JP2004038476A - Device and system for encoding - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To protect the secrecy of data stored in an external storage device without modifying an existing system and the external storage device themselves even when the same storage device is stolen or lost. <P>SOLUTION: The device is an encoder 12 of a system 11 connecting the external storage device 13. It is equipped with an installing means for installing the encoder 12 on a connection line of the system 11, an encoding part 12 for enciphering object data obtained from the system 11 and outputting them to the external storage device 13, and a decoding part 15 for decoding the encipher data obtained from the external storage device 13, and outputting them to the system 11. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an encryption device and an encryption system for protecting confidentiality of data stored in an external storage device connected by an external connection interface such as a USB (Universal Serial Bus).
[0002]
[Prior art]
In recent years, with the advent of a simple external connection interface such as a USB, a secondary storage device externally connected to a system or a device has become widespread.
2. Description of the Related Art Conventionally, the confidentiality of data stored in a secondary storage device connected to a system is determined based on the fact that software (eg, an operating system) mounted on the system performs user authentication based on a combination of a user ID and a password. This is ensured by a configuration in which data read / write permission is given only to each user who can confirm user authentication.
[0003]
In addition, with specific software, when data is stored in a storage device, the data is encrypted by various encryption techniques to improve the confidentiality of the stored data.
Further, for example, as described in Japanese Patent Application Laid-Open No. 2001-273059 or the like, authentication is performed between a USB host (computer) and a USB device (external storage device, printer, scanner, or the like). A USB device is protected by configuring it so that it can be used only by a specific USB host.
[0004]
[Problems to be solved by the invention]
However, in the conventional user authentication using a combination of a user ID and a password as described above, when the external storage device itself is stolen or lost, data stored in the external storage device can be freely used by a third party. There is a problem that the state becomes readable, which is not desirable for security.
[0005]
For this reason, a system to which the external storage device is connected needs a function for protecting the confidentiality of data stored inside the external storage device in preparation for theft or loss of the external storage device.
[0006]
Therefore, conventionally, the above data confidentiality protection has been achieved mainly by a software function. For example, when the confidentiality of data is protected by software installed in a computer, a user can usually read and write data only on a computer installed with the software.
[0007]
As described above, limiting the hardware resources that can be used by a user can improve the confidentiality of data. On the other hand, for example, a legitimate user can use other software without confidentiality protection software. There is a problem that it becomes inconvenient when trying to read and write data from and to an external storage device using a computer.
[0008]
In the case of the configuration described in Japanese Patent Application Laid-Open No. 2001-273059 or the like, it is necessary for each external storage device to support software for securing confidentiality. As a result, there is a problem that data confidentiality cannot be secured.
[0009]
The present invention has been made in view of the above problems, and has as its object to provide an encryption device and an encryption system for protecting the confidentiality of data stored in an external storage device.
[0010]
[Means for Solving the Problems]
For such a purpose, the present invention relates to an encryption device of a system to which an external storage device is connected, an installation means for installing the encryption device on a connection line of the system, and input data obtained from the system. Encryption means for encrypting the data and outputting the encrypted data to the external storage device, and decryption means for decrypting the encrypted data obtained from the external storage device and outputting the decrypted data to the system.
[0011]
Also, the present invention is an encryption system for an information processing device in which a plurality of devices are communicably connected to each other, wherein at least one device among the plurality of devices is any one of claims 1 to 6. It has the function of the encryption device described in (1).
[0012]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[First Embodiment]
The present invention is applied to, for example, an encryption system 100 as shown in FIG.
[0013]
As shown in FIG. 1, the encryption system 100 is configured to include a system 11, an encryption device 12, and an external storage device 13.
In the following, cipher text is data (encrypted data) that is converted (encrypted) into a form whose meaning is incomprehensible according to a certain rule in order to prevent the contents from being leaked to a third party. The term “data” means data before encryption or data (target data) obtained by converting (decrypting) ciphertext into original data.
[0014]
The system 11 creates a plaintext to be output to the encryption device 12.
The encryption device 12 includes an encryption unit 14, a decryption unit 15, and an encryption key (secret information) 16.
The encryption unit 14 encrypts the plaintext transmitted from the system 11 using an appropriate encryption method, and transmits the generated ciphertext to the external storage device 13.
