JP2011250020A - Information processing apparatus, image forming apparatus, and information processing method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To ehnance parallelism of processing in encryption with a result of calculating two or more data that are consecutive in the order of data processing.SOLUTION: An information processing apparatus for encrypting data by a predetermined encryption scheme comprises: a plurality of encrypters 144 that encrypt data by the predetermined encryption scheme; a memory buffer control unit 142 that divides data to be encrypted into data pieces of a predetermined data volume, and allocates and inputs the data pieces into the encrypters 144; and an HDD buffer control unit 145 that generates encrypted data by arranging the data pieces encrypted by the encrypters 144 in the order they were arranged before being divided, and stores the number of encrypters which encrypted the data pieces in relation to the encrypted data.

Description

  The present invention relates to an information processing apparatus, an image forming apparatus, and an information processing method, and more particularly, to an encryption and decryption method when original information is divided into a plurality of pieces and the divided information is encrypted in parallel.

  In recent years, there has been a tendency to digitize information, and image processing apparatuses such as printers and facsimiles used for outputting digitized information and scanners used for digitizing documents have become indispensable devices. Such an image processing apparatus is often configured as an MFP (Multi Function Peripheral) that can be used as a printer, a facsimile, a scanner, and a copier by providing an imaging function, an image forming function, a communication function, and the like. .

  Among such image processing apparatuses, a scanner used for digitizing a document encrypts information when an image generated by scanning is stored in the apparatus or transferred to another apparatus. Also, in the information encryption process, in order to shorten the time required for the encryption process, the information to be encrypted is divided into a plurality of pieces, and the divided pieces of information are encrypted in parallel. Has been proposed (see, for example, Patent Document 1).

  At present, there are several AES (Advanced Encryption Standard) encryption methods known as typical common key encryption algorithms, and among them, CBC (Cipher Block Chaining) methods can be decrypted. Widely adopted as a difficult system. In the CBC method, the exclusive OR of the original data to be processed next and the data encrypted by the previous process is used as the input of the encryption algorithm in the arrangement order of the data to be continuously processed. . In the case of the first data in the data arrangement order, there is no data processed in the previous time, so an exclusive OR with the initialization vector is taken. Therefore, when decrypting the encrypted data, the decrypted data is decrypted using the previous decrypted data, and if the leading data is decrypted using the initialization vector.

  In the CBC method, since encryption and decryption require data to be input in the same arrangement order, data encrypted by four parallel processes cannot be decrypted by two parallel processes. For example, in a device in which a plurality of encryption / decryption devices are installed, if a part of the device fails, the encrypted data cannot be read out. The same problem occurs when data encrypted in a certain device is decrypted in a device having a different number of encryption / decryptors.

  In addition, the method according to Patent Document 1 is based on a RAID (Redundant Array of Inexpensive Disks) configuration and has low versatility, and data to be encrypted is data stored in an HDD (Hard Disk Drive). Limited to. Therefore, it cannot be used for encryption of data transferred to the outside via the network.

  In recent years, parallelization of information processing has attracted attention, such as the generalization of multi-core CPUs (Central Processing Units). However, in the CBC encryption processing, due to the above-described restrictions, research is being conducted from the viewpoint of improving parallelism in the internal processing of encryption using AES encryption, and a plurality of encryption processing using AES encryption itself are performed in parallel. It was not common to do it.

  In order to increase the parallelism in the internal processing of encryption, it is necessary to create an encryption program and encryption circuit using AES encryption, which not only requires research costs, but also ultimately performs processing. Since all data that should be processed are processed in order, the efficiency is low in terms of speedup.

  Note that such a problem is not limited to the CBC method, and may similarly be a problem in an encryption method including a process of calculating two or more continuous data in the data processing order.

  The present invention has been made to solve such a problem, and is intended to improve parallelism of processing in an encryption method using a result of calculating two or more continuous data in the data processing order. Objective.

  In order to solve the above problems, one embodiment of the present invention is an information processing device that encrypts and decrypts data by an encryption method including a process of calculating two or more pieces of continuous data in the data processing order. A plurality of encryption units for encrypting input data by the encryption method, and distribution to the plurality of encryption units as divided data to be encrypted divided into predetermined data amounts for the data to be encrypted Encrypted data for generating encrypted data by arranging the encryption target data input unit to be input and the encryption target divided data encrypted by the plurality of encryption units according to the order before the division A generation unit, an encryption unit number storage unit that stores the number of encryption units obtained by encrypting the encryption target divided data in association with the encrypted data, and the plurality of encryption units A plurality of decrypting units configured corresponding to an encoding unit, the data to be decrypted which is the encrypted data and the number of the encrypting units stored in association with the encrypted data The obtaining unit and the decryption target divided data divided for each predetermined data amount as the data to be decrypted, and the decryption that can be used for decrypting the number of the obtained encryption units and the data to be decrypted The decoding target data input unit that rearranges the decoding target divided data based on the number of copies and distributes and inputs the divided data to the plurality of decoding units, and the decoding target divided data respectively decoded by the plurality of decoding units, And a decrypted data generation unit that generates data after decryption by rearranging based on the obtained number of encryption units and the number of decryption units.

