JPWO2009022376A1 - Authentication processing system, authentication processing method, and program - Google Patents

Abstract

It provides authentication processing that is robust as a security and easy to use for users. In the present invention, when reading an encrypted file from a confidential folder or writing a file to the confidential folder, the file I / O is detected and blocked to perform authentication. If the authentication is successful, the file I / O block is released, and the encrypted file to be read is decrypted and the file to be written is encrypted using the common key set in the confidential folder. The decrypted file is provided to the user via the application, and the encrypted file is written in the confidential folder. This series of processing is executed every time the user logs in even in the same confidential folder. That is, even if the authentication process is successful at the previous login and the file I / O of a certain confidential folder is permitted, once the user logs out, the authentication process is executed again at the next login.

Description

  The present invention relates to an authentication processing system, an authentication processing method, and an authentication processing program. For example, when file access is made to a folder in which an encrypted file exists, the user actually starts using the encrypted file. The present invention relates to on-demand authentication processing that enables authentication in units of folders in synchronization with user file operations.

  In an authentication processing system, the user is generally required to authenticate once as a system at the time of PC login or system start. On the other hand, in the case of using together with an encryption processing system having access control in units of folders with different key information for each folder, it is required to perform authentication processing for each folder. Although it is possible to perform authentication for all folders at the time of system startup, if a legitimate user authenticates a folder that is not actually used and then makes it accessible, there is a risk of unauthorized use by a malicious user. growing. In addition, storing key information of a folder that is not actually used in the PC in advance involves a security risk. Furthermore, allowing access to the encrypted file without the key information may cause the file to be destroyed if a user operation is mistaken without the encrypted data being decrypted.

  Therefore, before the user starts using the encrypted file, access to the encrypted file is prohibited, authentication processing is performed when the user starts using the file, and the key information is downloaded to the PC for the first time after the authentication processing is successful. Some technology that allows access to

For example, Patent Document 1 is proposed as a method for performing authentication at the start of use of an encrypted file and decrypting a data file using a key information file. In Patent Document 1, an encrypted data file and a corresponding key information file are stored in an IC card, and authentication is performed when the data file is opened, and the data file is decrypted using the key information file.
JP-A-2005-352961

  However, in Patent Document 1, since the system has a data file and a key file individually, it is possible to recognize key information from the outside. Therefore, a malicious user can illegally use the data file by using means such as transferring this key information to another IC card.

  In addition, when performing folder authentication in synchronization with the user's file operation, not at the time of PC login or system start, the file access to the encrypted file is detected, and the file access is blocked until the authentication process is completed. It is necessary to perform dynamic authentication processing in units of file access, such as permitting / prohibiting file access according to the authentication result. However, although such file-based authentication is strong as security, it is inconvenient for the user.

  The present invention has been made in view of such a situation, and provides an authentication process that is robust as a security and easy to use for a user.

  In order to solve the above-described problem, in the present invention, when reading an encrypted file from a confidential folder or writing a file to the confidential folder, the file I / O is detected and blocked, and authentication is performed. If the authentication is successful, the file I / O block is released, and the encrypted file to be read is decrypted and the file to be written is encrypted using the common key set in the confidential folder. The decrypted file is provided to the user via the application, and the encrypted file is written in the confidential folder. This series of processing is executed every time the user logs in even in the same confidential folder. That is, even if the authentication process is successful at the previous login and file I / O of a certain confidential folder is permitted, once the user logs out, the authentication process is executed again at the next login.

  In other words, the authentication processing system according to the present invention is an authentication processing system that executes authentication processing when accessing an encrypted file stored in a folder using a computer that executes a program. The encrypted file is encrypted with a common encryption key for each folder. The authentication processing system includes an access detection unit that detects access to an encrypted file, an access block unit that temporarily blocks access to the encrypted file when the access detection unit detects access to the encrypted file, When access is blocked, the authentication means that executes the authentication process, and if the result of the authentication process is successful, the access block to the encrypted file is released and the access to the encrypted file is permitted. When the result is an authentication failure, an access permission unit for prohibiting access to the encrypted file and an encryption processing unit for decrypting the encrypted file permitted to access using a common encryption key are provided.

  The authentication processing system further includes an authentication state determination unit that determines an authentication state of a folder to which the encrypted file belongs when the access detection unit detects an access to the encrypted file, and the authentication states are “unauthenticated” and “ If it is `` authenticating '', the access block means temporarily blocks access to the encrypted file. If the authentication status is `` authenticated '', the encryption processing means uses the common encryption key to delete the encrypted file. Decrypt. The authentication unit executes the authentication process for each user login.

