WO2011078535A2

WO2011078535A2 - Method and apparatus for separating personal information into sequential information and content information and then encrypting and compositing the information, a server and a recording medium

Info

Publication number: WO2011078535A2
Application number: PCT/KR2010/009111
Authority: WO
Inventors: 이순구
Original assignee: Lee Soon Goo
Priority date: 2009-12-22
Filing date: 2010-12-20
Publication date: 2011-06-30
Also published as: WO2011078535A3

Abstract

According to one embodiment of the present invention, a data encryption process performed in a data encryption means comprises: separating part of the information to be encrypted and determining sequential information; setting the other information, except the sequential information, out of the information to be encrypted as content information; performing a first encryption operation to make the encryption information of the sequential information into indexing information; performing a second encryption operation on the sequential information, independent of the indexing; generating encrypted content information by performing a third encryption operation on the content information, independent of the indexing, in a different manner from the second encryption operation; generating encrypted sequential information by replacing a part of the second encryption result values with the first encryption result values; and storing in a storage means the encrypted content information in correspondence to the encrypted sequential information.

Description

Method, device, server, and recording medium to separate and encrypt personal information into order information and content information

The present invention relates to a method, an apparatus and a recording medium for encrypting personal information, and in particular, to distinguish and encrypt the order information and the content information separated from the personal information such as social security number, card number, account number, and the like and before the encryption By synthesizing and storing each encrypted information so that it can be maintained, it is possible to index even the encrypted information in order using a secure encryption algorithm such as National Standard Encryption Logic (ARIA), and to quickly search, A device and a recording medium.

Attempts to solve search performance by database encryption have been conducted since 2000. DB encryption and retrieval technology can be largely divided into index encryption technology and order maintaining encryption technology. The characteristics are as follows.

First, the Bucket-based index algorithm is a method of creating a separate index column to create an index using the encryption DB search algorithm proposed by Hacigumus in 2002. This method has the advantage of being able to apply encryption to both numbers and characters with a well defined mapping function, but it requires additional filtering to find the exact matched plain text value and practically does not range search.

In addition, the hash-based index algorithm is a method of encrypting a column to be used for an index by using a one-way hash function. Choosing a hash function without Collision has the advantage of providing exact match and applying both numbers and letters, but it does not support range search, exact match requires additional filtering, and it is vulnerable to analogy attack using frequency distribution. Do.

In addition, the B + tree index algorithm is constructed separately in the order of plain text, and is safe from analogy attacks using frequency distribution using an index encryption method. However, if data is inserted or modified frequently, the B + tree needs to be re-created, and the data on the node has to be decoded to reach the final value even though the data on the node is not directly used.

In addition, the random number based encryption algorithm generates pseudo-random data using pseudo random numbers so that the order of the encryption results is the same as the original plain text order, and continuously generates pseudo random numbers during decryption to subtract the random number from the encrypted data. This is how to find plain text. There is an advantage that you do not have to worry about updating the encrypted data, but it is vulnerable to attacks using the frequency distribution, has a very large overhead of managing pseudo random numbers, and can only encrypt integers.

In addition, since the Polinomial function based encryption algorithm uses pseudo random numbers as a random number based encryption algorithm, the encryption value increases exponentially as the number increases, and the overhead of managing it increases the order maintenance using the monotonically increasing function. Encryption method. In this method, since only the coefficient information of the polynomial is needed for encryption and decryption, the encryption and decryption procedure is very simple, can be applied to mistakes, and there is no need to consider the problem of updating the encrypted data. However, since the distribution of the ciphertext is determined by the polynomial, inference attack is possible, and the order of the plaintext can be exposed when used with other columns.

The Order Preserving Encryption Scheme (OPES) algorithm is a typical algorithm in the field of ordered encryption and is a method of maintaining the order of encryption values for numerical data. In the encrypted state, it is possible to search for exact match, range search, MIN, MAX, Count, Groupby Order By, etc., and it is safe against attack using frequency of occurrence by different distribution of plain text and cipher text. However, if only the numeric data is applied and there are unencrypted columns in the same table, plain text information may be exposed through the analysis of ordinal statistics.

Many existing encryption methods, such as these, are currently being developed, and the encryption methods that supplement them are long gone and are published in papers or patents. However, the existing encryption method is excellent in preventing hackers from infiltrating, but has a fundamental problem of not being able to easily respond to the fast search function requested by a modern insurance company or financial institution. In addition, since 2009, Korea has been distributing personal information protection guides to insurance companies, banks and securities companies to make them legal. The Personal Information Protection Act encrypts customer IDs, passwords, social security numbers, and account numbers to prepare for mass hacking. According to this law, personal information must be encrypted and searched quickly. The existing encryption method encrypts the data and then cannot use the index function to find the data in the database. There was a problem that was very difficult to find.

