JP5015081B2 - Electronic pen for encrypting acquired data, method for controlling the electronic pen, and information system including the electronic pen - Google Patents

Description

  The technology disclosed in the present specification relates to data wiretapping prevention technology in an information system, and particularly relates to data encryption technology in an information system using an electronic pen.

  As a data encryption technique in an information system, there is a technique described in Patent Document 1. According to Patent Document 1, image data captured by a camera is encrypted and stored in the camera.

Further, as a data encryption technique in an information system, there is a technique described in Non-Patent Document 1. WPA-PSK described in Non-Patent Document 1 is a technique for encrypting data on a network. According to this, an encryption key is generated immediately before encryption, and the encryption key is changed for each frame.
JP 2007-288383 A “(Revised in 2007) to use wireless LAN safely” [online], December 2007, Ministry of Internal Affairs and Communications, [Search June 10, 2008], Internet <URL: http: / /www.soumu.go.jp/joho_tsusin/pdf/071214_1_bt.pdf>

  Even if the above-described conventional techniques are combined, it is possible to consistently cover the encryption of data in the data creating apparatus, which is a data generation source when not connected to the network, and the encryption of the data on the network. Can not. Furthermore, the mere combination of the above-described conventional techniques is difficult to realize when the resources of the data creation device are scarce.

A representative invention disclosed in the present application is an electronic pen that acquires data including coordinate information of a locus of a pen tip, encrypts and outputs the acquired data, and stores the acquired data, A processor connected to the memory; and a power supply unit that supplies power to the memory and the processor, and after starting the acquisition of the data , a predetermined event indicating interruption of writing using the electronic pen It is determined whether or not it is detected, and when the predetermined event is detected, encrypted data is generated by encrypting the retained data, and the encrypted data is output, said predetermined event, said electronic pen Finally the data that has passed a predetermined time after obtaining the or the electronic pen is to power down request is input And butterflies.

  According to an embodiment of the present invention, even when the data creation device that is the source of data has few resources, the data creation device is encrypted in a state where it is not connected to the network, and the data on the network is Encryption can be covered consistently, thereby preventing data eavesdropping.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a block diagram showing the overall system configuration of an embodiment of the present invention.

  The present embodiment is an electronic pen system that prints a form format on paper together with a dot pattern, and reads the dot pattern printed on the paper with an electronic pen to convert handwritten characters or figures into electronic data. In this electronic pen system, the electronic pen client 111, the data distribution server 121, the data processing server 131, and the data processing server 141 are connected via the network 103, and data can be transmitted and received between the devices.

  The electronic pen 101 is realized, for example, by the technique described in International Publication No. 2003/001440 pamphlet. According to this technology, a special electronic pen 101 and an electronic pen-compatible form on which a dot pattern is printed are used, and the locus of characters and figures written on the electronic pen-compatible form using the electronic pen 101 is obtained. It can be vectorized and stored and transmitted.

  Although only one electronic pen 101 is shown in FIG. 1, the electronic pen system of the present embodiment may include a plurality of electronic pens 101.

  FIG. 2 is a diagram for explaining the configuration and functions of the electronic pen 101.

  A dot pattern 201 is printed on the electronic pen-compatible form 102. The dots are printed for each lattice point at a constant interval, but the position is shifted from the lattice point by a predetermined distance. The electronic pen 101 emits the light of the light emitting diode 202 onto the printing surface of the dot pattern 201 and reads the dot pattern 201 with the built-in camera 203, so that the pen tip of the electronic pen 101 is positioned in the dot pattern space. It is possible to accurately specify the absolute coordinates.

  In order to facilitate the management of the dot pattern space, the dot pattern space is divided into a predetermined size such as a paper size standard, and a dot pattern unique identifier is assigned to each section. The electronic pen 101 also outputs a dot pattern unique identifier of the read dot pattern 201. Here, it is assumed that a dot pattern unique identifier is assigned to each page of the electronic pen-compatible form 102, and this dot pattern unique identifier is referred to as PageID.

  The electronic pen 101 includes a light emitting diode 202, a camera 203, an ink cartridge 204, a writing pressure sensor 205, a processor 206, a memory 207, a clock 208, a battery 209, and a communication device 210.

  The camera 203 reads the dot pattern only when the writing pressure sensor 205 is sensing pressure, and the processor 206 acquires the position information of the pen tip based on the dot pattern. That is, the processor 206 digitizes and acquires the trajectory of characters or figures written on the electronic pen correspondence form 102 by the electronic pen 101. This digital trajectory information is stored in the memory 207 in time series as written data, and is transmitted to a predetermined device by the communication device 210 at a certain timing.

  For example, writing data may be transmitted in response to writing with the electronic pen 101 in the area of the transmission box 211. When the electronic pen 101 recognizes that the area of the transmission box 211 is a special coordinate area and acquires the coordinates of the area, the electronic pen client 111 stores the writing data accumulated so far via the communication device 210. Send to.

  The battery 209 is a power supply unit that supplies power to each unit (for example, the light emitting diode 202, the camera 203, the processor 206, and the memory 207) in the electronic pen 101.

  When the power-off request is input, the electronic pen 101 turns off the power (that is, stops supplying power to each unit by the battery 209). When the power-on request is input, the electronic pen 101 turns off the power. (I.e., supply of power to each unit by the battery 209 is started).

  A request to turn off the electronic pen 101 is input by, for example, putting a cap (not shown) on the pen tip. The power-on request for the electronic pen 101 is input by, for example, removing a cap (not shown) from the pen tip.

