JPH1032568A - Ciphered transmission method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a ciphered transmission method by which decoding and data forgery are difficult and a distribution system of a ciphering key is not required. SOLUTION: In the case of ciphered transmission data 12 by using ciphering keys 14, 17 and sending the ciphered data, a nonvolatile storage medium with lots of ciphering keys 14, 17 and their ciphering numbers registered to them is provided respectively to a transmitter side 10 and a receiver side 11. In the case of transmission and reception, the transmitter and receiver sides 10, 11 select any of the ciphering keys not in use and registered in the nonvolatile storage media and confirm number of the ciphering keys 14, 17 not in use or used and send/receive the transmission data by using the selected and not in use ciphering key and the ciphering key used for the transmission reception is stored in the nonvolatile storage medium at the transmitter side as the key that is used.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

TECHNICAL FIELD The present invention relates to personal computer communication and L
The present invention relates to an encryption transmission method for performing data transmission in an AN, a WAN, or the like.

[0002]

2. Description of the Related Art Recently, security of electronic information has been increasing due to the spread of the Internet. Already, in the world of personal computer communication, online shopping for purchasing products through a network has been widely performed. In the "Cyber Mall Experiment" in which a fictitious shopping street is created on a WWW server on the Internet, product sales have begun.

At present, when conducting business transactions using the Internet or personal computer communication, a credit number is sent to the other party,
Settled.

However, this method is extremely low in security.

First, since the card number is stamped on the card, it can be seen by anyone. In the case of the Internet, since data flows to a partner computer via a plurality of computers, there is a high possibility that data will be eavesdropped on the way, and the data can be easily tampered with.

To cope with these problems, various encryption methods, electronic currencies, and electronic approval methods have been devised.

[0007] In general, an encryption system is a method in which, when data is transmitted, a third party converts the data into a data that cannot be seen even by a third party based on a certain rule, and the receiver decrypts the encrypted message into the original sentence. That is.

At present, there are many cryptosystems, and all use a series of numerical values called keys for encryption and decryption. If the key (encryption key) used at the time of encryption is changed, the cipher text to be generated changes.

[0009] The encryption method includes a "symmetric cryptosystem" in which an encryption key and a decryption key are the same,
"Asymmetric Cryptographic System (Asymmetric Cry
ptosystem) ”.

[0010] "Symmetric cryptosystem" is also called "secret key number". In the "symmetric cryptosystem", once the key number is known, the ciphertext can be easily read thereafter, and key management is an important issue.

On the other hand, an “asymmetric cryptosystem” is also called a “public key number” and utilizes the fact that even if an encryption key (or a decryption key) is made public, its reliability can be maintained. Encryption ”.

[0012]

One of the most common cryptographic systems is the Kerberos system. The Kerberos system is a computer network encryption system currently operated by MIT or the like and is an encryption system that manages encryption keys at a “key issuing authority” and an “authorization certificate issuing authority”.

Each time a client communicates with a server, it receives an encryption key from an "authorization certificate issuing authority". Communication between the "authorized certificate issuing authority" and the client is the "key issuing authority"
Encrypt with the key received from.

The Kerberos system is a highly reliable system. However, it is necessary to set up a "key issuing authority" and an "authorizing certificate issuing authority", or to issue an "authorizing certificate issue" every time communication with a server is performed. There are many problems in disseminating it to the public, such as the need to obtain an encryption key from the "bureau."

If the key used between the "authorization certificate issuing authority" and the client is known, all information may be decrypted. Also, it becomes possible to forge data.

An object of the present invention is to provide an encrypted transmission method which solves the above-mentioned problems, has excellent information concealment ability and forgery prevention ability, and can easily set an encryption key at the time of communication. .

[0017]

SUMMARY OF THE INVENTION In order to achieve the above object, the present invention provides a method for encrypting transmission data using an encryption key and transmitting the encrypted data. A non-volatile storage medium in which the encryption number and the encryption number are both registered is prepared, and at the time of transmission / reception, one of the unused encryption keys registered in the non-volatile storage medium is selected on the transmission / reception side. Check the number of used or used encryption keys, transmit / receive data using the selected unused encryption key, and record the encryption key used at the time of transmission / reception as used in the non-volatile medium of the transmission / reception side. Transmission method.

According to the above configuration, at the time of communication, the transmission / reception side uses the encryption key registered in the non-volatile storage medium, so that the encryption key is random. Since the number of remaining encryption keys is checked, it is very difficult to decrypt the transmitted data and forge the data unless the data in the storage medium storing the encryption key is stolen. Also, even if the connection is possible with the communication password, etc. known, transmission / reception is not possible unless the encryption key can be decrypted, and the remaining number is checked. Can be found connected.

[0019]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A preferred embodiment of the present invention will be described below in detail with reference to the accompanying drawings.

FIG. 1 shows a basic system configuration of the encrypted transmission method according to the present invention.

In the figure, 10 is a transmission side, 11 is a reception side, 12 is transmission data, 13 is an encryption unit, 14 is an encryption key stored in a non-volatile storage medium such as an IC card, FD, MO, HDD, etc. Reference numeral 15 denotes a transmission line such as a public line, LAN, or WAN, 16 denotes a decoding unit, 17 denotes an encryption key storing the same encryption key as that of the transmission side 10, and 18 denotes received data.

