JP7103334B2 - Plaintext encryption / decryption method and plaintext encryption / decryption device - Google Patents

Description

The present invention relates to a plaintext encryption / decryption method and a plaintext encryption / decryption apparatus for stirring and concealing a plaintext encrypted text by a stirring table.

Conventionally, as a plaintext encryption / decryption method and device of this kind, for example, there are an encryption method, a decryption method, and a device disclosed in Patent Document 1.

In this method and apparatus, an encryption means having a configuration in which a diffusion processing means is arranged between two Feistel processing means having a generalized Feistel structure is used. The plaintext is divided into n pieces and input to the first Feistel processing means. Each Feistel processing means is composed of one or more rounds of n-series generalized Feistel structure that performs non-linear conversion with key data. The data processed by the first Feistel processing means is then input to the diffusion processing means. The spreading processing means performs matrix calculation using a spreading table represented by a matrix of n rows and n columns, and multiplies n input data by each numerical value of the spreading table to spread. The spread n output data are then input to the second Feistel processing means and processed to be converted into a ciphertext.

International Publication No. 2009/075337

However, the conventional plaintext encryption and decryption method and the diffusion (stirring, affine) processing in the apparatus as disclosed in Patent Document 1 are based on a table stored and fixed in a memory such as the above diffusion table. Is done. Therefore, if the diffusion table, which is the key to the diffusion process, is made public or exposed by brute force, the diffusion-processed data can be easily restored to the original data before diffusion. Therefore, the confidentiality of the ciphertext that has been spread processed using such a fixed table cannot be sufficiently maintained. Further, in the conventional method and device, a storage area for storing the table value of the fixed table in the memory is required, which leads to an increase in the memory.

The present invention has been made to solve such a problem, and is a plaintext encryption / decryption method and plaintext encryption that can improve the confidentiality of the ciphertext and do not cause an increase in memory. It is an object of the present invention to provide a decryption device.

Therefore, in the present invention, the identification value generating means generates the first combined value by adding a plain sentence to the address value that specifies the storage destination for storing the confidential encryption statement in the memory, and generates the first combined value of the first combined value. An identification value generation step that calculates a hash value and generates an identification value from a value at a predetermined position in the hash value of the first join value, and an encryption step that encrypts a plain sentence and generates an encrypted sentence by an encryption means. , The first comparison means adds the random number generated by the random number generating means to the address value to generate the second combined value, calculates the hash value of the second combined value, and the hash value of the second combined value. The value at a predetermined position is compared with the identification value, and if the comparison results do not match, the next generated random number is further added to the address value by the random number generating means to generate a new second combined value. The process of calculating the hash value of the new second combined value, and the process of comparing the value at a predetermined position in the hash value of the new second combined value with the identification value are repeated until the comparison results match . The comparison step, the stirring step of stirring the encrypted text using the number sequence of random numbers generated by the time when the comparison results in the first comparison step match by the stirring means as the stirring table to generate the stirring encrypted text, and the concealment . The secret encryption step of adding the number sequence of the random numbers to the stirring encryption text by the encryption means to generate the secret encryption text, and the secret encryption text generated by the storage means are specified by the address value. A save step of saving in the memory of the address, a read step of reading the secret encryption text from the memory of the address specified by the address value by the read means, and a secret encryption text read by the second comparison means. The value at a predetermined position of is extracted as a random number constituting the number sequence of the random numbers, the extracted random number is added to the address value to generate a third combined value, the hash value of the third combined value is calculated, and the second 3 The value at a predetermined position in the hash value of the combined value is compared with the identification value, and if the comparison results do not match, the value at the position consecutively aligned with the value at the predetermined position in the read confidential encryption statement is the random number. A process of generating a new third combined value further added to the address value as the next random number constituting the sequence of numbers, a process of calculating a hash value of the new third combined value, and a process of calculating the hash value of the new third combined value. When the second comparison step, which repeats the process of comparing the value at a predetermined position in the hash value with the identification value until the comparison results match, and the comparison result in the second comparison step match by the stirring table extraction means . Stirring table extraction step that extracts a number of random numbers obtained as a stirring table and stirring that extracts the extracted stirring table from the secret encryption text that was read out by the stirring encryption text extraction means as a stirring encryption text. Obtained by reverse conversion by the encrypted sentence extraction step, the reverse conversion step of reverse-converting the encrypted text extracted by the reverse conversion means based on the extracted stirring table and returning it to the encrypted text, and the decryption means. A plaintext encryption / decryption method including a decryption step of decrypting the encrypted text to obtain the plaintext was constructed.