Note that there are various encryption methods (public key method, secret key method, etc.), but the present invention is applicable to any encryption method.
The decryption unit 15 assumes that the data transmitted from the external storage device 13 is a ciphertext, and decrypts the ciphertext before transmitting the data to the system 11.
[0015]
When the plaintext is encrypted by the encryption device 12 and the encrypted text is decrypted, the encryption unit 14 and the decryption unit 15 use the encryption key (encryption information) 16 stored in the encryption device 12 to perform encryption. Or decryption. By using the encryption key 16 at the time of encryption or decryption, only the encrypting device 12 that has performed the encryption can decrypt the ciphertext into plaintext. Here, the encryption key 16 is configured, for example, as information that is a unique value for each encryption device 12, and this is stored in a ROM or the like.
[0016]
The external storage device 13 records the data obtained from the encryption unit 14 in a storage medium in the external storage device 13 without managing whether the data is plaintext or ciphertext. Since the encryption process by the encryption unit 14 does not directly affect the data size, the external storage device 13 can store the encrypted data generated by the encryption unit 14.
[0017]
Next, a protocol exchanged between the system 11 and the external storage device 13 will be described.
When the system 11 issues a command to the external storage device 13, the external storage device 13 performs a process according to the command, and also transfers data as necessary.
[0018]
For example, when writing data to the external storage device 13, first, the system 11 issues a write command (write command) to the external storage device 13 and transmits write data (write data). The external storage device 13 receives the write data from the system 11 and stores it on a storage medium.
In this case, if the external storage device 13 is a storage device that can be accessed randomly, writing or reading processing to or from the storage medium of the external storage device 13 is performed in block units. Further, a logical block number indicating a position to be stored in the storage medium is output to the external storage device 13 as a part of the command.
[0019]
Normally, the external storage device 13 only has a function of storing data transmitted from the outside, and does not care about the contents of the transmitted data. For this reason, even if the encrypted data is transmitted to the external storage device 13, the data storage function of the external storage device 13 is not particularly affected. The transmission data (ciphertext data) is stored in the storage medium by the same operation as described above.
[0020]
[Second embodiment]
In the present embodiment, the connection configuration of the system 11 of the first embodiment shown in FIG. 1, the encryption device 12, and the external storage device 13 is changed to another connection configuration, and furthermore, the connection configuration of the first embodiment is changed. The configuration is such that an identification unit 23 is added to the configuration unit.
[0021]
FIGS. 2A and 2B show an example in which the encryption system 12 and the external storage device 13 are connected to the system 11 in a so-called one-to-many connection manner in the encryption system 100 of the present embodiment. .
FIG. 2A shows that the encryption device 12 (child), the external storage device 13 (child), and the device 22 (child) have a parent-child relationship with the system 11 (parent) via the line concentrator 21. It is connected. In FIG. 2B, the external storage device 13 and the device 22 are connected to the system 11 by a daisy chain.
[0022]
FIG. 2C shows a configuration of an encryption device 12 connected to the system 11 in the form shown in FIG. 2A or 2B.
Note that the encryption unit 14 and the decryption unit 15 included in the system 11, the external storage device 13, and the encryption device 12 are the same as the system 11, the external storage device 13, and the encryption device in the first embodiment described above. 12 has the same functions as the encryption unit 14 and the decryption unit 15 included in the unit 12, and a detailed description thereof will be omitted.
[0023]
The identification unit 23 shown in FIG. 2C supplies a part of data to be written to the external storage device 13 or a part of data to be read from the external storage device 13 to the encryption unit 13 or the decryption unit 15 included in the encryption device 12. Then, the remaining data is not supplied to the encryption unit 13 or the decryption unit 15, but is transferred to the system 11, the device 22, or the like as it is.
[0024]
Usually, various devices connected to the system 11 have unique ID (address) information, and the system 11 can specify a device to which data is to be transferred using the ID as identification information. .
[0025]
The encryption device 12 includes an ID list 24 in which device IDs required for the identification unit 23 to identify the device 22 are stored.
In this case, the identification unit 23 identifies write data (write data) having a transfer destination corresponding to the ID stored (held) in the ID list 24 from the data (plain text data) output from the system 11. And extract.