  The authentication processing system further includes an authentication timing management means for managing the timing of starting the authentication process for the encrypted file, and the access detecting means detects each access to each encrypted file included in the plurality of folders, and performs authentication. The timing management means detects the occurrence of a timeout at the start of authentication processing for each encrypted file, and prohibits access to the encrypted file that has timed out. The authentication processing system further includes an authentication processing time management unit that monitors the time of authentication processing for the encrypted file and prohibits access to the encrypted file corresponding to the time-out authentication processing.

  In the authentication processing system, the access detection unit detects each access to a plurality of encrypted files included in one folder, and the access permission unit determines whether the first access to the encrypted file among the plurality of encrypted files is performed. When the authentication process is successful, all access blocks for a plurality of encrypted files are released. The access permission unit prohibits all accesses to the plurality of encrypted files when the authentication process for the first accessed encrypted file fails.

  An authentication processing system according to the present invention is an authentication processing system that executes authentication processing when a file is written in a confidential folder using a computer that executes a program, and the files in the confidential folder have a common encryption key. It comes to be encrypted with. The authentication processing system includes an access detection unit that detects a file writing operation to the confidential folder, and an access block unit that temporarily blocks file writing when the access detection unit detects a file writing operation; Authentication means that executes authentication processing with writing blocked, and if the authentication processing result is authentication successful, the writing block is released, and if the authentication processing result is authentication failure, the file is written to the confidential folder. Access permission means for prohibiting the encryption, and encryption processing means for encrypting the unblocked file using a common encryption key and writing it in the confidential folder.

  The present invention further provides a program for causing a computer to function as the above-described authentication processing system, and an authentication processing method corresponding to the above-described authentication processing system.

  Further features of the present invention will become apparent from the best mode for carrying out the present invention and the accompanying drawings.

  According to the present invention, when a file is accessed to a folder in which an encrypted file exists, authentication is performed for each folder in synchronization with the user's file operation when the user actually starts using the file. , Reduce the risk of unauthorized access. Further, it is possible to reduce the security risk by storing only the key information actually necessary for the user in the PC.

It is a figure which shows schematic structure of the authentication processing system by embodiment of this invention. It is a flowchart for demonstrating a folder authentication process. It is a figure for demonstrating the concept of multiple folder authentication. It is a flowchart for demonstrating a multiple folder authentication process. It is a figure for demonstrating the concept of the folder authentication at the time of multiple file access. It is a flowchart for demonstrating the folder authentication process at the time of multiple file access.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Client terminal 2 ... File server 3 ... Authentication server 4 ... Network 5 ... User 11 ... Folder authentication processing driver 12 ... Cryptographic processing program part 13 ... High-order application 14 ... Redirector 15 ... Client service part 100 ... Authentication processing system

  In the present invention, when a file is accessed to a folder where an encrypted file exists, the user actually starts using the file (when the user clicks on the file or moves the cursor over the file). Provided is an on-demand authentication processing system capable of providing authentication for each folder in synchronization with file operations.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. The embodiment according to the present invention is only an example for realizing the present invention, and the present invention is not limited thereto, and can be changed or / and improved without departing from the essence of the invention. .

<Configuration of authentication processing system>
FIG. 1 is a block diagram showing a schematic configuration of an authentication processing system 100 according to an embodiment of the present invention. The authentication processing system 100 includes a client terminal 1 that performs folder authentication and encryption / decryption of an encrypted file, a file server 2 that stores an encrypted file, and an authentication server 3 that performs user authentication for accessing the encrypted file. Each of which is connected by a network 4. Note that a configuration may be adopted in which the client terminal 1 has an authentication program executed by the authentication server 3 and a confidential folder corresponding to the folder of the file server 2.

  In the client terminal 1, a folder authentication processing driver 11 that performs authentication (hereinafter referred to as “folder authentication”) for files in the same folder in units of folders, an encryption processing program unit 12 that performs encryption / decryption processing of encrypted files, and a user A higher-level application 13 activated by 5 or the like, a redirector 14 that retrieves a specified file from the file server 2 on the network, and a client service unit 15 that controls folder authentication are operating.

  The file server 2 has a shared secret folder 21 in which the encrypted file 22 is stored.

