JP6091394B2 - Information processing apparatus and encryption method - Google Patents

Description

  The present invention relates to an information processing apparatus and an encryption method that can encrypt confidential information in a short time.

  Encryption is effective as a means for concealing the content of confidential information. Encryption can prevent confidential information from being stolen in the middle of communication, and stored confidential information from being read.

  The confidential information is information managed confidentially, and the data format includes all of the binary formats such as a text format expressed by a character code, a load module, image data, and a document other than text.

  As an encryption method, a common key method using a common key and a public key method using a public key are generally known. These keys (common key, public key) are called encryption keys. In any encryption method, the longer the data length of confidential information to be encrypted, the more time is required for encryption processing.

For such problems, for example, techniques disclosed in the following Patent Documents 1 to 3 are known.
Any known document encrypts only a designated part from a series of data. This shortens the time required for the encryption process as much as possible.

JP 2008-31156 A JP-A-11-344925 JP 2002-91828 A

  However, since the above-described prior arts in Patent Documents 1 to 3 select only data to be encrypted from a series of data and partially encrypt the data, the data to be encrypted becomes long. For example, the time required for the encryption process exceeds the processing time required for the apparatus.

  For example, the A data shown in FIG. 7A can be reduced by 70% as the data size by encrypting the highly important data A3 as compared with the case where the entire A data is encrypted. In the case of B data shown in B), since the data size cannot be reduced by 50% even if the highly important data B3 is encrypted, the effect is considerably reduced.

  In particular, if you want to encrypt control parameter information in a control device that requires a high response, or if the hardware resource is limited, such as an embedded device, and the program is not available in an environment where sufficient memory capacity and high CPU performance are not available This is especially true when you want to encrypt.

  The present invention has been made in view of such a point, and an object of the present invention is to encrypt confidential information to be encrypted in a short time.

The present invention in order to solve the above problems, the plaintext, an information processing apparatus for converting the ciphertext, the plaintext, and means for dividing into blocks of a fixed length, the plaintext and the divided, the block Means for associating with the order information indicating the order, means for randomly rearranging the divided plaintext and the order information in the block unit, and the divided plaintext in the block unit. And means for performing an exclusive OR operation, and means for encrypting the randomly rearranged order information using an encryption key.

  Further, the present invention relates to a file generation unit that converts confidential information into a first file composed of a plurality of records, and associates the first file with order information and confidential information representing the order in units of records. An order information addition processing unit for converting to a second file, a first rearrangement processing unit for rearranging the second file in units of records, and converting the second file into a third file; The confidential information of the third file is subjected to an exclusive OR operation using the order information and converted into a fourth file, and the order information of the fourth file is converted to an encryption key. And an order information encryption processing unit that encrypts the data and converts it into a fifth file.

  The information processing apparatus according to the present invention includes an order information decryption processing unit that decrypts the encrypted order information of the fifth file using an encryption key and converts the decrypted order information into a fourth file. Based on the order information of the file, the order is rearranged in units of records, the second rearrangement processing unit for converting to the third file, and the confidential information of the third file are converted into exclusive logic using the order information. A confidential information decryption processing unit that performs a sum operation and converts the result into a second file, and a confidential information extraction unit that extracts confidential information from the second file.

In the encryption method by the information processing apparatus of the present invention, the information processing apparatus includes a storage unit, a file generation unit, an order information addition processing unit, a first rearrangement processing unit, and a confidential information encryption process. And a sequence information encryption processing unit, wherein the file generation unit includes a process of converting confidential information stored in the storage unit of the information processing apparatus into a first file including a plurality of records. the sequence information adding processing unit, the first file, the record unit, in correspondence with the order information and confidential information representative of the order, including the step of converting the second file, the first sorting The processing unit includes a process of converting the second file into a third file by randomly rearranging the second file in record units, and the confidential information encryption processing unit includes the confidential information of the third file. The order information for Exclusive OR calculated Te, comprising the step of converting the fourth file, the order information encryption processing unit, the order information of the fourth file, using the encryption key, fifth file It includes the process of converting to.

  According to the present invention, the arrangement of confidential information data is randomly rearranged in fixed-length block units, the confidential information is encrypted using order information corresponding to the confidential information, and the order information is encrypted using an encryption key. By encrypting, the confidential information can be encrypted in a much shorter time than when the entire confidential information is encrypted using the encryption key.

