JP6957292B2 - File management system and file management program - Google Patents

Description

The present invention relates to a file management system and a file management program.

When concealing the contents of an electronic file, it is common to encrypt the file. However, the problem is that it takes a lot of time to encrypt and decrypt files. For example, in the case of a very large (several TB) file such as a high-precision video (4K, 8K), it takes several tens of hours to encrypt and the processing cannot be completed by a predetermined date. Problems may occur.

Further, as shown in Patent Document 1, a method of dividing electronic information into a plurality of files and storing the electronic information together with a plurality of dummy files is known. In this case, it is known that the divided file is buried in the dummy data and concealed by performing reversible data conversion on the electronic information, further performing reversible division processing, and saving the divided file together with a plurality of dummy files. There is.

On the other hand, there is also known a method of dividing electronic information into a plurality of files and saving the electronic information together with a plurality of dummy files, and adopting a method of storing the divided result file as a part of the dummy file (patented). Document 2).

In addition, it is not possible to collect all of the distributed data divided into multiple pieces, and even if a predetermined number of data is collected, the original data is restored provided that the certification authority proves that there is no information leakage. An electronic data management system that enables this is known (Patent Document 3).

Further, a set of tally is generated from electronic data, one tally of the set and the other tally are stored in another storage medium, and one tally can be read out to search for the other tally. It is disclosed in Patent Document 4 that the restoration process of electronic data is executed from the tally of (1) and the other tally.

In Patent Document 5, the data to be written is divided into a predetermined data length, valu is generated, the cache value is calculated as the corresponding key to obtain keyi, and the set (keyi, valui) is written to the cache device. It is disclosed. Since this cache device can be accessed with the key calculated based on the divided data valu, the performance at the time of reading can be improved.

Japanese Patent No. 394311 Japanese Patent No. 4689644 Japanese Patent No. 5778018 Japanese Unexamined Patent Publication No. 2009-151561 Japanese Unexamined Patent Publication No. 2014-178734

However, according to the method of Patent Document 1, since the electronic information is divided into a plurality of files, a large number of divided files are created and a large number of dummy files are stored. Since these files are saved individually, there is a problem that the file opening and closing processing increases, the access to the storage device becomes enormous, and the processing time becomes long.

The invention of Cited Document 2 solves the problems of the invention of Patent Document 1 described above. According to the invention of Patent Document 2, since the divided data is stored in the dummy file, it is not necessary to provide a file for storing only the divided data, so that the number of files can be reduced. Therefore, since the reduced file is not opened and closed, the number of accesses can be reduced as compared with the invention of Patent Document 1, and the processing time can be reduced.

However, it is necessary to associate the divided data with the dummy file, which increases the management process. Therefore, there is a problem that the management process is complicated and time is required for this. In addition, the storage location of the divided data may be known from the association information between the divided data and the dummy file, which may affect the concealment.

Further, in the invention of Patent Document 3, since it is basically necessary to collect all distributed data, there is a risk of information corruption, and in order to restore some distributed data, the processing of the certification authority is performed. It is necessary, and there is a problem that the system as a whole is large and complicated.

Further, the invention of Patent Document 4 has an advantage that the electronic data is only divided into two tally, so that the structure is easy and the time and effort for collecting the tally at the time of restoration is small, but the number of tally is reduced. It may be inferior in terms of safe storage of files compared to the method of making a considerable number.

Further, in the invention of Patent Document 5, it is an advantage that the same data can be shared and managed with the same hash value, and the data of another person can be reused, but from the viewpoint of safely concealing and storing the file. Since then, the system has many problems.

The present invention has been made in view of the current state of the file management system as described above, and an object of the present invention is a file management system capable of concealing the contents of a file in a short time and safely storing the file. And to provide a file management program.

