JP5564453B2 - Information processing system and information processing method - Google Patents

Description

  The present invention relates to an information processing system and an information processing method used for encryption / decryption processing in a virtual system environment.

  In recent years, cloud computing has attracted attention, and services such as PaaS (Platform as a Service) and IaaS (Infrastructure as a Service) that provide users with virtual machines via a network have been spreading. In PaaS, a platform for executing an application via a network, such as a virtualized application server and database, is provided to the user. In IaaS, a user can introduce a system including an OS (Operating System) such as a virtualization server and a shared disk. Such a virtual machine is realized by starting the guest OS under the host OS.

  In such a virtual environment, when an application involving encryption processing is executed on the guest OS, it is necessary to protect the encryption key from attacks on the guest OS for the purpose of unauthorized acquisition of the encryption key or unauthorized use of the encryption key. There is. For example, there is a memory dump as an attack aimed at illegal acquisition of the encryption key. The memory dump illegally obtains the encryption key left on the memory by dumping the value on the memory. As an attack on the guest OS for the purpose of illegally obtaining and using the encryption key, for example, there is reverse engineering. In reverse engineering, an encryption key and credentials (ID, password) embedded in a program are extracted by decompiling the program.

  As a means for preventing such an attack, there is a hardware encryption device (HSM). For example, Patent Document 1 describes a technology in which servers are connected by a VPN (Virtual Private Network) in a virtual environment, and the host OS encrypts data transmitted between the servers.

JP 2010-62738 A

  However, the hardware encryption device requires a dedicated device and increases the cost. Further, when a hardware encryption device is used, the types of OS that can be provided are limited, and it becomes difficult to provide a service according to a user's request.

  Also, what is described in Patent Document 1 is to automatically determine and set encryption information on the host OS side when a VPN channel is established between servers in a virtual environment. The technique described in Patent Document 1 is a technique related to encryption in communication between servers in a virtual environment, and does not encrypt and decrypt data handled in the guest OS. In addition, in the one described in Patent Document 1, data cannot be encrypted or decrypted according to a request from an application on the guest OS side, or data stored on the guest OS side cannot be encrypted. There is a problem that the security of the data stored in the storage device or the storage medium is not taken into consideration at the time of creation.

  In view of the above-described problems, to provide an information processing system and an information processing method capable of ensuring and improving the security for an encryption key used for encryption and decryption of data handled in a guest OS in a virtual environment. Objective.

In order to solve the above-described problem, the present invention provides an information processing system that operates at least one guest OS using a virtual machine running on a host OS, and the host OS receives data from the guest OS and the data Upon receiving request information indicating a request for encryption or decryption of data, the guest OS that has transmitted the request information from a key database that stores an encryption key associated with each user using the guest OS A key management unit that reads out an encryption key corresponding to a user who uses the data and encrypts and decrypts data included in the request information using the read encryption key, and the guest OS includes the guest OS When a data encryption or decryption request is input from an application running on the OS, the data and the encryption for the data are encrypted. Request information indicating a request for or decoding transmitted to the host OS, with enhanced encryption providing unit for receiving the encrypted data or decrypted data from the host OS as a response to the request information, When the host OS operates the extended encryption providing unit, the guest OS uses the key management unit based on the identification information and credentials of the encryption key input by the user using the guest OS. An information processing system further comprising an authentication unit that authenticates whether or not to permit encryption and decryption of the received data .

Further, according to the present invention, in the above-described invention, the authentication unit communicates with the guest OS with respect to the guest OS that is permitted to encrypt and decrypt data with respect to the key management unit. the data to be transmitted and generate a session key used when encrypting between the generated session key in association with the encryption key corresponding to the guest OS is stored in the key database, encrypted by the session key This process is performed when data decrypted by the host OS is transmitted to the guest OS corresponding to the session key, and is performed when data encrypted by the host OS is transmitted to the guest OS. It is characterized by not being broken .

