[go: up one dir, main page]

WO2015190014A1 - Dispositif de gestion de clé de chiffrement et procédé de gestion de clé de chiffrement - Google Patents

Dispositif de gestion de clé de chiffrement et procédé de gestion de clé de chiffrement Download PDF

Info

Publication number
WO2015190014A1
WO2015190014A1 PCT/JP2014/083099 JP2014083099W WO2015190014A1 WO 2015190014 A1 WO2015190014 A1 WO 2015190014A1 JP 2014083099 W JP2014083099 W JP 2014083099W WO 2015190014 A1 WO2015190014 A1 WO 2015190014A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
user
password
encrypted
management
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/JP2014/083099
Other languages
English (en)
Japanese (ja)
Inventor
健児 伊藤
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hitachi Solutions Ltd
Original Assignee
Hitachi Solutions Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hitachi Solutions Ltd filed Critical Hitachi Solutions Ltd
Publication of WO2015190014A1 publication Critical patent/WO2015190014A1/fr
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms

Definitions

  • the present invention relates to an encryption key management apparatus and an encryption key management method for managing an encryption key used for data encryption and decryption of encrypted data (encrypted data).
  • a user stores data by using a one-way function converted from a password as an encryption key used for data encryption and decryption of encrypted data (hereinafter referred to as data encryption / decryption).
  • a technology is generally used in which an encryption key cannot be generated unless the password is known, and the encryption data is protected from a third party.
  • the password is changed, the encrypted data encrypted with the encryption key generated based on the password before the change cannot be decrypted using the password after the change.
  • Patent Document 1 generates a password key by converting a password with a one-way function or the like, and separately generates a data encryption key based on a random number as an encryption key for data encryption / decryption,
  • a technique for storing the data encryption key encrypted with a password key is disclosed. According to this technique, since the data encryption key cannot be extracted unless the password is known, the encrypted data cannot be decrypted. And when changing the password, if you take out the data encryption key using the password before the change, encrypt it again using the password after the change, and save it again, it will be encrypted using the password before the change. Even encrypted data can be decrypted using the changed password.
  • the third party can be known only by a legitimate user.
  • the encrypted data cannot be decrypted because the password is not known.
  • passwords are not normally stored. For this reason, even if a legitimate user forgets the password, since there is no means for knowing the password, the encrypted data cannot be decrypted, which is inconvenient.
  • the third party referred to here is, for example, a user who has a mail server administrator authority in the case of a mail system, or a user who has a Web server administrator authority in the case of a Web system.
  • information for generating an encryption key is held in a device such as an IC card, or a biometric information such as a fingerprint or a vein is digitized to obtain an encryption key.
  • a device such as an IC card
  • a biometric information such as a fingerprint or a vein
  • an encryption key is held in a device such as an IC card
  • a biometric information such as a fingerprint or a vein
  • An object of the present invention is to provide an encryption key management apparatus and encryption key management capable of decrypting encrypted data while maintaining a high security level without using a special device even when a legitimate user forgets the password. Is to provide a method.
  • the encryption key management device of the present invention provides: Encryption in which a user key used for encrypting the data of the first user and decrypting the encrypted data is encrypted using the password key of the first user converted from the password of the first user.
  • Password reset request receiving means for receiving password reset request information including a new password of the first user from the first terminal;
  • the password reset request receiving means receives the password reset request information, the password for transmitting the password reset approval request information including the user specifying information for specifying the first user who has transmitted the password reset request information to the second terminal Reset approval request information transmission means;
  • password reset approval notification information including the password of the second user is received from the second terminal, the password of the second user included in the password reset approval notification information is converted, and the password of the second user is converted.
  • a second user password key generating means for generating a key;
  • the encrypted user password key is read from the key management database, and the read encrypted user password key is read using the second user password key generated by the second user password key generation means.
  • First user password key obtaining means for decrypting and obtaining the first user password key;
  • the encrypted user key is read from the key management database, and the read encrypted user key is decrypted by using the first user password key acquired by the first user password key acquisition means.
  • User key acquisition means for acquiring the user key;
  • a first user password key generation unit that converts a password of the first user included in the password reset request information received by the password reset request reception unit and generates a new first user password key;
  • An encrypted user key update means for updating the encrypted user key stored in the key management database with the new encrypted user key;
  • the second user password key generated by the second user password key generation means the first user password key generated by the first user password key generation means is encrypted.
  • An encrypted user password key update means for generating a new encrypted user password key and updating the encrypted user password key stored in the key management database with the new encrypted user password key; It is characterized by providing.
  • the encryption key management device of the present invention is The key management database stores an encrypted management key obtained by encrypting a management key using the password key of the second user;
