JP2004180318A - Data encryption or decryption method and data encryption or decryption device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a data encryption and decryption method and apparatus. <P>SOLUTION: An encryption algorithm module combination is selected from a plurality of encryption algorithm module combinations predetermined by the user in cooperation with the data attribute matching and a dynamic selection mechanism to perform encryption of data. The encryption of data through such alternate use of different encryption algorithm module combinations not only enhances the complexity in decryption of the data, the processing speed is not sacrificed due to use of relatively complicated encryption algorithms to ensure security. Furthermore, data are decrypted using decryption algorithm module combinations that are dynamically switched according to decryption information appended to the ciphertext. <P>COPYRIGHT: (C)2004,JPO

Description

  The present invention integrates data encryption and decryption by matching data attributes and by alternately using different encryption algorithm modules in combination by a dynamic selection mechanism in data encryption, and A method and apparatus for encrypting and decrypting data that achieves sufficient data security and protection while guaranteeing speed.

  With the spread of the Internet, many companies are using the Internet to communicate with subordinate companies located in different locations. To protect sensitive data from being stolen or altered by hackers during data transmission over the network, the data is encrypted using an encryption algorithm associated with the key, prohibiting unauthorized access to the data and transferring the data. The confidentiality is guaranteed. Also, a hash function is used to authenticate the data, guaranteeing the validity of the data. Many products are currently available, such as CISCO routers. CISCO routers use security architecture technology over RFC 2401 IP to protect data during network transmission.

  In encryption algorithms, data is converted into a form that is invisible to humans. The recipient of the data must decrypt the data before it can read it. Even if the ciphertext is intercepted during transmission, if the intercepting party does not have a key to decrypt the data, the data is simply garbage data. Commonly used encryption algorithms include DES, RSA, 3DES, FEAL, IDEA, and the like.

  The authentication algorithm converts the data to a fixed length value. It is impossible to obtain the original data from this value by an inverse algorithm. Authentication algorithms are primarily used to ensure the identity of the sender and the recipient, and to verify that the data itself is valid. For example, transferring the data itself to a hash function for processing may result in a checksum transmitted with the data. The receiving side can verify the data itself using the checksum to know if the data itself has been modified. Common authentication algorithms include N-HASH, MD5, SHA1, MD4, MD2, and the like.

  Packets are a type of data format. All data transmitted or received over the network is converted to a packet format. Prior to data transmission, the data is split into packets, and the packets are recombined upon receipt of the data to form the original data. If an error occurs during packet transmission, the receiver may request retransmission of the erroneous packet to effectively reduce the overall transmission time. Even if the packets are stolen, the original complete data cannot be accessed unless all the packets are stolen.

  CISCO routers use "IP Security Protocol" technology to ensure data security during network transmission. FIGS. 5 and 6 are block diagrams showing a data encryption and decryption processing device employed therein. As shown in FIG. 5, reference numeral 50 denotes a data input unit for inputting an original text (plaintext), and reference numeral 51 denotes an encryption unit for executing a packet encryption process according to an encryption algorithm determined by a user. Reference numeral 52 denotes an authentication unit that executes a packet authentication process according to an authentication algorithm determined by the user. Reference numeral 53 denotes a data output unit that outputs a cipher text to a memory or another storage device. In FIG. 6, reference numeral 60 denotes an input unit for inputting a ciphertext. Reference numeral 61 denotes an authentication unit that executes a packet authentication process according to an authentication algorithm determined by the user. Reference numeral 62 denotes a decryption unit that performs a packet decryption process according to a decryption algorithm determined by the user. A data output unit 63 outputs the original text to a memory or another storage device.

  In the data encryption device, the original text is input via the data input unit 50. After that, the encryption unit 51 performs data encryption according to the encryption algorithm and the key determined previously. Next, in the authentication unit 52, data authentication is performed in accordance with the previously determined authentication algorithm. Finally, the ciphertext is output via the data output unit 53 for use.

  At the data decryption device end, the ciphertext is input via the data input unit 60. Thereafter, the authentication unit 61 performs data authentication according to the authentication algorithm determined previously. Then, the decryption unit 62 decrypts the data according to the previously determined decryption algorithm and key. Finally, the original is sent to data output 63 for use.

  In the above processing device for transmission and reception on the Internet, encryption and authentication algorithms are used to provide data validity and data confidentiality services. Therefore, when the 3DES algorithm is used for data encryption and the SHA1 algorithm is used for data authentication, the processing speed decreases. However, when the DES algorithm is used to encrypt data and the MD5 algorithm is used to authenticate data to improve processing speed, the security level of data confidentiality and data validity is greatly reduced. . Therefore, how to find the balance between security level and processing speed is an important issue in the field.

In order to solve the above problems, in one embodiment of the present invention, a data encryption method includes:
Step A of constructing a security class database storing a plurality of data record entries, each record entry including a data attribute description field and a corresponding encryption definition field, wherein the encryption definition field includes a plurality of encryption algorithm module indicators. And
Step B of inputting digital data to be encrypted;
Searching the security class database for a data attribute description that matches the attribute of the digital data and extracting the corresponding encryption definition data;
A step D of randomly selecting one encryption algorithm module indicator from the extracted encryption definition data;
Using the selected encryption algorithm module indicator as a criterion, controlling an encryption process of the input data; and
Adding decryption information to the encrypted digital data and outputting it.

A data encryption method according to another aspect of the present invention includes:
Step A of building an encryption module database that stores a plurality of data record entries;
Each record entry includes an encryption algorithm module indicator and an authentication algorithm module indicator,
Step B of building a security class database that stores a plurality of data record entries;
Each record entry includes a data attribute description field and a corresponding encryption definition field, wherein the encryption definition field includes a plurality of encryption module database indexes.
Step C of inputting digital data to be encrypted;
Searching the security class database for a data attribute description that matches the attribute of the digital data and extracting the corresponding cryptographic definition data;
A step E of randomly selecting one encryption module database index from the extracted encryption definition data;
Selecting a record entry from the encryption module database according to the selected encryption module database index, F;
Using the entry of the selected record as a criterion, controlling the encryption process of the input digital data, including the type of encryption and the type of authentication; and
Adding decryption information to the encrypted digital data and outputting it.

A data encryption method according to still another aspect of the present invention includes:
Constructing cryptographic definition data including a plurality of cryptographic algorithm module indicators;
Step B of inputting digital data to be encrypted;
(C) randomly selecting one encryption algorithm module indicator from the encryption definition data;
Using the selected encryption algorithm module indicator as a criterion, controlling the encryption process of the input digital data; D.
Adding decryption information to the encrypted digital data and outputting the digital data.

A data encryption method according to still another aspect of the present invention includes:
Step A of building an encryption module database that stores a plurality of data record entries;
Each record entry includes an encryption algorithm module indicator and an authentication algorithm module indicator,
Building B cryptographic definition data including a plurality of cryptographic module database indexes;
Step C of inputting digital data to be encrypted;
(C) randomly selecting one cryptographic module database index from the cryptographic definition data;
A step E of selecting an entry of one record from the encryption module database according to the selected encryption module database index;
Using the entry of the selected record as a criterion, controlling the encryption processing of the input digital data, including the type of encryption and the type of authentication;
Adding decryption information to the encrypted digital data and outputting it.