  The authentication server 3 communicates with the client service unit 15 and performs user authentication. The client service unit 15 hands over the password input by the user 5 from the input unit 17 to the authentication server 3 and makes an authentication request. The authentication server 3 executes user authentication in accordance with the authentication request and notifies the client service unit 15 of the success or failure.

<Access to encrypted files>
Next, a procedure for the user 5 to access the encrypted file 22 stored in the shared secret folder 21 on the network will be described.

  When the user 5 accesses the encrypted file 22 of the shared confidential folder 21 via the upper application 13 of the client terminal 1, the folder authentication processing driver 11 detects the file I / O. The folder authentication processing driver 11 checks the authentication status of the shared secret folder 21 using the authentication status management table 19 and temporarily blocks the detected file I / O if it is not authenticated. Here, the authentication status management table 19 is a table for managing whether or not the authentication to the folder to which the accessed encrypted file belongs has been completed. Is stored. For example, if there is no identification information of a folder in the table, it may be understood that the folder is in an unauthenticated state, or the identification information of all folders in the file server is acquired and authenticated / unauthenticated. Authentication may be managed. The authentication status management table 19 is reset when the authorized user 5 logs out, and the management of the authentication status of each folder is resumed when logging in again. In other words, folder authentication is effective only during one login, and if the next login is performed after logout, the folder authentication is performed again even if the folder has been authenticated previously.

  The folder authentication processing driver 11 notifies the client service unit 15 of an authentication request for the shared secret folder 21. Then, the client service unit 15 requests the user 5 to input a password or the like for authentication via the screen display unit 16 and the input unit 17. The client service unit 15 that has received the password or the like makes an inquiry to the authentication server 3 to request authentication. If the authentication is OK, the client service unit 15 acquires the encryption key 18 of the shared secret folder 21 and passes it to the folder authentication processing driver 11 together with the authentication result. .

  If the authentication result is successful, the folder authentication processing driver 11 temporarily releases the blocked file I / O block. The folder authentication processing driver 11 informs the redirector 14 of file I / O.

  The redirector 14 that has received the file I / O searches the faserver 2 when the file I / O is read, reads the encrypted data of the encrypted file 22 in the shared confidential folder 21, and delivers it to the folder authentication processing driver 11. . When the file I / O is a write, the redirector 14 stores the encrypted data to be written in the shared secret folder 21 as a file.

  The folder authentication processing driver 11 delivers the received encryption data and the encryption key 18 received from the client service unit 15 to the encryption processing program unit 12. The encryption processing program unit 12 uses the encryption key 18 to decrypt the encrypted data. The folder authentication processing driver 11 delivers the decrypted data to the upper application 13.

<Folder authentication process>
FIG. 2 is a flowchart for explaining folder authentication processing. In the folder authentication process, the folder authentication process driver 11 determines the authentication state of the shared secret folder after detecting the file I / O, controls the file I / O, and performs folder authentication.

  First, when access to the encrypted file in the shared secret folder 21 is started by the user 5, the folder authentication processing driver 11 detects file I / O related to the encrypted file 22 in the shared secret folder 21 (S201). Then, the folder authentication processing driver 11 determines the authentication status of the shared secret folder in which the encrypted file is stored by checking the contents of the authentication status management table 19 (S202). If the authentication state is “unauthenticated”, the process goes to step S203. If the authentication state is “authenticating”, the process goes to step S210. If the authentication state is “authenticated”, the process goes to step S216. , Migrate each.

  If the authentication state is “unauthenticated”, the folder authentication processing driver 11 temporarily blocks the file I / O (S203), and notifies the client service unit 15 of the start of authentication (S204). The client service unit 15 notifies the authentication server 3 of an authentication request, and the authentication server 3 performs authentication based on the input password or the like.

  The folder authentication processing driver 11 receives the authentication result via the client service unit 15 (S205). In addition, the folder authentication processing driver 11 confirms the received authentication result, determines the authentication result (S206), and if the authentication is successful, releases the block of the file I / O (S207), and the encryption processing program unit 12 However, encryption / decryption processing of the encrypted file is performed (S208). If the authentication fails, the folder authentication processing driver 11 sets the file I / O as an access error (S209). For example, the access error is displayed on the screen display unit 16 and notified to the user 5.

