KR20170128667A - encryption method, decryption method and apparatus thereof - Google Patents

Abstract

An encryption method, a decryption method, and an apparatus thereof are disclosed. A method for encrypting data comprises the steps of: (a) receiving time data by accessing a server; (b) updating a current secret key by using the time data and the current secret key; (c) primarily encrypting the data by using the updated secret key in an n-bit unit, wherein n is a natural number; and (d) secondarily encrypting the primarily encrypted data by using a matrix secret key.

Description

[0001] The present invention relates to an encryption method, a decryption method,

The present invention relates to an encryption method, a decryption method, and an apparatus based on a time synchronization scheme.

With the development of network communication, the Internet of Things is rapidly becoming popular in various fields such as industrial parks and home networks. However, the Internet of things has a vulnerability to hacking with a networked system. Hacking accesses the system of the other party through the network and acts as an adverse effect, forcing data to be forged or demodulated, which can interfere with communications or cause viruses to be leaked and leaked. Also, recently developed unmanned vehicles can be controlled by hacking, which emphasizes the importance of data security.

Security algorithms are classified into symmetric algorithms and asymmetric algorithms. Asymmetric algorithms are typically RSA (Rivest, Shamir, Adleman) and DSA (Digital Signature Algorithm). Asymmetric algorithms perform decryption through complex arithmetic operations because the encryption key and the decryption key are not the same. Security is better than symmetric algorithm, but encryption and decryption are time consuming. For this reason, it is mainly used for certificates and electronic signatures. Symmetric algorithms are typically SEED, Lightweight Encryption Algorithm (LEA), High security and light weigHT (HIGHT). The symmetric algorithm has the advantage that the encryption and decryption speed is fast because the secret keys of the sender and the receiver are the same. The SEED algorithm was developed by KISA (Korea Information and Communications Technology Association) and was established by ISO / IEC international standard.

The SEED algorithm performs encryption and decryption using the s-box table and secret key. The secret key used at this time has a problem that information is leaked to the outside when exposed to the outside. Also, there is a problem that the secret key must be periodically changed for the security of the algorithm. Due to these problems, a variety of researches are being conducted, such as finding and correcting weaknesses or defects of the SEED algorithm.

The present invention provides an encryption method, a decryption method, and an apparatus based on a time synchronization method.

According to an embodiment of the present invention, an encryption method and a decryption method based on a time synchronization method are provided.

According to an embodiment of the present invention, there is provided a method of encrypting data comprising the steps of: (a) receiving time data in accordance with a connection to a server; (b) updating the current secret key using the time data and the current secret key; (c) first encrypting the data in units of n bits using an updated secret key, wherein n is a natural number; And (d) secondary encrypting the primary encrypted data using a matrix secret key.

The time data is periodically received, and the step (b) may be periodically performed according to the periodic reception of the time data.

The step (b) may change each digit value of the current secret key using the element values of the time data and the current secret key position values.

In the step (b), each digit value of the current secret key may be changed through a modulo operation and an XOR operation using the current secret key position values and the element values of the time data.

In the step (d), the primary encrypted data may be secondarily encrypted by a matrix operation using an m-digit matrix secret key in units of m bits.

In the step (d), the secondary encryption is performed in units of m bits using the following equation,

Here, C0, C1, C2, and C3 represent the values of the respective positions of the primary encrypted data, and M0, M1, M2, and M3 represent the respective key values of the matrix secret key.

According to another embodiment of the present invention, there is provided a decoding method comprising the steps of: (aa) detecting a current time according to a connection of a client device, and reconstructing the detected current time with time data; (bb) updating the current secret key using the time data and the current secret key; (cc) receiving encrypted data from the client device; (dd) performing an inverse matrix operation on the encrypted data using a matrix secret key to perform first-order decoding; And (ee) performing a second-order decoding of the primary decoded data using the updated secret key.

Transmits the reconstructed time data to the client device, periodically detects the current time, reconstructs the time data, and transmits the reconstructed time data to the client device.

Wherein the step (dd) performs first-order decoding of the encrypted data using the matrix secret key in units of m (m is a natural number) bits, and the step (ee) The primary decrypted data can be secondarily decrypted using the updated secret key.

According to another aspect of the present invention, an apparatus for encryption and decryption based on a time synchronization scheme can be provided.

According to an embodiment of the present invention, there is provided an encryption apparatus comprising: a communication unit for receiving time data from a server; An update unit configured to update the current secret key using the time data and the current secret key; And an encrypting unit for encrypting the data by n (n is a natural number) bit unit by using the updated secret key, and encrypting the primary encrypted data by using the matrix secret key Can be provided.

