JP4537772B2 - Disk system - Google Patents

Description

  The present invention relates to a disk system, and more particularly to a disk system that manages a plurality of disks as one unit, and performs security management by data read and write processing and encryption for each unit.

  Optical discs such as CD, MO, and DVD have been developed with capacities ranging from several hundred megabytes to several gigabytes. In an enterprise server that needs to handle a large-capacity database, in order to back up all data in the database, it is not possible to store all data on a single disk, and a large number of optical disks are required. .

In addition, when data is backed up on an optical disk, each optical disk can be easily carried, so that recorded data cannot be read even if it is stolen or cannot be decrypted even if it is read. Data confidentiality is required.
In order to ensure the confidentiality of data recorded on an optical disc, generally, data to be recorded is encrypted, and the encrypted data is stored on the optical disc. For example, an encryption method in which a medium-specific ID assigned to each optical disk medium is fixedly recorded in a specific area of the medium, and data to be recorded is encrypted and stored on the optical disk using this ID as an encryption key Has been proposed.

FIG. 11 is a schematic explanatory diagram of an encryption method of a conventional storage / playback apparatus.
First, an ID unique to the optical disk medium is recorded in a specific ID area 102 in the optical disk 101 that cannot be read by a normal recording / reproducing apparatus in a format that cannot be rewritten by the user. When the user data 105 to be stored in the optical disc 101 is given by a command from the CPU or the like, the ID unique to the medium is read, and this is used as the encryption key 104 to encrypt the user data 105 given to the encryption unit 106. To do.
Encrypted data 107 is output from the encryption unit 106, and this data 107 is written into the data recording area 103 of the optical disc 101 in which a medium-specific ID is recorded.
The decryption process is performed by reading the data 107 recorded by the decryption unit 108 and decrypting the data using the same ID unique to the medium.

In this conventional method, since a unique ID is recorded in a specific area for each optical disk medium, in a normal recording / reproducing apparatus in which this medium-specific ID cannot be read, the written encryption The encrypted data cannot be decrypted, and the confidentiality of the data is ensured.
In addition, encryption is performed using a symbol unique to one information storage unit in the medium to ensure the confidentiality of data in each storage medium, and encryption and decryption can be performed even if the storage medium is replaced. A possible data filing method has been proposed (see Patent Document 1).

FIG. 12 is an explanatory diagram of a conventional embodiment in the case where one piece of data is recorded and reproduced in a magazine containing a large number of disks.
A magazine containing a large number of disks (D1 to Dn) itself constitutes one virtual disk. Here, long data to be recorded is first subdivided (divided) into n data blocks. The divided block data (1, 2,... N) is written on different disks. For example, the block data 1 is written in the disk D1 in the magazine.
Next, when reproducing the entire data, all the block data (1, 2,... N) distributed and recorded on each disk is read, and the read block data is synthesized to restore the original data. To do.
As described above, there has been proposed a technique for realizing reliability and speeding up of data recording / reproduction processing by recording data in a distributed manner.
JP 2002-31830 A

In the conventional encryption method as described above, encryption processing is performed using a different unique ID (encryption key) for each physical optical disk, and the encryption key and the encrypted data are one physical It is completed in the standard disk. Therefore, if one optical disk is stolen and the ID unique to the medium can be read by some method, the encrypted data can be decrypted in some cases, so it can be said that the level of security is low.
The situation is the same even in a huge database composed of a plurality of optical disks, and even if there is one or more stolen optical disks, the encrypted data recorded on those optical disks is not May be restored.

  Also, with the distributed recording method as shown in FIG. 12, even if one disk is stolen, the entire original data cannot be restored, but the data in the stolen disk must be restored. Can do. Also, if a magazine containing a plurality of disks is stolen, all the original data may be restored by combining the data of the disks.

  Further, in a huge database composed of a plurality of optical disks, a magazine storing a predetermined number of optical disks is often managed as one unit. In this case, if a magazine including a plurality of discs is stolen, the damage is greater. Therefore, it is desirable to prevent data recorded on each optical disc from being restored even if the entire magazine is stolen.

  Therefore, the present invention has been made in consideration of the above circumstances, and when managing a huge database composed of a plurality of optical discs, even if the optical discs are stolen in units of one or a magazine. An object of the present invention is to provide an optical disc system in which it is difficult to restore the recorded data.

The present invention provides a disk having a data area for recording user data and an ID area for recording unique identification information, a magazine containing a plurality of disks, and all identification information recorded on all the disks in the magazine. An ID acquisition unit to be read, a selection unit that selects a plurality of identification information used for generating a master key among all the identification information read by the ID acquisition unit, and a plurality of identification information selected by the selection unit A key generation unit that generates a master key using only the key , an encryption unit that encrypts user data to be recorded on a predetermined disk using the generated master key, and an encrypted user data that is The present invention provides a disk system comprising a writing unit for writing in a data area of a disk.

