JP2003069550A - Electronic information management device, electronic information management method, and key management device - Google Patents

Abstract

(57) [Problem] To provide an electronic information management device and an electronic information management method capable of improving security by making outflow of electronic information difficult. A terminal unit that stores electronic information encrypted with a session key in an electronic medium, and a terminal unit that stores and manages a session key used for encrypting the electronic information. And a key management unit 2 formed in

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronic information management device, an electronic information management method, and a key management device, and more particularly to a technique for preventing leakage of electronic information to the outside.

[0002]

2. Description of the Related Art Conventionally, an electronic information management device for managing various electronic information has been known. In this electronic information management device, it is common practice to encrypt and store electronic information for which leakage is desired to be prevented. When encrypting electronic information, a key for encrypting electronic information with a normal encryption algorithm (hereinafter referred to as "session key") is generated for each electronic information, and the generated session key is used. Encryption is done. The session key itself is encrypted using another key (hereinafter referred to as "session key encryption key").

The electronic information encrypted with the session key and the session key encrypted with the session key encryption key are
Generally, they are stored and managed in the same place. In addition, the session key encryption key must be stored separately from the encrypted session key in order to ensure confidentiality. The session key encryption key is often the I
It is stored in a storage medium such as a C card that can be attached to and detached from the electronic information management device.

FIG. 4 shows an example in which an electronic information management device configured to store a session key encryption key in an IC card is realized by a terminal device. This terminal device includes a processing unit 10, an encryption unit 11, a decryption unit 12, and an electronic medium 13.
And the IC card 14.

The processing unit 10 responds to the operation of the operator by
The electronic information is generated and sent to the encryption unit 11, and the decrypted electronic information from the decryption unit 12 is displayed on a display device (not shown) for viewing by an operator.

In response to the instruction from the processing unit 10, the encryption unit 11 encrypts electronic information using the session key encryption key from the IC card 14 and sends it to the electronic medium 13. The decryption unit 12 decrypts the encrypted electronic information from the electronic medium 13 using the session key encryption key from the IC card 14, and sends it to the processing unit 10.

The electronic medium 13 is composed of, for example, a disk device, and stores electronic information encrypted with a session key and a session key encrypted with the session key encryption key in a pair. The IC card 14 is detachably attached to this terminal device and stores a session key encryption key.

Next, the operation of the terminal device as the electronic information management device thus configured will be described. First, the operation of encrypting and storing electronic information will be described with reference to the flowchart shown in FIG.

First, the operator operates the terminal device to generate electronic information, and requests recording of the generated electronic information. In response to this request, the processing unit 10 generates a session key (step S50). The generated session key is sent to the encryption unit 11. Next, the encryption unit 11 encrypts the electronic information using the received session key (step S51).

Next, the encryption section 11 extracts the session key encryption key from the IC card 14 (step S5).
2). Further, the encryption unit 11 encrypts the session key used for encrypting the electronic information using the extracted session key encryption key (step S53).

Next, the encryption unit 11 performs the above step S5.
The electronic information encrypted with the session key in 1 and the session key encrypted with the session key encryption key in step S53 are stored in the electronic medium 13 as a pair. With the above, the operation of encrypting and storing the electronic information is completed.

Next, the operation of reading and displaying the encrypted electronic information will be described with reference to the flowchart shown in FIG.

First, the operator operates the terminal device to request the display of electronic information. In response to this request, the decryption unit 12 reads the session key encrypted by the session key encryption key and the electronic information encrypted by the session key from the electronic medium 13 (step S6).
0). Next, the decryption unit 12 extracts the session key encryption key from the IC card 14 (step S61).

Next, the decryption unit 12 decrypts the session key read from the electronic medium 13 using the extracted session key encryption key (step S62). Further, the decryption unit 12 decrypts the electronic information read from the electronic medium 13 using the decrypted session key (step S63). The decrypted electronic information is sent to the processing unit 10.

