KR20240066806A - Method of storing encryption key using table and method of extracting encryption key - Google Patents

Abstract

When the encryption data and encryption key are input, a table to store the encryption data and encryption key is created, the encryption key is separated into preset units to generate a plurality of key pieces, and at least one of the encryption data and the preset addressing algorithm is generated. An encryption key that specifies different table addresses in the table where each of the multiple key pieces will be stored, stores the encrypted data in the table, and stores each of the multiple key pieces in the table based on the set table address. A storage method is disclosed.

Description

Method of storing encryption key using table and method of extracting encryption key {METHOD OF STORING ENCRYPTION KEY USING TABLE AND METHOD OF EXTRACTING ENCRYPTION KEY}

The present invention relates to an encryption key storage method and an encryption key extraction method using a table.

As communication technology develops and communication services become more common, various encryption technologies are being used to ensure the safety of systems and users from attackers on communication networks. Encryption technology can be said to be a technology that prevents attackers from knowing the contents of the plain text by changing plain text into cipher text. For this encryption, an encryption algorithm and encryption key can be used. .

In the past, techniques were mainly used to hide the encryption key to prevent attackers from decrypting the plaintext from the ciphertext, but various techniques have been developed for attackers to obtain the encryption key of the attack target, and furthermore, it is impossible to completely prevent the leakage of the encryption key. Since there are bound to be limitations, encryption techniques that assume that encryption keys can be leaked are being attempted.

In this regard, as one of the encryption technologies, a table lookup encryption technology that operates by organizing the encryption algorithm and encryption key into a table is being attempted. A representative example of this is the white box encryption technique. In the white box encryption technique, the encryption algorithm and encryption key are organized into a table, so even if the table is exposed to the attacker, it is difficult for the attacker to extract the encryption key from the table, preventing the attacker's attack. can be prevented.

In this white box encryption technique, tables are usually packaged with an app or program or stored in a database or file system as a separate table file.

The present invention relates to an encryption key storage method that distributes and stores encryption keys in a table where encrypted data is stored.

Additionally, the present invention relates to an encryption key extraction method for extracting an encryption key from a table in which encrypted data and encryption keys are distributed and stored.

An encryption key storage method according to the present invention includes the steps of, when encryption data and an encryption key are input, creating a table to store the encryption data and the encryption key; generating a plurality of key pieces by dividing the encryption key into preset units; Specifying different table addresses in the table where each of the plurality of key pieces will be stored using at least one of the encryption data and a preset addressing algorithm; and storing the encrypted data in the table and storing each of the plurality of key pieces in the table based on the set table address.

Additionally, the step of specifying the table address may specify a table address for the most advanced key fragment among the plurality of key fragments based on the encryption data.

In addition, the step of specifying the table address includes checking a first table address assigned to a first key piece, which is one of the plurality of key pieces; checking the index of a second key piece, which is the next key piece adjacent to the first key piece; determining a second table address by considering at least one of the encrypted data and an index of the second key piece; and specifying the second table address to the second key piece.

Additionally, in the step of specifying the table address, an association code may be added to one side of the encrypted data to indicate the association between different table addresses to be assigned to each of the plurality of key pieces.

Additionally, the step of specifying the table address may include rearranging the plurality of key pieces in a preset order.

Meanwhile, an encryption key storage device according to the present invention includes a table generator that, when encryption data and an encryption key are input, creates a table to store the encryption data and the encryption key; an encryption key separation unit that separates the encryption key into preset units to generate a plurality of key pieces; an address designation unit that designates different table addresses in the table where each of the plurality of key pieces will be stored using at least one of the encryption data and a preset addressing algorithm; and a data processing unit that stores the encrypted data in the table and stores each of the plurality of key pieces in the table based on the set table address.

Meanwhile, a program stored in a computer-readable recording medium according to the present invention is a program stored in a computer-readable recording medium that is executed by one or more processes in an electronic device, and the program includes encrypted data and When an encryption key is input, creating a table to store the encryption data and the encryption key; generating a plurality of key pieces by dividing the encryption key into preset units; Specifying different table addresses in the table where each of the plurality of key pieces will be stored using at least one of the encryption data and a preset addressing algorithm; and storing the encrypted data in the table and storing each of the plurality of key pieces in the table based on the set table address.

