JP4703805B2 - ENCRYPTION DEVICE, ENCRYPTION METHOD, DECRYPTION DEVICE, DECRYPTION METHOD, AND COMMUNICATION SYSTEM - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
INDUSTRIAL APPLICABILITY The present invention is applicable to a case where desired data is transmitted while maintaining confidentiality, etc., and is preferably an encryption device, method thereof, encryption / decryption device, method thereof, encryption device, and encryption / decryption The present invention relates to a communication system having a device.
[0002]
[Prior art]
Advances in information processing technology and communication technology have made it possible to easily and efficiently transmit information over communication networks, and as a result, the amount of information transmitted over such communication networks Has also increased dramatically.
There are various types of communication networks. For example, the Internet in which a plurality of computer systems and networks are connected on a global scale is attracting attention in terms of its scale and communication cost, and is widely used. Yes.
[0003]
By the way, communication of various confidential data is performed between individuals and companies through such a communication network. However, in an open network system such as the Internet and a communication system such as wireless communication, there is a problem that it is easy to intercept relatively transmitted data.
As a general method of dealing with this and transmitting data requiring confidentiality, there is a method of encrypting transmission data and transmitting ciphertext, which is widely used.
Various methods are also considered for this encryption method. For example, Japanese Patent Laid-Open No. 3-108830 discloses that encrypted transmission data is divided into a plurality of data and these are transmitted via different lines. Thus, a method that can transmit desired data more safely is disclosed.
[0004]
[Problems to be solved by the invention]
However, various decryption methods have been considered for the conventional encryption methods, and there is a demand for encryption that is more difficult to decrypt and highly confidential.
For example, a known plaintext attack that takes advantage of the fact that typical text is often used in the export part of e-mails, etc., and derives a common key based on a pair of known plaintext and ciphertext corresponding to that text There is a cryptanalysis method. Once a part of the data has been decrypted by this method, there is a high risk that the entire data will be broken by the same method in the conventional ordinary encryption method. In the method described in Japanese Patent Laid-Open No. 3-108830 described above, the data is divided, but there is some difficulty in collecting the data. However, if the data is found, it is easily decoded. There is no.
[0005]
Accordingly, an object of the present invention is to provide an encryption device and an encryption method that are suitable for communication and can encrypt desired data with higher confidentiality.
Another object of the present invention is to provide an encryption / decryption device and an encryption / decryption device suitable for communication, which can appropriately decrypt data encrypted by such an encryption device and encryption method. It is to provide a method.
Still another object of the present invention is to provide a communication system capable of transmitting desired data with higher secrecy.
[0006]
According to the present invention, encoding means for encoding arbitrary data by a desired encoding method;
The encoded data is partitioned into a plurality of data blocks having different lengths of adjacent data blocks, and the partitioned data blocks are sequentially rearranged in a plurality of files having a number different from the number of data blocks. An encryption unit that generates a plurality of encrypted partial data by performing encryption processing with the same encryption method on the plurality of rearranged files using a different key for each file. There is provided an encryption device comprising an encryption processing means and an output means for outputting each of the plurality of encrypted partial data.
[0007]
According to the present invention, in an encryption device having an encoding unit, a file division unit, an encryption unit, and an output unit,
The encoding unit encodes arbitrary data by a desired encoding method,
The file dividing unit divides the encoded data into a plurality of data blocks having different lengths of adjacent data blocks, and a plurality of data blocks having a number different from the number of data blocks obtained by sequentially partitioning the divided data blocks. Rearrange to file,
The encryption unit performs encryption processing with the same encryption method on the plurality of rearranged files using a different key for each file , and generates a plurality of encrypted partial data And
The output unit outputs each of the plurality of encrypted partial data;
An encryption method is provided.
[0008]
According to the present invention, receiving means for receiving a plurality of encrypted data generated and output by the encryption device and the plurality of partial data received by the receiving means are divided and encrypted. the encrypted data, and decryption means for generating a plurality of data decrypted performs decryption process using a decryption key corresponding to the different the encryption key for each partial data, generated is the decrypted For the plurality of data , the rearrangement unit performs the reverse process of the rearrangement and the division process, and the rearrangement unit, the rearranged plural files are decoded by a decoding method corresponding to the encoding method, There is provided a decoding device having decoding means for generating arbitrary data.