The present invention is also an information processing method in an information processing system for operating at least one guest OS using a virtual machine running on a host OS , wherein the host OS is input by a user using the guest OS. Based on the identification information and the credential of the encrypted key, authenticating whether or not the data requested from the guest OS is to be encrypted and decrypted; and When a request for data encryption or decryption is input from an application executed in the guest OS, a step of transmitting request data indicating the data and a request for encryption or decryption to the data to the host OS And the host OS indicates data from the guest OS and a request for encryption or decryption of the data. When the information is received, an encryption key corresponding to the user using the guest OS that transmitted the request information is read from a key database storing an encryption key associated with each user using the guest OS, Encrypting and decrypting the data included in the request information using the read encryption key, and the guest OS encrypting or decrypting the data encrypted from the host OS as a response to the request information Receiving the processed data. An information processing method comprising:

According to the present invention, the key management unit included in the host OS stores the encryption key used for encryption or decryption of data handled by the application executed in the guest OS, and the data encryption in the guest OS is performed. When the necessity of encryption and decryption occurs, the host OS is requested to perform the data encryption and decryption.
Thereby, it is not necessary to store the encryption key in the guest OS, and security in the guest OS can be ensured. In addition, since all the encryption keys used in each of the plurality of guest OSs are stored in the key management unit included in the host OS, an area (multiple guest OSs and host OSs) that prevents external attacks is used as the key management unit. Since it can be limited, security can be improved.

It is a block diagram which shows the outline | summary of the computer system which can apply this invention. It is a functional block diagram which shows the outline | summary of the encryption / decryption process in 1st Embodiment. It is a functional block diagram which shows the structure of the registration server in 1st Embodiment. It is a sequence diagram which shows an example of the process of service use pre-registration in 1st Embodiment. It is a figure which shows an example of the key database in 1st Embodiment. It is a figure which shows an example of the authentication database in 1st Embodiment. It is a sequence diagram which shows the example of a process of each part in the service authentication process in 1st Embodiment. It is a sequence diagram which shows the example of a process in case the user in the 1st Embodiment receives the encryption request | requirement from the encryption utilization application 62 which operate | moves on guest OS60. It is a sequence diagram which shows the example of a process when the user in 1st Embodiment has received the decoding request | requirement from the encryption utilization application 62 which operate | moves on the guest OS60.

(First embodiment)
Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 shows an outline of a computer system (information processing system) to which the present invention can be applied.

  In FIG. 1, a data center 1 that provides PaaS, IaaS, and the like is provided with a management machine 2 and a virtual machine (VM) 3. Here, the OS installed in the management machine 2 is called a host OS. The virtual machine 3 is represented by predetermined data as an entity, but operates as a virtual device by being read into the management machine 2 and executed on the host OS. The OS installed in the virtual machine 3 is called a guest OS. The data center 1 is constituted by at least one computer. When configured by a plurality of computers, each computer may be configured as a distributed system connected by a network. A plurality of virtual machines 3 can be operated on the host OS. When a plurality of virtual machines 3 are operated, each virtual machine 3 can be handled as an independent device.

  A management authority of the virtual machine 3 is given to the user by the operating company of the data center 1, and equipment resources of the virtual machine 3 are provided. The user can access the virtual machine 3 on the data center 1 by the user terminal 5 via the network 6 and use the virtual machine 3 as a virtualized application server or database.

  In the first embodiment, secure encryption / decryption processing is performed in such a virtual environment, thereby protecting data and improving reliability. Such encryption processing according to the first embodiment will be described below.

  FIG. 2 is a schematic block diagram illustrating a configuration of an information processing system that performs encryption / decryption processing according to the first embodiment. In FIG. 2, the host OS 50 includes an encryption / decryption control unit 51, an authentication unit 52, and a key management unit 53. The guest OS 60 is provided with an extended encryption providing unit 61.

  In the host OS 50, the encryption / decryption control unit 51 controls encryption / decryption processing and also performs process control between the guest OS 60 and the authentication unit 52 and key management unit 53 provided in the host OS 50. The authentication unit 52 has an authentication database in which a key ID and a credential are stored in association with each other, and authenticates whether or not to permit output of information received from the guest OS 60 to the key management unit 53. Do.