  Since the memory 207 is non-volatile, the stored data does not disappear even when the power is turned off. When the memory 207 runs out of capacity, the electronic pen 101 notifies the user using an output device (not shown).

  When the processor 206 sequentially reads and executes the programs in the memory 207, the electronic pen PG 212 serving as a processing unit functions. Specific operations of the electronic pen PG 212 will be described later.

  Furthermore, the memory 207 holds a writing data management table 213, an encrypted writing data management table 214, a key storage unit 215, and a data distribution server information storage unit 216.

  The key storage unit 215 is an area for storing an encryption key used for encrypting handwritten data.

  The data distribution server information storage unit 216 is referred to when the electronic pen client 111 transmits handwritten data. When the electronic pen client 111 transmits the writing data, the electronic pen client 111 inquires the data distribution server 121 to which data processing server the writing data should be transmitted. The data distribution server information storage unit 216 is an area for storing information for identifying the data distribution server 121 that is the inquiry destination.

  FIG. 3 is a diagram illustrating the configuration of the writing data management table 213 according to the embodiment of this invention.

  The writing data management table 213 is a table for accumulating writing data, and stores “writing data”. “Writing data” is data including attributes as well as the digital trajectory information described above. For example, in addition to the digital trajectory information described above, the written data includes a PageID that identifies the page to which the coordinates included in the digital trajectory information belong, information indicating the time when the digital trajectory information was acquired, and the digital trajectory information. Information indicating the writing pressure when is acquired may be included.

  FIG. 4 is a diagram illustrating the configuration of the encrypted writing data management table 214 according to the embodiment of this invention.

  The encryption writing data management table 214 is a table for storing encrypted writing data, and stores “encryption writing data”. The “encrypted handwritten data” is data including the attribute as well as the encrypted digital trajectory information.

  The electronic pen client 111 is a computer device that relays writing data transmitted from the electronic pen 101 to a data processing server. The electronic pen client 111 includes a CPU 112, a communication device 113, a communication device 114, a storage device 115, and a control device (not shown) that controls data communication between them.

  The communication device 113 is an interface connected to the electronic pen 101 by wireless communication or wired communication. The communication device 114 is an interface connected to the network 103.

  Note that the electronic pen 101 needs to be connected to the communication device 113 when transmitting writing data, but need not always be connected to the communication device 113. In general, the electronic pen 101 is disconnected from the communication device 113 while acquiring writing data.

  When the CPU 112 sequentially reads and executes the programs in the storage device 115, the electronic pen client PG 116 serving as a processing unit functions. The specific operation of the electronic pen client PG 116 will be described later.

  The data processing server 131 is a computer device that uses handwritten data transmitted from the electronic pen client 111. The data processing server 131 may use the written data in any way. For example, the data processing server 131 may convert the written data into text data using a character recognition technique, and then process the text data with an application program (not shown) similar to the conventional one. The data processing server 131 includes a CPU 132, a communication device 133, a storage device 134, and a control device (not shown) that controls data communication between them.

  The communication device 133 is connected to the network 103.

  When the CPU 132 sequentially reads and executes the programs in the storage device 134, the data processing server PG135 that functions as a processing unit functions. Specific operations of the data processing server PG135 will be described later.

  The storage device 134 further holds a key pair storage unit 136. The key pair storage unit 136 is an area for storing a public key encryption key pair (that is, a pair including a public key and a secret key corresponding to the public key).

  Similar to the data processing server 131, the data processing server 141 is a computer device that uses handwritten data transmitted from the electronic pen client 111. The data processing server 141 includes a CPU 142, a communication device 143, a storage device 144, and a control device (not shown) that controls data communication between them.

  The communication device 143 is connected to the network 103.

  In addition, the CPU 142 sequentially reads and executes the programs in the storage device 144, so that the data processing server PG145 serving as a processing unit functions. Since the specific operation of the data processing server PG145 is the same as that of the data processing server PG135, description thereof is omitted.

  The storage device 144 further holds a key pair storage unit 146. Similar to the key pair storage unit 136, the key pair storage unit 146 is an area for storing a key pair for public key encryption. However, the key pair storage unit 136 and the key pair storage unit 146 store key pairs used by the data processing server 131 and the data processing server 141, respectively.

  Although two data processing servers are shown in FIG. 1, the electronic pen system of the present embodiment may include only one data processing server, or may include three or more data processing servers.

  The data distribution server 121 is a computer device that answers an inquiry from the electronic pen client 111 so that the electronic pen client 111 can transmit writing data to an appropriate data processing server. The data distribution server 121 includes a CPU 122, a communication device 123, a storage device 124, and a control device (not shown) that controls data communication between them.

  The communication device 123 is connected to the network 103.

  When the CPU 122 sequentially reads and executes the programs in the storage device 124, the data distribution server PG125 that functions as a processing unit functions. The specific operation of the data distribution server PG125 will be described later.

  The storage device 124 further holds a key pair storage unit 126, a data processing server management table 127, and a page management table 128.

  The key pair storage unit 126 is an area for storing a public key encryption key pair.

  FIG. 5 is a diagram illustrating the configuration of the data processing server management table 127 according to the embodiment of this invention.

  The data processing server management table 127 is a table for managing data for allowing the data processing server to receive writing data in the electronic pen system, and stores the data processing server ID 701 and the public key 702 in association with each other. The data processing server ID 701 is an address that uniquely identifies each data processing server on the network 103. The public key 702 is a public key encryption public key used by each data processing server (that is, a public key corresponding to a secret key held by each data processing server).