[0009]
According to the present invention, in a decoding device having a receiving unit, a decoding unit, a rearranging unit, and a decoding unit,
The receiving unit receives a plurality of encrypted data generated and output by the encryption method;
The decryption unit decrypts the encrypted data divided and encrypted into the plurality of received files by performing decryption processing using a decryption key corresponding to the encryption key different for each file. Generate multiple data,
The reordering unit performs a process opposite to the process in the file dividing unit according to claim 4 for the decrypted data,
The code portion, that the processed data turn into decoded by the decoding method corresponding to the coding method,
A decoding method is provided.
[0010]
According to the present invention, the encryption device and the decryption device, which are connected via a transmission system,
The encryption device has IC card recording means,
The decryption device has an IC card reading means,
The IC card recording means of the encryption device records key data necessary for decrypting the plurality of encrypted partial data on the IC card,
The IC card reading means in the decryption device reads the key data from the IC card that is distributed before the decryption device performs the decryption and records the key data.
The decryption means in the decryption device performs the decryption process using information of the read decryption key.
A communication system is provided.
[0011]
DETAILED DESCRIPTION OF THE INVENTION
An embodiment of the present invention will be described with reference to FIGS.
In the present embodiment, the present invention will be described by exemplifying a communication system having a transmission device and a reception device that transmit desired data via an arbitrary transmission path.
FIG. 1 is a block diagram showing the configuration of the communication system 1.
The communication system 1 has a configuration in which a transmission device 10 and a reception device 30 are connected via a transmission line 20.
[0012]
The transmission apparatus 10 performs various processes described later on desired data to be transmitted, converts the data into a predetermined format, and sends the data to the transmission path 20.
First, the configuration of the transmission device 10 will be described.
The transmission apparatus 10 includes a file encoding unit 11, a file division unit 12, a dummy file addition unit 13, a rearrangement unit 14, an encryption unit 15, a transmission unit 16, and an IC card processing unit 17.
[0013]
The file encoding unit 11 performs a predetermined encoding process on the data to be transmitted that is input or stored in advance in a storage device (not shown) in the transmission apparatus 10 and encodes the data. The encoded data is provided to the file dividing unit 12.
In this embodiment, it is assumed that compression encoding is performed using LHA32Ver1.12. For example, if a text file as shown in FIG. 2A is data to be transmitted, this data is shown in FIG. 2B when the text is displayed by this compression encoding process. It is converted to such data.
[0014]
The file dividing unit 12 divides the transmission target data encoded by the file encoding unit 11 into a plurality of files based on a predetermined rule. The file division unit 12 does not divide the data simply by providing a break in the middle of the file, but extracts the data sequence in the file in units of bytes and rearranges the data in a plurality of files according to a predetermined rule. Split.
In the present embodiment, as shown in FIG. 3A, the data of the transmission target file is sequentially divided into 1 byte and 3 bytes, and this is rearranged into three files in order, thereby transmitting the data. Divide the target data file into three files. Accordingly, when the contents of each divided file generated by this process are displayed as text, an unintelligible character string as shown in FIG. 3B is formed, and the original text cannot be imagined.
In FIG. 3A, what is known as the data before division is shown for easy understanding, but actually, the file dividing unit 12 includes a file encoding unit as described above. 11 is supplied with data in a format that is once compression-encoded and whose contents cannot be directly understood.
[0015]
The dummy file adding unit 13 adds a file having contents unrelated to the original data to be transmitted to the plurality of files generated by the file dividing unit 12 in the same format as those files. These are all output to the rearrangement unit 14 as data to be transmitted. The dummy file to be added may be stored in advance or may be generated by an arbitrary method. Moreover, you may add the position to add to arbitrary positions. In the present embodiment, a dummy data file having substantially the same size as the file generated by the file dividing unit 12 is generated using a dummy data column that has been facilitated in advance, and a rearrangement unit 14 is provided in the subsequent stage. Therefore, it shall be added to the end of these generated files.
[0016]
The rearrangement unit 14 changes the order of a plurality of files to be transmitted supplied with dummy data added by the dummy file addition unit 13 by a method such as using random numbers, and outputs the changed file to the encryption unit 15. .
