JP2009118257A - System for encryption processing and decoding processing - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve the problem that a heavy load, that is, the occurrence of binary data of encryption/decoding, is applied to a server when the number of client terminals is increased in a system that a conventional server partially takes over encryption and decoding, and also, to solve the problem that, in a security function substituting method, an additional exclusive server, which assumes encryption/decoding, other than a server and a client terminal is required, therefore, it causes an increase in costs when constructing a system and in management costs. <P>SOLUTION: An encryption/decoding processing system has the following configuration. An encryption program comprising a plurality of encryption means mounted to a client terminal is simplified. A server transmits an encryption-means execution command, which designates the encryption means to execute, to the client terminal. Further, in the client terminal, communication data are encrypted by the encryption-means execution command. Then, the encrypted communication data are transmitted to the server from the client terminal so as to decode them by the server. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a system for encryption processing and decryption processing related to communication data between a server and at least one client terminal, which is connected via a network and has a simple encryption program mounted thereon, and The present invention relates to an encryption process and a decryption process, a user authentication system, and a user authentication method thereof.

  For example, when data is transmitted / received between a server and a client terminal via the Internet, communication data is encrypted in order to maintain confidentiality of communication contents. Normally, in order to exchange encrypted communication data between a server and a client terminal, it is necessary to install a large encryption processing program on both the server and the client terminal. Therefore, in order for the encryption program to operate normally, a server and a client terminal having a central processing unit having a high calculation capability and a large-capacity storage device are required.

  On the other hand, for example, a small terminal such as a PDA (Personal Digital Assistance) or a mobile phone accesses a control unit having a server function installed in a house via the Internet to start lighting of a house, an air conditioner, etc. Systems that can collectively control and monitor residential equipment such as floor heating, water heaters, electric shutters, and electric locks have been developed and marketed. In the case of the system, the control unit is accessed via the Internet to control or monitor the housing equipment, so there is a risk of interception or impersonation of communication data exchanged between the control device and the small terminal. Therefore, it is necessary to encrypt the communication data or take security measures such as introducing a mutual authentication system between the control unit and the small terminal. Since the computing capacity of the computer mounted on the small terminal is low, it is difficult to install the encryption program and operate normally.

  In a system in which a client terminal and a server with low arithmetic processing capability are networked, a system is known that reduces the load associated with encryption of a client terminal with low arithmetic processing capability. For example, the server decrypts the encrypted binary data or the terminal device data necessary for encrypting the communication data based on an encryption key for encrypting the terminal device data connected via the network. The server generates generation of binary data for encryption or decryption that generates a large load, such as generating and generating decrypted binary data, then transmitting to the terminal device and encrypting or decrypting the data respectively. A system is known that reduces the load on the terminal device in the encryption and decryption processing by acting on behalf (see, for example, Patent Document 1).

Furthermore, a relay device is provided between a server and a client terminal that perform server-client type data communication using a security protocol, and transmission / reception data is sorted and transferred to the relay device with reference to a management table stored in advance. Demultiplexer, message interpreter for interpreting TLS message included in transmission / reception data, certificate check mechanism for confirming server certificate, certificate submission mechanism for submitting client certificate, encryption and decryption An encryption / decryption mechanism that performs encryption processing and a message shaping unit are known, and a relay device performs server authentication, client authentication, encryption, and decryption processing among security processing to be performed by the client. (For example, see Patent Document 2).
JP 2005-244661 A JP 2002-82907 A

  However, in order for encryption processing to be executed normally on the client terminal, a client terminal with high arithmetic processing capability is required, and the client terminal is expensive and requires a large number of units, so that the initial introduction cost is low. The problem of becoming expensive exists as a premise. In the conventional technology aiming to solve the above-mentioned problems, in a system where the server partially takes over encryption and decryption, when the number of client terminals increases, the generation of binary data for encryption and decryption is called There is a problem that a large load is applied to the server, and the security function proxy method requires a dedicated server for encryption / decryption in addition to the server and client terminal. There is a problem that the above cost increases.

  In view of the above situation, as a result of intensive studies to solve the problems related to conventional encryption, the client terminal and the encryption program installed in the server can be simplified, and further, the server to the client terminal In addition, it is necessary to install an encryption and decryption server by sending an encryption means execution command that designates the encryption means to be executed created by generating a random number and executing the encryption process. In addition, it is possible to solve the conventional problems such as encryption processing that imposes a burden on the server, and the lack of strength of the encryption processing of the client terminal by using the random number, The present invention has been completed by finding an encryption processing system that is simple and excellent in the strength of encryption, and compensates by making the probability of the same thing extremely low. .

