JPH04178038A - Secrecy security system in data transfer system - Google Patents

Abstract

PURPOSE:To improve the reliability of secrecy at data storage of a receiver side and at data transfer by sending and receiving a data subject to ciphering with a cryptographic key between plural information processing units and transmitting/receiving the cryptographic key just before a substantial data is processed at the receiver side. CONSTITUTION:When data transfer is commanded to a host computer 2 at a terminal equipment 1, the data is sent to the computer 2 while the data transferred and printed is ciphered by using a cryptographic key. The terminal equipment 1 receiving a cryptographic key transmission enable sends a cryptographic key 2 to the computer 2. When the computer 2 detects the reception of the cryptographic data, a reception program is started and the data is stored in a hard disk 25 and the number of the terminal equipment sending the cryptographic key transmission enable is registered in a print queue. Then the cryptographic key transmission enable is sent and when the cryptographic key is received, the cryptographic data is decoded and printed out by a printer 26.

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to a notification protection method for protecting the confidentiality of transferred data during data transfer between information processing devices using a communication line.

[Prior art] Conventionally, in online systems using communication lines,
#There is one as shown in JP-A-61-24552. In other words, in a system where the terminal device and the host combiator are connected to the communication line, the password can be used to connect the terminal device and host combiator. 1illi2iR gold control, after the same connection, terminal table 1 and host combination 1 - before data transfer at dusk; send and receive information indicating 1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000. The data is encrypted according to the information indicating the method, Kll is sent, and immediately after receiving the data, the host computer side converts the received data into data! In order to return the data to the state before conversion according to the information indicating the conversion method, it is necessary to make sure that even if the data is read on the converter, the data will not be secretly leaked.

[Problems to be Solved by the Invention] In the above-mentioned conventional technology, between the terminal device and the host combinator,
Since information indicating how to convert data is sent and received directly during data transfer, if the communication line is monitored, the data f
It is easy to make a correspondence between the information indicating the fighting method and the transferred data, and there is a possibility that secrets may be leaked during data transfer. 9. The host combiator 's-'+'' returns the data received from the terminal ffjt to the state before % conversion immediately after receiving it, and does not take into account cases where the data is not processed immediately. Data stored until processing can be read by other devices, and data confidentiality may be compromised.
There are five problems that could potentially occur.

The purpose of the invention is to completely improve the efficiency of AVF protection during data transfer and during data storage during data processing after receiving data damage in 1G video.

[Means for solving the problems] In order to achieve the above objectives, the central office] devices, storage devices, input/output Vi! ll, a display device, which transmits data to a first information processing device in row 5, and a central processing device 3! This is achieved by providing the means described below in the second information processing device, which consists of a device, a storage device, and an input/output device, and receives nine data transmitted by the first information processing device.

First Information Processing Device> (1) First input means for inputting data transfer instructions to the information processing device.

(2) A second input means for inputting an instruction to select data to be transferred to the entire information processing device.

(3) Ninth encryption ill to encrypt the data to be transferred
a third input means for inputting the information into the information processing device;

(4) Transmission data file that stores all data to be transferred.

(5) Data reading means for reading all selected data from the transmission data file.

(6) Encryption means that encrypts all input twI encryption power ratio and selected data.

(7) Encrypted data transmitting means for transmitting the input data to the second information processing device.

(8) Encryption key transmitting means for transmitting encrypted # to the second information processing device.

(9) Encrypted key transmission permission receiving means for receiving encryption key transmission permission from the second information processing device indicating that encryption at transmission may be performed.

<l! 2 Information Processing JAlt> (1) A reception data file that stores reception data from the first information processing device.

(2) Storage means for storing all received data in a received data file.

(3) Encrypted data receiving means for receiving encrypted data from the first 11llf information processing device.

(4) Encrypted abuse transmission permission sending means for transmitting encryption key transmission permission indicating that the encryption key may be transmitted to the first information processing device.

(5) The encryption key from the information processing device? Encryption key receiving means to receive.

(6) Decryption means for decrypting received data using an encryption key.

[Usage] In an information processing system employing the present invention, a first information processing device is instructed to transfer data to a first input means, and data to be transferred is selected to a second input means. When the encryption key for encrypting the data is input by the third input means, the first information processing device reads the data selected from the digital transmission data file to the data reading means, and encrypts the data. The data inputted by the means is encrypted using the nine cryptographic power ratio keys, and the encrypted data transmitting means transmits the encrypted data to the second information processing device. After receiving the encrypted data in the power ratio data receiving means, the information processing bag lit stores the received power ratio data in the storage means =9 in the received data file and decrypts the encrypted data. Immediately before processing the data in the encrypted data, the encryption key is transmitted by the encryption key transmission permission transmitting means to the ninth information processing device that decrypts the encrypted data. A request for permission to send the encryption key is sent to the first information processing device. The first information processing apparatus it, which has received the encryption key transmission permission by the encryption key transmission M permission receiving means, transmits the encrypted m to the second information processing apparatus by the encryption key reception means. The second information processing device, which has received the F encryption key in the encryption key receiving means, uses the encryption key to decrypt the encrypted data received from the first information processing device using the decryption means.