  • the encrypted user password key stored in the key management database is encrypted using the management key,
  • the first user's password key acquisition means reads the encrypted management key from the key management database, and uses the second user's password key generated by the second user's password key generation means. Decrypting the read encrypted management key to obtain a management key, reading the encrypted user password key from the key management database, and reading the encrypted user password using the obtained management key Decrypting the key to obtain the password key of the first user;
  • the encrypted user password key update means generates the first user password key using the management key obtained by using the second user password key by the first user password key obtaining means. Encrypting the first user's password key generated by the means to generate a new encrypted user password key; It is characterized by that.
  • the encryption key management method of the present invention includes: Encryption in which a user key used for encrypting the data of the first user and decrypting the encrypted data is encrypted using the password key of the first user converted from the password of the first user.
  • Management for storing a stored user key and an encrypted user password key obtained by encrypting the password key of the first user using the password key of the second user converted from the password of the second user An encryption key management method in an encryption key management apparatus having a database, A password reset request receiving step of receiving password reset request information including a new password of the first user from the first terminal; Upon receiving the password reset request information, a password reset approval request information transmission step of transmitting to the second terminal password reset approval request information including user specifying information for specifying the first user who has transmitted the password reset request information When, When password reset approval notification information including the password of the second user is received from the second terminal, the password of the second user included in the password reset approval notification information is converted, and the password of the second user is converted.
  • a second user password key generating step for generating a key The encrypted user password key is read from the key management database, and the read encrypted user password key is read using the second user password key generated in the second user password key generation step.
  • a first user password key obtaining step of decrypting and obtaining the first user password key The encrypted user key is read from the key management database, and the read encrypted user key is decrypted using the first user password key acquired in the first user password key acquisition step.
  • a user key obtaining step for obtaining the user key A first user password key generating step of converting a password of the first user included in the password reset request information received in the password reset request receiving step and generating a new first user password key; Using the first user password key generated in the first user password key generation step to generate a new encrypted user key by encrypting the user key acquired in the user key acquisition step; An encrypted user key update step of updating the encrypted user key stored in the key management database with the new encrypted user key; The first user password key generated in the first user password key generation step is encrypted using the second user password key generated in the second user password key generation step.
  • the encrypted data can be decrypted without using a special device.
  • FIG. 1 shows an example of the configuration of an encryption system including an encryption key management device according to an embodiment of the present invention.
  • the encryption system includes a user terminal 100, an administrator terminal 110, and an encryption key management device 120.
  • the user terminal 100, the administrator terminal 110, and the encryption key management device 120 are connected to the network 130 and can communicate with each other.
  • the user terminal 100 is used by a user who is an owner of encrypted data.
  • the user terminal 100 includes a CPU (Central Processing Unit), a main memory including a RAM (Random Access Memory), a storage device including a hard disk, an output device including a display and a speaker, And an input device including a keyboard and a mouse.
  • a terminal program is stored in the storage device of the user terminal 100.
  • the CPU of the user terminal 100 reads the terminal program from the storage device into the main memory and executes it, so that the personal identification information receiving unit 101, the key decryption unit 102, the encryption unit 103, the decryption unit 104, and the password reset request unit The function of each part with 105 is realized.
  • the personal identification information receiving unit 101 receives an authentication ID (Identifier) and a password input by the user, and transmits them to the encryption key management apparatus 120. If the authentication is successful, the encryption key management device 120 returns the encrypted user key.
  • the key decryption unit 102 decrypts the encrypted user key transmitted from the encryption key management apparatus 120 and acquires the user key.
  • the encryption unit 103 encrypts the user data using the user key.
  • the decrypting unit 104 decrypts the user data encrypted using the user key.
  • the password reset request unit 105 receives a new password when the user forgets the password or updates the password, and transmits password reset request information including the password to the encryption key management apparatus 120. The processing performed by the password reset request unit 105 will be described later with reference to FIG.
  • the user terminal 100 is an example of the first terminal of the present invention, and the user who uses the user terminal 100 is an example of the first user of the present invention.
  • the administrator terminal 110 is used by a user-side administrator.
  • the user-side administrator is a user different from the user, and is different from the administrator (system administrator) of the encryption key management apparatus 120.
  • the administrator terminal 110 includes a CPU, a main memory, a storage device, an output device, and an input device. Note that the users of this cryptographic system may be grouped into a plurality of groups, and a different user-side administrator and administrator terminal 110 may be placed for each group.