Therefore, the present invention is urgently needed because a new model of encryption method is required to prevent hacking and search quickly even after encrypting data.

Accordingly, the present invention is to solve the above-described problems, the object of the present invention is to distinguish the order information and the content information separated from the personal information such as social security number, card number, account number and the like and encrypt the order information as before encryption The present invention provides an encryption method, an apparatus, and a recording medium capable of synthesizing and storing each encrypted information so as to maintain the same.

In addition, the present invention provides an encryption method, an apparatus, and a recording medium which can index in order and search quickly even by using a secure encryption algorithm such as a national standard encryption logic (ARIA).

First, to summarize the features of the present invention, the method for encrypting data in the data encryption means according to an aspect of the present invention for achieving the object of the present invention as described above, to determine the order information by separating a portion of the information to be encrypted Doing; Determining a portion of the encryption target information including the remaining information from which the order information is separated as content information; First encrypting the encryption information of the order information to be indexing information; Encrypting the order information independently of indexing; Generating encrypted content information by third encrypting the content information in a different manner from the second encryption regardless of indexing; Generating encrypted order information by replacing a part of the result value of the second encryption with the result value of the first encryption; And storing the encrypted content information in a storage means in correspondence with the encrypted order information.

The first method of encryption includes selecting each element (number, letter, or symbol) of the sequence information based on a G-table that divides codes on an ASCII code system into a plurality of groups in order. This is a method of converting to a value corresponding to a corresponding code belonging to one group.

Generates an S-table in which codes of different groups of the plurality of groups are mapped one by one with respect to different elements included in the order information according to the input S-key, and based on the S-table, Each element can be converted.

The encryption target information includes a social security number, a credit card number, or an account number of a financial institution.

The second encryption method is a method based on a one-way encryption method.

The one-way encryption scheme includes a scheme based on a secure hash algorithm.

The third encryption method is based on National Standard Encryption Logic (ARIA).

The encryption method may further comprise: encrypting the encryption information of the order information such that the encryption information is indexing information; And generating the encrypted order information by replacing a part of the result value of the second encryption with a combination of the result value of the first encryption or the result value of the fourth encryption.

The fourth encryption method is a method of converting the order information by using a function including a fifth or more equation.

Further, in the data encryption means according to another aspect of the present invention, a method for encrypting data includes content information including sequence information separated from encryption target information and remaining information from which the sequence information is separated among the encryption target information. It is combined by encrypting in different ways, characterized in that the encrypted information so that the sequence information is included as indexing information, stored in a database and managed.

The ordered information is encrypted based on a one-way encryption method, an encryption method using a function including a fifth order equation, or a G-table that divides codes on an ASCII code system into a plurality of groups in order. And a combination of encryption methods for converting each element of the information into a value corresponding to a corresponding code belonging to any one of the plurality of groups.

In addition, the encryption apparatus according to another aspect of the present invention, to determine the order information by separating a portion of the encryption target information, and determines the portion of the encryption target information including the remaining information from which the order information is separated as the content information. Information separation means; First encryption means for first encrypting the encryption information of the order information to be indexing information; Second encryption means for secondly encrypting the order information regardless of indexing; Third encryption means for generating third encrypted content information by encrypting the content information in a manner different from the second encryption regardless of indexing; Combining means for generating encrypted order information by replacing part of the second encryption result with the first encryption result; And storage means for storing the encrypted content information in a storage means corresponding to the encrypted order information.

The first means for encrypting each element (number, letter, or symbol) of the order information based on a G-table that divides codes on an ASCII code system into a plurality of ordered groups, any one of the plurality of groups. Convert to a value that corresponds to the code in the group.

The first encryption means generates an S-table in which codes of different groups of the plurality of groups are mapped to one another according to different elements included in the order information according to the input S-key, and the S-table Each element of the order information is converted based on.

The encryption apparatus further includes fourth encryption means for fourth encryption so that the encryption information of the order information becomes indexing information, and the combining means replaces a part of the result value of the second encryption with the result value of the first encryption. Or replace the combination of the result values of the fourth encryption to generate the encrypted order information.

The data management server for encrypting, storing, and managing data received from a user terminal according to another aspect of the present invention includes order information separated from encryption target information among the data, and the order information among the encryption target information. And encrypting and combining the content information including the remaining remaining information in different ways, and encrypting and storing the ordered information so that the encrypted information is included as indexing information, and storing and managing the information in the database. In response to the request for data from the encrypted information stored in the database by referring to the indexing information, characterized in that for providing the search results to the user terminal.

According to the encryption method, apparatus and recording medium according to the present invention, the variable information and the hash function are used to encrypt the order information of personal information such as social security number, card number, account number, etc., and the content information is national standard encryption logic (ARIA). Highly secure because it is encrypted and stored.