Further, in the present invention, the first join value is generated by adding a plain sentence to the address value that specifies the save destination for saving the confidential encryption statement in the memory, the hash value of the first join value is calculated, and the first An identification value generation means that generates an identification value from a value at a predetermined position in a hash value of a combined value, an encryption means that encrypts a plain sentence and generates an encrypted sentence, a random number generation means that generates a random number, and a random number generation means. The random number generated in is added to the address value to generate the second combined value, the hash value of the second combined value is calculated, and the value at a predetermined position of the hash value of the second combined value and the identification value are obtained. After comparison , if the comparison results do not match, a process of further adding a random number generated next by the random number generating means to the address value to generate a new second combined value, a hash of the new second combined value. Comparison between the first comparison means and the first comparison means, in which the process of calculating the value and the process of comparing the value at a predetermined position in the hash value of the new second combined value with the identification value are repeated until the comparison results match. A stirring means for generating a stirring encryption statement by stirring the encrypted text using a number sequence of random numbers generated by the time the results match as a stirring table, and a stirring means for generating the stirring encryption statement, and adding the number sequence of the random numbers to the stirring encryption statement for concealment. A secret encryption means that generates an encrypted statement, a storage means that saves the generated secret encryption statement in the memory of the address specified by the address value, and a secret means for storing the generated secret encryption statement from the memory of the address specified by the address value. The reading means for reading the encrypted text and the value at a predetermined position of the read secret encrypted text are extracted as random numbers constituting the number sequence of the random numbers, and the extracted random numbers are added to the address value to add the third combined value. Is generated, the hash value of the third join value is calculated, the value at a predetermined position in the hash value of the third join value is compared with the identification value, and if the comparison results do not match, the read secret encryption statement is used. A process of generating a new third combined value by further adding the values of the positions arranged consecutively to the values of the predetermined positions as the next random numbers constituting the sequence of the random numbers to the address value, the new third combined value. In the second comparison means and the second comparison means, the process of calculating the hash value and the process of comparing the value at a predetermined position in the hash value of the new third combined value with the identification value are repeated until the comparison results match . A stirring table extraction means that extracts a number sequence of random numbers obtained when the comparison results match as a stirring table, and a stirring code that extracts the extracted stirring table as a stirring encryption statement after removing it from the read confidential encryption statement. Cryptographic extraction means and extracted stirring A plaintext provided with an inverse conversion means for inversely converting the stirred encrypted text based on the extracted stirring table and returning it to the encrypted text, and a decryption means for decrypting the encrypted text obtained by the reverse conversion to obtain a plaintext. An encryption / decryption device was configured.

According to this configuration, the second combined value is generated by sequentially adding each random number generated by the random number generating means to the address value of the memory for storing the confidential encryption statement. The hash value of the generated second combined value is calculated, and the value at a predetermined position of the calculated hash value is compared with the identification value. The stirring table is dynamically generated as a sequence of random numbers generated by the time when the value at a predetermined position of the hash value of the second binding value and the identification value match as a result of the comparison. The agitation of the encrypted text is performed using the agitation table dynamically generated in this way.

Therefore, unlike the conventional plaintext encryption / decryption method and device in which data is agitated using a agitation table fixed in a memory and stored, the agitation table that is the key to the agitation process is open to the public or round-robin. There is no such thing as being exposed. Therefore, it becomes difficult to easily return the agitated data to the original data before agitation, and the confidentiality of the ciphertext is improved. Further, unlike the conventional case, a storage area for storing the table value of the fixed table in the memory is not required, so that the memory does not increase.

Therefore, according to the present invention, it is possible to provide a plaintext encryption / decryption method and a plaintext encryption / decryption apparatus that can improve the confidentiality of the ciphertext and do not cause an increase in memory. ..

It is a block diagram which shows the functional structure of the host which comprises the plaintext encryption / decryption apparatus by one Embodiment of this invention. It is a flowchart which shows the plaintext encryption processing performed by the plaintext encryption decryption method by one Embodiment of this invention. It is a table for demonstrating the stirring process of the encrypted sentence performed in the plaintext encryption process shown in FIG. It is a flowchart which shows the plaintext decryption processing performed by the plaintext encryption decryption method by one Embodiment of this invention.

Next, a mode for implementing the plaintext encryption / decryption method and the plaintext encryption / decryption apparatus according to the present invention will be described.

FIG. 1 is a block diagram showing a functional configuration of a host (HOST) 1 constituting a plaintext encryption / decryption apparatus according to an embodiment of the present invention.

The HOST 1 is a personal computer (PC), a microcomputer (commonly known as a microcomputer), or the like, and is connected to an external memory 2 which is an EEPROM (Electrically Erasable Programmable Read-Only Memory) and an HSM (Hardware Security Module) 3. The external memory 2 is not limited to EEPROM, and may be DDR (Double Data Rate), NAND FLASH (NAND Fash Memory), or the like. The external memory 2 is initialized with a random number. The HSM3 is also a cryptographic processor specially designed to protect cryptographic keys.

The HOST 1 includes an internal memory 1a, an identification value generation means 1b, an encryption means 1c, a random number generation means 1d, a first comparison means 1e, a stirring means 1f, a secret encryption means 1g, a storage means 1h, a reading means 1i, and a second comparison. The means 1j, the stirring table extraction means 1k, the stirring encrypted sentence extraction means 1l, the inverse conversion means 1m, the decoding means 1n, the third comparison means 1o, and the tampering determination means 1p are provided as functional blocks.