  FIG. 6 is a diagram illustrating the configuration of the page management table 128 according to the embodiment of this invention.

  The page management table 128 is a table for managing a data processing server (in other words, a data processing server to which the electronic pen client 111 should transmit writing data) that should receive writing data for each page written with the electronic pen 101. The page ID 801 and the data processing server ID 802 are stored in association with each other.

  1 shows an example in which the electronic pen client 111, the data distribution server 121, the data processing server 131, and the like are realized by independent hardware, but these may be realized by the same hardware. .

  For example, if the data distribution server 121 has an interface equivalent to the communication device 113 and a program equivalent to the electronic pen client PG 116 is stored in the storage device 124, the data distribution server 121 may be used as the electronic pen client 111. Can be used.

  Alternatively, one of a plurality of data processing servers, for example, the storage device 134 of the data processing server 131, stores the data distribution server PG 125, the key pair storage unit 126, the data processing server management table 127, and the page management table 128 equivalent. If so, the data processing server 131 can also be used as the data distribution server 121.

  Next, a basic flow of processing of the electronic pen system will be described.

  FIG. 7 is a flowchart showing the entire processing of the electronic pen system according to the embodiment of the present invention.

  The process shown in FIG. 7 is started when the electronic pen system is introduced (step 301).

  In the data distribution server 121, when an administrator inputs an instruction using an input / output device (not shown), the data distribution server PG125 generates a key pair for public key encryption, and stores the generated key pair in the key pair storage unit 126. (Step 302).

  Also in the data processing server 131, when an administrator inputs an instruction using an input / output device (not shown), the data processing server PG 135 generates a key pair for public key encryption, and stores the generated key pair in the key pair storage unit 136. To do. Similarly, in the data processing server 141, the data processing server PG 145 generates a key pair and stores it in the key pair storage unit 146. When the electronic pen system further includes a data processing server (not shown) other than the above, a key pair generation process (step 302) in the data processing server is executed for each data processing server. Further, when a data processing server is added, a key pair generation process (step 302) is executed in the added data processing server.

  Next, the data processing server PG135 registers the public key Kau among the key pairs stored in the key pair storage unit 136 together with the data processing server ID of the data processing server in the data distribution server 121 (step 303). . The delivery of the public key from the data processing server to the data distribution server 121 may be performed manually by an administrator of each server using an input / output device (not shown) or automatically via the network 103. Also good. The data distribution server PG 125 stores the data processing server ID and public key pair in the data processing server management table 127.

  The data processing server PG 145 also executes the same process as described above at step 303.

  Next, an electronic pen activation process (see FIG. 8) is executed (step 304).

  FIG. 8 is a flowchart showing an electronic pen activation process executed in the embodiment of the present invention.

  The electronic pen activation process is executed for each electronic pen 101 at the start of use of the electronic pen 101. In advance, a data distribution server ID that is an address for uniquely identifying the data distribution server 121 on the network 103 is registered in the electronic pen client 111.

  First, the electronic pen PG 212 transmits an activation request to the connected electronic pen client 111 (step 401). This transmission may be executed by, for example, preparing an activation request box (not shown) in the same manner as the transmission box 211 and writing the activation request box in the electronic pen 101.

  Alternatively, the electronic pen PG 212 may determine whether or not the public key of the data distribution server 121 is stored in the electronic pen 101 when the power of the electronic pen 101 is turned on. When it is determined that the public key of the data distribution server 121 is not stored, the electronic pen PG 212 notifies the user that activation is necessary using the output device (not shown) of the electronic pen 101. Also good.

  Alternatively, the electronic pen PG 212 may determine whether or not the public key of the data distribution server 121 is stored in the electronic pen 101 when a writing data acquisition process described later is started. When it is determined that the public key of the data distribution server 121 is not stored, the electronic pen PG 212 may notify the user that activation is necessary using the output device of the electronic pen 101.

  Alternatively, when the electronic pen 101 is connected to the electronic pen client 111 before the writing data acquisition process is started, the electronic pen PG 212 or the electronic pen client PG 116 stores the public key of the data distribution server 121 in the electronic pen 101. It may be determined whether or not it is done. When it is determined that the public key of the data distribution server 121 is not stored, the electronic pen PG 212 or the electronic pen client PG 116 indicates that the activation is necessary, and the output of the electronic pen 101 or the electronic pen client 111 You may notify a user using an apparatus (illustration omitted).

  Alternatively, when the electronic pen PG 212 or the electronic pen client PG 116 determines that the public key of the data distribution server 121 is not stored as described above, the electronic pen PG 212 or the electronic pen client PG 116 determines whether to execute activation. This may be inquired to the user using the output device of the electronic pen 101 or the output device of the electronic pen client 111.

  The user who has received the above notification or inquiry determines whether or not to execute activation, and performs an operation for instructing activation when it is determined to execute the activation. This operation may be, for example, writing in an activation request box using the electronic pen 101 as described above, or input of a predetermined instruction to the electronic pen client 111. When a predetermined instruction is input to the electronic pen client 111, the instruction may be treated as an activation request in step 401.

  When the electronic pen client PG 116 receives the activation request (step 402), the electronic pen client PG 116 transmits the activation request to the registered data distribution server ID (step 403).