In this way, data encrypted with an encryption key is transmitted and received between the first information processing device and the second information processing device, and the unencrypted data of the encrypted data received by the second information processing device is transmitted and received. By processing data, sending and receiving encrypted *' data, receiving it, receiving it, and then decrypting all 9-level encrypted data, even when the communication line is being monitored during data transfer. The data on one communication line and the original data are all
Since the encrypted data and the encrypted β are sent and received using a timer, it is difficult to establish a correspondence between the encrypted data and the encryption key, and even if the data is read out, it is difficult to decrypt the data. This improves the security of confidentiality during data transfer. Furthermore, even if the received data is retrieved from another first information processing device after it is received by the second information processing device and before it is processed, the data cannot be deciphered and the data cannot be saved. The MM nature of security protection is improved.

[Example] Hereinafter, an example of the present invention will be described using the drawings. Note that this embodiment is an example in which the present invention is fully applied to a system consisting of a terminal device and a host combinator that performs printing.

First, FIG. 1jc2 shows the connections between the terminal device and the host combination terminal according to the present invention. Terminal devices 18 to 1b and host combination 2dL A N (L
OQ&l Area Network) 5 Send and receive data via f. Host Combiator 2 is a terminal*
The next data is printed from the stations 11 to 1b.

FIG. 5 shows the hardware structure of the terminal devices 1a to 1b and the mist combiator 2 shown in FIG. 2.

First, the hardware configuration of the terminal devices i11a to 1b will be explained using FIG. 3(a)'fc.

The central processing unit (CPU) 10 has main memory (MM)
11, executes various programs related to data transmission and reception, and controls all peripheral devices. CPU1
The contents of the display data stored in the video memory (VRAM) are displayed on the display device (CRT) 14.

Data transfer instructions, selection of transfer data, and input of encryption keys are performed from the keyboard (KB) 15. The fixed disk device (DD) 15 performs data encryption and stores various programs and data related to data transmission and reception.The communication control unit (CDRT/) 16 is a LAN 3tl
- communicates with the host combiator 2 via.

Data transfer between these peripherals 11i11-15 and the CPU 10 is performed via the bus 17.

Next, the hardware configuration of the host combination 2 will be explained using FIG. 5Cb)k. Central processing unit (
The CPU) 20 decodes data on the main memory (MM) 21, executes each program for transmitting and receiving data, and controls peripheral devices.5. The content of the display data stored in the video memory (VRAM) 22 by the CPU 20 is displayed on the display device (CRT) 24. The flk operation of the host computer 2 is performed from the keyboard (KB) 15. Fixed disk device #CHD D) 25
It also stores various programs and data related to data decoding and data transmission and reception. Printer (PRT)
At 26, the host combiator 2 receives the data from the 1-tree device 1 and prints the data. Communication control unit (CDRV)
Communication between the terminal device 1 and the host combiator 2 is performed via the 271C1 LAN 3i. These peripheral devices 21-2
6 and CPO 20 via the td/Z bus 28.

For a long time, host computer 2's mark on non-invention 41J
Figure 4 about the queue structure? I will explain using The print queue 400 includes a queue header 410 and queue blocks 420ρ corresponding to each data. Queue header 410 and queue block 420q,
Key block storage position, tk indicated by voice/reference 421.4
22. 422 is the tth upward pointer that refers to the cube block 420 in the header direction, and 421iJ is the downward pointer that refers to the cube block gold header in the opposite direction. However, each cue block has a cue block 420.
A file name 423 of data corresponding to the file name 423 and a terminal device number 424 for identifying all nine terminal devices to which the data is transferred are described. The print queue 400 is the ninth one that completely controls each print order, and the data print queue 400
To fd, write the file name of the data and the terminal device number of the terminal device that sent the data! −? , - means that the block follows the last queue block 420. Then, printing is performed from the first queue block 420, the first queue block 420, the first queue header 410, and the first key block 420, and after the mark 41I, the key block 423 is printed.
will be deleted.

For a long time, as explained above, the data transfer processing and markings for the Masukibukuro Nao 1a-1b and the host combination 1-Y2 Kaunaru System Kk! 11 processing will be explained using FIG.

Reference numeral 100 indicates the data transfer process in the supplementary tables fi1a to 1b, and reference numerals 12D and 140.160 indicate the operating system operating program that controls the startup of programs in the host computer 2, and the terminal device 1, respectively.
It shows a receiving program that receives data transmitted from a to 1b, and a printing program that performs print processing. Note that 140 and 160 operate independently on the multitasking operator/goo system program.

First, data transfer processing of the terminal device 1 will be explained.

