JPH11161167A - Device and method for ciphering and recording medium which records ciphering program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To decode the ciphered sentence data, which are ciphered by a user, by a third party who is other than the user and is given a secret key. SOLUTION: Every time plain sentence data are ciphered, a throwaway key is generated. Then, the data are ciphered employing the generated key and ciphered data are generated. Then, the throwaway key is ciphered by a user intrinsic key and an open key and first and second ciphering keys are generated. Then, the ciphered data and the first and the second ciphering keys are stored in a ciphering file. When a user deciphers the ciphered sentence data, the user obtains the throwaway key by decoding the first ciphering key using the user intrinsic key. If the third party, who is given a secret key, decodes the ciphered sentence data, the party obtains the throwaway key by decoding the second ciphered key using the secret key. Then, using the throwaway key, the ciphered sentence data are decoded into the plain sentence data.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to an encryption device, an encryption method, and a computer-readable recording medium.

[0002]

BACKGROUND OF THE INVENTION Encryption of plaintext and decryption of ciphertext in a cryptographic device are known using a common key cryptosystem and a public key cryptosystem.

In the common key cryptosystem, the key used for encrypting plaintext and the key used for decrypting ciphertext are the same.

In a public key cryptosystem, a plaintext is encrypted using a public key, and a ciphertext is decrypted using a secret key paired with the key used for encryption.

[0005] In such a cryptographic system, when a government requests a key for decrypting a ciphertext, it is desired to be able to respond to the request.

[0006]

DISCLOSURE OF THE INVENTION An object of the present invention is to enable a third party to decrypt a ciphertext as necessary.

An encryption / decryption device according to the present invention is used in a data encryption stage for generating ciphertext data from plaintext data using a data encryption key used for encrypting the plaintext data, and in the data encryption means. A first encryption key generating means for encrypting the data encryption key using a user unique key to generate a first encryption key, and a data encryption key used in the data encryption means.
A second encryption key generation means for encrypting using a public key to generate a second encryption key is provided.

[0008] The present invention also provides a method suitable for the encryption device. That is, ciphertext data is generated from plaintext data using a data encryption key used to encrypt the plaintext data, and the data encryption key is encrypted using a user unique key to perform first encryption. This is an encryption method for generating a key and encrypting the data encryption key using a public key to generate a second encryption key.

[0009] In the present invention, when decrypting the encrypted data in which the plaintext data is encrypted into the plaintext data, the first encryption key is decrypted using the user unique key to obtain the data encryption key. . The ciphertext data is decrypted into plaintext data using the obtained data encryption key.

The user unique key is usually managed by the user who has generated the ciphertext data. As mentioned above, the user
The ciphertext data can be decrypted into plaintext data using the user unique key.

Usually, the secret key is managed by a maker or a store, and a third party deposited from the maker or the store can use the secret key to decrypt ciphertext data into plaintext data.

The data encryption key used when encrypting the plaintext data into the ciphertext data is preferably the above-mentioned discarded key which is newly generated every time the plaintext data is encrypted. A disposable key is generated each time it is encrypted,
Since the plaintext data is encrypted using the generated disposable key, the ciphertext data is decrypted by a person who does not have the authority to decrypt the ciphertext data as compared with the case where the ciphertext data is generated using a specific encryption key. Danger can be reduced. For this reason, the confidentiality of the ciphertext data can be improved.

[0013] The data encryption key or the user unique key may be generated, and ciphertext data may be generated from the plaintext data using the generated data encryption key or user unique key.

[0014]

FIG. 1 is a block diagram showing an electrical configuration of an encryption / decryption device according to this embodiment.

The encryption / decryption device includes a computer 1. The computer 1 has a display device 2 for displaying data, an input device (keyboard, mouse, etc.) for receiving input via a bus 3, an external storage device 4 for temporarily storing data, and a floppy disk FD. A first FD drive 5 and a second FD drive 6 for reading data recorded on the FD and recording data on the FD are connected.

In the encryption / decryption device, the user of the encryption / decryption device encrypts the plaintext data, the user can decrypt the encrypted data obtained by the encryption, and deposits a specific secret key other than the user. A third party can decrypt the ciphertext data.

FIG. 2 shows an outline of the encryption processing executed by the encryption / decryption device, focusing on the function of the key. FIG. 3 shows an outline of the decryption processing executed by the user, focusing on the function of the key. FIG. 4 shows an outline of the decryption processing executed by a third party who has deposited a secret key other than the user. It mainly shows the function of the key. 5 and 6 are flowcharts showing a procedure of an encryption / decryption process executed by a user, and FIG. 7 is a flowchart showing a procedure of a decryption process executed by a third party who has deposited a secret key.

