JP6111165B2 - Cryptographic processing apparatus and cryptographic processing system - Google Patents

Description

  The present invention relates to an encryption processing device and an encryption processing system, and more particularly to an encryption processing device and an encryption processing system that perform encryption and decryption using a plurality of common keys.

  In wireless communication and Internet communication that may be intercepted by a third party, the data to be transmitted is encrypted and transmitted to the other device so that the content of the communication is not leaked to the third party. ing. Public encryption methods and common key methods are known for data encryption. Related to the present invention is a common key system.

  In the public key method, the receiving side generates a public key and a secret key, the public key is made public so that it can be used by the transmitting side, and the receiving side manages the secret key secretly. The transmitting side transmits data encrypted using the public key, and the receiving side decrypts the received data using the secret key. In this method, if the receiving side secretly manages the secret key, the contents of communication will not leak to a third party.

  On the other hand, in the common key method, data called an encryption key is shared so that both the transmission side and the reception side are not known to a third party, and encryption and decryption are performed using the encryption key. In the common key method, it is necessary to determine a common key shared for each communication partner. Different common keys may be used for different parties, or the same common key may be used.

  In general, the common key method is lighter in processing than the public key method and is suitable for high-speed communication. However, in order to share the encryption key, for example, it is necessary to notify the encryption key from the transmission side to the reception side. Both parties need to manage the encryption key secretly. The public key method is usually used to send and receive data to and from an unspecified partner, but the common key method is still often used when data is sent to and received from a specified partner. The specific partner is, for example, communication between bases of the same company, or communication within a store or between stores in a POS system that manages sales of one or more stores.

  In order to secure the secret management of the common key, a method has been proposed in which a plurality of encryption keys are facilitated and the encryption keys used for the encryption process are switched (for example, see Patent Document 1).

  According to Patent Document 1, a plurality of key data (encryption keys) are prepared, and a data table including a plurality of key data is stored in memories on the transmission side and the reception side. Further, at the start of communication, one of the transmission side and the reception side determines key data used for the encryption process, and transmits position data (index) indicating where the key data is in the data table to the other side. The other receiving the position data selects key data from the data table using the received position data. Thereafter, both the transmission side and the reception side perform encryption processing using the same key data until a series of communications is completed.

JP-A-9-134413

In the common key method, in order to notify the encryption key without being known to a third party, the encryption key needs to be transferred to the other party by a route different from the route for communicating the encrypted data or a transfer method. Further, when changing the encryption key once determined, it is necessary to change it synchronously on the transmission side and the reception side, and the change is not easy.
Also, if the encryption key is used for a long time without changing the encryption key, the encryption may be analyzed.

  In Patent Document 1, the encryption key itself is not exchanged by exchanging position data for referring to a data table in which a plurality of encryption keys are registered. However, since only one encryption key is used at a time, it is easy to decrypt. Further, if the encryption key is decrypted by a third party, communication with other devices using the same data table is also decrypted. For example, when the same encryption key data table used for communication between device A and device B is also used for communication between device C and device D, the encryption key used for communication between device A and device B is decrypted. Then, the communication between the device C and the device D is also decrypted.

  The present invention has been made in consideration of the above circumstances, and has a low risk that a third party can know a common key. A processing method is provided.

  The invention includes an encryption key storage unit that stores a plurality of common keys used for encryption processing as an encryption key table with an index, a self-unique key storage unit that pre-stores a device-specific encryption key as its own unique key, When receiving the unique key of the counterpart device, provide the external unique key storage unit that stores the received unique key and the unique key stored in the self-unique key storage unit to the counterpart device or the unique key from the counterpart device An encryption key sharing processing unit that receives the password and stores it in the external unique key storage unit, one or more common keys of the encryption key table stored in the encryption key storage unit, and the self-unique key storage unit or the external unique key storage An encryption unit that applies the unique key stored in the unit to the data to be transmitted and generates encrypted data, the index of the common key used for encryption, and the encryption A transmission unit for transmitting data to the counterpart device, a reception unit for receiving the common key index and encrypted data used for encryption in the counterpart device from the counterpart device, and the encryption key storage unit. A decryption key acquisition unit for acquiring one or more common keys of the stored encryption key table and a unique key stored in the self-unique key storage unit or the external unique key storage unit; and the acquired common key and unique key A decryption unit for decrypting encrypted data received by applying the encryption key, the decryption key obtaining unit obtains a common key by referring to the encryption key storage unit with the received index, and the external unique key A cryptographic processing apparatus is provided that acquires a unique key with reference to a storage unit or the self-unique key storage unit.

  Further, from a different point of view, the present invention includes at least a transmission-side device and a reception-side device, and the transmission-side device stores a plurality of common keys used for encryption processing as an encryption key table with an index. A self-unique key storage unit that pre-stores an encryption key unique to the device as its own unique key, and a first encryption key sharing processing unit that provides the reception-side device with the unique key stored in the self-unique key storage unit An encryption unit that applies one or more common keys of the encryption key table stored in the encryption key storage unit and its own unique key to data to be transmitted to generate encrypted data; and A transmission unit that transmits the index of the used common key and the encrypted data to the receiving device, and the receiving device stores a second encryption key table that stores the same encryption key table as the transmitting device. When receiving the unique key of the key storage unit and the transmission side device, the external unique key storage unit for storing the received unique key, and the second receiving the unique key from the transmission side device and storing it in the external unique key storage unit An encryption key sharing processing unit, a receiving unit that receives the index and encrypted data of the common key used for encryption in the transmission side device from the transmission side device, and an encryption key table stored in the encryption key storage unit A decryption key acquisition unit that acquires one or more common keys and a unique key of a transmission-side device; and a decryption unit that decrypts encrypted data received by applying the acquired common key and unique key, The encryption unit applies the unique key stored in the self-unique key storage unit and provided to the receiving side device by the first encryption key sharing processing unit, and the decryption key acquisition unit uses the received index as the index. Encryption key storage It gets the common key with reference to the stored encryption key table, to provide a cryptographic processing system, wherein a second encryption key sharing process section acquires the unique key stored in the external unique key storage unit.