Meanwhile, the encryption key extraction method according to the present invention includes the steps of loading a table in which encryption data and a plurality of key pieces are stored; Loading encrypted data from the table; determining different table addresses in the table where each of the plurality of key pieces is stored using at least one of the encryption data and a preset addressing algorithm; extracting each of the plurality of key pieces from the table based on the determined table address; and generating an encryption key by listing the extracted plurality of key pieces.

Meanwhile, an encryption key extraction device according to the present invention includes a table loader that loads a table in which encryption data and a plurality of key pieces are stored; an address determination unit that determines different table addresses where each of the plurality of key pieces is stored in the table using at least one of the encryption data and a preset addressing algorithm; a data load unit that loads encrypted data from the table and extracts each of the plurality of key pieces from the table based on the determined table address; and an encryption key generator that generates an encryption key by listing the extracted plurality of key pieces.

Meanwhile, a program stored in a computer-readable recording medium according to the present invention is a program stored in a computer-readable recording medium that is executed by one or more processes in an electronic device, and the program includes encrypted data and Loading a table in which a plurality of key fragments are stored; Loading encrypted data from the table; determining different table addresses in the table where each of the plurality of key pieces is stored using at least one of the encryption data and a preset addressing algorithm; extracting each of the plurality of key pieces from the table based on the determined table address; and generating an encryption key by listing the extracted plurality of key pieces.

As seen above, the encryption key storage method according to the present invention stores the encryption key in a distributed manner in a table where encrypted data is stored, thereby obfuscating encryption key extraction through reverse engineering (RE). It can be realized.

Additionally, the encryption key extraction method according to the present invention can safely and accurately extract the encryption key from a table where encrypted data and encryption keys are distributed and stored.

Figure 1 shows a cryptographic key storage system according to the present invention.
Figure 2 is a flowchart showing an encryption key storage method according to the present invention.
Figure 3 is a flowchart showing an encryption key extraction method according to the present invention.
Figures 4 to 8 show the process of configuring a table by the encryption key storage device according to the present invention.
Figure 9 shows a process in which the encryption key extraction device according to the present invention generates an encryption key from a table.

Hereinafter, embodiments disclosed in the present specification will be described in detail with reference to the accompanying drawings. However, identical or similar components will be assigned the same reference numbers regardless of drawing symbols, and duplicate descriptions thereof will be omitted. Suffix "module" for components used in the description below. and "Part" are given or used interchangeably considering only the ease of preparing the specification, and do not have distinct meanings or roles in themselves. Additionally, in describing the embodiments disclosed in this specification, if it is determined that detailed descriptions of related known technologies may obscure the gist of the embodiments disclosed in this specification, the detailed descriptions will be omitted. In addition, the attached drawings are only for easy understanding of the embodiments disclosed in this specification, and the technical idea disclosed in this specification is not limited by the attached drawings, and all changes included in the spirit and technical scope of the present invention are not limited. , should be understood to include equivalents or substitutes.

Terms containing ordinal numbers, such as first, second, etc., may be used to describe various components, but the components are not limited by the terms. The above terms are used only for the purpose of distinguishing one component from another.

A component is "connected" to another component. present or "connected" When it is mentioned that there is, it may be directly connected or connected to the other component, but it should be understood that other components may exist in the middle. On the other hand, a component is "directly connected" to another component. or "directly connected" When mentioned, it should be understood that no other intermediate components exist.

Singular expressions include plural expressions unless the context clearly dictates otherwise.

In this application, "includes" or "have" Terms such as are intended to designate the presence of features, numbers, steps, operations, components, parts, or a combination thereof described in the specification, but are intended to indicate the presence of one or more other features, numbers, steps, operations, components, parts, or It should be understood that the existence or addition possibility of combinations of these is not excluded in advance.

Figure 1 shows a cryptographic key storage system according to the present invention.

The encryption key storage system 1 according to the present invention can store encryption data and encryption keys in memory and load the stored encryption data and encryption keys. Here, the encrypted data may be data encrypted through various encryption techniques (eg, hash encryption, symmetric key encryption, etc.). Additionally, the encryption key may be a key used in the process of encrypting data or a key used in the process of decrypting encrypted data.