  The key management unit 53 stores a key ID, a common key (session key) that encrypts data transmitted and received between the guest OS 60 and the host OS 50, and a key value of the encryption key in association with each other. Has a key database. Further, in this key database, a pair of public keys (HOST_PUBLIC_KEY) and a secret key (HOST_PRIVATE_KEY) used for authentication with respect to the guest OS 60 are protected and stored in advance in an encrypted format. The key management unit 53 encrypts and decrypts data using the encryption key stored in the key database. The key management unit 53 encrypts the encrypted encryption key (public key, secret key, key value used for data handled by the guest OS 60 described later) stored in the key database. A predetermined decryption process is performed on the encrypted key.

In the guest OS 60, the extended encryption providing unit 61 is, for example, a program installed in the guest OS 60 and encrypts data from the encryption application 62 that uses encryption and decryption executed on the guest OS 60. Alternatively, upon receiving a request for data decryption, a secure communication channel is formed between the guest OS 60 and the host OS 50.
Note that the software of the extended encryption providing unit 61 may be downloaded from, for example, the site of the operating company of the data center 1, or the program of the extended encryption providing unit 61 may be stored on a recording medium such as a CD-ROM. You may make it distribute.

In the encryption / decryption processing according to the first embodiment, in FIG. 2, when the guest OS 60 is activated, the guest OS 60 is authenticated. The user uses in advance a credential used to authenticate whether or not to allow the operating company of the data center 1 to request encryption and decryption processing in the host OS 50 and a key for identifying the user. The ID is registered, the key ID and the credential are received from the operating company of the data center 1, and authentication is performed using the key ID and the credential. That is, the key ID and the credential are information associated with each user.
The extended encryption providing unit 61 provided in the guest OS 60 transmits the key ID and the credential to the authentication unit 52 provided in the host OS 50, and the authentication unit 52 authenticates the guest OS 60. When the authentication is established, the key ID and the session key are stored in the authentication database that the authentication unit 52 has.

  In the encryption / decryption process, when the encryption application 62 of the guest OS 60 calls an encryption / decryption API (Application Program Interface), the data and request information indicating encryption or decryption of the data are transmitted through the encryption / decryption API. 62 to the extended encryption provider 61. When the request information is input, the extended encryption providing unit 61 establishes a secure communication channel between the guest OS 60 and the host OS 50 and entrusts the encryption / decryption processing to the host OS 50. The encryption / decryption control unit 51 of the host OS 50 reads the encryption key stored in the key management unit 53 in advance, and performs the encryption / decryption process corresponding to the encryption / decryption process requested by the guest OS 60 using the read encryption key. . Then, the encryption / decryption control unit 51 sends the processing result to the extended encryption providing unit 61 of the guest OS 60, and the extended encryption providing unit 61 sends this processing result to the encryption using application 62.

  Thus, in the encryption / decryption process in the first embodiment, when the encryption application 62 of the guest OS 60 calls the encryption / decryption API, the guest OS 60 establishes a secure communication channel for the host OS 50 and performs the encryption / decryption process. Entrust host OS 50. Then, the host OS 50 performs encryption / decryption processing using a corresponding encryption key corresponding to the user who uses the guest OS 60, and transmits the result of the encryption / decryption processing to the guest OS 60 via the communication channel. As a result, secure encryption / decryption processing is performed in a virtual environment, and data handled by the guest OS 60 is protected and security is improved.

  That is, the host OS 50 is isolated from the guest OS 60 and has higher reliability than the guest OS 60. Therefore, by performing encryption processing on the host OS 50 isolated from the guest OS 60, it is possible to perform a memory dump that extracts a key on the memory by an attack on the guest OS 60, or by reverse engineering of the encryption key built in the program. It is possible to prevent unauthorized use of encryption keys due to unauthorized acquisition of encryption keys and reverse engineering of credentials built into the program. Further, the configuration shown in the first embodiment can be realized at low cost only by software technology, and there is an advantage that no additional hardware is required.