The HOST 1 is configured as an IC module including a CPU (central processing unit) (not shown) and a ROM (read-only memory) and RAM (readable / writable memory) which are internal memories 1a.

The CPU controls each part according to the computer program stored in the ROM. Each of the above means 1b to 1p is realized by software control according to the computer program of the CPU. However, these may be configured to be realized by hardware by an electronic circuit instead of software control of the CPU. In addition to computer programs, operation parameters and various tables are stored in the ROM. Parameters and the like used in CPU control processing and the like are temporarily stored in the RAM, and are used as a temporary storage work area.

HOST 1 encrypts plain text H stored in the internal memory 1a or input from the outside, and is encrypted to the external memory 2 stored in the internal memory 1a or specified by the address value A input from the outside. The secret encrypted text Z, which will be described later, is saved. The flowchart shown in FIG. 2 is the plaintext H encryption process performed by the CPU at this time, and the flowchart shown in FIG. 4 is the decryption process in which the secret encrypted text Z read from the external memory 2 is decrypted into the plaintext H by the CPU. Represents processing. In the following explanation, the plaintext H, which is the original data, is expressed as "15 5d 39 c0 7d" by the hexadecimal number of 5 bytes, and the address value A = "df 94 f5 2c" expressed by the hexadecimal number of 4 bytes. It is assumed that the data is saved in the external memory 2 at the specified address.

In the plaintext encryption process, first, in the identification value generation step of FIG. 2, step 101 (hereinafter referred to as S) 101, the plaintext H is added to the end of the address value A by the identification value generation means 1b, and the first is the first. Join value {address value / plaintext} = "df 94 f5 2c 15 5d 39 c0 7d" is generated, and the hash value of the first join value HASH1 = "55 89 94 9d 02 d5 55 1c 2c 94 20 0f 22 da a0" 20 8d 01 d8 a2 51 bb e9 27 61 22 aa ac 96 1f af ad ”is calculated by the hash function. In this embodiment, SHA-256 is used as the hash function, but SHA-512, MD5, or the like may be used. The identification value generating means 1b generates a value at a predetermined position in the calculated hash value HASH1, a value "ad" in the last two digits of the end of HASH1 in the present embodiment as an identification value, and uses it as HASH-ID which is confidential information. Save in HSM3 or the like.

Next, in the encryption step of S102, the plaintext H is encrypted by the encryption means 1c, and an encrypted sentence X = "02 a3 f9 76 21 d3 4a c9" having a predetermined length of 8 bytes is generated.

Next, in S103 constituting the first comparison step, the first comparison means 1e generates random number sequences B = “4a”, “fc 4a” ... In order by each random number value R generated by the random number generation means 1d. Random numbers. Then, in S104 constituting the first comparison step, the random number value R generated by the random number generating means 1d is sequentially added to the end of the address value A by the first comparing means 1e, and the second combined value {address value -Random number sequence} = "df 94 f5 2c 4a", "df 94 f5 2c fc 4a" ... are generated in order. Each of the generated second combined values is hashed by the hash function by the first comparison means 1e to generate the hash value HASH2. For example, when the random number sequence B = "fc 4a" is generated in S103, HASH2 = "0d 49 21 78 0a f7 65 2b 9a 02 8e d6 22" from the second coupling value = "df 94 f5 2c fc 4a" in S104. ac 1c 95 43 2e c3 ee 02 74 56 68 e1 9f 86 c1 b1 3e 03 93 ”is generated.

Next, in S105 which constitutes the first comparison step together with S103 and S104, the value of the last two digits of the last two digits in HASH2 of the second binding value obtained by adding the random number value R to the end of the address value A and S101. The HASH-ID, which is the last two digits of the value in the generated HASH1, is compared with the first comparison means 1e. If the comparison results are No and do not match, the process returns to S103, and the random number value R newly generated next by the random number generating means 1d is added to the head of the random number sequence B. Then, in S104, a new random number sequence B is added to the end of the address value A, in other words, a newly generated random number value R is further added to the end of the address value A, and a new second coupling value is added. Is generated, and the new second binding value, HASH2, is calculated. Then, in S105, the last two digits of the value in the new HASH2 and the HASH-ID are compared again.

The processing of S103 to S105 is repeated until the last two digits of the value in HASH2 and HASH-ID match. However, when the data length of HASH2 exceeds the size set as the upper limit in the setting, the random number sequence B is reset so as not to exceed the memory capacity of the internal memory 1a used as the temporary storage area, and S103 to S103 to The process of S105 is re-executed.

For example, a random number sequence B = "81 94 0a e6 9b 76 cb 66 fc 4a" is generated in S103, and HASH2 calculated in S104 is "4b ..... When calculated as "... d 27 22 ad", the last two digits of the value in HASH2 and HASH-ID match with "ad", and the comparison result in S105 is Yes. In this case, in S106 constituting the stirring step, the sequence B = "81 94 0a" of the random number value R generated by the random number generating means 1d and added to the end of the address value A by the time the comparison results in S105 match. "e6 9b 76 cb 66 fc 4a" is input from the comparison means 1e to the stirring means 1f, and the sequence B thereof is set as the stirring table by the stirring means 1f. Then, in S107 in which the stirring step is configured together with S106, the encrypted sentence X is stirred by the stirring means 1f, and the stirring encrypted sentence Y is generated.

