TW490966B - Secure data transmission method and system using hardware protected hidden key and variable passcode - Google Patents

Abstract

The present invention is a secure data transmission method and system using hardware protected hidden key and variable passcode, which employs a hardware protected hidden key and a variable passcode. The system is composed of a source and a target, a passcode generator for generating the variable passcode, a working key generator based on the hidden key and the variable passcode, and a device for encrypting and decrypting the secure data. The method is to transmit the secure data from a source to a target using the hardware protected hidden key and the variable passcode, which includes the following steps: providing a first hidden key to the source and a second hidden key to the target, and the first and second hidden keys are equal and protected by the hardware; distributing the secure data as a plurality of data blocks; generating a plurality of variable passcodes, in which each passcode corresponds to one data block; using the variable passcode and the first hidden key to generate a plurality of working keys; using the working keys to encrypt the data block, in which each data block is encrypted with a working key generated by a corresponding passcode; transmitting the encrypted data block and the variable passcode from the source to the target; recovering the working key with the variable passcode received by the target and the second hidden key; and, using the recovered working key to decrypt the encrypted data block received by the target.

Description

490966

This case is a method and system for transmitting confidential data using a hardware-protected built-in key and a variable passcode, especially a hardware-protected built-in key and a changed passcode to build a built-in key Method and system for transmitting confidential data with variable pass code. [Background] Cryptographic systems are developed to maintain the privacy of information transmission between communication channels. A cryptographic system is a system that can send a secure message from a transmitting end to a receiving end, so that only a specified receiving end can restore the message. Traditional codes can be classified into one type, one is a private recording password system, and the other is a public key password system. Figure 1 is a block diagram of a symmetric cryptosystem related to a private key system. As shown in Figure 1, the two communication terminals each have ciphers C1, c2, which are respectively used to encrypt the transmitted data and decrypt the received data. More specifically, the role of the cipher is to convert information about the plaintext into an encryption format known as ciphertext. Encryption is performed by operating or transforming the message using the cryptographic key K1. The other end decrypts the message, that is, uses the reversal operation or conversion procedure of the cryptographic key K2 to convert it from cipher text to plain text. Generally, in the private key cryptosystem, the contents of the encryption keys K1 and K2 are the same. Since 1977, digital encryption systems or the so-called DES system have been widely used in industry and government agencies. The DES system uses a 56-bit gold record to encrypt 64-bit data characters through a lengthy process of conversion and replacement. Another symmetric cryptosystem, I d E A (International data encrypti a 1 g0rithm) uses a similar architecture to DES, but uses a longer cryptographic gold loss. Key exchange system is an important subject in symmetric cryptosystems. its

490966

It is required that the two communication ends have the same encryption " The encryption key is generated by the transmitting end and hidden; the ground transmission key needs to be kept secret. Generally, the existing symmetric cryptosystem does not mention the receiving end. However, the description of the invention (2) No. 88120414 5 U. Therefore, if the security of the key is consistent with the security of the Internet, the transmitted message can be easily solved. You are right, everyone can cook. Another disadvantage of the symmetric f-code grabbing system is that, for example, 〆 is used between any two communication terminals. Because of the key, the system cannot make it known. -Once the two communication terminals do not mutually :; change = the two terminals cannot mutually determine. In order to solve the above shortcomings, Niu Er = built-in key (hldden_key) from the concept of privacy of the exchange 4 system = y 2 The entire system consists of two communication terminals u, which are respectively ^ 3 The decoder 15 (codec) and a second built-in key codec ^ 25. The built-in keys KEY and Q25 have built-in keys 丨 丨 and 21, respectively. Generally, the contents of the two built-in keys ^, 2; [are the same. When the transmitting end inputs Plaintext to the first built-in gold record codecl5, the built-in gold balance 11 is combined with the appropriate passcode 12 (passcode), and the one-way function 13 is processed to generate the coded gold record 1 4 (c 〇deingkey). ). The encoding key 14 is used in codecl5 to encrypt the plaintext into ciphertext. In addition to the ciphertext, the output of codecl5 also includes the passcode 1 2. After the receiving end receives the ciphertext and passcode 12, the same passcode 2 2 and built-in key 2 1 as the passcode 12 are processed by the one-way function 23 to generate a coded record 24, which is used by codec25 to decrypt the ciphertext. To the original plaintext. In general, coded gold loss 2 4 is the same as coded gold balance 14 〇