[0017]
The encryption unit 15 performs an encryption process on the plurality of files input from the rearrangement unit 14, generates a plurality of encrypted data files, and outputs them to the transmission unit 16. In the present embodiment, the encryption unit 15 uses the same encryption algorithm for a plurality of files, but changes the key for each file and performs encryption processing for each file.
The encryption unit 15 prepares a plurality of information such as a common key and a secret key used for the encryption process in advance for each destination, for example, and outputs the information to the IC card processing unit 17 to be recorded on the IC card 21. deep. In the subsequent processing, encryption processing is performed using one of the prepared keys for each transmission destination. The key used for the encryption process is received via the transmission line 20 using an index such as a key number indicating which key of the prepared keys is used instead of the key data. Notify device 30.
[0018]
The transmission unit 16 includes an interface and a protocol control unit according to the transmission line 20 to which the transmission device 10 is connected, and transmits a plurality of encrypted files input from the encryption unit 15 to the transmission line. 20 to the receiving device 30.
[0019]
The IC card processing unit 17 records data such as a common key and a secret key for each transmission destination that are input in advance from the encryption unit 15 in advance on the IC card 21 that is attached.
The IC card 21 in which data such as the common key and the secret key is recorded is conveyed to the receiving device 30 prior to data transmission.
[0020]
The transmission device 10 having such a configuration sends a desired transmission target file to the transmission path 20.
The operation of the transmission apparatus 10 at this time will be described together.
First, in the encryption unit 15, a plurality of public keys and secret keys used for encryption processing are determined for each transmission destination, stored in the IC card 21 via the IC card processing unit 17, and conveyed to the receiving device 30. Keep it.
In such a situation, when a data file to be transmitted is input to the transmission device 10, the file encoding unit 11 compresses and encodes the data by a predetermined encoding method, and at first glance, the content differs from the original data. Is converted into a file expressed in a code that cannot be understood.
[0021]
This file is divided into a plurality of files by the file division unit 12, a dummy file is added by the dummy file addition unit 13, and rearrangement is performed by the rearrangement unit 14.
Then, the encryption unit 15 performs encryption processing on the plurality of files in which the order is rearranged, using any one of the public key and the secret key determined for each transmission destination as described above. Then, the encrypted file is transmitted from the transmission unit 16 to the reception device 30 via the transmission path 20.
In addition, the index indicating the key used for the encryption process at this time is transmitted together with other indexes such as the encoding state, the division method, the dummy file identification, the sorting algorithm, and the like indicating various processing conditions. It is transmitted to the receiving device 30 via the path 20.
[0022]
The transmission line 20 is an arbitrary transmission line. In the present embodiment, it is assumed that the Internet includes various devices, computers, and networks including the transmitting device 10 and the receiving device 30 connected on a global scale.
[0023]
As described above, the receiving device 30 receives data that has been converted into a predetermined format by the transmitting device 10 and transmitted via the transmission path 20, and restores and outputs the data file in the original format. Therefore, the receiving device 30 has a configuration corresponding to each component of the transmitting device 10 described above.
The configuration of the receiving device 30 will be described.
The receiving device 30 includes an IC card processing unit 31, a receiving unit 32, an encryption / decryption unit 33, a rearrangement unit 34, a dummy file removal unit 35, a file integration unit 36, and a file decryption unit 37.
[0024]
IC card processing unit 31, information such as a public key and a private key used in encrypting and transmitting data to the receiving apparatus 30 from the transmission device 10, read from the IC card 21 to be mounted prior to the transmission of data And output to the encryption / decryption unit 33.
[0025]
The receiving unit 32 includes an interface and a protocol control unit according to the transmission path 20 to which the receiving apparatus 30 is connected, and a plurality of encrypted encrypted data transmitted from the transmission apparatus 10 via the transmission path 20. The files are sequentially received and output to the encryption / decryption unit 33.