  When the data distribution server PG 125 receives the activation request (step 404), the data distribution server PG 125 corresponds to the public key Keu included in the key pair stored in the key pair storage unit 126 (ie, the secret key held by the data distribution server 121). To the electronic pen client 111 (step 405).

  When the electronic pen client PG 116 receives the public key Keu of the data distribution server 121 (step 406), the electronic pen client PG 116 returns the public key Keu together with the registered data distribution server ID to the connected electronic pen 101 ( Step 407).

  When receiving the public key Keu and the data distribution server ID of the data distribution server 121, the electronic pen PG 212 stores them in the data distribution server information storage unit 216 (step 408).

  Thereafter, the electronic pen PG 212 generates an encryption key used for encrypting the writing data, and stores the generated encryption key in the key storage unit 215 (step 409). Here, not the public key encryption but the common key encryption is used for encrypting the writing data. This is because the load for processing the common key encryption is smaller than the load for processing the public key encryption. Therefore, the encryption key generated in step 409 is the common key K1.

  Information (for example, the public key Keu and the common key K1) stored in the non-volatile memory 207 is retained even after the power is turned off unless it is intentionally deleted. For this reason, when the electronic pen activation process is once performed in the electronic pen 101 and then the power is turned off and then the power is turned on, it is not necessary to execute Step 401 to Step 408 again for the electronic pen 101. . For this reason, for example, after the power is turned on, the electronic pen 101 may determine whether or not it holds the public key Keu, and may execute steps 401 to 408 if not.

  However, as will be described later, in order to ensure the safety of data, the common key stored in the key storage unit 215 is deleted when the power of the electronic pen 101 is turned off. For this reason, when the power is turned on, the electronic pen PG 212 needs to execute Step 409 to generate a new common key.

  With reference to FIG. 7 again, the processing after the completion of step 304 will be described.

  After the execution of step 304 is completed, a writing data acquisition process (step 305) is executed. The writing data acquisition process is executed every time the electronic pen 101 is used for writing. Furthermore, when the electronic pen system of this embodiment includes a plurality of electronic pens 101, the writing data acquisition process is executed for each electronic pen 101.

  In step 305, the electronic pen PG 212 acquires writing data in time series by the method described above. The acquired writing data and the PageID corresponding to the writing data are stored in the writing data management table 213. When the PageID of the acquired writing data changes, the writing data acquired thereafter is stored in the writing data management table 213 as the next record. That is, one record of the writing data management table 213 stores writing data for one page.

  Next, the electronic pen PG 212 determines whether or not a predetermined event has been detected (step 308). Here, the predetermined event is an event that should be an opportunity to start encryption of handwritten data, for example, an event indicating that it is necessary to start encryption (or that necessity has increased). Or an event indicating that encryption can be executed (or has become easier). The fact that encryption can be executed (or easy) means that, for example, a writing data encryption process that does not affect the writing data acquisition process can be performed.

  For example, when a predetermined time has elapsed since the last writing data was acquired (in other words, when writing data was not acquired for a predetermined time), it is considered that the user of the electronic pen 101 has stopped writing. . Even when the processing capacity of the processor 206 is not high, the writing data can be encrypted without affecting the writing data acquisition process while writing is interrupted. That is, it can be said that interruption of writing by the user indicates that encryption can be executed (or easily). For this reason, the predetermined event may be, for example, that a predetermined time has elapsed since the last writing data was acquired.

  Even when a power-off request is input to the electronic pen 101, it can be said that encryption is possible (or easy) for the same reason as described above.

  Further, the power-off of the electronic pen 101 indicates the possibility that the user will leave the electronic pen 101. In such a case, if the electronic pen 101 holds writing data that is not encrypted, a third party may read the writing data. In order to prevent this, it is necessary to promptly encrypt the written data. That is, it can be said that the input of the power-off request indicates that the necessity of encryption has occurred (or the necessity has increased).

  For this reason, the predetermined event may be that a power-off request is input to the electronic pen 101 (that is, for example, the cap of the electronic pen 101 is attached).

  Furthermore, events other than those described above may be detected in step 308. For example, events indicating that it is necessary to execute encryption include that the remaining amount of the battery 209 has become equal to or less than a predetermined threshold, and that the free capacity of the memory has become equal to or less than the predetermined threshold. .

  If it is determined in step 308 that a predetermined event has been detected, the electronic pen PG 212 executes the writing data encryption process (see FIG. 9) because the timing for encrypting the writing data has arrived (step 306).

  On the other hand, if it is determined in step 308 that the predetermined event has not been detected, the electronic pen PG 212 waits for the detection of the predetermined event without executing the writing data encryption process yet. If the electronic pen 101 is used for writing until a predetermined event is detected, step 305 is executed.

  FIG. 9 is a flowchart showing the handwritten data encryption process executed in the embodiment of the present invention.

  The primary meaning of the electronic pen 101 is to acquire and store writing data with high accuracy. Cryptographic methods that prevent this are not allowed. In the present embodiment, since the processing capability of the electronic pen 101 is poor, it is assumed that writing data acquisition and encryption cannot be processed in parallel.

  The electronic pen 101 encrypts the writing data stored in the writing data management table 213 when writing data is not acquired, that is, when the processing of step 305 is not performed (step 306). For example, if the predetermined event in step 308 is that a predetermined time has elapsed since the last writing data was acquired, or that a power-off request has been input to the electronic pen 101, the processing in step 305 Encryption of handwritten data is executed when no data is being performed.