Next, the processing unit 10 displays the decoded electronic information sent from the decoding unit 12 on a display device (not shown) (step S64). As described above, the operation of decrypting and displaying the encrypted electronic information is completed.

[0016]

In the electronic information management device configured as described above, it is desirable for safety to manage electronic information and session key separately. However, since it is difficult to separately store and manage electronic information and session keys without sacrificing convenience, conventionally, electronic information and session keys are stored and managed in the same place for convenience. However, there is a problem that it is not preferable for safety.

The present invention has been made in order to solve the above-mentioned problems, and it is possible to improve the safety by making it difficult to leak electronic information, an electronic information management method, an electronic information management method, and a key. To provide a management device.

[0018]

In order to achieve the above object, an electronic information management apparatus of the present invention comprises a terminal section for storing electronic information encrypted by a session key in an electronic medium,
And a key management unit formed separately from the terminal unit for storing and managing the session key used for encryption of the electronic information.

According to this electronic information management apparatus, electronic information is encrypted and recorded in the terminal section. The key used for encryption is recorded in the key management unit. Therefore, in order to leak the electronic information, the information must be taken out from both the terminal unit and the key management unit, so that the leakage of the electronic information becomes difficult and the security can be improved.

In the electronic information management method of the present invention, a storage step of storing electronic information encrypted by a session key in an electronic medium, and the session key used for encryption of the electronic information in the electronic medium And a key management step of storing and managing the key in a key management unit in a different location.

This electronic information management method also has the same operation and effect as the above-described electronic information management device.

The key management device of the present invention is a key management device formed separately from a terminal unit for storing electronic information encrypted by a session key in an electronic medium, wherein the encryption of the electronic information is performed. A key management unit for storing and managing the session key used for encryption is provided.

This key management device also has the same operation and effect as the electronic information management device described above.

[0024]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described in detail below with reference to the drawings. It should be noted that the same or corresponding parts as those of the conventional electronic information management device described in the section of the related art are designated by the same reference numerals, and the description thereof will be omitted or simplified.

FIG. 1 is a block diagram showing a configuration of an electronic information management device according to an embodiment of the present invention. The electronic information management device shown in FIG. 1 includes a terminal unit 1 and a key management unit 2. The key management unit 2 corresponds to the key management device of the present invention. The terminal unit 1 and the key management unit 2 can be configured in the same terminal device, or the terminal unit 1 can be configured by one terminal device and the key management unit can be configured by another terminal device. . From the viewpoint of safety, the latter configuration is preferable.

The terminal unit 1 includes a processing unit 10, an encryption unit 11,
It is composed of a decryption unit 12, an electronic medium 13 and an IC card 14.

The processing unit 10 responds to the operation of the operator by
The electronic information and the session key are generated and sent to the encryption unit 11. In addition, the processing unit 10 displays the decrypted electronic information from the decryption unit 12 on a display device (not shown) for the operator to browse.

The encryption section 11 encrypts electronic information using the session key from the processing section 10 and sends it to the electronic medium 13. The encryption unit 11 uses an encryption algorithm for encryption processing of electronic information. As this encryption algorithm, an encryption algorithm using a public key called RSA (Rivest Shamir Adleman) is used. A private key is used as the decryption key, and the private key and the public key are numerical data different from each other.

The encryption unit 11 also generates a hash value using a predetermined hash function, associates the generated hash value with the encrypted session key used to encrypt the electronic information, and then the key management unit 11 Send to 2. A hash value is generated by compressing electronic information to a basic unit or less using a hash function H. As the predetermined hash function, for example, MD
5 is used.

The decryption unit 12 decrypts the encrypted session key from the key management unit 2 using its own secret key from the IC card 14. Then, using this decrypted session key, the electronic information stored in the electronic medium 13 is decrypted and sent to the processing unit 10.

The electronic medium 13 is composed of, for example, a disk device, and stores electronic information encrypted by using a session key. In this case, only the encrypted electronic information is stored in the electronic medium 13, and the encrypted session key is not stored in the electronic medium 13.