At this time, the encryption key storage system 1 may create a table and store the encryption data and encryption key in the created table, or extract the encryption data and encryption key from the table. Here, the table may include multiple spaces for storing values such as integers, characters, or strings, and in this case, each space may be assigned a different table address. Such a table may be included in an application or application program that uses encrypted data, or may be stored as a separate file. For example, the table may be prepared based on White-Box Cryptography. In this case, the table may contain encryption data, encryption keys and encryption algorithms, etc.

In this regard, referring to FIG. 1 , the encryption key storage system 1 may include an encryption key storage device 100, a storage server 500, and an encryption key extraction device 300. Meanwhile, the above configuration is intended to conceptually explain the configuration and operation of the encryption key storage system 1, that is, the encryption key storage system 1 according to the present invention is integrated into one or two or more devices or individually. It can be provided.

When encryption data and an encryption key are input from an encryption module, the encryption key storage device 100 may create a table and store the encryption data and encryption key in the created table. Here, the encryption module may be designed to generate an encryption key and encrypt data using an arbitrary encryption algorithm. This encryption key storage device 100 may be integrated with the encryption module or may be implemented separately.

For this purpose, the encryption key storage device 100 may include a storage unit 110, a communication unit 130, and a control unit 150.

The storage unit 110 may be implemented to store data generated in the process of storing an encryption key.

Specifically, the storage unit 110 may store a table created by the control unit 150 and a command or algorithm for storing encryption data and an encryption key in the table.

For example, the storage unit 110 may store an addressing algorithm. Here, the addressing algorithm may be an algorithm that determines where in the table the encryption data and encryption key will be stored.

The communication unit 130 may be implemented to perform wired or wireless communication with at least one of the encryption module, the storage server 500, and the encryption key extraction device 300.

Specifically, the communication unit 130 may receive encryption data and an encryption key from the encryption module through wired or wireless communication. Additionally, the communication unit 130 may transmit a table storing the encryption data and the encryption key to at least one of the storage server 500 and the encryption key extraction device 300.

The control unit 150 may control the overall operation of the encryption key storage device 100. Specifically, when encryption data and an encryption key are input through the communication unit 130, the control unit 150 may create a table and store the encryption data and encryption key in the table.

To this end, the control unit 150 may include a table creation unit 151, an encryption key separation unit 153, an address designation unit 155, and a data processing unit 157.

When the encryption data and encryption key are input, the table creation unit 151 may create a table to store the encryption data and encryption key. At this time, creating a table may mean loading a table previously stored in the storage unit 110 to store the encryption key.

The encryption key separation unit 153 may separate the encryption key into preset units and generate a plurality of key pieces. Here, the preset unit may mean the data size (for example, 1 Byte) for one key piece.

The address designation unit 155 may use at least one of encryption data and a preset address designation algorithm to designate different table addresses in the table where each of the plurality of key pieces will be stored.

The data processing unit 157 may store encrypted data in a table and store each of a plurality of key pieces in the table based on the set table address.

Through the above process, the control unit 150 can store the encryption data and encryption key (or multiple key pieces) in the table. Accordingly, the control unit 150 may transmit the table storing the encryption data and the encryption key to the storage server 500 and the encryption key extraction device 300 through the communication unit 130.

The storage server 500 may store a table in which encryption data and encryption keys are stored. That is, the storage server 500 can receive the table from the encryption key storage device 100 and store it.

Accordingly, the storage server 500 may transmit the table in which the encryption data and the encryption key are stored to the encryption key extraction device 300 based on the request command from the encryption key extraction device 300.

When the encryption key extraction device 300 receives a table in which encryption data and encryption keys (or multiple key pieces) are stored from the storage server 500, the encryption key extraction device 300 may extract the encryption data and encryption keys from the table. Accordingly, the encryption key extraction device 300 can transmit the encryption data and encryption key to the decryption module. Here, the decryption module may be provided to decrypt encrypted data using an arbitrary decryption algorithm and encryption key (or decryption key). At this time, the encryption key extraction device 300 may be integrated with the decryption module or may be implemented separately.