  Next, the encryption / decryption process in the first embodiment will be described. First, a service use pre-registration process performed before using the guest OS 60 will be described.

In order to perform the encryption / decryption processing according to the first embodiment, pre-registration processing is required.
FIG. 3 is a schematic block diagram showing the configuration of the registration server 70 that performs the pre-registration process. As shown in the figure, the registration server 70 includes a key ID generation unit 71, a key generation unit 72, and a credential generation unit 73.
The key ID generation unit 71 generates a user key ID according to a predetermined rule. The key generation unit 72 generates a key value as an encryption key corresponding to the key ID generated by the key ID generation unit 71. The credential generation unit 73 generates a user credential (for example, a password) using a random number generator or the like.

  FIG. 4 is a sequence diagram illustrating an example of a service use pre-registration process according to the first embodiment. In addition, it is desirable that pre-registration is performed by a method that ensures security other than electronic messages, such as documents and face-to-face delivery, considering security improvements. Here, pre-registration of documents and face-to-face usage will be described.

In FIG. 4, when the user 80 makes a use application to the operating company of the data center 1 (step S100), the key ID generation unit 71 of the registration server 70 follows the predetermined rule and the key ID corresponding to the user. Is generated (step S101).
Next, the key generation unit 72 of the registration server 70 generates a key value as an encryption key corresponding to the key ID generated by the key ID generation unit 71 (step S102). Next, the credential generation unit 73 of the registration server 70 generates a credential corresponding to the user using a random number generator (step S103).

When a user key ID is generated in step S101 and a key value is generated in step S102, the registration server 70 associates the key ID with the key value and associates the key database with the key management unit 53 of the host OS 50. (Step S104).
When the credential is generated in step S103, the registration server 70 associates the key ID with the credential and stores them in the authentication database of the authentication unit 52 provided in the host OS 50 (step S105). Further, the user 80 receives a key ID and credentials from the operating company of the data center 1 (step S106).

  As described above, when the service use pre-registration is completed, the key ID and the credential are notified to the user 80. When the service use pre-registration is completed, the key database of the key management unit 53 of the host OS 50 and the authentication database of the authentication unit 52 of the host OS 50 are updated.

FIG. 5 is a diagram illustrating an example of a key database according to the first embodiment. FIG. 6 is a diagram illustrating an example of an authentication database according to the first embodiment.
As shown in FIG. 5, in addition to the public key (HOST_PUBLIC_KEY) and the secret key (HOST_PRIVATE_KEY), the key management unit 53 of the host OS 50 has an encryption key associated with the key ID (KEY_ID_001) for the user 80. The key value (471cd0 ...) is stored in the key database. At this time, the key value stored in the key database is appropriately protected by a method such as encryption separately.
Further, as shown in FIG. 6, the key ID (KEY_ID_001) and the credential (PASSWORD_001) for the user 80 are stored in the authentication database of the authentication unit 52 provided in the host OS 50 in association with each other.

Next, service authentication processing will be described.
FIG. 7 is a sequence diagram illustrating an example of processing of each unit in the service authentication processing according to the first embodiment. Here, the service authentication process when the service use pre-registration process shown in FIG. 4 has already been performed will be described.

  After the guest OS 60 is activated, the user terminal 5 installs the software of the extended encryption providing unit 61 in the guest OS 60 according to the user's operation (step S107). At this time, the software of the extended encryption providing unit 61 installed in the guest OS 60 includes in advance information for identifying the host OS 50 that entrusts data encryption and decryption.

  When the software installation of the extended encryption providing unit 61 is completed, the extended encryption providing unit 61 generates a dialog screen and requests the user terminal 5 to input a key ID and credentials (step S108).

The user terminal 5 transmits the key ID and the credential in step S106 to the extended encryption providing unit 61 according to the operation of the user 80 (step S109).
Upon receiving the key ID and the credential, the extended encryption provider 61 of the guest OS 60 has received the information using the host OS 50 information (eg, host name, IP address, MAC address, etc.) set in advance. An authentication request including the key ID and credentials is transmitted to the host OS 50 (step S110).