The IC card 14 corresponds to the memory of the present invention. The IC card 14 is detachably attached to the terminal unit 1 and stores its own secret key. The storage medium for storing the secret key is not limited to the IC card, and a floppy (registered trademark) disk, a memory stick (nonvolatile semiconductor memory), or another storage medium can be used.

The key management unit 2 stores the encrypted session key sent from the encryption unit 11 and the hash value in association with each other. The stored pair of session key and hash value are read by the decryption unit 12.

Next, the operation of the electronic information management apparatus thus configured, that is, the electronic information management method will be described.
First, the operation of encrypting and storing electronic information will be described with reference to the flowchart shown in FIG.

First, the operator operates the terminal unit 1 to generate electronic information and requests recording of the generated electronic information. In response to this request, first, a session key is generated (step S10). That is, the processing unit 10 generates a session key used for encrypting electronic information with a normal encryption algorithm. The generated session key is sent to the encryption unit 11.

Next, the electronic information is encrypted and recorded by the session key (step S11). That is, the encryption unit 11 encrypts the electronic information received by the processing unit 10 using the session key also received from the processing unit 10, and stores it in the electronic medium 13.

Next, the hash value of the encrypted electronic information is acquired (step S12). That is, the encryption unit 11 acquires a hash value from the electronic information encrypted in step S11 by a one-way function.

Further, the session key is encrypted by the public key algorithm using its own public key (step S1).
3). That is, the encryption unit 11 uses the public key algorithm to encrypt the session key generated in step S10 using the public key of the terminal unit 1.

Next, the encrypted session key and hash value are sent (step S14). That is, the encryption unit 11 sends the session key encrypted by the public key in step S13 and the hash value acquired in step S12 as a pair to the key management unit 2 (step S1).
4). The key management unit 2 registers the hash value and the encrypted session key in association with each other.

Next, the session key is discarded (step S15). That is, the encryption unit 11 discards the session key used to encrypt the electronic information. As a result, the session key used to encrypt the electronic information does not exist in this electronic information management device at all, and the security is maintained. With the above, the operation of encrypting and storing the electronic information is completed.

Next, the operation of reading and displaying the encrypted electronic information will be described with reference to the flowchart shown in FIG.

First, the operator operates the terminal unit 1 to request the display of electronic information. In response to this request, the hash value of the encrypted electronic information is calculated (step S
20). That is, the processing unit 10 instructs the decoding unit 12 to read the electronic information in response to the operation of the operator. In response to this instruction, the decryption unit 12 reads the encrypted electronic information from the electronic medium 13 and calculates a hash value based on the read electronic information.

Next, the acquisition of the encrypted session key is requested (step S21). That is, the decoding unit 1
2 sends the hash value calculated in step S20 to the key management unit 2. The key management unit 2 takes out the encrypted session key corresponding to the received hash value and sends it to the decryption unit 12.

Next, the private key is read (step S22). That is, the decryption unit 12 reads out its own private key from the IC card 14.

Further, the session key is decrypted with the secret key (step S23). That is, the decryption unit 12 decrypts the encrypted session key extracted from the key management unit 2 using the secret key. As a result, the session key used to encrypt the electronic information is reproduced.

Next, the electronic information is read (step S24). That is, the decoding unit 12 includes the processing unit 1
The designated electronic information is read from 0.

Further, the electronic information is decrypted by the session key (step S25). That is, the decryption unit 12 decrypts the electronic information read in step S24 using the session key reproduced in step S23. The decrypted electronic information is sent to the processing unit 10.

Next, the processing unit 10 displays the decrypted electronic information sent from the decryption unit 12 on a display device (not shown) (step S26). As described above, the operation of decrypting and displaying the encrypted electronic information is completed.

As described above, according to the electronic information management device, the electronic information management method, and the key management device according to the embodiments, electronic information is encrypted and recorded in the terminal unit 1.
The key used for encryption is recorded in the key management unit 2.
For this reason, in order to leak the electronic information, the information must be taken out from both the terminal unit 1 and the key management unit 2, so that the electronic information becomes difficult to leak and the security can be improved. Moreover, since the public key and the secret key are used, the security can be further improved.