A data encryption method according to still another aspect of the present invention includes:
Step A of building a security class database that stores a plurality of data record entries;
Each record entry includes a data attribute description field and a corresponding encryption definition field, wherein the encryption definition data field is an encryption algorithm module indicator;
Step B of inputting digital data to be encrypted;
Finding, from the security class database, a data attribute description that matches an attribute of the digital data, and extracting an encryption algorithm module indicator of a corresponding encryption definition field;
Using the retrieved encryption algorithm module indicator as a criterion, controlling the encryption of the input digital data; D.
Adding decryption information to the encrypted digital data and outputting the digital data.

A data encryption method according to still another aspect of the present invention includes:
Step A of building an encryption module database that stores a plurality of data record entries;
Each record entry includes an encryption algorithm module indicator and an authentication algorithm module indicator,
Step B of building a security class database that stores a plurality of data record entries;
Each record entry includes a data attribute description field and a corresponding encryption definition field, wherein the encryption definition field includes a plurality of encryption module database indexes.
Step C of inputting digital data to be encrypted;
Searching the security class database for a data attribute description that matches the attribute of the digital data, and extracting an encryption module database index from the corresponding encryption definition field;
Using the retrieved cryptographic module database index as a criterion, selecting an entry for one record from the cryptographic module database;
Using the entry of the selected record as a criterion, controlling the encryption processing of the input data, including the type of encryption and the type of authentication, and F;
Adding decryption information to the encrypted digital data and outputting it.

A data encryption device according to one aspect of the present invention is a data encryption device including an input unit that inputs data, and an output unit that outputs data after data encryption processing.
A security class database that stores a plurality of data record entries,
Each record entry includes a data attribute description field and a corresponding encryption definition field, the encryption definition field including a plurality of encryption algorithm module indicators,
A verification unit that verifies data input through the input unit, and separates the data into parameter data or digital data.
A parameter processing unit that updates the security class database with parameter data sent from the verification unit,
From the security class database, an attribute verification unit that searches for a data attribute description that matches the attribute of the digital data sent from the verification unit, and transmits the corresponding encryption definition data to the encryption selection unit,
The encryption selecting unit randomly selects one encryption algorithm module indicator from the searched encryption definition data,
And an encryption processing unit that controls encryption processing of the input data using the encryption algorithm module indicator selected by the encryption selection unit as a reference.

A data encryption device according to another aspect of the present invention is a data encryption device including an input unit that inputs data, and an output unit that outputs data after data encryption processing.
An encryption module database that stores a plurality of data record entries;
Each record entry contains an encryption algorithm module indicator,
A verification unit that verifies data input through the input unit, and separates the data into parameter data or digital data.
A parameter processing unit that updates the encryption module database using parameter data from the verification unit;
An encryption selection unit that randomly selects one record entry from the encryption module database;
An encryption processing unit that controls an encryption process of the input digital data using an entry of a record selected by the encryption selection unit as a reference.

A data encryption device according to another aspect of the present invention is a data encryption device including an input unit that inputs data, and an output unit that outputs data after data encryption processing.
A security class database that stores a plurality of data record entries,
Each record entry includes a data attribute description field and a corresponding encryption definition field, wherein the encryption definition field is an encryption algorithm module indicator;
A verification unit that verifies data input through the input unit, and separates the data into parameter data or digital data.
A parameter processing unit that updates the security class database with parameter data from the verification unit,
An attribute verification unit that searches the security class database for a data attribute description that matches the attribute of the digital data transmitted from the verification unit, and transmits the corresponding cryptographic definition data to a cryptographic processing unit. The encryption processing unit controls the encryption processing of the input digital data using the encryption algorithm module indicator selected by the attribute verification unit as a criterion.

A data decryption method according to one aspect of the present invention includes:
Step A of inputting digital data to be decrypted;
Verifying whether the digital data includes a decryption algorithm module indicator, and if so, detecting the decryption algorithm module indicator; if not, processing the data to be decrypted in a later step D A step B for setting the input data equivalent to the input data;
Using the retrieved decryption algorithm module indicator as a criterion to control decryption processing of the input digital data;
Outputting the decrypted digital data.

According to another aspect of the present invention, there is provided a data decryption method.
Step A of building a decryption module database that stores a plurality of data record entries;
Each record entry is a decryption algorithm module indicator,
Inputting digital data to be decrypted, step B;
Verify whether the digital data includes a decryption module database index, and if so, search the decryption module database index; otherwise, retrieve the data to be decrypted for processing in step F below. A step C for setting the input data equal to the input data;
Selecting a record entry from the decryption module database using the retrieved decryption module database index as a criterion;
Using the entries of the selected record as a criterion, controlling the decoding process of the input digital data;
Outputting the decrypted digital data.

A data decryption device according to one aspect of the present invention is a data decryption device including an input unit that inputs data, and an output unit that outputs data after decryption processing,
Verify whether the data input through the input unit includes a decryption algorithm module indicator, if so, take out the decryption algorithm module indicator, if not, the input data directly to the output unit A verification unit to transmit;
A decryption processing unit that controls decryption processing of the input digital data using a decryption algorithm module indicator extracted by the verification unit.

  According to the configuration of the data encryption device of the present invention, the user inputs data via the input unit. The verification unit verifies the input data and separates the input data into parameter data or data to be encrypted. In the case of parameter data, it is sent to a parameter processing unit that updates the security database or the encryption module database. If the data is encrypted, it is sent to the attribute verification unit. The attribute verifying unit searches the security database for a data attribute description that matches the attribute of the input data, extracts encryption definition data, and transmits it to the encryption selection unit. The encryption selection unit dynamically selects one encryption module database index from the encryption definition data, extracts one entry of the encryption module combination record from the encryption module database based on the dynamically selected encryption module database index, and sends the entry to the encryption processing unit. Send. The encryption processing unit controls the encryption processing of the input data to be encrypted, including the type of encryption and the type of authentication, based on the combination of the encryption modules transmitted by the encryption processing unit. The converted input data is output after the decoding information is added by the output unit.

  Further, the present invention provides a user with a data decryption device. According to the data decoding device of the present invention, the user inputs data through the input unit. The verification unit verifies the input data and separates the input data into parameter data or digital data to be decoded. In the case of parameter data, it is sent to a parameter processing unit that updates the decryption module database. In the case of data to be decrypted, it is determined whether or not there is decryption information. If there is decryption information, the decryption module database index is retrieved from the decryption information, and based on that, one entry of the decryption module combination record is retrieved from the decryption module database and sent to the decryption processing unit for processing. Otherwise, the input data is sent to the output for processing. The decryption processing unit controls decryption processing of input data to be decrypted, including the type of decryption and the type of authentication, according to the transmitted decryption module combination record. Finally, the data is output via the output.