  • An administrator terminal program is stored in the storage device of the administrator terminal 110.
  • the CPU of the administrator terminal 110 reads the administrator terminal program from the storage device into the main memory and executes it, so that the personal identification information receiving unit 101, the key decryption unit 102, the encryption unit 103, the decryption unit 104, and the password Functions of each unit with the reset approval unit 115 are realized.
  • the personal identification information receiving unit 101, the key decryption unit 102, the encryption unit 103, and the decryption unit 104 are the same as those of the user terminal 100.
  • the password reset approval unit 115 transmits password reset approval notification information including the password to the encryption key management device 120. The processing performed by the password reset approval unit 115 will be described later with reference to FIG.
  • the administrator terminal 110 is an example of the second terminal of the present invention, and the user-side administrator who uses the administrator terminal 110 is an example of the second user of the present invention.
  • the encryption key management device 120 has a CPU, a main memory composed of a RAM and the like, and a storage device composed of a hard disk and the like.
  • the storage device of the encryption key management device 120 stores an encryption key management program and a user information / key management DB (database) 125.
  • the CPU of the encryption key management device 120 reads out the encryption key management program from the storage device to the main memory and executes it, so that each unit of the authentication unit 121, the key encryption unit 122, the key transmission unit 123, and the password reset unit 124 The function is realized.
  • the user information / key management DB (database) 125 includes authentication data 140, an encrypted user key 200, an encrypted management user key 210, an encrypted management key 220, and an encryption key.
  • Stored user password key 222 is stored.
  • the authentication data 140 is obtained by converting a password using a one-way function or the like.
  • the authentication unit 121 receives the authentication ID and password from the user terminal 100 or the administrator terminal 110, the authentication unit 121 converts the received password by the same method as the authentication data, and determines whether or not the converted password matches the authentication data. It is determined whether or not the user is a valid user.
  • the key encryption unit 122 generates an encrypted user key 200, an encrypted management user key 210, an encrypted management key 220, and an encrypted user password key 222. The encryption key generation flow by the key encryption unit 122 will be described in detail later.
  • the key transmission unit 123 reads the user's encrypted user key 200 from the user information / key management DB 125 and transmits it to the user terminal 100.
  • the password reset unit 124 Upon receiving password reset request information from the user terminal 100, the password reset unit 124 resets the old password and validates the new password. The processing performed by the password reset unit 124 will be described later with reference to FIG.
  • the user information / key management DB (database) 125 is an example of the key management database of the present invention.
  • the user password key 201 is obtained by converting the user password by a one-way function or the like.
  • the user authentication data and the user password key 201 are converted by different methods and are different.
  • the user key 202 is an encryption key for encrypting / decrypting user data.
  • the user key 202 is generated using a random number.
  • the encrypted user key 200 is obtained by encrypting the user key 202 using the user password key 201.
  • the administrator password key 211 is obtained by converting the password of the user-side administrator using a one-way function or the like.
  • the authentication data of the user side administrator and the password key 211 of the administrator are also converted by different methods and are different.
  • the administrator user key 212 is an encryption key for encrypting / decrypting data on the user side administrator.
  • the administrator user key 212 is generated using a random number.
  • the encrypted management user key 210 is obtained by encrypting the administrator user key 212 using the administrator password key 211.
  • the management key 221 is generated using a random number.
  • the encrypted management key 220 is obtained by encrypting the management key 221 using the administrator's password key 211.
  • the encrypted user password key 222 is obtained by encrypting the user password key 201 using the management key 221.
  • FIG. 3 is a diagram illustrating an example of an encryption key generation flow by the key encryption unit 122.
  • (1) Generation of Encrypted User Key 200 The key encryption unit 122 generates a user password key 201 by converting the user password 301 using a one-way function. The key encryption unit 122 generates the user key 202 from the random number. Then, the key encryption unit 122 generates the encrypted user key 200 by encrypting the user key 202 using the user password key 201. The key encryption unit 122 registers the generated encrypted user key 200 in the user information / key management DB 125.
  • the key encryption unit 122 converts the administrator password 302 using a one-way function to generate the administrator password key 211. In addition, the key encryption unit 122 generates an administrator user key 212 from the random number. Then, by encrypting the administrator user key 212 with the administrator's password key 211, an encrypted management user key 210 is generated. At the same time, the key encryption unit 122 generates the management key 221 from the random number. Then, the key encryption unit 122 generates the encrypted management key 220 by encrypting the management key 221 with the administrator's password key 211. The key encryption unit 122 registers the generated encrypted management user key 210 and the encrypted management key 220 in the user information / key management DB 125.
  • the key encryption unit 122 generates the encrypted user password key 222 by encrypting the user password key 201 using the management key 221.
  • the key encryption unit 122 registers the generated encrypted user password key 222 in the user information / key management DB 125.