It is a figure which shows the structure outline | summary of the information processing apparatus which concerns on embodiment of this invention. It is a figure which shows the encryption processing procedure which concerns on embodiment of this invention. It is a flowchart which shows the encryption process of the information processing apparatus which concerns on embodiment of this invention. It is a figure which shows the decoding processing procedure which concerns on embodiment of this invention. It is a flowchart which shows the decoding process of the information processing apparatus which concerns on embodiment of this invention. It is a figure which shows the example which divided | segmented the source program which concerns on embodiment of this invention into record units. It is a figure for demonstrating the conventional problem.

Hereinafter, embodiments of the present invention will be described in detail.
<Outline of configuration of information processing apparatus>
FIG. 1 is a diagram showing a configuration outline of an information processing apparatus according to an embodiment of the present invention. The information processing apparatus 1 includes an encryption processing unit 10 and a decryption processing unit 20, and transmits and receives information by communication.

  The encryption processing unit 10 further includes a confidential information receiving unit 11, a file generation unit 12, an order information addition processing unit 13, a first rearrangement processing unit 14, a confidential information encryption processing unit 15, and an order information encryption processing unit. 16.

  The main function of the encryption processing unit 10 is to add order information to the received confidential information and rearrange it randomly, encrypt the confidential information using the order information, encrypt the order information using a common key, It is to pass the encrypted file to the decryption processing unit 20.

  The decryption processing unit 20 further includes an encrypted file receiving unit 21, an order information decryption processing unit 22, a second rearrangement processing unit 23, a confidential information decryption processing unit 24, and a confidential information extraction unit 25.

  The main function of the decryption processing unit 20 is to decrypt the order information using the common key of the encrypted file received from the encryption processing unit 10, rearrange the data based on the order information, and decrypt the confidential information using the order information. The confidential information is taken out and the confidential information is output.

  The information processing apparatus 1 is a well-known computer as a hardware resource such as a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), an input / output device, a drive device, and various interfaces. It has a configuration (not shown). The input device is realized using an interface such as a keyboard, a mouse, a touch panel, the output device is realized using a display panel made of liquid crystal or organic EL, etc., and the drive device is a CD-ROM, DVD, USB memory A program and data can be read from and written to a portable storage medium such as the above, and these components are connected via a bus, a serial line, or the like.

  The information processing apparatus 1 can also communicate with other computers via a network. At this time, the network is the Internet, a local area network (LAN), a radio network of portable terminals, or the like. Further, the input / output device may be a terminal of the information processing device 1 connected via a network.

  The entity of the encryption processing unit 10 and the decryption processing unit 20 is a program, and each processing unit (11 to 16 and 21 to 25) is stored in a ROM or the like as a storage unit, and the CPU is stored in the ROM or the like. The above-described functions are realized by executing the stored program. The storage unit RAM stores input / output data (confidential information, encrypted files) used in each of the above-described processing units (11 to 16 and 21 to 25), work data used during the processing, and the like. .

  In addition, each processing unit (11-16 and 21-25) may be formed on a single semiconductor chip or in combination. For example, the first rearrangement processing unit 14 may construct a circuit that rearranges data.

The entities of the encryption processing unit 10 and the decryption processing unit 20 may be in different computers. The hardware resources at this time are basically the same as those of the information processing apparatus 1 described above. Further, the encryption processing unit 10 sends the encrypted file to the decryption processing unit 20 via a network or via a storage medium.
<Encryption procedure>
FIG. 2 is a diagram showing an encryption processing procedure in association with a data example of confidential information and order information according to the embodiment of the present invention. FIG. 3 is a flowchart showing details of the encryption processing according to the embodiment of the present invention. The subsequent encryption processing procedure will be described with reference to FIGS.

  The confidential information receiving unit 11 receives the confidential information 30 that is plain text from the outside of the information processing apparatus 1 (S11). As a receiving method, confidential information may be input from an input device to receive the information. Further, information may be received from a portable storage medium in which confidential information is stored. Information may be received from an external device via a network.

Next, the file generation unit 12 converts the confidential information 30 received by the confidential information receiving unit 11 into a record unit file, and generates a first file 31 (S12).
Further, it is desirable to generate the first file 31 so that the number of records is “58” or more.

  In other words, the strength of the AES-256bit encryption method (number of patterns that the encryption key can take) is 2 to the 256th power, approximately 10 to the 77th power, but the number of records is 58 lines (N = 58) The number of combinations is about 10 to the 78th power.

