JP4447084B2 - Cryptographic communication method and apparatus - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an encryption communication method and apparatus for concealing communication data in network communication.
[0002]
[Prior art]
Today, data communication is widely performed on open computer networks such as the Internet. In such a network environment, there is a data communication format in which a data receiver selects a specific one from a plurality of options included in data from a sender and answers the sender. For example, in a member-based driving school or an English conversation class, there is an example in which a member looks at a schedule table transmitted from an organizer, selects a specific time from the schedule, and makes a time reservation. When data communication is performed on such a public network, it is necessary to ensure the security of the data to be communicated. As a method for ensuring the confidentiality of data on this network, a data encryption technique is widely used. Encryption is performed by, for example, generating a random number bit string that serves as an encryption key, and performing an exclusive OR operation on the bit string of the random number bit string and the data to be encrypted (plaintext data) for each bit. Done. In a communication system that does not have an encryption function on the receiver (client) side, this encryption is performed on the sender (server side).
[0003]
For example, a driving training reservation system using the Internet will be described as an example. The school side server encrypts plaintext data and transmits it in response to a request from a member side client. The plaintext data to be encrypted is data corresponding to a reservationable date and time, a learning content, or the like that is alternatively selected by a member. At the time of encrypting such plaintext data, the server side cannot know in advance which plaintext data among a plurality of plaintext data is the data selected by the member. Encrypted with a key. That is, one random number bit string is generated, the exclusive OR of the random number bit string and each plaintext data is calculated, and the calculation result is transmitted to the client as encrypted data. Then, when the member wants to make a reservation, the encrypted data corresponding to the selected content is returned to the server, and this encrypted data is exclusive ORed with the random number bit string used for the previous encryption. Is decrypted by Then, the reservation data is updated based on the decrypted plaintext data, and the reservation is established.
[0004]
[Problems to be solved by the invention]
In such conventional encryption communication, since a plurality of plaintext data is simply encrypted with the same encryption key, a plurality of encryption data encrypted with the same encryption key may be intercepted illegally. When such a plurality of pieces of encrypted data are obtained, the original plaintext data can be easily inferred by calculating an exclusive OR of the plurality of pieces of encrypted data. In addition, plaintext data can be easily inferred from the number of transmitted encrypted data. Therefore, the conventional encryption communication that encrypts a plurality of plaintext data with the same encryption key has a problem that the encryption strength is lowered.
[0005]
An object of the present invention is to provide an encryption communication method and apparatus that does not reduce encryption strength when a plurality of data arbitrarily selected on the receiver side is encrypted on the sender side.
[0006]
[Means for Solving the Problems]
In order to achieve the above object, according to the encryption communication method of the present invention, the server side device prepares a plurality of information sets that are alternatively selected, and the plurality of information is obtained by a different encryption method for each set. And the server side device prepares display information including options corresponding to each information so that the client side device can select specific information from the above sets. A procedure for associating the plurality of encrypted information with each option of information, a procedure for the server side device to transmit the plurality of encrypted information together with the display information to the client side device , and the client side apparatus, a step of displaying the alternatives for selecting the particular information to the recipient based on said received display information, which is selected by operating the recipient of the client device The encrypted information associated with the択肢, decoding the client device and transmitting toward the server apparatus, the server-side apparatus receives the encrypted information, corresponding to the encryption method of each pair belongs And a procedure for decoding by each method.
[0008]
In this case, the encryption method and the decryption method may be based on a stream encryption method that performs an exclusive OR operation on a bit string of information and a random number bit string for each bit.
[0009]
In the encryption communication device of the present invention, a plurality of information sets that are alternatively selected are prepared in the server side device, and the plurality of information is encrypted by a different encryption method for each set. In order for the client side device to select specific information from each of the above-mentioned sets, display information including options corresponding to each of the information is prepared , and the encryption is included in each option of the display information Display information generating means for associating a plurality of pieces of information, and transmission means for transmitting the plurality of pieces of encrypted information together with the display information to the client side apparatus . display means for displaying the options for selecting a specific information to the recipient based on said received display information, related to the option selected by operating the recipient of the client device Cipher vignetting the above encrypted information, said client-side device and a transmitting means for transmitting to said server-side apparatus, the server-side apparatus, a receiving means for receiving the encrypted information, the received Decryption means for decrypting the encrypted information by a decryption method corresponding to the encryption method to which each set belongs.
[0011]
In this case, the encryption method and the decryption method may be based on a stream encryption method that performs an exclusive OR operation on a bit string of information and a random number bit string for each bit.