For this purpose, the encryption key extraction device 300 may include a storage unit 310, a communication unit 330, and a control unit 350.

The storage unit 310 may be implemented to store data generated in the process of extracting an encryption key.

Specifically, the storage unit 310 may store a table received through the communication unit 330 and a command or algorithm for extracting encryption data and an encryption key from the table.

For example, the storage unit 310 may store an addressing algorithm. Here, the addressing algorithm may be an algorithm that determines where the encryption data and encryption key are stored in the table. At this time, the addressing algorithm may be the same as or set to correspond to the addressing algorithm previously used in the encryption key storage device 100. That is, the addressing algorithms provided in each of the encryption key storage device 100 and the encryption key extraction device 300 specify or determine the table address for the encryption key (or key fragments) in the table 50 using the same rules. It can be set to do so. Alternatively, the addressing algorithm of the encryption key extraction device 300 may be partially modified to determine the location in the table where the encryption key is stored.

The communication unit 330 may be implemented to perform wired or wireless communication with at least one of the decryption module, the storage server 500, and the encryption key storage device 100.

Specifically, the communication unit 330 may receive the table from at least one of the storage server 500 and the encryption key storage device 100 through wired or wireless communication. Additionally, the communication unit 330 may transmit encryption data and an encryption key to the decryption module.

The control unit 350 may control the overall operation of the encryption key extraction device 300. Specifically, when the control unit 350 receives a table storing encryption data and encryption keys (or multiple key pieces) through the communication unit 330, the control unit 350 may extract the encryption data and encryption keys from the table.

To this end, the control unit 350 may include a table load unit 351, a data load unit 353, an address determination unit 355, and an encryption key generation unit 357.

The table loader 351 can load a table in which encrypted data and multiple key pieces are stored. At this time, the table load unit 351 may receive and load a table stored in the storage server 500 through the communication unit 330, or load a table stored in the storage unit 310.

The data load unit 353 may extract encrypted data from the table. Additionally, when the address determination unit 355 determines the table address where each of the plurality of key pieces is stored, the data load unit 353 may extract each of the plurality of key pieces from the table based on the determined table address.

The address determination unit 355 may use at least one of encryption data and a preset addressing algorithm to determine different table addresses where each of the plurality of key pieces is stored in the table.

The encryption key generator 357 may generate an encryption key by listing a plurality of extracted key pieces.

Through the above process, the control unit 350 can extract the encryption data and encryption key (or multiple key pieces) from the table. Accordingly, the control unit 350 can transmit the encryption data and encryption key to the decryption module through the communication unit 330.

Meanwhile, a pre-generated table may be stored in each of the encryption key storage device 100 and the encryption key extraction device 300. At this time, the tables stored in each of the encryption key storage device 100 and the encryption key extraction device 300 may be different tables. In this case, each of the encryption key storage device 100 and the encryption key extraction device 300 may be arranged to generate the same encryption key using each pre-stored table.

For example, when the table is stored in advance, the encryption key storage device 100 may generate an encryption key from the table according to an encryption key request signal from the encryption module and transmit the encryption key to the encryption module. Accordingly, the encryption key storage device 100 may receive encryption data from the encryption module and transmit the received encryption data to at least one of the server device 500 and the encryption key extraction device 300.

In addition, the encryption key extraction device 300 pre-stores a table different from the table stored in the encryption key storage device 100 and receives encryption data from at least one of the encryption key storage device 100 and the server device 500. Then, you can generate an encryption key from a pre-stored table. Accordingly, the encryption key extraction device 300 can transmit the encryption data and encryption key to the decryption module.

As described above, the encryption key storage system 1 is configured to create a table in which the encryption key is stored, and transmit the created table to another device to extract the encryption key from the table, or extract the encryption key from the table stored in advance. It is configured to be used to generate and encrypt or decrypt data, so only encrypted data can be transmitted and received.

Based on the configuration of the encryption key storage system (1) discussed above, the following describes a method of storing encryption data and encryption keys in a table and a method of extracting encryption data and encryption keys from the table where the encryption data and encryption keys are stored. Let me explain in more detail.