The file management system according to the present invention includes a file dividing means for dividing one file into a plurality of file fragments, a key generating means for generating a key having KVS uniqueness for the divided file fragments, and the above. A key information file is created by concealing the fragment storage control means that stores each file fragment and the corresponding key as a pair in the file fragment storage unit and the key acquisition information that can acquire all the keys corresponding to each file fragment. A key information file creating means for creating a key information file, a key information outputting means for outputting the key information file, and a dummy pair information creating means for creating dummy pair information similar to a pair of a file fragment and a corresponding key. The fragment storage control means is characterized in that the dummy pair information is stored in the file fragment storage unit .

In the file management system according to the present invention, a key restoration means for reading a key information file stored in the key information storage unit and restoring all the keys corresponding to each file fragment and a restored key are used. It is characterized by providing a file restoration means for reading all pairs from a file fragment storage unit and combining the file fragments in all the read pairs to restore one file.

In the file management system according to the present invention, the file dividing means is characterized in that one file is divided into a plurality of file fragments having the same size.

In the file management system according to the present invention, the file dividing means is characterized in that one file is divided into a plurality of file fragments having different sizes.

In the file management system according to the present invention, the key generation means detects whether or not the generated key has uniqueness by referring to each pair of keys in the file fragment storage unit each time the key is generated, and is unique. The feature is that the key whose sex cannot be confirmed is discarded and the key generation is continued until the uniqueness can be confirmed.

In the file management system according to the present invention, the key information file creating means is characterized in that the key information file is created by concealing it by encryption.

In the file management system according to the present invention, the key information file creating means creates a key information file using all the keys corresponding to the file fragments as key acquisition information.

In the file management system according to the present invention, the key information file creating means acquires the initial value at the time of key generation obtained by the key generating means, the generation order number of the discarded key, and the total number of keys. It is characterized by creating a key information file as information.

The file management system according to the present invention includes a file fragment multiplexing means for generating N (two or more integers) pairs of a plurality of file fragments corresponding to one file divided by the file dividing means as one pair. The key generation means generates a key having KVS uniqueness for an N pair of file fragments, and the fragment storage control means files a pair of N pairs of each file fragment and a corresponding key as a pair. The key information file creating means stores the key information file for N pairs by concealing the key acquisition information that can acquire all the keys corresponding to each of the file fragments corresponding to the N pairs. The key information output means created is characterized in that the key information file for the N pairs is output.

In the file management system according to the present invention, the key information output means is a key information storage control means for storing the key information file in the key information storage unit.

The file management program according to the present invention causes a file management system computer to generate a file dividing means for dividing one file into a plurality of file fragments, and a key having KVS uniqueness for the divided file fragments. A key generation means, a fragment storage control means for storing each file fragment and a corresponding key as a pair in a file fragment storage unit, and a key acquisition information that can acquire all the keys corresponding to each file fragment are concealed and a key. It functions as a key information file creating means for creating an information file, a key information outputting means for outputting the key information file, and a dummy pair information creating means for creating dummy pair information similar to a pair of the file fragment and the corresponding key. Further, the file management system computer is used as the fragment storage control means to function to store the dummy pair information in the file fragment storage unit.

In the file management program according to the present invention, when the file management system computer is further given the key information file, the key restoration that restores each file fragment and all the corresponding keys based on the information of the key information file. The feature is that all the corresponding pairs are read from the file fragment storage unit using the restored key, and the file fragments in all the read pairs are combined to function as a file restoration means for restoring one file. do.

The file management program according to the present invention is characterized in that the file management system computer further functions as the file dividing means so as to divide one file into a plurality of file fragments of the same size.

The file management program according to the present invention is characterized in that the file management system computer further functions as the file dividing means so as to divide one file into a plurality of file fragments having different sizes.

In the file management program according to the present invention, the key generated by referring to the key of each pair of the file fragment storage unit each time the key is generated by using the file management system computer as the key generation means is unique. It is characterized in that it detects whether or not it has a uniqueness, discards a key whose uniqueness cannot be confirmed, and makes it function to continue generating a key until the uniqueness can be confirmed.

The file management program according to the present invention is characterized in that the file management system computer further functions as the key information file creation means so as to create a key information file by concealing it by encryption.