  When the authentication state is “authenticating”, the folder authentication processing driver 11 temporarily blocks the file I / O as in the unauthenticated state (S210). However, since the authentication process has already been started, an authentication start request to the client service unit 15 is not made. Further, the processing after receiving the authentication result (S211 to S215) is the same as the processing in the “unauthenticated” state, and thus the description thereof is omitted here.

  When the authentication state is “authenticated”, the folder authentication processing driver 11 performs only encryption / decryption (S216) of the encrypted file by the encryption processing program unit 12 without performing file I / O block processing or the like.

<Processing when simultaneous access to multiple folders occurs>
When simultaneous access to a plurality of shared secret folders occurs, the folder authentication process is serialized. FIG. 3 is a conceptual diagram showing processing when authentication processing for a plurality of shared secret folders (A to E) occurs simultaneously. FIG. 4 is a flowchart for explaining the serialized folder authentication process. FIG. 4 corresponds to the case where a plurality of processes in FIG. Also, the reference numbers in FIG. 3 correspond to the step numbers in FIG.

  In FIG. 3, it is assumed that access to the encrypted file in the folder E is started when the folder A is in authentication processing and the folders B, C, and D are waiting for authentication. When access to the encrypted file in the folder E is started, file I / O to the encrypted file is detected (S401). At this time, if the number of folders being authenticated is greater than or equal to a predetermined value (S402), access is immediately denied (S410). If the number of folders is less than the predetermined value, the folder E enters the authentication process start queue (S403) and waits until the authentication starts (S404). The waiting time is determined in advance, and in the case of timeout (S405), access to the encrypted file in the corresponding folder is denied (S410). As shown in FIG. 3, the folder queue is output from the queue after it is determined whether or not it is timed out in the input order, or authentication processing start is performed, like a FIFO. When the authentication process is started (S406), if the authentication is successful (S409), the folder becomes accessible (S411), and the authentication process takes more than a predetermined time (S407), or the authentication fails (S408). Then, access to the encrypted file in the folder is denied (S410).

  The content of FIG. 3 is shown in a flowchart in FIG. When access to the encrypted file in the shared confidential folder occurs, the folder authentication processing driver 11 detects file I / O to the encrypted file (S401). If the number of folders being authenticated exceeds the maximum value, access to the encrypted file in the folder is denied (S402).

  If the number of authentication folders is less than the maximum value, the folder authentication processing driver 11 inputs the folder into the authentication processing start queue (S403). If there is a shared secret folder that has already been authenticated, it waits in the authentication processing start queue. The folder authentication processing driver 11 monitors whether or not a timeout has occurred for the “waiting for authentication start” folder, and determines whether or not such a timeout has occurred (S405). If a timeout has occurred, access to the encrypted file in the folder is denied (S410).

  The folder authentication processing driver 11 outputs the shared secret folder for which authentication processing can be started from the authentication processing start queue (S406), and starts the authentication processing. Further, the folder authentication processing driver 11 monitors whether or not an “authentication processing” timeout has occurred for the folder, and determines whether or not the folder has occurred (S407). In the case of timeout, access to the encrypted file in the folder is denied (S410). Further, the folder authentication processing driver 11 determines whether or not the authentication is successful (S412), and if the authentication fails, the access is rejected (S410). If the authentication is successful, access is permitted and the encryption processing program unit 12 performs encryption / decryption processing of the encrypted file (S411).

<Processing when accessing multiple files in the same folder>
FIG. 5 is a conceptual diagram showing folder authentication processing when file I / O occurs simultaneously for a plurality of encrypted files in the shared secret folder. FIG. 6 is a flowchart for explaining the folder authentication process corresponding to FIG. Note that FIG. 6 corresponds to the case where a plurality of processes in FIG.

  In FIG. 5, the folder authentication processing driver 11 requests the client service unit 15 to start authentication when the first file I / O for the folder A is detected. Further, when the second and third file I / Os for the folder A occur during the authentication process, the folder authentication process driver 11 temporarily blocks these continuous file I / Os. When the folder authentication processing driver 11 receives the authentication result of the folder A from the client service unit 15 and the authentication result is successful, the folder authentication processing driver 11 releases all the file I / Os in the block and all the file I / Os. Tell / O to redirector 14. If the authentication result is unsuccessful, all file I / Os in the block result in access errors.

  Referring to the flowchart of FIG. 6, first, the folder authentication processing driver 11 blocks the first file I / O for a certain folder (for example, folder A). In addition, if the second and third file I / Os are continuously generated for the folder (folder A) before the authentication process is completed, the folder authentication process driver 11 also temporarily stores these continuous file I / Os. Block (S601). The blocked file I / O is added to the waiting list for each target folder. Here, the first to third file I / Os are listed in the waiting list of folder A (S602).