  FIG. 1 is a block diagram of a data decoding apparatus according to a preferred embodiment of the present invention. In FIG. 1, reference numeral 109 denotes a security class database that stores a plurality of entries of a data record. Each record entry includes a data attribute description and corresponding cryptographic definition data. The data attribute description occupies 24 bytes, and the encryption definition data occupies 8 bytes. FIG. 7 is a diagram showing those structures. The data attribute description is provided for the purpose of comparing the attributes of the input packet data, and includes a logical operator and a conditional expression. Their total length must not exceed 24 bytes. If it is smaller than 24 bytes, the end value FF must be added to the end of the attribute description data as the end. The description of the command related to the data attribute description is shown in FIG. Cryptographic definition data is provided for dynamic selection of a cryptographic algorithm module, which consists of four sets of data. Each set of data includes a one-byte encryption algorithm module index and a one-byte ratio determined thereby. If the encryption definition data is less than four sets, FF is added at the end. FIG. 9 is a diagram showing the configuration.

  Reference numeral 111 denotes an encryption module database. The encryption module database stores data relating to various combinations of an encryption algorithm, an authentication algorithm, and an integrated authentication algorithm for encrypting input data. FIG. 10 shows the structure of the encryption module database. Each combination is represented by one record. Each record entry includes a data encryption algorithm indicator, a data authentication algorithm indicator, and an integrated authentication algorithm indicator. Each indicator, that is, the address of the algorithm program is composed of 4 bytes.

The content of the data encryption algorithm indicator is
DES encryption algorithm indicator,
3DES encryption algorithm indicator,
RSA encryption algorithm indicator,
RC4 encryption algorithm indicator,
FEAL encryption algorithm indicator,
It may be an IDEA encryption algorithm indicator, or a TWOFISH encryption algorithm indicator.

The contents of the data authentication algorithm indicator and the integrated authentication algorithm indicator are as follows:
MD5 authentication algorithm indicator,
It may be a SHA1 authentication algorithm indicator, or an N-HASH authentication algorithm indicator.

  The preferred embodiment is illustrated using seven encryption algorithms and three authentication algorithms. It allows for situations that do not require encryption or authentication. The encryption module database can store entries of up to 128 (= (7 + 1) × (3 + 1) × (3 + 1)) records.

  110 indicates a buffer area. The buffer area stores the sequence data generated by the encryption selection unit, the data related to the encryption module algorithm stored by the parameter verification unit, and the temporary data required by the data attribute verification unit and the encryption control unit during processing. The temporarily stored data is temporarily stored.

100 indicates an input unit. The input unit is constituted by a keyboard or any input device capable of inputting normal encrypted data and parameter data.
Reference numeral 101 denotes a verification unit that verifies input data. The input data, if it is parameter data, is sent to a parameter processing unit for processing or is sent to an attribute verification unit for processing.

  Reference numeral 102 denotes an attribute verification unit. The attribute verification unit finds a data attribute that is stored in the data attribute description field from the security class database 109 and matches the attribute of the input data, sends the corresponding encryption definition data to the encryption selection unit, and sends an index to the encryption module database. And transmits the index together with the input data to the encryption control unit for processing.

  Reference numeral 103 denotes an encryption selection unit. The encryption selection unit generates a series of corresponding numbers of indices in the data buffer area 110 according to the ratios according to each of the indexes of the cryptographic module database in the encryption definition data and the ratio employed thereby. The random number generator generates a value and performs a MOD operation using the sum of the ratios employed by the module as a reference to obtain a remainder. It is used as an index to search the cryptographic module database index from a previously generated sequence. The result and the data to be encrypted are then transmitted to the encryption processing unit.

  104 is an encryption control unit. The encryption control unit obtains the data encryption algorithm indicator, the data authentication algorithm indicator, and the integrated authentication algorithm indicator according to the encryption module database index, and encrypts the input data according to the algorithm module indicated by each indicator. Perform processing.

Reference numeral 105 denotes an encryption unit. The encryption unit performs an encryption process on the input data according to the encryption algorithm indicator and related data required thereby, and transmits the result to the encryption control unit.
106 is an authentication unit. The authentication unit performs an authentication process on the input data according to the authentication algorithm indicator and the related data required for the authentication algorithm indicator, and transmits the result to the encryption control unit.

  An output unit 107 adds the description information to the encrypted text and transmits it to a memory device or any other output device.

  Reference numeral 108 denotes a parameter processing unit that checks parameter data input via the verification unit. If the parameter is a cryptographic algorithm module parameter, that parameter is used to update the cryptographic algorithm module database. When the parameter is a security class data parameter, that parameter is used to update the security class database. In either case, no error code is sent.

  FIG. 3 is a processing flowchart of a data encryption operation in the preferred embodiment of the data encryption device according to the present invention. In the block diagram of FIG. 1, when the verification unit 101 determines that the input data is data to be encrypted, the attribute verification unit 102 starts operating. In FIG. 3, the input data is stored in step S301. Thereafter, the flow proceeds to the attribute verification unit 102, and finds encryption definition data in which the attribute and the data correspond. First, in step S302, an entry of security definition data is read. Next, in step S303, it is determined whether the data attribute description field is blank. If blank, this indicates that it is the predetermined security class data, and the flow proceeds directly to step S306. Otherwise, the content of the input data is verified according to the data in the data attribute description field. In step S304, it is determined whether the data attributes match. If they match, the flow proceeds to step S306. Otherwise, the flow returns to step S302. In step S306, the encryption selection unit 103 dynamically selects a combination of encryption algorithm modules. First, in step S306, it is determined whether or not the encryption definition data includes only one combination of encryption algorithm module data. If only one is included, this indicates that no dynamic selection needs to be performed, and the flow proceeds to step S307, where one module combination to be used is set. Then, the process proceeds to S309. If there is not only one, the process proceeds to S308, and a sequence is generated according to the ratio adopted by each module. A random number generator is used to generate further values, and the MOD operation is performed using the sum of the ratios employed by the module as a reference to obtain a remainder. The remainder serves as an index to obtain the combination of encryption algorithm modules in the data of the previous sequence. Thereafter, the flow proceeds to S309. In step S309, the encryption processing unit 104 starts the data encryption processing. First, in S309, each of the module indicators is searched according to the combination of the encryption algorithm modules. Next, in S310, it is determined whether or not the data encryption algorithm module indicator is 0. If 0, this indicates that the encryption process is not performed, and the flow proceeds to step S312. Otherwise, the flow proceeds to S311 where the encryption indicator and the parameters required by the indicator are processed and encrypted by the encryption unit 105 together with the input data, and the result of the encryption is obtained. Next, the flow proceeds to step S312. In step S312, it is determined whether the data authentication algorithm indicator is 0. If 0, this indicates that the authentication process should not be performed, and the flow proceeds to S314. Otherwise, the flow proceeds to step S313, where the authentication indicator and the parameters required thereby are processed and authenticated by the authentication unit 106 together with the processed result data just processed, and an authentication result is obtained. Thereafter, the flow proceeds to step S314. In step S314, it is determined whether or not the integrated authentication algorithm indicator is 0. If it is 0, this indicates that the integrated authentication processing is not executed, and the flow proceeds to step S316. Otherwise, the flow proceeds to S315, where the authentication indicator and the parameters required by the indicator are processed and authenticated by the authentication unit 106 together with the processing result data and the header data just processed, and an authentication result is obtained. The flow then proceeds to S316, where the decryption information is added to the ciphertext and output to a memory device or any other device.