  In addition, each of the magazines includes a storage unit that stores a unique magazine key, and further includes a magazine key acquisition unit that reads the magazine key, and the key generation unit stores the identification information read by the ID acquisition unit. A system for generating a master key using the read magazine key and the encryption key after generating the encryption key using the method is provided.

According to the present invention, the master key is generated using the identification information of each disk accommodated in the magazine, and the user data is encrypted with this master key. Therefore, even if the disk or magazine is stolen, If the key generation method is not known, the user data recorded on the disk cannot be restored, the confidentiality of the data can be improved, and the security level can be improved.
Further, since a magazine key unique to the magazine is stored and a master key is generated using this magazine key, it is more difficult to restore user data, and the security level can be further improved.

  In this invention, it further has a selection part which selects the identification information used for generation of a master key among a plurality of identification information read by the ID acquisition part, and the key generation part uses only the selected identification information. A master key may be generated.

  In addition, the selection unit may update the identification information to be selected every time a predetermined period elapses.

  Further, a magazine detection unit that detects that the magazine has been attached / detached at a predetermined mounting position, and when the magazine detection unit detects that the magazine has been mounted, the magazine key of the storage unit of the magazine is replaced with a new magazine key. And an updating unit for updating to the above.

  Further, when the magazine detection unit detects that the magazine is removed, the update unit may delete the magazine key in the storage unit of the magazine.

  The present invention also comprises a library unit constituting a virtual disk and an information recording / reproducing apparatus for recording / reproducing user data with respect to the library unit, wherein the library unit includes a plurality of magazines containing a plurality of disks. The disc has a data area for recording user data and an ID area for recording unique identification information, and the information recording / reproducing apparatus is predetermined from one or more magazines in the library unit. A selection unit that selects a plurality of disks based on a rule, an ID acquisition unit that reads identification information recorded on the selected disc, a key generation unit that generates a master key using the read identification information, An encryption unit that encrypts user data to be recorded on a predetermined disk using the master key, and an encrypted user data The data is intended to provide a disk system that is characterized in that a writing unit for writing the data area of the predetermined disk.

  Here, each of the magazines includes a storage unit that stores a unique magazine key, the information recording / reproducing apparatus further includes a magazine key acquisition unit that reads the magazine key, and the magazine key acquisition unit includes the selection unit. The magazine key stored in the storage unit of the magazine in which the selected disk is stored is read, and the key generation unit generates the encryption key using the identification information read by the ID acquisition unit, and then reads it. A master key may be generated using the magazine key and the encryption key.

  In addition, a plurality of the library units are distributed in different locations, the plurality of library units and the information recording / reproducing apparatus are connected via a network, and the selection unit is stored in a different library unit. A plurality of disks may be selected so that is always included.

  Furthermore, a RAID may be configured using a plurality of predetermined disks included in the library unit, and the selection unit may select a plurality of disks from the disks included in the RAID.

  In the embodiments described below, a disk means a medium capable of recording and reproducing information, and corresponds to an optical disk, for example. The magazine means a box containing a plurality of discs so that data can be read and written. The storage unit provided in the magazine is a so-called memory and means a semiconductor recording element or a recording medium. For example, a ROM, a RAM, a flash memory, an optical disk, and the like are applicable, and it is particularly preferable to use a non-volatile memory.

  The ID acquisition unit, key generation unit, encryption unit, writing unit, magazine key acquisition unit, selection unit, and update unit can each be configured by hardware, but a CPU, ROM, RAM, I / O controller And a control software stored in a ROM or the like. The control unit corresponds to the selection unit and the update unit. The disc-specific identification information is information for identifying each disc and is hereinafter referred to as an ID.

Hereinafter, the present invention will be described in detail based on the embodiments shown in the drawings. In addition, this invention is not limited by this.
<Configuration of Disk System of the Invention>
FIG. 1 is a block diagram showing the configuration of an embodiment of a disk system according to the present invention.
The optical disk system of the present invention comprises an information recording / reproducing apparatus 10 and a recording medium group (virtual disk) composed of a plurality of magazines (M1, M2,... Mn) 21. The recording medium group constitutes a virtual disk that can be viewed as a single storage device as a whole when viewed from the user.
The personal computer 31 is an external device that supplies user data D1 to the information recording / reproducing apparatus 10 and extracts data from the information recording / reproducing apparatus 10. Here, the personal computer 31 is described as a representative example of a device that transmits and receives user data D1 to and from the information recording / reproducing device 10, and is not limited thereto. Other information devices such as a workstation may be used.

In one magazine 21 of the present invention, a plurality of discs (DS1, DS2,... DSK, recording medium) 22 are accommodated. The disk 22 is a medium on which information can be recorded so as to be rewritable. Various media such as a hard disk and a magnetic tape can be used in addition to a portable disk medium such as an optical disk and a magneto-optical disk.
One disk 22 is divided into an area for recording user data D1 (user area) and an area for recording a unique ID of the disk 22 (ID area). The user area is an area where the information recording / reproducing apparatus currently on the market can freely read and write.
In the present invention, the user data D1 given from the personal computer 31 is recorded in the user area of one of the disks 22 in the specific magazine 21 after a predetermined encryption process.

