JPH09134311A - Security system - Google Patents

Abstract

The present invention relates to a security system, and to a device I.
D, medium ID, license information encrypted using the data encryption key and encrypted data are written on the medium, and only the device having the device ID can decrypt the data, and encryption is performed even if the medium or the restoration program is stolen. The purpose is to protect the encrypted data on the medium by disabling data restoration. When data is written, permission information encrypted from a medium 1D read from the medium, its own device ID, and a data encryption key, and encrypted data obtained by encrypting the data with a data encryption key are written to the medium. , Means for decrypting the data decryption key from the medium 1D read from the medium, the license information, and the device ID of the device itself when the data is read, and decrypting the encrypted data read from the medium using the decrypted data decryption key It is configured to include

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a security system for protecting data on a medium.

[0002]

2. Description of the Related Art Conventionally, in a system in which a plurality of devices (terminals) are connected to a host, data created on a certain device is written in a medium such as an MO (magneto-optical disk) and a unique identification symbol is written in advance. The device on the reading side reads the original data by inputting the unique identification code to prevent the data from being stolen when the medium is lost for some reason.

[0003]

As described above, a device writes data to a medium and also writes a unique identification symbol, and the unique identification symbol is input from the reading side device to restore the data from the medium. However, there is a problem that any restoration device may be used, and if the restoration program is stolen together with the medium, the data is easily restored by another device and used undesirably.

[0004] The present invention solves these problems,
The device ID, the medium ID, the license information encrypted using the data encryption key, and the encrypted data are written to the medium so that only the device having the device ID can decrypt the data, and the encryption is performed even if the medium or the restoration program is stolen. The purpose is to protect the encrypted data on the medium by prohibiting restoration of encrypted data.

[0005]

Means for solving the problem will be described with reference to FIG. In FIG. 1, medium 1
Is a portable medium in which the medium ID, the permission information, and the encrypted data are written.

The individual key generating means 5 generates an individual key from the device ID 4 and the medium ID 21. The encryption means 7 is for encrypting the data encryption key 6 with an individual key to generate the permission information 22.

The encryption means 8 transfers the data to the data encryption key 6
To generate encrypted data 23.
The individual key generating means 9 generates an individual key from the device ID 4 and the medium ID 21.

The decrypting means 10 decrypts the license information 22 with an individual key to generate a data decryption key 11. The decryption means 12 converts the encrypted data 23 into the data decryption key 11
Is used to generate data by decoding.

Next, the operation will be described. The medium I read from the medium 1 by the individual key generation means 5 at the time of writing data
D21 and the individual key generated from its own device ID 4 generate the permission information 22 in which the data encryption key 6 is encrypted to generate the medium 1
At the same time, the encryption means 8 writes the encrypted data 23, which is the data encrypted with the data encryption key 6, to the medium.
Then, at the time of reading the data, the individual key generation unit 9 generates an individual key from the medium ID 21 read from the medium 1 and its own device ID 4, and the decryption unit 10 reads the permission information from the medium 1 with the generated individual key. The data 22 is decrypted to generate the data decryption key 11, and the decryption means 12 decrypts the encrypted data 23 read from the medium 1 with the generated data decryption key 11 to generate the data.

At this time, when there are a plurality of devices, the permission information 22 is generated and written in the medium 1 in correspondence with the device ID 4 of each device. Also,
When there are a plurality of encrypted data 23 to be written on the medium 1,
The permission information 22 is written in the medium 1 for each encrypted data 23.

Further, the device ID is the device ID of the computer itself or the device ID of a portable medium access device that reads / writes on / from the medium 1. Therefore, by writing the permission information 22 and the encrypted data 23 encrypted by using the device ID, the medium ID, and the data encryption key to the medium 1, and only the device having the device ID can decrypt the medium, Even if the restoration program is stolen, the encrypted data cannot be restored, and the encrypted data on the medium can be protected.

[0012]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Next, an embodiment and operation of the present invention will be described in detail with reference to FIGS.

FIG. 1 shows a system configuration diagram of the present invention.
In FIG. 1, a medium 1 is a unique medium ID, license information,
And a portable medium for writing encrypted data, for example, a portable medium capable of storing a large capacity such as MO (magneto-optical disk).

The medium ID 21 is a non-rewritable unique medium ID written on the medium. For example, the medium ID 21 is burned to a predetermined area with a laser beam to write the unique medium ID. As a result, even if the medium 1 is copied, the medium ID cannot be copied, and forgery of the medium 1 itself can be prevented.