In the file management program according to the present invention, the file management system computer further functions as the key information file creation means to create a key information file using all the keys corresponding to the file fragments as key acquisition information. It is characterized by letting it.

In the file management program according to the present invention, the file management system computer is further used as the key information file creation means, and the initial value at the time of key generation obtained by the key generation means and the generation order number of the discarded key. It is characterized in that it functions to create a key information file using the total number of keys as key acquisition information.

In the file management program according to the present invention, the file management system computer further sets a plurality of file fragments corresponding to one file divided by the file division means as one pair, and N (two or more integers) pairs are generated. together to function as a file fragmentation multiplexing means for, as the key generation unit, to the file fragment N pairs, to function so as to generate a key with the uniqueness of the KVS, as a fragment storage control unit, the N pairs min Each file fragment and the corresponding key are paired to function to store the pair in the file fragment storage unit, and as the key information file creation means, all the keys corresponding to the N pair of the file fragments are stored. The key acquisition information that can be acquired is concealed so that a key information file for N pairs is created, and as the key information output means, the key information file for N pairs is output. It is a feature.

In the file management program according to the present invention, the file management system computer further functions as the key information output means and as the key information storage control means that functions to store the key information file in the key information storage unit. It is characterized by.

In the present invention, one file is divided into a plurality of file fragments, a key having KVS uniqueness is generated for the divided file fragment, and each file fragment and the corresponding key are paired as a file fragment. A key information file is created by concealing the key acquisition information that can be stored in the storage unit and all the keys corresponding to the file fragments can be acquired, and the key information file is stored in the key information storage unit for a short time. The contents of the file can be kept secret, and the file can be stored safely.

The block diagram of the file management system which concerns on 1st Embodiment of this invention. The flowchart which shows the file storage operation of the file management system which concerns on 1st Embodiment of this invention. The conceptual diagram which shows the operation of the file management system which concerns on 1st Embodiment of this invention. The flowchart which shows the file restoration operation of the file management system which concerns on 1st Embodiment of this invention. The block diagram of the file management system which concerns on 2nd Embodiment of this invention. The block diagram of the file management system which concerns on 3rd Embodiment of this invention.

Hereinafter, embodiments of the file management system according to the present invention will be described with reference to the accompanying drawings. In each figure, the same components are designated by the same reference numerals, and duplicate description will be omitted. FIG. 1 shows a configuration diagram of a file management system according to the first embodiment. As is clear from the figure, the input unit 11, the output unit 12, the central arithmetic processing unit 10, the key information storage unit 40, and the file fragment storage unit 50 are provided. This system can consist of personal computers, workstations and other computer systems.

The input unit 11 has a configuration for inputting a file to be stored in the file management system, and may be configured as long as the file can be imported by the system, and may include a storage medium, a network, and the like. .. Further, the input unit 11 allows a keyboard, a touch panel, and various pointing devices used for inputting commands, data other than the above files, and the like into this system.

Further, the output unit 12 has a configuration for outputting a file stored in this file management system, and may be configured as long as the file can be retrieved from the system, and includes a storage medium, a network, and the like. be able to. The output unit 12 may be a printer or a display.

The central arithmetic processing unit 10 includes a file storage processing unit 20 and a file restoration processing unit 30. Each means provided in the central arithmetic processing unit 10 can be realized by a program. The file storage processing unit 20 includes a file division means 21, a key generation means 22, a fragment storage control means 23, a key information file creation means 24, and a key information storage control means 25. The file dividing means 21 divides one file into a plurality of file fragments. The key generation means 22 generates a key having uniqueness of KVS (Key Value Store) for the divided file fragment.

The fragment storage control means 23 stores each of the file fragments and the corresponding key as a pair in the file fragment storage unit 50. The key information file creating means 24 creates a key information file by concealing the key acquisition information that can acquire all the keys corresponding to each of the above file fragments. The key information storage control means 25 stores the key information file in the key information storage unit 40. In the present embodiment, the key information storage control means 25 is used, but the key information storage control means 25 can be a key information output means for outputting the key information file. That is, it is not essential to store the key information file, and it is sufficient if the key information file can be output to a printer or display and retained by the user of this system.