On the other hand, the ID area is an area in which a different ID 23 is fixedly recorded for each disk, is not disclosed to the user, and cannot be read or modified by a commercially available information recording / reproducing apparatus.
The ID 23 recorded in the ID area can be, for example, the serial number of the disc, but is not limited to this, and may be composed of a combination of numbers, English letters, symbols and the like. Each disk 22 is stacked in a magazine 21 so that the information recording / reproducing apparatus 10 can write and read data.
The magazine 21 is a box that accommodates a plurality of discs, but the number of discs to be accommodated varies depending on the design specifications, and is therefore an arbitrary number.

The magazine 21 includes a readable / writable non-volatile memory 24 so that the magazine 21 can be accessed by the magazine key acquisition unit 17 of the information storage / reproduction device 10.
In this memory 24, a magazine key MK used in an encryption process to be described later is stored. However, when performing encryption processing without using the magazine key MK, the memory 24 may not be provided.
The memory 24 may be a non-volatile memory and is not particularly limited. For example, a flash memory, an EEPROM, a small magneto-optical disk, or the like may be used.

  The magazine key MK is data unique to the magazine, and data may be previously written in the memory 24 so that it cannot be rewritten. Further, when the magazine 21 is shipped, appropriate unique data is initially set in the memory 24 as the magazine key MK, and when the magazine 21 is actually mounted on the information recording / reproducing apparatus 10 for the first time, the apparatus 10 The unique data to be the magazine key MK may be written in the memory 24 by the writing process.

  Alternatively, each time the magazine 21 is mounted on the apparatus 10, new unique data may be written in the memory 24 as the magazine key MK. Whether or not the magazine 21 is mounted on the apparatus 10 may be determined by providing an electrical or mechanical switch at the magazine mounting portion and detecting the ON / OFF state of the switch by the magazine detection unit 20.

The information recording / reproducing apparatus 10 encrypts the user data D1 sent from the personal computer 31 or the like, records the encrypted data D2 on the disk 22, and conversely records it on the disk 22 based on a read instruction from the personal computer. This is a device that reads the read data D3, decrypts the data, and transfers the decrypted data D4 to the personal computer 31.
As shown in FIG. 1, the information recording / reproducing apparatus 10 mainly includes an interface unit (I / F unit) 11, a control unit 12, an encryption unit 13, a writing unit 14, a key generation unit 15, and an ID acquisition unit 16. , A magazine key acquisition unit 17, a reading unit 18, a decryption unit 19, and a magazine detection unit 20.

Here, the I / F unit 11 is a part for inputting / outputting data to / from the personal computer 31 and the like, and includes an I / O connector, an I / O controller, and the like having a predetermined shape.
The I / F unit 11 includes a data bus for transmitting / receiving user data D1 to be read / written, an address bus for sending an address for specifying a magazine or a disk, a read line for sending a read signal, a write line for sending a write signal, etc. The control line is connected.
The control unit 12 is a part that controls the operation of each component (11, 13 to 20) of the information recording / reproducing apparatus 10, and is configured by a CPU, a dedicated DSP, and the like.
The encryption unit 13 is a part that encrypts the user data D1 using the encryption key (referred to as master key MS) generated by the key generation unit 15. The encryption process itself may be performed using various methods currently used. The encrypted data D2 is given to the writing unit 14.

The writing unit 14 is a part that uses the address information given from the control unit 12 to write the encrypted data D2 into the user area of the disc 22 specified by the address information.
The address information includes, for example, data specifying the magazine 21, data specifying the disk 22 in the magazine, and sector information to be written in the disk. The data writing process itself performed by the writing unit 14 is the same as that normally performed.

The reading unit 18 is a part that reads data from the disk 22 specified by the address information using the address information given from the control unit 12. Since the read data D3 is encrypted data, it is given to the decryption unit 19.
The decryption unit 19 is a part that decrypts the encrypted data D3 using the master key MS generated by the key generation unit 15. The decrypted data D4 corresponds to the user data D1, and is transferred to the personal computer 31 or the like via the I / F unit 11. Since the decryption process is used as a pair with the encryption process, the decryption process may be performed using various methods currently used in connection with the encryption process.

The ID acquisition unit 16 is a part that reads the ID 23 used to generate the key from a predetermined disk. Here, the ID 23 to be read is the ID 23 of all the disks 22 accommodated in the magazine 21 to which the user data D1 is to be written. For example, assuming that ten magazines 22 are accommodated in one magazine 21, each ID 23 is read from each disc 22 and a total of ten IDs 23 are acquired.
Also, the ID 23 of all the disks in one magazine is not acquired, but the ID 23 of any number of disks designated by the control unit 12 (i, 1 ≦ i ≦ the number of stored disks) is selected and acquired. You may make it do. Here, the number i of IDs may be one, but is preferably as large as possible in order to increase security.