  While writing data exists in the writing data management table 213, step 306 is repeated. If the electronic pen 101 is used for writing during the process of step 306, the electronic pen PG 212 interrupts the process of step 306 and executes the process of step 305.

  The common key used for encryption of handwritten data is changed according to a certain rule. Holding the single common key for a long time by the electronic pen 101 lowers the security level. The target data encrypted with a single common key is called a unit. If the unit is too fine, the processing efficiency is poor. For example, in units of strokes (that is, writing data in units of one stroke) or units of sample points (coordinate data of one point), the efficiency is low. On the other hand, when a plurality of data processing servers use one unit, the same common key and data are held in the plurality of data processing servers, and as a result, the security level is lowered.

  On the other hand, if the unit is a page unit, for example, it is efficient and safe. In this embodiment, one record in the writing data management table 213 is handled as one unit. As a result, writing data acquired from one page (that is, writing data acquired from the start of writing on one page until the start of writing on another page) is one unit. Are treated as

  However, in order to ensure the security of the written data, it is desirable to encrypt the acquired written data as soon as possible. For this reason, when a predetermined time has elapsed since the last writing data was acquired, all data stored in the writing data management table 213 at that time (that is, data included in all records) is encrypted. May be. Such a process is realized when the predetermined event in step 308 is that a predetermined time has elapsed since the last writing data was acquired. In that case, the writing data acquired after the encryption is executed is treated as a unit different from the writing data acquired before the execution regardless of the PageID.

  Hereinafter, the writing data encryption process will be described step by step. All of this processing is executed by the electronic pen PG212.

  First, the electronic pen PG 212 reads the unit and PageID from the oldest record stored in the writing data management table 213, and encrypts each using the common key stored in the key storage unit 215 (step 501). . Here, the unit of the oldest record stored in the writing data management table 213 is expressed as Unit1, the common key stored in the key storage unit 215 is expressed as K1, and Unit1 encrypted by the common key K1 is expressed as K1 ( Unit1) and PageID encrypted with the common key K1 is denoted as K1 (PageID).

  Next, the electronic pen PG 212 encrypts the common key used for encryption in step 501 by using the public key Keu of the data distribution server 121 and the result of encrypting the encrypted common key in step 501. And stored in the encrypted writing data management table 214 (step 502). Here, since the common key used for encryption in step 501 is K1, data obtained as a result of encryption using the public key Keu is expressed as Keu (K1).

  Thereafter, the electronic pen PG 212 stores the record encrypted in step 501 (the record including Unit1 in the above example) from the writing data management table 213 and stores the common key (K1 in the above example) used for encryption as a key. The data is deleted from the unit 215 (step 503).

  Finally, the electronic pen PG 212 generates a common key used for encrypting new writing data and stores it in the key storage unit 215 (step 504). Here, the common key K2 is generated.

  When the electronic pen PG 212 receives a request to turn off the power of the electronic pen 101, the electronic pen PG 212 performs the above-described writing data after all the data has been encrypted, that is, until there is no record stored in the writing data management table 213. Turn off the power after executing the encryption process. Furthermore, it is desirable that the electronic pen PG 212 terminates encryption before reaching the capacity limit of the memory 207 and before the battery 209 runs out.

  In addition, even after the user turns off the power of the electronic pen 101, the fact that the electronic pen 101 continues to hold the common key significantly reduces the security level. For example, when the user leaves the electronic pen 101 whose power is turned off and leaves the desk, a third party (that is, a person who should not view the writing data acquired by the electronic pen 101) is common to the electronic pen 101. There is a possibility of reading the key. Thereafter, even if the user acquires writing data using the electronic pen 101 and encrypts it, the third party who has acquired the common key can easily decrypt the encrypted writing data.

  In order to prevent such a decrease in security level, it is desirable that the electronic pen 101 whose power is turned off not hold a common key. For example, when the handwritten data encryption process of FIG. 9 is executed because the power-off request is input in step 308, the execution of step 504 is omitted. As a result, the electronic pen 101 whose power is turned off does not hold the common key. Thereby, wiretapping of data by a third party can be prevented.

  The electronic pen PG 212 may create a plurality of common keys (that is, common keys to be used in the writing data encryption process after the next time) in Step 409 or Step 504. In this case, the key storage unit 215 stores a plurality of common keys. In this case, when the power of the electronic pen 101 is turned off, the electronic pen PG 212 deletes all the common keys stored in the key storage unit 215 in step 503 in order to ensure data safety as described above. To do.

  The above-mentioned handwritten data encryption processing may be executed when encryption is explicitly instructed by the user. Specifically, for example, as in the case of the transmission box 211, when the electronic pen 101 reads a predetermined dot pattern, writing is performed on the target page or all writing data held by the electronic pen 101. Data encryption processing may be performed.

  With reference to FIG. 7 again, the processing after the completion of the execution of step 306 will be described.

  When the execution of step 306 is completed, a writing data transfer process is executed (step 307).

  FIG. 10 is a flowchart showing the handwriting data transfer process executed in the embodiment of the present invention.

  The writing data transfer process is executed for each electronic pen 101.

  First, the electronic pen PG 212 converts all encrypted writing data stored in the encrypted writing data management table 214 together with the data distribution server ID stored in the data distribution server information storage unit 216 to the connected electronic pen client 111. After that, all the encrypted writing data stored in the encrypted writing data management table 214 is deleted (step 601). Here, the encryption writing data is K1 (Unit 1), K1 (PageID), and Keu (K1), which are transmitted and then deleted. Hereinafter, a case where the above-described encrypted writing data is transmitted will be described as an example.