  FIG. 12 is a diagram illustrating the structure of input packet data in a preferred embodiment of the data encryption device according to the present invention. In the figure, input data is an IP packet for Internet communication, and includes an IP header and transmitted data. In the header data, VERS indicates a version used by the IP packet, and its size is 4 bits. HLEN represents the IP packet header length measured in 32-bit words and its size is 4 bits. SERVICE TYPE indicates a service format of an IP packet, and its size is 8 bits. TOTAL LENGTH indicates the total length and size of the IP packet, and its size is 16 bits. IDENTIFICATION represents identification data of an IP packet, and its size is 16 bits. FLAGS represents flag data of an IP packet, and its size is 4 bits. FLAGMENT OFFSET represents the transition address of the data of the IP packet, and its size is 12 bits. TIME TO LIVE represents the longest time for Internet transmission of an IP packet, its unit is seconds, and its size is 8 bits. PROTOCOL represents the value of the communication protocol in the IP packet data field, and has a size of 8 bits. HEADER CHECKSUM represents checksum data of a header of an IP packet, and has a size of 16 bits. SOURCE IP ADDRESS represents a source IP address of an IP packet, and has a size of 32 bits. DESTINATION IP ADDRESS indicates a destination IP address of an IP packet, and has a size of 32 bits. IP OPTIONS represents additional data of an IP packet header, and has a maximum size of 40 bits. PADDING compensates for the header length of the IP packet by a multiple of 4 bytes.

FIG. 13 is a diagram illustrating the configuration of output data according to a preferred embodiment of the data encryption device of the present invention. The output data is composed of an IP header, decryption information and ciphertext.
Hereinafter, an example of processing according to a preferred embodiment of the data encryption device of the present invention will be described. FIG. 14 illustrates an example of data processed by a preferred embodiment of the data encryption device of the present invention. In FIG. 14, reference numeral 14b denotes data in the security class database at the start of the encryption operation flow in this processing example. 14c shows the data of the encryption module database at the start of the encryption operation flow in this processing example. 14a shows input data at the start of the encryption process in this processing example. In FIG. 3, after the input data (as shown at 14a) is received in step S301, the data of the first entry is read from the data in the security class database in step S302. The first 14 bytes of the data attribute description data are “01 04 18 C0A800000 05 18 AC100000 FF”. The last 10 bytes are all "FF". The encryption definition data is “01 03 02 03 03 01 04 01”. In step S303, the data attribute description data is not blank. Thereafter, the flow directly proceeds to S304. In step S304, first, the data attribute description data is interpreted according to the data attribute description command description table shown in FIG. 8, whereby the value of the first 24 bits of both the transmission source IP address and the C0A80000 in the input packet data is obtained. And the first 24 bits of both the destination IP address and AC100000 match, the input packet data is considered to be true. Otherwise, the incoming packet data is considered false. Thereafter, based on the contents of the input data (as shown in 14a), the source IP address and the first 24 bits of C0A80001 match, and the destination IP address AC100001 and the first 24 bits of AC100000 match. You can see that Therefore, a data attribute match is set. In step S305, if the result obtained in step S304 is a match of the data attributes, the flow directly proceeds to step S306. In step S306, the encryption definition data is verified, and it is determined whether there is only one data entry. Because the data is 01 03 02 03 03 01 04 01, there is not a single entry for only one encryption algorithm module combination. Therefore, the flow proceeds to step S308. In step S308, a continuous sequence 01 01 01 02 02 02 02 including three 01, three 02, one 03, and one 04 according to the current cryptographic definition data and the cryptographic module database index in the ratio adopted thereby. 03 04 is generated. The total length is the sum of the ratios used. A random number generator is used to generate a value of 5318659. This value is used in the MOD8 operation to get 3. This value corresponds to the sequence value 02. Therefore, the selected encryption module database index is 02. Next, the flow proceeds to step S309. In step S309, the available encryption algorithm module for the value 02 of the encryption module database index is searched from the encryption module database data (shown at 14c). They are the DES encryption algorithm indicator for the data encryption algorithm indicator, the SHA1 authentication algorithm indicator for the data authentication algorithm, and the MD5 authentication algorithm indicator for the integrated authentication algorithm indicator, respectively. Thereafter, the flow proceeds to step S310. In step S310, since the data encryption algorithm indicator is the DES encryption algorithm indicator and is not 0, the flow proceeds to step S311. In step S311, the DES encryption algorithm index and the data field data (as shown at 14a) of the input data are transmitted to the encryption unit for encryption processing. Thereafter, the flow proceeds to step S312. In step S312, since the data authentication algorithm indicator is the SHA1 authentication algorithm indicator and is not 0, the flow proceeds to step S313. In step S313, the SHA1 authentication algorithm indicator and the result of the encryption processing obtained in step S311 are transmitted to the authentication unit for data authentication processing. Next, the flow proceeds to step S314. In step S314, since the integrated authentication algorithm indicator is the MD5 authentication algorithm indicator and is not 0, the flow proceeds to step S315. In step S315, the MD5 authentication algorithm indicator, the header field data of the input data (as shown at 14a), and the result of the authentication process obtained in step S313 are transmitted to the authentication unit for the integrated authentication process. The flow then proceeds to step S316. In step S316, the decryption information label and the decryption module database index value 02 are added to the processing result obtained in step S315, and output to another device as output data (as shown in 14d). In FIG. 14, reference numeral 14d denotes output data obtained at the end of the flow of the encryption process in this example. The decryption information data includes two of a decryption information label and a decryption module database index value.

FIG. 16 is a block diagram of another preferred embodiment of the data encryption device according to the present invention. As shown in FIG. 16, the security class database 109 and the attribute verification unit 102 in the example shown in FIG. 1 are not necessary. Reference numeral 108 denotes a parameter processing unit that verifies the parameter data input from the verification unit. If the parameter flag field is an encryption algorithm module parameter flag, according to the encryption algorithm module identification code in its data field, the encryption algorithm module parameter is a parameter data storage address corresponding to the encryption algorithm module, and It is stored in the buffer area 110. The encryption selector 103 dynamically selects a combination of encryption algorithm modules directly using the encryption definition data stored in the data buffer area 110.
FIG. 17 is a block diagram of still another preferred embodiment of the data encryption device according to the present invention. As shown in FIG. 17, the encryption selecting unit 103 in the example shown in FIG. 1 is not necessary. The encryption definition data of the security class database 109 stores data of only one combination of encryption algorithm modules. Further, the attribute verification unit 102 directly transmits the encryption algorithm module combination data stored in the encryption definition data in which the input data and the attribute description data match with the input data to the encryption processing unit 104 for processing.

  FIG. 2 is a block diagram of a preferred embodiment of the data decryption device according to the present invention.