  • the user When encrypting data or decrypting encrypted data, the user first inputs an authentication ID and password from the input unit of the user terminal 100. Upon receiving the authentication ID and password, the personal identification information receiving unit 101 of the user terminal 100 transmits them to the encryption key management device 120. Upon receiving the authentication ID and password, the authentication unit 121 of the encryption key management apparatus 120 converts the received password by the same method as the authentication data 140, and whether or not the converted password matches the authentication data 140, It is determined whether or not the user is valid.
  • the key transmission unit 123 extracts the encrypted user key 200 stored in the user information / key management DB 125 and transmits it to the user terminal 100.
  • the key decryption unit 102 of the user terminal 100 When receiving the encrypted user key 200, the key decryption unit 102 of the user terminal 100 generates a user password key 201 from the password using a one-way function, and uses the user password key 201 for the encrypted user key 200.
  • the user key 202 is obtained by decrypting.
  • the encryption unit 103 encrypts plaintext data using the user key 202 to obtain encrypted data.
  • the decrypting unit 104 decrypts the encrypted data using the user key 202 to obtain plain text data.
  • FIG. 4 shows an example of the flow of password reset processing in the encryption key management apparatus 120.
  • the user inputs a new password using the input device of the user terminal 100.
  • the password reset request unit 105 of the user terminal 100 accepts a new password
  • the password reset request unit 105 transmits password reset request information including the password to the encryption key management apparatus 120.
  • the password reset unit 124 of the encryption key management device 120 receives the password reset request information from the user terminal 100 (S101)
  • the password reset approval including the user identification information for identifying the user such as the authentication ID is given to the administrator terminal 110.
  • Request information is transmitted (S102).
  • the password reset approval unit 115 of the administrator terminal 110 receives the password reset approval request information transmitted from the encryption key management device 120, the inquiry for inquiring whether to approve the password reset of the user specified by the user specifying information. Information is displayed on an output device.
  • the password reset approval unit 115 transmits password reset approval notification information including the administrator password 302 to the encryption key management device 120.
  • the password reset unit 124 of the encryption key management device 120 receives the password reset approval notification information from the administrator terminal 110 (S103)
  • the password reset unit 124 passes the administrator password 302 to the key encryption unit 122 and the encrypted user key 200. And requesting to regenerate the encrypted user password key 222 (S104).
  • the key encryption unit 122 Upon receiving the request from the password reset unit 124, the key encryption unit 122 converts the administrator password 302 included in the password reset approval notification information using a one-way function, and generates the administrator password key 211 (S105). Next, the key encryption unit 122 reads the encrypted management key 220 from the user information / key management DB 125, decrypts it using the administrator's password key 211, and obtains the management key 221 (S106). Then, the key encryption unit 122 reads the encrypted user password key 222 from the user information / key management DB 125, decrypts it using the management key 221, and obtains the user password key 201 (S107).
  • the key encryption unit 122 may generate the user password key 201 by converting the user password 301 used for authentication by the authentication unit 121 using a one-way function.
  • the key encryption unit 122 reads the encrypted user key 200 from the user information / key management DB 125, decrypts it using the user's password key 201, and obtains the user key 202 (S108).
  • the key encryption unit 122 converts the new user password 301 included in the password reset request information using a one-way function, and generates a new user password key 201 (S109). Then, the key encryption unit 122 generates a new encrypted user key 200 by encrypting the user key 202 acquired in step S108 using the password key 201 of the new user, and the user information / key management DB 125 has already been encrypted. The user key 200 is updated with the new encrypted user key 200 (S110). At the same time, the key encryption unit 122 encrypts the new user password key 201 generated in step S109 by using the management key 201 acquired in step S106 to generate a new encrypted user password key 222. The encrypted user password key 222 of the key management DB 125 is updated with the new encrypted user password key 222 (S111).
  • Step S101 is an example of a password reset request receiving step realized by the password reset request receiving means of the present invention
  • step S102 is a password reset approval request information transmission realized by the password reset approval request information transmitting means of the present invention.
  • Steps S103 and S105 are examples of the second user password key generation step realized by the second user password key generation means of the present invention
  • steps S106 and S107 are steps of the present invention.
  • 1 is an example of a first user password key acquisition step realized by a user password key acquisition means
  • step S108 is an example of a user key acquisition step realized by a user key acquisition means of the present invention.
  • S109 is the present invention.
  • step S110 is an encrypted user key update realized by the encrypted user key update means of the present invention.
  • step S111 is an example of an encrypted user password key update step realized by the encrypted user password key update unit of the present invention.
  • the user side administrator is also one of the users.
  • a password reset request unit 105 is added to the administrator terminal 110 to provide a second user-side administrator who is a user-side administrator different from the user-side administrator (hereinafter referred to as the first user-side administrator). .