When data transfer to the host combination controller 2 is instructed in the terminal device L1'/c, a data transfer process 100 is started. In data transfer processing 100);, first, data to be transferred and printed is selected n (101), data? When the ninth encryption key to be encrypted is entered manually (102), the data is encrypted with the encryption key and sent to all host combinators 2 (103). Recently, the host combiator 2 sends an encrypted key to the terminal device by transmitting an encrypted key *' to the host combiator 2.
It waits until it receives f-allow (104). After receiving the permission to send the encryption key, the fc layer end transfer cover 1 sends the encryption key to the host computer 2 (1OS).

The processing of the host computer 2 will now be explained.

When the host combiator 2 detects reception of encrypted data (180), it starts the operating system program 120i and the reception program 140. The reception program 140 is started and the encrypted data sent from the terminal 1i1 is received and transferred to the fixed disk fil25.
141), and registers the encrypted data in the terminal device Isekin Printing Key 400 of Mizuki Kosui who sent the encrypted data (142). Then, the print program 160 is started (143). However, at that point it was already) 2 seals 4 II
If program 160 has already been started, the startup weight n
7, print program 160ζ, first print queue 400
An encrypted transmission permission fee is sent to the terminal device with the number registered at the beginning of the encryption key (16
1). When receiving encryption #, print key S-400
The encrypted data having the file name registered at the beginning of the file name is canceled and decrypted using the nine-dimensional power ratio (163), and the decrypted data is printed on the printer 26 (164). The beginning of the print key 400 is deleted at the arrow (165). Finally, if the encryption key cannot be received because the source on the end device side is disconnected or the like, the processing in steps 165 and below is performed. Then, the processes 161 to 165 are performed until there is no more encrypted data registered in the print key 400.

In the above embodiment, the terminal device [1 and the host combinator 2]
and the data transfer method between the host combinator 2 and the host combiator 2.
The data storage method in Terminal 1 is to completely encrypt the data entered by the user on the terminal device 1 and encrypt it overnight. The host combiator 2 sends the data ta, receives it, and sends the encryption key t to J'J, who then receives the encryption key and encrypts the data using the encryption key. It decodes the . In this way: Even when LANA is being monitored, the data on LANA and the original data are completely different, so the encrypted data and the encrypted S,
Transmission and reception are performed after a certain amount of time.

Nine, it is difficult to establish a correspondence between encrypted data and encryption key.
It is possible to protect confidentiality during data transfer.

In the host combination Tame-Yu 2, the data is encrypted and stored in secret until just before it is printed, so it is possible to protect the confidentiality of the data when it is saved.

[Effects of the invention] If the present invention is implemented, data encrypted with an encryption key can be sent and received between multiple information processing and processing devices connected using one communication line, and the original data can be sent and received using a receiving device. The efficiency of decrypting encrypted data immediately before processing - for all transmission and reception: 15 reliability of FM secure protection during data transfer and data storage on the receiving side is the same as above. .

[Brief explanation of the drawing]

Figure 1 is 1 tree f! 7! 7+:I-chart of the data transmission/reception g1 process executed by Fumoto, the data transmission/reception process and print process executed by the host combiator, and Figure 2 shows the connections between the terminal device and the host combiator. FIG. 6 is a block diagram of the terminal device and the host combiator, and FIG. 4 is an explanatory diagram of the print queue of the host combiator. Explanation of symbols 1--terminal device, 2... host combinator, 3...
- LAN, 100 - data transfer tin salt, 120... operating system program, 14o... receiving program, 160... printing program, 400...
・Print queue

Claims (1)

[Claims] 1. One or more first information processing devices each including a central processing unit, a storage device, an input/output device, and a display device; and a second information processing device having an encryption key, the first information processing device includes an encryption means for encrypting data with an encryption key, and an encryption means for encrypting data with an encryption key; an encrypted data transmitter for transmitting to an information processing device; an encryption key for receiving encryption key transmission permission from the second information processing device indicating that the encryption key may be transmitted to the second information processing device; A transmission permission receiving means and an encryption key sending means for sending the encryption key to the second information processing device are provided, and the second information processing device is configured to send the encrypted data to the first information processing device. an encrypted data receiving unit that receives the encrypted data from the device; an encrypted key transmission permission transmitting unit that transmits the encryption key transmission permission to the first information processing device immediately before processing the received data;
Encryption key receiving means for receiving the encryption key and decryption means for decrypting the encrypted data using the encryption key are provided, and the first information processing apparatus receives the data encrypted using the encryption key. and the second information processing device receives the encryption key from the first information processing device and decrypts the encrypted data with the encryption key, immediately before processing the received encrypted data. A security protection method for data transfer characterized by: 2. The security system for data transfer according to claim 1, wherein the encrypted data received by the second information processing device is decrypted immediately before being processed. 3. The security protection system for data transfer according to claim 1, wherein the second information processing device receives the encryption key for decoding the encrypted data immediately before processing the received encrypted data. 4. Data encrypted with the encryption key is transmitted and received between information processing devices using a communication line, and the receiving side receives the encryption key immediately before processing the received encrypted data, and 1. A security protection method for data transfer, characterized in that the encrypted data is decrypted using an encryption key.