  This transmission is executed, for example, when the electronic pen 101 writes in the transmission box 211. At this transmission timing, the electronic pen PG 212 confirms the presence of writing data in the writing data management table 213. If writing data exists, the electronic pen PG 212 executes the processing of step 306, thereby writing unencrypted writing. After the data is lost (that is, after all stored writing data is encrypted), the process of step 601 is executed.

  When the electronic pen client PG 116 receives the encrypted writing data and the data distribution server ID (step 602), the encrypted page ID (that is, K1 (PageID)) of the encrypted writing data and the encryption pen data used for the encryption are used. The result of encrypting the common key K1 with the public key Keu of the data distribution server 121 (that is, Keu (K1)) is transmitted to the data distribution server 121 identified by the received data distribution server ID (step 603).

  The data distribution server PG 125 receives the encrypted PageID (K1 (PageID)) and the common key (Keu (K1)) encrypted by Keu transmitted in Step 603 (Step 604). The encrypted common key (Keu (K1)) is decrypted with the secret key Ker in the key pair stored in the key pair storage unit 126, thereby obtaining the common key K1 (step 605).

  Next, the data distribution server PG 125 obtains the PageID by decrypting the encrypted PageID (K1 (PageID)) received at Step 604 with the common key K1 obtained at Step 605 (Step 606). .

  Further, the data distribution server PG 125 encrypts the common key K1 obtained in step 605 with the public key Kau of the data processing server corresponding to the PageID obtained in step 606 (step 607). The data processing server corresponding to the PageID obtained in step 606 is a data processing server that should process the writing data to be transmitted from now on, that is, a data processing server to be a transmission destination of the writing data to be transmitted from now. .

  The public key Kau of the data processing server corresponding to the PageID acquires the corresponding data processing server ID by searching the page management table 128 using the PageID as a key, and the data processing server management table using the data processing server ID as a key It is obtained by searching 127.

  Hereinafter, a case where the data processing server 131 corresponds to the PageID obtained in Step 606 will be described as an example.

  The data distribution server PG 125 deletes the common key obtained in step 605 from the data distribution server 121 (step 608).

  Next, the data distribution server PG 125 uses a data processing server ID (in this example, information for identifying the data processing server 131) obtained by searching the page management table 128 using the Page ID obtained in step 606 as a key, and a step In step 607, the common key (Kau (K1)) encrypted by the public key Kau is returned to the electronic pen client 111 (step 609).

  The electronic pen client PG 116 receives the data processing server ID and the encrypted common key (Kau (K1)) (step 610).

  Next, the electronic pen client PG 116 receives the common key (Kau (K1)) encrypted by the public key Kau received in Step 610 and the encrypted unit and PageID of the encrypted writing data received in Step 602. Is transmitted to the data processing server 131 identified by the received data processing server ID (step 611).

  The data processing server PG135 receives the encrypted common key (Kau (K1)), the unit encrypted with the common key (K1 (Unit1)) and the PageID (K1 (PageID)) transmitted in Step 611. (Step 612).

  Next, the data processing server PG135 decrypts the encrypted common key (Kau (K1)) with the secret key Kar in the key pair stored in the key pair storage unit 136, thereby obtaining the common key K1. Obtain (step 613).

  Next, the data processing server PG135 decrypts the encrypted unit (K1 (Unit1)) and PageID (K1 (PageID)) received in Step 612 with the common key K1 obtained in Step 613. , PageID and a unit corresponding to the PageID are obtained (step 614).

  Next, the data processing server PG135 deletes the common key K1 obtained in step 613 from the data processing server 131 (step 615), and ends step 307. If there are a plurality of pieces of encrypted writing data received in step 602, steps 603 to 615 are repeated for each piece of encrypted writing data.

  According to the above processing, at least writing data other than PageID is encrypted using the common key in the electronic pen 101 and then decrypted once until reaching the data processing server that processes the writing data. There is nothing. As a result, data encryption in the data creation apparatus such as the electronic pen 101 that is not always connected to the network 103 and data encryption in the network 103 are processed consistently.

  If the PageID and the data processing server ID of the data processing server 141 correspond to each other, in step 609, the data processing server ID of the data processing server 141 is transmitted. In that case, the unit or the like is transmitted to the data processing server 141 in step 611, and the processing corresponding to steps 612 to 615 is executed in the data processing server PG145.

  The specific algorithm and key length of the public key cipher and common key cipher to be used may be determined in consideration of security and high speed in addition to the processing capacity of the computer and the capacity of the storage device. For example, RSA, AES, or MULTI-S01 may be used.

  The reason why the electronic pen 101 generates a common key used for encrypting writing data is that the electronic pen 101 cannot always communicate with other components.

  Although different depending on the algorithm and key length, common key generation also places a load on the electronic pen 101. The electronic pen PG 212 generates one common key used for the next encryption process when the load on the electronic pen 101 is light. Specifically, the electronic pen PG 212 generates one common key immediately after activation of the electronic pen and after encrypting the previous unit.

  The electronic pen PG 212 may be generated when a plurality of common keys can be generated, but a memory area for storing the generated plurality of common keys is required. If the process in step 305 occurs during the common key generation process, the electronic pen PG 212 interrupts the common key generation process and performs the process in step 305. If the process of step 306 occurs during the common key generation process, the electronic pen PG 212 interrupts the common key generation process and performs the process of step 306. However, when there is no common key in the key storage unit 215 (that is, when a common key to be used has not yet been generated), the electronic pen PG 212 generates a common key for performing the processing of step 306.