[0026]
The encryption / decryption unit 33 performs encryption / decryption processing on the plurality of files sequentially received by the reception unit 32, generates a plurality of data files that have been decrypted, and outputs them to the rearrangement unit 34. . As described above, the encryption unit 15 of the transmission apparatus 10 performs encryption processing on each of a plurality of files by changing the key for each file using the same encryption algorithm. Therefore, the encryption / decryption unit 33 also performs encryption / decryption processing on each of the plurality of files input from the reception unit 32 by changing the key for each file using the same decryption algorithm. Note that key information used at this time , for example, information such as a public key and a secret key, is input and stored in advance via the IC card processing unit 31 as described above.
[0027]
The rearrangement unit 34 performs a process opposite to the rearrangement process performed by the rearrangement unit 14 of the transmission device 10 as described above, and rearranges the plurality of files whose ciphers are decrypted in the original order. , Output to the dummy file removal unit 35.
[0028]
The dummy file removal unit 35 detects a dummy file from the plurality of files rearranged by the rearrangement unit 34, removes the dummy file, and outputs the remaining plurality of files to the file integration unit 36. In the present embodiment, as described above, since the dummy file adding unit 13 of the transmitting apparatus 10 simply adds a dummy file to the end of the actual file, the dummy file removing unit 35 also includes the last file. By removing the file, the dummy file is removed and the actual file is detected.
[0029]
The file integration unit 36 performs the opposite process of the file division process performed by the file division unit 12 of the transmission device 10 as described above, rearranges the data of the plurality of files in order, and performs the encoding process. One original file that has only been performed is generated and output to the file integration unit 367.
[0030]
The file decoding unit 37 performs a predetermined decoding process corresponding to the encoding process performed by the file encoding unit 11 of the transmission device 10 as described above, restores the original file, and outputs it from the reception device 30. To do. Thereby, for example, the encoded data as shown in FIG. 2B is restored to the text file as shown in FIG.
[0031]
With the receiving device 30 having such a configuration, a file transmitted from the receiving device 30 via the transmission path 20 is received, and the original data is restored and output.
The operation of the receiving device 30 at this time will be described together.
First, the IC card 21 in which the information of the public key and the secret key used in the encryption / decryption process in the encryption / decryption unit 33 is recorded in the IC card processing unit 31, and the key information is read out from this. It is recorded in the encryption / decryption unit 33.
In such a situation, when a plurality of files converted into the above-described format are transmitted from the transmission device 10 via the transmission path 20, the reception unit 32 sequentially receives them and the encryption / decryption unit 33 Then, for each file, encryption / decryption processing is performed using one of the previously recorded keys.
[0032]
Next, the plurality of decrypted files are rearranged by the rearrangement unit 34 and returned to the original order, and the dummy file added at the end is removed by the dummy file removal unit 35.
Then, the file integration unit 36 rearranges the data of the plurality of files based on a predetermined rule and integrates the data into the original one file, and the file decoding unit 37 transmits the data of the file. A predetermined decoding process corresponding to the process performed by the file encoding unit 11 of the apparatus 10 is performed to restore the original data and output from the receiving apparatus 30.
[0033]
As described above, in the communication system 1 according to the present embodiment, the data to be transmitted is once encoded, and the contents cannot be directly recognized, and the encryption process is performed. In general, when an encrypted file is decrypted illegally, the original data is estimated and compared with the encrypted data. In the communication system 1 of the present embodiment, As described above, it is virtually impossible to estimate the original file contents before and after the encryption process. Specifically, for example, even if all possible encryption algorithms and keys are applied in a brute force manner and attempted to be decrypted, the decrypted data is not meaningful data. It cannot be confirmed whether it has been decrypted or not. Therefore, the communication system 1 according to the present embodiment has very high security against such an illegal decryption attack.
[0034]
Further, in the communication system 1, the data to be transmitted can be divided into a plurality of files, and an encryption algorithm and an encryption key can be selected for each file to perform encryption processing. Therefore, even if the cipher is decrypted for one file, it does not lead to the decryption of the entire data. That is, it takes more time and labor to decipher the entire data, and it can be said that it has high security.
[0035]
Further, in the communication system 1, since the division method is finely divided in units of bytes, it is difficult to estimate the original data in this point, making decryption difficult, and security is improved. Yes.
Further, in the communication system 1, the order of the divided files is rearranged, which makes it more difficult to estimate the original file and enhances the security.