In FIG. 2, reference numeral 208 denotes a decryption module database. The decryption module database stores data relating to various combinations of decryption algorithms, authentication algorithms, and integrated authentication algorithms used in performing decryption of input data. FIG. 11 is a diagram showing the structure of the decryption module database. Each combination is represented for each record. Each record entry includes a data description algorithm indicator, a data authentication algorithm indicator, and an integrated authentication algorithm indicator. Each indicator, that is, the address of the algorithm program, is composed of 4 bytes. The contents of the data description algorithm indicator are:
DES decryption algorithm indicator,
3DES decryption algorithm indicator,
RSA decryption algorithm indicator,
RC4 decryption algorithm indicator,
FEAL decryption algorithm indicator,
It may be an IDEA decryption algorithm indicator, or a TWOFISH decryption algorithm indicator.

The contents of the data authentication algorithm indicator and the integrated authentication algorithm indicator are as follows:
MD5 authentication algorithm indicator,
It may be a SHA1 authentication algorithm indicator, or an N-HASH authentication algorithm indicator.
The preferred embodiment is illustrated using seven encryption algorithms and three authentication algorithms. It allows for situations that do not require decryption or authentication. The decryption module database can store entries of up to 128 (= (7 + 1) × (3 + 1) × (3 + 1)) records.

  Reference numeral 207 denotes a data buffer area. The data buffer area temporarily stores the decryption / authentication-related data stored by the parameter processing unit and the data temporarily required and stored by the data verification unit and the decryption / authentication control unit during processing.

  Reference numeral 200 denotes an input unit. The input unit is constituted by a keyboard or any device capable of inputting a data packet.

  Reference numeral 201 denotes a verification unit that verifies input data. The verification unit, if the data is parameter data, sends the data to the parameter processing unit, otherwise, verifies whether there is a decoding information label, if there is no decoding information label, transmits an error code, Otherwise, the input data is separated into the decryption module database index and the ciphertext, and transmitted to the decryption processing unit for processing.

  Reference numeral 202 denotes a decryption control unit. The decryption control unit searches for the data decryption algorithm indicator, the data authentication algorithm indicator, and the integrated authentication algorithm indicator according to the decryption module database index, and performs the decryption processing of the input data according to the algorithm module indicated by each indicator.

  203 denotes an authentication unit. The authentication unit authenticates the input data according to the authentication algorithm indicator and the related data required for the authentication algorithm indicator, and transmits the result to the decryption control unit.

  Reference numeral 204 denotes a decoding unit. The decryption unit performs decryption processing of the input data according to the decryption algorithm indicator and related data necessary for the decryption algorithm indicator, and transmits the result to the decryption control unit.

  An output unit 205 outputs the decrypted data to a memory device or any other output device.

  Reference numeral 206 denotes a parameter processing unit. The parameter processing unit verifies the parameters input by the verification unit, updates the decryption algorithm module database when the decryption algorithm module data is detected, and transmits an error code otherwise.

  FIG. 4 is a flowchart of the data decryption process in the preferred embodiment of the data decryption device according to the present invention. In the block diagram of FIG. 2, when the verification unit 201 determines that the input data is data to be decrypted, the input of the data is recognized in step S401. In S402, it is determined whether or not the input data includes a decryption information label. If the input data does not include the decryption information label, it is determined that the input data includes an error, an error code is transmitted in step S404, and the flow ends. If the input data includes the decryption information label, step S403 is executed to decompose the input data into decryption algorithm module combination data and ciphertext. Thereafter, in step S405, it is determined whether the decryption algorithm module combination data is correct. If not, step S407 is executed, an error code is transmitted, and the flow ends. If it is correct, the flow proceeds to step S406. In step S406, the flow proceeds to the decryption control unit 202, and the data decryption process is started. First, each of the decryption algorithm module indicators is searched according to the decryption algorithm module combination data. Then, in step S408, it is determined whether or not the integrated authentication algorithm indicator is 0. If it is 0, this indicates that the integrated authentication processing is not executed, and the flow proceeds to step S412. Otherwise, the flow proceeds to step S409, where the integrated authentication indicator and its necessary parameters are processed and authenticated by the authentication unit 204 together with the ciphertext and the header data, and an authentication result is obtained. Thereafter, the flow proceeds to S410, and determines whether the authentication result is correct. If not correct, the flow proceeds to step S411, and transmits an error code before the end. Otherwise, the flow goes to step S412. In step S412, it is determined whether the data authentication algorithm indicator is 0. If it is 0, this indicates that the data authentication process is not executed, and the flow proceeds to step S416. Otherwise, the flow proceeds to step S413, where the data authentication indicator and the necessary parameters are authenticated by the authentication unit 204 together with the ciphertext, and an authentication result is obtained. Thereafter, the flow proceeds to S414, where it is determined whether the authentication result is correct. If not correct, the flow proceeds to step S415, and transmits an error code before the end. Otherwise, the flow goes to step S416. In step S416, it is determined whether the data decryption algorithm indicator is 0. If it is 0, this indicates that the data authentication process is not performed, and the flow proceeds to step S420. Otherwise, the flow proceeds to step S417, where the data decryption indicator and the necessary parameters are processed by the decryption unit 204 together with the ciphertext, and a decryption result is obtained. Next, the flow proceeds to S418, where it is determined whether the decryption result is correct. If not correct, the flow proceeds to step S419, and transmits an error code before the end. Otherwise, flow proceeds to step S420, where the decrypted data is output to a memory device or any other device.

  Hereinafter, an example of the processing of the preferred embodiment of the data decoding device according to the present invention will be described. FIG. 15 is a diagram showing data processed by an example of the preferred embodiment of the data decryption device according to the present invention. In FIG. 15, reference numeral 15a denotes input data at the start of the decryption process according to this processing example. It includes a decryption information label, a decryption module database index value (the value is 2), and a ciphertext. Reference numeral 15b denotes data in the decryption module database at the start of the decryption process in this processing example. Reference numeral 15c denotes output data at the end of the decryption processing according to this processing example. In the data decryption process flow chart of the preferred embodiment of the data decryption device according to the present invention, after receiving the input data (as shown at 15a) in step S401 and determining in step S402 that the input data includes a decryption information label. After that, in step S403, the input data (as indicated by 15a) is decomposed into a decryption module database index value (value is 2) and a ciphertext as indicated by 15a. If it is determined in step S405 that the decryption module database index value having the value of 2 is a correct value, the flow directly proceeds to step S406. In step S406, according to the decryption module database index value of 2, a decryption algorithm module available for it is retrieved from the decryption module database data (as shown in 15b). They are a DES decryption algorithm indicator for a data decryption algorithm indicator, a SHA1 authentication algorithm indicator for a data authentication algorithm indicator, and an MD5 authentication algorithm indicator for an integrated authentication algorithm indicator, respectively. The flow then proceeds to step S408. In step S408, since the integrated authentication algorithm indicator is the MD5 authentication algorithm indicator and is not 0, the flow proceeds to step S409. In step S409, the MD5 authentication algorithm indicator, the header field data of the input data (as shown in 15a) and the cipher text obtained in step S403 are sent to the authentication unit for integrated authentication processing. Next, the flow proceeds to step S410. In step S410, it is determined whether the integrated authentication result is correct. Thereafter, the flow proceeds to step S412. In step S412, since the data authentication algorithm indicator is the SHA1 authentication algorithm indicator and is not 0, the flow proceeds to step S413. In step S413, the SHA1 authentication algorithm indicator and the ciphertext obtained in step S403 are transmitted to the authentication unit for data authentication processing. Next, the flow proceeds to step S414. In step S414, it is determined that the data authentication result is correct, and the process proceeds to step S416. In step S416, since the data decryption algorithm indicator is the DES decryption algorithm indicator and is not 0, the flow proceeds to step S417. In step S417, the DES decryption algorithm index and the ciphertext obtained in step S403 are transmitted to the encryption unit for encryption processing. Next, the flow proceeds to step S418. In step S418, when it is determined that the data decryption result is correct, the flow proceeds to step S420. In step S420, output of data (as shown in 15c) to another device is completed according to the input data (as shown in 15a) and the decryption result obtained in step S418.