490966 ---- i ^ _88120414 Article 5: Description of Invention (3) " '7' It is always a necessary issue to keep the general gold records secretly in a password system. Based on the discovery of the shortcomings of the aforementioned cryptographic system, we hope that the system and method for transmitting machine data using the built-in keys protected by hardware and changing passcodes will be used. The system and method for transmitting confidential data using hardware to protect built-in keys and changing pass codes uses encoding keys and an encryption algorithm to perform encryption / decryption work, and can provide the secret of key exchange Sex. [Brief description of the invention] This case is ^ a secure data transmission system using hardware to protect the built-in gold record and a flexible code, which uses a hardware-protected built-in key and a changed passcode, including: a A source end and a destination end; a passcode generator to generate a changed passcode; a device for generating working money based on the built-in gold record and the changed passcode; and a device for encrypting and decrypting confidential data. A specific hardware is used to protect the internal circuit. The insurance is to cover the work order. The relative to the insurance is to use the system described in the description. If it is passed, it can only send the borrowed data.

The use system described above, its input single input / input and the use system described above, where a hard-core thin built-in Menglu and a variable passcode are included in a hardware module, and Not retrieved by external path. The built-in key and the variable pass code are kept confidential. The surplus generating device includes: a directional function, which meets the conditions of a second round of incompatible output inversion. The built-in key and variable passcode are protected.

490966 Amendment No. 88120414 V. Description of the Invention (4) The generator, to generate the pass code for the change. The security information transmission system using the built-in key and the pass code of Shifeng Sports Security as described in 2 is used, wherein the pass code is changed according to the confidential information. The described use of hardware to protect the confidentiality of the built-in key and the variable passcode. [2] The "system" further includes a feature extractor to extract the features of the confidential information. = Enable: ΪΪProtect the confidentiality of the built-in gold loser and variable passcodes Λ 'X ^' 1 ^ ... μ The change passcode generated by the passcode generator is the feature of using hardware two internal device to take out as described -function. The data transmission system and system also include the security of key and variable pass code: temporary storage element ', and the pass code generating device is produced in twentieth: the special feature is that it is stored in the dualization of the temporary storage element. The basic pass code and the store also proposed 'code in this case. The method for transmitting the serviced data of the security code is from: the local key and the pass-through: the pass code built to the key and the cross link includes the following steps: the source end of the target key,-the second built-in gold key to allocate the The confidential information is a plurality of information ^^ and is protected by hardware; blocks; | several cross-pass subscription codes' each pass code corresponds to a data area using the changed pass code and the first gold input; built-in key To produce plural

490966 fix

V. Description of the invention (5) By adding poor-owing to the work record of Lu Hai, ^ ^ ^, in the δ Hai lust block, each data block is encrypted by using the work key generated by H: code ; Transmitting the encrypted data block and the change from the source to the destination; τ Ma restores the work record by the change pass code and the second surplus received by the destination; and i, The rest of the working money of Hai Hei decrypts the plus block received by the destination. The method of using the hardware to protect the built-in gold balance and variable lean material transmission as described, wherein the working balance is derived from a second input and a second input and a corresponding output Conditional double-input single-output one-way function. Ί Use the hardware to protect the built-in key and data transmission method as described, where the passcode is a one-way one-way conditional output that is inferred by __compliance-by-input-and a corresponding output Function. The input uses the hardware to protect the built-in key and the variable data transmission method as described earlier. This change is generated by sending an order to a horse's premium device. -The generalized ordering code in Chinese is generated by-random variables, as described in the hardware protection built-in key and data transmission method, where each passcode is generated as η =, code and _ one taken from -A function corresponding to the characteristics of the data block.土 I 仃 [Brief description of the icons] ° Figure 1 is a block diagram of a traditional private recording cipher system; Β2 y The basic block diagram of a key cryptosystem;