In addition, by encrypting the sequence information, indexing is possible even after encryption, financial institutions or telecommunications companies that hold tens of millions of personal data can securely manage customer information by making some modifications to existing programs without investing in large hardware.

Also, it is ideal for encrypting and retrieving personal information such as social security number, card number, account number, etc., and even if the insider leaks personal data, it has high security effect and prevents hacking.

1 is a flowchart illustrating an encryption method according to an embodiment of the present invention.

2 is a view for explaining the sort order maintenance before and after encryption according to the encryption method according to an embodiment of the present invention.

3 is an illustration for explaining each encryption result in the encryption process according to the encryption method according to an embodiment of the present invention.

4 is a diagram illustrating a G-table applied to variable code encryption according to an embodiment of the present invention.

5 is an example of a hexadecimal value according to an S-key of an S-table applied to variable code encryption according to an embodiment of the present invention.

6 is an example of an output symbol according to an S-key of an S-table applied to variable code encryption according to an embodiment of the present invention.

7 is a block diagram of an encryption apparatus according to an embodiment of the present invention.

8 is a block diagram of a variable code encryption unit according to an embodiment of the present invention.

9 is a flowchart illustrating an encryption method according to another embodiment of the present invention.

10 is an illustration for explaining indiscriminate equation encryption according to the present invention.

11 is a diagram for explaining an example where the encryption apparatus according to the present invention is realized in a server connected to a network.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings and the contents described in the accompanying drawings, but the present invention is not limited or limited to the embodiments.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Referring to FIG. 1, first, an encryption apparatus for encrypting various types of encryption required data according to an encryption method according to an embodiment of the present invention receives encryption target information (S110). Here, the encryption target information means personal information composed of Arabic numerals (0 to 9) such as a social security number, a credit card number, or an account number of a financial institution. However, in some cases, the encryption target information may include not only numbers but also letters or symbols, and it may be noted that the above numerical information may further include other information in which letters or symbols are added.

When the encryption target information is received, the encryption apparatus may determine a sequence information by separating a portion of the encryption target information, and a portion of the encryption target information including the remaining information from which the sequence information is separated (for example, the entirety of the encryption target information). ) May be determined as content information (S120). For example, when the information to be encrypted is the social security number 600511-1690413, a part of the seven-digit number 6005111 may be determined as the order information, and the entire information 6005111690413 may be determined as the content information to be substantially encrypted. Here, although the encryption target information is the social security number, the 7-digit order information is taken as an example, but the present invention is not limited thereto. For example, the order information may be any one digit from 1 to 13 digits. Even when characters or symbols are included in the information to be encrypted, the order may be set in advance so that they may be arranged in a predetermined order, and some of them may be order information.

After the order information and the content information are determined as described above, the encryption apparatus performs variable code encryption on the order information (S130). In this way, the variable-code encrypted information becomes indexing information that enables the sort order to be known. The variable code encryption method is a data conversion method based on codes on the ASCII code system as described below.

For example, as shown in 210 of FIG. 2, various encryption target information (for example, social security number) may be converted into a hexadecimal value (hexadecimal value) in ASCII code before encryption. Can be decided. For example, in the case of searching for the resident registration number 600511-1690412 in the data search according to the order of sorting, it is earlier than 3 times in the order of sorting in FIG. It is not necessary to search for the

following sort order

4, 5...

However, in case of encrypting data according to an encryption method such as Secure Hash Algorithm or National Standard Encryption Logic (ARIA), the index information disappears after encrypting the data to retrieve the necessary data from the encrypted data. In this case, it is difficult to search the entire encrypted data stored in the database. In the present invention, the variable code-encrypted information is used as indexing information, and the variable-coded encrypted information (indexing information) is included at the front of the hexa value of the encrypted information as shown in 220 of FIG. We wanted to know the order of sorting.

In the variable code encryption method performed in step S130, each element of the above order information (numbers, letters, and the like) is based on a G-table (see FIG. 4) that divides codes on the ASCII code system into a plurality of groups in order. Or a symbol) into a value corresponding to a corresponding code belonging to one of the plurality of groups. Here, an S-table (see FIG. 5) corresponding to codes of different groups of the plurality of groups is generated for different elements included in the order information according to the input S-key, and the corresponding S-table is generated. Convert each element of the corresponding order information based on.

For example, as shown in FIG. 3, the seven-digit number 6005111, which is the sequence information of the social security number 600511-1690413, which is the encryption target information, is set according to the S-table shown in FIG. 5 based on the G-table shown in FIG. 21 5A 2B 2B 2B

Codes on the ASCII code system used for such a variable code encryption method have 256 code systems, and are divided into a plurality of ordered groups, such as the G-table of FIG. 4. As shown in Fig. 4, the number 0, which is an element of the order information to be encrypted, is converted into a value corresponding to a corresponding code belonging to a group consisting of hexadecimal values 21 (output symbols '!') To 28 (output symbols '(') on the ASCII code. That is, in the case where the input S-key is 1, the number 0 may be converted to the hexadecimal value 21 as shown in FIG.