According to another aspect of the present invention, there is provided a client apparatus comprising: a synchronization unit that detects a current time according to a connection of a client device, and reconfigures the detected current time as time data; A secret key updating unit updating the current secret key using the time data and the current secret key; A communication unit for receiving encrypted data from the client device; And a decoding unit for performing an inverse operation on the encrypted data by inverse matrix operation using a matrix secret key, and performing a second-order decoding on the first-decoded data using the updated secret key.

The synchronization unit may transmit the time data to the client device through the communication unit.

By providing the encryption method, the decryption method, and the apparatus according to the embodiment of the present invention, there is an advantage in that security is enhanced because it is difficult to decrypt the encrypted data.

In addition, the present invention is advantageous in that data leakage is difficult because the secret key is continuously updated based on the time synchronization scheme.

1 is a flow chart illustrating an encryption method according to an embodiment of the present invention;
FIG. 2 and FIG. 3 are diagrams for explaining a secret key update according to an embodiment of the present invention; FIG.
4 is a flowchart showing a method of decrypting encrypted data as shown in FIG.
5 is a diagram illustrating a method for reconstructing time data according to an embodiment of the present invention;
6 is a block diagram schematically illustrating an internal configuration of an encryption apparatus according to an embodiment of the present invention;
FIG. 7 is a block diagram schematically illustrating an internal configuration of a decoding apparatus according to an embodiment of the present invention; FIG.

As used herein, the singular forms "a", "an" and "the" include plural referents unless the context clearly dictates otherwise. In this specification, the terms "comprising ", or" comprising "and the like should not be construed as necessarily including the various elements or steps described in the specification, Or may be further comprised of additional components or steps. Also, the terms "part," " module, "and the like described in the specification mean units for processing at least one function or operation, which may be implemented in hardware or software or a combination of hardware and software .

The present invention is for encrypting and decrypting data using a seed (SEED) algorithm based on a time synchronization scheme.

To this end, according to the present invention, when the client device, which is the encryption subject, connects to the server, the server detects the server time for time synchronization with the client device, and reconstructs the time data to share with the client device.

The client device and the server may then update the synchronized secret key for encryption and decryption based on the reconstructed time data.

Since the server periodically detects the time after the client device connects and reconstructs the time data to transmit to the client device, the client device and the server periodically update the secret key, and can encrypt and decrypt the data using the updated secret key.

Hereinafter, the server will be referred to as a decryption device and the client device will be collectively referred to as an encryption device. The server can also encrypt the data, and it is natural that the client device can also decrypt the encrypted data.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

FIG. 1 is a flowchart illustrating an encryption method according to an embodiment of the present invention. FIG. 2 and FIG. 3 are diagrams for explaining a secret key update according to an embodiment of the present invention.

In step 110, the encryption apparatus 600 determines whether time data has been received from the decryption apparatus 700. [

If time data is received, the encryption device 600 updates the current secret key using the time data in step 115. [

The time data is data in which the values are reconstructed by modulo operation and XOR operation using days, hours, minutes and seconds as days, hours, minutes and seconds. Since the reconstruction of the time data is performed at the server terminal called the decoding apparatus 700, the decoding method will be described in more detail.

A method for updating the secret key using time data will be described in more detail.

The encryption apparatus 600 according to an embodiment of the present invention can encrypt data based on a seed algorithm. In the present specification, it is assumed that data is encrypted based on a 128-bit seed algorithm in order to facilitate understanding and explanation.

Thus, the secret key may be 128 bits.

The encryption apparatus 600 according to an embodiment of the present invention divides the secret key into 64 bits and can change the key values of each position of the secret key.

Hereinafter, a method of changing the key value of the lower 64-bit secret key will be described.

Let K0, K1, K2, K3, K4, K5, K6 and K7 be the key values of the lower 64 bits of the secret key. Each secret key is divided into 64 bits to change the secret key, and 64 bits can be changed in the same manner by being divided into 8 bits again.

Therefore, only the method of changing the secret key values of K0, K1, K2, and K3 will be described.

For example, a key value (hereinafter referred to as a first key value) K0 of the first secret key is XORed with a key value of a second key (called a second key value) and a fourth element value of the time data The result value and the fourth key value of the secret key (referred to as a fourth key value) may be updated to a result of module operation.

The second key value of the secret key may be updated to a value obtained by performing an XOR operation on the first key value and the third element value of the time data, and a result obtained by modulo computing the third key value.

The third key value of the secret key may be updated to a value obtained by performing an XOR operation on the third key value and the second element value of the time data, and a result obtained by performing a module operation on the second key value.