  According to another aspect of the present invention, there is provided an image forming apparatus for encrypting and decrypting data by an encryption method including a process of calculating two or more continuous data in the data processing order, wherein the input data And a plurality of encryption units for encrypting the data to be encrypted by dividing the data to be encrypted into the encryption target divided data divided for each predetermined amount of data and inputting the divided data to the plurality of encryption units A target data input unit; an encrypted data generation unit that generates encrypted data by arranging the encrypted target divided data encrypted by the plurality of encryption units according to the order before the division; and In correspondence with the plurality of encryption units, an encryption unit number storage unit that stores the number of the encryption units obtained by encrypting the encryption target divided data in association with the encrypted data, and A plurality of decrypting units formed, a data to be decrypted, the data to be decrypted, and a decryption target data obtaining unit for obtaining the number of the encrypted units stored in association with the encrypted data, and the decrypting Based on the number of encryption units obtained and the number of decryption units that can be used for decryption of the data to be decrypted, the data to be decrypted is divided for each predetermined amount of data. The decryption target data input unit that rearranges and inputs the decryption target split data to the plurality of decryption units, and the decryption target split data decrypted by the plurality of decryption units, respectively, of the acquired encryption unit. A decryption data generation unit that generates data after decryption by rearranging based on the number and the number of the decryption unit, the encryption target data input unit, the encrypted data generation unit, A plurality of information processing modules including a decryption target data input unit and the decryption data generation unit, a plurality of encryption units, the encryption target data input unit included in any of the plurality of information processing modules, An encryption data generation unit, a decryption target data input unit, and a connection switching unit connected to the decryption data generation unit, the encryption target data input unit, the encrypted data generation unit, the decryption target data input unit, and At least one of the decrypted data generation units outputs a control signal for controlling the connection state by the connection switching unit, and the plurality of encryption units based on an operation state of the image forming apparatus The number of allocations to the information processing module is determined, and the encryption target data input unit, the encrypted data generation unit, the decryption target data input unit, and the decryption It further includes an encryption unit allocation control unit for notifying at least one of the data generation units of the determined number of allocations.

  According to still another aspect of the present invention, there is provided an information processing apparatus that includes a plurality of encryption units that encrypt input data, and encryption that is divided into predetermined data amounts of data to be encrypted. An encryption target data input unit that distributes and inputs the target divided data to the plurality of encryption units, and the encryption target divided data encrypted by the plurality of encryption units according to the order before the division. An encrypted data generating unit that generates encrypted data by arranging, a plurality of decrypting units configured to correspond to the plurality of encrypting units, and data that is the encrypted data to be decrypted are defined A decryption target data input unit that distributes and inputs to the plurality of decryption units as decryption target split data divided for each data amount, the encryption target data input unit, the encrypted data generation unit, A plurality of information processing modules including a decryption target data input unit and the decryption data generation unit, a plurality of encryption units, the encryption target data input unit included in any of the plurality of information processing modules, An encryption data generation unit, a decryption target data input unit, and a connection switching unit connected to the decryption data generation unit, the encryption target data input unit, the encrypted data generation unit, the decryption target data input unit, and At least one of the decoded data generation units outputs a control signal for controlling the connection state by the connection switching unit.

  Still another aspect of the present invention provides a plurality of encryption units for encrypting data and a plurality of decryption units for decryption by an encryption method including a process of calculating two or more continuous data in the data processing order. An information processing method for performing encryption and decryption processing according to the method, wherein the data to be encrypted is distributed and input to the plurality of encryption units as divided data to be encrypted divided for each predetermined data amount, and the plurality The encryption unit encrypts the input encryption target divided data by the encryption method, and the order before the division of the encryption target divided data encrypted by the plurality of encryption units is performed. The encrypted data is generated by arranging the encrypted data, and the number of the encryption units obtained by encrypting the encryption target divided data is stored in association with the encrypted data. The data to be decrypted and the number of the encryption units stored in association with the encrypted data are obtained, and the data to be decrypted is divided into decrypted data to be decrypted for each predetermined amount of data. , Based on the number of the obtained encryption units and the number of the decryption units that can be used for decrypting the data to be decrypted, the decrypted data to be decrypted is rearranged and input to the plurality of decryption units. The plurality of decrypting units decrypts the inputted decryption target divided data by the encryption method, and the decryption target divided data respectively decrypted by the plurality of decryption units is stored in the obtained encryption unit. The data after decoding is generated by rearranging based on the number and the number of the decoding units.

  ADVANTAGE OF THE INVENTION According to this invention, the parallelism of a process can be improved in the encryption system using the result of calculating two or more continuous data in the data processing order.

1 is a block diagram schematically illustrating a hardware configuration of an image forming apparatus according to an embodiment of the present invention. 1 is a block diagram illustrating a functional configuration of an image forming apparatus according to an embodiment of the present invention. It is a block diagram which shows the function structure of the controller ASIC which concerns on embodiment of this invention. It is a block diagram which shows the function structure of the HDD controller which concerns on embodiment of this invention. It is a figure which shows the structure of the encryption device which concerns on embodiment of this invention. It is a figure which shows the aspect of the encryption and the decryption which concern on embodiment of this invention. It is a figure which shows the aspect of the encryption and the decryption which concern on embodiment of this invention. It is a figure which shows the aspect of the encryption and the decryption which concern on embodiment of this invention. It is a figure which shows the example of the code | symbol number information which concerns on embodiment of this invention. 6 is a diagram illustrating an example of a print setting screen. FIG. It is a figure which shows the aspect of the composite process which concerns on embodiment of this invention. It is a figure which shows the calculation timing of the initialization vector which concerns on embodiment of this invention. It is a block diagram which shows the function structure of the controller ASIC which concerns on other embodiment of this invention. It is a figure which shows the relationship between the operation state of the image forming apparatus which concerns on other embodiment of this invention, and the number of allocation of an encryption device.

Embodiment 1 FIG.
Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In the present embodiment, an image forming apparatus as an MFP including a function of storing image information generated by scanning in a storage medium will be described as an example.

  FIG. 1 is a block diagram illustrating a hardware configuration of an image forming apparatus 1 according to the present embodiment. The image forming apparatus 1 includes an engine for realizing a scanner, a printer, and the like in addition to the hardware configuration shown in FIG. As shown in FIG. 1, the image forming apparatus 1 according to the present embodiment includes the same configuration as that of a general server or PC. That is, the image forming apparatus 1 according to the present embodiment includes a CPU (Central Processing Unit) 10, a RAM (Random Access Memory) 20, a ROM (Read Only Memory) 30, an HDD (Hard Disk Drive) 40, and an I / F 50. 80 is connected. Further, an LCD (Liquid Crystal Display) 60 and an operation unit 70 are connected to the I / F 50.

  The CPU 10 is a calculation unit and controls the operation of the entire image forming apparatus 1. The RAM 20 is a volatile storage medium capable of reading and writing information at high speed, and is used as a work area when the CPU 10 processes information. The ROM 30 is a read-only nonvolatile storage medium and stores a program such as firmware. The HDD 40 is a non-volatile storage medium that can read and write information, and stores an OS (Operating System), various control programs, application programs, and the like.