In addition, in the communication system 1, since a dummy file is added, if the file is attempted to be decrypted, no valid data can be obtained, and the decryption attempt can be confused. In addition, security can be further improved.
[0036]
Further, in the communication system 1, the key information used for the encryption process and the decryption process is directly recorded on the IC card 21 by the transmission device 10, transported and attached to the reception device 30, and directly to the reception device 30. Is read. That is, this key information is not transmitted through the transmission path 20 at all. Therefore, by intercepting the signal transmitted through the transmission path 20 and detecting the key information, an attack for decrypting the data can be completely prevented, and the security can be remarkably improved.
[0037]
In addition, if the encoding process performed in the file encoding unit 11 reduces the data size, that is, if compression is performed, the amount of data to be transmitted can be reduced, and the communication time and communication cost are reduced. The effect that it is possible is also acquired.
[0038]
The present invention is not limited to the present embodiment, and various modifications can be made.
For example, although the transmission apparatus 10 described above has a configuration including the dummy file addition unit 13 and the rearrangement unit 14, the gist of the present invention is to divide the data encoded by the file encoding unit 11 by the file dividing unit 12, The encryption unit 15 performs encryption. Therefore, even if these dummy file addition unit 13 and rearrangement unit 14 are not provided, or have only one of them, or a dummy file is added after encryption unit 15. Even if it is provided as a means for performing rearrangement, there is no problem, and both are within the scope of the present invention.
[0039]
In addition, an arbitrary method may be used as the encoding method in the file encoding unit 11 of the transmission device 10. At this time, any encoding method that compresses the data size is effective from the viewpoint of communication time and communication cost as described above, but the present invention is not limited to this, and as a result, the data amount is small. An increasing encoding method may be used.
[0040]
Further, in the file dividing unit 12 of the transmission apparatus 10, the transmission target data is repeatedly divided into 1 byte and 3 bytes in order and rearranged into three files sequentially. However, the dividing method is not limited to this method. However, the image may be divided by an arbitrary method.
Further, the number of files to be divided is not limited to three, and may be divided into an arbitrary number.
Of course, the data to be transmitted need not be a text file as shown in FIG. 2, and may be data in an arbitrary format.
[0041]
In addition, in the present embodiment, the dummy file adding unit 13 of the transmission apparatus 10 includes the rearrangement unit 14 in the subsequent stage, so that the dummy file is divided by the file dividing unit 12 and the real data to be transmitted is divided. For example, in the case where the rearrangement unit 14 is not provided in the subsequent stage, it is preferable that the file is placed between any one of a plurality of divided files. is there. The present invention may be implemented by such a configuration.
[0042]
Further, in the encryption unit 15 of the transmission device 10, encryption is performed using a different key for each file to be transmitted, but the entire file is encrypted using the same key, or conversely for each file. You may make it encrypt using a different encryption algorithm.
[0043]
In addition, the encryption method, the encryption algorithm, the key generation method, the configuration of the transmission unit 16, the configuration of the communication path to be used, the configuration of the IC card processing unit 17 and the configuration of the IC card 21 to be applied are also included. Any configuration and form are possible.
In addition, the configuration of the receiving device 30 and its modifications may be arbitrarily changed in a form corresponding to the transmitting device 10 described above.
[0044]
【The invention's effect】
As described above, according to the present invention, it is possible to provide an encryption device and an encryption method that are suitable for communication and can encrypt desired data with higher confidentiality.
Further, it is possible to provide an encryption / decryption device and an encryption / decryption method suitable for communication, which can appropriately decrypt data encrypted by such an encryption device and an encryption method. .
Furthermore, it is possible to provide a communication system that can transmit desired data with higher confidentiality.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of a communication system according to an embodiment of the present invention.