  The ID selection method is not particularly limited. For example, several selection rules may be determined in advance, such as selecting K even-numbered IDs or selecting m IDs that are multiples of 3. Any one of them can be used. In this case, the control unit functions as a selection unit, and the plurality of selected IDs 23 are given to the ID acquisition unit 16.

  The acquired ID is given to the key generation unit 15 and used to generate the master key MS. The key generation unit 15 is a part that generates the master key MS using the ID 23 acquired by the ID acquisition unit 16. Various methods can be used to generate the master key MS. For example, transposition, substitution table, bit rotation shift, exclusive OR, and the like can be used.

The master key MS may be generated using the magazine key MK acquired by the magazine key acquiring unit 17 in addition to the ID 23.
The magazine key acquisition unit 17 is a part for reading the magazine key MK recorded in the memory 24 of the magazine 21 to which the user data D1 is to be written.
The magazine detection unit 20 detects that the magazine 21 has been attached / detached to / from the information recording / reproducing apparatus 10 and provides a detection signal to the control unit 12. For example, the control unit 12 that has received a detection signal indicating that a magazine has been installed recognizes the magazine 21 that has been installed by this detection signal, and thereafter causes the magazine key acquisition unit 17 to acquire the magazine key MK of the magazine. Or processing for writing the magazine key MK into the memory 24 of the magazine. On the contrary, when a detection signal indicating that the magazine has been removed is received, a process of deleting the magazine key MK is performed.

  In the above embodiment, the magazine 21 is described as being mounted on the information recording / reproducing apparatus 10, but the present invention is not limited to this, and a library unit LB having a plurality of magazines 21 is configured, and the library unit LB and the information are recorded. The recording / reproducing apparatus 10 may be connected. The library unit LB is a huge virtual disk device, and is installed at a location physically separated from the information recording / reproducing device 10.

  For example, when the library unit LB and the information recording / reproducing apparatus 10 are installed on the same premises, they may be connected via a LAN. Alternatively, a plurality of library units LB are installed in different buildings, the information recording / reproducing apparatus 10 is installed in a building different from the library unit LB, and the apparatus 10 and the library unit LB are connected by the Internet or a dedicated line. It may be. For example, the library unit LB is arranged at a branch office of a company in Sapporo, Osaka, Fukuoka, etc., and the information recording / reproducing apparatus 10 is arranged at the head office of the company in Tokyo, and is connected by a dedicated line. When such a library unit LB is used, a plurality of information recording / reproducing apparatuses 10 may be installed at each site instead of one.

<Description of Data Recording / Reproducing Process of the Invention>
Next, the overall flow of one embodiment of the data recording / reproducing process of the present invention will be described.
In the disk system of the present invention, three processes of key generation processing, encryption processing and decryption processing are mainly performed for data recording / reproduction.
The encryption process is executed when the given user data is written, the decryption process is executed when the recorded data is read, and the key generation process is executed when the master key MS used for encryption and decryption is generated. Is done.

FIG. 2 shows a schematic flowchart of one embodiment of main processing of the information recording / reproducing apparatus of the present invention.
This process is executed by the control unit 12 using other components (13 to 20). For example, a microcomputer including a CPU, a ROM, a RAM, a timer, an I / O controller, etc., a ROM, etc. This is realized by a stored control program.
In addition, the functions of the constituent elements (13 to 20) are not realized by separate hardware, but the CPU operates not only a dedicated LSI but also hardware such as logic elements based on a control program. This is realized.

In this embodiment, it is assumed that three types of instructions (key generation instruction, encryption instruction, and decryption instruction) are given from an external device such as the personal computer 31. However, the instructions are not limited to these, and other instructions may be used.
The key generation command includes, for example, information indicating key generation, information specifying a magazine and a disk used to generate a key, information specifying a key version (revision), and the like.
The encryption command corresponds to a data write command, and is composed of information meaning encryption, user data to be written, information for specifying a magazine and a disk in which user data is written, and the like.
The decryption command corresponds to a data read command, and includes information meaning decryption and address information (magazine, disk number, etc.) specifying the recording position of user data to be read.

  In step S <b> 1 of FIG. 2, the control unit 12 checks whether or not a “key generation command” is sent from the personal computer 31 via the I / F unit 11.

If a key generation command has been received, the process proceeds to key generation processing in step S2. The key generation process is a process for generating a master key MS used for encrypting the user data D1, and uses the ID 23 and the magazine key MK recorded on the disk 22. A specific example of this key generation process will be described later.
If there is no key generation command in step S1, or after performing key generation processing in step S2, the process proceeds to step S3 to check whether or not an encryption command has been sent.
If there is no encryption command, the process proceeds to step S7 to check whether or not a decryption command has been sent. If no decryption instruction has been sent, the process returns to step S1.

On the other hand, if an encryption command is sent in step S3, the process proceeds to step S4, where the user data D1 to be recorded is received (step S4), the received user data D1 is encrypted (step S5), and the user data. A series of processes of writing data D2 to the disk after encrypting D1 (step S6) is performed.
Here, in the encryption process of step S5, the received user data D1 is encrypted using the generated master key MS.
The encryption process may be performed using conventional processes such as transposition, substitution table, and exclusive OR.