  When the folder authentication processing driver 11 receives the authentication result of the folder A from the client service unit 15 (S603), the folder authentication processing driver 11 determines the success or failure of the authentication processing (S604). The file I / O is released and transmitted to the redirector 14 (S605). Then, the folder authentication processing driver 11 acquires the encryption file to be accessed, and the encryption processing program unit 12 decrypts the encryption file (S606). Although this is an explanation of the encrypted file reading process, even in the case of file writing, after successful authentication, the file is encrypted and can be written to the folder (folder A).

  If the authentication result is unsuccessful, the folder authentication processing driver 11 sets the first file I / O in the block as an access error (S607).

  Subsequently, the folder authentication processing driver 11 checks the presence / absence of file I / O in the listed block (S608), and if it remains in the list, all the file I / O in the block (see FIG. In this case, the second and third file I / O are processed based on the authentication result (S604 to S608).

<Summary of Embodiment>
In this embodiment, when reading an encrypted file from a confidential folder or writing a file to the confidential folder, the file I / O is detected and blocked, and authentication is performed. If the authentication is successful, the file I / O block is released, and the encrypted file to be read is decrypted and the file to be written is encrypted using the common key set in the confidential folder. The decrypted file is provided to the user via the application, and the encrypted file is written in the confidential folder. In this way, when writing and reading an encrypted file to and from a confidential folder, it becomes possible to perform authentication for each folder when the user actually starts using and storing the file. Further, since encrypted files included in the same folder can be encrypted / decrypted with a common key, it is more convenient for the user than encrypting / decrypting with different keys for each file.

  The above-described series of processing is executed every time a user logs in even if the same confidential folder is used. That is, even if the authentication process is successful at the previous login and file I / O of a certain confidential folder is permitted, once the user logs out, the authentication process is executed again at the next login. In this way, once authenticated, the files in the folder can be accessed all the time thereafter, and the risk of being exposed to an access threat by an unauthorized user (a malicious user) is extremely low.

  Further, the authentication processing system manages the timing of the start of authentication processing for file I / O. When a file I / O included in a plurality of folders is detected, the occurrence of a timeout at the start of authentication processing for each file I / O is detected, and the folder corresponding to the file I / O that has timed out is detected. Access (file writing and reading) is prohibited. In this way, file I / O for a plurality of folders can be managed efficiently, and the occurrence of traffic congestion of file I / O can be prevented.

  Further, the authentication processing system monitors the time of authentication processing for the file I / O, and prohibits access (file writing and reading) to the folder corresponding to the authentication processing that has timed out. As a result, when the authentication process takes time due to some trouble or the like, the process can be shifted to the authentication process for another file I / O, so that the process can be efficiently performed.

  In the authentication processing system, a plurality of file I / Os may occur for one folder. Therefore, in such a case, the plurality of file I / Os are detected and temporarily blocked. Then, when the authentication process to the file I / O is successful first among the plurality of file I / Os, all blocks for the other file I / Os are released. When the authentication process for the first file I / O fails, all other file I / Os are prohibited. In addition, when there are a plurality of file I / Os for one folder as described above, if one file I / O is permitted (not permitted), another file I / O to be continued is also permitted. (Disallowed) does not confuse the user.

  The present invention can also be realized by a program code of software that realizes the functions of the embodiments. In this case, a storage medium in which the program code is recorded is provided to the system or apparatus, and the computer (or CPU or MPU) of the system or apparatus reads the program code stored in the storage medium. In this case, the program code itself read from the storage medium realizes the functions of the above-described embodiment, and the program code itself and the storage medium storing the program code constitute the present invention. As a storage medium for supplying such program code, for example, floppy (registered trademark) disk, CD-ROM, DVD-ROM, hard disk, optical disk, magneto-optical disk, CD-R, magnetic tape, non-volatile A memory card, ROM, or the like is used.

  Also, based on the instruction of the program code, an OS (operating system) running on the computer performs part or all of the actual processing, and the functions of the above-described embodiments are realized by the processing. May be. Further, after the program code read from the storage medium is written in the memory on the computer, the computer CPU or the like performs part or all of the actual processing based on the instruction of the program code. Thus, the functions of the above-described embodiments may be realized.