The encryption / decryption control unit 51 transmits the authentication request received from the guest OS 60 to the authentication unit 52 (step S111).
Upon receiving the authentication request, the authentication unit 52 of the host OS 50 generates a random number (Step S112). In addition, a pair of a public key (HOST_PUBLIC_KEY) and a secret key (HOST_PRIVATE_KEY) is stored in advance in the key database that the key management unit 53 has. After generating the random number in step S112, the authentication unit 52 of the host OS 50 reads out its own public key (HOST_PUBLIC_KEY) from the key database of the key management unit 53 (step S113).

Subsequently, the authentication unit 52 transmits information including the generated random number and the read public key (HOST_PUBLIC_KEY) to the encryption / decryption control unit 51 (step S114).
When receiving the information including the random number and the public key (HOST_PUBLIC_KEY), the encryption / decryption control unit 51 transmits the received information to the extended encryption providing unit 61 of the guest OS 60 (Step S115).

When receiving the information including the random number and the public key (HOST_PUBLIC_KEY) from the encryption / decryption control unit 51, the extended encryption providing unit 61 concatenates the random number included in the received information and the credential corresponding to the user 80. A hash value is generated (step S116).
Subsequently, the extended encryption providing unit 61 generates a common key (session key) and encrypts the generated common key and key ID using the public key (HOST_PUBLIC_KEY) received in step S115 (step S115). S117).
The extended encryption providing unit 61 transmits information including the hash value generated in step S116 and the common key and key ID encrypted in step S117 to the encryption / decryption control unit 51 of the host OS 50 (step S118).

When receiving the information including the encrypted common key and key ID, and the hash value, the encryption / decryption control unit 51 transmits the received information to the authentication unit 52 (step S119).
When receiving the information from the encryption / decryption control unit 51, the authenticating unit 52 concatenates the random number generated in step S112 and the credentials stored in the authentication database of the authenticating unit 52 to generate a hash value (step). S120). Then, the authentication unit 52 compares the hash value generated in step S120 with the hash value received in step S119, and determines whether or not the hash values match (step S121).

If it is determined in step S121 that the hash values match, the authentication unit 52 reads out a private key (HOST_PRIVATE_KEY) paired with the public key (HOST_PUBLIC_KEY) from the key database of the key management unit 53 (step S122).
The authentication unit 52 of the host OS 50 uses the read secret key (HOST_PRIVATE_KEY) to decrypt the common key and key ID included in the information received in step S119 (step S123).

When the key management unit 53 of the host OS 50 decrypts the common key and key ID, the common key decrypted in step S123 corresponds to the key ID and the session key as a session key used for communication between the host OS 50 and the guest OS 60. And stored in the key database (step S124).
Then, the authentication unit 52 of the host OS 50 sends authentication response information indicating that the guest OS 60 is permitted to perform data encryption and decryption processing using the key management unit 53 included in the host OS 50 to the host OS 50. It transmits to the encryption / decryption control part 51 (step S125).
The encryption / decryption control unit 51 of the host OS 50 transmits the authentication response information received in step S125 to the guest OS 60 (step S126).

  Upon receiving the authentication response information, the extended encryption provider 61 of the guest OS 60 stores the common key in the memory in association with the key ID as a session key (step S127). The extended encryption providing unit 61 of the guest OS 60 outputs an authentication success screen if the authentication response information received in step S125 indicates information indicating that the processing is permitted (authentication OK). The providing unit 61 outputs an authentication error screen (step S128) and returns to step S108.

  As described above, the authentication unit 52 of the host OS 50 authenticates the guest OS 60 using the credentials in the service authentication process when operating the extended encryption providing unit 61. When authentication is established, the guest OS 60 stores a key ID and a session key in association with each other. The key database of the key management unit 53 of the host OS 50 stores a key ID and a session key in association with each other.