  The present invention is not limited to the preferred embodiments described above. For example, the input data to be processed is not limited to packet data, but may be non-packet type digital data. In addition, the cryptographic definition data of the security class database according to the present invention, besides storing the cryptographic module database index and the corresponding ratio adopted therein, also includes an encryption algorithm indicator, a data authentication algorithm indicator, an integrated authentication. The algorithm indicators and the ratios employed for them may be stored without having to separately store the combination of encryption algorithm modules in the encryption module database. Furthermore, although the preferred embodiment of the present invention has been described using packet data processing as an example, the present invention can be applied to other types of data.

  In view of the above, the encryption device of the present invention can solve the conventional problems. In other words, the present invention has the effect that the combination of encryption algorithm modules is automatically switched according to different data attributes. For example, when a user reads a message from a remote terminal, the transmitted data is encrypted using a combination of the most secure encryption algorithm modules in the authentication process, and the other transmitted data is different. Adopt a combination of encryption algorithm modules. As a result, the user's login account and password are not disclosed. Further, since other transmitted data is encrypted using different encryption algorithm module combinations, it is difficult for an unauthorized user to read the contents of the data. At the same time, the transmission time can be improved by adjusting the usage ratio of the combination of the encryption algorithm modules.

  Although the present invention has been described in what is considered to be the most practical and preferred, the present invention is not limited to the disclosed embodiments, but covers various variations that fall within the spirit and scope of the broadest interpretation. It goes without saying that all changes and equivalent modifications are included.

FIG. 1 is a block diagram of a preferred embodiment of a data encryption device according to the present invention. 1 is a block diagram of a data decoding device according to a preferred embodiment of the present invention; Processing flowchart of the data encryption operation in the preferred embodiment of the data encryption device according to the present invention Processing flowchart of the data decryption operation in the preferred embodiment of the data decryption device according to the present invention System block diagram of conventional data encryption device System block diagram of conventional data decryption device FIG. 4 is a diagram showing the structure of a security class database in a preferred embodiment of the data encryption device according to the present invention. Table describing data attribute description command capable of data attribute description in security class database in preferred embodiment of data encryption device according to the present invention FIG. 2 is a diagram illustrating the structure of encryption definition data in a security class database of a preferred embodiment of the data encryption device according to the present invention FIG. 2 is a diagram illustrating a structure of a cryptographic module database of a preferred embodiment of a data encryption device according to the present invention FIG. 2 is a diagram illustrating the structure of a decryption module database of a preferred embodiment of the data encryption device according to the present invention FIG. 2 is a view for explaining a structure of input data in a preferred embodiment of a data encryption device according to the present invention. FIG. 3 is a view for explaining the structure of output data in a preferred embodiment of the data encryption device according to the present invention. FIG. 2 is a view for explaining an example of processing of a preferred embodiment of the data encryption device according to the present invention. FIG. 3 is a view for explaining an example of processing of a preferred embodiment of the data decryption device according to the present invention. FIG. 2 is a block diagram of another preferred embodiment of the data encryption device according to the present invention. FIG. 2 is a block diagram of still another preferred embodiment of the data encryption device according to the present invention.

Claims (38)

