Patent Application
20100011226
The present invention relates to a data management technique for managing encrypted files.
Electronic data is occasionally stored and managed in an encrypted manner due to its confidentiality or the necessity to restrict its copying and reproduction in terms of copyright protection. One problem associated with data encryption is that when encrypted data is stored on a portable storage device and its encryption key is managed in a correlated manner with a particular host device, that storage device cannot be used with other host devices. Even when the encryption key is to be stored on that storage device, the encryption key fails to serve the purpose of data protection if information associated with the key can be copied easily onto other storage devices. In response to such problems, a large number of systems or storage devices have been proposed that store encryption keys and their associated information in a special limited-access area. Patent Document 1 (JP-A-2007-96817), for example, discloses a storage device and host device of that kind.
Possible methods for encrypting electronic data on a storage device include encrypting all the electronic data with a single encryption key and encrypting data by assigning an encryption key to each file or folder. In addition, there are cases where a file is divided into several areas, and the divided file areas are managed with different encryption keys or under different requirements for using the encryption keys. Non-Patent Document 1 (SAFIA (Security Architecture for Intelligent Attachment) Recording and Playback Device for iVDR-TV Recording Specification Version 1 2 0 http://www.safia-lb.com/doc/spec/SAFIA_RPD_TV_V120—20080221.pdf, 2008) describes a method for dividing a digital broadcast content into areas smaller than an area for a certain reproduction time and encrypting the divided areas with different encryption keys. This method has a problem that the areas that require the different encryption keys need to be clearly recorded, and the encryption keys need to be correctly associated with the areas without an error. As a technique to avoid the above problem, a file system that incorporates the concept of “named stream” has been put to practical use. As an example of the file system, Non-Patent Document 2 (Optical Storage Technology Association (OSTA) Universal Disk Format Specification Revision 2.00 http://www.osta.org/specs/pdf/udf200.pdf, 1998) describes a file system standard that defines a named stream.
Occasionally, encrypted data and its encryption keys need to be separately stored on different storage devices. In the case of data management by coupling encrypted data and its encryption keys within a single storage device, it is convenient to write related coupling information in a named data stream. However, when multiple encryption keys are used for encrypting data in a single file, its data management may become complex, unless management data closely related to the encrypted data is used, due to the necessity to record the coupling information between the encrypted data and the keys. In addition, when encryption keys are stored on different storage devices, it is difficult to correctly locate, with the use of a named stream of one of the storage devices, the key storage locations of the other storage devices. Thus, the challenge the invention is to meet is to separately manage encrypted data and its encryption keys with different storage devices such that the data and the keys are correctly retrieved without mismatches at a later time.
According to an aspect of the present invention, a data management method is performed by a first storage device and a host device connected with the first storage device and with a second storage device different from the first storage device. The first storage device stores an encrypted data block, predetermined information including key data for decrypting the encrypted data block and including a requirement for using the encrypted data block, and first management information that is used to manage the encrypted data block and includes a first address at which the predetermined information is stored. The data management method comprises the steps of: transferring the predetermined information from the first storage device to the second storage device by means of the host device; storing, in the second storage device, second management information including a second address at which the transferred predetermined information is stored, the second address being included in the second storage device; and deleting the first address that indicates an area storing the predetermined information and is included in the first management information stored in the first storage device.
According to another aspect of the present invention, in the data management method, the encrypted data block is obtained by dividing data required to be protected into a plurality of data pieces and encrypting the divided data pieces with the key data, and the host device causes an identifier for identifying an association between the first management information and the second management information to be included in the second management information, causes the second management information including the identifier to be stored in the second storage device, and overwrites the identifier in the first address in order to delete the predetermined information stored in the first address.
According to still another aspect of the present invention, a data management method is performed by a first storage device and a host device connected with the first storage device and with a second storage device different from the first storage device. The first storage device stores an encrypted data block and first management information used to manage the encrypted data block. The second storage device stores predetermined information and second management information. The predetermined information includes key data for decrypting the encrypted data block and includes a requirement for using the encrypted data block. The second management information associates the encrypted data block with a first address at which the predetermined information is stored. The data management method comprises the step of performing either one of a first process of transferring the predetermined information from the second storage device to the first storage device by means of the host device and causing the transferred predetermined information to be included in the first management information stored in a second address of the first storage device and a second process of transferring the encrypted data block and the first management information from the first storage device to the second storage device by means of the host device and causing the first address to be included in the transferred first management information to delete either one of a set of the encrypted data block and the first management information that are included in the first storage device, and a set of the predetermined information and the second management information that are included in the second storage device.