[0012]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, the present invention will be described in detail based on the illustrated embodiment. In the following, a reservation system for driving lessons using the Internet will be described as an example. However, the present invention can be used for data communication of any content through any type of communication network. In addition, the encryption method used for realizing the present invention may be any method in which at least the data sender holds an encryption key that is kept secret by a third party. For example, a secret whose encryption key is not disclosed to a third party. In the key encryption, any of a stream cipher that performs encryption in bit units of information and a block cipher that performs encryption for each block composed of a plurality of bits such as a DES cipher and a FEAL cipher may be employed.
[0013]
FIG. 1 is a block diagram showing the overall configuration of the cryptographic communication system in the present embodiment, FIG. 2 is a sequence chart showing the communication procedure in the system of FIG. 1, and FIG. 3 shows the flow of each data in the encryption processing on the server side FIG. 4 and FIG. 4 are diagrams showing the flow of each data in the decryption process on the server side. In the present embodiment, when a plurality of data on the server side is encrypted, the encryption is performed by a different encryption method for each data set.
[0014]
In FIG. 1, a server 1 serving as an encryption communication device disposed on a school (sender) side and a client 10 provided on a member (receiver) side are communicably connected via the Internet 20. The server 1 includes a storage unit 2 that stores plaintext data, reservation data, and an encryption key, an encryption key generation unit 3 that generates an encryption key used to encrypt plaintext data, and plaintext data encryption that encrypts plaintext data. 4, a page data description unit 5 that describes page data, a transmission / reception unit 6 that transmits and receives various data, and a plaintext data decryption unit 7 that decrypts encrypted plaintext data. The client 10 includes a transmission / reception unit 11 that transmits and receives various data, and a display unit 12 that displays page data. The server 1 and the client 10 can be configured by a general-purpose or dedicated computer, and each of the above-described constituent elements realized therein can be configured by a CPU and a program operating on the CPU. it can.
[0015]
Next, a procedure when the client 10 makes a reservation for driving lessons in such a system will be described with reference to FIG. 2 together with FIG. First, the client 10 opens the initial screen of the reservation system on the browser displayed on the display unit 12, and inputs a pre-assigned ID to log in (step S1). The server 1 that has received this ID approves the log-in if the ID is valid (step S2), and encrypts data to be transmitted to the client 10 (steps S4 to S6).
[0016]
The data to be encrypted here is data associated with the description of the learning reservation page displayed on the client side, and is a plurality of data corresponding to the reservation possible date and time, the learning content, etc. selected by the member. . Hereinafter, the data before encryption is referred to as plain text data. The plurality of plaintext data includes a plurality of data sets that are alternatively selected by the member. For example, a plurality of study time zones (this is a description corresponding to the data in each group) are set for each day from Sunday to Saturday (which corresponds to each group), and 1 is alternatively set for each day. When selecting one learning time zone, plaintext data corresponding to each learning time zone is grouped for each day of the week and stored in the storage unit 2 while maintaining the state of the data structure. In FIG. 3, six sets of plaintext data are combined such as “r ₀₁ ”, “r ₁₁ , r ₁₂ ”, “r ₂₁ ”, “r ₃₁ , r ₃₂ ” to form four sets. . In this way, the plaintext data constituting each group can include plaintext data of “no selection” as needed, with the plaintext data being alternatively selected by each member.
[0017]
In order to encrypt the plaintext data configured as described above, prior to this, the encryption key generation unit 3 generates a different random number bit string for each set (step S3). In the present embodiment, a stream encryption method using a random number bit string is employed for encryption. The plurality of types of random number bit strings are generated by setting different encryption keys as initial values of the feedback shift register. In FIG. 3, different random number bit strings “x ₀ ”, “x ₁ ”, “x ₂ ”, and “x ₃ ” are assigned to each set. However, when implementing the present invention, data encryption can be performed using an encryption method other than the stream encryption method. In the plaintext data encryption unit 4, the plaintext data stored in the storage unit 2 is encrypted using the random number bit string generated by the encryption key generation unit 3, and the encrypted plaintext data ( (Encrypted data) is created (step S4). In the stream cipher used here, the bit string of each set of plaintext data and the random number bit string assigned to each set are subjected to an exclusive OR operation in bit units. Here, a plurality of plaintext data in the same set is encrypted using a random number bit string assigned to the set (see encrypted data in FIG. 3). A plurality of random number bit strings used for the encryption are stored in the storage unit 2.
[0018]
Next, a page for reservation to be displayed on the client is described in the page data description section 5 (step S5). The page data includes a description or a mechanism corresponding to each encrypted data. The description or mechanism allows the member to select one of a plurality of training hours for each day. It will be apparent to those skilled in the art that such a description or mechanism can be realized by a program module such as a pull-down menu, a radio button or the like and a code according to HTML (Hyper Text Markup Language) description. The data of this page is transmitted to the client 10 via the Internet 20 via the transmission / reception unit 7 together with the encryption data (step S6).