The permission information 22 is an individual key and is the data encryption key 6
Is encrypted. The encrypted data 23 is data encrypted by the data encryption key 6, and is data encrypted by an encryption algorithm such as DES.

The data creation source device 2 encrypts the data encryption key 6 and writes it on the medium 1, or encrypts the data with the data encryption key 6 and writes it on the medium 1. 5, encryption means 7, 8 and the like.

The individual key generation means 5 is for generating an individual key from the unique medium ID 21 and device ID 4 read from the medium 1. Here, the device ID is the device ID of the computer device itself or the device ID of a portable medium access device that reads from and writes to the medium. Normally,
Although the former is used as the device ID, one portable medium access device (for example, a magneto-optical disk device) is carried during installation or maintenance to install one control medium or store data. If the license information and the encrypted data associated with the device ID of the access device are written in the medium 1, the program can be installed in all the devices and the initial setting and correction of the data can be performed using the one medium access device. It is very convenient for maintenance work.

The encryption means 7 encrypts the data encryption key 6 with an individual key and writes it as the permission information 22 on the medium 1. The encryption means 8 encrypts the data with the data encryption key 6 and writes it as the encrypted data 23 in the medium 1.

The data restoration side device 3 is a device on the data restoration side, which reads the medium ID, the license information 22 and the encrypted data 23 from the medium 1 and decrypts them to generate data, and generates an individual key. Means 9, Decoding Means 10, 12
And so on.

The individual key generating means 9 is for generating an individual key from the medium ID read from the medium 1 and the device ID of itself. The decryption means 10 decrypts the permission information read from the medium 1 with the generated individual key to generate the data decryption key 11.

The decryption means 12 decrypts the encrypted data 23 read from the medium 1 with the generated data decryption key 11 to generate data. FIG. 2 shows an example of medium information of the present invention.

FIG. 2A shows an example of medium information. This medium information is information written in the portable medium 1 in FIG. 1 and is the following information shown in the figure. -Medium ID-Company unique ID-License information 1-n-Encrypted data 1-n Here, as described above, the medium ID is the one in which the medium ID is written on the medium by a laser beam or the like. Therefore, even if the data on the medium 1 is copied, it cannot be copied. The company unique ID is an ID unique to a company and is uniquely determined for each company having a different system. The license information 1 to n is generated for each different device. Therefore, in order to write or install one encrypted data to n devices, for example, the permission information for each of the n devices is written. The encrypted data 1 to n is encrypted data for each license information. Note that one piece of encrypted data may be stored in association with a plurality of pieces of permission information.

FIG. 2B is an explanatory view for explaining the correspondence between the license information and the device ID. As described with reference to FIG. 1, the license information is generated by generating an individual key from the device ID 4 and the medium ID 21, and encrypting the data encryption key 6 with this individual key. Therefore, as a result, the license information is generated in association with the device ID.
The situation is schematically represented, and the permission information 1 corresponds to the device ID 1, and so on.

Next, the procedure for creating the encrypted data having the configuration of FIG. 1 will be described in detail according to the order shown in the flowchart of FIG. FIG. 3 shows an encrypted data creation flowchart of the present invention.

In FIG. 3, S1 takes out the data to be encrypted. In S2, the data encryption key is taken out. S3
Encrypts the data with the data encryption key to create encrypted data.

At step S4, the data is stored in the medium. By the above,
This means that the encryption means 8 in FIG. 1 can write the encrypted data 23 generated by encrypting the data using the data encryption key 6 to the medium 1.

Next, the procedure for creating the permission information having the configuration of FIG. 1 will be described in detail according to the order shown in the flowchart of FIG. FIG. 4 shows a license information creation flowchart of the present invention.

In FIG. 4, S21 retrieves the device ID on the data restoration side. This retrieves the device ID of the device that restores the data. In S22, the medium ID is taken out. This retrieves the unique medium ID 21 from the medium 1 to which the encrypted data is written.

In step S23, an individual key is created using both IDs. This is the device ID extracted in S21 and S22.
An individual key is created based on the medium ID taken out in step. S2
Reference numeral 4 encrypts the data encryption key with the individual key to generate the permission information.

In step S25, the medium is stored. In step S26, it is determined whether the number of device IDs has been repeated. If YES, the process ends. If NO, the process returns to S21 and is repeated.