Figure 2 is a flowchart showing a method for storing an encryption key according to the present invention, and Figure 3 is a flowchart showing a method for extracting an encryption key according to the present invention. In addition, Figures 4 to 8 show the process of constructing a table by the encryption key storage device according to the present invention, and Figure 9 shows the process of generating the encryption key from the table by the encryption key extraction device according to the present invention.

Referring to FIG. 4, when the encryption data 10 and the encryption key 30 are input from the encryption module, the encryption key storage device 100 creates a table 50 to store the encryption data 10 and the encryption key 30. can be created.

For example, when an encryption module creates a table to store an encryption algorithm, the encryption key storage device 100 may create a table 50 of the same size as the table created in the encryption module.

For another example, the encryption key storage device 100 may create the table 50 by considering at least one of the size of the encryption data 10 and the size of the encryption key 30. Specifically, the encryption key storage device 100 may determine the size of the table 50 to be proportional to at least one of the size of the encryption data 10 and the size of the encryption key 30.

Meanwhile, the encryption key storage device 100 may separate at least one of the encryption data 10 and the encryption key 30 into preset units.

For example, the encryption key storage device 100 may separate at least one of the encryption data 10 and the encryption key 30 into a size of 1 byte.

For another example, the encryption key storage device 100 may separate at least one of the encryption data 10 and the encryption key 30 on a character basis. Specifically, the encryption key storage device 100 is configured so that the encryption key 30 is "swinnus", as multiple key pieces, "s", "w", "i", "n", "n", "u" and "s". In addition, when the encryption data 10 is "23fdkefa23", the encryption key storage device 100 is "2", "3", "f", "d", "k", ";e","f","a","2" and "3".

Furthermore, the encryption key storage device 100 can rearrange a plurality of separated key pieces in a preset order. That is, the encryption key storage device 100 can determine the order in which table addresses will be assigned to each of the plurality of key pieces.

For example, the cryptographic key storage device 100 may rearrange a plurality of key pieces in a predetermined order according to an addressing algorithm. Specifically, the cryptographic key storage device 100 includes a plurality of key pieces such as "s", "w", "i", "n", "n", "u" and "s", "s", "u", "w", "n", "n", "i" You can rearrange multiple key pieces in the order of and "s"

For another example, the encryption key storage device 100 may rearrange the order of the plurality of key pieces in the reverse order of the encryption key 30. In other words, the cryptographic key storage device 100 includes a plurality of key pieces such as "s", "w", "i", "n", "n", "u" and "s", "s", "u", "n", "n", "i", "w" You can rearrange multiple key pieces in reverse order, such as the order of "s"

Furthermore, the encryption key storage device 100 may store the encryption data 10 in the table 50. At this time, the encryption key storage device 100 may store the encryption data 10 in various ways.

For example, the encryption key storage device 100 may store the encryption data 10 in one table address located at the front within the table 50.

For another example, as shown in FIG. 5, the encryption key storage device 100 may separate the encryption data 10 into characters and store them in the table 50. In this case, the encryption key storage device 100 may store the encryption data 10 in the table 50. The encrypted data 10 can be stored sequentially starting from the table address located at the front within the table 50.

Meanwhile, the encryption key storage device 100 may use at least one of the encryption data 10 and an addressing algorithm to designate different table addresses in the table 50 where each of the plurality of key pieces will be stored.

Specifically, the encryption key storage device 100 uses an addressing algorithm to determine the size of the encryption data 10, the value included in the encryption data 10, the number of key pieces, and the index (or , order) and the value of each key piece, etc., can be used to specify the table address. Alternatively, the encryption key storage device 100 may designate a pre-designated table address according to the order of each key piece through an addressing algorithm.

For example, as shown in FIG. 6, the encryption key storage device 100 stores each key at a pre-designated table address (e.g., 33, 83, 45, 51, 62, 76, and 87) in the table 50. Pieces can be specified.

For another example, the encryption key storage device 100 may specify a table address so that two key pieces that are adjacent in order have a gap equal to the number of key pieces. At this time, the first key piece may be assigned a table address spaced apart from the end table address of the encrypted data 10 by the size of the encrypted data 10.