According to still another of the present invention, a data management system comprises: a first storage device storing an encrypted data block, predetermined information including key data for decrypting the encrypted data block and a requirement for using the encrypted data block, and first management information that is used to manage the encrypted data block and includes a first storage address at which the predetermined information is stored; a second storage device different from the first storage device; and a host device connected with the first and second storage devices and having a transfer section, a storage section and a deletion section, the transfer section being adapted to transfer the predetermined information from the first storage device to the second storage device, the storage section being adapted to cause second management information including a second storage address at which the transferred predetermined information is stored and which is included in the second storage device to be stored in the second storage device, the deletion section being adapted to delete the first storage address that indicates an area storing the predetermined information and is included in the first management information stored in the first storage device.
According to still another aspect of the present invention, a data storage system comprises: a first storage device having an area for storing an encrypted data block and an area for storing first management information used to manage the encrypted data block; and a second storage device that is different from the first storage device and has an area for storing predetermined information including key data for decrypting the encrypted data block and a requirement for using the encrypted data block and an area for storing second management information that includes information on a storage address of the area for storing the predetermined information and is associated with the first management information.
According to the present invention, encrypted data and an encrypted key used for the encrypted data can be separately managed.
These and other features, objects and advantages of the present invention will become more apparent from the following description when taken in conjunction with the accompanying drawings wherein:
Described hereinafter are preferred embodiments of the invention in which encrypted data to be protected and its encryption key information are separately managed with different storage devices.
The storage device 113 includes an interface 114 that controls the interface 115 connected to the host device 101; a storage module 116 of a tamper-resistant structure; and an open-access storage unit 120. The storage module 116 has a. The storage module 116 has a license transfer unit 117, a limited-access storage unit controller 118 and a limited-access storage unit 119. The open-access storage unit 120 does not restrict data writing thereon and data reading therefrom. By the user specifying a particular position inside the open-access storage unit 120 from the host device 101 via the interface 115, data can be freely written on or read from that position. In contrast, the limited-access storage unit 119 stores particular management information called a license. The license is encrypted by the license transfer unit 117 of the storage device 113 and by the license transfer unit of another device (e.g., the license transfer unit 107 of the host device 101) in accordance with predetermined authentication and transfer procedures. The limited-access storage unit 119 stores this encrypted license. Thus, the limited-access storage unit 119 does restrict data writing thereon and data reading therefrom, contrary to the open-access storage unit 120. The limited-access storage unit controller 118 is a control device for controlling license writing on and license reading from the limited-access storage unit 119 and controlling the operation of the license transfer unit 117.
The storage device 121 is the same as the storage device 113 in terms of configuration and operation and will not be discussed further.
The storage module 106 provided in the host device 101, a counterpart of the storage module 116, includes the license management unit 108 as stated above. The license management unit 108 manages licenses as data; for example, it restricts license transfer performed by the license transfer unit 107 and overwrites transfer records. Because the host security manager 105 is not intended as a storage unit, it does not require a memory area such as the limited-access storage unit 119.
When the host device 101 needs to store data in an encrypted manner on the storage device 113, the data is first encrypted by the content encryption/decryption unit 109, and the encrypted data is then stored on the open-access storage unit 120. Encryption keys used for the encryption and information such as on an initial vector are embedded in license information newly created by the license management unit 108. The license information also includes license IDs for identifying respective licenses and use conditions such as prohibition or restriction of license duplication. Licenses are stored by being transferred from the license transfer unit 107 of the host device 101 to the license transfer unit 117 of the storage device 113 through a safe communication method that prevents the licenses from being eavesdropped, falsified, and tampered.