  The I / F 50 connects and controls the bus 80 and various hardware and networks. The LCD 60 is a visual user interface for the user to check the state of the image forming apparatus 1. The operation unit 70 is a user interface for the user to input information to the image forming apparatus 1.

  In such a hardware configuration, a program stored in a storage medium such as the ROM 30, the HDD 40, or an optical disk (not shown) is read into the RAM 20, and operates according to the control of the CPU 10, thereby configuring a software control unit. A functional block that realizes the functions of the image forming apparatus 1 according to the present embodiment is configured by a combination of the software control unit configured as described above and hardware.

  Next, the functional configuration of the image forming apparatus 1 according to the present embodiment will be described with reference to FIG. FIG. 2 is a block diagram illustrating a functional configuration of the image forming apparatus 1 according to the present embodiment. As shown in FIG. 2, the image forming apparatus 1 according to the present embodiment includes a scanner 101, an engine unit 102, a plotter 103, and a controller 100 that controls them.

  The scanner 101 converts the reflected light of the irradiation light with respect to the read document into an image data signal in the RGB (Red Green Blue) format or the like by a CCD (Charge Coupled Device) or the like and outputs the image data signal. The engine unit 102 reads an image on the RAM 20 according to the control of the controller 100 and outputs the image data in accordance with the timing of the plotter 103. The plotter 103 performs image formation output on the output paper to be printed according to the output data from the engine unit 102.

  Further, the controller 100 includes a controller ASIC 110 in addition to the CPU 10, the RAM 20, and the HDD 40, as shown in FIG. 2. That is, the controller 100 includes a software control unit configured by the CPU 10 operating in accordance with a program read into the RAM 20 and a hardware control unit configured by the controller ASIC 110, and the entire image forming apparatus 1 is configured. Take control.

  Among the functions of the controller 100, the controller ASIC 110 exchanges data with the HDD 40 or other devices via the network, and performs image processing on an image input from the scanner. Further, the CPU 10 controls the controller ASIC, the engine unit 102, and the like by operating according to the control program loaded in the RAM 20 in the controller 100.

  Next, the configuration of the controller ASIC 110 will be described with reference to FIG. FIG. 3 is a block diagram showing the configuration of the controller ASIC 110. As shown in FIG. 3, the controller ASIC 110 includes a scanner I / F 111, a CPU I / F 112, an arbiter 113, an HDD controller 114, an image processing controller 115, and a network controller 116.

  The scanner I / F 111 captures image data in accordance with the input timing of the image data signal from the scanner 101 in the controller ASIC 110. The CPU I / F 102 exchanges data with the CPU 10 and the RAM 20 via the CPU 10. The arbiter arbitrates exchange of data on the RAM 20 with each module, ie, each block, included in the controller ASIC 110. In addition, the exchange between each block included in the controller ASIC 110 and the data on the RAM 20 includes an exchange by the DMA (Direct Memory Access) in addition to the exchange through the CPU 10 as described above.

  The HDD controller 114 performs writing of data to the HDD 40, control of reading of data from the HDD 40, encryption of data to be written, and decryption of the read data. The image processing controller 115 reads image data on the RAM 20, performs image processing such as filter processing and color correction, and outputs the processed image to the RAM 20. The network controller 116 controls data transmission / reception of other devices via the network.

  In this embodiment, the HDD controller 114 includes a plurality of encryptors that perform encryption by the CBC (Cipher Block Chaining) method, and one aspect of the gist is to operate the encryptors. . The HDD controller 114 according to this embodiment will be described with reference to FIG.

  As shown in FIG. 4, the HDD controller 114 according to this embodiment includes a DMAC in addition to a plurality of encryptors 144-1, 144-2,... 144-n (hereinafter collectively referred to as encryptors 144). (DMA Controller) 141, memory buffer control unit 142, memory buffer 143, HDD buffer control unit 145, HDD buffer 146, and RAID controller 147. In the present embodiment, a case where four HDDs 40 are connected and operated will be described as an example.

  The DMAC 141 directly controls the reading and writing of data from the RAM 20 without going through the CPU 10. The memory buffer 143 is a storage area that temporarily holds data read from the RAM 20 and data to be written to the RAM 20. The memory buffer control unit 142 controls data writing to the memory buffer 143 and data reading from the memory buffer 143.

  The HDD buffer 146 is a storage area for temporarily storing data read from the HDD 40 and data to be written to the HDD 40. The HDD buffer control unit 145 controls data writing to the HDD buffer 146 and data reading from the HDD buffer 146. The RAID controller 147 performs control to distribute write data to a plurality of connected HDDs 40 and control to combine data read from the HDDs 40.

  The encryptor 144 encrypts data written to the HDD 40 by the CBC method and decrypts data read from the HDD 40 by the CBC method. With reference to FIGS. 5A and 5B, the encryptor 144 according to the present embodiment will be described in detail. FIG. 5A is a diagram showing a functional mode when the encryptor 144 encrypts data to be written to the HDD 40, and FIG. 5B is a diagram illustrating how the encryptor 144 decrypts the data read from the HDD 40. It is a figure which shows the function aspect at the time of doing.

  The number of input bytes for one encryption process in the encryption algorithm according to the present embodiment is 16 bytes, and the memory buffer control unit 142 divides the data to be stored in the HDD 40 into 16 bytes and sequentially encrypts the data. Input to 144. As shown in FIG. 5A, in the encryption process by the CBC method, the exclusive OR of the input data to be processed and the encrypted data encrypted by the previous process in the above order is encrypted. It becomes the input of the conversion algorithm. still,

  Since there is no encrypted data encrypted by the previous process as described above in the top data in such data order, the initialization vector is used when encrypting the top data. Is the input of the encryption algorithm. In addition, as shown in FIG. 5B, when decrypting encrypted data, an exclusive OR with the previous decrypted data is always calculated, and the initial data is the initial value. An exclusive OR with the vector is calculated.