  Further, the present invention includes at least a transmission-side device and a reception-side device, and the transmission-side device includes a first encryption key storage unit that stores a plurality of common keys used for encryption processing as an encryption key table with an index, and a reception side An external unique key storage unit that stores the received unique key when receiving the unique key of the device, a first encryption key sharing processing unit that receives the unique key from the receiving device and stores it in the external unique key storage unit; An encryption unit that encrypts one or more common keys of the encryption key table stored in the encryption key storage unit and a unique key of the receiving device by applying to the data to be transmitted, and generates encrypted data; A transmission unit that transmits the index of the common key used for the encrypted data and the encrypted data to the receiving device, and the receiving device stores a second encryption key table that stores the same encryption key table as the transmitting device. A key storage unit, a self-unique key storage unit that pre-stores an encryption key unique to the device as its own unique key, and a second encryption key share that provides the transmission-side device with the unique key stored in the self-unique key storage unit A processing unit; a receiving unit that receives the common key index and the encrypted data used for encryption in the transmitting device from the transmitting device; and one or more encryption key tables stored in the encryption key storage unit A decryption key acquisition unit that acquires a common key and its own unique key; and a decryption unit that decrypts encrypted data received by applying the acquired common key and unique key, and the encryption unit includes: The first encryption key sharing processing unit applies the unique key stored in the external unique key storage unit to the encryption, and the decryption key acquisition unit uses the received index to store the encryption key table stored in the encryption key storage unit. See and share Get the key, the self-unique key stored second encryption key sharing process section stored in the unit to provide a cryptographic processing system and acquires the unique key provided to the sender device.

In the encryption processing device of the present invention, the encryption unit applies the unique key stored in the external unique key storage unit by the first encryption key sharing processing unit to the encryption, and the decryption key acquisition unit uses the received index to Since the common key is obtained by referring to the encryption key table stored in the key storage unit, the unique key stored in the self-unique key storage unit and provided to the transmission side device by the second encryption key sharing processing unit is acquired. The common key itself is not sent to the counterpart device, and the common key used for encryption and decryption can be changed by changing the index. Therefore, there is a low risk that the contents of communication will be known to a third party. The counterpart device can decrypt the data by referring to the encryption key table using the index transmitted before transmission of the encrypted data or together with the transmission of the encrypted data. Furthermore, since encryption is performed using not only the common key but also the unique key, even if the encryption key table is known to a third party, the secret of communication using other unique keys is protected and is locally Can be kept to a great deal of damage.
The cryptographic processing system of the present invention also has the same effect.

It is a block diagram which shows the structural example of the encryption processing apparatus of this invention. 4 is an explanatory diagram illustrating a configuration of encrypted communication according to Embodiment 1. FIG. FIG. 6 is an explanatory diagram illustrating a state when a transmitting-side cryptographic processing device transmits plaintext data in the first embodiment. 6 is an explanatory diagram illustrating a process in which the transmitting side performs 3DES encryption processing in Embodiment 1. FIG. 6 is an explanatory diagram illustrating an example of a reception encryption key index storage unit on a reception side before communication of encryption data in Embodiment 1. FIG. 6 is an explanatory diagram illustrating a process in which a receiving side performs a 3DES decoding process in Embodiment 1. FIG. 3 is a flowchart illustrating processing executed by a central processing unit on the transmission side in the first embodiment. 3 is a flowchart illustrating processing executed by a central processing unit on the reception side in the first embodiment. FIG. 10 is an explanatory diagram showing a state when a transmitting-side cryptographic processing device transmits plaintext data in the fifth embodiment. FIG. 10 is an explanatory diagram illustrating a process in which a transmitting side performs encryption processing in a fifth embodiment. FIG. 17 is an explanatory diagram illustrating an example of a reception encryption key index storage unit on a reception side before communicating encrypted data in the fifth embodiment. FIG. 10 is an explanatory diagram illustrating a process in which a receiving side performs a decoding process in the fifth embodiment. 10 is a flowchart illustrating processing executed by a transmission-side central processing unit in the fifth embodiment. 10 is a flowchart illustrating processing executed by a central processing unit on the receiving side in the fifth embodiment.

Hereinafter, the present invention will be described in more detail with reference to the drawings. In addition, the following description is an illustration in all the points, Comprising: It should not be interpreted as limiting this invention.
<Configuration of cryptographic processing device>

  FIG. 1 is a block diagram showing a configuration example of a cryptographic processing apparatus according to the present invention. The cryptographic processing device is mounted on an information device such as a mobile communication terminal or a wireless communication access point, for example. The mobile communication terminal may be an information processing device such as a smartphone, a tablet terminal, or a personal computer used by a general consumer, but may also be a dedicated terminal used for a business POS system. Alternatively, a general-purpose smartphone, tablet terminal, or personal computer in which an application for a specific purpose is mounted may be used.

  As shown in FIG. 1, the cryptographic processing apparatus 11 according to the present invention includes a central processing unit 100, a main storage unit 200, an encryption key storage unit 300, an instruction receiving unit 500, a communication unit 600, an external unique key storage unit 700, and a program storage. Part 800. The numbers in parentheses for each block in FIG. 1 indicate the code of that block.

  The central processing unit 100 is a computer that executes processes related to encryption, decryption, and communication. Further, for example, when this cryptographic processing device is mounted on a POS terminal, the central processing unit 100 may execute not only the processing as the cryptographic processing device but also other processing as the POS terminal.