FIG. 2 is a diagram for explaining processing of a file encoding unit of the transmission apparatus of the communication system shown in FIG. 1;
FIG. 3 is a diagram for explaining processing of a file division unit of the transmission device of the communication system illustrated in FIG. 1;
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 ... Communication system 10 ... Transmission apparatus 11 ... File encoding part 12 ... File division part 13 ... Dummy file addition part 14 ... Rearrangement part 15 ... Encryption part 16 ... Transmission part 17 ... IC card processing part 20 ... Transmission path 21 ... IC card 30 ... receiving device 31 ... IC card processing unit 32 ... receiving unit 33 ... encryption / decryption unit 34 ... rearrangement unit 35 ... dummy file removal unit 36 ... file integration unit 37 ... file decryption unit

Claims (9)

Encoding means for encoding arbitrary data by a desired encoding method;
The encoded data is partitioned into a plurality of data blocks having different lengths of adjacent data blocks, and the partitioned data blocks are sequentially rearranged in a plurality of files having a number different from the number of data blocks. Dividing means;
An encryption processing means for performing encryption processing by the same encryption method on the plurality of rearranged files using a different key for each file , and generating a plurality of encrypted partial data; ,
And an output unit that outputs each of the plurality of encrypted partial data. The encryption device
The relative relocated several files, a dummy data adding means with the same size as the file, the dummy data in any way without involvement from the coded data, is appended to the end of the plurality of files,
Further comprising a rearranging means for rearranging using pre Symbol relocated plurality of files and the additional random number and order of the dummy data,
The encryption processing means performs the encryption processing on the data rearranged by the rearrangement means,
The output means outputs the encrypted data ;
The encryption device according to claim 1. The encryption device further includes an IC card processing means for recording data of the key needed to decrypt the encrypted data to the IC card,
The encryption apparatus according to claim 1 or 2 . In an encryption device having an encoding unit, a file division unit, an encryption unit, and an output unit
The encoding unit encodes arbitrary data by a desired encoding method,
The file division unit divides the encoded data into a plurality of data blocks having different lengths of adjacent data blocks, and a plurality of data blocks having a number different from the number of data blocks obtained by sequentially partitioning the divided data blocks. Rearrange to file,
The encryption unit performs encryption processing with the same encryption method on the plurality of rearranged files using a different key for each file , and generates a plurality of encrypted partial data And
The output unit outputs each of the plurality of encrypted partial data;
Encryption method. Receiving means for receiving a plurality of encrypted data generated and output by the encryption apparatus according to claim 1;
The encrypted data divided and encrypted into the plurality of partial data received by the receiving means is decrypted by performing a decryption process using a decryption key corresponding to the encryption key different for each partial data. Decryption means for generating a plurality of data,
Reordering means for performing reversal and division processing of the dividing means according to claim 1 for the plurality of pieces of data generated by decryption ;
A decoding device comprising: decoding means for decoding the plurality of rearranged files by a decoding method corresponding to the encoding method and generating the arbitrary data. The encrypted data received by the receiving means is data having the plurality of files into which the arbitrary data is divided and dummy data that has the same size as the files and has nothing to do with the encoded data ,
The decryption apparatus further includes dummy data removal means for removing the dummy data from the input encrypted data,
Said rearranging means rearranges the plurality of data the generated removed the dummy data
The decoding device according to claim 5 . The decryption device stores decryption key information corresponding to the encryption key that is different for each file , and is necessary for the decryption process of the encrypted data from the IC card distributed in advance. Further comprising IC card processing means for reading out the information of the decryption key,
The decryption means performs the decryption process using the read decryption key information.
The decoding device according to claim 6 . In a decoding device having a receiving unit, a decoding unit, a rearranging unit, and a decoding unit,
The receiving unit receives a plurality of encrypted data generated and output by the encryption method of claim 4 ;
The decryption unit decrypts the encrypted data divided and encrypted into the plurality of received files by performing decryption processing using a decryption key corresponding to the encryption key different for each file. Generate multiple data,
The reordering unit performs a process opposite to the process in the file dividing unit according to claim 4 for the decrypted data,
The code portion, that the processed data turn into decoded by the decoding method corresponding to the coding method,
Decryption method. The encryption device according to any one of claims 1 to 2 and the decryption device according to any one of claims 5 to 6 , which are connected via a transmission system,
The encryption device has IC card recording means,
The decryption device has an IC card reading means,
The IC card recording means of the encryption device records key data necessary for decrypting the plurality of encrypted partial data on the IC card,
The IC card reading means in the decryption device reads the key data from the IC card that is distributed before the decryption device performs the decryption and records the key data.
The decryption means in the decryption device performs the decryption process using information of the read decryption key.
Communications system.

Images