Hi

LMJiHU, page 9, 490966, Amendment No. 881204U 5. Description of the invention (6) Figure 3 is the preferred embodiment 1 of the case; Figure 4 is the preferred embodiment of figure 2-Figure 5 is the second embodiment of the preferred embodiment 1 Branch flow block diagram; Figure 6 is the second preferred embodiment of the present invention. ": Figure 7 is a block diagram of the preferred embodiment 2 of the sixth embodiment of the present invention ^ Figure 9 is a block diagram of the preferred embodiment 3 of the present invention. Figure 10 (a) (i) is the preferred implementation and sequence of the present invention. J port your code and decoding process [Illustration of figure number] Figure 1 ·· C1 'C 2: Encryptor 12, 22 ·· Pass code U, 24: Codec (Codec) 1,2: Communication terminal

Kl, K2: Key diagram 2 · 11, 21 · Built-in gold loss 13, 23 · Early direction function 1 5, 2 5: Codec picture 3: 3, 4: Communication end 31, 41: Built-in gold钤 32: Random variable generators 33,43: Pass codes 34, 44 · Early direction function 35,45: Coding code 36, 46 :: Codec 37: Segmentation: Figure 4: Dry Also < Beck block PC: Passcode DB: Data block E (DB) · Added data block Encoder: Encoding Decoder: Decoder. Σσ Page 10 490966 Case No. 88120414 Explanation of the invention (7) Fig. 6 · 5, 6: Communication terminals 51, 61: Built-in keys 52, 6 2: Pass codes 53, 63: One-way functions 54 Functions 55, 6 5. Encoded gold inputs 56, 6 6 : Codec 57: Feature extractor Figure 8: 7: Source 70: Random variable generator 71 Built-in golden record 72: Pass code 73 Function 74: Feature extractor 75 One-way function 76: Code golden record 77 Encoding and decoding 78: Segmented data block diagram 9 · 8: Receiving end 81: Built-in Jinye 83 function 84: Feature extractor 85 One-way function 86: Encoding gold record 87 Encoding and decoding Ten (A) 91: Function 92, 9 3, 9 4, 9 5: Data block 96, 9 7, 9 8, 9 9: Real pass code map Ten (B) 101: Function 102, 1 0 3, 1 0 4,1 0 5 ·· Data area 1 0 6,1 0 7. 1 0 8. 1 0 9: Real pass code [Detailed description] Embodiment 1: Figure 3 is the first embodiment of this case. The entire password system includes two communication terminals 3

Page 11 490966 ---- Case No. 88120414_Year Month and Five ^ Description of the invention (Magic One and 4. For the transmitting end 3, the first input data is segmented into several consecutive data blocks 37 Corresponding to each new data block, the new pass code M is generated by the random variable generator 32. Then, the code is built with a one-way function processing unit 31 (hidden key) and pass code 33 The data block that generates the receiver's continuous performance is encrypted by the codec 3 6 (Co de C) using the encoding key 35. The cipher text is sent to the receiving end 4 with the corresponding pass code 3 3. As for the receiving end, using the received passcode "and built-in key 41, codec 46 can generate a code record 45 'from a general one-way function program 44 so that the codec 46 at the receiving end can use the obtained code balance 45 to Decrypt the ciphertext. Generally, the contents of the built-in keys 3 丨 and 41 are the same, and the work keys 35 and 45 are also the same. Figure 4 is a data flow chart of this embodiment. As shown in Figure 4, The data blocks marked DBA, DBB, DBC, and DBD are derived from random production I: Passcodes PCA, P CB, PCC and PCD code keys are used to encrypt. Then ^ encrypted data blocks are marked E (DBA), E (DBB), E (DBC) and E (DBD), ^ by the gold derived from the passcode Key to decode. The detailed steps of this embodiment are shown in Figure 5 and summarized as follows:

Step S1: The input data is segmented into continuous data blocks (DBA, DBB, DBC, DBD, etc.) at the source end; A Step S2: Generate a random one at the source end relative to the individual data area. Step S3: The source uses the passcode and the built-in key to generate the encoding key, and uses the encoding key to encrypt the corresponding data block. Step S4. From the source, the data block and the corresponding block The passcode is transmitted to the destination;

Page 12 490966 ___ Case No. 88120414 V. Description of the invention (9)