Finally, the fourth key value of the secret key may be updated to a value obtained by performing an XOR operation on the third key value and the first element value of the time data, and a result obtained by performing a module operation on the first key value.

This can be expressed by the following equation (1).

Here, K0 ', K1', K2 'and K3' represent a first key value, a second key value, a third key value and a fourth key value of the changed secret key, respectively. K0 to K3 denote 8 And the key values of the secret key of the place. In addition, tK0, tK1, tK2, and tK3 represent the first to fourth element values of the time data, respectively.

This is illustrated in FIG.

As in the case of FIG. 2, the key values can be updated in the same manner in the remaining K4 to K7.

K4 to K7 can also be updated with respective key values in the same manner as shown in Equations (1) and (2).

The 8-digit secret key of the upper 64 bits of the secret key can be changed as shown in Equation (2).

This is illustrated in FIG.

The remaining 8 digits of the upper 64 bits may be changed as shown in Equation (2) and (3).

This is similar to that described above, and the combination of the key values and the time data used for the operation are different, and the duplicated description will be omitted.

As described above, each key value of the secret key can be updated using the key values of the secret key and the element values of the time data.

The secret key can be updated by changing the calculation procedure of the key values of the secret key and the element values of the time data used for updating the respective key values of the secret key.

The updating process of the secret key may be repeatedly performed each time the time data is received.

In an embodiment of the present invention, it is assumed that the encryption apparatus 600 receives the time data, updates the secret key using the received time data, and encrypts the data using the updated secret key.

However, the encryption apparatus 600 can encrypt the data at least once using the current secret key, and may be used for encryption after updating the secret key as time data is received thereafter.

In operation 120, the encryption apparatus 600 first encodes the data using the current secret key.

The encryption apparatus 600 according to an embodiment of the present invention can primarily encrypt data based on a 128-bit seed algorithm. Therefore, the data can be divided into 128-bit block units using the secret key and then subjected to primary encryption.

Since the seed algorithm itself is a known matter, a detailed description thereof will be omitted.

In operation 125, the encryption apparatus 600 secondary-encrypts the primary encrypted data using the matrix secret key.

The encryption apparatus 600 can perform secondary encryption by matrix-computing the first-encrypted data in units of m bits using the matrix secret key.

This can be expressed by the following equation (1).

Here, C0, C1, C2, and C3 represent the values of each digit of the primary encrypted data, and M0, M1, M2, and M3 represent the respective key values of the matrix secret key.

Here, the matrix secret key may be composed of an m-key key value. Here, m may be a natural number.

This will be described in more detail as follows.

For example, the primary encrypted data is referred to as C, and C = {(1,2,3,4), (5,6,7,8), (9,10,11,12) (13, 14, 15, 16)} and the matrix secret key M = {1, 2, 3, 4}. Since the matrix secret key is 4 digits, the primary encrypted data can be encrypted by dividing into 4 digits.

First, C = (1, 2, 3, 4) is secondarily encrypted by a matrix operation with a matrix secret key. This is expressed as a determinant.

When this is calculated using Equation (3), C '= (5, 11, 11, 25).

In this way, C = (5, 6, 7, 8) is secondarily encrypted with C '= (19,22, 43,50) by a matrix operation using a matrix secret key and C = , 11, 12) are secondarily encrypted with C '= (31, 34, 71, 78) by a matrix operation using the matrix secret key, and C = (13,14,15,16) Can be secondarily encrypted with C '= (43, 46, 99, 106) by matrix operation.

The encryption apparatus 600 can transmit the encrypted data to the decryption apparatus 700.

FIG. 4 is a flowchart illustrating a method of decoding encrypted data as shown in FIG. 1, and FIG. 5 is a diagram illustrating a method of reconstructing time data according to an embodiment of the present invention.

In step 410, the decryption apparatus 700 determines whether or not the encryption apparatus 600 is connected.

If the encrypting apparatus 600 is connected, in step 415, the decrypting apparatus 700 detects the current time of the decrypting apparatus 700, and reconstructs the detected time into time data.

A method of reconstructing time data will be briefly described.

The decoding apparatus 700 detects a time including days, hours, minutes, and seconds. In order to facilitate understanding and explanation, these are referred to as element values, respectively.

At this time, since the time element values may overlap, the decoding apparatus 700 can reconstruct the time data without using the detected time as it is.

First, each element value corresponding to the day, hour, and minute of the detected time can be changed to the result value modulo-operated by the element value corresponding to the second.

In order to facilitate understanding and explanation, each element value corresponding to day, hour, minute, and second will be referred to as a first element value, a second element value, a third element value, and a fourth element value.