Step A of building a security class database that stores a plurality of data record entries;
Each record entry includes a data attribute description field and a corresponding encryption definition field, wherein the encryption definition field includes a plurality of encryption algorithm module indicators,
Step B of inputting digital data to be encrypted;
Searching the security class database for a data attribute description that matches the attribute of the digital data and extracting the corresponding encryption definition data;
A step D of randomly selecting one encryption algorithm module indicator from the extracted encryption definition data;
Using the selected encryption algorithm module indicator as a criterion, controlling an encryption process of the input data; and
A step F of adding decryption information to the encrypted digital data and outputting the resultant data.   The cryptographic definition field in the security database constructed in step A includes a plurality of cryptographic algorithm module indicators and the corresponding ratios employed by them, and in step D, each cryptographic algorithm module indicator and corresponding counterpart employed therein 2. The data encryption method according to claim 1, wherein one encryption algorithm module indicator is selected from the extracted encryption definition data in cooperation with a random number generator and a MOD operation based on the ratio.   The encryption definition field in the security database constructed in step A includes a plurality of encryption algorithm module combinations, each encryption algorithm module combination includes an encryption algorithm module indicator and an authentication algorithm module indicator, and in step D, One encryption algorithm module combination is randomly extracted from the extracted encryption definition data, and in step E, the selected encryption algorithm module combination includes the type of encryption and the type of authentication. 2. The data encryption method according to claim 1, wherein the data encryption method is used as a criterion for an encryption process.   The encryption definition field in the security database constructed in step A includes a plurality of encryption algorithm module combinations and corresponding ratios adopted therein, and in step D, each encryption algorithm module combination and the corresponding association adopted therein 4. The data encryption method according to claim 3, wherein one encryption algorithm module combination is selected from the extracted encryption definition data in cooperation with the random number generator and the MOD operation according to the ratio. Step A of building an encryption module database that stores a plurality of data record entries;
Each record entry includes an encryption algorithm module indicator and an authentication algorithm module indicator,
Step B of building a security class database that stores a plurality of data record entries;
Each record entry includes a data attribute description field and a corresponding encryption definition field, wherein the encryption definition field includes a plurality of encryption module database indexes.
Step C of inputting digital data to be encrypted;
Searching the security class database for a data attribute description that matches the attribute of the digital data and extracting the corresponding cryptographic definition data;
A step E of randomly selecting one encryption module database index from the extracted encryption definition data;
Selecting a record entry from the encryption module database according to the selected encryption module database index, F;
Using the entry of the selected record as a criterion, controlling the encryption process of the input digital data, including the type of encryption and the type of authentication; and
Adding a decryption information to the encrypted digital data and outputting the added digital data.   The cryptographic definition fields in the security database constructed in step B include a plurality of cryptographic module database indexes and corresponding ratios employed therein, and in step E, each cryptographic module database index and the corresponding 6. The data encryption method according to claim 5, wherein one encryption module database index is selected from the extracted encryption definition data in cooperation with a random number generator and a MOD operation according to a corresponding ratio. Constructing cryptographic definition data including a plurality of cryptographic algorithm module indicators;
Step B of inputting digital data to be encrypted;
(C) randomly selecting one encryption algorithm module indicator from the encryption definition data;
Using the selected encryption algorithm module indicator as a criterion, controlling the encryption process of the input digital data; D.
Adding a decryption information to the encrypted digital data and outputting the decrypted information.   The cryptographic definition data constructed in step A includes a plurality of encryption algorithm module indicators and corresponding ratios employed therein, and in step C, according to each encryption algorithm module indicator and the corresponding ratio employed therein. 8. The data encryption method according to claim 7, wherein one encryption algorithm module indicator is selected from the encryption definition data in cooperation with a random number generator and a MOD operation.   The encryption definition data constructed in step A includes a plurality of encryption algorithm module combinations, each encryption algorithm module combination includes an encryption algorithm module indicator and an authentication algorithm module indicator, and in step C, the cipher extracted in step C One encryption algorithm module combination is selected at random from the definition data. In step D, the selected encryption algorithm module combination includes the type of encryption and the type of authentication. The data encryption method according to claim 7, which is used as a criterion for the encryption process.   The cryptographic definition data constructed in step A includes a plurality of encryption algorithm module combinations and corresponding ratios adopted therein, and in step C, each encryption algorithm module combination and the corresponding ratio employed therein 10. The data encryption method according to claim 9, wherein one encryption algorithm module combination is selected from the extracted encryption definition data in cooperation with a random number generator and a MOD operation. Step A of building an encryption module database that stores a plurality of data record entries;
Each record entry includes an encryption algorithm module indicator and an authentication algorithm module indicator,
Building B cryptographic definition data including a plurality of cryptographic module database indexes;
Step C of inputting digital data to be encrypted;
(C) randomly selecting one cryptographic module database index from the cryptographic definition data;
A step E of selecting an entry of one record from the encryption module database according to the selected encryption module database index;
Using the entry of the selected record as a criterion, controlling the encryption processing of the input digital data, including the type of encryption and the type of authentication;
Adding decryption information to the encrypted digital data and outputting the resulting digital data.   The encryption definition data constructed in step B includes a plurality of encryption module database indexes and corresponding ratios adopted therein, and in step D, according to each encryption module database index and corresponding ratio adopted therein, The data encryption method according to claim 11, wherein one encryption module database index is selected from the encryption definition data in cooperation with a random number generator and a MOD operation. Step A of building a security class database that stores a plurality of data record entries;
Each record entry includes a data attribute description field and a corresponding encryption definition field, wherein the encryption definition data field is an encryption algorithm module indicator;
Step B of inputting digital data to be encrypted;
Finding, from the security class database, a data attribute description that matches an attribute of the digital data, and extracting an encryption algorithm module indicator of a corresponding encryption definition field;
Using the retrieved encryption algorithm module indicator as a criterion, controlling the encryption of the input digital data; D.
Adding a decryption information to the encrypted digital data and outputting the decrypted information.   The encryption definition field in the security class database constructed in step A is an encryption algorithm module combination, the encryption algorithm module combination including an encryption algorithm module indicator and an authentication algorithm module indicator. An encryption algorithm module combination is retrieved in step C to find a data attribute description from the security class database that matches the attribute of the digital data, and in step D the selected encryption algorithm module combination is 14. The data encryption method according to claim 13, wherein the data encryption method is used as a criterion for controlling an encryption process of input digital data including the following types. Step A of building an encryption module database that stores a plurality of data record entries;
Each record entry includes an encryption algorithm module indicator and an authentication algorithm module indicator,
Step B of building a security class database that stores a plurality of data record entries;
Each record entry includes a data attribute description field and a corresponding encryption definition field, wherein the encryption definition field includes a plurality of encryption module database indexes.
Step C of inputting digital data to be encrypted;
Searching the security class database for a data attribute description that matches the attribute of the digital data, and extracting an encryption module database index from the corresponding encryption definition field;
Using the retrieved cryptographic module database index as a criterion, selecting an entry for one record from the cryptographic module database;
Using the entry of the selected record as a criterion, controlling the encryption processing of the input data, including the type of encryption and the type of authentication, and F;
Adding decryption information to the encrypted digital data and outputting the resulting digital data. In a data encryption device including an input unit for inputting data and an output unit for outputting data after data encryption processing,
A security class database that stores a plurality of data record entries,
Each record entry includes a data attribute description field and a corresponding encryption definition field, the encryption definition field including a plurality of encryption algorithm module indicators,
A verification unit that verifies data input through the input unit, and separates the data into parameter data or digital data.
A parameter processing unit that updates the security class database with parameter data sent from the verification unit,
From the security class database, an attribute verification unit that searches for a data attribute description that matches the attribute of the digital data sent from the verification unit, and transmits the corresponding encryption definition data to the encryption selection unit,
The encryption selecting unit randomly selects one encryption algorithm module indicator from the searched encryption definition data,
A data encryption device that controls an encryption process of the input data by using an encryption algorithm module indicator selected by the encryption selection unit as a reference.   The cryptographic definition field in the security class database includes a plurality of encryption algorithm module indicators and corresponding ratios employed therein, and the cipher selection unit determines whether each of the encryption algorithm module indicators and the corresponding ratios employed therein. 17. The data encryption device according to claim 16, wherein one encryption algorithm module indicator is selected based on the random number generator and the MOD operation.   The encryption definition field in the security database includes a plurality of encryption algorithm module combinations, each encryption algorithm module combination includes an encryption algorithm module indicator and an authentication algorithm module indicator, and the encryption selector randomly selects 1 One encryption algorithm module combination is selected from the retrieved encryption definition data, and the encryption processing unit uses the encryption algorithm module combination selected by the encryption selection unit as a criterion to determine the type of encryption and the type of authentication. 17. The data encryption device according to claim 16, wherein the data encryption device controls encryption processing of the input digital data.   The encryption definition field in the security database includes a plurality of encryption algorithm module combinations and corresponding ratios employed therein, and the encryption selection unit according to each encryption algorithm module combination and the corresponding ratio employed therein, 19. The data encryption device according to claim 18, wherein one encryption algorithm module combination is selected from the searched encryption definition data in cooperation with a random number generator and a MOD operation. A cryptographic module database that stores a plurality of data record entries;