First, the encryption / decryption processing executed by the user will be described.

Referring to FIG. 1, FIG. 2, FIG. 5 and FIG.
The user mounts the first FD in which the encryption / decryption program is stored in the first FD drive 5. The first F
It is determined whether the first FD attached to the D drive 5 has been initialized (step 11).

If the first FD has not been initialized (NO in step 11), the user's name is input from the input device 3 (step 12). Further, the computer 1 generates a first random number and a second random number in accordance with the encryption / decryption program read from the first FD (step 13).

The data representing the name input from the input device 3 and the data representing the generated first random number are used as user-specific IDs (step 14). Also, the second random number is used as the user unique key (step 15).

The initialization of the FD is completed by the processing of steps 12 to 15.

If the first FD mounted on the first FD drive 5 has already been initialized (YES in step 11)
), Steps 12 to 15 are skipped.

When the initialization processing of the FD is completed, or when the initialized FD is mounted on the first FD drive 5,
The file stored in the external storage device 4 is read (step 16). It is determined whether the read file represents plaintext data (step 17).
If the data is plaintext data (YES in step 17), an encryption process is executed (steps 18 to 22). If the data is not plaintext data (NO in step 17), decryption processing is executed (steps 23 to 26).

When encrypting plaintext data,
A random number is generated to generate a disposable key used for encryption (step 18). The generated random number is used as a discard key.
The plaintext data read from the external storage device 4 is encrypted using the generated disposable key. The ciphertext data is generated by this encryption (step 19).

The discarded key is encrypted using the generated user unique key (step 20). The first encryption key is generated by encrypting the disposable key using the user unique key.

Further, the public key is read based on the encryption / decryption program stored in the first FD.
The disposable key is encrypted using the read public key (step 21). A second encryption key is generated by encrypting the disposable key using the public key.

The user ID, the first encryption key, the second encryption key, and the encrypted data are stored in the external storage device 4 as encrypted files (step 22). Information indicating the version of the encryption / decryption program stored in the first FD is also stored in the encryption file.

Next, a process in which the user decrypts the generated ciphertext data will be described. Decryption by the user is also executed according to the encryption / decryption program stored in the first FD.

Referring mainly to FIGS. 3 and 6, the encrypted file is read from the external storage device 4 (step 17).
NO). When the encrypted file is read, the user inputs a user ID from the input device 3. Version information and user ID stored in the encrypted file and the first FD
It is determined whether or not the version information stored in the URL matches the user ID input by the user (step 23).

If they match, the first encryption key is decrypted using the user unique key stored in the first FD (step 24). This generates the disposable key used to encrypt the plaintext data.

When the disposable key is generated, the ciphertext data is decrypted into plaintext data using the generated disposable key (step 25). The generated plaintext data is provided to the display device 2, and the plaintext represented by the plaintext data is displayed on the display device (step 26).

If the version information and the user ID do not match (NO in step 23), the ciphertext data contained in the encrypted file storing the version information cannot be decrypted, and an error is displayed on the display device 4 ( Step 2
3).

The encryption / decryption device according to this embodiment not only allows a user who has performed encryption to decrypt ciphertext data, but also encrypts a third party who has deposited a secret key other than the user. The ciphertext data can be decrypted.

Next, a case will be described in which the ciphertext data encrypted by the user is decrypted by a third party whose private key has been deposited.

Here, it is assumed that a third party whose private key is deposited uses the encryption / decryption device shown in FIG. 1 to decrypt the ciphertext data into plaintext data. Of course, it goes without saying that the ciphertext data can be decrypted using a decryption device possessed by a third party who has deposited the secret key. Secondly, a decryption program based on a public key method and an encryption / decryption device
The FD storing the private key corresponding to the public key used to generate the encryption key is mounted on the second FD drive 6. The decoding process is executed according to a decoding program stored in the FD mounted on the second FD drive 6.

Referring to FIGS. 4 and 7, an external storage device 4 stores an encrypted file. An encrypted file is read from the external storage device 4 (step 31), and it is determined whether the read file is ciphertext data (step 32).

In the case of an encrypted file (step 32), it is determined whether or not the version information of the encrypted program and the user ID stored in the encrypted file match the version information of the decrypted program and the user ID (step 3).
3).