In order to prevent the time data from being output in an overlapping manner, the first element value to the third element value are reconstructed in combination with the fourth element value.

That is, the first element value, the second element value, and the third element value may be reconstructed through a modulo operation with the fourth element value, respectively.

The fourth element value may be reconstructed by XORing the fourth element value with a result obtained by modulo-computing the second element value and the third element value.

This can be expressed as shown in FIG.

As described above, the decoding apparatus 700 detects the current time of the decoding apparatus 700 in accordance with the connection of the encrypting apparatus 600, applies at least one of the modulo operation and the XOR operation at the detected time, Lt; / RTI >

The decryption apparatus 700 may periodically (for example, 10 seconds) detect the time since the encryption apparatus 600 is connected, reconfigure the time data, and transmit the time data to the encryption apparatus 600. [

In step 415, the decryption apparatus 700 changes the secret key using the time data. Here, the secret key is a secret key that is shared with the encryption apparatus 600.

The method of changing (updating) the secret key using the time data is the same as that described with reference to FIG. 1, so that redundant description will be omitted.

In operation 420, the decryption apparatus 700 determines whether or not encrypted data has been received from the encryption apparatus 600.

If encrypted data is not received, step 410 is proceeded to.

However, if encrypted data is received, the decryption apparatus 700 first decrypts the encrypted data using the matrix secret key in step 425.

As described above, the encryption apparatus 600 first encrypts data using a secret key, and then encrypts the data with a matrix secret key.

Accordingly, the decryption apparatus 700 must perform inverse matrix operation on the designated size unit using the matrix secret key to decrypt the encrypted data, perform first-order decoding, and then perform second-order decoding using the secret key.

When the primary decoding is completed, the decoding apparatus 700 secondary-decodes the primary-decoded data at a block unit of a designated size using the secret key at step 430. [

6 is a block diagram schematically illustrating an internal configuration of an encryption apparatus according to an embodiment of the present invention.

6, the encryption apparatus 600 includes a communication unit 610, a secret key renewal unit 615, an encryption unit 620, a memory 625, and a processor 630.

The communication unit 610 is a means for transmitting and receiving data through a communication network.

For example, the communication unit 610 may periodically acquire time data from the decryption apparatus 700. [

The communication unit 610 may transmit the encrypted data to the decryption apparatus 700 under the control of the processor 630. [

In an embodiment of the present invention, the encryption apparatus 600 may be a client device, and the decryption apparatus may be a server.

In order to facilitate understanding and explanation, the encryption apparatus and the decryption apparatus are separately described, but the encrypting apparatus and the decrypting apparatus may be one apparatus.

The secret-key updating unit 615 is means for updating the current secret key using the time data received from the server. This is the same as that described with reference to FIG. 1, so duplicate descriptions will be omitted.

The encryption unit 620 is a means for encrypting data.

For example, the encrypting unit 620 can encrypt the data by using the secret key in units of blocks of the designated first size. Then, the encryption unit 620 can encrypt the primary encrypted data by using the matrix secret key in the second unit of size.

Here, the secret key is a secret key different from the matrix secret key, and the size may also be different.

The method of encrypting data using the secret key and the matrix secret key is the same as that described with reference to FIG. 1, so that a duplicate description will be omitted.

The memory 625 stores various algorithms, data, various data derived in this process, etc. necessary for performing a method for encrypting data according to a seed algorithm based on a time synchronization scheme according to an embodiment of the present invention It is means.

Processor 630 may be coupled to internal components (e.g., communication unit 610, secret key update unit 615, encryption unit 620, memory 625, etc.) of cryptographic apparatus 600 according to an embodiment of the present invention. ), And the like).

FIG. 7 is a block diagram schematically illustrating an internal configuration of a decoding apparatus according to an embodiment of the present invention. Referring to FIG.

In this specification, it is assumed that the encrypting apparatus 600 and the decrypting apparatus 700 are different from each other. However, the encrypting apparatus 600 and the decrypting apparatus 700 may be the same apparatus.

7, a decoding apparatus 700 according to an exemplary embodiment of the present invention includes a communication unit 710, a synchronization unit 715, a secret key update unit 720, a decryption unit 725, a memory 730, And a processor 735.

The communication unit 710 is a means for performing data communication with another device (for example, the encryption device 600) via a communication network.

For example, the communication unit 710 can transmit the reconstructed time data to the encryption apparatus 600 via the communication network. The communication unit 710 may also receive the encrypted data from the encryption apparatus 600. [

The synchronization unit 715 is means for time synchronization with the encryption apparatus 600 and is means for detecting the current time of the decryption apparatus 700 according to the connection of the encryption apparatus 600 and reconstructing it into time data.