The identification unit 23 identifies read data (read data) having a transfer source corresponding to an ID stored (held) in the ID list 24 from data output from the external storage device 13 or the device 22. And extract.
Accordingly, the identification unit 23 can distinguish between data supplied to the encryption unit 13 or the decryption unit 15 and data not supplied.
[0026]
For example, if only the data whose corresponding transfer destination exists in the ID list 24 among the plaintext data output from the system 11 is extracted as write data, only the extracted data can be output to the encryption unit 13. . If only the data whose corresponding transfer source exists in the ID list 24 among the data output from the external storage device 13 or the device 22 is extracted as read data, only the extracted read data is transmitted to the decoding unit 15. It is also possible to output.
[0027]
In order to store (register) the information of the device ID in the ID list 24, the user directly operates a dial or a key provided in the ID input unit 25 included in the encryption device 12 by directly operating the device. When the system 11 has dedicated software for editing the ID list 24, the ID list 24 can be edited by the software.
[0028]
Examples of a method for setting unique ID information for each device 22 include a method for setting a fixed ID for the device 22 and a method for dynamically setting a non-fixed ID by the system 11 when the device 22 is connected to the system 11. There is a method to set. When the device ID is dynamically set, the encryption device 12 detects the device ID from the ID setting information issued from the system 11 and stores the device ID in the ID list 24.
[0029]
As described above, since the identification unit 23 can distinguish between data supplied to the encryption unit 13 or the decryption unit 15 and data not supplied, for example, data (ciphertext data) encrypted by the encryption unit 13 It is possible to configure the external storage device 13 that stores therein and the external storage device 13 that does not store ciphertext data. For this reason, the user can take measures such as executing a strict security measure for the external storage device 13 in which the ciphertext data is stored.
[Third Embodiment]
In the present embodiment, the encryption key 16 included in the encryption device 12 of the first embodiment shown in FIG. 1 is stored in a rewritable nonvolatile storage medium (not shown) such as a flash ROM. , The user changes the encryption key 16.
[0030]
Note that the encryption unit 14 and the decryption unit 15 included in the system 11, the external storage device 13, and the encryption device 12 are the same as those of the system 11, the external storage device 13, and the first embodiment illustrated in FIG. Since the encryption unit 14 and the decryption unit 15 included in the encryption device 12 have the same functions as each other, a detailed description thereof will be omitted.
[0031]
The encryption device 12 shown in FIG. 1 includes an encryption key input unit (not shown) for changing the setting of the encryption key 16. For example, the user sets or changes the encryption key 16 or a password for the encryption key 16 by operating a dial or a key included in the encryption key input unit. As described above, the user can save a new set value (change value) in a rewritable nonvolatile storage medium by setting or changing the encryption key 16 or the like. Therefore, the user can improve the confidentiality of data by changing the value of the encryption key 16 and the like as necessary.
[0032]
If the system 11 has dedicated software for setting an encryption key and a password for the encryption key, the encryption key and the like can be changed by the software.
[0033]
[Fourth Embodiment]
In the present embodiment, the encryption device 12 according to the first embodiment shown in FIG. 1 includes a controller 31, and the controller 31 uses the encryption unit 14 to encrypt plaintext stored in the external storage device 13. The operation is controlled.
[0034]
FIG. 3 shows the configuration of the encryption system 100 according to the present embodiment.
As shown in FIG. 3, the encryption device 12 is not connected to the system 11, and transmits and receives the ciphertext and the plaintext to and from the external storage device 13. Note that a configuration in which the encryption device 12 and the system 11 are connected may be employed.
[0035]
The encryption unit 14, the decryption unit 15, and the external storage device 13 included in the encryption device 12 are the same as the encryption unit 14, the decryption unit 15, and the external storage device of the encryption device 12 in the first embodiment described above. Since the storage device 13 has the same functions as those of the storage device 13, detailed description thereof is omitted.
[0036]
The controller 31 included in the encryption device 12 determines whether or not the encryption unit 14 performs an encryption process on the plaintext stored in the external storage device 13. An operation example of the controller 31 will be described below.
First, the controller 31 issues a data read command to the external storage device 13 and reads plaintext data stored without encryption from the external storage device 13.