If they match (step 34), the second encryption key stored in the encrypted file is read. Also, the secret key stored in the second FD is read.
The second encryption key read from the encrypted file is decrypted using the secret key read from the second FD (step 34). As a result, a disposable key used when encrypting the plaintext data into the ciphertext data is generated.

The ciphertext data is read from the cipher file, and the ciphertext data is decrypted using the generated disposable key (step 35). This decryption generates plaintext data.

The plaintext represented by the generated plaintext data is displayed on the display device 4 (step 36). Even if the user who has generated the ciphertext data does not know the user unique key for decoding the ciphertext data into the plaintext data, a third party who has deposited a secret key other than the user can decode the ciphertext data.

The version of the encryption program used to generate the ciphertext data read from the encryption file and the second
If the version of the decryption program stored in the second FD mounted on the FD drive 6 of the first FD does not match, decryption cannot be performed. At this time, an error indicating that decoding cannot be performed is displayed on the display device 4 (step 3).
7).

In the above-described embodiment, the encrypted file is stored in the external storage device 4, but may be stored in the FD.

Further, since the decryption of the ciphertext data by a third party whose private key is deposited uses the public key method, the confidentiality of the ciphertext data can be kept high.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating an electrical configuration of an encryption / decryption device.

FIG. 2 shows an outline of encryption.

FIG. 3 shows an outline of decryption by a user.

FIG. 4 shows an outline of decryption by a third party who deposits a secret key other than a user.

FIG. 5 is a flowchart illustrating a procedure of an encryption / decryption process performed by a user.

FIG. 6 is a flowchart showing a procedure of an encryption / decryption process by a user.

FIG. 7 is a flowchart illustrating a procedure of a decryption process performed by a third party who has deposited a secret key.

[Explanation of symbols]

 Reference Signs List 1 computer 2 display device 3 input device 4 external storage device 5, 6 FD drive

──────────────────────────────────────────────────の Continued on the front page (51) Int.Cl. ⁶ Identification code FI H04L 9/00 601E

Claims (9)

[Claims] 1. A data encryption means for generating ciphertext data from plaintext data using a data encryption key used for encrypting plaintext data, and a data encryption key used in the data encryption means. A first encryption key generating means for generating a first encryption key by encrypting using a user unique key, and a data encryption key used in the data encryption means are encrypted using a public key. An encryption device comprising: a second encryption key generation unit configured to generate a second encryption key. 2. The system according to claim 1, further comprising an encryption key generation unit configured to generate the data encryption key, wherein the data encryption unit uses the data encryption key generated by the encryption key generation unit to generate the data encryption key from the plaintext data. 2. The encryption device according to claim 1, wherein the encryption device generates the ciphertext data. 3. The apparatus according to claim 1, further comprising: a user unique key generation unit configured to generate the user unique key, wherein the first encryption key generation unit uses the user unique key generated by the user unique key generation unit. The encryption device according to claim 1, wherein the encryption device generates one encryption key. 4. A first encryption key decryption means for decrypting the first encryption key using the user unique key to obtain the data encryption key, and a first encryption key decryption means. Data decryption means for decrypting the ciphertext data into plaintext data using the data encryption key obtained by decryption,
The encryption device according to claim 1, further comprising: 5. A second encryption key decryption means for decrypting the second encryption key using a secret key corresponding to the public key to obtain the data encryption key, and the second encryption key. 2. The encryption device according to claim 1, further comprising data decryption means for decrypting ciphertext data into plaintext data using a data encryption key obtained by decryption by the key decryption means. 6. A ciphertext data is generated from the plaintext data using a data encryption key used for encrypting the plaintext data, and the data encryption key is encrypted using a user unique key to generate a first data. And a second encryption key is generated by generating the second encryption key by encrypting the data encryption key using a public key. 7. A ciphertext data is generated from plaintext data using a data encryption key used for encrypting the plaintext data, and the data encryption key is encrypted using a user unique key to generate first data. A computer storing a program for controlling the computer of the encryption apparatus so as to generate an encryption key and generate a second encryption key by encrypting the data encryption key using a public key. A readable recording medium. 8. The data encryption key is obtained by decrypting the first encryption key using a user unique key, and the ciphertext data is converted to the plaintext data using the data encryption key obtained by decryption. 8. The computer-readable recording medium according to claim 7, wherein the recording medium is decrypted. 9. Using a secret key corresponding to the public key,
8. The computer-readable computer according to claim 7, wherein the second encryption key is decrypted to obtain the encryption key, and the ciphertext data is decrypted into plaintext data using the data encryption key obtained by the decryption. Recording medium.