JPH027080A - Variable enciphering device - Google Patents

Abstract

PURPOSE:To optionally vary enciphering intensity by including information indicating the number of times of enciphering processing block passage in an original key for enciphering and determining the number of times of encipher processing with the information. CONSTITUTION:When a normal sentence is enciphered, the original key for enciphering whose starting (m) bits indicate the number (i) of times of enciphering processing block passage is inputted to a terminal A, the normal sentence is inputted to a terminal B, and an indication signal indicating enciphering is inputted to a terminal D. A deciphering means 1 when inputting the original key for enciphering reads its starting (m) bits to discriminate the number (e.g. 2) of times of enciphering processing block passage, and informs a key supply means 4 and a control means 2 of it. Further, the means 4 generates keys for enciphering corresponding to the number of times of block passage reported from the means 1 according to the input original key for enciphering and supplies them to a processing block 3. The normal sentence from the terminal B, on the other hand, is divided by a dividing means 5 into two, which are inputted to the block 3 and enciphered and outputted to the means 2. The means 2 performs processing so that only the number '2' of times is deciphered and a merging means 6 performs merging processing and outputs the result.

Description

[Detailed Description of the Invention] [Industrial Application Field] The present invention relates to an encryption device that encrypts data, and in particular, the number of times of encryption processing, that is, the number of encryption processing blocks that are passed through the encryption processing block included in the original key for encryption. The present invention relates to a variable encryption device whose strength can be arbitrarily changed.

[Prior Art] An encryption device that encrypts data by giving different encryption keys to n encryption processing blocks and performing encryption processing n times. It has been known. As such an encryption device, for example, DBS (Data E
There is a standard encryption method.

[Problems to be Solved by the Invention] The conventional encryption device described above, for example, the DBS method encryption device, is advantageous for the spread of encryption because the encryption logic itself is made public and it is made into an LSI and sold on the market. Due to the focus on maintaining the strength of data, computer systems that incorporate encryption processing have had the following problems.

(1) When applied to data processing that requires processing large amounts of data, such as data exchange using magnetic tape files, multi-stage encryption processing (n = 16 in the DES method)
(stage encryption processing) requires a large amount of time for encryption, making the overall processing time too long.

(2) Information whose confidential value decreases in a short period of time (for example, a company's financial results report before it is published in a newspaper, etc.)
Even if they are encrypted on the same computer system, they can only be encrypted to maintain the strength of the encryption, which would take years to decipher, similar to important secrets, which results in wasted computer processing time.

The present invention has been made in view of these circumstances,
The purpose is to provide a variable encryption device that can arbitrarily change the encryption strength depending on the number of passes of the encryption processing block included in the encryption key.

[Means to solve the problem]

In order to achieve the above object, the variable encryption device of the present invention performs encryption processing on human data using a supplied encryption key, and outputs the encrypted data. A processing block, a decryption means for inputting an encryption original key including information indicating the number of times the encrypted block has passed, and decrypting the number of times the encrypted block has passed, and a decryption means for decoding the number of times the encrypted block has passed, and a decryption means for decoding the number of times the encrypted block has passed. a key supply unit that inputs the number of times and the original encryption key, generates encryption keys for the number of times the encryption processing block passes from the encryption original key, and sequentially supplies the encryption keys to the encryption processing block; , controlling the number of times the output data of the encrypted processing block is used as input data of the encrypted processing block again according to the number of times the encrypted processing block passed through is decrypted by the decryption means, and performs the encryption processing with the encrypted processing block. It is comprised of a block passing count limit input means for outputting data that has been encrypted for the number of times the block has passed as encrypted data.

[Operation] In the variable encryption device of the present invention, the decryption means decrypts the original encryption key that includes information indicating the number of times the encryption processing block has passed, and the key supply means decrypts the original key that is decrypted by the decryption means. An encryption key is generated for the number of times the encryption processing block has passed from the number of times the encryption processing block has passed and the original encryption key, and the encryption processing block is supplied with the encryption processing for the input data from the key supply means. The block passing count control means controls the number of times the output data of the encrypted block is used as the input data of the encrypted block again according to the number of passes of the encrypted block decrypted by the decryption means. By controlling, data that has been encrypted by the encryption processing block the number of times the encryption processing block has passed is extracted as encrypted data.

[Example] Next, an example of the present invention will be described in detail with reference to the drawings.

Referring to FIG. 1, one embodiment of the present invention includes a processing number decoding means 1, a block passing number controlling means 2, an encryption processing block 3, a key supplying means 4, a dividing means 5, and a merging means. 6, terminal A to which the original key for encryption is added, terminal B to which plaintext (data before encryption) is added during encryption and ciphertext during decryption, ciphertext during encryption and ciphertext during decryption. It consists of a terminal C from which plain text is extracted, and a terminal to which an instruction signal indicating whether to encrypt or decrypt is applied.