As another example, the encryption key storage device 100 may specify a table address for the most advanced key piece among the plurality of key pieces based on the encryption data 10. Accordingly, the cryptographic key storage device 100 checks the first table address assigned to the first key fragment, which is one of the plurality of key fragments, and the second key fragment, which is the next key fragment adjacent to the first key fragment. The process of checking the index, determining the second table address by considering at least one of the encryption data 10 and the index of the second key fragment, and assigning the second table address to the second key fragment is repeated to create a plurality of keys. You can specify table addresses for pieces.

Specifically, referring to FIG. 7, the encryption key storage device 100 is a table address for "s", which is the most advanced key fragment among a plurality of key fragments, and is a table address spaced apart by the size of the encryption data 10. You can specify 20. Accordingly, the encryption key storage device 100 can designate 22, a table address spaced apart by 1, which is the index of "w", as the table address for "w". Thereafter, the above process can be repeated to specify table addresses of 20, 22, 25, 29, 34, 40, and 47 for multiple key pieces, respectively.

Meanwhile, the encryption key storage device 100 may add a correlation code to one side of the encryption data 10 to indicate the correlation between different table addresses to be assigned to each of the plurality of key pieces. At this time, the correlation code can be set to indicate how the addressing algorithm operates and each key piece is stored in the table 50.

Specifically, the association symbol may include multiple values. In this case, each association code can specify the table address for each key piece in a different way. Accordingly, if different association codes are set in the encryption key storage device 100, different table addresses may be assigned even to the same key piece.

For example, with reference to FIG. 8, the encryption key storage device 100 stores "1" as an association code at the end of the encryption data 10, and accordingly, the encryption key storage device 100 stores each key. Pieces can be assigned pre-assigned table addresses.

For another example, the encryption key storage device 100 may store "2" as an association code at the end of the encryption data 10, and in this case, the encryption key storage device 100 may store the first key piece. A table address spaced apart from the end table address of the encrypted data 10 by the size of the encrypted data 10 is designated, and thereafter, the table is set so that two key pieces adjacent in order have an interval equal to the number of key pieces. Addresses can be specified.

As described above, the encryption key storage device 100 can store the encryption data 10 and the encryption key 30 in the table 50 in various ways.

Furthermore, the encryption key storage device 100 may store each key fragment at a table address designated for each key fragment.

Through the above configuration, the encryption key storage device 100 stores the encryption data 10 and the encryption key 30 (or multiple key pieces) in the table 50, and stores the encryption data 10 and the encryption key 30 in the table 50. The table 50 in which the key 30 is stored can be transmitted to either the storage server 500 or the encryption key extraction device 300.

Meanwhile, when the table 50 is delivered from either the storage server 500 or the encryption key storage device 100, the encryption key extraction device 300 can retrieve the encryption data 10 from the table 50. Thereafter, the encryption key extraction device 300 may use at least one of the encryption data 10 and a preset addressing algorithm to determine different table addresses in the table 50 where each of the plurality of key pieces is stored.

Here, the encryption key extraction device 300 uses an addressing algorithm set to the same rules as the addressing algorithm of the encryption key storage device 100 described above to extract the encryption key 30 (or, You can determine the table address for key pieces). Therefore, repeated explanations will be omitted.

Through this, the encryption key extraction device 300 can extract each of a plurality of key fragments from the table 50 based on the determined table address and generate the encryption key 30 by listing the extracted plurality of key fragments. there is.

Specifically, the encryption key extraction device 300 can restore the order of a plurality of key pieces to the state before they were stored in the table 50 based on an addressing algorithm.

Through the above configuration, the encryption key extraction device 300 can extract the encryption data 10 and the encryption key 30 (or a plurality of key pieces) from the table 50. Accordingly, the encryption key extraction device 300 can transmit the encryption data 10 and the encryption key 30 to the decryption module through the communication unit 330.

Furthermore, the present invention discussed above can be implemented as computer-readable codes or instructions on a program-recorded medium. That is, various control methods according to the present invention may be provided in the form of programs, either integrated or individually.

Meanwhile, computer-readable media includes all types of recording devices that store data that can be read by a computer system. Examples of computer-readable media include HDD (Hard Disk Drive), SSD (Solid State Disk), SDD (Silicon Disk Drive), ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, etc. There is.