In this stirring process, in the present embodiment, the positions of the respective values in the encrypted sentence X are exchanged based on the residual value obtained by dividing each random value R constituting the stirring table by 8 which is the length of the encrypted sentence X. It is done. That is, first, each random value R (= hexadecimal number) 81, 94, 0a, e6, 9b, 76, cb, 66, fc, 4a constituting the stirring table is modularly calculated with the length 8 of the encrypted statement X. , Stirring table, formula 81 mod 8 = 1, 94 mod 8 = 4, 0a mod 8 = 2, e6 mod 8 = 6, 9b mod 8 = 5, 76 mod 8 = 6, cb mod 8 = 5, 66 It is converted to the sequence C = "1 4 2 6 5 6 5 6 4 2" obtained from mod 8 = 6, fc mod 8 = 4, 4a mod 8 = 2. By this conversion, each value constituting the sequence C becomes a value having a length of less than 8 of the encrypted statement X.

The encrypted statement X = “02 a3 f9 76 21 d3 4a c9” is based on this sequence C = “1 4 2 6 5 6 5 6 4 2”, as shown in the table of FIG. Is replaced and agitated. That is, each value of the sequence C is treated as an index representing the position of 0 to 7 of each value of the encryption statement X, and the index 1 of the encryption statement X is based on the two values "1 4" from the beginning of the sequence C. The value "a3" at the position of is exchanged with the value "21" at the position of the index 4, and the encrypted statement X is converted into the encrypted statement X1 = "02 21 f9 76 a3 d3 4a c9". Next, the value "f9" at the index 2 position of the encrypted statement X1 and the value "4a" at the index 6 position are obtained by the two values "2 6" following the value "1 4" in the sequence C. Is exchanged, and the encrypted statement X1 is converted into the encrypted statement X2 = "02 21 4a 76 a3 d3 f9 c9".

Next, the value "d3" at the index 5 position of the encrypted statement X2 and the value "f9" at the index 6 position are obtained by the two values "5 6" following the value "2 6" in the sequence C. Is exchanged, and the encrypted statement X2 is converted into the encrypted statement X3 = "02 21 4a 76 a3 f9 d3 c9". Next, the value "f9" at the index 5 position of the encrypted statement X3 and the value "d3" at the index 6 position are obtained by the two values "5 6" following the value "5 6" in the sequence C. Is exchanged, and the encrypted statement X3 is converted into the encrypted statement X4 = "02 21 4a 76 a3 d3 f9 c9". Next, the value "a3" at the index 4 position of the encrypted statement X4 and the value "4a" at the index 2 position are obtained by the two values "4 2" following the value "5 6" in the sequence C. Is exchanged, and the encrypted sentence X4 is converted into the encrypted sentence X5 = "02 21 a3 76 4a d3 f9 c9". The stirring means 1f sets this encryption sentence X5 = “02 21 a3 76 4a d3 f9 c9” as the stirring encryption sentence Y and outputs it to the secret encryption means 1g.

Next, in S108 of FIG. 2, which constitutes the secret encryption step and the storage step, the stirring encryption statement Y = “02 21 a3 76 4a d3 f9 c9” is added to the stirring table by the secret encryption means 1g. The sequence B = "81 94 0a e6 9b 76 cb 66 fc 4a" that composes the value is added, and the confidential encryption statement Z = "02 21 a3 76 4a d3 f9 c9 81 94 0a e6 9b 76 cb 66 fc 4a" Is generated. The generated secret encryption statement Z is stored in the external memory 2 at the address specified by the address value A = "df 94 f5 2c" by the storage means 1h.

In the decryption process of the secret encrypted text Z, first, in the read step of FIGS. 4 and S201, the secret encrypted text Z is read from the external memory 2 of the address specified by the address value A by the reading means 1i. .. Next, in S202 constituting the second comparison step, the values at the predetermined positions of the confidential encryption sentence Z read by the second comparison means 1j are arranged consecutively with the values at the predetermined positions. The values are added in order, and the sequence B of the random value R is reproduced. In the present embodiment, the values "fc", "66", and "cb" of the last two digits of the confidential encryption statement Z are arranged consecutively back to the value "4a". "..." is added in order, and the sequence B = "... cb 66 fc 4a" of the random number value R is reproduced. Then, the sequence B is added to the end of the address value A = "df 94 f5 2c", and the third coupling value {address value / random number sequence} = "df 94 f5 2c 4a", "df 94 f5 2c fc 4a". "..." are generated in order. Each of the generated third combined values is hashed by the second comparison means 1j with a hash function, and the hash value HASH3 is generated.