Step S 5 ·· Use the received passcode and the contents within it to restore the encoding key at the destination; and bite into step S6 ·· Use the encoding key generated in the area at the destination to solve the poor data Block. * Receiving: Month obviously: According to the idea of this case, the encoding key used for the encryption process varies with each parent material block. As a result, encoding gold loses. That is, it will be difficult to establish the correlation between the encoding key and the corresponding plaintext / poor = group, and even to calculate the built-in key. Mountain Second Embodiment: Figure 6 is a block diagram of the second preferred embodiment of the present invention. Similarly, the entire system can be divided into two subsystems 5 and 6. For the transmitting end 5, the real pass code used to generate the encoding balance 55 is a function 54 derived from a basic pass code 52 and some features from the data of the feature extractor 57. In this embodiment, the basic pass code 5 2 is fixed and is built on the source side. Feature extraction cry 5 7 You can extract the features of the input data, such as the current time, attributes, fixed length of the information ’building case, and its check sum. At the communication end 5, the built-in key 5 1 of the real passcode of the person 5 is processed by the one-way function 5 3 to generate the stone = key 55. Furthermore, the data is encrypted by the codec56 using the encoding key 55, ... At the communication end 6, like the encoding key 55, the pass code 62 received from the other communication terminal and the built-in gold record 61 is processed by the one-way function 63 to generate the encoding key 65, which is used to communicate with c. dec66 merge to decrypt the data. Obviously, in the second embodiment, the real pass code changes with the input data. In particular, the real passcode can change as the data is entered. So the ‘encoding key 5 5’ can be changed even when the input remains the same

66 ^ S 88120414 of bamboo V. Description of invention (10) Modification and support. In other words, the real pass code is delivered to the communication peer, and the encoded key 66 is restored regionally. The detailed steps of the second embodiment are shown in Figure 7, and the summary is as follows: y Step S1 1 · Extract features such as slot length, attributes, input time, addressing, etc. on the source side; Step S1 2 · Calculate a basic on the source side The specific function of the pass code and the extracted features to obtain the real pass code; Step S13: Use the real pass code and the built-in gold input at the source side to generate an encoding key, and encrypt with the encoding key The corresponding data block; step S1 4: transmitting the data block with the corresponding real passcode from the source to the destination; step S1 5 · using the received passcode and its The internal built-in gold record is used to return the original code balance; Step S16 ··· Use the coded key generated in the area at the destination to decrypt the received data block. FIG. 8 is a block diagram of the third embodiment. For simplicity, only the source 7 is described. First, the data is segmented into several blocks π, which are further input to a codec 77 and a feature extractor 74, respectively. At the same time, the pass code 72 is generated by a random variable generator, which is synchronized with the data segment 78. The pass code 72 and the extracted features are then processed by a one-way function 73 to generate a true pass code. As in the above embodiment, a built-in record 71 and the real pass code are processed by another one-way function 5 to generate a coding key 76, which is used by the codec 77 to encrypt the data. Such as

490966 Case No. 881204U V. Description of the invention (11) The real pass key 86 generated by the month is modified and connected to the basic principle of generating the real pass. The true feature extractor 7 4 and this basic flux generator 70 are the benefits of the second embodiment. The input is adjusted. The code record 8 6 is used to solve the line code system. The code of the extracted line is generated. . The features of Figure 9 are secretly used by a one-way function 85 to generate the code gold—codec87, to decrypt the data. The feature extractor 84 merged with the pass code is used in this embodiment in combination with the codes of the first and second embodiments to derive a feature preset function 7 3 from a basic pass code 7 2 and a input data of — . Except for a random variation result synchronized with the input data block, this embodiment obtains the first embodiment and the actual encoding and decoding process. Obviously, even the receiver 8 on the 5H will not restore the original material. Embodiment 4 This embodiment is similar to the previous one. e ^ 3 is different at ☆, at this time; Second: Example 4 and Examples are in this implementation <column, the opposite bank is one capital and two "block: selected and then extracted this feature. The former data block." Zone ;: It guides one cycle of its nearest data block \ The device is used to retain it for up to a week and is replaced. Yu Chuanyuzhu ^ σ; μ, the political extractor retains the other end of the feature, which can be delivered to the basic pass Shima Xiang received by:] the birth pass code, the receiving end uses the encoding key . Figures ten (A) and ten (B) are divided in order to restore the required order. As shown in the figure, at the encoding end, the data; the coding and decoding processes are 92, 93, 94, 95, and so on. No.-&quot; is a section of several data blocks. Page 15 490966