In the writing process, address information indicating the writing position of the disk is generated from the information specifying the magazine and the disk included in the encryption command given from the personal computer, and the address information indicating the disk information indicated by the address information is encrypted. Write user data.
For example, when writing long user data, assuming that 1, 8, and 10 are given as disk numbers by the encryption command, the user data to be recorded starts to be recorded from the disk of number 1, When there is no more free space on the disk, recording is next performed on the number 8 disk, and when there is no more free space on the number 8 disk, recording is performed on the number 10 disk.

In step S7, when a decryption instruction is sent, the process proceeds to step S8, where data is read from the specific disk given by the decryption instruction (step S8), and the read data D3 is decrypted. (Step S9), a series of processes of transferring the decrypted data D4 to the personal computer 31 (Step S10) is performed.
Here, in the decryption process (S9), the read data D4 is decrypted using the generated master key MS. The decryption process itself may use the same process as the conventional one.

In the reading process (S8), the address information included in the decryption instruction is used to calculate the disk on which the encrypted data to be read and the physical address in the disk exist, and then the disk can be read. To access the calculated physical address and read out the requested encrypted data.
When the encrypted data to be read is divided and recorded across multiple discs, the data recorded for each disc can be read into the temporary storage memory and the discs can be replaced sequentially to read all the requested data. That's fine.

Further, when performing the encryption and writing process, the user data D1 to be recorded may be divided and recorded on a plurality of disks accommodated in one magazine.
FIG. 9 shows an explanatory diagram of an embodiment of the data division and encryption processing of the present invention.
In FIG. 9, first, the original data to be recorded is divided by a number corresponding to the number (n) of disks. An encryption process is performed on each of the divided block data (1, 2,... N) using the master key MS generated by the key generation process, and encrypted user data is generated for each data block. . Next, the encrypted user data is written to the corresponding disks (DS1, DS2,... DSn). Further, for example, the data may be divided into n or more and n or less of the number of disks, each of which is encrypted with the master key MS, and recorded on n disks according to a predetermined procedure.

FIG. 10 shows an explanatory diagram of an embodiment of the decoding and restoration processing of the divided data according to the present invention.
When restoring the original data from the data divided and recorded by the processing of FIG. 9, first, all encrypted user data is read from each disk.
Next, each read user data is decrypted using the master key MS, and the original block data for each block is reproduced. Thereafter, the respective block data (1, 2,... N) are combined to restore the original data.

  In addition, after all the data requested to be reproduced is read, the entire data may be decrypted. However, when reading data that is divided and recorded across a large number of discs, first read one piece. After reading only the block data recorded on the disc, the decoding process is performed on the block data immediately, and then the reading process and the decoding process are performed for each remaining one disk. The reproduction process may be executed.

As described above, since the data encrypted using the master key MS is divided and recorded on a plurality of disks, if the master key MS cannot be generated, even the data for each disk is restored. I can't.
Therefore, by performing such an encryption method and divided recording processing, it is difficult to illegally restore the original data by a third party, and further, the reliability of the data recording / reproducing processing and the access speed are improved. be able to.
Also, the disk group used for key generation may be separated from the disk group for recording data encrypted using the key. This further improves security resistance against illegal access.

Next, a specific example of master key MS generation processing (key generation processing) performed by the key generation unit 15 will be described.
<First embodiment>
FIG. 3 shows an explanatory diagram of the first embodiment of the master key generation process of the present invention. Here, a case where the master key MS is generated using K IDs 23 of all the disks (1 to K) included in the designated magazine 21 is shown.
For example, when the magazine 21 designated by the control unit 12 is composed of 20 disks 22, the ID acquisition unit 16 acquires each ID 23 from these 20 disks. The acquired 20 IDs 23 are given to the key generation unit 15, and the key generation unit 15 performs a predetermined process on these IDs to generate a master key MS. The master key MS is stored in a memory (not shown) of the information recording / reproducing apparatus 10.

Here, as the predetermined processing, the same processing as conventionally used can be used. For example, by performing logical operations such as transposition and exclusive OR on 20 IDs, 1 One master key MS is generated. The master key MS is given to the encryption unit 13 and the decryption unit 19 and is used for the encryption process and the decryption process.
Thus, since the master key MS used for encryption is generated using the IDs of a plurality of disks, even if one disk is stolen, the encrypted data recorded on the disk can be restored. It is not possible to improve data confidentiality. Even if the magazine is stolen and the ID of each disk in the magazine is read, if the method for generating the master key MS is not known, the encrypted data cannot be restored and the confidentiality of the data can be reduced. Can increase security level.