Next, in S203 in which the second comparison step is configured together with S202, the value at a predetermined position in the hash value HASH3 of the third coupling value, in the present embodiment, the value of the last two digits at the end is HASH- by the second comparison means 1j. Compared to ID. If the comparison results do not match with No, the process returns to S202, and a value traced back from the end of the read confidential encryption statement Z is further added to the end of the address value A, and a new third combination is added. A value is generated. Then, the hash value HASH3 of the new third binding value is calculated, and in S203, the last two digits of the value in HASH3 and the HASH-ID are compared again.

In S203, when the last two digits of the value in HASH3 and HASH-ID match with "ad" and the comparison result is Yes, then the stirring table extraction step of S204 is performed. At this time, the last two digits of the HASH3 for the third combined value generated by adding all the values tracing from the end of the confidential encryption statement Z to the end of the address value A are HASH-ID. If they do not match, it can be considered that the confidential encryption statement Z has been tampered with.

In step S204, the sequence B = "81 94 0a e6 9b 76 cb 66 fc 4a" of the random number values R obtained side by side at the end of the address value A when the comparison results in the second comparison means 1j match is the stirring table. It is extracted as a stirring table by the extraction means 1k. Next, in the stirring encrypted sentence extraction step of S205, the stirring table extracted in S204 is removed from the confidential encryption sentence Z read in S201 by the stirring encrypted sentence extracting means 1l, and the stirring table and the stirring table are used. It is separated from the confidential encryption statement Z. Then, the sentence from which the stirring table has been removed is extracted by the stirring encrypted sentence extracting means 1l as the stirring encrypted sentence Y = "02 21 a3 76 4a d3 f9 c9".

Next, in the inverse conversion step of S206, the stirring encrypted sentence Y extracted in S205 is inversely converted by the inverse conversion means 1m based on the stirring table extracted in S204, and returned to the encrypted sentence X. .. That is, each random value R81, 94, 0a, e6, 9b, 76, cb, 66, fc, 4a constituting the stirring table is modulo-operated with the length 8 of the encrypted statement X, and each value constituting the stirring table is calculated. However, it is converted into the sequence C = "1 4 2 6 5 6 5 6 4 2" by each of the above-mentioned modulo arithmetic expressions. Then, based on this sequence C = "1 4 2 6 5 6 5 6 4 2", as shown in the table of FIG. 3, each value of the stirring encryption statement Y = "02 21 a3 76 4a d3 f9 c9". The position of is returned to the original position toward the encrypted sentences X5 to X1, and is converted back to the encrypted sentence X = "02 a3 f9 76 21 d3 4a c9".

Next, in the decryption step of S207, the encrypted sentence X obtained by the inverse conversion is decrypted by the decryption means 1n and converted into the original plaintext H = "15 5d 39 c0 7d". Next, in S208 constituting the third comparison step, the plaintext H = “15 5d 39 c0 7d” decoded by the decoding means 1n by the third comparison means 1o has the address value A = “df 94 f5 2c”. The fourth join value {address value / plaintext} = "df 94 f5 2c 15 5d 39 c0 7d" is added to the end of. Then, the hash value HASH4 of the fourth bond value = "55 89 94 9d 02 d5 55 1c 2c 94 20 0f 22 da a0 20 8d 01 d8 a2 51 bb e9 27 61 22 aa ac 96 1f af ad" is calculated by the hash function. The calculated value of the last two digits, which is the value at a predetermined position in the HASH4, is compared with the HASH-ID by the third comparison means 1o.

Next, in S208, which constitutes the tampering determination step together with the third comparison step, the tampering determination means 1p determines whether or not the confidential encryption sentence Z has been tampered with from the comparison result of the third comparison means 1o.

According to the plaintext encryption / decryption method and the plaintext encryption / decryption apparatus of the present embodiment, each random number value R generated by the random number generating means 1d is an external memory 2 that stores the confidential encryption sentence Z. The second coupling value = "df 94 f5 2c 4a", "df 94 f5 2c fc 4a" ... Is generated by sequentially adding to the address value A in FIGS. 2 and S104. The hash value HASH2 is calculated for the generated second combined value, and the last two digits of the calculated hash value HASH2 and the HASH-ID are compared in FIGS. 2 and S105. As a result of the comparison, the stirring table is set in S106 as a sequence B of random numbers generated by the time when the last two digits of the hash value HASH2 of the second binding value and the HASH-ID match. Is dynamically generated. The stirring of the encrypted sentence X is performed as shown in FIG. 3 using the stirring table dynamically generated in this way.

Therefore, according to the present embodiment, unlike the conventional plaintext encryption / decryption method and apparatus in which data is agitated using a agitation table fixed in a memory and stored, the agitation table is the key to the agitation process. Will not be made public or exposed in a round-robin manner. Therefore, it becomes difficult to easily return the agitated data to the original data before agitation, and the confidentiality of the confidential encrypted sentence Z is improved. Further, unlike the conventional case, the storage area for storing the table value of the fixed table in the memory is not required, so that the internal memory 1a and the external memory 2 do not increase.