  The embodiment of the present invention described above exemplifies an information system that processes writing data acquired by the electronic pen 101. However, the electronic pen 101 may be replaced by another data creation device (for example, a digital camera). In that case, even if the processing capacity of the data creation device is not sufficient, data encryption can be executed without disturbing the data acquisition process. As a result, the security level can be improved while maintaining the performance of the data acquisition process.

It is a block diagram which shows the whole system configuration | structure of embodiment of this invention. It is a figure for demonstrating the structure and function of the electronic pen of embodiment of this invention. It is a figure explaining the structure of the writing data management table of embodiment of this invention. It is a figure explaining the structure of the encryption writing data management table of embodiment of this invention. It is a figure explaining the structure of the data processing server management table of embodiment of this invention. It is a figure explaining the structure of the page management table of embodiment of this invention. It is a flowchart which shows the whole process of the electronic pen system of embodiment of this invention. It is a flowchart which shows the electronic pen activation process performed in embodiment of this invention. It is a flowchart which shows the writing data encryption process performed in embodiment of this invention. It is a flowchart which shows the writing data transfer process performed in embodiment of this invention.

Explanation of symbols

101 Electronic Pen 102 Electronic Pen Compatible Form 201 Dot Pattern 202 Light Emitting Diode 203 Camera 204 Ink Cartridge 205 Pen Pressure Sensor 206 Processor 207 Memory 208 Clock 209 Battery 210 Communication Device 211 Transmission Box 212 Electronic Pen PG
213 Writing data management table 214 Encryption writing data management table 215 Key storage unit 216 Data distribution server information storage unit

Claims (19)