First, in the protocol for encryption at the time of transmission and reception, the encryption keys 14 and 17 stored in the non-volatile storage medium to be used are selected between the transmission side 10 and the reception side 11.
The transmission data 12 is encrypted by the encryption unit 13 using the selected encryption key 14, transmitted to the receiving side 11 via the transmission line 15, and decoded by the decoding unit 16 using the selected encryption key 17. The data is decrypted and becomes the received data 18.

The encryption keys 14 and 17 are used to select one of a large number of encryption keys stored in the non-volatile storage media of the transmission and reception sides 10 and 11 by the encryption protocol. A flag is set on the encryption key to distinguish the unused encryption key from the unused encryption key as a used encryption key, and the used encryption key used once is prevented from being used again, and the used or unused encryption key is simultaneously used. Is calculated, and at the time of selecting an encryption key, a match between the selected encryption key and the remaining number is detected, and then encryption and decryption are performed with the encryption key.

As shown in FIG. 3, a set 22 of encryption keys 1, 2, 3,... Corresponding to an encryption number 21 is registered in an encryption key table 20 stored in a nonvolatile storage medium. When used in communication with the device 21, the used flag 23 is set up and stored.

An apparatus configuration using the encryption table 20 will be described with reference to FIG.

In FIG. 4, reference numeral 30 denotes an operation unit including a CPU, 31 denotes a storage unit such as a RAM, 32 denotes an input device,
Reference numeral 33 denotes an output device such as a CRT or a printer, and reference numeral 34 denotes a communication control unit for inputting or outputting data, and these are connected by a bus line 35. An encryption / decryption unit 36 is connected to the bus line 35, and a transmission line 38 is connected to the encryption / decryption unit 36 via a communication control unit 37. The encryption / decryption unit 36 has a storage unit 39 storing the encryption key table 20 shown in FIG.
Is connected.

FIG. 2 shows a specific example of performing data transmission by personal computer communication using a public line.

In the figure, reference numerals 40 and 41 denote transmission / reception side computers (A ₁ and A ₂ ), reference numerals 42 and 43 denote transmission / reception side encryption devices (C ₁ and C ₂ ), and reference numerals 44 and 45 denote transmission / reception side encryption key tables. , 47 and 47 are modems (E ₁ , E ₂ ), and 48 is a public line. Note that between the computers 40 and 41 and the encryption devices 42 and 43 (B ₁ , B
₂ ) and signals between the encryption devices 42 and 43 and the modems 46 and 47 (D ₁ , D ₂ ), where RD is reception data, SD is transmission data, CD is carrier detection, and ER is terminal device ready.

The transmission and reception procedures in the apparatus shown in FIG. 2 are shown separately in FIGS. 5 and 6 along the line AA.

FIGS. 5 and 6 show a computer (A1) 40.
FIG. 5 shows a procedure for transferring data from the computer to the computer (A2) 41. As shown in FIG. 5, when an operator makes a data transfer request, he or she inputs a password which is the ID of the transmission side and makes a transmission request. , Encryption device (C1) 4
2 is sent the destination phone number and password, and the modem (E
1) A calling signal is received by 46 via the public line 48 to the modem (E2) 46 on the receiving side, which is the destination, and the CD on the receiving side is turned ON, the line is connected, and the CD on the transmitting side is connected almost simultaneously. Is also turned ON.

When the carrier is detected, the encryption device (C1) 42 stores the C1 device number in the encryption key table stored in itself in the encryption device (C2) 43 on the transmission side.
, And in response to this, the transmitting-side encryption device (C2)
43 receives the device number of the partner station, reads the same encryption key table as that of the partner station based on this, selects one of the unused encryption keys from the table, and selects the encryption key of the encryption key and the encryption key ( Pair) and the used encryption number flagged and the password of the partner station are obtained. Subsequently, the local station apparatus number (C2) and the encryption number selected from the encryption key table are transmitted to the encryption apparatus (C1) 42 on the transmission side.

The encryption device (C1) 42 on the transmission side refers to the encryption key table corresponding to the device number (C2) and confirms that there is an unused encryption key corresponding to the encryption number.
When the unused encryption key exists, the encryption key (set) corresponding to the used encryption number (remaining number) and the encryption number is obtained.

Subsequently, as shown in FIG. 6, the encryption data of the password and the number of used encryptions are transmitted to the encryption device (C
2) Send to 43.

The encrypting device (C2) 43 on the receiving side checks the password transmitted as encrypted data from the transmitting side with the number of used encryptions, and if the password is correct, transmits a connection permission to the transmitting side and simultaneously transmits an encryption key. The encryption key (set) selected from the table is flagged as used, and the CD is turned on to connect to the computer (A2) 41. At the same time, the transmission-side encryption device (C1) 42 also receives the connection permission reception, determines that the encryption key in its own encryption key table has been used,
The CD is turned on to connect to the computer (A1) 40.

