Information processing apparatus, encryption apparatus, and control method

• US 10,038,556 B2
• Filed: 03/22/2016
• Issued: 07/31/2018
• Est. Priority Date: 03/24/2015
• Status: Active Grant

• Current Assignee: Canon Kabushiki Kaisha (Canon Inc.)
• Original Assignee: Canon Kabushiki Kaisha (Canon Inc.)
• Inventors: Akiba, Tomohiro
• Primary Examiner(s): Revak, Christopher
• Application Number:
  US15/077,541
• Publication Number:
  US 20160285632A1
• Time in Patent Office: 861 Days
• Field of Search: None
• CPC Class Codes: G09C 1/00 Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system cryptographic typewriters G09C3/00
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

An information processing apparatus includes a storage unit, an encryption processing unit that encrypts data to be stored in the storage unit, and a control unit that stores a first key in a unit different from the encryption processing unit, wherein the first key, which is used to decrypt data encrypted by the encryption processing unit and stored in the storage unit, is encrypted using a second key set in the encryption processing unit.

Claims

1. An information processing apparatus comprising:

an encryption processing device, which is configured to connect to a storage memory, encrypt data to be stored in the storage memory and decrypt the encrypted data read from the storage memory; and

a control unit configured to perform control to back-up a first key into a memory unit which is different from the encryption processing device, wherein the first key, which is used to decrypt data encrypted by the encryption processing device and stored in the storage memory, is encrypted using a second key set in the encryption processing device,

wherein, during an initialization process after the control unit is powered on, the control unit obtains an initial key from the encryption processing device and checks whether the data stored in the storage memory can be decrypted by using the initial key by determining whether data read from a specific area of the storage memory and decrypted by using the initial key coincides with predetermined data,

wherein, in a case where a check result indicates the data stored in the storage memory can be decrypted by using the initial key, the control unit backs-up the initial key encrypted by using the second key in the memory unit which is different from the encryption processing device, and

wherein, in a case where the check result does not indicate the data stored in the storage memory can be decrypted by using the initial key, the control unit acquires a back-up key which has been stored in the memory unit, and replace the initial key in the encryption processing device by the acquired back-up key.

2. The information processing apparatus according to claim 1, wherein the second key is set in the encryption processing device according to a command from the control unit.

3. The information processing apparatus according to claim 1, wherein the control unit checks a consistency between the first key and the data stored in the storage device, and

wherein, based on the control unit having checked that there is the consistency, the control unit stores the initial key encrypted using the second key in the memory unit different from the encryption processing unit.

4. The information processing apparatus according to claim 3, wherein the control unit checks the consistency between the initial key and the data stored in the storage memory by determining whether data read from a specific area of the storage memory coincides with specific data.

5. The information processing apparatus according to claim 1, wherein the control unit checks a consistency between the initial key and the data stored in the storage memory, and

wherein, based on the control unit having checked that there is no consistency, the control unit acquires the first key encrypted using the second key and is stored in the memory unit different from the encryption processing device, and sets the acquired first key in the encryption processing device.

6. The information processing apparatus according to claim 1, wherein the encryption processing device encrypts, according to a command from the control unit, the data to be stored in the storage memory using the first key.

7. The information processing apparatus according to claim 1, wherein the encryption processing device decrypts, according to a command from the control unit, data read from the storage device using the first key.

8. The information processing apparatus according to claim 1, wherein the storage memory is an auxiliary storage device.

9. The information processing apparatus according to claim 1, wherein the encryption processing device further includes a key storage memory configured to store the first key.

10. A method for controlling an information processing apparatus including an encryption processing device, which is configured to connect to a storage memory, encrypt data to be stored in the storage memory, the method comprising:

backing-up a first key, encrypted using a second key set in the encryption processing device, into a memory unit different from the encryption processing device, wherein the first key is used to decrypt data that encrypted by the encryption processing device and stored in the storage unit,

wherein, during an initialization process obtains an initial key from the encryption processing device and checks whether the data stored in the storage memory can be decrypted by using the initial key by determining whether data read from a specific area of the storage memory and decrypted by using the initial key coincides with predetermined data,

wherein, in a case where a check result indicates the data stored in the storage memory can be decrypted by using the initial key, backs-up the initial key encrypted by using the second key in the memory unit which is different from the encryption processing device, and

wherein, in a case where the check result does not indicate the data stored in the storage memory can be decrypted by using the initial key, acquires a back-up key which has been stored in the memory unit, and replace the initial key in the encryption processing device by the acquired back-up key.