The main memory 200 is a storage device that stores a control program executed by the central processing unit 100 and data used for encryption processing. As the hardware, various RAMs such as DDR3 SDRAM can be applied. For data used for encryption processing, refer to plain text data before and after decryption that can be understood by third parties, encrypted data obtained by encrypting the plain text data, and a data table of encryption keys used for encryption and decryption. Such as an index to be performed and a unique key which is a device-specific encryption key. However, the encryption key storage unit 300 that stores the encryption key table 310 that is the data table of the encryption key, the self-unique key storage unit 400 that stores the unique encryption key, and the unique key of the counterpart device are received. The external unique key storage unit 700 is prepared separately from the main storage unit 200. The content of the plaintext data may be a sentence, but is not limited to this, and includes all communicable data such as numerical values, images, and sounds.
The main storage unit 200 has the following storage areas as shown in FIG.

The control program storage unit 210 stores a control program transferred from the program storage unit 800 and executed by the central processing unit 100 (shown as the control program storage unit 210 in FIG. 1). The control program relates to the processing of the encryption unit 120 that encrypts plaintext data in a storage area (shown as a transmission plaintext storage unit 220 in FIG. 1) in which plaintext data to be transmitted is stored and outputs encrypted data, for example. It is a program. A storage area for storing encrypted plaintext data is shown as a transmission ciphertext storage unit 230. Further, the control program storage unit 210 controls the transmission unit 610 that transmits the encrypted data to the transmission partner, functions as the encryption key sharing processing unit 110 that shares the encryption key table 310 with the communication partner device, and the encrypted data. Control of receiving unit 620 to receive, function as decryption key acquisition unit 130 for acquiring encryption key for decryption of received encrypted data, function as decryption unit 140 for decrypting encrypted data using acquired encryption key The control program concerning is stored. A storage area for storing encrypted data received from the counterpart device is shown as a received ciphertext storage section 250, and a storage area for storing plaintext data obtained by decrypting the encrypted data is shown as a received plaintext storage section 240.
The transmission encryption key index storage unit 260 stores a plurality of indexes of an encryption key table used for encryption processing of plain text data to be transmitted.
The reception encryption key index storage unit 270 stores a plurality of encryption key table indexes used for encryption processing of received data.

  Next, the encryption key storage unit 300 will be described. The encryption key storage unit 300 stores an encryption key table 310. As the hardware, for example, a nonvolatile memory such as an EEPROM or a flash ROM or a hard disk device can be applied. In FIG. 1, the encryption key table is a data table in which m encryption keys (m is a natural number of 2 or more) are each given a unique index for reference. The cryptographic processing device 11 communicates with all counterpart devices using one cryptographic key table 310. The larger the m, the more variations of the encryption key to be applied. This is preferable in terms of security, but the capacity of the encryption key table 310 increases. It is highly preferable to use different encryption keys for different counterpart devices.

The self-unique key storage unit 400 stores a unique key that is a device-specific encryption key. That is, the encryption key is unique to the encryption processing device 11. For example, when it is produced in a factory, a unique key that is different for each device is written in the self-unique key storage unit 400 of each encryption processing device 11. For the writing, for example, wireless data transfer is performed in an electromagnetically shielded room so that a third party cannot intercept. Alternatively, data transfer is performed using a wired or memory card without using wireless communication.
As the hardware of the self-unique key storage unit 400, for example, a nonvolatile memory such as an EEPROM or a flash ROM or a hard disk device can be applied.

  The instruction receiving unit 500 receives an instruction transmission instruction, an encryption key sharing instruction, and the like given to the cryptographic processing apparatus 11 by an operator or an external device. As a specific example, it may be a touch panel or a key that accepts an operation from the user. For example, when this cryptographic processing apparatus is mounted on a POS terminal, not only an instruction regarding cryptographic processing but also an input as a POS terminal may be accepted. In addition, the instruction receiving unit 500 may receive an instruction such as an instruction to share an encryption key by communicating with an external device.

  The communication unit 600 is a circuit that communicates with an external device. The form of communication may be wireless, wired, public, or leased line. The communication unit includes a transmission unit 610 and a reception unit 620. It is assumed that the communication counterpart device has a communication unit having the same configuration and specifications as in FIG.

The external unique key storage unit 700 stores the unique key received from the counterpart device. Since unique keys may be received from a plurality of counterpart devices, the external unique key storage unit 700 can store a plurality of unique keys.
For example, when the external unique key is produced as a set of communication terminals or the like in a factory, unique keys of different devices are written in the respective external unique key storage units 700. For the writing, for example, wireless data transfer is performed in an electromagnetically shielded room so that a third party cannot intercept. Alternatively, data transfer is performed using a wired or memory card without using wireless communication. In addition, after shipment from the factory, a user or a service engineer may perform data transfer using a wired or memory card.
As the hardware of the external unique key storage unit 700, for example, a nonvolatile memory such as an EEPROM or a flash ROM or a hard disk device can be applied.

  The program storage unit 800 stores a control program to be executed by the central processing unit 100 in advance. In this embodiment, all or part of the control program stored in the program storage unit 800 in the initialization process after power-on is transferred to the control program storage unit 210 that can be accessed at a higher speed and executed by the central processing unit 100. Is done. As the hardware, for example, a ROM, a flash ROM, a hard disk device, and the like are applicable.

  (Embodiment 1)

  In this embodiment, an example of a 3DES (Data Encryption Standard) encryption method in which encryption and decryption are performed using three common keys will be described as an example, and a procedure of encrypted communication by the encryption processing apparatus and encryption processing system of the present invention will be described. To do.

  3DES is a scheme in which the encryption strength is increased by repeating the process of the original DES three times. A different key may be used each time, but two different keys may be used. is there. As an encryption sub-process, encryption → decryption → encryption processing is performed, and decryption executes the reverse decryption → encryption → decryption sub-process.