That is, this invention relates to the invention described in the following (1)-(11).
(1) Encryption processing and decryption related to communication data between a server and at least one client terminal, which is connected via a network and includes a simple encryption program including a plurality of encryption means. System for processing,
Means for generating a random number when receiving a communication request from the client terminal, and generating an encryption means execution command for executing encryption of the data in the client terminal;
At the same time as transmitting the encryption means execution instruction, means for storing the encryption means execution instruction, and the encrypted communication data transmitted from the client terminal based on the stored encryption means execution instruction Means for decryption,
And means for transmitting a communication start request to the server,
Means for receiving the encryption means execution command transmitted from the server and executing only the encryption means specified by the encryption means execution command, and performing encryption processing of the communication data; and A system of encryption processing and decryption processing, comprising a client terminal comprising means for transmitting the converted communication data to the server.
(2) The number of the plurality of encryption means is the same as the number of digits of the encryption means execution command, and the plurality of encryption means is assigned to each digit of the encryption means execution command. (1) The encryption processing and decryption processing system according to (1). (3) The encryption processing and decryption processing system according to (1), wherein the communication data is user authentication data.
(4) The user authentication system, wherein the server further includes means for performing user authentication based on the decrypted user authentication data described in claim 1.
(5) Encryption processing and decryption related to communication data between a server and at least one client terminal, which is connected via a network and includes a simple encryption program having a plurality of encryption means. A method of crystallization processing,
The client terminal transmitting a communication start request to the server;
When the server receives a communication request from the client terminal, generating a communication data encryption means execution command executed by the client terminal by generating a random number;
Transmitting the encryption means execution instruction to the client terminal and simultaneously storing the encryption means execution instruction;
The client terminal receives the encryption means execution instruction, and executes only the encryption means specified by the encryption means execution instruction, thereby performing an encryption process of the communication data;
Transmitting the encrypted communication data to the server; and the server transmits the encrypted communication data transmitted from the client terminal to the server based on the stored encryption means execution command. Decrypting,
A method of encryption processing and decryption processing characterized by comprising:
(6) The number of the plurality of encryption means is the same as the number of digits of the encryption means execution command, and the plurality of encryption means is assigned to each digit of the encryption means execution command. (5) A method of encryption processing and decryption processing characterized by the above.
(7) The method of encryption processing and decryption processing according to (5), wherein the communication data is user authentication data.
(8) The user authentication method further comprising the step of performing user authentication based on the decrypted user authentication data described in claim 5.
(9) To cause the client terminal described in (1) to execute communication data encryption processing by executing only the encryption means specified in the encryption means execution command transmitted from the server described in (1). Program.
(10) The number of encryption means is the same as the number of digits of the encryption means execution command, and the plurality of encryption means are assigned to each digit of the encryption means execution command. The program according to (9), which is characterized.
(11) The user authentication method according to (5), wherein the user authentication method is a dynamic DNS (Domain Name System) user authentication method.

  The encryption processing and decryption processing system of the present invention can be applied to any system as long as it is a system composed of at least one client terminal and a server connected to a network such as the Internet. The client terminal with low arithmetic processing capability has a feature that encryption can be executed without imposing an excessive load. Therefore, considering the current situation where client terminals with low arithmetic processing capability are frequently used in many practical systems, the encryption processing and decryption processing systems of the present invention are industrially versatile. Therefore, it can be said that the invention has high practical value.

Next, the best mode for carrying out the present invention will be described with reference to the drawings. FIG. 1 is a schematic diagram showing a network system including a server 1 and at least one client terminal 2 to which an encryption processing and decryption processing system of the present invention is applied. Here, a simple encryption program of the present invention that is installed in advance in the server 1 and at least one client terminal 2 is, for example,
(A) Character shift in a specific pattern (for example, 1 character shift (example: a
To b)
(B) Replacing characters in a specific pattern (eg: converting a to z or b
converted to y))
(C) Replacing the character sequence in a specific pattern
(For example: replacement of the first character and the second character (eg: abc to bac
Conversion); replacement of the first to third characters and the fifth to seventh characters (example: abcdf)
g converted to defcabc))
(D) Capitalization of characters (example: aBcDe converted to ABCDE)
(E) Lower case letters (eg: aBcDe converted to abcde)
(F) Symbolization of characters (example: 123 is converted to "#")
(G) Adding invalid data (example: changing abcd to abcde123456)
Or (h) well-known encryption means such as hashing (e.g., MD5 hash calculation), or, for example, (b) is shifted by 2 characters or 3 characters, and (b) is replaced. Then, the encryption means obtained by changing the above-described known encryption means, such as converting a to e and b to f, is appropriately combined. The number of the encryption means constituting the encryption program is 1024 to 32 means, preferably 512 to 32 means, more preferably 128 to 32 means, and most preferably 64 to 32. Means. The encryption program is executed by assigning each encryption means to each digit of an encryption means execution command (random number) transmitted from the server 1. That is, the execution or non-execution of the encryption means is executed only by the encryption means assigned to the digit whose digit number of the encryption means execution command is “1”, and the digit number is In this method, the encryption means assigned to the digit “0” is not executed. Therefore, the encryption program includes the same number of encryption means as the number of digits of the encryption means execution command. Note that the decryption is executed by reversely executing the encryption process in the same manner by the encryption means used for the encryption.