Therefore, according to the plaintext encryption / decryption method and the plaintext encryption / decryption apparatus of the present embodiment, the confidentiality of the ciphertext can be improved and the plaintext encryption / decryption that does not increase the memory is not caused. An encryption method and a plaintext encryption / decryption apparatus can be provided.

Further, in the conventional plaintext encryption / decryption method and device, for example, even if the data in another memory is overwritten and rewritten in the external memory 2 in which the confidential encryption sentence Z is stored, whether or not the data has been tampered with. I don't know. Further, even if a part of the data in the external memory 2 in which the confidential encryption sentence Z is stored is rewritten, the tampering is not found unless the data structure can be determined that the decrypted data is garbled. However, in the plaintext encryption / decryption method and the plaintext encryption / decryption apparatus of the present embodiment, the plaintext H decrypted by the decryption means 1n in FIGS. 4 and S207 stores the confidential encryption sentence Z in S208. The fourth join value = "df 94 f5 2c 15 5d 39 c0 7d" is generated by being added to the address value A of the external memory 2 to be used, and the last two digits of the hash value HASH4 of the fourth join value. Is compared with HASH-ID = "ad".

The HASH-ID is generated from the last two digits of the hash value HASH1 of the first binding value generated in FIGS. 2 and S101 by adding the original plaintext H to the address value A. Therefore, the last two digits of the hash value HASH4 of the fourth combined value are the last two digits of the last two digits of the hash value HASH1 of the first combined value unless the confidential encryption statement Z is tampered with. , Should match HASH-ID. Therefore, according to the plaintext encryption / decryption method and the plaintext encryption / decryption apparatus of the present embodiment, the last two digits of the hash value HASH4 of the fourth binding value are compared with the HASH-ID. It is possible to determine whether or not the confidential encryption text Z has been tampered with.

In addition, in order to falsify, it is necessary to know the plaintext H, and there is no choice but to falsify without knowing the plaintext H. However, by tampering with the confidential encryption statement Z, the value of the stirring encryption statement Y and the position of each value in the confidential encryption statement Z change, and the value of the plaintext H returned from the stirring encryption statement Y changes. And the position of each value changes, and it is not possible to return from the confidential encryption sentence Z to the original plaintext H. Therefore, when the confidential encryption statement Z is tampered with, the possibility that the last two digits of the hash value HASH4 of the fourth binding value and the HASH-ID match is considerably low. Therefore, it is possible to detect falsification of the confidential encrypted text Z, and it is possible to prevent falsification.

Further, in the present embodiment, the stirring table is associated with the hash value HASH1 of the first binding value and the hash value HASH2 of the second binding value as described above, and the stirring table is dynamically generated in FIGS. 2 and S106. It is possible to improve the tamper-proof property while suppressing the size of the stirring table. As a result, it is possible to realize the difficulty of falsification while simplifying the process of encrypting and decrypting the plaintext H.

Further, in the present embodiment, the stirring table can be extracted when the comparison results in FIGS. 4 and S203 for comparing the last two digits of the hash value HASH3 of the third binding value with the HASH-ID match. In addition to the configuration in which the match between the last two digits of the hash value HASH4 of the fourth join value and the HASH-ID is confirmed in S208, the hash value match confirmation is performed twice. By adopting it, it makes tampering more difficult.

Further, according to the plaintext encryption / decryption method and the plaintext encryption / decryption apparatus of the present embodiment, when the stirring encryption statement Y is back-converted to the original encryption statement X in FIGS. 4 and S206, the encryption statement X is used. If you do not know the length of, add the value of each position that is continuously traced back to the last value to the last value of the secret encryption statement Z read in S201, and add the value of each position to the sequence of random numbers. I don't know if I should play B. Therefore, it is not possible to extract the stirring table obtained as the sequence B of random numbers, and it is not easy to obtain the stirring encryption statement Y by removing the stirring table from the confidential encryption statement Z read from the external memory 2. .. The plain sentence H is a decryption that extracts the stirring encryption sentence Y from the confidential encryption sentence Z, a decryption that reversely converts the stirring encryption sentence Y into the encryption sentence X, and a cryptanalysis that returns the encryption sentence X to the plain sentence H. If and is not done as a set, it cannot be decrypted. Therefore, even if the stirring table is composed of a short sequence of random numbers, it is sufficient to know whether the secret encryption statement Z can be correctly returned to the encryption statement X via the stirring encryption statement Y. It takes time and can encrypt and decrypt plaintext H, which is resistant to attacks by hackers.

Further, according to the plaintext encryption / decryption method and the plaintext encryption / decryption apparatus of the present embodiment, since the external memory 2 is initialized with a random number, secret encryption is performed in the arrangement of the stored numerical values in the external memory 2. The context of sentence Z and its block length become unknown. Therefore, the person who reads the stored numerical value of the external memory 2 cannot determine whether the read numerical value is the initial value of the external memory 2 or the value of the secret encrypted statement Z, and from where to where is the secret encrypted statement Z. I don't know if it's a block. For this reason, it becomes difficult to specify the storage position of the secret encrypted sentence Z in the arrangement of the stored numerical values in the external memory 2, and it is possible to specify and read the secret encrypted sentence Z from the stored numerical values in the external memory 2. become unable.