As described above, the individual key generation means 5 in FIG. 1 generates an individual key from the device ID 4 on the restoration side and the unique medium ID read from the medium 1, and the encryption means 7 uses this individual key to encrypt data. This means that the key 6 can be encrypted and written in the medium 1 as the permission information 22.

Next, the procedure for decoding the data having the configuration of FIG. 1 will be described in detail according to the order shown in the flowchart of FIG. FIG. 5 shows a data decoding flowchart of the present invention.

In FIG. 5, S31 retrieves the device ID on the data restoration side. This retrieves the device ID of the device that restores the data. In S32, the medium ID is taken out. This retrieves the unique medium ID 21 from the medium 1 from which the encrypted data is to be read.

In step S33, an individual key is created by using both IDs. This is the device ID extracted in S31 and S32.
An individual key is created based on the medium ID taken out in step. S3
Reference numeral 4 decrypts the permission information on the medium using the individual key to generate a data decryption key.

In step S35, the encrypted data on the medium is decrypted using the data decryption key to generate the data. This is S
An individual key is generated from the device ID extracted from the device to be decrypted in 31 and the medium ID extracted from the medium in S32, and the license information on the medium 1 is decrypted using this individual key to generate a data encryption key. The encrypted data read from the medium 1 is decrypted by using this data encryption key to generate the original data.

In step S36, it is determined whether or not the process has ended. If YES, the process ends. If NO, the process returns to S34 and is repeated. As described above, the individual key generation unit 9 of FIG. 1 generates an individual key from the device ID of the restoration-side device and the medium ID read from the medium 1, and the decryption unit 10 reads from the medium 1 using this individual key. The license information is decrypted to generate a data decryption key (here, the same as the data encryption key 6), and the decryption means 12 uses this data decryption key to decrypt the encrypted data read from the medium 1 to restore the original data. It means that the data can be generated.

[0037]

As described above, according to the present invention,
A configuration is adopted in which the license information 22 and the encrypted data 23 encrypted by using the device ID, the medium ID, and the data encryption key are written in the medium 1 so that only the device having the device ID can decrypt the information. Therefore, even if the medium 1 or the restoration program is stolen, the encrypted data 23 cannot be restored, and the encrypted data on the medium can be protected.

[Brief description of the drawings]

FIG. 1 is a system configuration diagram of the present invention.

FIG. 2 is an example of medium information of the present invention.

FIG. 3 is an encrypted data creation flowchart of the present invention.

FIG. 4 is a flowchart for creating permission information according to the present invention.

FIG. 5 is a data decoding flowchart of the present invention.

[Explanation of symbols]

 1: Medium 2: Data creation source device 3: Data restoration side device 4: Device ID 5, 9: Individual key generation means 6: Data encryption key 7, 8: Encryption means 10, 12: Decryption means 11: Data decryption key

Claims (5)

[Claims] 1. A security system for protecting data on a medium, comprising: a portable medium in which a medium ID, permission information, and encrypted data are written, and the medium ID read from the medium when writing the data. And the license information encrypted from the device ID and the data encryption key of itself and the encrypted data obtained by encrypting the data with the data encryption key are written in the medium, and when the data is read, the medium ID and the license read from the medium are written. A security protection system comprising: a device for decrypting a data decryption key from information and its own device ID; and a device provided with means for decrypting encrypted data read from the medium using the decrypted data decryption key. . 2. A security system for protecting data on a medium, comprising: a portable medium in which a medium ID, license information, and encrypted data are written, and the medium ID read from the medium when writing the data. And the permission information in which the data encryption key is encrypted with the individual key generated from the device ID of itself and the encrypted data in which the data is encrypted with the data encryption key are written in the medium,
Medium I read from the above medium at the time of reading data
A means for decrypting the license information read from the medium with the individual key generated from D and its own device ID to generate a data decryption key, and decrypting the encrypted data read from the medium with the generated data decryption key is provided. A security system comprising a device. 3. The security system according to claim 1, wherein when there are a plurality of the devices, the license information is generated corresponding to the device ID of each device and written in the medium. . 4. The security system according to claim 1, wherein, when there are a plurality of encrypted data to be written in the medium, the license information is written in the medium for each encrypted data. 5. The apparatus ID is the apparatus ID of the computer apparatus itself or the apparatus ID of a portable medium access apparatus for reading / writing from / to the medium.
Security system described.