  FIG. 2 is a block diagram of the server 1 used in the encryption processing and decryption processing system of the present invention. That is, the server 1 used in the encryption processing and decryption processing system of the present invention includes a display unit 11, a control unit 12, a transmission / reception unit 13, a decryption processing unit 14, client terminal authentication data 15, and encryption means storage. Unit 16, encryption means execution command generation unit 17, and encryption means execution command storage unit 18.

  FIG. 3 is a block diagram of the client terminal 2 used in the encryption processing and decryption processing system of the present invention. That is, the client terminal 2 used in the encryption processing and decryption processing system of the present invention includes a display unit 21, a control unit 22, a transmission / reception unit 23, a client terminal 24, and an encryption means storage unit 25.

  FIG. 4 is a flowchart relating to the encryption processing and decryption processing system of the present invention. That is, the server 1 stands by until a communication request from the client terminal 2 such as a communication start request of a communication protocol to be used (for example, TCP / IP protocol) is received. (Step 1)

  Next, when the server 1 receives a communication request from the client terminal 2, the encryption means execution command generation unit 17 generates a random number to instruct execution of the encryption means in the client terminal 2. Is created (step 2). The encryption means execution command referred to here is the generated random number. For example, in the case of 8 bits, if the generated random number is 00100111, for example, “00100111” is created as the encryption means execution command.

  Next, the server 1 transmits the encryption means execution command created in step 2 from the transmission / reception unit 13 to the client terminal 2 via the network 3. At the same time, the server 1 stores the transmitted encryption means execution command in the encryption means execution command storage unit 18 (step 3).

  When the client terminal 2 receives the encryption means execution command transmitted from the server 1, the client terminal 2 executes the encryption means specified by the encryption means execution command, and sends the server 1 via the network 3 from the transmission unit 23. The encrypted communication data is transmitted to (step 4). The execution of the encryption means based on the encryption means command here is, for example, assigned to the digit “1” when the encryption means execution command exemplified in the above 8-bit example is “00100111”. Only the encryption means is executed by the client terminal 2, and the communication data is encrypted.

  When the transmission / reception unit 13 receives the encrypted communication data, the server 1 stores the encryption unit execution command stored in the encryption unit execution command storage unit 18 and the encryption unit storage unit 16 in step 3. The encrypted communication data is decrypted by the decryption processing unit 14 by the encrypted program of the present invention (step 5).

  If the decrypted communication data is authentication data consisting of, for example, an ID and a password, the server 1 checks the data stored in the client terminal authentication data storage unit 15 and if it matches, the client 1 Communication is started between the terminal 2 and the server 1. On the other hand, if they do not match, the process returns to the communication request wait (step 6).

  As described above, the encryption processing and decryption processing system of the present invention can be encrypted by the client terminal 2 having a low arithmetic processing capability because the encryption program is simple. The strength of the encryption process is not high. However, since the encryption means execution command from the server 1 is based on a random number, the possibility that the same encryption means execution command is transmitted is very low, so even if the communication between the client terminal 2 and the server 1 is the third Even if intercepted by a person, it is difficult to decipher the cipher because of almost different encryption commands.

  The reason for this will be described. As shown in Table 1, when the server 1 communicates over 10 years using 1000 client terminals 2, the total number of communications is one per minute. In the case of communication frequency, it is about 60 billion times, and in the case of communication frequency once in 5 minutes, it is about 11 billion times. On the other hand, as shown in Table 2, for example, if 48 or more encryption means are set, the approximate number of encryption means execution instructions generated by random numbers is calculated to be about 281 trillion times or more. Therefore, even if 1000 client terminals and servers communicate for 10 years, the probability that the same encryption means execution command is generated is extremely low.