Similarly, as shown in Fig. 4, the number 1, which is an element of the order information to be encrypted, corresponds to a corresponding code belonging to a group consisting of hexadecimal values 29 (output symbol ')' to 35 (output symbol '5') on an ASCII code. Can be converted to In this case, when the input S-key is 1, the number 1 may be converted into a hexadecimal value 2B as shown in FIG. 5. In the same way, other Arabic numerals 2-9, which are elements of the order information, can be converted to the corresponding hexa value.

According to the above example, the seven-digit number 6005111, which is the order information, can be converted to 65 21 21 5A 2B 2B 2B when the input S-key is 1, and the value differs depending on the input S-key. May be converted to. FIG. 6 shows output symbols (symbols displayed on the user terminal) on the ASCII code system corresponding to the hexa value of FIG. 5.

For example, when the input S-key is 3, as shown in 220 of FIG. 2, the seven-digit sequence information 5711101 of the encryption target information 571110-1017817 may be converted into 5F6F2F2F2F282F. As such, the S-key, which may be input differently at each encryption time, may be more usefully used to prevent hacking. As shown in 220 of FIG. 2, the encrypted indexing information may be different according to the change of the S-key, but the order of sorting is different. Can remain the same. That is, even when the S-key is input to any one of 1 to 13 as shown in FIG. 5, the encrypted information according to the variable code encryption of the order information may be indexing information that can know the sort order.

Meanwhile, in S140 of FIG. 1, the encryption apparatus encrypts the sequence information separated from the encryption target information as described above according to a one-way encryption scheme such as a secure hash algorithm. 3 illustrates an example of the encryption result of the secure hash algorithm for the seven-digit number 6005111, which is the sequence information. When the sequence information is encrypted according to the secure hash algorithm, the encrypted sequence results the sort order regardless of indexing. You won't know. The secure hash algorithm is a method of using a predetermined hash function that converts data having an arbitrary length into a hash value having a fixed length, and is a one-way way in which data modulation by a third party can be easily identified. ) Encryption method, and there are various methods such as Message Digest 4 (MD4), Message Digest 5 (MD5), Secure Hash Algorithm (SHA) -1, and algorithms for these can be acquired based on published data. The detailed description is omitted here.

In operation S150 of FIG. 1, the encryption apparatus may include a portion of a result of encryption according to the secure hash algorithm as described above, for example, a seven-digit hexadecimal value (33353931616633) in the above example as a variable code encryption method in operation S130. The encrypted result value (6521215A2B2B2B) is substituted (S150) to generate encrypted order information as shown in FIG. 3 (S160).

On the other hand, if the portion (for example, the entirety of the encryption target information) including the remaining information from the encryption target information is separated from the encryption target information in step S120 is determined as the content information, the encryption apparatus converts the content information to the national standard encryption logic. (ARIA) The encryption is performed according to the based encryption method (S170). As described above, the content information may be personal information consisting of Arabic numerals (0-9), such as a social security number, a credit card number, or an account number of a financial institution, but in some cases, may include letters or symbols as well as numbers. The above numerical information may further include other information with additional characters or symbols.

FIG. 3 exemplifies contents information encoded according to the National Standard Encryption Logic (ARIA) for the 13-digit number 6005111690413, which is the information on the Resident Registration No. 600511-1690413, and according to the National Standard Encryption Logic (ARIA). When the content information is encrypted, the encrypted result does not know the sort order regardless of indexing. The encryption method based on the National Standard Encryption Logic (ARIA) is an encryption method adopted as the Korean standard encryption method and is also called a 128-bit block encryption algorithm. Algorithms for the National Standard Cryptography Logic (ARIA) can be acquired based on published data, so detailed descriptions are omitted here.

As described above, when the encrypted order information is generated in step S160 and the encrypted content information is generated in step S180, the encrypted content information may be stored in a storage means such as a database in correspondence with the encrypted order information.

For example, as shown in 220 of FIG. 2, various encryption target information (for example, a social security number) may be encrypted and stored in a database according to the method of the present invention as shown in FIG. 1. As in step S150 of FIG. 1, a part of the result value encrypted according to the secure hash algorithm, for example, the result value encrypted by the variable code encryption method in step S130 with the 7-digit hexadecimal value (33353931616633) in step S130. The encrypted order information generated by substituting (6521215A2B2B2B) and the encrypted content information generated in step S180 may be corresponded to (or in addition to) database storage management. Accordingly, since there is indexing information (a variable code encrypted information of the order information) that knows the sort order in front of each encrypted final information, the data management server can sort the data. Accordingly, when the request information is retrieved from each encrypted final information, the data management server can quickly search based on such indexing information and provide the corresponding data.