An electronic pen that acquires data including coordinate information of a locus of a pen tip, encrypts and outputs the acquired data,
A memory that holds the acquired data; a processor connected to the memory; and a power supply unit that supplies power to the memory and the processor.
After starting the acquisition of the data, determine whether a predetermined event indicating interruption of writing using the electronic pen has been detected,
When the predetermined event is detected, the encrypted data is generated by encrypting the retained data,
Outputting the encrypted data ;
The predetermined event is that a predetermined time has elapsed since the last time the electronic pen acquired the data, or that a power-off request has been input to the electronic pen. . The electronic pen is
  Generate a first encryption key;
  If the predetermined event is detected, the encrypted data is generated using the first encryption key, and then the stored data is deleted.
  After encrypting the first encryption key with a public encryption key, erasing the first encryption key;
  The electronic pen according to claim 1, wherein the encrypted first encryption key is output. The electronic pen is
  If the public encryption key is not held before generating the first encryption key, a predetermined request is output,
  When the public encryption key is input, the input public encryption key is held,
  The electronic pen according to claim 2, wherein the first encryption key is generated after the public encryption key is input and before the acquisition of the data is started. The electronic pen is
  After erasing the first encryption key, generating a second encryption key different from the first encryption key;
  Acquire and retain new data,
  After starting the acquisition of the new data, determine whether the predetermined event has been detected,
  The encrypted new data is generated by encrypting the held new data using the second encryption key when the predetermined event is detected. 2. The electronic pen according to 2. The electronic pen is
  After erasing the first encryption key, cutting off power supply to the processor and the memory by the power supply unit,
  5. The electronic pen according to claim 4, wherein when a power-on request is input, the second encryption key is generated after the power supply unit starts power supply to the processor and the memory.   The power-on request is input by attaching a cap that covers a pen tip to the electronic pen, and the power-on request is input by removing the cap from the electronic pen. Electronic pen.   The electronic pen is
  Generating a third encryption key different from the first encryption key;
  When the data including the coordinate information indicating the second coordinate outside the first coordinate range is acquired after acquiring the data including the coordinate information indicating the first coordinate within the first coordinate range, the first The data including the coordinate information indicating coordinates is encrypted using the first encryption key, and the data including the coordinate information indicating the second coordinates is encrypted using the third encryption key. The electronic pen according to claim 2. A program for controlling an electronic pen that acquires data including coordinate information of a locus of a pen tip and encrypts and outputs the acquired data,
  The electronic pen includes a memory that holds the acquired data, a processor connected to the memory, and a power supply unit that supplies power to the memory and the processor,
  The program is
  A procedure for determining whether or not a predetermined event indicating interruption of writing using the electronic pen is detected after starting the acquisition of the data;
  A procedure for generating encrypted data by encrypting the retained data if the predetermined event is detected; and
  Outputting the encrypted data to the processor, and
  The program according to claim 1, wherein the predetermined event is that a predetermined time has elapsed since the electronic pen last acquired the data, or that a power-off request has been input to the electronic pen. The program further includes:
  Generating a first encryption key;
  Erasing the retained data after generating the encrypted data;
  Encrypting the first encryption key with a public encryption key;
  Erasing the first encryption key after the first encryption key is encrypted;
  Outputting the encrypted first encryption key to the processor, and
  9. The program according to claim 8, wherein the procedure for generating the encrypted data is executed by encrypting the held data using the first encryption key. The program further includes:
  Generating a second encryption key different from the first encryption key after erasing the first encryption key;
  Procedures to acquire and retain new data,
  A procedure for determining whether or not the predetermined event has been detected after starting the acquisition of the new data;
  When the predetermined event is detected, a procedure for generating new encrypted data by encrypting the retained new data using the second encryption key is provided to the processor. The program according to claim 9, wherein the program is executed.   The program further causes the processor to execute a procedure for generating a third encryption key different from the first encryption key,
  The procedure for generating the encrypted data includes: the coordinate indicating the second coordinate outside the first coordinate range after the data including the coordinate information indicating the first coordinate within the first coordinate range is acquired; When the data including information is acquired, a procedure for encrypting the data including the coordinate information indicating the first coordinates using the first encryption key, and the coordinate information indicating the second coordinates The program according to claim 9, further comprising: a step of encrypting the data to be included using the third encryption key. An information system comprising an electronic pen, an interface for communicating with the electronic pen, a data distribution computer connected to the interface, and one or more data processing computers connected to the data distribution computer,
  The electronic pen includes a first memory for holding data including coordinate information of a pen tip locus acquired by the electronic pen, a first processor connected to the first memory, the first memory, and the first memory A power supply for supplying power to the processor,
  The data distribution computer includes a first communication device that communicates with the interface and the one or more data processing computers, a second processor connected to the first communication device, and a second processor connected to the second processor. And a memory,
  Each data processing computer includes a second communication device that communicates with the data distribution computer, a third processor connected to the second communication device, and a third memory connected to the third processor,
  The electronic pen is
  After starting the acquisition of the data, determine whether a predetermined event indicating interruption of writing using the electronic pen has been detected,
  When the predetermined event is detected, the encrypted data is generated by encrypting the retained data,
  Sending the encrypted data;
  The information system characterized in that the predetermined event is that a predetermined time has elapsed since the last time the electronic pen acquired the data, or a power-off request was input to the electronic pen. . The electronic pen is
  Generate a first encryption key;
  If the predetermined event is detected, the encrypted data is generated using the first encryption key, and then the stored data is deleted.
  After encrypting the first encryption key using a public encryption key corresponding to a secret encryption key held by the data distribution computer, erasing the first encryption key;
  The information system according to claim 12, wherein the encrypted first encryption key is transmitted. If the electronic pen does not hold the public encryption key before generating the first encryption key, the electronic pen sends a predetermined request to the data distribution computer via the interface,
  When the data distribution computer receives the predetermined request, the data distribution computer transmits the public encryption key corresponding to the secret encryption key held by the data distribution computer,
  When the electronic pen receives the public encryption key, the electronic pen holds the received public encryption key,
  The information system according to claim 13, wherein the first encryption key is generated after the public encryption key is received and before the acquisition of the data is started. The electronic pen is
  After erasing the first encryption key, generating a second encryption key different from the first encryption key;
  Acquire and retain new data,
  After starting the acquisition of the new data, determine whether the predetermined event has been detected,
  The encrypted new data is generated by encrypting the held new data using the second encryption key when the predetermined event is detected. 13. The information system according to 13. The electronic pen is
  After erasing the first encryption key, cutting off power supply to the processor and the memory by the power supply unit,
  The information system according to claim 15, wherein when a power-on request is input, power supply to the processor and the memory is started by the power supply unit, and the second encryption key is generated.   The electronic pen is
  When the acquired data includes the coordinate information indicating the first coordinate in the first coordinate range, the encrypted first encryption key and information for identifying the first coordinate range are transmitted to the interface. To the data distribution computer via
  In the data distribution computer, the management information for associating the coordinate range with each data processing computer, and the public encryption key corresponding to the secret encryption key held by each data processing computer is held in advance,
  The data distribution computer is
  Upon receipt of information for identifying the first coordinate range, the data processing computer corresponding to the first coordinate range is identified based on the management information;
  Decrypting the encrypted first encryption key using a secret encryption key held by the data distribution computer;
  Encrypting the decrypted first encryption key using the public encryption key corresponding to the identified data processing computer;
  Information identifying the specified data processing computer, and the first encryption key encrypted using the public encryption key corresponding to the specified data processing computer, is transmitted to the electronic pen,
  The electronic pen transmits the encrypted data and the first encryption key encrypted using the public encryption key corresponding to the specified data processing computer to the specified data processing computer. Send
  The identified data processing computer is:
  Decrypting the first encryption key encrypted using the public encryption key corresponding to the identified data processing computer, using the secret encryption key held by the identified data processing computer,
  14. The information system according to claim 13, wherein the encrypted data is decrypted using the decrypted first encryption key. The electronic pen is
  Generating a third encryption key different from the first encryption key;
  When the data including the coordinate information indicating the second coordinate outside the first coordinate range is acquired after acquiring the data including the coordinate information indicating the first coordinate within the first coordinate range, the first The data including the coordinate information indicating coordinates is encrypted using the first encryption key, and the data including the coordinate information indicating the second coordinates is encrypted using the third encryption key. The information system according to claim 17. A method of controlling an electronic pen that acquires data including coordinate information of a locus of a pen tip and encrypts and outputs the acquired data,
  The electronic pen includes a memory for holding the data, and a processor connected to the memory,
  The method
  A procedure for determining whether or not a predetermined event indicating interruption of writing using the electronic pen is detected after starting the acquisition of the data;
  A procedure for generating encrypted data by encrypting the retained data if the predetermined event is detected; and
  Outputting the encrypted data, and
  The method according to claim 1, wherein the predetermined event is that a predetermined time has elapsed since the last time the electronic pen acquired the data, or a power-off request was input to the electronic pen.