The synchronization unit 715 may transmit the reconstructed time data to the encryption apparatus 600 through the communication unit 710. [

The secret key renewing unit 720 is means for updating the secret key using the time data in order to synchronously update the secret key shared with the encryption apparatus 600. [ This is the same as that described with reference to FIG. 1, so duplicate descriptions will be omitted.

The decryption unit 725 is means for decrypting the encrypted data received from the encryption apparatus 600 using the secret key and the matrix secret key.

For example, as described above with reference to FIG. 4, the decryption unit 725 performs inverse matrix operation on the encrypted data using a matrix secret key in units of a designated size, performs first-order decoding, and uses the first- And can perform secondary decoding on a block unit of a designated size.

Since this is the same as that described above with reference to FIG. 4, redundant description will be omitted.

The memory 730 is a means for storing various algorithms necessary for performing a method of decoding the encrypted data based on the time synchronization scheme, various data derived from the process.

The processor 735 may include internal components (e.g., a communication unit 710, a synchronization unit 715, a secret-key update unit 720, a decryption unit 710, and a decryption unit 720) of the decryption apparatus 700 according to an embodiment of the present invention. 725, memory 730, etc.).

On the other hand, the components of the above-described embodiment can be easily grasped from a process viewpoint. That is, each component can be identified as a respective process. Further, the process of the above-described embodiment can be easily grasped from the viewpoint of the components of the apparatus.

In addition, the above-described technical features may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks, and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

It will be apparent to those skilled in the art that various modifications, additions and substitutions are possible, without departing from the spirit and scope of the invention as defined by the appended claims. Should be regarded as belonging to the following claims.

600: Encryption device
610:
615: secret key renewal unit
620:
625: Memory
630: Processor

Claims (12)

A method for encrypting data,
(a) receiving time data according to a connection to a server;
(b) updating the current secret key using the time data and the current secret key;
(c) first encrypting the data in units of n bits using an updated secret key, wherein n is a natural number; And
(d) secondary encrypting the primary encrypted data using a matrix secret key.
The method according to claim 1,
Wherein the time data is periodically received,
And the step (b) is periodically performed according to the periodic reception of the time data.
The method of claim 1, wherein the step (b)
Wherein each digit value of the current secret key is changed using each element value of the time data and the place value of the current secret key.
The method of claim 1, wherein the step (b)
Wherein each digit value of the current secret key is updated through a modulo operation and an XOR operation using the current secret key position values and each element value of the time data.
The method of claim 1, wherein the step (d)
Wherein the primary encrypted data is secondarily encrypted by a matrix operation using an m-digit matrix secret key in units of m bits.
6. The method of claim 5, wherein step (d)
Wherein the second encryption is performed in units of m bits using the following equation.

Here, C0, C1, C2, and C3 represent the values of respective digits of the primary encrypted data, and M0, M1, M2, and M3 represent the respective key values of the matrix secret key.
An encryption apparatus comprising:
A communication unit for receiving time data from a server;
An update unit configured to update the current secret key using the time data and the current secret key; And
And an encrypting unit for first encrypting the data using n (n is a natural number) bit unit using the updated secret key, and performing second encryption using the matrix secret key.
In the decoding method,
(aa) detecting a current time according to a connection of the client device, and reconstructing the detected current time with time data;
(bb) updating the current secret key using the time data and the current secret key;
(cc) receiving encrypted data from the client device;
(dd) performing an inverse matrix operation on the encrypted data using a matrix secret key to perform first-order decoding; And
(ee) secondary decoding the primary decrypted data using the updated secret key.
9. The method of claim 8,
Transmitting the reconfigured time data to the client device,
Wherein the client device periodically detects the current time, reconstructs the time data, and transmits the reconstructed time data to the client device.
9. The method of claim 8,
Wherein the step (dd) performs the first-order decoding of the encrypted data using the matrix secret key in units of m (m is a natural number) bits,
Wherein the step (ee) secondarily decrypts the primary decrypted data with n (n is a natural number) bit unit using the updated secret key.
A synchronization unit for detecting the current time according to the connection of the client device and reconstructing the detected current time as time data;
A secret key updating unit updating the current secret key using the time data and the current secret key;
A communication unit for receiving encrypted data from the client device; And
And decrypting the encrypted data by inverse matrix computation using a matrix secret key to perform first-order decoding, and secondarily decoding the first-decoded data using the updated secret key.
12. The method of claim 11,
Wherein the synchronization unit transmits the time data to the client device through the communication unit.

Images