Each step of the encryption method according to an embodiment of the present invention as shown in FIG. 1 may be implemented as a computer readable code on a computer readable recording medium so that a corresponding function may be realized. In addition, the encryption method according to an embodiment of the present invention can be implemented as a device as shown in FIG.

7 is a block diagram of an encryption apparatus 700 according to an embodiment of the present invention.

Referring to FIG. 7, the encryption apparatus 700 according to an embodiment of the present invention may include an information separation unit 710, a variable code encryption unit 720, an incomprehensible equation encryption unit 725, and a one-way encryption unit 730. ), A combination unit 740, an ARIA encryption unit 750, a storage unit 760, and a database 761. The variable code encryption unit 720 may include a G-table database 721, an S-table generator 722, and an S-table database 723 as shown in FIG. 8. Such an encryption apparatus 700 according to an embodiment of the present invention may be implemented by hardware, software, or a combination of hardware and software.

The information separator 710 receives the encryption target information (see S110 of FIG. 1). Here, the encryption target information may be personal information consisting of Arabic numerals (0-9), such as a social security number, a credit card number, or an account number of a financial institution, and in some cases, the encryption target information includes not only numbers but also letters and symbols. In addition, the numerical information may further include other information in which letters or symbols are added.

When the encryption target information is received, the information separation unit 710 may determine a sequence information by separating a portion of the encryption target information, and a portion (eg, encryption) including the remaining information from which the corresponding sequence information is separated from the encryption target information. The entirety of the target information) can be determined as the content information (see S120 of FIG. 1). For example, when the information to be encrypted is the social security number 600511-1690413, a part of the seven-digit number 6005111 may be determined as the order information, and the entire information may be determined as the content information to be substantially encrypted. As described above, when the encryption target information is the social security number, the seven-digit order information is taken as an example, but the present invention is not limited thereto. For example, any one digit from one to thirteen digits may be determined as the order information. have. Even when characters or symbols are included in the information to be encrypted, the order may be determined in advance so that they may be arranged in a predetermined order, and some of them may be determined as order information.

After the order information and the content information are determined as described above, the variable code encryption unit 720 performs variable code encryption on the order information (see S130 of FIG. 1). In this way, the variable-code encrypted information becomes indexing information that enables the sort order to be known.

Variable code encryption is a data conversion method based on codes on the ASCII code system. For example, the variable code encryption method uses each element of the above sequence information (number, letter, or symbol) based on a G-table (see FIG. 4) that divides codes on the ASCII code system into a plurality of ordered groups. Is converted into a value corresponding to a corresponding code belonging to any one group among a plurality of groups.

The G-table database 721 of the variable code encryption unit 720 may store and manage a G-table (see FIG. 4) that divides codes on an ASCII code system into a plurality of groups in order. Codes on the ASCII code system used for such a variable code encryption method have 256 code systems, and are divided into a plurality of ordered groups, such as the G-table of FIG. 4. As shown in Fig. 4, the number 0, which is an element of the order information to be encrypted, is converted into a value corresponding to a corresponding code belonging to a group consisting of hexadecimal values 21 (output symbols '!') To 28 (output symbols '(') on the ASCII code. Similarly, as shown in Fig. 4, the number 1, an element of the order information to be encrypted, is assigned to a corresponding code belonging to a group consisting of hexadecimal value 29 (output symbol ')' to 35 output symbol '5') on an ASCII code. Can be converted to the corresponding value. In the same manner, other Arabic numerals 2 to 9, which are elements of the order information, can be converted into corresponding hexa values as in the G-table of FIG.

The S-table generating unit 722 corresponds to an S-table in which codes of different groups among the plurality of groups are mapped to one another in accordance with the S-key input from a user terminal or the like. 5) may be generated, stored and managed in the S-table database 723, and the variable code encryption unit 720 converts each element of the corresponding order information based on the corresponding S-table.

In other words, when the input S-key is 1, the number 0 may be converted to the hexa value 21 as shown in FIG. 5. In addition, the number 1 may be converted to the hexadecimal value 2B. In the same way, other Arabic numerals 2-9, which are elements of the order information, can be converted to the corresponding hexa value.

For example, when the input S-key is 3, the S-table generation unit 722, as shown in the S-table of Fig. 5, a plurality of groups in which the codes on the ASCII code system are ordered for the corresponding S-keys. Each of the codes of different groups may be generated one by one, but may be stored in the S-table database 723 and stored in the S-table database 723. For other S-keys (one of 1 to 13), the S-table generator 722 stores and manages the corresponding S-table values in the database 723 in a similar manner, and based on this, the variable code encryption unit 720 ) Converts each element of the corresponding order information. For example, when the input S-key is 3, as shown in 220 of FIG. 2, the seven-digit sequence information 5711101 of the encryption target information 571110-1017817 may be converted into 5F6F2F2F2F282F.