  Next, a data division mode when the HDD controller 114 according to the present embodiment stores data in the HDD 40 or reads data from the HDD 40 will be described. In the following description, the original data to be encrypted (hereinafter referred to as original data) is divided into 8 data “1” to “8” (hereinafter referred to as divided data). Will be described as an example. FIG. 6 is a diagram showing a data division mode in the case where four encryptors, ie, encryptors 144-1, 144-2, 144-3, and 144-4 are used.

  As shown in FIG. 6, the memory buffer control unit 142 divides the original data held in the memory buffer 143 by 16 bytes, sequentially reads out the divided data, and distributes them in the order of the encryptors 144-1 to 144-4. input. That is, the divided data is processed as the encryption target divided data, and the memory buffer control unit 142 functions as the encryption target divided data input unit. As a result, as shown in FIG. 6, “1” and “5” are stored in the encryptor 144-1, “2” and “6” are stored in the encryptor 144-2, and “2” and “6” are stored in the encryptor 144-3. Divided data of “4” and “8” are input to “3” and “7” and the encryptor 144-4, respectively.

  In the encryptors 144-1 to 144-4, when each piece of divided data is input, encryption is performed according to the CBC method, and encrypted divided data (hereinafter referred to as encrypted divided data) “1c” to “8c” is obtained. That is, the encryption device 144 functions as an encryption unit. The HDD buffer control unit 145 reads the encrypted divided data one by one from the used encryptors 144-1 to 144-4 one by one, and stores them in the HDD buffer 146 in the order of “1c” to “8c”. As a result, data integrated in the order of “1c” to “8c” (hereinafter referred to as encrypted data) is stored in the HDD 40 via the RAID controller 147. That is, the HDD buffer control unit 145 functions as an encrypted data generation unit that generates encrypted data by arranging the encrypted divided data according to the order before the division.

  When the encrypted data stored in the HDD 40 is read and decrypted, first, the HDD buffer control unit 145 reads the encrypted data to be decrypted from the HDD 40 and causes the HDD buffer 146 to hold it. Thereby, as shown in FIG. 6, the encrypted data composed of the encrypted divided data “1c” to “8c” is held in the HDD buffer 146.

  Then, the HDD buffer control unit 145 divides the encrypted data held in the HDD buffer 146 by 16 bytes and sequentially reads out the encrypted divided data of “1c” to “8c”, and encrypters 144-1 to 144-1. Input in the order of 144-4. As a result, as shown in FIG. 6, “1c” and “5c” are stored in the encryption device 144-1, “2c” and “6c” are stored in the encryption device 144-2, and “2c” is stored in the encryption device 144-3. The divided data “4c” and “8c” are input to the 3c ”and“ 7c ”and the encryptor 144-4, respectively.

  In each of the encryptors 144-1 to 144-4, when each encrypted divided data is input, decryption is performed according to the CBC method, and decrypted divided data “1” to “8” are obtained. The memory buffer control unit 142 reads the encrypted divided data one by one from the used encryptors 144-1 to 144-4 one by one, and stores them in the memory buffer 143 in the order of “1” to “8”. As a result, the data integrated in the order of “1” to “8” is read to the RAM 20.

  FIG. 7 and FIG. 8 are diagrams showing division modes when there are three ciphers and two ciphers, respectively. In the case of FIGS. 7 and 8, as in the case of FIG. 6, the memory buffer control unit 142 divides the original data held in the memory buffer 143 into the divided data “1” to “8” and sequentially reads them. The data are input to the encryptor 144 in order. Then, the encrypted divided data “1c” to “8c” encrypted by the encryptor 144 are sequentially read out by the HDD buffer control unit 145 and held in the HDD buffer 146 in the order of “1c” to “8c”. Is done. As a result, the data integrated in the order of “1c” to “8c” is stored in the HDD 40 via the RAID controller 147. The same applies to decoding.

  In the CBC method, since an exclusive OR with the preceding encrypted data is calculated, the encrypted divided data “1c” to “8c” in FIG. 6 and the encrypted divided data “1c” in FIGS. To “8c” are different from the encrypted divided data obtained by exclusive OR with the initialization vector. Therefore, as shown in FIG. 6, the encrypted data encrypted by using four encryptors 144 is the same as the above processing when two encryptors 144 as shown in FIG. 8 are used. Cannot be decrypted. In this embodiment, as described above, one of the gist is to enable decryption of encrypted data when the number of encryptors used for encryption and decryption is different.

  In order to realize the above-described gist, the HDD buffer control unit 145 according to the present embodiment, when storing the encrypted data in the HDD 40, the number of encrypted data and the number of encryptors used when encrypting the encrypted data. Is generated (hereinafter referred to as “encryptor number information”). That is, in the present embodiment, the HDD buffer control unit 145 functions as an encryption unit number storage unit that stores the number of encryption units used for data encryption in association with the encrypted data. FIG. 9 is a diagram showing an example of such information.

  As shown in FIG. 9, the number-of-encryption-unit information according to the present embodiment is “storage destination address” indicating the address of the storage area in the HDD 40 where the encrypted data is stored as information for specifying the encrypted data. And “number of encryptors” indicating the number of encryptors 144 used when the encrypted data is encrypted. In the present embodiment, the “storage destination address” information is specified as a CHS (Cylinder Head Sector) type address.

  When the encrypted data is read from the HDD 40, the HDD buffer control unit 145 recognizes the number of the encryptors 144 when the read encrypted data is encrypted by referring to the encryptor number information shown in FIG. When the number of recognized encryptors 144 is different from the number of encryptors 144 used for decryption of encrypted data, the number of encryptors 144 different from those at the time of encryption is obtained by executing the processing described below. Enables decryption. The number-of-encryption-unit information shown in FIG. 9 is managed not only by being stored in the HDD 40 but also by being stored in a storage area provided in the HDD controller 114.

  Hereinafter, the aspect of the decryption process of the encrypted data according to the present embodiment will be described with reference to FIGS. FIGS. 10A and 10B are diagrams illustrating an example in which the encrypted data encrypted by the four encryptors 144 is decrypted by the two encryptors 144.