Next, the controller 31 outputs the plaintext data read from the external storage device 13 to the encryption unit 14. The encryption unit 14 performs an encryption process on the plaintext data output from the external storage device 13 using a predetermined encryption method, and generates a ciphertext. Note that the encryption key 16 is used for encryption.
Next, the controller 31 outputs the ciphertext generated by the encryption unit 14 to the external storage device 13.
Then, the external storage device 13 writes the ciphertext obtained from the controller 31 on a recording medium.
[0037]
When the external storage device 13 is a storage medium to which data can be written in a randomly accessible manner, the controller 31 reads out the plaintext data in order from the first block of the data stored in the external storage device 13, and The generated cipher text is written to the same address on the recording medium, and this process is repeated until the last block.
[0038]
As described above, the controller 31 can specify the plaintext data to be read from the external storage device 13 and supply the actually read plaintext data to the encryption unit 14 to generate the ciphertext data. As a result, the ciphertext data can be generated for specific plaintext data stored in the external storage device 13, and the ciphertext data can be stored on the external storage device 13 again. Therefore, the user can improve the confidentiality of the data stored in the external storage device 13 by controlling the operation of the controller 31.
[0039]
[Fifth Embodiment]
In the present embodiment, the encryption device 12 according to the first embodiment shown in FIG. 1 includes a controller 31, and the controller 31 uses the decryption unit 15 to decrypt a cipher text stored in the external storage device 13. Is configured to control the activation operation.
[0040]
FIG. 4 shows the configuration of the encryption system 100 according to the present embodiment.
As shown in FIG. 4, the encryption device 12 is not connected to the system 11, and transmits and receives the ciphertext and the plaintext to and from the external storage device 13. Note that a configuration in which the encryption device 12 and the system 11 are connected may be employed.
[0041]
The encryption unit 14, the decryption unit 15, and the external storage device 13 included in the encryption device 12 are the same as the encryption unit 14, the decryption unit 15, and the external storage device of the encryption device 12 in the first embodiment described above. Since the storage device 13 has the same functions as those of the storage device 13, detailed description thereof is omitted.
[0042]
The controller 31 included in the encryption device 12 determines whether or not the decryption unit 15 performs decryption processing on the cipher text stored in the external storage device 13. An operation example of the controller 31 will be described below.
First, the controller 31 issues a data read command to the external storage device 13 and reads encrypted data stored in the external storage device 13 in an encrypted manner.
Next, the controller 31 outputs the ciphertext data read from the external storage device 13 to the decryption unit 15. The decryption unit 15 performs a decryption process on the ciphertext data output from the external storage device 13 using a predetermined decryption method, and generates a plaintext. Note that the encryption key 16 is used for decryption.
Next, the controller 31 outputs the plaintext generated by the decryption unit 15 to the external storage device 13.
Then, the external storage device 13 writes the plaintext obtained from the controller 31 on the recording medium.
[0043]
When the external storage device 13 is a storage medium to which data can be written and which can be accessed randomly, the controller 31 reads the ciphertext data in order from the first block of the data stored in the external storage device 13, Is written to the same address on the recording medium, and this process is repeated until the last block.
[0044]
As described above, the controller 31 can specify the ciphertext data to be read from the external storage device 13 and supply the actually read ciphertext data to the decryption unit 15 to generate plaintext data. . Thereby, the plaintext can be generated for the specific ciphertext data stored in the external storage device 13, and the plaintext data can be stored on the external storage device 13 again. Therefore, the user can improve the confidentiality of the data stored in the external storage device 13 by controlling the operation of the controller 31.
[0045]
[Sixth Embodiment]
In the present embodiment, the encryption device 12 of the first embodiment shown in FIG. 1 includes a USB protocol analysis unit 57, and analyzes the USB protocol (communication protocol) by the USB protocol analysis unit 57. In this configuration, write data to be output to the external storage device 13 or read data to be input from the external storage device 13 are extracted to generate a ciphertext or a plaintext.
[0046]
FIG. 5 shows the configuration of the encryption system 100 according to the present embodiment.
As shown in FIG. 5, the encryption system 100 includes a system 11, a controller 12, a line concentrator (USB hub) 51, a device 52, and an external storage device 13.