  FIG. 2 is an explanatory diagram showing the configuration of the encrypted communication in this embodiment. As shown in FIG. 2, the encryption processing device 11T on the transmission side is an encryption processing device having the configuration of FIG. 1, and the encryption processing device 11R on the reception side is also an encryption processing device having the configuration of FIG. That is, encrypted communication is performed between two encryption processing apparatuses having the configuration of FIG. This corresponds to the encryption processing system of the present invention.

FIG. 3 is an explanatory diagram showing a state when the transmitting-side cryptographic processing device 11T transmits plaintext data in this embodiment. The code | symbol of each block shown in FIG. 3 attaches the subscript T which shows that it is a transmission side apparatus after the number corresponding to FIG. The transmission plaintext storage unit 220T of the main storage unit 200T stores character strings “I want you, I need you, I love you” as an example of plaintext data to be transmitted. Furthermore, k numerical values from 1 to k are stored in the transmission encryption key index storage unit 260T. The encryption key storage unit 300T stores an encryption key table 310T having m encryption keys. Further, the self-unique key storage unit 400T stores its own unique key in advance. The external unique key storage unit 700T stores the unique key when the unique key of the receiving side cryptographic processing apparatus 11R is received.
For example, when a set of cryptographic processing apparatuses 11 is produced, unique keys of different devices are written in the respective external unique key storage units 700, or after that, a user or service engineer externally identifies a unique key of an external device. Write to the unique key storage unit 700. The writing is performed, for example, by wireless communication in a room that is electromagnetically shielded so that a third party cannot intercept it, or by a wired or memory card.

  FIG. 4 is an explanatory diagram showing a process in which the transmission side performs 3DES encryption processing in this embodiment. As described above, 3DES performs three processes of encryption → decryption → encryption as an encryption sub-process. FIGS. 4A, 4B, and 4C are the first and second processes, respectively. An example of data stored in the transmission ciphertext storage unit 230T after the third and third processing is shown.

  In the first process, the first index of the transmission encryption key index storage unit 260T of the encryption processing apparatus 11T on the transmission side is “11” (see FIG. 3). Therefore, the plaintext data stored in the transmission plaintext storage unit 220T is encrypted with the eleventh encryption key of the encryption key table 310T and stored in the transmission ciphertext storage unit 230T.

  In the second process, the content of the transmission ciphertext storage unit 230T is further decrypted with the unique key stored in the self-unique key storage unit 400T and stored again in the transmission ciphertext storage unit 230T.

  In the third process, the second index of the transmission encryption key index storage unit 260T is “21” (see FIG. 3). Therefore, the encrypted data stored in the transmission ciphertext storage unit 230T is encrypted with the 21st encryption key of the encryption key table 310T and stored again in the transmission ciphertext storage unit 230T.

  FIG. 5 shows the encryption key index stored in the reception encryption key index storage unit 270R received by the reception side encryption processing device 11R from the transmission side encryption processing device 11T before the encryption data is communicated in this embodiment. It is explanatory drawing which shows an example. By this reception, the encryption key index stored in the transmission encryption key index storage unit 260T of the encryption processor 11T on the transmission side matches the encryption key index stored in the reception encryption key index storage unit 270R.

  FIG. 6 is an explanatory diagram showing a process in which the receiving side performs the 3DES decoding process in this embodiment. As described above, the decryption sub-process is the reverse of encryption, and three processes of decryption → encryption → decryption are performed. FIGS. 6A and 6B show examples of data stored in the received ciphertext storage unit 230R after the first and second processing, respectively. FIG. 6C shows an example of data stored in the received plaintext storage unit 240R after the third processing. These data correspond to the data of FIGS. 4C, 4B, and 4A.

  In the first process, the second index of the reception encryption key index storage unit 270R of the reception-side encryption processing device 11R is “21” (see FIG. 5). Therefore, the encrypted data stored in the received ciphertext storage unit 250R is decrypted with the 21st encryption key of the encryption key table 310R and stored again in the received ciphertext storage unit 250R.

  In the second process, the contents of the received ciphertext storage unit 250R are further encrypted with the unique key stored in the external unique key storage unit 700R and stored again in the received ciphertext storage unit 250R. In the external unique key storage unit 700R, the unique key of the encryption processing apparatus 11T on the transmission side is provided and stored in advance.

In the third process, the first index of the received encryption key index storage unit 270R is “11” (see FIG. 5). Therefore, the encrypted data stored in the received ciphertext storage unit 250R is decrypted with the eleventh encryption key of the encryption key table 310R and stored in the received plaintext storage unit 240R.
≪Flowchart≫

  7 and 8 are flowcharts showing the flow of processing executed by the central processing unit 100 in this embodiment. FIG. 7 shows a process executed by the central processing unit 100T of the encryption processing apparatus 11T on the transmission side in this embodiment. FIG. 8 shows processing executed by the central processing unit 100R of the receiving side cryptographic processing apparatus 11R in this embodiment. Hereinafter, the processing will be described with reference to the flowchart.

  In FIG. 7, the transmission-side central processing unit 100T waits for the instruction receiving unit 500 to accept a transmission instruction (step S11) as a transmission processing task executed in a multitask environment (step S11). No loop).

  When the transmission instruction is accepted (Yes in step S11), the central processing unit 100T transmits the contents of the transmission encryption key index storage unit 260T to the receiving side (step S13).

  Subsequently, the central processing unit 100T executes a first encryption sub-process. That is, the content of the transmission plaintext storage unit 220T is encrypted with the encryption key of the encryption key table indicated by the first content of the transmission encryption key index storage unit and stored in the transmission ciphertext storage unit 230T (step S15, FIG. )).

  Further, a second encryption sub-process is executed. That is, the content of the transmission ciphertext storage unit 230T is decrypted with the own unique key stored in the self-unique key storage unit 400 and stored again in the transmission ciphertext storage unit 230T (step S17, corresponding to FIG. 4B). ).