Next, the encryption / decryption process will be described.
FIG. 8 is a sequence diagram illustrating an example of processing in a case where the user makes an encryption request from the encryption use application 62 operated on the guest OS 60 in the first embodiment. Here, the service authentication process shown in FIG. 7 has already been performed, and the authentication that permits the data encryption and decryption processes using the key management unit 53 provided in the host OS 50 is performed by the guest OS 60. The case where it is performed for will be described.

In FIG. 8, the encryption using application 62 of the guest OS 60 transmits a processing request including the data to be encrypted to the extended encryption providing unit 61 of the guest OS 60 (step S129).
When the extended encryption provider 61 of the guest OS 60 receives the processing request including the data to be encrypted, it encrypts the data to be encrypted and the key ID included in the processing request using the session key stored in the service authentication process. (Step S130).
The extended encryption providing unit 61 transmits the encryption request information including the data encrypted in step S130 to the encryption / decryption control unit 51 of the host OS 50 (step S131).

The encryption / decryption control unit 51 of the host OS 50 transmits the encryption request information received in step S131 to the key management unit 53 (step S132).
When the key management unit 53 receives the encryption request information from the encryption / decryption control unit 51, the key management unit 53 uses the session key from the key database of the key management unit 53 and the data to be encrypted and the key included in the received encryption request information. The ID is decrypted (step S133).

The key management unit 53 reads a key value (encryption key) corresponding to the decrypted key ID from the key database (step S134).
The key management unit 53 encrypts the data to be encrypted using the read key value (step S135), and transmits the encrypted data to the encryption / decryption control unit 51 (step S136).
The encryption / decryption control unit 51 transmits the encrypted data received from the key management unit 53 to the extended encryption providing unit 61 of the guest OS 60 (step S137).

The extended encryption provider 61 of the guest OS 60 receives the encrypted data from the encryption / decryption controller 51 of the host OS 50 and transmits it to the encryption application 62 (step S138).
Thereby, the encryption using application 62 can obtain the encrypted data for the data to be encrypted requested to the guest OS 60 in step S129.

  As described above, in the encryption process, when the encryption application 62 of the guest OS 60 calls the encryption / decryption API and requests the guest OS 60 to encrypt the data, the extended encryption providing unit 61 of the guest OS 60 A secure communication channel is constructed, and cryptographic processing is outsourced to the host OS 50. In step S131, the data transmitted from the guest OS 60 to the host OS 50 is encrypted using a session key, thereby avoiding the risk of eavesdropping and protecting the data. In step S137, the data to be transmitted from the host OS 50 to the guest OS 60 has already been encrypted, so that encryption with the session key is not performed. By not performing encryption with the session key, the processing burden is reduced and performance degradation can be prevented.

  FIG. 9 is a sequence diagram illustrating an example of processing when the user makes a decryption request from the encryption utilization application 62 operated on the guest OS 60 in the first embodiment. Here, as in the case of the above-described encryption request, the service authentication process shown in FIG. 7 has already been performed, and data encryption and decryption using the key management unit 53 provided in the host OS 50 is performed. A case will be described in which authentication for permitting the processing is performed on the guest OS 60.

In FIG. 9, the encryption using application 62 transmits a processing request including the decryption target data to the extended encryption providing unit 61 of the guest OS 60 (step S139).
When receiving the processing request including the data to be decrypted, the extended encryption providing unit 61 encrypts the key ID using the session key corresponding to the key ID (step S140). Then, the extended encryption providing unit 61 transmits the decryption request information including the decryption target data and the encrypted key ID to the encryption / decryption control unit 51 of the host OS 50 (step S141).

When receiving the data in step S141, the encryption / decryption control unit 51 of the host OS 50 transmits the received decryption request information to the key management unit 53 (step S142).
The key management unit 53 decrypts the encrypted key ID included in the decryption request information received from the encryption / decryption control unit 51 using the session key stored in the key database (step S143), and decrypts the decrypted key. A key value (encryption key) corresponding to the ID is read (searched) from the key database (step S144).