This means that the first rearrangement processing unit 14 to be described later rearranges the order of the records at random, so that the encryption strength becomes higher than that of the AES-256 bit encryption method.
The example of FIG. 6 is an example in which the source program, which is confidential information shown in (A), is converted into a record unit file shown in (B).

  The source program in FIG. 6A is divided into 4 bytes of data per record. As a result, it is difficult to decipher the entire source program by linking the data in one record to other related data in the record.

Although FIG. 6 shows an example of a source program (text format), the same applies to a load module (binary format).
In the example of FIG. 2, data 1 corresponds to the first record, data 2 corresponds to the second record,... Data N corresponds to the Nth record.

  Here, file generation means defining a data file with the concept of a row (record) used in an RDB (relational database) or a process file, for example, in order to make it easy to handle confidential information of a general file as a data file. Means. Further, the file generation unit 12 may manage data for each fixed-length block by the file generation unit 12 itself without using the data file management function.

Next, the order information addition processing unit 13 adds order information to the first file in units of records, and converts it to the second file 32 (S13).
In the example of FIG. 2, an address is used as the order information. “8000” is added in hexadecimal as order information to the top of the first record. Thereafter, order information is added in ascending order.

The address may be a head address corresponding to each record on a RAM (random access memory) in which the second file is stored.
In addition, an address corresponding to the first record may be determined in advance, and addresses corresponding to subsequent records may be arranged in ascending or descending order at regular intervals.

Further, when the substance of the confidential information is a load module, the address on the memory when the corresponding load module is executed by the CPU may be used as the order information.
Further, the order information may not be an address but may be a number (1, 2, 3,...) Or a character (A, B, C.

Further, the position to which the order information is added in the record may be before or after the confidential information. Further, the relative position from the beginning of the record may be determined and order information may be added.
Next, the 1st rearrangement process part 14 rearranges the 2nd file 32 at random for every record, and converts it into the 3rd file 33 (S14). By randomly selecting one record from the N records, selecting one record from the remaining records, and repeating this, it can be rearranged randomly in record units.

  Next, the confidential information encryption processing unit 15 encrypts the confidential information in the third file 33 by exclusive OR (EX-OR) operation using the corresponding order information, and converts it into the fourth file 34. (S15).

  For example, if the record order information is binary "1100 1000 0000 0000" (2 bytes) and the confidential information is "1011 0100 0000 0000 0100 0000 ..." (4 bytes), the exclusive OR operation Thus, the encrypted confidential information becomes “0111 1100 0000 0000 1000 1000...”.

That is, 2 bytes of order information and 2 bytes of confidential information are subjected to an exclusive OR operation, and the exclusive OR operation is sequentially repeated for the remaining 2 bytes of confidential information.
Here, encryption is performed by exclusive OR operation, but other operations can be applied as long as they are reversible operations (reversible calculations).

  Next, the order information encryption processing unit 16 encrypts the order information of the fourth file 34 by the common key method, and converts it into the fifth file 40 (S16). As a common key encryption algorithm, a typical AES-256 bit encryption algorithm may be used.

  As for the common key, each of the encryption processing unit 10 and the decryption processing unit 20 manages two identical common keys in different secure storage areas. Although the same processing is performed in the public key method, it is generally said that the public key method takes more time for encryption and decryption than the common key method.

  Next, the order information encryption processing unit 16 sends the encrypted fifth file to the decryption processing unit 20 (S17). In the information processing apparatus 1, it is conceivable to send the fifth file 40 via a bus, a serial line, or the like. When the encryption processing unit 10 and the decryption processing unit 20 are in different computers, the encrypted fifth file 40 is sent via a network or a storage medium.

In the processing of the encryption processing unit described above, the processing order of the first rearrangement processing unit 14, the confidential information encryption processing unit 15, and the order information encryption processing unit 16 may be changed. Even if the processing is switched, the content of the fifth file is the same as a result.
<Decoding processing procedure>
FIG. 4 is a diagram showing a decryption processing procedure in association with the data example of confidential information and order information according to the embodiment of the present invention. FIG. 5 is a flowchart showing details of the decoding process according to the embodiment of the present invention. The subsequent decoding processing procedure will be described with reference to FIGS. 4, 5, and 1.

The encrypted file receiving unit 21 receives the encrypted fifth file 40 from the order information encryption processing unit 16 of the encryption processing unit 10 (S21).
Next, the order information decryption processing unit 22 decrypts the order information of the fifth file 40 received by the encrypted file receiving unit 21 using a common key method, and generates a fourth file 34 (S22).