  As shown in FIG. 10A, the HDD buffer control unit 145 reads the encrypted data to be decrypted from the HDD 40 and causes the HDD buffer 146 to hold the encrypted data. At this time, the HDD buffer control unit 145 stores the encryption number information. With reference to the figure, the number “4” of the encryptors when the encrypted data to be decrypted is encrypted is recognized. That is, the HDD buffer control unit 145 functions as a decryption target data acquisition unit. Further, the number of encryptors 144 used for decryption is recognized by referring to information indicating the number of encryptors 144 to be operated. Further, these pieces of information are transmitted to the memory buffer control unit 142. Information indicating the number of encryptors 144 to be operated is stored in, for example, a registry.

  As shown in FIG. 10 (a), the HDD buffer control unit 145 first divides the encrypted data held in the HDD buffer 146 by 16 bytes and sequentially obtains encrypted divided data of “1c” to “8c”. Read and distribute to the encryptor 144 for input. That is, the encrypted divided data is used as the decryption target split data, and the HDD buffer control unit 145 functions as the decryption target data input unit.

  Here, when the HDD buffer control unit 145 reads the encrypted divided data “1c” and inputs it to the encryptor 144-1 and reads the encrypted divided data “2c” and inputs it to the encryptor 144-2, it is normal. Next, the encrypted divided data “3c” is read out and input to the encryptor 144-1, but the HDD buffer control unit 145 determines that the recognized number of encryptors “4” and In accordance with the number of encryptors “2” used for decryption, the encrypted divided data “5c” to be input next to “1c” is skipped when the encrypted divided data “3c” and “4c” are skipped. "Is read out and input to the encryptor 144-1.

  Further, the HDD buffer control unit 145 reads the encrypted divided data “6c” to be input next to “2c” when the number of encryptors is “4”, and inputs it to the encryptor 144-1. As a result, as shown in FIG. 10A, the encrypted divided data “1c”, “2c”, “5c”, “6c” are correctly decrypted by the encryptors 144-1, 144-2, and the divided data “ 1 "," 2 "," 5 "," 6 "are obtained. That is, the encryption device 144 functions as a composite unit.

  When the divided data “1”, “2”, “5”, and “6” are obtained, the memory buffer control unit 142 transmits the number of encryption units “4” and decryption transmitted from the HDD buffer control unit 145. The divided data “1”, “2”, “5”, “6” are held in the memory buffer 143 in the arrangement order as shown in FIG.

  Next, the HDD buffer control unit 145 performs the encrypted divided data “3” skipped in FIG. 10A according to the number of encryptors “4” at the time of encryption and the number of encryptors “2” used for the decryption. “4”, “7”, and “8” are read out and input to the encryptors 144-1 and 144-2 as shown in FIG. 10B. As a result, decryption is performed by the encryptors 144-1 and 144-2, and divided data “3”, “4”, “7”, and “8” are obtained.

  When the divided data “3”, “4”, “7”, “8” are obtained, the memory buffer control unit 142 transmits the number of encryption units “4” and decryption transmitted from the HDD buffer control unit 145. The divided data “3”, “4”, “7”, “8” are held in the memory buffer 143 in the arrangement order as shown in FIG. As a result, the divided data “1”, “2”, “5”, “6” and the divided data “3”, “4”, “7”, “8” are integrated in the correct arrangement order. Original data consisting of “1” to “8” is obtained. By such processing, the composite processing according to the present embodiment is completed. That is, the memory buffer control unit 142 functions as a decoded data generation unit.

  In other words, in the example of FIGS. 10A and 10B, the HDD buffer control unit 145 determines that the number of encryptors 144 used for decryption is the same as “4”, which is the acquired number of encryptors. Then, the encrypted divided data is rearranged and input to the encryptors 144-1 and 144-2 so that the encrypted divided data is arranged in the same order as the sort order when the encrypted divided data is sequentially distributed to the respective encryptors 144. Further, when the number of encryptors 144 used for decryption is the same as the number of encryptors “4”, the memory buffer control unit 142 distributes the encrypted divided data to the respective encryptors 144 in order. The decoded divided data is rearranged so as to be the same order as the original order.

  When the plurality of encryptors 144 are operated in parallel as in the image forming apparatus 1 according to the present embodiment, parallelization of information processing can be performed with a simpler configuration than improving the parallelism of the processes inside the encryptor 144. realizable. Further, even if the parallelism of the processing inside the encryptor 144 is improved, the divided data “1” to “8” are sequentially input to the encryptor 144, so that a significant improvement in performance cannot be expected. . On the other hand, in the image forming apparatus 1 according to the present embodiment, since the divided data “1” to “8” can be processed in parallel, a significant improvement in performance can be obtained with a simple configuration. Is possible.

  In this way, by operating a plurality of encryptors 144 in parallel, when the number of encryptors / decryptors is different at the time of encryption and at the time of decryption, the encrypted divided data at the time of decrypting the encrypted data is changed. The arrangement order is different, and there is a problem that data is not correctly decoded in the CBC method. On the other hand, in the image forming apparatus 1 according to the present embodiment, when the encrypted data and the number of the encryptors 144 used at the time of encryption are managed, the encrypted data is decrypted when the encrypted data is decrypted. The order of the encrypted divided data input to the encryptor 144 is rearranged on the basis of the relationship between the number of encryptors 144 used for encryption and the number of encryptors 144 used for decryption. This makes it possible to correctly decrypt the encrypted data even when the number of encryption / decryption devices used for encryption and decryption is different.

  As described above, according to the encryption processing method in the image forming apparatus 1 according to the present embodiment, when encryption is performed using the result of calculating two or more continuous data in the data processing order. It becomes possible to increase the parallelism of processing.

  As described with reference to FIG. 5, in the CBC system encryption, the exclusive OR of the data to be processed next and the previous encryption data is used as an input to the encryption algorithm. Logical OR. Even when the encrypted data is decrypted, the exclusive OR with the decrypted data one time before is always taken.

  Here, data reading from the HDD is performed for each sector, which is a reading unit, and data reading is not necessarily performed from the head sector of the data, so data stored across multiple sectors is stored. When the exclusive OR with only the initial data is calculated in the first data, the data cannot be decoded even if read from any sector of the HDD.

