in the hard disk drive 110. To do. Further, the disk key encryption module 102 is a key management virtual machine 60A (computer) from which the key encryption key 63A used to generate the path of the first encryption disk key 124A and the first encryption disk key 124A is obtained. 20A), the path of the second encryption disk key 124B, and the key management virtual machine 60B (computer 20B) from which the key encryption key 63B used to generate the second encryption disk key 124B is obtained. Are written in the key identification information 123 in the hard disk drive 110. The disk key encryption module 102 encrypts the disk key 120A using the key encryption key 63A and the key encryption key 63B, and then deletes the disk key 120A.

  When the user wants to decrypt the ciphertext 122, the key encryption key acquisition module 104 selects a key management virtual machine that can communicate with the key management virtual machines 60A and 60B, and performs key encryption from the selected key management server. Get the activation key. For example, the key encryption key acquisition module 104 gives priority to the key management virtual machines 60A and 60B, and tries communication in descending order of priority. When the communication is successful, the key encryption keys 63A and 63B are acquired from any of the successful key management virtual machines 60A and 60B. The key encryption key acquisition module 104 uses the acquired key encryption key 63, which is one of the key encryption keys 63A and 63B, and the information of the key management virtual machine 60 to which the key encryption key 63 is distributed as a disk key. Pass to the decryption module 105. For example, the key management application programs 62A and 62B and the key encryption key acquisition module 104 exchange the key encryption keys 63A and 63B using the AKE procedure.

  The disk key decryption module 105 refers to the key identification information 123, thereby encrypting the disk key 124 (the first encrypted disk key 124 </ b> A) corresponding to the information of the key management virtual machine 60 to which the key encryption key 63 has been distributed. And the second encrypted disk key 124B). The disk key decryption module 105 acquires an encrypted disk key from the hard disk drive 110 based on the acquired path. As shown in FIG. 5, the disk key decryption module 105 decrypts the encrypted disk key 124 acquired using the key encryption key 63 passed from the key encryption key acquisition module 104, and calculates the disk key 120B. To do. The key encryption key acquisition module 104 passes the disk key 120B obtained by decryption to the data decryption module 106.

  As shown in FIG. 5, the data decryption module 106 decrypts the ciphertext 122 using the passed disk key 120B, and calculates the plaintext 121B.

  According to this embodiment, a single disk key used for plaintext encryption is encrypted with a plurality of different key encryption keys to generate a plurality of cipher caddy keys, which are stored in the hard disk drive of the computer itself. This is a feature. In this way, the key management virtual machine 60A and the key management virtual machine 60B can be operated independently. As a result, even if one of the key management virtual machines 60A and 60B fails, the ciphertext in the computer can be decrypted if one of them is operating. Further, it is not necessary to synchronize the key management data between the key management virtual machine 60A and the key management virtual machine 60B, and a highly reliable encryption system can be provided.

  When the key management virtual machines 60A and 60B operating as the key management server are operating on the battery-driven notebook personal computers 20A and 20B as in the present embodiment, one of the computers 20A and 20B You can leave the LAN and carry it outside the company. A situation in which the computers 20A, 20B are taken out and the computers 10A, 10B, 10C cannot communicate with any of the computers 20A, 20B tends to occur. Therefore, the configuration of the present embodiment is particularly useful in an environment where the key management virtual machines 60A and 60B that operate as the key management server are operating on the battery-driven notebook personal computers 20A and 20B.

  In the above embodiment, the number of computers on which the key management virtual machine that operates as the key management server operates is two, but may be three or more.

  Note that the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. Further, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, you may combine suitably the component covering different embodiment.

The figure which shows the structure of the encryption / decryption system concerning one Embodiment of this invention. The figure which shows the structure of the computer with which the virtual machine for key management which operate | moves as a key management server concerning one Embodiment of this invention operate | moves. 1 is a block diagram illustrating a configuration of a computer that performs encryption and decryption of data using a disk key according to an embodiment of the present invention. The figure used for description of encryption processing of a disk key concerning one embodiment of the present invention. The figure used for description of the decoding process of the disk key concerning one Embodiment of this invention.