  • the first user-side administrator and the second user-side administrator are regarded as the user and the user-side administrator, respectively, and the password (administrator) of the first user-side administrator is performed by performing the password reset process described above. It is also possible to reset the password 302).
  • the management key 221 (hereinafter referred to as the user management key) necessary for acquiring the original user password key 201 is also the password of the administrator lost by the first user administrator due to forgetting or the like.
  • the encrypted management key 220 (hereinafter referred to as the first user-side administrator's encrypted management key 220) is encrypted by the administrator's password key 211 converted from 302. For this reason, it is also necessary to regenerate the encrypted management key 220 of the first user side administrator.
  • the administrator's password key 211 used by the second user-side administrator (hereinafter referred to as the second user-side administrator's password key 211) is used in the user information / key management DB 125.
  • An encrypted management key obtained by encrypting the user management key (hereinafter referred to as an encrypted user management key of the second user-side administrator) is also held in advance. That is, it is assumed that the user management key is encrypted in the user information / key management DB 125, and the encrypted user management key 220 of the first user side administrator and the encrypted user management key of the second user side administrator are stored. Is stored twice.
  • the key encryption unit 122 decrypts the encrypted user management key of the second user-side administrator by using the password key 211 of the second user-side administrator generated in step S105 described above, and the user management key To get.
  • the key encryption unit 122 re-encrypts the user management key using the password key 211 of the new administrator (in this case, the first user-side administrator) and encrypts the new first user-side administrator.
  • the generated management key 220 is regenerated.
  • the key encryption unit 122 generates the encrypted management key 220 of the first user-side administrator generated by the first user-side administrator registered in the user information / key management DB 125. Update with key 220.
  • the encrypted management key 220 of the first user-side administrator can be regenerated by a method different from the above. That is, the key encryption unit 122 performs the password reset process by regarding the first user-side administrator and the second user-side administrator as the user and the user-side administrator, respectively, and thereby the user password key 201 in step S107. To get.
  • the user password key 201 is an administrator password key 211 (hereinafter referred to as a first user administrator password key 211) used by the first user administrator. Therefore, the key encryption unit 122 can use this to decrypt the encrypted management key 220 of the first user-side administrator and acquire the user management key.
  • the key encryption unit 122 regenerates the encrypted first management key 220 of the first user-side administrator, and the first user side registered in the user information / key management DB 125 The administrator's encrypted management key 220 is updated.
  • the administrator on the user's side does not forget his / her password, using the same password for a long period of time increases the risk of password leakage. It is possible to adopt an operation mode in which the administrator password is updated.
  • the new and old administrator passwords can be transmitted from the administrator terminal 110 to the encryption key management device 120 without setting the second administrator.
  • the management key 221 can be decrypted using the password key 211 of the administrator before the change.
  • a configuration in which the user password key 201 directly encrypted using the administrator password key 211 is stored in the user information / key management DB 125 without using the management key 221 at all is also possible.
  • the encrypted user password key 222 of all users is decrypted with the administrator password key 211 before the change. Then, the overhead of re-encrypting with the changed administrator password key 211 occurs each time.
  • changing the management key 221 is not planned in normal operation, if the user password key 201 is encrypted using the management key 221, the encrypted user password key 222 for all users is encrypted. There is no extra overhead such as simultaneous decryption and re-encryption.
  • the key encryption unit 122 converts the user password 301 by a one-way function to generate the user password key 201.
  • the key encryption unit 122 converts the user password 301 by encryption.
  • the user password key 201 may be generated.
  • the key encryption unit 122 may generate the administrator password key 211 by converting the administrator password 302 by encryption.
  • the password is reset without using a special device, the user key is extracted using the new password, and the encryption is performed. Data decryption and plaintext data encryption can be performed.
  • the password is always updated, the approval of the user-side administrator is required, so that the password update request from an unauthorized user and the password update due to the system administrator's allegation can be eliminated.
  • the user-side administrator cannot access the user information / key management DB 125, the user-side administrator cannot use the user key or the like.
  • the present invention it is possible not only to prevent unauthorized access from a third party, but also to maintain independence in the relationship among users who are insiders, user-side administrators, and system administrators. As a result, the user password can be updated while maintaining a high security level.
  • DESCRIPTION OF SYMBOLS 100 ... User terminal, 101 ... Personal identification information reception part, 102 ... Key decryption part, 103 ... Encryption part, 104 ... Decryption part, 105 ... Password reset request part, 110 ... Administrator terminal, 115 ... Password reset approval part, 120 DESCRIPTION OF SYMBOLS ... Encryption key management apparatus 121 ... Authentication part 122 ... Key encryption part 123 ... Key transmission part 124 ... Password reset part 125 ... User information and key management DB (database), 130 ... Network, 140 ... Authentication data, 200 ... encrypted user key 201 ... user password key 202 ... user key 210 ... encrypted management user key 211 ... administrator password key 212 ... administrator user key 220 ... encrypted management Key, 221 ... management key, 222 ... encrypted user password key