The first data block is encrypted by the basic pass code and the real pass code 97 generated from the data block 92, broken = pre ^ function 91. Similarly, the second data block 94 is encrypted by the basic passcode and the real passcode 98 generated by the function 91 obtained from the characteristics of the data block 93. The same is true for data block 95. Knife—At the end of Xiao's code, the encrypted data block received is the same in the same way. The tribute block 丨 〇2 is decrypted by the basic passcode and the predetermined function 1 (预定) of the real passcode 106 generated. After that, the data block 103 is composed of the basic passcode and the data block 1 The real passcode generated by the function ι〇1 characteristic of 2 is decrypted. Similarly, the data block 〇04 is the true generated by the base pass code and the function 101 obtained from the characteristic of data block 103. The decryption is performed through the line code 108. The same is true for the data block 05. The relationship between the pass code (real pass code) and the encoding key transmitted in the fourth embodiment is more complicated than W. Therefore, 'It can be expected that the fourth embodiment can provide a stronger password system. This case can be implemented by any person skilled in the art who works as a craftsman.

Claims (1)

490966 Case No. 88120414, patent application scope x kinds of confidential data transmission systems using hardware protection of built-in keys and variable pass codes, which use a hardware-protected built-in key and a changed pass code, including: A source end and a destination end; a special government extraction state, by which a feature is extracted from a data block of the source end, the feature is the current time of a data block, an attribute, 'A coffin case length and a check sum; a pass code generator that includes a random variable generator to generate a changing pass code based on the features extracted by the feature extractor, the pass code is It is changed according to the data block, and the changed pass code is a function of two basic pass codes and the features extracted by the feature extractor; a working key generating device generates the internal code according to the built-in gold pass code Jianjin 鍮 is included in the hardware = S worker: ΐ! Ί hunted by a specific circuit rather than by an external path; Coupling-to ΐ ΐ device contains-one-way function of dual input single output, its input cannot By -Input and-Corresponding output change: = force solution! : Device for confidential data, 11 with the work key and the 2. such as code and decrypt the data block. The optional breeding material transfer system using hardware to protect the built-in tear as described in item 1 above on v can also include: Feature transmission methods 1, 2 to protect the built-in key with hardware and variable access Code of confidential information to a destination 'using hardware protection Page 17 1 Store 7L pieces to store one from the previous data block. 490966 _Case No. 88120414_Year Month Day__ VI. Passport for applying for a patent key to build a key and change, which includes the following steps: Provide a A first built-in key to the source end, a second built-in key to the destination end, the first and second built-in keys are equal and protected by the hardware; allocating the confidential data into a plurality of data areas Block; generating a plurality of change passcodes, each passcode corresponding to a data block, using the change passcode and the first built-in key to generate a plurality of work records, the work loss is determined by a The two inputs cannot be generated by a one-way function of two inputs and one output with the conditions inferred by a first input and a corresponding output; measures are used to encrypt the tribute block by the work record. The method is encrypted by using a work record generated by a corresponding pass code, which is a dual input single output that meets a condition that a second input cannot be deduced by a first input and a corresponding output One-way function Transmitting the encrypted data block and the changed passcode from the source to the destination; recovering the work key by the changed passcode and the second built-in key received by the destination; and The recovered work key is used to decrypt the encrypted data block received by the destination. 4 · The method for transmitting secure data using the hardware-protected built-in key and a variable passcode as described in item 3 of the scope of the patent application, wherein the changed passcode is generated by a random variable generator. 5 · The secure data transmission method using hardware to protect the built-in key and variable passcode as described in item 3 of the scope of the patent application, where each passcode is generated Page 18 490966 l _Case No. 88120414_ Year Month Revision_ VI. Patent Application Range As a function of a basic pass code and a feature taken from a corresponding data block. 6. The method for transmitting secure data using a hardware-protected built-in key and a variable passcode as described in item 3 of the scope of the patent application, wherein the basic passcode is generated by a random variable generator. 7 · The secure data transmission method using hardware to protect the built-in key and variable passcode as described in item 3 of the scope of the patent application, where each passcode is generated as a basic passcode and one is taken from the previous one A function of the characteristics of a data block. 8. The secure data transmission method using hardware to protect the built-in gold record and variable passcode as described in item 7 of the scope of the patent application, wherein the basic passcode is generated by a random variable generator. Page 19