Finally, the third encryption sub-process is executed. That is, the content of the transmission ciphertext storage unit 230T is encrypted with the encryption key of the encryption key table indicated by the second content of the transmission cipher key index storage unit 260T and stored again in the transmission ciphertext storage unit 230T (step S19).
Then, the encrypted data in the transmission ciphertext storage unit 230T is transmitted to the encryption processing device 11R on the receiving side (step S21).
Thereafter, the routine returns to step S11 and waits for the next transmission instruction. The above is the processing of the central processing unit 100T on the transmission side.
Next, processing executed by the central processing unit 100R on the receiving side will be described.

  In FIG. 8, the receiving-side central processing unit 100R waits for an encryption key index to be sent from the transmitting-side cryptographic processing device 11T as a transmission processing task executed in a multitasking environment (step S31). ) Wait (No loop in step S31).

When the encryption key index is received (Yes in step S31), the central processing unit 100R stores the received encryption key index in the reception encryption key index storage unit 270R.
Thereafter, the central processing unit 100R waits for encryption data to be sent from the transmission side (step S35) and waits (No loop in step S35).
When the encrypted data is received, the received encrypted data is stored in the received ciphertext storage unit 250R (step S37, corresponding to FIG. 6A).

  Subsequently, the central processing unit 100T executes the first decoding sub-process. That is, the content of the received ciphertext storage unit 250R is decrypted with the encryption key of the encryption key table indicated by the second content of the received encryption key index storage unit 270R and stored again in the received ciphertext storage unit 250R (step S39, FIG. 6 (b)).

  Further, a second decoding sub-process is executed. That is, the content of the received ciphertext storage unit 250R is encrypted with the unique key of the transmitting-side cryptographic processing device 11T stored in advance in the external unique key storage unit 700, and stored again in the received ciphertext storage unit 250R (step S41, Corresponding to FIG.

Finally, the third encryption sub-process is executed. That is, the content of the received ciphertext storage unit 250R is encrypted with the encryption key of the encryption key table indicated by the first content of the received encryption key index storage unit 270R and stored in the received plaintext storage unit 240R (step S43, FIG. 6 ( d)).
Thereafter, the routine returns to step S31 and waits for reception of the next encryption key index. The above is the processing of the central processing unit 100R on the receiving side.

  (Embodiment 2)

In the first embodiment, different encryption keys, that is, indexes are used in the first and third sub-processes of encryption and decryption, but the same encryption key may be used. However, different encryption keys are used for the first sub-process and the second sub-process of 3DES.
(Embodiment 3)

In the first embodiment, the encryption key index is transmitted together with the encryption data, and every time the encryption key index is referred to, the index to be used is incremented. For example, when the first reference is made to the transmission encryption key index storage unit 260T, the first registered index “11” is used, and when the second reference is made, the second registration is performed. The index “21” is used, and the reference destination is sequentially shifted in the following. Instead of this, the indexes “11” and “21” may be transmitted together with the encrypted data. Even in such a case, since the encryption key is not exchanged, safety of communication is ensured.
(Embodiment 4)

Embodiment 3 considers a mode in which a different index is transmitted each time encrypted data is transmitted. However, as a further modification, the index is changed when the passage of time, the number of communication times, or the communication amount reaches a predetermined standard. It is also conceivable to perform this. In that case, if there is no change in the index with the previous time, the same index as the previous time may be transmitted together with the encrypted data or before and after the encrypted data. Therefore, encryption processing may be performed using the already transmitted index until the index is changed. In response to this, the other party performs a decoding process using the already received index. This is a mode in which an index is transmitted in the first communication, and then a new index is transmitted when it is time to change the index.
(Embodiment 5)

Embodiment 1 uses a 3DES encryption method as an example. However, the present invention is not limited to 3DES, and can be applied to any encrypted communication that uses a plurality of common keys for encryption and decryption. In this embodiment, as an example of an encryption method different from 3DES, a mode in which n encryption keys are used as a part of the encryption key table and one unique key is used will be described.
FIG. 9 is an explanatory diagram showing a state when the encryption processing apparatus on the transmission side transmits plaintext data in this embodiment.
FIG. 10 is an explanatory diagram showing a process in which the transmitting side performs encryption processing in this embodiment.
FIG. 11 is an explanatory diagram showing an example of a reception encryption key index storage unit on the reception side before communicating encrypted data in this embodiment.
FIG. 12 is an explanatory diagram showing a process in which the receiving side performs a decoding process in this embodiment.
Hereinafter, with reference to FIGS. 9-12, it demonstrates centering on a different point from 1st Embodiment.
Since FIG. 9 corresponds to FIG. 3 according to the first embodiment, it is self-evident and description thereof is omitted.

FIG. 10 corresponds to FIG. 4 according to the first embodiment. FIG. 10A shows that encryption is performed with the 11th encryption key of the encryption key table 310T using the first index “11” of the encryption key index. FIG. 10B shows that encryption is performed with the 21st encryption key of the encryption key table 310T using the second index “21” of the encryption key index. Thereafter, the same processing is repeated up to the n-th interval. FIG. 10C shows that encryption is performed using the third encryption key of the encryption key table 310T using the nth index “3” of the encryption key index. FIG. 10D shows that encryption is performed using its own unique key.
Since FIG. 11 corresponds to FIG. 5 according to the first embodiment, it is self-explanatory and description thereof is omitted.

  FIG. 12 corresponds to FIG. 6 according to the first embodiment. In addition, a decryption process opposite to the encryption process illustrated in FIG. 10 is illustrated. FIG. 12A shows the received encrypted data. FIG. 12B shows that decryption is performed using a unique key on the transmission side. FIG. 12C shows that the nth index “3” of the encryption key index is acquired and decrypted with the third encryption key of the encryption key table 310T. FIG. 12D shows that the second index “21” of the encryption key index is acquired and decrypted with the 21st encryption key of the encryption key table 310T. FIG. 12E shows that the first index “11” of the encryption key index is acquired and decrypted with the 11th encryption key in the encryption key table 310T.