There are cases where data to be protected is divided into multiple sections, and those sections are managed by different encryption keys and under different use conditions. For an easier understanding of later explanations, described next with reference to
In
A block information stream 202 (hereinafter referred to as Block_Info 202) and a license information stream 803 (hereinafter referred to as Lic_Info 803) are provided as management information so as to manage in a correlated manner each of the data blocks in the data stream 201 and their respective licenses. The Block_Info 202 retains information on the divided data blocks in the data stream 201 and on their respective licenses. The Block_Info 202 is a collection of fixed pattern data that is divided on an entry-by-entry basis. The Entry #1 (209) section of the Block_Info 202 retains information on the start and end positions of Block #1 (206) of the data stream 201 and on License ID (210) that identifies a corresponding license, that is, License #1. The Start and end positions of the other blocks of the data stream 201 and the licenses for the other blocks can be identified by referencing the entries #2 (211) to #x (213) of the Block_Info 202 in the same manner as the entry #1 (209). The Block_Info 202 specifies the licenses by means of the license IDs that are identifiers and indicate license information. Thus, the Block_Info 202 does not have information that indicates a storage area storing each of the licenses and included in the limited-access storage unit 119. The license IDs and storage addresses (storage areas) that are included in the limited-access storage unit 119 and store the respective licenses are described in the stream Lic_Info 803. The stream Lic_Info 803 is divided into predetermined license information. The license information includes license location information #1 (815), license location information #2 (818), . . . , and license location information #x (821). The license location information #1 (815), #2 (818), . . . , and #x (821) have license ID fields (816), (819) and (822) and address fields (817), (820), . . . , and (823), respectively. The license IDs are described in the respective license ID fields (816), (819), . . . , and (822). Addresses at which the licenses are stored in the limited-access storage unit 119 are described in the address fields (817), (820), . . . , and (823), respectively. Therefore, the license for Block #2 of the data stream 201 can obtain the license ID 212 from the entry #2 (211) of the Block_Info 202. In addition, the license for Block #2 of the data stream 201 can obtain the address #2 (820) indicative of the storage area of the limited-access storage unit 119 from the license location information #2 (818).
Next, a description is made of a static management method performed under the condition that data to be protected and information on an encryption key for the data are separated and stored in different storage devices, with reference to
When the data stream 201 shown in
According to the present embodiment, it is possible to store encrypted data and encryption keys in different storage devices and manage the encrypted data and the encryption keys.
According to the present embodiment, since tag data capable of being mutually referenced is added to management information included in encrypted data and to management information used to manage a storage area for storing an encryption key, the storage areas can be included in a single storage device or can be included in different storage devices without disturbing a relationship between the encrypted data and the encryption key.
The second embodiment is described below. In the first embodiment, the Lic_Info_Tag 215 and the Lic_Info_Ptr 205 are stored in the storage device 113 and in the storage device 121, respectively, and the same TAG #i is stored in the storage devices 113 and 121 as an identifier to reference the license location information included in the Lic_Info_Tag 215 and in the Lic_Info_Ptr 205. However, when the process for separating a storage area at which a data stream is stored from a storage area at which a license is stored, or the process for integrating a storage area at which a data stream is stored with a storage area at which a license is stored, is performed on the first to last blocks of the data stream in this order as a rule, it is not necessary that the TAG #i be stored. In the second embodiment, the address field of the Lic_Info_Tag 203 does not include tag data and is empty, and the Lic_Info_Ptr 205 does not include a tag field.
According to the second embodiment, a process related to tag data is not necessary. It is therefore possible to easily perform the process for separating a storage area at which a data stream is stored from a storage area at which a license is stored, and the process for integrating a storage area at which a data stream is stored with a storage area at which a license is stored.
The third embodiment is described below. In the third embodiment, either one or both of the storage devices 113 and 121 is or are remotely connected to the host device through a network. It is general that the interfaces 115 and 122 shown in
In accordance with the embodiments, since storage devices and a host device only need be remotely connected through a network, the storage devices need not necessarily be portable, thus increasing the latitude in selecting storage devices to be used.
In accordance with the above-described embodiments of the invention, encrypted data and its encryption keys are separately managed with different storage devices. Thus, even when data is encrypted in a divided manner with multiple encryption keys or under multiple encryption conditions, the encrypted data and the encryption keys can be separately handled without affecting the mutual relation between the encryption positions and their corresponding encryption/decryption keys. This provides the following advantages over the case where encrypted data and its encryption keys are managed with a single storage device.
First, by encrypting confidential data with encryption keys and managing the data and the keys with different storage devices, the data and its encryption/decryption keys can be distributed easily via different routes at different times. Documents files to be opened by a particular recipient are often distributed in this manner.
Secondly, when electronic content, such as images and music, whose intellectual properties need to be protected is distributed for sale, what is called a superdistribution service model can be realized in which only its encrypted data is distributed in advance over the Internet or with portable media and its encryption keys necessary for playing the data are thereafter sold at a certain price.
Moreover, the invention advantageously increases the user's latitude in protecting data. For example, the user can back up only encrypted files or only encryption keys onto several storage devices.
Furthermore, since encrypted data and its encryption/decryption keys can be separately distributed in order for the electronic information in the data to be protected from unauthorized copying or the like, the latitude in handling confidential or copyrighted data can be increased. Thus, the invention is applicable to information security management within a firm or to business-to-consumer data delivery services.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2008-182572 | Jul 2008 | JP | national |