In the above embodiment, the stirring of the encrypted sentence X in the stirring step of FIGS. 2 and S107 is based on the remainder value obtained by dividing each random number value R constituting the stirring table by the length 8 of the encrypted sentence X. This was done by exchanging the positions of the respective values in the encrypted statement X as shown in FIG. However, the stirring of the encrypted sentence X is performed by using a linear transformation (linear mapping) process by matrix calculation in which each random value R constituting the stirring table is applied to all the values of the encrypted sentence X, and FIG. The inverse transformation in the inverse transformation step of S206 may be configured to be performed by using the linear transformation processing by the inverse matrix calculation of the matrix calculation.

According to such a configuration, all the values constituting the encrypted statement X are agitated by the linear conversion process by matrix calculation. Therefore, the stirring process in the present embodiment is performed by exchanging the positions of the respective values in the encrypted sentence X based on the residual value obtained by dividing each random number value R constituting the stirring table by the length 8 of the encrypted sentence X. Compared to, it is possible to encrypt and decrypt plaintext H that is stronger than the attack by a hacker.

Further, in the above embodiment, the HASH-ID is configured from the last two digits of the hash value HASH1 of the first binding value, and this HASH-ID is used as the last 2 at the end of each hash value HASH2,3,4. It is configured to be compared with the digit value. However, the larger the number of digits of the value constituting the HASH-ID, the longer it takes to generate the random number sequence B and other processing time, but the larger the number, the higher the tamper resistance.

1 ... Host (HOST)
2 ... External memory 3 ... HSM (Hardware Security Module)

Claims (9)