Furthermore, the computer-readable medium may be a server or cloud storage that includes storage and can be accessed by electronic devices through communication. In this case, the computer can download the program according to the present invention from a server or cloud storage through wired or wireless communication.

Furthermore, in the present invention, the computer described above is an electronic device equipped with a processor, that is, a CPU (Central Processing Unit), and there is no particular limitation on its type.

Meanwhile, the above detailed description should not be construed as restrictive in all respects and should be considered illustrative. The scope of the present invention should be determined by reasonable interpretation of the appended claims, and all changes within the equivalent scope of the present invention are included in the scope of the present invention.

1: Cryptographic key storage system
10: Encrypted data
30: encryption key
50: table
100: Cryptographic key storage device
300: Cryptographic key extraction device
500: storage server

Claims (10)

When encryption data and encryption key are input, creating a table to store the encryption data and encryption key;
generating a plurality of key pieces by dividing the encryption key into preset units;
Specifying different table addresses in the table where each of the plurality of key pieces will be stored using at least one of the encryption data and a preset addressing algorithm; and
Storing the encryption data in the table and storing each of the plurality of key pieces in the table based on the set table address.
The method of claim 1, wherein specifying the table address comprises:
An encryption key storage method that specifies a table address for the most advanced key piece among the plurality of key pieces based on the encryption data.
The method of claim 2, wherein specifying the table address includes:
Confirming a first table address assigned to a first key fragment, which is one of the plurality of key fragments;
checking the index of a second key piece, which is the next key piece adjacent to the first key piece;
determining a second table address by considering at least one of the encrypted data and an index of the second key piece; and
Specifying the second table address to the second key fragment.
The method of claim 1, wherein specifying the table address comprises:
An encryption key storage method of adding an association code to one side of the encryption data to indicate a relationship between different table addresses to be assigned to each of the plurality of key pieces.
The method of claim 1, wherein specifying the table address comprises:
A method of storing an encryption key, comprising: rearranging the plurality of key pieces in a preset order.
When encryption data and encryption key are input, a table creation unit that creates a table to store the encryption data and encryption key;
an encryption key separation unit that separates the encryption key into preset units to generate a plurality of key pieces;
an address designation unit that designates different table addresses in the table where each of the plurality of key pieces will be stored using at least one of the encryption data and a preset addressing algorithm; and
An encryption key storage device comprising: a data processing unit that stores the encryption data in the table and stores each of the plurality of key pieces in the table based on the set table address.
A program that is executed by one or more processes in an electronic device and stored on a computer-readable recording medium,
The above program is,
When encryption data and encryption key are input, creating a table to store the encryption data and encryption key;
generating a plurality of key pieces by dividing the encryption key into preset units;
Specifying different table addresses in the table where each of the plurality of key pieces will be stored using at least one of the encryption data and a preset addressing algorithm; and
Storing the encrypted data in the table and storing each of the plurality of key pieces in the table based on the set table address; A computer-readable record comprising instructions for performing the following steps: Program stored on media.
Loading a table storing encryption data and multiple key pieces;
Loading encrypted data from the table;
determining different table addresses in the table where each of the plurality of key pieces is stored using at least one of the encryption data and a preset addressing algorithm;
extracting each of the plurality of key pieces from the table based on the determined table address; and
A method of extracting an encryption key comprising: generating an encryption key by listing the extracted plurality of key pieces.
A table load unit that loads a table storing encrypted data and multiple key pieces;
an address determination unit that determines different table addresses where each of the plurality of key pieces is stored in the table using at least one of the encryption data and a preset addressing algorithm;
a data load unit that loads encrypted data from the table and extracts each of the plurality of key pieces from the table based on the determined table address; and
An encryption key generator that generates an encryption key by listing the extracted plurality of key pieces.
A program that is executed by one or more processes in an electronic device and stored on a computer-readable recording medium,
The above program is,
Loading a table storing encryption data and multiple key pieces;
Loading encrypted data from the table;
determining different table addresses in the table where each of the plurality of key pieces is stored using at least one of the encryption data and a preset addressing algorithm;
extracting each of the plurality of key pieces from the table based on the determined table address; and
Generating an encryption key by listing the plurality of extracted key pieces. A program stored in a computer-readable recording medium, comprising instructions to perform the following.