[0019]
On the client 10 side, when page data is received via the transmission / reception unit 11 (step S7), this page data is displayed on the display unit 12 as a page for teaching reservation (step S8). Then, the member selects the date and time etc. he / she wishes to reserve by looking at the displayed learning reservation page (step S9). As described above, this selection is performed so that one data is always selected for each set. When this selection is performed, encrypted data corresponding to the selected data is transmitted to the server 1 via the transmission / reception unit 11 (step S10). FIG. 4 shows a state in which one encrypted data is returned for each set out of the previous six encrypted data.
[0020]
In the server 1, when the encrypted data is received by the transmission / reception unit 6 (step S11),
The encrypted data is decrypted using the encryption key stored in the storage unit 2 (step S12). That is, a plurality of random number bit strings that are encryption keys are called from the storage unit 2, and an exclusive OR of the plurality of random number bit strings and the returned encrypted data is taken. Here, since one plaintext data is always selected and returned by the member for each set, the number of returned encrypted data corresponds to the random number bit string at the time of encryption, and decryption can be performed without excess or deficiency. It can be carried out. FIG. 4 conceptually shows the state in which plaintext data is decrypted by performing an exclusive OR operation between the four encrypted data and the corresponding random number bit string used for the encryption. ing. Then, the reservation data in the storage unit 2 is updated based on the plain text data (step S13), and the reservation is established.
[0021]
According to such encrypted communication, since each set of information is encrypted by a different method, it is difficult to estimate plaintext data even if the encrypted data is intercepted. In addition, since the number of encrypted data returned from the receiver is constant, it is difficult for the eavesdropper to guess the content from this number of data.
[0022]
The embodiment of the present invention has been described with reference to the drawings. However, the present invention is not limited to the matters shown in the above-described embodiments, and it is obvious that changes, improvements, etc. can be made based on the description of the scope of claims. Encryption may be performed by a different encryption method for each group, and an encryption method other than the stream encryption method using different random number bit strings as described above may be employed.
[0023]
【The invention's effect】
As described above, according to the present invention, since a plurality of encrypted data to be transmitted and received are encrypted by different encryption methods, it is difficult to estimate plaintext data and the encryption strength is not reduced. In addition, since the number of data returned from the receiver is constant, it is difficult to guess the plaintext data from the number.
[Brief description of the drawings]
FIG. 1 is a block diagram showing an overall configuration of a cryptographic communication system according to an embodiment of the present invention.
FIG. 2 is a sequence chart showing a communication procedure in the system of FIG.
FIG. 3 is a conceptual diagram showing the flow of each data in encryption processing on the server side.
FIG. 4 is a conceptual diagram showing the flow of each data in a decryption process on the server side.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 Server 2 Memory | storage part 3 Encryption key generation part 4 Plaintext data encryption part 5 Page data description part 6, 11 Transmission / reception part 7 Plaintext data decryption part 10 Client 12 Display part 20 Internet

Claims (4)

A procedure in which the server side apparatus prepares a plurality of information sets that are alternatively selected, and encrypts the plurality of information by different encryption methods for each set;
In order for the server-side apparatus to select specific information from the above-mentioned sets, the client-side apparatus prepares display information including options corresponding to the information, and the encryption information is included in each option of the display information. A procedure for associating multiple pieces of information ,
A procedure in which the server side device transmits the plurality of encrypted information together with the display information to the client side device ;
A procedure in which the client-side device displays options for allowing a recipient to select specific information based on the received display information;
A procedure in which the client-side device transmits the encryption information associated with an option selected by a receiver operating the client-side device to the server-side device;
And a server-side device receiving the encrypted information and decrypting the encrypted information using a decryption method corresponding to the encryption method to which each set belongs. 2. The encryption communication method according to claim 1, wherein the encryption method and the decryption method are based on a stream encryption method that performs an exclusive OR operation on a bit string of information and a random number bit string for each bit. The server-side apparatus prepares a plurality of information sets that are alternatively selected, and an encryption unit that encrypts the plurality of information by different encryption methods for each set;
In order to allow the client side device to select specific information from each of the above sets, display information including options corresponding to each of the information is prepared , and a plurality of encrypted information is included in each option of the display information. Display information generating means for associating information;
Transmission means for transmitting the plurality of encrypted information together with the display information to the client side device ,
On the client side device , display means for displaying options for causing the recipient to select specific information based on the received display information;
Transmission means for the client side device to transmit the encryption information associated with the option selected by the receiver operating the client side device to the server side device,
The server side device includes a receiving means for receiving the encrypted information ,
An encryption communication apparatus, further comprising: decryption means for decrypting received encryption information by a decryption method corresponding to an encryption method to which each set belongs. 4. The encryption communication apparatus according to claim 3, wherein the encryption method and the decryption method are based on a stream encryption method that performs an exclusive OR operation on a bit string of information and a random number bit string for each bit.

Images