<Second embodiment>
FIG. 4 shows an explanatory diagram of a second embodiment of the master key generation process of the present invention.
Here, the master key MS is generated using only the ID 23 of the designated disk among the disks 22 included in the designated magazine 21.
FIG. 4 shows a case where the master key MS is generated using only IDs (ID1, ID5, ID6, IDi) recorded on four disks 1, 5, 6, i in a certain magazine 21. . In this case, the control unit 12 corresponds to the selection unit described above, and selects a disk based on a predetermined selection rule. From the control unit 12, a disk number (1, 5, 6, i) for acquiring an ID is given to the ID acquisition unit 16.

The ID acquisition unit 16 accesses the four disks having the given disk number, and reads the ID 23 recorded in a specific area therein. The read four IDs 23 are given to the key generation unit 15. The key generation unit 15 generates a master key MS using four IDs by performing a predetermined process as shown in the first embodiment.
Further, since this master key MS is used in encryption processing and decryption processing, the generated master key MS itself or the number of the disc used for generating the master key MS is designated as an information recording / reproducing apparatus. 10 is preferably held in a memory (management table) (not shown). Here, it is considered that it is more difficult to restore the disk number than the master key MS itself, so that the security level is high.

In the second embodiment, as in the first embodiment, the master key MS is generated using the ID 23 stored in a plurality of disks. Therefore, even if one disk is stolen, the encrypted data Restoration is difficult, and the confidentiality of data can be improved. Even if a person who knows that the master key MS is generated using a plurality of disks is stolen, the restoration is difficult unless the number and number of disks for generating the master key are known. As a result, the level of security can be increased.
In addition, the control unit 12 does not select the disk for generating the master key MS in advance, but reselects the disk every certain period (for example, every day, once every month, once every year, etc.). The master key MS may be rewritten by updating to an ID different from the previous one.
Here, instead of updating all IDs for generating the master key MS, only a part of the IDs may be changed to another ID.

<Third embodiment>
FIG. 5 shows an explanatory diagram of a third embodiment of master key generation processing according to the present invention.
Here, the master key MS is generated using the magazine key MK stored in the memory 24 provided in the magazine 21.
First, a first master key MS1 (encryption key) is generated using the IDs 23 of a plurality of disks stored in a certain magazine 21. For this process, the same process as in the first embodiment or the second embodiment can be used.

Next, the second master key MS2 is generated from the first master key MS1 using the magazine key MK acquired by the magazine key acquisition unit 17 (second key generation processing). The second key generation process may be performed using a general encryption process.
The second master key MS2 is given to the encryption unit 13 and the decryption unit 19 as a master key MS.
Also in the third embodiment, the confidentiality of data when one disk is stolen or when the whole magazine is stolen can be improved.

  In the third embodiment, a master key MS is generated in two stages using the magazine key MK in the memory 24 provided in the magazine 21, and the data is encrypted by this master key MS. Even if a large amount is stolen, it is difficult to restore the data, and even if the entire magazine 21 is stolen, if the contents of the memory 24 cannot be read, the data cannot be restored. high.

In the third embodiment, if the magazine key MK stored in the memory 24 is updated as necessary, the security level can be further increased.
For example, when the magazine 21 is attached to the information recording / reproducing apparatus 10, when the magazine detection unit 20 detects that the magazine 21 is attached, the control unit 12 accesses the memory 24 via the writing unit 14, A new magazine key MK may be written.
In this case, the new magazine key MK written by the control unit 12 uses information (for example, a magazine serial number) specifying the magazine 21 in which the memory 24 to be written exists, and performs a predetermined encryption process or random number. Can be generated.
Further, the magazine key MK may be rewritten periodically (for example, every day, once a month, once a year, etc.). In this case, the control unit 12 corresponds to the updating unit described above.

  Thus, if the magazine key MK of the magazine is rewritten every time the magazine 21 is attached to the apparatus 10, the magazine 21 is stolen by the person who owns the apparatus 10 that can access the memory 24. Even so, the person cannot restore the data, and security can be further increased.

Further, if it is detected immediately before the magazine 21 is removed from the apparatus 10, and the magazine key MK is deleted by accessing the memory 24, the magazine key MK does not exist even if the magazine is stolen. The master key MS cannot be generated and data cannot be restored.
In order to detect the removal immediately before the removal, for example, a mechanical switch and an electrical switch are provided in the mounting portion, and only the mechanical switch is turned off and removed before it is physically completely removed. This is detected, and the magazine key MK may be deleted by accessing the memory 24 before the electrical connection is lost.

<Fourth embodiment>
FIG. 6 shows an explanatory diagram of a fourth embodiment of master key generation processing according to the present invention.
Here, a key generation process when the library unit LB accommodating a large number of magazines and the information recording / reproducing apparatus 10 of the present invention are connected will be described.
In order to generate the master key MS, the control unit 12 selects n IDs 23 and provides the selection information to the ID acquisition unit 16.
Here, the selection information is, for example, information for specifying the position of a disk in which one ID exists, and information including a magazine number and a disk number in the magazine can be used.
For example, when acquiring the ID 23 of the eighth disk (DS8) in the fifth magazine (M5), selection information (M5, DS8) may be given to the ID acquisition unit 16.