  From the above, since the encryption processing and decryption processing system of the present invention is encryption processing by a simple encryption program, there is a possibility that the strength of encryption is insufficient. In this regard, the same can be supplemented by an encryption means execution command that is very unlikely to be transmitted from the server 1.

  A preferred application of the encryption processing and decryption processing system of the present invention is authentication of a client terminal such as a dynamic DNS (Domain Name System), for example.

  In a system including a server and a client terminal connected via a network by an encryption processing and decryption processing system of the present invention, not only a client terminal having a high arithmetic processing capability but also a client terminal having a low arithmetic processing capability Since the encryption processing and the decryption processing are possible, the encryption processing and the decryption processing system of the present invention have so far been unable to encrypt the communication data because of the arithmetic processing capability of the client terminal. The safety of communication data can be improved in this system.

FIG. 1 is a schematic diagram showing a network system including a server 1 and at least one client terminal 2 to which an encryption processing and decryption processing system of the present invention is applied. FIG. 2 is a block diagram of the server 1 used in the encryption processing and decryption processing system of the present invention. FIG. 3 is a block diagram of the client terminal 2 used in the encryption processing and decryption processing system of the present invention. FIG. 4 is a flowchart relating to the encryption processing and decryption processing system of the present invention.

Explanation of symbols

1: Server 2: Client terminal 3: Network 11: Display unit 12: Control unit 13: Transmission / reception unit 14: Decryption processing unit 15: Client terminal authentication data storage unit 16: Encryption unit storage unit 17: Encryption unit execution command Generation unit 18: Encryption means execution command storage unit 21: Display unit 22: Control unit 23: Transmission / reception unit 24: Client terminal authentication data storage unit 25: Encryption unit storage unit

Claims (11)

An encryption process and a decryption process related to communication data between a server and at least one client terminal, which are connected via a network and have a simple encryption program equipped with a plurality of encryption means. A system,
Means for generating a random number when receiving a communication request from the client terminal, and generating an encryption means execution command for executing encryption of the data in the client terminal;
At the same time as transmitting the encryption means execution instruction, means for storing the encryption means execution instruction, and the encrypted communication data transmitted from the client terminal based on the stored encryption means execution instruction Means for decryption,
And means for transmitting a communication start request to the server,
Means for receiving the encryption means execution command transmitted from the server and executing only the encryption means specified by the encryption means execution command, and performing encryption processing of the communication data; and A system of encryption processing and decryption processing, comprising a client terminal comprising means for transmitting the converted communication data to the server.   The number of the plurality of encryption means is the same as the number of digits of the encryption means execution command, and the plurality of encryption means is assigned to each digit of the encryption means execution command. The system for encryption processing and decryption processing according to claim 1   The system for encryption processing and decryption processing according to claim 1, wherein the communication data is user authentication data.   The user authentication system according to claim 1, further comprising means for performing user authentication based on the decrypted user authentication data described in claim 1. An encryption process and a decryption process related to communication data between a server and at least one client terminal, which are connected via a network and have a simple encryption program equipped with a plurality of encryption means. A method,
The client terminal transmitting a communication start request to the server;
The server generates a communication data encryption means execution command executed by the client terminal by generating a random number in response to a communication request from the client terminal;
Transmitting the encryption means execution instruction to the client terminal and simultaneously storing the encryption means execution instruction;
The client terminal receives the encryption means execution instruction, and executes only the encryption means specified by the encryption means execution instruction, thereby performing an encryption process of the communication data;
Transmitting the encrypted communication data to the server; and the server transmits the encrypted communication data transmitted from the client terminal to the server based on the stored encryption means execution command. Decrypting,
A method of encryption processing and decryption processing characterized by comprising:   The number of the plurality of encryption means is the same as the number of digits of the encryption means execution command, and the plurality of encryption means is assigned to each digit of the encryption means execution command. The method for encryption processing and decryption processing according to claim 5.   6. The encryption processing and decryption processing method according to claim 5, wherein the communication data is user authentication data.   The user authentication method further comprising the step of performing user authentication based on the decrypted user authentication data according to claim 5.   A program for causing a client terminal according to claim 1 to execute encryption processing of communication data by executing only the encryption means specified by the encryption means execution command transmitted from the server according to claim 1. The number of the plurality of encryption means is the same as the number of digits of the encryption means execution command, and the plurality of encryption means is assigned to each digit of the encryption means execution command. The program according to claim 9.   6. The user authentication method according to claim 5, wherein the user authentication method is a dynamic DNS (Domain Name System) user authentication method.

Images