The file restoration processing unit 30 is provided with a key restoration means 31 and a file restoration means 32. When the key information file is given, the key restoration means 31 restores all the keys corresponding to each file fragment based on the information of the key information file. In the present embodiment, since the key information storage unit 40 is adopted as the key information output means, the key restoration means 31 reads the key information file stored in the key information storage unit 40 according to the instruction from the input unit 11. , Restores each file fragment and all corresponding keys. The file restoration means 32 reads all the corresponding pairs from the file fragment storage unit 50 using the restored key, combines the file fragments in all the read pairs, and restores one file.

In the file management system configured as described above, the file storage process is performed based on the program of the flowchart as shown in FIG. That is, the process starts, and the file to be stored is input from the input unit 11 (S201). This file is split (S202). FIG. 3 shows a conceptual diagram. The input target file TF is divided into a plurality of file fragments C1, C2, C3, ....

Here, the file dividing means 21 can divide one file into a plurality of file fragments having the same size. There is no limit to this size, and reducing the size increases the confidentiality of the file, but it takes time to write and read, so it is appropriately determined in relation to the processing time. This size, once determined at system startup, shall be fixed thereafter. Further, the file dividing means 21 can divide one file into a plurality of file fragments having different sizes. In this case, the upper limit value and the lower limit value are determined, and are appropriately changed between them. Specifically, a mechanism for specifying a value between the upper limit and the lower limit of the size by a random number can be adopted.

Next, the processing between step S203A and step S203B is repeatedly executed for all the file fragments. That is, each time the key generation means 22 generates a key, the key of each pair of the file fragment storage unit 50 is referred to to detect whether or not the generated key has uniqueness (S205), and the uniqueness is determined. Discard the key that cannot be confirmed, and continue to generate the key until the uniqueness can be confirmed (S204).

When the key is generated as described above, the generated key and the file fragment are stored as a pair in the file fragment storage unit 50 as shown in FIG. 3 (S206). When the processing between steps S203A and S203B for all the file fragments is completed, the key information file is created by concealing the key acquisition information that can acquire all the keys corresponding to each of the above file fragments (S207). ).

In step S207, confidentiality can be performed by encryption. The key acquisition information from which all the keys corresponding to each file fragment can be acquired can be the information itself of all the keys generated in steps S204 and S205. However, if the number of divided file fragments is large, the size of the key information file may become enormous.

Therefore, when the number of divided file fragments is large, the initial value at the time of key generation obtained by the key generation means 22 and the generation order number of the discarded key (what number of the generated key was discarded). Create a key information file using the number indicating) and the total number of keys as key acquisition information. From this information, by causing the key generation means 22 to generate the key again, all the keys of the corresponding pair stored in the file fragment storage unit 50 can be restored.

The key information file created by the key information file creating means 24 as described above is stored in the key information storage unit 40 (S208). This step S208 is generally a step of processing to output the key information file created by the key information file creating means 24.

When the file stored as described above is restored, the process is performed by the operation corresponding to the flowchart shown in FIG. That is, the process starts, the desired key information file is read from the key information storage unit 40, and all the keys are restored (S301). Next, the process from step S302A to S302B is repeated until all the fragments are read out.

First, the first file fragment is read from the KVS file fragment storage unit 50 using the key corresponding to the first file fragment (S303), and then the key corresponding to the second file fragment is used. The second file fragment is read from the file fragment storage unit 50, which is KVS, (S303) and combined with the end of the first file fragment (S304).

Further, the third file fragment is read from the KVS file fragment storage unit 50 using the key corresponding to the third file fragment (S303), and the third file fragment is combined with the end of the second file fragment (S304). .. After that, the same process is continued and one file is restored. The restored file is output from the output unit 12 (S305).