  Then, the key management unit 53 decrypts the data to be decrypted using the read key value (step S145). The key management unit 53 encrypts the decrypted data with the session key (step S146), and transmits the encrypted data to the encryption / decryption control unit 51 of the host OS 50 (step S147).

  When receiving the data encrypted with the session key from the key management unit 53, the encryption / decryption control unit 51 of the host OS 50 transmits the received data to the extended encryption providing unit 61 of the guest OS 60 (step S148).

  The extended encryption providing unit 61 of the guest OS 60 decrypts the data received from the encryption / decryption control unit 51 of the host OS 50 with the session key (step S149). Then, the extended encryption providing unit 61 transmits the decrypted data to the encryption using application 62 (Step S150). Thereby, the encryption using application 62 can obtain the decrypted data for the decryption target data requested in step S139.

  Thus, in the decryption process, when the encryption application 62 of the guest OS 60 calls the encryption / decryption API and requests the guest OS 60 to decrypt the data, the extended encryption providing unit 61 of the guest OS 60 A secure communication channel is constructed, and decryption processing is outsourced to the host OS 50. In step S141, the data transmitted from the guest OS 60 to the host OS 50 is encrypted, so that encryption with a session key is not necessary. However, the key ID is encrypted with the session key because there is a risk of eavesdropping. In step S148, the data transmitted from the host OS 50 to the guest OS 60 is encrypted using a session key to avoid the risk of eavesdropping.

As described above, in the host OS 50, when the key management unit 53 receives the request information indicating the data and the encryption or decryption request for the data from the guest OS 60, the key management unit 53 associates each user who uses the guest OS 60 with each other. The encryption key corresponding to the user who uses the guest OS that transmitted the request information is read from the authentication database in which the stored encryption key is stored, and the read encryption key is used to encrypt the data included in the request information. And decryption. Further, in the guest OS 60, when a request for encryption or decryption of data is input from the encryption application running in the guest OS 60, the extended encryption providing unit 61 encrypts or decrypts the data and the data. Request information indicating a request for decryption is transmitted to the host OS 50, and encrypted data or decrypted data is received from the host OS 50 as a response to the request information.
Thereby, the guest OS 60 entrusts the encryption / decryption processing to the host OS 50, the host OS 50 performs the encryption / decryption processing using the encryption key corresponding to the encryption / decryption processing requested from the guest OS 60, and the processing result is sent to the guest OS 60. By transmitting, secure encryption / decryption processing is performed in a virtualized environment, data can be protected, and reliability can be improved.

In the host OS 50, the authentication unit 52 permits the guest OS 60 to perform encryption and decryption of data using the key management unit 53 when operating the extended encryption providing unit 61 in the guest OS 60. Authenticate whether or not. That is, it is determined whether or not the key ID and credential received from the guest OS 60 match the key ID and credential assigned in advance to the user. Allowed to perform encryption and decryption.
As a result, by limiting the guest OS 60 that permits the encryption and decryption of data using the key management unit 53, it is possible to improve the security for the encryption and decryption of data using the encryption key.

In addition, when the authentication unit 52 encrypts data transmitted / received to / from the guest OS 60 with respect to the guest OS 60 permitted to encrypt and decrypt the data by the key management unit 53. A session key to be used is generated, and the generated session key is stored in the key database in association with an encryption key corresponding to the guest OS.
Thereby, since the data transmitted / received between the host OS 50 and the guest OS 60 are encrypted using the session key, the secrecy can be increased and the security can be improved.

  For example, there are cases where it is desired to use the key requested by the user as the encryption / decryption key. In such a case, the key value is not registered in step S104, the key value in the key database is left blank, the user is informed of only the key ID and credentials, and the service is provided in step S125 of FIG. After the authentication process is completed, the user is requested to input a key, the key is acquired, the key is encrypted with a session key, transmitted from the guest OS 60 to the host OS 50, and the key of the key management unit 53 of the host OS 50 You may make it memorize | store in a database.