[0047]
The system 11, the device 52, and the external storage device 13 have the same functions as those of the system 11, the device 52, and the external storage device 13 in the above-described first or second embodiment. Description is omitted.
[0048]
The line concentrator (USB hub) 51 connects various devices such as the device 52 and the encryption device 12 to the system 11 by USB connection (specific connection) as a network relay point. It should be noted that a USB device 52 other than the encryption device 12 may be connected to the USB hub 51.
[0049]
The encryption device 12 is configured to include a controller 53, an encryption unit 14, a decryption unit 15, and an encryption key 16.
The controller 53 includes SIEs (serial interface engines) 54 and 55, an identification unit 56, an ID list (not shown), and a USB protocol analysis unit 57.
[0050]
The SIEs 54 and 55 convert serial data input from the system 11 (upstream side) and the external storage device 13 (downstream side) via a USB signal line into a predetermined format, and output the format to the USB protocol analysis unit 57.
The SIEs 54 and 55 serialize the data output from the SB protocol analysis unit 57 and output the serialized data to a USB signal line.
[0051]
The USB protocol analysis unit 57 determines whether the data obtained from the SIEs 54 and 55 is write data (write data) to the input data external storage device 13 or data (read data) to be read from the external storage device 13. To analyze. As a protocol for the USB external storage device, for example, a mass storage class or the like is standardized (standard protocol). The USB protocol analyzer 57 is configured to support such a standard protocol. Is also good.
[0052]
The encryption unit 14, the decryption unit 15 and the key 16 are the same as the encryption unit 14, the decryption unit 15 and the key 16 of the first embodiment, and the identification unit 56 is the second embodiment. Since the identification unit 23 has the same functions as those of the identification unit 23, detailed description thereof is omitted.
[0053]
FIG. 6 shows a flow of data processing by the controller 53.
As shown in FIG. 6, the data (plaintext data) output from the system 11 is input to the SIE 54 via the USB hub 51 (step S61).
Since the system 11 and the encryption device 12 are connected by USB, the output data from the system 11 follows the USB protocol. In the USB protocol, first, a destination (device address and endpoint number) to which data is transferred, and data to the destination Information indicating whether reading or writing is performed is transmitted to the encryption device 12.
[0054]
Therefore, upon receiving the data output from the SIE 54, the identification unit 56 determines whether or not the destination of the data is included in the ID list 24 as shown in FIG. 2C (step S62). ).
When the identification unit 56 determines that the data transfer destination is not included in the ID list, the SIE 54 outputs the data to the SIE 55 on the opposite side to the input direction without changing the data content (step S67). ).
[0055]
On the other hand, if it is determined that the data transfer destination is included in the ID list, the USB protocol analysis unit 57 stores the data portion of the protocol sequence in the external storage based on the data read / write information transmitted together with the destination information. It is determined whether the data is write data (write data) for the device 13 (step S63) or read data (read data) from the external storage device 13 (step S64).
[0056]
When the USB protocol analyzing unit 57 determines that the protocol sequence exchanged between the system 11 and the external storage device 13 is data writing, the USB protocol analyzing unit 57 transmits the data ( Write data) is received from the SIE 54 and output to the encryption unit 14 (step S65).
The encryption unit 14 performs predetermined encryption on the data obtained from the USB protocol analysis unit 57 using the encryption key 16 (step S65), and outputs the generated ciphertext to the SIE 55 on the external storage device 13 side. (Step S67).
[0057]
On the other hand, when the USB protocol analysis unit 57 determines that the protocol sequence exchanged between the system 11 and the external storage device 13 is data reading, the USB protocol analysis unit 57 transmits the data from the external storage device 13 The received data (read data) is received from the SIE 55 and output to the decoding unit 15 (step S66).
The decryption unit 15 performs predetermined decryption on the data obtained from the USB protocol analysis unit 57 using the encryption key 16 (step S65), and outputs the generated plaintext to the SIE 54 of the system 11 (step S65). S67).
[0058]
As described above, only when the data output from the system 11 is write data to the external storage device 13, the ciphertext generated by the encryption unit 14 is output to the external storage device 13, and the external storage device 13 The ciphertext is stored on a storage medium. Only in the case of data read from the external storage device 13, the plaintext generated by the decryption unit 15 is output to the system 11.