[0050]

As described in detail above, according to the present invention,
It is possible to provide an electronic information management device, an electronic information management method, and a key management device that can improve security by making leakage of electronic information difficult.

[Brief description of drawings]

FIG. 1 is a block diagram showing a configuration of an electronic information management device according to an embodiment of the present invention.

FIG. 2 is a flowchart showing an electronic information recording operation in the electronic information management device according to the embodiment of the present invention.

FIG. 3 is a flowchart showing a display operation of electronic information in the electronic information management device according to the exemplary embodiment of the present invention.

FIG. 4 is a block diagram showing a configuration of a conventional electronic information management device.

FIG. 5 is a flowchart showing a recording operation of electronic information in a conventional electronic information management device.

FIG. 6 is a flowchart showing a display operation of electronic information in a conventional electronic information management device.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 ... Terminal part, 2 ... Key management part, 10 ... Processing part, 11 ... Encryption part, 12 ... Decryption part, 13 ... Electronic medium, 14 ... IC card.

Claims (8)

[Claims] 1. A terminal unit that stores electronic information encrypted by a session key in an electronic medium, and a terminal unit that stores and manages the session key used for encrypting the electronic information and is separate from the terminal unit. An electronic information management device comprising: a key management unit formed on the body. 2. The terminal unit calculates a hash value of the encrypted electronic information when storing the encrypted electronic information in the electronic medium,
An encryption unit that encrypts the session key used for encrypting the electronic information, and stores the calculated hash value and the encrypted session key in the key management unit in association with each other; When reading the generated electronic information from the electronic medium, a hash value of the encrypted electronic information is calculated, and a session key associated with the calculated hash value is read from the key management unit and decrypted. 2. The electronic information management apparatus according to claim 1, further comprising: a decryption unit that decrypts the encrypted electronic information from the electronic medium using the decrypted session key. 3. The session key is further provided with a memory for storing a secret key, wherein the encryption unit uses the public key of the terminal unit when storing the encrypted electronic information in the electronic medium. The decryption unit uses the private key stored in the memory to read the encrypted session key from the key management unit when reading the encrypted electronic information from the electronic medium. 3. The electronic information management device according to claim 2, which is decrypted. 4. A storage step of storing electronic information encrypted by a session key in an electronic medium, and a key management in which the session key used for encryption of the electronic information is located in a place different from the electronic medium. An electronic information management method comprising: a key management step of storing and managing in a department. 5. When storing the encrypted electronic information in the electronic medium, a hash value of the encrypted electronic information is calculated, and the session key used for encrypting the electronic information is calculated. An encryption step of encrypting and storing the calculated hash value and the encrypted session key in the key management unit in association with each other; and when reading the encrypted electronic information from the electronic medium, Calculating a hash value of the encrypted electronic information, decrypting the session key associated with the calculated hash value,
The decryption step of decrypting the encrypted electronic information from the electronic medium by using the decrypted session key, the electronic information management method according to claim 4. 6. The encryption step encrypts the session key with a public key when storing the encrypted electronic information in the electronic medium, and the decryption step includes the encryption. 6. The electronic information management method according to claim 5, wherein the encrypted session key is decrypted using a secret key when the electronic information is read from the electronic medium. 7. A key management device formed separately from a terminal unit for storing electronic information encrypted by a session key in an electronic medium, the session key used for encrypting the electronic information. A key management device comprising: a key management unit that stores and manages. 8. The terminal unit calculates a hash value of the encrypted electronic information when storing the encrypted electronic information in the electronic medium, and is used for encryption of the electronic information. When the session key is encrypted, the key management unit stores the calculated hash value and the encrypted session key in association with each other, and the terminal unit stores the encrypted electronic key. When the hash value of the encrypted electronic information is calculated when reading the information from the electronic medium, the key management unit reads the session key associated with the calculated hash value and The key management device according to claim 7, wherein the key management device outputs the data to a terminal unit.