Further, when a plurality of guest OSs 60 request the host OS 50 to encrypt and decrypt data, the host OS 50 assigns guest OS-IDs, IP addresses, The session key may be stored in association with the MAC address or the like, and the session key corresponding to each guest OS 60 may be managed.
In step S126, the response authentication information transmitted to the guest OS 60 is transmitted including information for uniquely identifying the guest OS 60, and the session key for the guest OS 60 and the information are stored in association with each other. You may make it do. Further, the guest OS 60 may include information for transmitting the information to the host OS 50 so that the host OS 50 can identify the information transmitted from which guest OS 60.

  In the present embodiment, the configuration in which the user and the encryption key are associated one-to-one has been described. However, a plurality of encryption keys may be associated with the user. In this case, a combination of the encryption application to be used by the user and the key ID and encryption key (key value) may be stored in the key database. In addition, a setting file for associating a plurality of key IDs and encryption keys (key values) used by a user with a user is prepared for each guest OS, and when the guest OS starts, the setting file is read to In the authentication process (FIG. 7), authentication of credentials corresponding to a plurality of key IDs and encryption keys may be performed collectively. Thereby, the user can handle data using different encryption keys for each encryption application, and the security in the guest OS can be further improved.

  The present invention is not limited to the above-described embodiments, and various modifications and applications can be made without departing from the gist of the present invention.

DESCRIPTION OF SYMBOLS 1 ... Data center 2 ... Management machine 3 ... Virtual machine 5 ... User terminal 6 ... Network network 50 ... Host OS
51 ... Encryption / Decryption Control Unit 52 ... Authentication Unit 53 ... Key Management Unit 60 ... Guest OS
61 ... Extended encryption provider 62 ... Encryption application 70 ... Registration server

Claims (3)

An information processing system for operating at least one guest OS using a virtual machine operating in a host OS,
The host OS is
Upon receiving request information indicating data and a request for encryption or decryption for the data from the guest OS, the key database stores an encryption key associated with each user using the guest OS. A key management unit that reads an encryption key corresponding to a user who uses the guest OS that transmitted the request information, and encrypts and decrypts the data included in the request information using the read encryption key;
The guest OS is
When a data encryption or decryption request is input from an application executed in the guest OS, the request information indicating the data and the encryption or decryption request for the data is transmitted to the host OS. An extended encryption providing unit that receives encrypted data or decrypted data from the host OS as a response to the request information ;
The host OS is
When operating the extended encryption providing unit, the guest OS uses the key management unit to encrypt data based on the identification information and the credentials of the encryption key input by the user using the guest OS. And an information processing system further comprising an authentication unit for authenticating whether or not to permit the decryption . The authentication unit
Generates a session key to be used when encrypting data transmitted / received to / from the guest OS, with respect to the guest OS permitted to encrypt / decrypt data by the key management unit. And storing the generated session key in the key database in association with the encryption key corresponding to the guest OS ,
Encryption with the session key is as follows:
This is performed when data decrypted by the host OS is transmitted to the guest OS corresponding to the session key, and is performed when data encrypted by the host OS is transmitted to the guest OS. the information processing system according to claim 1, characterized in that there is no. An information processing method in an information processing system for operating at least one guest OS using a virtual machine operating in a host OS,
Whether to allow the host OS to encrypt and decrypt data requested by the guest OS based on the identification information and credentials of the encryption key input by the user using the guest OS Authenticating or
When the authenticated guest OS receives a data encryption or decryption request from an application running on the guest OS, the request information indicating the data and the data encryption or decryption request Sending to the host OS;
When the host OS receives request information indicating data and a request for encryption or decryption of the data from the guest OS, an encryption key associated with each user using the guest OS is stored. A step of reading an encryption key corresponding to a user who uses the guest OS that transmitted the request information from the key database, and performing encryption and decryption on the data included in the request information using the read encryption key When,
The guest OS includes a step of receiving encrypted data or decrypted data from the host OS as a response to the request information.

Images