As such, the S-key, which may be input differently at each encryption time, may be more usefully used to prevent hacking. As shown in 220 of FIG. 2, the encrypted indexing information may be different according to the change of the S-key, but the order of sorting is different. Can remain the same. That is, even if the S-key is input to any one of 1 to 13 (which may be a larger number in some cases) as shown in FIG. 5, the indexed information for which the encrypted information according to the variable code encryption of the order information can know the sort order. Can be

Here, the case of receiving the S-key is exemplified, but is not limited thereto. The variable code encryption unit 720 may use the remainder or the quotient obtained by dividing the order information by a predetermined value as the S-key. The remaining division or quotient after giving a predetermined weight to the element can also be used as the S-key.

Meanwhile, the one-way encryption unit 730 encrypts the sequence information separated from the encryption target information as described above according to a one-way encryption method such as a secure hash algorithm. 3 illustrates an example of the encryption result of the secure hash algorithm for the seven-digit number 6005111, which is the sequence information. When the sequence information is encrypted according to the secure hash algorithm, the encrypted sequence results the sort order regardless of indexing. You won't know. The secure hash algorithm is a method of calculating a hash value using a predetermined hash function. Since the algorithm can be acquired based on published data, a detailed description thereof will be omitted.

The combiner 740 is a part of the result of encryption according to the secure hash algorithm as described above, for example, the result of the seven-digit hexadecimal value (33353931616633) encrypted by the variable code encryption method in step S130 in the above example. Substituted by (6521215A2B2B2B) generates encrypted sequence information as shown in FIG. 3 (see S150 and S160 of FIG. 1).

On the other hand, when the information separation unit 710 determines the entirety of the information to be encrypted as the content information, the ARIA encryption unit 750 encrypts the content information according to the encryption method based on the National Standard Encryption Logic (ARIA) (FIG. 1). See S170). As described above, the content information may be personal information consisting of Arabic numerals (0-9), such as a social security number, a credit card number, or an account number of a financial institution, but in some cases, may include letters or symbols as well as numbers. The above numerical information may further include other information with additional characters or symbols.

As described above, when the encrypted order information is generated in the combiner 740 and the encrypted content information is generated in the ARIA encrypting unit 750, the storage unit 160 stores the encrypted content information in correspondence with the encrypted order information. In the database 861.

For example, as shown in 220 of FIG. 2, various encryption target information (for example, a social security number) may be encrypted and stored in a database according to the method of the present invention as shown in FIG. 1. For example, the combiner 740 generates a part of the result value encrypted according to the secure hash algorithm, that is, replaces the first 7 hexadecimal value (33353931616633) with the result code (6521215A2B2B2B) encrypted by the variable code encryption method. The encrypted order information and the encrypted content information generated by the ARIA encryption unit 750 may correspond to (or in addition to) store and manage the database 761.

9 is a flowchart illustrating an encryption method according to another embodiment of the present invention. In FIG. 9, a process in which each step of S210 to S290 is performed is similar to that of FIG. 7, in addition to the steps of S300 and S310.

For example, the incomprehensible equation encrypting unit 725 of FIG. 7 uses a function including order equations among the order information and the content information included in the above encryption target information as shown in Equation 1 above. Each element of the sequence information can be converted and encrypted (S300). Mathematician Abel proved that the root can not be found algebraically on equations of 5th or higher order. By encrypting it, it has security against hacker attacks. In Equation 1, variables a to k are constants such as real numbers.

Here, Equation 1 shows an example of a fifth-order function, and in some cases, it is not possible. The equation encryptor 725 includes various fifth-order functions, or sixth or seventh order equations such as fifth or more equations. Each element of the order information can be converted using the function F (x).

[Equation 1]

F (x) = (a * x * f (x4) -b) / c

f (x4) = (d * x * f (x3) -e) / c

f (x3) = (f * x * f (x2) -g) / c

f (x2) = (h * x * f (x1) -i) / c

f (x1) = (j * x-k) / c

For example, as shown in FIG. 11, the incomprehensible equation encrypting unit 725 may convert order information included in the resident registration number into x by using a fifth-order function such as [Equation 1]. In this case, since the alignment order is maintained as shown in FIG. 11, the indexing information can be used as indexing information. However, since the result of encryption converted using the function F (x) has a very large number as shown in FIG. 11, the inconsistency equation encryption unit 725 is a natural log (ln). The transcendental function may be processed to maintain a small value of the encrypted number (S310).