FIG. 5 shows a configuration diagram of the file management system according to the second embodiment. In this embodiment, the central arithmetic processing unit 10A is provided with the dummy pair information creating means 41. The dummy pair information creating means 41 creates dummy pair information similar to the pair by the file fragment and the corresponding key. The rules regarding the size of dummy pair information also follow the rules regarding the size of file fragments. The fragment storage control means 23 stores the dummy pair information in the file fragment storage unit 50. This process is performed when the system is started up (initialized).

Because of the above configuration, even if an unauthorized person who does not have a legitimate key information file can invade the file fragment storage unit 50, it is not possible to know which file fragment is legitimate, and the file is highly concealed. Can be achieved.

In the third embodiment, the key information file and the information of the pair of each file fragment and the corresponding key are multiplexed and stored in case the file fragment is lost due to a failure of KVS or the like. be. That is, in the third embodiment, as shown in FIG. 6, a plurality of file fragments corresponding to one file divided by the file dividing means 21 are set as one pair in the central arithmetic processing unit 10B, and N (2 or more). A file fragment multiplexing means 28 for generating a ( integer) pair is provided.

The key generation means 22 generates a key having KVS uniqueness for the N pair of file fragments generated by the file fragment multiplexing means 28. The fragment storage control means 23 stores N pairs of each of the above file fragments and the corresponding key as a pair in the file fragment storage unit 50.

The key information file creating means 24 creates a key information file for N pairs by concealing the key acquisition information that can acquire all the keys corresponding to each of the file fragments corresponding to the N pairs. The key information storage control means 25 stores the key information files for the N pairs in the key information storage unit 40.

In this third embodiment, the key is restored from the key information file related to the first pair in the key information file for N pairs, and the file is restored in the same manner as in the first embodiment. At this time, if the number of the file fragment cannot be read, the key is restored from the key information file related to the next pair, and the key corresponding to the order number when the above file fragment cannot be read is used. Can read file fragments.

Since the key information file and the pair information of each file fragment and the corresponding key are multiplexed as described above, the file can be restored appropriately even if the file fragment is lost due to a failure of KVS or the like. It is possible to do.

10, 10A, 10B Central arithmetic processing unit 11 Input unit 12 Output unit 20 File storage processing unit 21 File division means 22 Key generation means 23 Fragment storage control means 24 Key information file creation means 25 Key information storage control means 28 File fragment multiplexing Means 30 File restoration processing unit 31 Key restoration means 32 File restoration means 40 Key information storage unit 41 Dummy pair information creation means 50 File fragment storage unit

Claims (20)