  In order to allow the encrypted data written in the HDD to be read from any sector and decrypted, it is preferable to perform encryption after calculating the exclusive OR with the initialization vector for the divided data at the head of each sector. . For example, when the storage capacity of one sector is 512 bytes, every time the total amount of data written to the HDD is a multiple of 512 bytes, the encryptor 144 sets the initialization vector for the divided data to be encrypted next. Encrypt after calculating exclusive OR. As a result, the encrypted divided data stored at the head of all the sectors becomes data encrypted by performing an exclusive OR operation with the initialization vector, and can be read from any sector.

  Here, the total amount of data stored in the HDD and the total amount of data input to the encryptor 144 are mirrored and striped according to the number of encryptors used for encryption and the RAID level controlled by the RAID controller 147. Etc., depending on the RAI level. The example will be described with reference to FIGS. 11 (a) and 11 (b). In FIGS. 11A and 11B, the case where the storage capacity of one sector is 512 bytes is taken as an example.

  FIG. 11A shows the number of HDDs 40 and the RAID level and the amount of data in which each encryptor 144 uses an initialization vector for the exclusive OR operation when two encryptors 144 are used when storing data in the HDD 40. It is a table which shows the relationship with the space | interval of. In the following description, the use of the initialization vector for the exclusive OR operation by the encryptor 144 is expressed as “initialization”.

  For example, when mirroring is performed with one HDD 40 or with two or four HDDs 40, all the encrypted data held in the HDD buffer 146 is stored in the same HDD 40 without being divided, and mirroring is performed. In this case, the same encrypted data is stored in each HDD 40. Therefore, each encryptor 144 performs initialization each time the total of the divided encrypted data output from the two encryptors 144 is a multiple of 512 bytes, that is, whenever 256 bytes of data are encrypted.

  When performing striping with two HDDs, the encrypted data held in the HDD buffer 146 is divided into two and stored in the two HDDs 40, respectively. Accordingly, each encryptor 144 performs initialization every time the total of the divided encrypted data output from the two encryptors 144 is a multiple of 1024 bytes, that is, every time 512 bytes of data are encrypted. That is, when data is divided and stored in the HDD 40 as in the case of striping, each of the encryptors 144 has the total amount of data encrypted by the encryptor 144 used for encryption as a read unit of the HDD 40. Initialization is performed every time the sector size is a multiple of the value obtained by dividing the sector size by the number of data divisions in the HDD 40.

  On the other hand, FIG. 11B shows the number of HDDs 40 and the RAID level in the case where four encryptors 144 are used when data is stored in the HDD 40, and each encryptor 144 uses an initialization vector for the exclusive OR operation. It is a table which shows the relationship with the space | interval of data amount. As shown in FIG. 11B, when one HDD 40 is used, or when mirroring is performed using two or four HDDs 40, each encryption unit 144 outputs divided encrypted data output from the four encryption units 144. Is initialized every time when the total of is a multiple of 512 bytes, that is, every 128 bytes of data is encrypted.

  When performing striping with two HDDs, each encryptor 144 encrypts 256 bytes of data every time the total of the divided encrypted data output from the four encryptors 144 is a multiple of 1024 bytes. Initialize every time.

  Further, in the above embodiment, the case where the encryptor 144 is included as a part of the HDD controller 114 and the data stored in the HDD 40 is encrypted or decrypted has been described as an example. The present invention is not limited to this, and includes the above-described encryptor 144, memory buffer control unit 142, and HDD buffer control unit 145 as a part of the network controller 116, and encrypts data to be output to the outside via the network or via the network. The present invention can also be applied to a case where externally input data is decoded.

  Furthermore, it is possible to configure the function including the plurality of encryptors 144 described above as one module included in the controller ASIC, not as a part of the HDD controller 114 and the network controller 116.

  In the above embodiment, the case has been described in which the number of encryptors 144 used when encrypted data is encrypted is managed by using the number of encryptors information shown in FIG. However, the gist of the present embodiment is not limited to this, and can be achieved if the number of the encryptors 144 used when the encrypted data is encrypted is found when the encrypted data is decrypted. It is not necessary to manage by the table as data different from the encrypted data by using the number-of-encryption-unit information as shown in FIG.

  For example, when the HDD buffer control unit 145 stores the encrypted data in the HDD 40, the encryption number information is added to the encrypted data and stored, for example, as a mode other than the case of using the above-described number of encrypted units information. Conceivable. In this case, the HDD buffer control unit 145 reads the encrypted data to be decrypted, holds it in the HDD buffer 146, and refers to the information on the number of encryptors added to the encrypted data, thereby performing the same processing as described above. Can be executed.

Embodiment 2. FIG.
In the present embodiment, as described above, an encryption module including a plurality of encryptors 144 is configured as one module included in the controller ASIC, not as a part of the HDD controller 114 and the network controller 116, and the HDD controller. A case where a plurality of information processing modules share an encryption module, such as 114 and network controller 116, will be described. In addition, about the structure which attaches | subjects the same code | symbol as Embodiment 1, the same or an equivalent part is shown and detailed description is abbreviate | omitted.

  FIG. 12 is a block diagram showing the functional configuration of the arbiter 113, HDD controller 114, network controller 116, and encryption module 117 in the controller ASIC 110 according to the present embodiment. As shown in FIG. 12, the HDD controller 114 according to the present embodiment includes a configuration other than the plurality of encryptors 144 in the configuration in the first embodiment.

  The network controller 116 according to the present embodiment includes a DMA controller 161, a memory buffer control unit 162, a memory buffer 163, an NW (NetWork) buffer control unit 165, an NW buffer 166, and a network I / F 167. The DMA controller 161, the memory buffer control unit 162, and the memory buffer 163 have the same functions as the DMA controller 141, the memory buffer control unit 142, and the memory buffer 143 included in the HDD controller 114, respectively.

  The NW buffer control unit 165, the NW buffer 166, and the network I / F 167 correspond to the HDD buffer control unit 145, the HDD buffer 146, and the RAID controller 147 of the HDD controller 114, and the HDD controller 114 transmits and receives data to and from the HDD 40. As realized, data transmission / reception via the network is realized.