The processing number decoding means 1 is a means for decoding the number i of encrypted block passages included in the original encryption key manually entered from the terminal A, and notifying the block passage number control means 2 and the key supply means 4 of the number of times i. It is. Various methods can be considered for including information indicating the number of times i of encryption processing blocks in the original encryption key itself, and the present invention is not limited to such methods. For example, when using a 56-bit original key for encryption as in the conventional DES method, a 56-bit bit string is generated using random numbers, and the first m bits are set to a value indicating the number of times i of the encryption processing block has passed. A method of changing can be adopted. In this case, the processing number decoding means 1 reads m
By decoding the bits, the number i of passing the encryption processing block is obtained.

The key supply means 4 generates an encryption key for the number i of encryption processing block passages notified by the processing number decoding means 1 from the original encryption key inputted from the terminal A, and sequentially performs the encryption processing. This is means for supplying the block 3. for example,
Encryption processing block - If the number of passes l is the maximum n, then -1, -2, and -2 for each different n encryption key.
..., Kn is generated according to a predetermined rule.

Then, when the designated signal applied to the two terminals indicates encryption, the above encryption key is applied to K-1, -2°...
, -2K- is supplied to the encryption processing block 3 in the order of -n, and at the time of decryption, -2K-
1 to the encryption processing block 3 in the order of 1.

The dividing means 5 is a means for dividing the data added from the terminal B into two parts and inputting the divided data to the encryption processing block 3.

For example, if plaintext (or ciphertext) is to be input in 64 bits and encrypted (or decrypted), the dividing means 5 divides it into 32 bits each and inputs it into the encryption processing block 3.

The encryption processing block 3 is supplied with data from the key supply means 4 when the instruction signal at the terminal indicates encryption with respect to the data added from the dividing means 5 or the data added from the block passing number control means B 2. The encryption key is used to perform encryption processing, and the processing result is output to the block passing count control means 2. Also, when the instruction signal at the terminal indicates decryption, the processing result is output from the division means 5. Decryption processing (processing opposite to encryption processing) is applied to the added data or data added from the block passing number control means 2 using the encryption key supplied from the key supplying means 4, and the processing is performed. This is means for outputting the result to the block passing number control means 2.

The block passing number control means 2 is notified by the processing number decoding means 1 of the number of times the output data of the encrypted processing block 3 that is applied to the terminal C is outputted from the terminal a and becomes manual data of the encrypted processing block 3 again. It is a means for controlling according to the number i of passing the encryption processing block, and outputting the data encrypted by the encryption processing block 3 by the number i of passing the encryption processing block from the terminal to the merging means 6 as encrypted data.

The merging means 6 is a means for rearranging the left and right data of the data outputted from the block passing number control means 2, which is divided into two parts of 32 bits each, returning the data to 64 bits, and outputting the data to the terminal C.

Next, the operation of this embodiment will be explained with reference to the drawings.

(Encryption) When encrypting plaintext, for example, as described above, connect terminal A to terminal A. An original encryption key whose I1m bit indicates the number of passes of the encryption processing block is input, a plain text is input to the terminal, and an instruction signal indicating encryption is input to the terminal. In the following, for convenience of explanation, a case will be taken as an example in which the number of times i of encryption processing blocks is passed is "2".

When the original key for encryption is input, the processing number decoding means 1 reads the first m bits of this original key for encryption, identifies the number of times r2J of encryption processing blocks has passed, and decodes this with the key supply means 4 and the block. The number-of-passage system '4'B is notified to the means 2.

In addition, the key supply means 4, according to the original encryption key input manually from the terminal A, supplies - 1, -2 is generated and sequentially supplied to the encryption processing block 3.

On the other hand, the plain text applied to the terminal B is input by the dividing means 5, for example, in 64 bits each, divided into two parts each in 32 bits, and inputted to the encryption processing block 3.

When the data divided into two parts of 32 bits each is inputted from the dividing means 5, the encryption processing block 3 converts the data into, for example, the conventional D
Similar to the encrypted block in the ES encryption device, the data is encrypted using -1 as the encryption key, and the result is output to the block pass count control means 2.

The block passing number control means 2 holds the number of times when the encrypted block passing number "2J" is notified from the processing number decoding means 1, and so that the encryption processing is executed only the number of times "2". Control. Therefore, when the first processing result is output from the encryption processing block 3, it is output from the terminal a and used as manual data of the encryption processing block 3 again.

When the above data is input, the encryption processing block 3 performs the encryption processing again and outputs the result. At this time, the encryption processing block 3 uses -2 as the second encryption key supplied from the key supply means 4 to perform the encryption processing.

The block passage number control means 2 controls the encryption processing block 3
When the processing result is outputted, the encryption processing corresponding to the number of times "2" has been completed, so the data outputted this time from the encryption processing block 3 is outputted from the terminal to the merging means 6.

The merging means 6 performs the merging process described above and outputs a 64-bit ciphertext from the terminal C.

With the above, the encryption process for the 64-bit data in the plain text is completed, and the same operation is repeated for the remaining data in the plain text.