In this case, since the number of combinations of disks included in the selection information given from the control unit 12 increases as the number of magazines and disks increases, it is necessary to specify which disk ID 23 is used to generate the master key MS. It is very difficult.
That is, even if several sets of magazines are stolen from the library unit LB, it is practically impossible to generate the master key MS, so that the security level can be further increased.

<Fifth embodiment>
FIG. 7 shows an explanatory diagram of a fifth embodiment of master key generation processing according to the present invention.
This is an embodiment in which the second master key MS2 is generated by adding the magazine key MK of the third embodiment to the fourth embodiment. In this case, the magazine key MK is generated by a predetermined encryption process using each magazine key (MK1,... MKn) stored in the plurality of magazines 21.
According to this, since the master key MS is generated in two stages, the security level can be further increased.

<Sixth embodiment>
FIG. 8 shows an explanatory diagram of a sixth embodiment of master key generation processing according to the present invention. Here, a case where a plurality of library units LB exist is shown. The library units LB may all be installed in the same building.
However, in order to increase the security level, each library unit LB is installed in a physically separated building, or distributed to remote places in Japan and overseas such as Tokyo, Osaka, Fukuoka, New York, Paris. Preferably they are arranged.
In this case, each library unit LB and the information recording / reproducing apparatus 10 are connected via a network.
The ID 23 used for generating the master key MS is not selected from one library unit, but is selected from an arbitrary library unit LB according to a certain rule, and magazines and disks included therein are selected. Read from one disc.

For example, three IDs (ID 1 to 3) are selected from the library unit LB1 in Tokyo, four IDs (ID 4 to 7) are selected from the library unit LB2 in Osaka, and from the library unit LB3 in Paris. Selects two IDs (ID8, 9) and generates a master key MS from these nine IDs 23.
In the sixth embodiment, even if a magazine or disk of the library unit LB1 in Tokyo is stolen, the master key MS cannot be generated without a disk of another library unit, so that it is almost impossible to restore data. I can say that.

In other words, when a huge virtual disk is configured as a distributed library unit, if the master key MS is generated using a plurality of IDs of the distributed disk as in the sixth embodiment, security can be achieved. The level can be quite high.
In addition, since each library unit LB and the information recording / generating apparatus 10 are connected via a network, this key is used not only when there is one information recording / generating apparatus 10 but also when a plurality of apparatuses 10 are distributed in various places. Generation process can be used.

<Seventh embodiment>
The magazine 21 and the disk 27 are provided with tamper resistance often used in security technology. Tamper resistance refers to providing a structure that prevents unauthorized browsing and unauthorized alteration of internal data in magazines and disks.
For example, a sensor such as an optical sensor or a non-contact IC (a sensor used in an RF tag) is provided inside the magazine, and when this sensor detects a state different from the normal state, it is recorded in the memory 24. A device for automatically erasing the magazine key MK is stored.
In this case, when the magazine 21 is intentionally disassembled, the magazine key MK is erased when the light sensor not detecting normal light detects light of a predetermined level or higher. Thereby, since there is no magazine key MK, the master key MS cannot be generated, and the confidentiality of data can be improved.

  Further, instead of erasing only the magazine key MK, when the magazine is disassembled, part or all of the recorded data itself may be positively erased. Other methods for providing tamper resistance include, for example, erasing the ID and making decoding impossible, physically making the disc difficult to reproduce, for example, scratching and deforming. Conceivable.

<Eighth embodiment>
When a large number of disks 22 are regarded as one virtual disk, a RAID already installed in the hard disk may be used. RAID may be applied to a plurality of disks 22 in one magazine, but may be applied to a plurality of magazines 21 in one library unit LB.
When adopting RAID, the master key MS may be generated using the IDs of a plurality of disks 22 constituting the RAID. When a RAID is configured for a plurality of magazines 21, the magazine key MK and the master key MS may be generated using each magazine key recorded in the memory of those magazines. If RAID is introduced in this way, not only the security level can be improved, but also the reliability of data and the speed of access can be improved.

<Other examples>
In the embodiments described above, the case where data is recorded on a portable disk medium has been mainly described. However, the target for recording data may be not only the disk medium but also a plurality of hard disks and a plurality of magnetic tapes.
For example, in the case of a hard disk, an ID is recorded for each hard disk, one RAID array is configured for each predetermined number (n) of hard disks, one memory is provided for the one RAID array, and the magazine key MK is provided. Is recorded in the memory. Then, the master key MS may be generated by the method as in the third embodiment, using the ID recorded for each hard disk stored in the RAID array and the array key AK.