Accordingly, in operation S250, the combiner 740 may replace a portion of the result value encrypted by the one-way encryption unit 730 with the result encrypted by the variable code encryption unit 720, but in one direction. A part of the result value encrypted by the encryption unit 730 may not be replaced by the result value encrypted by the equation encryption unit 725. However, the present invention is not limited thereto, and the coupling unit 740 may partially encrypt the result value encrypted by the one-way encryption unit 730 in some cases, or may not be encrypted. The combination of result values encrypted by the equation encrypting unit 725 may be substituted. For example, the combiner 740 replaces a part of the result value encrypted by the one-way encryption unit 730 with the result encrypted by the variable code encryption unit 720 as above, and the other It is impossible to replace a part with a result value encrypted by the equation encrypting unit 725. In addition, in some cases, the combiner 740 may not replace a part of the result value encrypted by the one-way encryption unit 730 with another encryption result value as described above, and in this case, the one-way encryption unit 730 The encrypted result value itself may be encrypted order information stored together with the encrypted content information in the storage unit 160. 11 is a view for explaining an example in which the encryption apparatus 700 according to an embodiment of the present invention is realized in a data management server connected to a network.

For example, the data management server may encrypt and store the data received from the user terminal through the network using the encryption apparatus 700, and the database of the encryption apparatus 700 for the data request from the user terminal. The search result may be searched in the encrypted information stored at 761 and the search result may be provided to the user terminal.

The network may be a wired or wireless Internet, or may be a core network integrated with a wired public network, a wireless mobile communication network, or a portable Internet, or may be a LAN or other dedicated network. The user terminal is generally a computer such as a desktop PC or a notebook PC, but is not limited thereto. Any kind of interactive service that can transmit data to the data management server or request data from the data management server through a network can be used. It may be a wired or wireless communication device. For example, the user terminal may be a cellular phone, a PCS phone (Personal Communications Services phone), a synchronous / asynchronous IMT-2000 (International Mobile Telecommunication-2000), or the like that communicates through a wireless Internet or a portable Internet. Including a mobile terminal, in addition to a Palm Personal Computer (PDA), a Personal Digital Assistant (PDA), a Smartphone (Smart phone), a WAP phone (Wireless application protocol phone), a mobile game machine (mobile play- All wired and wireless consumer electronics / communication devices with a user interface for accessing a data management server, such as a station, may be inclusively referred to.

The data management server capable of encrypting, storing, and managing data online through such a network and providing search results may be data received using the encryption apparatus 700 when received from a user terminal through the network. The sequence information separated from the encryption target information, which is some data as in step S110 (or S210), and the content information which is the entire encryption target information are encrypted and combined in different ways, respectively (see S130, S140, S160, or S230, S300). , S310, S240, S260), and the encrypted information may be stored and managed in the database 761 so that the encrypted information is included as indexing information.

As such, the encrypted information managed in the database 761 includes indexing information (a variable code encrypted information of the order information) at the front as shown in 220 of FIG. sorting) is enabled. Accordingly, when there is a request for data from the user terminal, the data management server can quickly search based on the indexing information from the sorting information of each final information encrypted and stored in the database 761 and provide the corresponding search result.

Conventionally, when encrypting data according to an encryption method such as Secure Hash Algorithm or National Standard Encryption Logic (ARIA), after encrypting the data, index information disappears to search for the necessary data in the encrypted data. In this case, it was difficult to search the entire encrypted data stored in the database.

However, in the present invention, the variable information is encrypted using sequence code information, or the information encrypted using a function including a fifth or higher equation is indexing information, and the hexadecimal value of the encrypted information as shown in FIG. In order to maintain the sorting order according to the indexing information by including the variable code encrypted information or the information (indexing information) encrypted using a function including a fifth order or higher equation, the data management server may use the database 761. You can quickly search for requested material at.

For example, as shown in 220 of FIG. 2, in the case of searching for the resident registration number 600511-1690412 in the data management server among the encrypted and stored data, this is earlier than three times in the alignment order, so that up to the

alignment order

1,2,3 times. If the relevant data is not found by searching, it can be judged that there is no corresponding data, and the search can not be performed for the

order

4,5 .. below.

The functions used in the methods and apparatus disclosed herein can be embodied as computer readable code on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disks, optical data storage devices, hard disks, removable storage devices, and also carrier waves (for example, transmission over the Internet). It also includes the implementation in the form of. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

As described above, although the present invention has been described with reference to limited embodiments and drawings, the present invention is not limited to the above embodiments, and those skilled in the art to which the present invention pertains various modifications and variations from such descriptions. This is possible. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined not only by the claims below but also by the equivalents of the claims.