Each record entry further includes an encryption algorithm module indicator and an authentication algorithm module indicator,
The security definition field of the security class database includes a plurality of encryption module database indexes,
The encryption selecting unit randomly selects one encryption module database index from the searched encryption definition data and, according to the searched encryption module database index, deletes one record entry from the encryption module database. Selected,
The encryption processing unit controls an encryption process of the input digital data including a type of encryption and a type of authentication by using an entry of a record selected by the encryption selection unit as a criterion. 16. The data encryption device according to item 16.   The cryptographic definition field in the security class database includes a plurality of cryptographic module database indexes and corresponding ratios employed therein, and the cryptographic selecting unit determines, from the retrieved cryptographic definition data, each cryptographic module database index and In cooperation with the random number generator and the MOD operation, one cryptographic module database index is selected based on the corresponding ratio adopted, and according to the selected cryptographic module database index, 21. The data encryption device according to claim 20, wherein an entry of one record is selected.   22. The data encryption device according to claim 20, wherein the parameter processing unit updates the security database and the encryption module database using parameter data sent from the verification unit. In a data encryption device including an input unit for inputting data and an output unit for outputting data after data encryption processing,
An encryption module database that stores a plurality of data record entries;
Each record entry contains an encryption algorithm module indicator,
A verification unit that verifies data input through the input unit, and separates the data into parameter data or digital data.
A parameter processing unit that updates the encryption module database using parameter data from the verification unit;
An encryption selection unit that randomly selects one record entry from the encryption module database;
A data encryption device that controls an encryption process of the input digital data using an entry of a record selected by the encryption selection unit as a reference. The cryptographic module database stores a plurality of record entries for data, each record entry including a cryptographic algorithm module indicator and a corresponding ratio employed thereby;
24. The cipher selector, in conjunction with a random number generator and a MOD operation, selects one record entry according to a corresponding ratio adopted by each record entry in the encryption module database. A data encryption device as described. The cryptographic module database stores a plurality of record entries for data, each record entry including a cryptographic algorithm module indicator and a corresponding ratio employed thereby;
The encryption processing unit controls the encryption process including the type of encryption and the type of authentication, using, as a reference, an encryption algorithm module combination of an entry of a record randomly selected by the encryption selection unit. The data encryption device according to claim 23.   The encryption module database stores a plurality of entries for records of data, each entry of the record including an encryption algorithm module indicator, an authentication algorithm module indicator, and a corresponding ratio employed by the encryption algorithm module indicator. Selecting, in cooperation with a random number generator and a MOD operation, an entry of one record from the encryption module database according to a corresponding ratio adopted by an entry of each record in the encryption module database. Item 30. The data encryption device according to item 25. In a data encryption device including an input unit for inputting data and an output unit for outputting data after data encryption processing,
A security class database that stores a plurality of data record entries,
Each record entry includes a data attribute description field and a corresponding encryption definition field, wherein the encryption definition field is an encryption algorithm module indicator;
A verification unit that verifies data input through the input unit, and separates the data into parameter data or digital data.
A parameter processing unit that updates the security class database with parameter data from the verification unit,
An attribute verification unit that searches the security class database for a data attribute description that matches the attribute of the digital data sent from the verification unit, and transmits the corresponding encryption definition data to the encryption processing unit,
The data encryption device, wherein the encryption processing unit controls the encryption processing of the input digital data using the encryption algorithm module indicator selected by the attribute verification unit as a criterion.   The encryption definition field in the security class database is an encryption algorithm module combination, the encryption algorithm module combination includes an encryption algorithm module indicator and an authentication algorithm module indicator, and the encryption processing unit includes the parameter verification unit 28. The data encryption apparatus according to claim 27, wherein the encryption processing of the input digital data including the type of encryption and the type of authentication is controlled using the encryption algorithm module combination selected by the above as a criterion. Step A of inputting digital data to be decrypted;
Verifying whether the digital data includes a decryption algorithm module indicator, and if so, detecting the decryption algorithm module indicator; if not, processing the data to be decrypted in a later step D A step B for setting the input data equivalent to the input data;
Using the retrieved decryption algorithm module indicator as a criterion to control decryption processing of the input digital data;
And D) outputting the decrypted digital data.   In step B, it is verified whether the digital data includes a decryption algorithm module combination having a decryption algorithm module indicator and an authentication algorithm module indicator, and if so, the decryption algorithm module combination is searched; Setting the data to be decrypted to be equivalent to the input data for processing in step D, and further comprising in step C the type of input digital data including the type of decryption and the type of authentication. 30. The data decoding method according to claim 29, wherein the data decoding process is controlled using the selected decoding algorithm module combination as a criterion. Step A of building a decryption module database that stores a plurality of data record entries;
Each record entry is a decryption algorithm module indicator,
Inputting digital data to be decrypted, step B;
Verify whether the digital data includes a decryption module database index, and if so, search the decryption module database index; otherwise, retrieve the data to be decrypted for processing in step F below. A step C for setting the input data equal to the input data;
Selecting a record entry from the decryption module database using the retrieved decryption module database index as a criterion;
Using the entries of the selected record as a criterion, controlling the decoding process of the input digital data;
Outputting the decrypted digital data. F. A method for decrypting data. In step A, a decryption module database for storing a plurality of record entries of the data is constructed, wherein each record entry includes a decryption algorithm module indicator and an authentication algorithm module indicator;
32. The data decryption method according to claim 31, wherein in the step E, the entry of the selected record is used as a criterion for controlling decryption processing of the input digital data, including a type of decryption and a type of authentication. In a data decryption device including an input unit for inputting data and an output unit for outputting data after decryption processing,
Verify whether the data input through the input unit includes a decryption algorithm module indicator, if so, take out the decryption algorithm module indicator, if not, the input data directly to the output unit A verification unit to transmit;
A decryption processing unit that controls decryption processing of the input digital data using a decryption algorithm module indicator extracted by the verification unit.   The verification unit verifies whether data input through the input unit includes a decryption algorithm module combination, wherein the decryption algorithm module combination includes a decryption algorithm module indicator and an authentication algorithm module indicator, When the input data includes a decryption algorithm module combination, the verifying unit extracts the decryption algorithm module combination, and when the input data does not include the decryption algorithm module combination, directly transmits the input data to the output unit. 34. The data decryption apparatus according to claim 33, wherein decryption processing of the input digital data including the type of the authentication data and the type of authentication is controlled using a decryption algorithm module indicator extracted by the verification unit as a criterion. A decryption module database for storing a plurality of record entries of the data, wherein each record entry includes a decryption algorithm module indicator;
The verification unit verifies whether the data input via the input unit includes a decryption module database index, and if so, extracts the decryption module database index, and further uses the index to decrypt the decryption module database. Retrieve the entry of one record from the database, if not, send the input data directly to the output unit,
34. The data decryption device according to claim 33, wherein the decryption processing unit controls decryption processing of the input digital data using an entry of a record extracted by the verification unit as a criterion.   The decryption module database stores a plurality of data record entries, each record entry includes a decryption algorithm module indicator and an authentication algorithm module indicator, and the decryption processing unit stores the record entry retrieved by the verification unit. 36. The data decryption device according to claim 35, wherein the decryption process including a type of decryption and a type of authentication is controlled as a standard. The decryption module database further includes a parameter processing unit that updates using the parameter data,
The verification unit verifies the data input through the input unit, separates the data into parameter data or digital data, and when the input data is parameter data, transmits it to the parameter processing unit, and If the obtained data is digital data, it is verified whether or not the digital data includes a decryption module database index, and if so, the decryption module database index is extracted and one 36. The data decoding apparatus according to claim 35, wherein an entry of one record is taken out, and when the entry is not included, the input data is directly transmitted to an output unit. The decryption module database stores a plurality of record entries for data, each record entry including a decryption algorithm module indicator and an authentication algorithm module indicator,
38. The data decryption device according to claim 37, wherein the decryption processing unit controls decryption processing of the input data including a type of decryption and a type of authentication using an entry of a record extracted by the verification unit as a criterion. apparatus.

Images