  The encryption module 117 includes a plurality of encryptors 144 and selectors S11, S12, S21, S22,... Sn1, Sn2 (hereinafter collectively referred to as selector S) connected to the input / output sides of the plurality of encryptors. Including. The plurality of encryptors 144 are connected to the HDD controller 114 and the network controller 116 via the selector S. For example, the encryptor 144-1 is connected to the memory buffer control unit 142 of the HDD controller 114 and the memory buffer control unit 162 of the network controller 116 via the selector S11, and is connected to the HDD of the HDD controller 114 via the selector S12. It is connected to the buffer control unit 145 and the NW buffer control unit 165 of the network controller 116.

  Each selector S sets the encryptor 144 on the HDD controller 114 side or the network controller 116 side in accordance with control signals output from the memory buffer control unit 142, HDD buffer control unit 145, memory buffer control unit 162, and NW buffer control unit 165. It is the connection switching part connected to either. For example, when the encryptor 144-1 is used by the HDD controller 114, the memory buffer control unit 142 outputs a control signal to the selector S11, and the encryptor 144-1 and the memory buffer control unit 142 are connected. Thus, the connection state of the selector S11 is switched. Further, the HDD buffer control unit 145 outputs a control signal to the selector S12, and switches the connection state of the selector S12 so that the encryptor 144-1 and the HDD buffer control unit 145 are connected. As a result, the encryptor 144-1 is used by the HDD controller 114.

  The encryption / decryption process using the encryptor 144 after the connection state is switched by the selector S is the same as that described in the first embodiment. Further, the memory buffer control unit 162 and the NW buffer control unit 165 operate in the same manner as the memory buffer control unit 142 and the HDD buffer control unit 145, thereby encrypting data to be output via the network, or via the network. The received data is decrypted.

  The memory buffer control unit 142, HDD buffer control unit 145, memory buffer control unit 162, and NW buffer control unit 165 output a control signal for controlling the selector S in accordance with the control by the CPU 10. The image forming apparatus 1 is installed with an application program (hereinafter referred to as an encryption number determination program) for controlling how the plurality of encryptors 144 are distributed to the HDD controller 114 and the network controller 116. The CPU 10 controls the memory buffer control unit 142, the HDD buffer control unit 145, the memory buffer control unit 162, and the NW buffer control unit 165 in accordance with the encryption device determination program read into the RAM 20. That is, the CPU 10 performs an operation according to the encryption number determination program, thereby functioning as an encryption unit assignment control unit.

  In the encryption number determination program according to the present embodiment, it is determined how to distribute the plurality of encryption devices 144 to the HDD controller 114 and the network controller 116 in accordance with the operation state of the image forming apparatus 1. FIG. 13 is a table showing the relationship between the operating state of the image forming apparatus 1 and the distribution of the number of encryptors. In the example of FIG. 13, the total number of the encryptors 144 is four.

  As shown in FIG. 13, in the case of a copying operation for copying a document or a scan (storage) in which a generated image is stored in the HDD 40, the network controller 116 does not transmit / receive information via the network. All the devices 144 are used by the HDD controller 114. In the printout operation, since the exchange of information via the network and the exchange of information with the HDD 40 are almost the same, the same number of encryptors 144 are distributed to the HDD controller 114 and the network controller 116.

  Further, in the case of scanning (distribution) in which a generated image is distributed via a network, since there is more information exchange via the network than information exchange with the HDD, one network controller 116 is provided for each HDD controller 114. The three ciphers 144 are distributed to each other.

  The CPU 10 determines the allocation number of the encryptor 144 according to the rule as shown in FIG. Notify As a result, the memory buffer control unit 142, the HDD buffer control unit 145, the memory buffer control unit 162, and the NW buffer control unit 165 output a switching signal for switching the selector S as described above.

  Thus, according to the encryption module 117 included in the image forming apparatus 1 according to the present embodiment, sharing of the encryption module by a plurality of modules can be realized with a simple configuration.

  In the above embodiment, the case where the memory buffer control unit 142, the HDD buffer control unit 145, the memory buffer control unit 162, and the NW buffer control unit 165 each output a switching signal has been described as an example. However, at least one of these may switch the connection states of all the selectors S.

1 image forming apparatus,
10 CPU,
20 RAM,
30 ROM,
40 HDD,
50 I / F,
60 LCD,
70 operation unit,
80 bus,
100 controller,
101 scanner,
102 engine unit,
103 plotters,
111 Scanner I / F,
112 CPU I / F
113 Arbiter,
114 HDD controller,
115 image processing controller,
116 network controller,
141 DMA controller,
142 memory buffer controller,
143 memory buffer,
144 encryptor,
145 HDD buffer control unit,
146 HDD buffer,
147 RAID controller,
161 DMA controller,
162 memory buffer controller,
163 memory buffer,
165 NW buffer control unit,
166 NW buffer,
167 Network I / F

JP 2007-215028 A

Claims (8)