  FIG. 13 is a flowchart showing processing executed by the central processing unit on the transmission side in this embodiment. Step S55 corresponds to FIG. 10A, step S57 corresponds to FIG. 10B, step S61 corresponds to FIG. 10C, and step S63 corresponds to FIG. .

FIG. 14 is a flowchart showing processing executed by the central processing unit on the receiving side in this embodiment. Step S73 corresponds to FIG. 11, and steps S77, S79, S81, S91, and S93 correspond to FIGS. 12 (a), (b), (c), (d), and (e), respectively.
(Other variations)

In the fifth embodiment, the first to n-th encryption uses the encryption key in the encryption key table and then the n + 1th encryption is performed with the unique key. However, the unique key may be used in any order. (Embodiment 6)
Further, a mode is also conceivable in which both the unique key is provided after the communication side and the receiving side provide the unique key to each other. (Embodiment 7)

  As mentioned above,

(I) An encryption processing device according to the present invention stores in advance an encryption key storage unit that stores a plurality of common keys used for encryption processing as an indexed encryption key table, and an encryption key unique to the device as its own unique key. When the self-unique key storage unit and the unique key of the partner device are received, the external unique key storage unit that stores the received unique key and the unique key stored in the self-unique key storage unit are provided to the partner device. Alternatively, an encryption key sharing processing unit that receives a unique key from the counterpart device and stores it in the external unique key storage unit, and one or more common keys of the encryption key table stored in the encryption key storage unit and the self-unique key storage Or an encryption unit that generates encrypted data by applying the unique key stored in the external unique key storage unit to the data to be transmitted and the common key used for the encryption. A transmission unit that transmits the index and the encrypted data to the counterpart device, a reception unit that receives the index of the common key used for encryption in the counterpart device and the encrypted data from the counterpart device, and the encryption A decryption key acquisition unit that acquires one or more common keys of the encryption key table stored in the key storage unit and a unique key stored in the self-unique key storage unit or the external unique key storage unit, and the acquired common key A decryption unit that decrypts the encrypted data received by applying the key and the unique key, and the decryption key acquisition unit acquires the common key by referring to the encryption key storage unit with the received index, The unique key is obtained by referring to the external unique key storage unit or the self-unique key storage unit.

  In the present invention, the counterpart device is an external device. If it is considered that the counterpart device has the same configuration as the own device and stores the same encryption key table in the encryption key storage unit, it will be easy to understand the encryption processing of the present invention.

  The encryption key table is a data table in which a plurality of common keys are registered, and each common key is given a unique index indicating a position in the data table for reference. By referring to the data table using the index, the common key indicated by the index can be acquired.

  The unique key is an encryption key unique to each device. Therefore, the own unique key and the unique key of the counterpart device are different. In the present invention, the “unique key” is read for the sake of convenience so that it can be easily distinguished from the common key registered in the encryption key table. However, the unique key is also used as the common key for encryption processing.

  The function of the encryption key sharing processing unit according to the present invention is realized when the central processing unit executes a predetermined control program in the above-described embodiment. If the encryption key sharing processing unit provides at least its own unique key to the counterpart device or receives the unique key of the counterpart device and shares one unique key with the counterpart device, encrypted communication is performed. Can do. In addition, two unique keys may be shared by exchanging unique keys with the counterpart device. In that case, the sender uses the own unique key for encryption, and the recipient uses the unique key received from the sender. Whether to perform decryption or vice versa is determined in advance.

  The functions of the encryption unit, the decryption key acquisition unit, and the decryption unit are realized by the central processing unit executing a predetermined control program in the above-described embodiment. However, these functions may be realized by hardware or may be realized by using a dedicated processing unit.

  Furthermore, the preferable aspect of this invention is demonstrated.

(Ii) The encryption unit applies the unique key stored in the self-unique key storage unit when the encryption key sharing processing unit provides its own unique key to the counterpart device; When the unique key is received and stored in the external unique key storage unit, the received unique key is applied, and the decryption key acquisition unit receives the unique key of the counterpart device and stores the external unique key If the encryption key sharing processing unit provides its own unique key to the other device, the unique key stored in the own unique key storage unit is acquired. You may get it.
In this way, the transmission side that performs encryption and the reception side that performs decryption can perform encrypted communication using a common unique key.

  (Iii) The encryption unit uses a part and a plurality of common keys in the encryption key table for encryption, and transmits an index of the common key used for encryption before transmission of encrypted data or transmission of encrypted data. At the same time, it may be provided to the transmission unit, and the common key used for encryption may be changed as encrypted data is transmitted.

In this way, since the common key can be changed by changing the index as it is transmitted, it is possible to further reduce the risk of the content of communication being decrypted by a third party.

  Here, as an aspect of changing the selection as communication is performed, it is conceivable that the index is changed with the passage of time, or the index is changed with the communication amount or the number of times of communication. However, it is not limited to these aspects.

  (Iv) An instruction receiving unit that receives an instruction for sharing the encryption key is further provided, and the encryption key sharing processing unit provides the unique key stored in the self-unique key storage unit to the counterpart device in response to the received instruction. May be.

In this way, in response to the instruction received by the instruction receiving unit, its own unique key can be provided to the counterpart device and used as an encryption key for encrypted communication. In addition, by storing that the unique key is provided to the partner device in response to the instruction, encryption or decryption using the unique key is performed in subsequent communication with the partner device. Can be determined to be possible.
The instruction receiving unit may be a touch panel, a key, or the like that receives an operation from the user, or may receive an instruction by communicating with a counterpart device or an external device.