(Decryption) When decrypting the ciphertext to return it to plaintext, input the same original encryption key to terminal A as the original encryption key used during encryption, input the ciphertext to terminal B, and then Inputs an instruction signal indicating that the data should be decoded.

When the original key for encryption is input, the processing number decoding means 1 reads the first m bits of this original key for encryption, identifies the number of passages of the encryption processing block "2", and transmits this to the key supply means 4. and the block passing count control means 2 is notified.

Further, according to the original encryption key input from the terminal A, the key supply means 4 adds -1 to the encryption key for the number of times the encryption processing block has passed, which is notified from the processing number decoding means 1.
-2 is generated and supplied to the sequential encryption processing block 3. At this time, since the key supplying means 4 is instructed to decrypt, it supplies the encryption key to the encryption processing block 3 in the reverse order from that at the time of encryption, that is, in the order of -2, then -1.

On the other hand, the cipher text applied to terminal B is inputted in 64 bits each by the dividing means 5 and divided into two parts of 32 bits each.
The data is input to the encryption processing block 3.

In the encryption processing block 3, when the data divided into two parts of 32 bits each is input from the dividing means 5, the data is decrypted using -2 as the encryption key, and the result is calculated as the number of times the block passes. Output to control means 2.

Block passing count system? The i1 means 2 holds the number of times when the encrypted block passing number "2J" is notified from the processing number decoding means l, and controls the decryption process so that the decryption process is executed for the number of times r2. When the first processing result is output from the processing block 3, it is sent to the terminal a.
The data is outputted from the block 3 and used as the input data for the encryption processing block 3 again.

When the above data is input, the encryption processing block 3 performs the decryption processing again and outputs the result. At this time, the encryption processing block 3 uses -1 as the second encryption key supplied from the key supply means 4 to perform the decryption processing.

When the above-mentioned processing result is output from the encryption processing block 3, the block passing count system jn means 2 determines that the decryption processing corresponding to the number of times "2" has been completed, and therefore The data is output from the terminal to the merging means 6.

The merging means 6 performs the merging process described in iiT and outputs 64-bit plaintext from the terminal C.

With the above, the decryption process for the 64-pinto data in the ciphertext is completed, and the same operation is repeated for the remaining data in the ciphertext.

FIG. 2 is a block diagram showing an example of the configuration of the block passage number control means 2. As shown in FIG. The number i of passing the encrypted processing block notified from the processing number decoding means 1 shown in FIG. 1 is held in the register 20. The contents of this register 20 are changed to the subtraction circuit 20 every time the encryption processing block 3 finishes one encryption process or decryption process and the processing result is input from the terminal C.
By 1, "l" is subtracted. Further, the processing result of the encryption processing block 3 input from the terminal C is stored in the register 24.
is temporarily stored. The gate 22 indicates that the value of the register 20 is “
It opens when the value is other than 0, and outputs the data in the register 24 to the terminal a. On the other hand, the gate 23 is connected to the register 20 (direction is "
0], it opens and outputs the data in the register 24 to the terminal.

〔Effect of the invention〕

As explained above, the variable encryption device of the present invention includes information indicating the number of times data passes through the encryption processing block in the original key for encryption, and uses this information to determine the number of times data passes through the encryption processing block, i.e., the number of times data passes through the encryption processing block. The number of processing times is determined, and the amount of data handled by the information processing system1
This has the advantage that encryption strength and encryption performance can be flexibly set in accordance with confidentiality. In other words, increasing the number of times the encryption processing block passes will slow down the processing speed, but will provide stronger encryption, so it is especially suitable for encrypting important small debt information. If the number is reduced, the encryption strength will be weak, but the processing speed will be high, so it is possible to realize cryptographic processing suitable for encrypting a large amount of information without a very long concealment period.

[Brief explanation of the drawing]

FIG. 1 is a block diagram of an embodiment of the present invention, and FIG. 2 is a block diagram showing an example of the structure of the block passage number control means 2. In FIG. In the figure, l... Processing number decoding means 2... Block passing number controlling means 3... Encrypted processing block 4... Key supplying means 5... Dividing means 6... Merging means

Claims (1)

[Claims] An encryption processing block that encrypts input data using a supplied encryption key and outputs the encrypted data; and information indicating the number of times the encryption processing block has passed. a decryption means for inputting an original key for encryption including a code, and decoding the number of times the encrypted block has passed; inputting the same number of passes for the encrypted block decrypted by the decryption means and the original key for encryption; key supply means that generates encryption keys for the number of times the encryption processing block passes from the encryption original key and sequentially supplies the encryption keys to the encryption processing block; The number of input data of the encrypted processing block is controlled according to the number of times the encrypted processing block is passed, which is decrypted by the decryption means, and the encrypted data is encrypted by the encrypted processing block the number of times the encrypted processing block is passed. What is claimed is: 1. A variable encryption device comprising block passage count control means for outputting as data.