Additional Notes: The present invention is a disk system having the following features.
(Appendix 1) A disk having a data area for recording user data and an ID area for recording unique identification information, a magazine containing a plurality of disks, and an ID for reading identification information recorded on all the disks in the magazine An acquisition unit; a key generation unit that generates a master key using the read identification information; an encryption unit that encrypts user data to be recorded on a predetermined disk using the master key; A disk system comprising: a writing unit for writing user data into a data area of the predetermined disk.
(Additional remark 2) Each said magazine is provided with the memory | storage part which stored the unique magazine key, It further has a magazine key acquisition part which reads the said magazine key, The said key generation part is the identification read by the said ID acquisition part The disk system according to appendix 1, wherein a master key is generated using the read magazine key and the encryption key after generating an encryption key using information.
(Additional remark 3) It further has the selection part which selects the identification information used for the production | generation of a master key among the some identification information which the said ID acquisition part read, The said key generation part uses only the selected identification information The disk system according to appendix 1, wherein a master key is generated.
(Supplementary note 4) The disk system according to supplementary note 3, wherein the selection unit updates the identification information to be selected every time a predetermined period elapses.
(Appendix 4-1) A magazine detection unit that detects that the magazine has been attached / detached at a predetermined mounting position, and a magazine key of the storage unit of the magazine when the magazine detection unit detects that the magazine has been mounted. The disk system according to appendix 2, further comprising an update unit for updating to a new magazine key.
(Supplementary note 4-2) The disk system according to supplementary note 4-1, wherein when the magazine detection unit detects that the magazine is removed, the update unit erases the magazine key of the storage unit of the magazine. .
(Supplementary note 5) comprising a library unit constituting a virtual disk and an information recording / reproducing device for recording / reproducing user data with respect to the library unit,
The library unit includes a plurality of magazines containing a plurality of disks,
The disc has a data area for recording user data and an ID area for recording unique identification information;
The information recording / reproducing apparatus selects a plurality of disks based on a predetermined rule from one or a plurality of magazines in the library unit, and obtains an ID for reading identification information recorded on the selected disks A key generation unit that generates a master key using the read identification information, an encryption unit that encrypts user data to be recorded on a predetermined disc using the master key, and an encrypted A disk system comprising: a writing unit that writes user data to a data area of the predetermined disk.
(Supplementary Note 5-1) Each of the magazines includes a storage unit storing a unique magazine key,
The information recording / reproducing apparatus further includes a magazine key acquisition unit that reads the magazine key,
The magazine key acquisition unit reads the magazine key stored in the storage unit of the magazine that stores the disk selected by the selection unit, and the key generation unit uses the identification information read by the ID acquisition unit. The disk system according to appendix 5, wherein a master key is generated using the read magazine key and the encryption key after generating the encryption key.
(Supplementary Note 5-2) A plurality of the library units are distributed in different locations, the plurality of library units and the information recording / reproducing apparatus are connected via a network, and the selection unit is connected to a different library unit. The disk system according to appendix 5, wherein a plurality of disks are selected so that the stored disks are necessarily included.
(Supplementary Note 5-3) A RAID is configured using a plurality of predetermined disks included in the library unit, and the selection unit selects a plurality of disks from disks included in the RAID. The disk system according to appendix 5-2.

1 is a configuration block diagram of an embodiment of a disk system of the present invention. FIG. It is a schematic flowchart of the main processes of the information recording / reproducing apparatus of this invention. It is explanatory drawing of 1st Example of the key production | generation process of this invention. It is explanatory drawing of 2nd Example of the key production | generation process of this invention. It is explanatory drawing of 3rd Example of the key production | generation process of this invention. It is explanatory drawing of 4th Example of the key production | generation process of this invention. It is explanatory drawing of 5th Example of the key production | generation process of this invention. It is explanatory drawing of 8th Example of the key production | generation process of this invention. It is explanatory drawing of one Example of the data division | segmentation of this invention, and an encryption process. It is explanatory drawing of one Example of the decoding and decompression | restoration process of the division data of this invention. It is a schematic explanatory drawing of the encryption system of the conventional storage / reproducing apparatus. It is explanatory drawing of one Example of the conventional data division | segmentation and a recording / reproducing process.

Explanation of symbols

11 I / F unit 12 Control unit 13 Encryption unit 14 Writing unit 15 Key generation unit 16 ID acquisition unit 17 Magazine key acquisition unit 18 Reading unit 19 Decoding unit 20 Magazine detection unit 21 Magazine 22 Disk 23 ID
24 Memory 31 Personal computer D1 User data MK Magazine key MS Master key D2 Encrypted data D3 Encrypted data D4 Decrypted data LB Library unit

Claims (2)

A disk having a data area for recording user data and an ID area for recording unique identification information, a magazine containing a plurality of disks, and an ID acquisition unit for reading all identification information recorded on all the disks in the magazine And using only a plurality of identification information selected by the selection unit and a selection unit that selects a plurality of identification information used for generating a master key among all the identification information read by the ID acquisition unit. A key generation unit for generating a master key, an encryption unit for encrypting user data to be recorded on a predetermined disk using the generated master key, and encrypted user data on the data on the predetermined disk A disk system comprising a writing unit for writing in an area. The selection unit, for each elapse of a predetermined period, the disk system according to claim 1, characterized in that updating the identification information the selection.

Images