  (V) the encryption key sharing processing unit provides the counterpart device with the encryption key table stored in the encryption key storage unit in response to an instruction received by the instruction receiving unit or a request from the counterpart device; When the unique key is received from the counterpart device, but the encryption key table is not stored in the encryption key storage unit, the encryption key table may be requested from the counterpart device.

In this way, when sharing the unique key with the counterpart device, the encryption key table can be provided to the counterpart device or received from the counterpart device and shared.
Preferred embodiments of the present invention include combinations of any of the plurality of embodiments described above.

  Moreover, the cryptographic processing system according to the present invention provides:

(Vi) comprising at least a transmission-side device and a reception-side device, wherein the transmission-side device includes a first encryption key storage unit that stores a plurality of common keys used for encryption processing as an encryption key table with an index, and a device-specific A self-unique key storage unit that pre-stores the encryption key as a self-unique key; a first encryption key sharing processing unit that provides a unique key stored in the self-unique key storage unit to the receiving device; and the encryption key storage unit One or more common keys of the encryption key table stored in the key and its own unique key are applied to data to be transmitted and encrypted to generate encrypted data, and the common key used for encryption A transmission unit that transmits the index and the encrypted data to the reception-side device, wherein the reception-side device stores a second encryption key storage unit that stores the same encryption key table as the transmission-side device; When receiving the unique key, the external unique key storage unit for storing the received unique key, the second encryption key sharing processing unit for receiving the unique key from the transmission side device and storing it in the external unique key storage unit, and the transmission side A receiving unit that receives the common key index and encrypted data used for encryption in the device from the transmitting device; and at least one common key in the encryption key table stored in the encryption key storage unit and the transmitting device And a decryption key obtaining unit that obtains the unique key, and a decryption unit that decrypts the encrypted data received by applying the obtained common key and unique key. The unique key stored in the key storage unit and provided to the receiving device by the first encryption key sharing processing unit is applied to the encryption, and the decryption key acquisition unit stores the encryption stored in the encryption key storage unit with the received index. Key table To obtain a common key, and the second encryption key sharing processing unit obtains the unique key stored in the external unique key storage unit.
According to different aspects,

(Vii) comprising at least a transmission-side device and a reception-side device, wherein the transmission-side device includes a first encryption key storage unit that stores a plurality of common keys used for encryption processing as an encryption key table with an index; An external unique key storage unit for storing the received unique key when receiving the unique key; a first encryption key sharing processing unit for receiving the unique key from the receiving device and storing it in the external unique key storage unit; One or more common keys of the encryption key table stored in the key storage unit and the unique key of the receiving device are applied to the data to be transmitted and encrypted to generate encrypted data, and used for encryption A second encryption key storage for storing the same encryption key table as that of the transmission-side device, the transmission-side device including a transmission unit that transmits the index of the received common key and the encrypted data to the reception-side device A self-unique key storage unit that preliminarily stores an encryption key unique to the device as its own unique key, and a second encryption key sharing processing unit that provides the transmission-side device with the unique key stored in the self-unique key storage unit; A receiving unit that receives the index of the common key used for encryption in the transmission side device and the encrypted data from the transmission side device, and one or more common keys in an encryption key table stored in the encryption key storage unit, A decryption key obtaining unit that obtains its own unique key; and a decryption unit that decrypts encrypted data received by applying the obtained common key and unique key. The encryption key sharing processing unit applies the unique key stored in the external unique key storage unit to encryption, and the decryption key acquisition unit refers to the encryption key table stored in the encryption key storage unit with the received index. Get common key , And acquires the unique key the self inherent key storing second cipher key sharing process section stored in the unit has provided the transmitting device.
A combination of any of the above-described preferred embodiments with the cryptographic processing system of the present invention is also included in the scope of the present invention.

  In addition to the embodiments described above, there can be various modifications of the present invention. These modifications should not be construed as not belonging to the scope of the present invention. The present invention should include the meaning equivalent to the scope of the claims and all modifications within the scope.

11, 11T, 11R: Cryptographic processing device, 100, 100T, 100R: Central processing unit, 110: Encryption key sharing processing unit, 120: Encryption unit, 130: Decryption key acquisition unit, 140: Decryption unit, 200: Main Storage unit 210: control program storage unit 220, 220T: transmission plaintext storage unit 230, 230T: transmission ciphertext storage unit 240, 240R: reception plaintext storage unit 250, 250R: reception ciphertext storage unit 260 260T: Transmission encryption key index storage unit, 270, 270R: Reception encryption key index storage unit, 300, 300T: Encryption key storage unit, 310, 310T, 310R: Encryption key table, 400, 400T: Self-unique key storage unit, 500 : Instruction receiving unit, 600: Communication unit, 610: Transmission 620: receiving unit, 700, 700T, 700R: external unique key storage unit, 800: program storage unit

Claims (7)