As described above, in the encryption protocol, if it is confirmed that the transmission and reception sides are the right holders, the encrypted data is encrypted and decrypted using the selected encryption key, and the data is encrypted. When data transmission and reception are completed, the receiving side turns off ER and disconnects the line.
On the transmission side, the CD is turned off in response to this, and the data transmission / reception ends.

In this encrypted transmission method, if the transmission / reception partner is predetermined communication, that is, communication between a specific user and a maker, for example, a host computer and a site terminal in a parking lot failure diagnosis system, the site of a power plant and the head office It can be used for communication between devices.

Also, in electronic commerce communication between the computer of the card company and the personal computer of the card holder, a business transaction can be performed by passing the storage medium containing the encryption key table to the card holder and communicating based on this.

The storage medium containing the encryption key table is:
After a predetermined number of communications, the data can be updated to a new one, and if the storage medium is stolen, the data can be updated to a new one, so that the security can be further improved.

In the above embodiment, an example of personal computer communication using a modem has been described. However, a LAN or a WAN can be used.

FIG. 7 shows an example in which the encrypted transmission method of the present invention is applied to a LAN. In the figure, reference numeral 60 denotes an administrator server, 61 denotes an encryption device connected to the server 60, and 62 denotes an encryption device. 61 is an administrator encryption key table connected to 61.

The administrator server 60 is connected to a LAN 63 via an encryption device 61, and a number of personal computers 64, 64 are connected to the LAN 63.

In FIG. 7, the management server 60
It is a server that only administrators can access,
The administrator server 60 allows the administrator to select an arbitrary personal computer 64.
When the management server 60 accesses the management server 60 by inserting a floppy 65 having the same data as the encryption key table 62 into the personal computer 64, the management server 60 can access the unspecified personal computer 64 by the LA.
Even if the connection is made via N63, access by anyone other than the administrator can be disabled, and the security of the management server 60 can be maintained.

This access procedure is the same as the procedures in FIGS. 5 and 6.

In this case, the encryption device (C ₁ ) shown in FIG.
The function of 42 is emulated by software in the personal computer 64 to be used.

FIG. 8 shows an example of encrypted transmission when the in-house network 70 is separated from the outside LAN 72 or the public line 73 by the firewall 71.

Since the firewall 71 often allows access to the inside only when a predetermined machine goes through a certain procedure, it cannot be accessed from a general personal computer. When it is desired to refer to the data of the in-house network 70 from a business trip destination, the access to the in-house network 70 can be managed by using the encrypted transmission method of the present invention.

That is, a business traveler is provided with a DICS card or a floppy disk 74 containing an encryption key table, while the same encryption key table 75 as the encryption key table held by the business traveler is provided along with the business traveler ID on the firewall 7.
1 and prepare a DIC
Using the S card or the floppy 74, the provider 77
Can be accessed by communicating via
8 can also be accessed via the public line 73.

Thus, a business traveler who wants to access an in-house network can be provided with a DICS card or the like containing an encryption key table, thereby authenticating an authorized user and encrypting data. In addition, DICS owned by business travelers
The card has a low communication frequency and is disposable. Even if the card is lost on a business trip, access to the card becomes impossible if the fact is notified and the corresponding encryption key table on the firewall 71 side is deleted. Although access is possible before erasure, hacking through the firewall 71 becomes extremely difficult if the access time is limited by one encryption key.

[0049]

In summary, according to the present invention, at the time of communication, the transmission / reception side checks the encryption key registered in the non-volatile storage medium and the remaining number of encryption keys, so that the decryption by a third party is practically impossible. It is impossible, and even if the connection is possible with the communication password etc. known, transmission and reception is impossible unless the encryption key can be decrypted, and in the next connection, the remaining number will be checked, The connection itself becomes impossible to connect.

[Brief description of the drawings]

FIG. 1 is a schematic diagram showing an embodiment of the present invention.

FIG. 2 is a diagram showing a device configuration in personal computer communication in the present invention.

FIG. 3 is a diagram showing details of an encryption key table in the present invention.

FIG. 4 is a diagram showing a system configuration of an apparatus according to the present invention.

FIG. 5 is a diagram showing a communication procedure of the encrypted transmission method in FIG. 2;

FIG. 6 is a diagram illustrating a continuation of the communication procedure of the encrypted transmission method in FIG. 5;

FIG. 7 is a diagram showing a device configuration when applied to a LAN in the present invention.

FIG. 8 is a diagram showing a device configuration for accessing from outside in the present invention.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 10 Sending side 11 Receiving side 12 Transmission data 13 Encryption section 14, 17 Encryption key 16 Decoding section 17 Received data 20 Encryption table

Claims (1)

[Claims] When transmitting transmission data by encrypting it using an encryption key, a nonvolatile storage medium in which a large number of encryption keys and their encryption numbers are registered in advance is prepared on the transmission side and the reception side. At the time of transmission / reception, the transmission / reception side selects one of the unused encryption keys registered in the non-volatile storage medium, confirms the number of unused or used encryption keys of the encryption key, and selects the selected encryption key. An encrypted transmission method comprising transmitting and receiving transmission data using an unused encryption key, and recording the used encryption key as used in a non-volatile medium on the transmission and reception side.