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)

Abstract

L'invention a pour but de déchiffrer des données chiffrées même si un utilisateur oublie un mot de passe. À cet effet, selon l'invention, lorsqu'un terminal utilisateur demande un changement d'un mot de passe, un dispositif de gestion de clé de chiffrement demande une autorisation à un terminal de gestionnaire. Lorsque le terminal de gestionnaire l'autorise, le dispositif de gestion de clé de chiffrement convertit un mot de passe de gestionnaire en une clé de mot de passe de gestionnaire (211) par utilisation d'une fonction à sens unique et déchiffre une clé de mot de passe d'utilisateur chiffrée (222), permettant ainsi d'acquérir une clé de mot de passe d'utilisateur (201). Ensuite, le dispositif de gestion de clé de chiffrement utilise la clé de mot de passe d'utilisateur (201) pour déchiffrer une clé d'utilisateur chiffrée (200), permettant ainsi d'acquérir une clé d'utilisateur (202). Ensuite, le dispositif de gestion de clé de chiffrement convertit un nouveau mot de passe d'utilisateur en une clé de nouveau mot de passe d'utilisateur (201) par utilisation d'une fonction à sens unique et chiffre la clé d'utilisateur (202), permettant ainsi de réaliser à nouveau une clé d'utilisateur chiffrée (200), et utilise en outre la clé de mot de passe de gestionnaire (211) pour chiffrer la clé de nouveau mot de passe d'utilisateur (201), permettant ainsi de réaliser à nouveau une clé de mot de passe d'utilisateur chiffrée (222).
PCT/JP2014/083099 2014-06-13 2014-12-15 Dispositif de gestion de clé de chiffrement et procédé de gestion de clé de chiffrement Ceased WO2015190014A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
JP2014122608A JP6092159B2 (ja) 2014-06-13 2014-06-13 暗号鍵管理装置および暗号鍵管理方法
JP2014-122608 2014-06-13