An information processing apparatus for encrypting and decrypting data by an encryption method including a process of calculating two or more continuous data in a data processing order,
A plurality of encryption units for encrypting input data by the encryption method;
An encryption target data input unit that distributes and inputs data to be encrypted to the plurality of encryption units as the encryption target divided data divided for each predetermined data amount;
An encrypted data generation unit that generates encrypted data by arranging the encryption target divided data encrypted by the plurality of encryption units according to the order before the division;
A number-of-encryption-unit storage unit that stores the number of the encryption units obtained by encrypting the respective encryption target divided data in association with the encrypted data;
A plurality of decryption units configured to correspond to the plurality of encryption units;
A decryption target data acquisition unit that acquires the data to be decrypted as the encrypted data and the number of the encryption units stored in association with the encrypted data;
The data to be decrypted is divided data to be decrypted divided for a predetermined amount of data, and the number of the obtained encryption units and the number of the decryption units that can be used for decrypting the data to be decrypted A decoding target data input unit that rearranges the decoding target divided data and distributes and inputs the divided data to the plurality of decoding units;
A decrypted data generating unit that generates decrypted data by rearranging the decrypted data to be decrypted by the plurality of decrypting units based on the number of the obtained encrypting units and the number of the decrypting units. An information processing apparatus comprising:   The decryption target data input unit is configured to distribute the decryption target divided data to the decryption units when decrypting the data to be decrypted by the same number of decryption units as the number of the obtained encryption units. 2. The information processing apparatus according to claim 1, wherein the decoding target divided data is rearranged according to the number of the composite units so as to be arranged in the order of the target divided data, and is distributed and input to the plurality of decoding units. . The encryption unit
The first data in the processing order of the data is calculated as an initialization vector,
Each time the total amount of data encrypted by the plurality of encryption units reaches a multiple of the read unit of the storage medium in which the generated encrypted data is stored, the next processing is performed in the processing order of the data The information processing apparatus according to claim 1, wherein the data is calculated as an initialization vector. A storage medium control for controlling a storage medium in which the generated encrypted data is stored;
When the storage medium control unit divides and stores the encrypted data into the plurality of storage media, the encryption unit stores the total amount of data encrypted by the plurality of encryption units as the storage medium. 4. The data to be processed next in the processing order of the data is calculated as an initialization vector every time the read unit is divided by the division number of the encrypted data. Information processing device. A plurality of information processing modules including the encryption target data input unit, the encrypted data generation unit, the decryption target data input unit, and the decryption data generation unit;
A plurality of the encryption units are connected to the encryption target data input unit, the encrypted data generation unit, the decryption target data input unit, and the decryption data generation unit included in any of the plurality of information processing modules A connection switching unit;
At least one of the encryption target data input unit, the encrypted data generation unit, the decryption target data input unit, and the decryption data generation unit has a control signal for controlling the connection state by the connection switching unit. The information processing apparatus according to claim 1, wherein the information processing apparatus outputs the information processing apparatus. An image forming apparatus that encrypts and decrypts data by an encryption method including a process of calculating two or more continuous data in a data processing order,
A plurality of encryption units for encrypting input data by the encryption method;
An encryption target data input unit that distributes and inputs data to be encrypted to the plurality of encryption units as the encryption target divided data divided for each predetermined data amount;
An encrypted data generation unit that generates encrypted data by arranging the encryption target divided data encrypted by the plurality of encryption units according to the order before the division;
A number-of-encryption-unit storage unit that stores the number of the encryption units obtained by encrypting the respective encryption target divided data in association with the encrypted data;
A plurality of decryption units configured to correspond to the plurality of encryption units;
A decryption target data acquisition unit that acquires the data to be decrypted as the encrypted data and the number of the encryption units stored in association with the encrypted data;
The data to be decrypted is divided data to be decrypted divided for a predetermined amount of data, and the number of the obtained encryption units and the number of the decryption units that can be used for decrypting the data to be decrypted A decoding target data input unit that rearranges the decoding target divided data and distributes and inputs the divided data to the plurality of decoding units;
A decrypted data generating unit that generates decrypted data by rearranging the decrypted data to be decrypted by the plurality of decrypting units based on the number of the obtained encrypting units and the number of the decrypting units. When,
A plurality of information processing modules including the encryption target data input unit, the encrypted data generation unit, the decryption target data input unit, and the decryption data generation unit;
A plurality of the encryption units are connected to the encryption target data input unit, the encrypted data generation unit, the decryption target data input unit, and the decryption data generation unit included in any of the plurality of information processing modules Including a connection switching unit,
At least one of the encryption target data input unit, the encrypted data generation unit, the decryption target data input unit, and the decryption data generation unit has a control signal for controlling the connection state by the connection switching unit. Output,
The number of the plurality of encryption units assigned to the plurality of information processing modules is determined based on the operation state of the image forming apparatus, and the encryption target data input unit, the encrypted data generation unit, and the decryption target data An image forming apparatus, further comprising: an encryption unit allocation control unit that notifies at least one of the input unit and the decrypted data generation unit of the determined number of allocations. A plurality of encryption units for encrypting input data;
An encryption target data input unit that distributes and inputs data to be encrypted to the plurality of encryption units as the encryption target divided data divided for each predetermined data amount;
An encrypted data generation unit that generates encrypted data by arranging the encryption target divided data encrypted by the plurality of encryption units according to the order before the division;
A plurality of decryption units configured to correspond to the plurality of encryption units;
A decryption target data input unit that distributes and inputs to the plurality of decryption units as decryption target split data that is the encrypted data and is to be decrypted for each predetermined data amount;
A plurality of information processing modules including the encryption target data input unit, the encrypted data generation unit, the decryption target data input unit, and the decryption data generation unit;
A plurality of the encryption units are connected to the encryption target data input unit, the encrypted data generation unit, the decryption target data input unit, and the decryption data generation unit included in any of the plurality of information processing modules Including a connection switching unit,
At least one of the encryption target data input unit, the encrypted data generation unit, the decryption target data input unit, and the decryption data generation unit has a control signal for controlling the connection state by the connection switching unit. An information processing apparatus that outputs the information. Information processing method for performing encryption and decryption processing by a plurality of encryption units for encrypting data and a plurality of decryption units for decrypting the data by an encryption method including processing for calculating two or more continuous data in the data processing order Because
The data to be encrypted is distributed and input to the plurality of encryption units as divided data to be encrypted divided for each predetermined amount of data,
The plurality of encryption units encrypts the input divided data to be encrypted by the encryption method,
Generating encrypted data by arranging the encryption target divided data encrypted by the plurality of encryption units according to the order before the division;
Storing the number of the encryption units that respectively encrypted the encryption target divided data in association with the encrypted data;
Obtaining the number of the encrypted data stored in association with the data to be decrypted and the encrypted data,
The data to be decrypted is divided data to be decrypted divided for a predetermined amount of data, and the number of the obtained encryption units and the number of the decryption units that can be used for decrypting the data to be decrypted Reordering the divided data to be decoded based on the input to the plurality of decoding units,
The plurality of decrypting units decrypts the inputted decryption target divided data by the encryption method,
Generating the decrypted data by rearranging the decrypted data to be decrypted respectively decrypted by the plurality of decrypting units based on the number of the obtained encrypting units and the number of the decrypting units. Information processing method.

Images