File division means for dividing one file into multiple file fragments,
A key generation means for generating a key having KVS uniqueness for the divided file fragment, and
A fragment storage control means for storing each file fragment and a corresponding key as a pair in the file fragment storage unit,
A key information file creation means for creating a key information file by concealing key acquisition information that can acquire all the keys corresponding to each file fragment.
The key information output means for outputting the key information file and
Dummy pair information creation means for creating dummy pair information similar to the pair by the file fragment and the corresponding key, and
Equipped with
The fragment storage control means is a file management system characterized in that the dummy pair information is stored in a file fragment storage unit. Given the key information file, a key recovery means that restores each file fragment and all the corresponding keys based on the information in this key information file.
It is characterized by providing a file restoration means for reading all the corresponding pairs from the file fragment storage unit using the restored key and combining the file fragments in all the read pairs to restore one file. The file management system according to claim 1. The file management system according to claim 1 or 2, wherein the file dividing means divides one file into a plurality of file fragments having the same size. The file management system according to claim 1 or 2, wherein the file dividing means divides one file into a plurality of file fragments having different sizes. Each time the key is generated, the key generation means refers to each pair of keys in the file fragment storage unit to detect whether or not the generated key has uniqueness, discards the key whose uniqueness cannot be confirmed, and discards the key. The file management system according to any one of claims 1 to 4, wherein key generation is continued until uniqueness can be confirmed. The file management system according to any one of claims 1 to 5 , wherein the key information file creating means is concealed by encryption to create a key information file. The file management system according to any one of claims 1 to 6 , wherein the key information file creating means creates a key information file using all the keys corresponding to each file fragment as key acquisition information. .. The key information file creating means creates a key information file using the initial value at the time of key generation obtained by the key generating means, the generation order number of the discarded key, and the total number of keys as key acquisition information. The file management system according to any one of claims 1 to 7. A file fragment multiplexing means for generating N (integer of 2 or more) pairs with a plurality of file fragments corresponding to one file divided by the file dividing means as one pair is provided.
The key generation means generates a key having KVS uniqueness for an N pair of file fragments, and generates a key having KVS uniqueness.
The fragment storage control means stores N pairs of each file fragment and the corresponding key as a pair in the file fragment storage unit.
The key information file creating means conceals the key acquisition information that can acquire all the keys corresponding to each of the file fragments corresponding to the N pair, and creates a key information file for N pairs.
The file management system according to any one of claims 1 to 8 , wherein the key information output means outputs a key information file for N pairs. The file management system according to any one of claims 1 to 9 , wherein the key information output means is a key information storage control means for storing the key information file in the key information storage unit. File management system computer,
File division means for dividing one file into multiple file fragments,
A key generation means for generating a key having KVS uniqueness for the divided file fragment,
Fragment storage control means for storing each file fragment and the corresponding key as a pair in the file fragment storage unit,
A key information file creation means for creating a key information file by concealing key acquisition information capable of acquiring all the keys corresponding to each file fragment.
Key information output means for outputting the key information file,
Dummy pair information creating means for creating dummy pair information similar to the pair of the file fragment and the corresponding key,
To function as
Further, a file management program characterized in that the file management system computer is used as the fragment storage control means to function to store the dummy pair information in the file fragment storage unit. File management system computer, more
Given the key information file, a key recovery means that restores each file fragment and all the corresponding keys based on the information in this key information file.
Claims all pairs corresponding with the restored key read from the file fragment storage unit, characterized in that function as file restoration means for restoring a file by combining the file fragment 1 in all the read pairs Item 11. The file management program according to item 11. File management system computer, more
The file management program according to claim 11 or 12 , wherein as the file dividing means, one file is made to function to be divided into a plurality of file fragments having the same size. File management system computer, more
The file management program according to claim 11 or 12 , wherein as the file dividing means, one file is made to function to be divided into a plurality of file fragments having different sizes. File management system computer, more
As the key generation means, each time a key is generated, it is detected whether or not the generated key has uniqueness by referring to the key of each pair of the file fragment storage unit, and the key whose uniqueness cannot be confirmed is discarded. The file management program according to any one of claims 11 to 14 , wherein the key generation function is continued until the uniqueness can be confirmed. File management system computer, more
The file management program according to any one of claims 11 to 15 , wherein as the key information file creating means, the key information file is concealed by encryption to function to create a key information file. File management system computer, more
The method according to any one of claims 11 to 16 , wherein as the key information file creating means, all the keys corresponding to the file fragments are made to function to create a key information file as key acquisition information. File management system. File management system computer, more
As the key information file creation means, the key information file is created with the initial value at the time of key generation obtained by the key generation means, the generation order number of the discarded key, and the total number of keys as key acquisition information. The file management program according to any one of claims 11 to 17 , wherein the file management program is characterized in that. File management system computer, more
A plurality of file fragments corresponding to one file divided by the file dividing means are set as one pair to function as a file fragment multiplexing means for generating N (integer of 2 or more) pairs.
As the key generation means, N pairs of file fragments are made to function to generate a key having KVS uniqueness.
As a fragment storage control means, N pairs of the file fragments and the corresponding keys are paired and the pair is stored in the file fragment storage unit.
As the key information file creation means, the key acquisition information that can acquire all the keys corresponding to each of the file fragments corresponding to the N pair is concealed so as to create a key information file for N pairs.
The file management program according to any one of claims 11 to 18 , wherein the key information output means functions to output a key information file for N pairs. File management system computer, more
The file according to any one of claims 11 to 19 , wherein the key information output means functions as a key information storage control means that functions to store the key information file in the key information storage unit. Management system.

Images