Publications (1)

Publication Number Publication Date
WO2015190014A1 true WO2015190014A1 (fr) 2015-12-17

Family

ID=54833134

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2014/083099 Ceased WO2015190014A1 (fr) 2014-06-13 2014-12-15 Dispositif de gestion de clé de chiffrement et procédé de gestion de clé de chiffrement

Country Status (2)

Country Link
JP (1) JP6092159B2 (fr)
WO (1) WO2015190014A1 (fr)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH11212922A (ja) * 1998-01-22 1999-08-06 Hitachi Ltd パスワード管理、回復方式
US20030182584A1 (en) * 2002-03-22 2003-09-25 John Banes Systems and methods for setting and resetting a password
JP2004201038A (ja) * 2002-12-18 2004-07-15 Internatl Business Mach Corp <Ibm> データ記憶装置、これを搭載した情報処理装置及びそのデータ処理方法並びにプログラム
JP2008148095A (ja) * 2006-12-12 2008-06-26 Buffalo Inc 記憶装置及び利用者認証方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH11212922A (ja) * 1998-01-22 1999-08-06 Hitachi Ltd パスワード管理、回復方式
US20030182584A1 (en) * 2002-03-22 2003-09-25 John Banes Systems and methods for setting and resetting a password
JP2004201038A (ja) * 2002-12-18 2004-07-15 Internatl Business Mach Corp <Ibm> データ記憶装置、これを搭載した情報処理装置及びそのデータ処理方法並びにプログラム
JP2008148095A (ja) * 2006-12-12 2008-06-26 Buffalo Inc 記憶装置及び利用者認証方法

Also Published As

Publication number Publication date
JP6092159B2 (ja) 2017-03-08
JP2016005031A (ja) 2016-01-12

Similar Documents

Publication Publication Date Title
CN1939028B (zh) 从多个设备存取网络存储器上的保护数据
US8423764B2 (en) Method and apparatus for key revocation in an attribute-based encryption scheme
CN110868301B (zh) 一种基于国密算法的身份认证系统及方法
JP5670272B2 (ja) 情報処理装置、サーバ装置およびプログラム
JP6667371B2 (ja) 通信システム、通信装置、通信方法、及びプログラム
CN101924739A (zh) 一种软件证书及私钥的加密存储并找回的方法
CN113282944A (zh) 智能锁开启方法、装置、电子设备及存储介质
CN105637802A (zh) 密钥装置、密钥云系统、解密方法、以及程序
CN105281902B (zh) 一种基于移动终端的Web系统安全登录方法
JP6426520B2 (ja) 暗号鍵管理システムおよび暗号鍵管理方法
KR101809976B1 (ko) 다중 사용자의 인증요소를 조합하여 보안키를 생성하는 보안인증방법
EP3144838A1 (fr) Système de sécurité, dispositif de gestion, dispositif d&#39;autorisation, dispositif terminal, procédé de sécurité et programme
KR20200067987A (ko) 로그인 제어 방법
CN100514333C (zh) 一种数据库安全访问方法和系统
JP2017108237A (ja) システム、端末装置、制御方法、およびプログラム
KR102053993B1 (ko) 인증서를 이용한 사용자 인증 방법
JP4794970B2 (ja) 秘密情報の保護方法及び通信装置
CN113282945B (zh) 智能锁权限管理方法、装置、电子设备及存储介质
CN114726544B (zh) 获取数字证书的方法以及系统
JP6092159B2 (ja) 暗号鍵管理装置および暗号鍵管理方法
CN115720137B (zh) 一种信息管理的系统、方法以及装置
CN106790185B (zh) 基于cp-abe的权限动态更新集中信息安全访问方法和装置
CN108345801B (zh) 一种面向密文数据库的中间件动态用户认证方法及系统
KR101449680B1 (ko) 사용자 인증 방법 및 사용자 인증 서버
JP2016163198A (ja) ファイル管理装置、ファイル管理システム、ファイル管理方法及びファイル管理プログラム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14894290

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14894290

Country of ref document: EP

Kind code of ref document: A1