The identification value generation means adds a plain sentence to the address value that specifies the save destination for storing the confidential encryption statement in the memory to generate the first combined value, calculates the hash value of the first combined value, and then calculates the said. An identification value generation step that generates an identification value from a value at a predetermined position in the hash value of the first join value, an encryption step that encrypts the plain sentence by an encryption means to generate an encrypted sentence, and a first comparison means. A random number generated by the random number generating means is added to the address value to generate a second combined value, the hash value of the second combined value is calculated, and a predetermined position of the hash value of the second combined value is calculated. If the comparison result does not match, the random number generated next by the random number generating means is further added to the address value to generate a new second combined value. The process, the process of calculating the new hash value of the second combined value, and the process of comparing the value at a predetermined position in the new hash value of the second combined value with the identified value until the comparison results match. Using the repeating first comparison step and the stirring means as a stirring table using the number sequence of the random numbers generated by the time when the comparison results in the first comparison step match, the encrypted text is stirred to generate a stirred encrypted text. The secret encryption step of adding a number sequence of the random numbers to the stirring encryption sentence by the stirring step, and the secret encryption step of generating the secret encryption sentence by the stirring encryption means, and the secret encryption generated by the storage means. A save step of storing the encrypted text in the memory of the address specified by the address value, a read step of reading the confidential encrypted text from the memory of the address specified by the address value by the reading means, and the first step. 2 The value at a predetermined position of the confidential encryption text read out is extracted as a random number constituting the number sequence of the random numbers by the comparison means, and the extracted random number is added to the address value to generate a third combined value. , The hash value of the third combined value is calculated, the value at a predetermined position in the hash value of the third combined value is compared with the identification value, and if the comparison results do not match, the read-out secret encryption is performed. A process of generating a new third combined value by further adding the values at positions consecutively arranged in a predetermined position of the statement to the address value as the next random number constituting the sequence of the random numbers, the new third The process of calculating the hash value of the combined value and the process of comparing the value at a predetermined position in the new hash value of the third combined value with the identified value are repeated until the comparison results match . 2 By the comparison step and the stirring table extraction means, the stirring table extraction step of extracting the number sequence of the random numbers obtained when the comparison results in the second comparison step match as the stirring table, and the stirring encrypted sentence extraction means . The agitation encryption sentence extraction step of extracting the sentence removed from the concealment encryption sentence obtained by reading the extracted agitation table as the agitation encryption sentence and the agitation encryption sentence extracted by the inverse conversion means are extracted. A reverse conversion step of reverse conversion based on the stirring table and returning to the encrypted text, and a decryption step of decrypting the encrypted text obtained by reverse conversion by a decryption means to obtain the plaintext. Plaintext encryption / decryption method. By the third comparison means, the plaintext decoded in the decoding step is added to the address value to generate a fourth combined value, the hash value of the fourth combined value is calculated, and the fourth combined value is calculated. The third comparison step of comparing the value at a predetermined position in the hash value of the above with the identification value, and the tampering determination means for determining whether or not the confidential encryption text has been tampered with from the comparison result of the third comparison step. The plaintext encryption / decryption method according to claim 1, further comprising a step. The encryption in the encryption step is performed by converting the plaintext into the encrypted sentence having a predetermined length.
The stirring in the stirring step is performed by exchanging the positions of the respective values in the encrypted text based on the residual value obtained by dividing each random value constituting the stirring table by the predetermined length.
In the inverse conversion in the inverse conversion step, the position of each value in the stirring encryption statement is returned to the original position based on the remainder value obtained by dividing each random value constituting the extracted stirring table by the predetermined length. The plaintext encryption / decryption method according to claim 1 or 2, wherein the method is performed. The stirring in the stirring step is performed by using a linear conversion process by matrix calculation in which each random value constituting the stirring table is applied to all the values of the encrypted statement.
The plaintext encryption / decryption method according to claim 1 or 2, wherein the inverse transformation in the inverse transformation step is performed by using a linear transformation process based on the inverse matrix calculation of the matrix calculation. The plaintext encryption / decryption method according to any one of claims 1 to 4, wherein the memory is initialized with a random number. The identification value generation step generates the identification value from the last value in the hash value of the first combined value in which the plaintext is added to the end of the address value.
In the first comparison step, the last value in the hash value of the second combined value obtained by adding the random number generated by the random number generating means to the end of the address value is compared with the identification value and compared. If the results do not match, the end value in the hash value of the new second combined value obtained by further adding the random number generated next by the random number generation means to the end of the address value and the identification value. Made by comparing with
The stirring step is performed by using the sequence of random numbers added to the end of the address value as the stirring table by the time the last value in the hash value of the second binding value and the identification value match. I,
In the second comparison step, the last value in the hash value of the third combined value in which the last value of the read confidential encryption statement is added to the last of the address value is compared with the identification value and compared. If the results do not match, the value at the end of the hash value of the new third combined value, in which the value traced back from the end of the read confidential encryption statement is further added to the end of the address value, and the identification value are used. Made by comparing
The stirring table extraction step is performed by using the sequence of values arranged at the end of the address value as the stirring table when the last value in the hash value of the third binding value and the identification value match. The plaintext encryption / decryption method according to any one of claims 1 to 5, which is characterized. The third comparison step is performed by comparing the last value in the hash value of the fourth combined value with the plaintext decoded in the decoding step added to the end of the address value with the identification value. The plaintext encryption / decryption method according to claim 6, which cites claim 2. The first join value is generated by adding a plain sentence to the address value that specifies the save destination for saving the secret encryption statement in the memory, the hash value of the first join value is calculated, and the hash of the first join value is calculated. An identification value generation means that generates an identification value from a value at a predetermined position in a value, an encryption means that encrypts the plain sentence and generates an encrypted sentence, a random number generation means that generates a random number, and the random number generation means. The random number to be used is added to the address value to generate a second join value, the hash value of the second join value is calculated, and the value at a predetermined position of the hash value of the second join value and the identification value are used. If the comparison results do not match, a process of further adding a random number generated next by the random number generating means to the address value to generate a new second combined value, a new second combined value. A first comparison means that repeats a process of calculating the hash value of the combined value and a process of comparing the value at a predetermined position in the new hash value of the second combined value with the identification value until the comparison results match . The stirring means for generating the stirring encryption sentence by stirring the encryption sentence using the number sequence of the random numbers generated by the time when the comparison results in the first comparison means match as the stirring table, and the stirring encryption sentence. A secret encryption means that adds a sequence of random numbers to generate the secret encryption statement, and a storage means that stores the generated secret encryption statement in the memory at an address specified by the address value. A reading means for reading the secret encryption text from the memory of the address specified by the address value and a value at a predetermined position of the read secret encryption text are extracted as random numbers constituting the sequence of random numbers. The extracted random number is added to the address value to generate a third combined value, the hash value of the third combined value is calculated, and the value at a predetermined position in the hash value of the third combined value is used as the identification value. If the comparison results do not match, the value at the position consecutively arranged in the value at the predetermined position of the read confidential encryption statement is further added to the address value as the next random number constituting the random number sequence. The process of generating the added new third combined value, the process of calculating the new hash value of the third combined value, and the value at a predetermined position and the identification value in the new hash value of the third combined value. A second comparison means that repeats the process of comparing the above until the comparison results match, and a stirring table extraction means that extracts the number sequence of the random numbers obtained when the comparison results in the second comparison means match as the stirring table. ,Extracted Inverse based on the stirring encryption sentence extraction means for extracting the sentence removed from the concealment encryption sentence from which the stirring table is read out as the stirring encryption sentence, and the stirring table from which the extracted stirring encryption sentence is extracted. A plaintext encryption / decryption apparatus including a reverse conversion means for converting and returning to the encrypted text, and a decryption means for decrypting the encrypted text obtained by reverse conversion to obtain the plaintext. The plaintext decoded by the decoding means is added to the address value to generate a fourth combined value, the hash value of the fourth combined value is calculated, and a predetermined position in the hash value of the fourth combined value is calculated. The claim is characterized by comprising a third comparison means for comparing the value of 8. The plaintext encryption / decryption device according to 8.

Images