Therefore, the user can store only specific data in the external storage device 13 based on the analysis result of the USB protocol analysis unit 57, and can further improve the confidentiality of the data stored in the external storage device 13. It becomes.
[0059]
【The invention's effect】
As described above, according to the present invention, an encryption device is installed on a connection line of a system to which an external storage device is connected, and target data (plaintext data) obtained from the system by the encryption device or obtained from an external storage device. Since the encryption data to be obtained is encrypted or decrypted, the confidentiality of the data stored in the external storage device can be protected.
[0060]
For example, the encryption device encrypts the plaintext data by a predetermined method before storing the target data output from the system in the external storage device. Unless the contents are obtained, the encrypted data (encrypted data) cannot be decrypted and decrypted, and the confidentiality of the data can be improved.
[0061]
Further, if the encryption device is configured to include an identification unit for identifying the external storage device, the target data from the system can be stored only in a predetermined external storage device designated by the system. As a result, data to be stored in the external storage device can be selected according to the type and content of the data, and the confidentiality of the data can be further improved.
[0062]
In addition, if the encryption device and the external storage device are configured to have a specific connection, for example, a USB connection to the system, the configuration and processing method of the system and the external storage device can be changed without changing the system. Data protection can be effectively performed by collective management based on analysis of a communication protocol (USB protocol) in the encryption device without providing software for data protection on the storage device side and the external storage device side.
[0063]
Further, for example, if the encryption device is configured to be miniaturized, the encryption device can be always carried or strictly stored, so that even if the external storage device itself is stolen, It is possible to minimize the possibility that data stored in the storage device is leaked to a third party.
[Brief description of the drawings]
FIG. 1 is a configuration diagram of an encryption system 100 according to a first embodiment of the present invention.
FIG. 2 is a configuration diagram of an encryption system 100 according to a second embodiment to which the present invention is applied.
FIG. 3 is a configuration diagram of an encryption system 100 according to a fourth embodiment to which the present invention has been applied.
FIG. 4 is a configuration diagram of an encryption system 100 according to a fifth embodiment to which the present invention has been applied.
FIG. 5 is a configuration diagram of an encryption system 100 according to a sixth embodiment of the present invention.
FIG. 6 is a flowchart of data processing by a controller 53.
[Explanation of symbols]
11 System
12 Encryption device
13 External storage device
14 Encryption unit
15 Decoding unit
16 Encryption key
21 Concentrator
22 devices
23 Identification part
24 ID list
25 ID input section
31 Controller
53 Controller
54 Upstream SIE (Serial Interface Engine)
55 Downstream SIE (Serial Interface Engine)
56 Identification unit
57 USB Protocol Analyzer

Claims (7)

An encryption device for a system to which an external storage device is connected,
Installation means for installing the encryption device on a connection line of the system,
Encryption means for outputting encrypted data obtained by encrypting the target data obtained from the system to the external storage device,
Decryption means for outputting to the system target data obtained by decrypting encrypted data obtained from the external storage device. Having identification means for identifying the external storage device,
Based on the identification result of the identification means,
2. The encryption apparatus according to claim 1, wherein the encryption unit encrypts the target data, and the decryption unit decrypts the encrypted data. 2. The encryption device according to claim 1, further comprising an input unit for inputting secret information in order to encrypt the target data by the encryption unit. 2. The encryption device according to claim 1, wherein the encryption unit reads unencrypted data from the external storage device to generate encrypted data, and outputs the encrypted data to the external storage device. 2. The encryption device according to claim 1, wherein the decryption unit reads the encrypted data from the external storage device, generates decrypted target data, and outputs the decrypted target data to the external storage device. An encryption device for a system in which the external storage device is connected by a specific connection,
Having protocol analysis means for analyzing a communication protocol between the system and the external storage device,
Based on the analysis result of the above protocol analysis means,
2. The encryption apparatus according to claim 1, wherein the encryption unit encrypts the target data, and the decryption unit decrypts the encrypted data. An encryption system for an information processing device in which a plurality of devices are communicably connected to each other,
An encryption system, wherein at least one of the plurality of devices has the function of the encryption device according to claim 1.

Images