An encryption key storage unit for storing a plurality of common keys used for encryption processing as an indexed encryption key table;
A self-unique key storage unit that pre-stores a device-specific encryption key as its own unique key;
When receiving the unique key of the counterpart device, an external unique key storage unit that stores the received unique key;
An encryption key sharing processing unit that provides the unique key stored in the self-unique key storage unit to the counterpart device or receives the unique key from the counterpart device and stores it in the external unique key storage unit;
One or more common keys of the encryption key table stored in the encryption key storage unit and the unique key stored in the self-unique key storage unit or the external unique key storage unit are applied to the data to be transmitted and encrypted. An encryption unit for generating encrypted data;
A transmission unit that transmits the index of the common key used for encryption and the encrypted data to the counterpart device;
A receiving unit that receives the index of the common key used for encryption in the partner device and the encrypted data from the partner device;
A decryption key acquisition unit that acquires one or more common keys of an encryption key table stored in the encryption key storage unit and a unique key stored in the self-unique key storage unit or the external unique key storage unit;
A decryption unit that decrypts the encrypted data received by applying the acquired common key and unique key,
The decryption key acquisition unit acquires a common key by referring to the encryption key storage unit with the received index, acquires a unique key with reference to the external unique key storage unit or the self-unique key storage unit ,
The encryption unit uses a common key that is the same as or different from the previous one when generating encrypted data for the second and subsequent times,
The transmission unit transmits the common key index used for encryption together with the generated encrypted data when a common key different from the previous time is used, but if the same common key as the previous time is used, the index is displayed. Send encrypted data without it,
The decryption unit is a cryptographic processing device that decrypts received encrypted data using an already received index until a new index is received . The encryption unit applies the unique key stored in the self-unique key storage unit when the encryption key sharing processing unit provides its own unique key to the counterpart device, and the unique key of the counterpart device Is received and stored in the external unique key storage unit, the received unique key is applied,
The decryption key obtaining unit obtains the received unique key when the unique key of the counterpart device is received and stored in the external unique key storage unit, and the encryption key sharing processing unit obtains its own unique key. The cryptographic processing apparatus according to claim 1, wherein the unique key stored in the self-unique key storage unit is acquired when the information is provided to the counterpart device.   The encryption unit uses a part and a plurality of common keys in an encryption key table for encryption, and transmits the common key index used for encryption before transmission of encrypted data or together with transmission of encrypted data. The cryptographic processing apparatus according to claim 1, wherein the common key used for encryption is changed as the encrypted data is transmitted to the unit. An instruction receiving unit for receiving an instruction to share the encryption key;
The encryption processing apparatus according to claim 1, wherein the encryption key sharing processing unit provides a unique key stored in the self-unique key storage unit to a counterpart device in response to an accepted instruction. .   The encryption key sharing processing unit provides the partner device with the encryption key table stored in the encryption key storage unit in response to an instruction received by the instruction receiving unit or a request from the partner device. 5. The cryptographic processing apparatus according to claim 4, wherein when the unique key is received from the encryption key storage unit but the cryptographic key table is not stored in the cryptographic key storage unit, the cryptographic key table is requested from the counterpart device. It consists of at least the sending device and the receiving device,
The transmitting device is
A first encryption key storage unit that stores a plurality of common keys used for encryption processing as an indexed encryption key table;
A self-unique key storage unit that pre-stores a device-specific encryption key as its own unique key;
A first encryption key sharing processing unit for providing a unique key stored in the self-unique key storage unit to the receiving device;
An encryption unit that encrypts data by applying one or more common keys of the encryption key table stored in the encryption key storage unit and its own unique key to data to be transmitted; and
A transmission unit that transmits an index of a common key used for encryption and the encrypted data to a receiving device;
The receiving device is:
A second encryption key storage unit for storing the same encryption key table as that of the transmission side device;
When receiving the unique key of the sending device, an external unique key storage unit that stores the received unique key;
A second encryption key sharing processing unit that receives the unique key from the transmission side device and stores it in the external unique key storage unit;
A receiving unit that receives the index of the common key used for encryption in the transmitting device and the encrypted data from the transmitting device;
A decryption key acquisition unit for acquiring one or more common keys of the encryption key table stored in the encryption key storage unit and a unique key of the transmission side device;
A decryption unit that decrypts the encrypted data received by applying the acquired common key and unique key,
The encryption unit applies the unique key stored in the self-unique key storage unit and provided to the receiving side device by the first encryption key sharing processing unit for encryption;
The decryption key acquisition unit acquires a common key by referring to the encryption key table stored in the encryption key storage unit with the received index, and the second encryption key sharing processing unit stores the unique key stored in the external unique key storage unit. to get the key,
The encryption unit uses a common key that is the same as or different from the previous one when generating encrypted data for the second and subsequent times,
The transmission unit transmits the common key index used for encryption together with the generated encrypted data when a common key different from the previous time is used, but if the same common key as the previous time is used, the index is displayed. Send encrypted data without it,
The decryption unit decrypts the received encrypted data using the already received index until a new index is received . It consists of at least the sending device and the receiving device,
The transmitting device is
A first encryption key storage unit that stores a plurality of common keys used for encryption processing as an indexed encryption key table;
When receiving the unique key of the receiving device, an external unique key storage unit that stores the received unique key;
A first encryption key sharing processing unit that receives a unique key from the receiving device and stores it in the external unique key storage unit;
An encryption unit that applies one or more common keys of the encryption key table stored in the encryption key storage unit and the unique key of the receiving device to the data to be transmitted to generate encrypted data;
A transmission unit that transmits an index of a common key used for encryption and the encrypted data to a receiving device;
The receiving device is:
A second encryption key storage unit for storing the same encryption key table as that of the transmission side device;
A self-unique key storage unit that pre-stores a device-specific encryption key as its own unique key;
A second encryption key sharing processing unit that provides the transmitting side device with the unique key stored in the self-unique key storage unit;
A receiving unit that receives the index of the common key used for encryption in the transmitting device and the encrypted data from the transmitting device;
A decryption key acquisition unit for acquiring one or more common keys and a unique key of the encryption key table stored in the encryption key storage unit;
A decryption unit that decrypts the encrypted data received by applying the acquired common key and unique key,
The encryption unit applies the unique key stored in the external unique key storage unit by the first encryption key sharing processing unit to encryption,
The decryption key acquisition unit acquires a common key by referring to an encryption key table stored in the encryption key storage unit with the received index, and stores the common key in the self-unique key storage unit. Get the unique key provided to the sending device ,
The encryption unit uses a common key that is the same as or different from the previous one when generating encrypted data for the second and subsequent times,
The transmission unit transmits the common key index used for encryption together with the generated encrypted data when a common key different from the previous time is used, but if the same common key as the previous time is used, the index is displayed. Send encrypted data without it,
The decryption unit decrypts the received encrypted data using the already received index until a new index is received .