Claims

In the method of encrypting data in the data encryption means,

Determining order information by separating a part of the encryption target information;

Determining a portion of the encryption target information including the remaining information from which the order information is separated as content information;

First encrypting the encryption information of the order information to be indexing information;

Encrypting the order information independently of indexing;

Generating encrypted content information by third encrypting the content information in a different manner from the second encryption regardless of indexing;

Generating encrypted order information by replacing a part of the result value of the second encryption with the result value of the first encryption; And

Storing the encrypted content information in a storage means in correspondence with the encrypted order information.

Encryption method comprising a.
The method of claim 1, wherein the first encryption method is

Based on a G-table that divides codes in the ASCII code system into a plurality of ordered groups, each element (number, letter, or symbol) of the order information is assigned to a corresponding code belonging to any one of the plurality of groups. Encryption method characterized in that the conversion to the corresponding value.
The method of claim 2,

Generates an S-table in which codes of different groups of the plurality of groups are mapped one by one with respect to different elements included in the order information according to the input S-key, and based on the S-table, An encryption method characterized by converting each element.
The method of claim 1, wherein the encryption target information,

An encryption method comprising a social security number, a credit card number, or an account number of a financial institution.
The method of claim 1, wherein the second encryption method is

An encryption method, which is a method based on a one-way encryption method.
6. The encryption method of claim 5, wherein the one-way encryption method includes a method based on a secure hash algorithm.
The method of claim 1, wherein the third encryption method,

An encryption method characterized by a method based on National Standard Encryption Logic (ARIA).
The method of claim 1,

Fourth encryption so that the encryption information of the order information becomes indexing information; And

Generating the encrypted order information by replacing a part of the result value of the second encryption with a combination of the result value of the first encryption or the result value of the fourth encryption;

Encryption method comprising a.
The method of claim 8, wherein the fourth encryption method,

And encrypting the order information by using a function including a fifth or higher equation.
In the method of encrypting data in the data encryption means,

The sequence information separated from the encryption target information and the content information including the remaining information from which the sequence information is separated among the encryption target information are encrypted and combined in different ways, respectively.

And encrypting the sequence information so that the encrypted information is included as indexing information, and storing the information in the database.
The method of claim 10,

The information which encrypted the said sequence information is,

One-way encryption,

Encryption method using a function containing 5th or more mathematical expressions, or

An encryption scheme for converting each element of the order information into a value corresponding to a corresponding code belonging to any one of the plurality of groups based on a G-table that divides codes on the ASCII code system into a plurality of ordered groups.

And encrypting the combined information.
A recording medium having recorded thereon a computer readable program for performing the method of any one of claims 1 to 11.
Information separation means for separating a portion of the encryption target information to determine order information, and determining a portion including the remaining information from which the sequence information is separated among the encryption target information as content information;

First encryption means for first encrypting the encryption information of the order information to be indexing information;

Second encryption means for secondly encrypting the order information regardless of indexing;

Third encryption means for generating third encrypted content information by encrypting the content information in a manner different from the second encryption regardless of indexing;

Combining means for generating encrypted order information by replacing part of the second encryption result with the first encryption result; And

Storage means for storing the encrypted content information in a storage means in correspondence with the encrypted order information;

Encryption apparatus comprising a.
The method of claim 13, wherein the first encryption means,

Based on a G-table that divides codes on the ASCII code system into a plurality of ordered groups, each element (number, letter, or symbol) of the order information is assigned to a corresponding code belonging to any one of the plurality of groups. Encryption apparatus, characterized in that for converting to a corresponding value.
The method of claim 14, wherein the first encryption means,

Generates an S-table in which codes of different groups among the plurality of groups are mapped one by one with respect to different elements included in the order information according to the input S-key, and based on the S-table, An encryption device characterized by converting each element.
The method of claim 13,

Fourth encryption means for fourth encryption so that the encryption information of the order information is indexing information,

And the combining means generates the encrypted order information by replacing a part of the result value of the second encryption with a combination of the result value of the first encryption or the result value of the fourth encryption.
In the data management server to encrypt and store the data received from the user terminal,

The sequence information separated from the encryption target information among the data and the content information including the remaining information from which the sequence information is separated among the encryption target information are encrypted and combined in different ways, respectively. An encryption device that encrypts to be included as indexing information, stores it in a database, and manages it;

A data management server for retrieving the data request from the user terminal with reference to the indexing information in the encrypted information stored in the database and providing a search result to the user terminal.
The method of claim 17,

The information which encrypted the said sequence information is,

One-way encryption,

Encryption method using a function containing 5th or more mathematical expressions, or

An encryption scheme for converting each element of the order information into a value corresponding to a corresponding code belonging to any one of the plurality of groups based on a G-table that divides codes on the ASCII code system into a plurality of ordered groups.

Data management server, characterized in that it comprises a combination of information encrypted.