Next, the second rearrangement processing unit 23 rearranges the order in record units based on the order information of the fourth file, and generates the third file 32 (S23).
Next, the confidential information decryption processing unit 24 decrypts by the exclusive OR operation using the order information of the third file 33, and converts it into the second file 32 (S24).

Next, the confidential information extraction unit 25 extracts the confidential information 30 from the second file 32 (S25).
Next, the confidential information extraction unit 25 outputs the extracted confidential information 30 in plain text (S26). Examples of the output include display on an output device, writing to a storage medium, application processing using confidential information, transmission to another computer, and the like.
<Effect of Example>
According to the above-described embodiment, by applying the information processing apparatus of the present invention, it is possible to encrypt confidential information in a much shorter time than encryption processing using an encryption key for the entire confidential information. .

  Since the confidential information in the record is encrypted by exclusive OR operation, visual analysis is difficult. Therefore, in a situation where the order of the records is rearranged at random, it is no longer possible for a third party to understand the entire confidential information from the encrypted confidential information in the record.

Furthermore, although the size of the order information of the records is slightly different depending on the type of the record, the size of the portion to be encrypted using the encryption key can be fixed regardless of the importance of the confidential information.
Also, it is not necessary to encrypt all data that needs to be protected using an encryption key.

  Furthermore, since the data order is rearranged randomly before encryption processing is performed using the encryption key every time, a random ciphertext can be output without changing the encryption key.

DESCRIPTION OF SYMBOLS 1 Information processing apparatus 10 Encryption process part 11 Confidential information receiving part 12 File generation part 13 Order information addition process part 14 1st rearrangement process part 15 Confidential information encryption process part 16 Order information encryption process part 20 Decryption process part 21 Encrypted File Receiving Unit 22 Order Information Decryption Processing Unit 23 Second Rearrangement Processing Unit 24 Confidential Information Decryption Processing Unit 25 Confidential Information Extraction Unit 30 Confidential Information 40 Encrypted File

Claims (4)

An information processing apparatus that converts plaintext into ciphertext,
Means for dividing the plaintext into fixed-length block units ;
Means for associating the divided plaintext with order information representing an order in the block unit;
Means for randomly rearranging the divided plaintext and the order information in units of the blocks;
Means for performing an exclusive OR operation on the divided plaintext in units of blocks using the order information;
An information processing apparatus comprising: means for encrypting the randomly rearranged order information using an encryption key. An information processing device that converts confidential information into an encrypted file,
A file generator for converting confidential information into a first file comprising a plurality of records;
An order information addition processing unit for converting the first file into a second file in correspondence with order information representing the order and confidential information in units of records;
A first rearrangement processing unit that randomly rearranges the second file in units of records and converts the second file into a third file;
A confidential information encryption processing unit that performs an exclusive OR operation on the confidential information of the third file using the order information and converts the confidential information into a fourth file;
An information processing apparatus comprising: an order information encryption processing unit that encrypts the order information of the fourth file using an encryption key and converts the information into a fifth file. The information processing apparatus according to claim 2,
An order information decryption processing unit that decrypts the encrypted order information of the fifth file using an encryption key and converts the decrypted order information into a fourth file;
A second rearrangement processing unit that rearranges the order in units of records based on the order information of the fourth file, and converts the order into a third file;
A confidential information decryption processing unit that performs an exclusive OR operation on the confidential information of the third file using the order information and converts it into a second file;
An information processing apparatus comprising: a confidential information extraction unit that extracts confidential information from the second file. An encryption method by an information processing apparatus, wherein the information processing apparatus includes a storage unit, a file generation unit, an order information addition processing unit, a first rearrangement processing unit, a confidential information encryption processing unit, An order information encryption processing unit;
The file generator
Confidential information stored in the storage unit of the information processing apparatus includes a process of converting a first file comprising a plurality of records,
The order information addition processing unit
It said first file includes a record unit, in correspondence with the order information and confidential information representative of the order, a process of converting the second file,
The first rearrangement processing unit includes:
Including a step of converting the second file into a third file by randomly rearranging the second file in units of records ,
The confidential information encryption processing unit
Confidential information of the third file, exclusive OR is calculated using the order information includes the step of converting the fourth file,
The order information encryption processing unit
An encryption method, comprising: encrypting the order information of the fourth file using an encryption key and converting it into a fifth file.