Encryption control apparatus

• US 20020016914A1
• Filed: 12/12/2000
• Published: 02/07/2002
• Est. Priority Date: 06/29/2000
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Hashimoto, Shigeru, Kawasaki, Yusuke, Yanagi, Ryoichi, Seki, Yuji
• Granted Patent: US 6,993,654 B2
• Time in Patent Office: Days
• US Class Current: 713/172
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 7/082 Features insuring the integrity of the data on or in the card
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

An encryption control apparatus for encrypting and decrypting data that ensures data security by preventing illegal deciphering or leakage of the data is provided. A CPU 11A for running a program, a ROM 13A for storing the program run by the CPU, a RAM 12A used as a work area while the CPU is running the program, an I/O section 14A for sending/receiving data to/from an external device, and an encryption section 15A for decrypting encrypted data and encrypting plain text data are formed on a single semiconductor device.

Claims

1. An encryption control apparatus, comprising:

a CPU for running a program;

a ROM for storing the program run by the CPU;

a RAM used as a work area while the CPU is running the program;

an I/O section for sending/receiving data to/from an external device; and

an encryption section for decrypting encrypted data and encrypting plain text data,

wherein each of the foregoing components is formed on a single semiconductor device.

2. The encryption control apparatus according to claim 1, wherein:

the RAM stores a private key used in decrypting the encrypted data;

the ROM stores data specifying a party having an authorization to use the encryption control apparatus; and

the encryption control apparatus has a standby mode for waiting for data to be received from an external and an enable mode for enabling an operation, and further comprises mode switching means for decrypting encrypted data sent from the external in the standby mode with the private key stored in the RAM so that the plain text data is restored, the switching means also checking whether the plain text data coincides with the data stored in the ROM, and switching the encryption control apparatus to the enable mode or back to the standby mode depending on coincidence and discrepancy of the data.

3. The encryption control apparatus according to claim 2, wherein:

the ROM stores a plurality of main programs run in the enable mode; and

the encryption control apparatus further comprises main program selecting means for selecting one of the plurality of main programs run in the enable mode based on the data sent from the external in the standby mode.

4. The encryption control apparatus according to claim 1, further comprising an authentication section, formed on the single semiconductor device, for sending/receiving data to/from an external information processing device that carries out information processing based on data sent/received to/from the encryption control apparatus, the authentication section also authenticating a data sender party to judge whether the data sender party is an authorized party.

5. The encryption control apparatus according to claim 1, further comprising key generating means for generating a key used in encrypting and decrypting data, so that the encryption control apparatus encrypts and decrypts the data with the key generated by the key generating means.

6. The encryption control apparatus according to claim 5, wherein the key generating means generates a private key and a public key, and sends the public key alone to an external and stores the private key in the RAM.

7. The encryption control apparatus according to claim 4, wherein:

the RAM stores a private key used in decrypting the encrypted data;

the ROM stores data for specifying a party having an authorization to use the encryption control apparatus; and

the encryption control apparatus further comprises I/O section control means for decrypting the encrypted data received in the authentication section with the private key stored in the RAM so that plain text data is restored, the I/O section control means also checking whether the plain text data coincides with the data stored in the ROM, and enabling the I/O section only when coincidence of the data is confirmed.

8. The encryption control apparatus according to claim 7, wherein:

the single semiconductor device includes a plurality of the I/O sections mounted thereon; and

the I/O section control means enables an I/O section corresponding to the data received by the authentication section based on the authentication data.

9. The encryption control apparatus according to claim 7, wherein:

the I/O section is allowed to be set to an arbitrary security level among a plurality of security levels; and

the I/O section control means sets the I/O section to a security level corresponding to the data received in the authentication section based on the data.

10. The encryption control apparatus according to claim 4, wherein the authentication section sends/receives the data to/from the external information processing device through a modem.

11. The encryption control apparatus according to claim 1, further comprising data destroying means for;

upon receipt of abnormality detection, destroying a key stored in the RAM.