Explanation of symbols

  10A, 10B, 10C, 20A, 20B ... notebook personal computer, 30 ... hardware layer, 31 ... network interface card, 40 ... virtual machine monitor, 50 ... user virtual machine, 51 ... user operating system, 52 ... user Application program, 60, 60A, 60B ... Virtual machine for key management, 61 ... Service operating system, 62, 62A, 62A ... Key management application program, 63, 63A, 63B ... Key encryption key, 101 ... Disk key generation module, DESCRIPTION OF SYMBOLS 102 ... Disk key encryption module, 103 ... Data encryption module, 104 ... Key encryption key acquisition module, 105 ... Disk key encryption module, 106 ... Data decryption module, 110 ... Hard disk Live, 120A ... disk key, 120B ... disk key, 121A, 121B ... plaintext, 122 ... ciphertext, 123 ... key identification information, 124,124A, 124B ... disk key, 130 ... network interface cards.

Claims (10)

A network controller for communication over the network;
Means for encrypting the data using the first key;
A storage device for storing encrypted data obtained by encrypting the data;
Key encryption means for acquiring a key encryption key from each of a plurality of key management servers and encrypting the first key using each of the key encryption keys;
An acquisition unit that selects a key management server capable of performing communication via the network from the plurality of key management servers, and acquires a key encryption key from the selected key management server;
An encryption key decryption means for decrypting the encrypted first key using the key encryption key acquired by the acquisition means;
And data decrypting means for calculating the data by decrypting the encrypted data stored in the storage device using the first key decrypted by the encryption key decrypting means. Processing equipment.   The information processing apparatus according to claim 1, further comprising means for generating the first key.   The information processing apparatus according to claim 1, wherein each of the plurality of key management servers has a different key encryption key. A plurality of key management servers each having a first network controller for performing communication via a network and a key management means for managing key encryption keys;
A second network controller for performing communication via the network; means for encrypting data using a first key; a storage device for storing encrypted data obtained by encrypting the data; and a plurality of key managements A key encryption unit that obtains a key encryption key from each server and encrypts the first key using each key encryption key, and communicates through the network from among the plurality of key management servers An acquisition unit that selects a key management server that can perform the authentication, obtains a key encryption key from the selected key management server, and the first encrypted using the key encryption key acquired by the acquisition unit An encryption key decryption unit that decrypts the key, and a data recovery unit that calculates the data by decrypting the encrypted data stored in the storage device using the first key decrypted by the encryption key decryption unit. Encryption / decryption system characterized by comprising an information processing apparatus having a means.   The encryption / decryption system according to claim 4, wherein each of the plurality of key management servers has a different key encryption key.   5. The encryption / decryption system according to claim 4, wherein the information processing apparatus further includes means for generating the first key. A plurality of software resources having the first network controller and having an operating system, a program and data operating on the operating system, and controlling each software resource to operate simultaneously on one hardware resource A plurality of other information processing devices provided with the monitoring means,
5. The encryption / decryption system according to claim 4, wherein the key management server is one of the software resources.   8. The encryption / decryption system according to claim 7, wherein the other information processing apparatus can be driven using a battery. The first key is used to encrypt the data, and the information processing device stores the encrypted data in the storage device;
Obtaining a key encryption key from each of a plurality of key management servers, encrypting the first key using each key encryption key, and storing the first key in the storage device;
When decrypting encrypted data stored in the storage device, select a key management server capable of communication from the plurality of key management servers,
Obtain a key encryption key from the selected key management server,
Decrypting the encrypted first key using the acquired key encryption key;
An encryption / decryption method, comprising: decrypting encrypted data stored in the storage device using the decrypted first key.   10. The encryption / decryption method according to claim 9, wherein each of the plurality of key management servers has a different key encryption key.

Images