  In addition, the program code of the software that realizes the functions of the embodiment is distributed via a network, so that it is stored in a storage means such as a hard disk or memory of a system or apparatus or a storage medium such as a CD-RW or CD-R. It may also be achieved by the computer (or CPU or MPU) of the system or apparatus reading and executing the program code stored in the storage means or the storage medium.

Claims (12)

An authentication processing system that executes authentication processing when accessing a cryptographic file stored in a folder using a computer that executes a program,
The encrypted file is encrypted with a common encryption key for each folder,
Access detection means for detecting access to the encrypted file;
An access blocking means for temporarily blocking access to the encrypted file when the access detecting means detects access to the encrypted file;
Authentication means for executing an authentication process in a state where the access is blocked;
If the result of the authentication process is authentication success, the access block to the encrypted file is released and access to the encrypted file is permitted. If the result of the authentication process is authentication failure, access to the encrypted file is permitted. Prohibit access, access permission means,
An encryption processing means for decrypting an encrypted file permitted to be accessed using the common encryption key;
An authentication processing system comprising: Further, when the access detection unit detects access to the encrypted file, the access detection unit includes an authentication state determination unit that determines an authentication state of the folder to which the encrypted file belongs
When the authentication status is “unauthenticated” and “authenticating”, the access block means temporarily blocks access to the encrypted file,
2. The authentication processing system according to claim 1, wherein, when the authentication state is “authenticated”, the encryption processing unit decrypts the encrypted file using the common encryption key. The access detection means detects each access to a plurality of encrypted files included in one folder,
The access permission unit releases all access blocks for the plurality of encrypted files when the authentication process to the first accessed encrypted file among the plurality of encrypted files succeeds, and the first access is made 3. The authentication processing system according to claim 1, wherein when an authentication process for an encrypted file fails, all accesses to the plurality of encrypted files are prohibited. Furthermore, an authentication timing management means for managing the timing of starting the authentication process for the encrypted file is provided,
The access detection means detects each access to each encrypted file included in a plurality of folders,
4. The authentication timing management unit according to any one of claims 1 to 3, wherein the authentication timing management unit detects occurrence of a timeout at the start of authentication processing for each encrypted file and prohibits access to the encrypted file that has timed out. The authentication processing system described in 1.   5. The authentication processing time management means for monitoring an authentication processing time for the encryption file and prohibiting access to the encryption file corresponding to the authentication processing that has timed out. The authentication processing system according to claim 1. A program for causing a computer to function as an authentication processing system that executes authentication processing when accessing an encrypted file stored in a folder,
The encrypted file is encrypted with a common encryption key for each folder,
The computer,
Access detection means for detecting access to the encrypted file;
An access blocking means for temporarily blocking access to the encrypted file when the access detecting means detects access to the encrypted file;
Authentication means for executing an authentication process in a state where the access is blocked;
If the result of the authentication process is authentication success, the access block to the encrypted file is released and access to the encrypted file is permitted. If the result of the authentication process is authentication failure, access to the encrypted file is permitted. Prohibit access, access permission means,
A program for functioning as encryption processing means for decrypting an encrypted file permitted to be accessed using the common encryption key. Further, when the access detection unit detects access to the encrypted file, the computer functions as an authentication state determination unit that determines an authentication state of the folder to which the encrypted file belongs,
When the authentication status is “unauthenticated” and “authenticating”, the access block means temporarily blocks access to the encrypted file,
The program according to claim 6, wherein, when the authentication state is “authenticated”, the encryption processing unit decrypts the encrypted file using the common encryption key. The access detection means detects each access to a plurality of encrypted files included in one folder,
The access permission unit releases all access blocks for the plurality of encrypted files when the authentication process to the first accessed encrypted file among the plurality of encrypted files succeeds, and the first access is made The program according to claim 6 or 7, wherein when the authentication process to the encrypted file fails, all access to the plurality of encrypted files is prohibited. Further, the computer is caused to function as an authentication timing management means for managing the timing of the authentication process start for the encrypted file,
The access detection means detects each access to each encrypted file included in a plurality of folders,
9. The authentication timing management unit according to any one of claims 6 to 8, wherein the authentication timing management unit detects occurrence of a timeout at the start of authentication processing for each encrypted file and prohibits access to the encrypted file that has timed out. The program described in.   Further, the computer is caused to function as an authentication processing time management unit that monitors an authentication processing time for the encrypted file and prohibits access to the encrypted file corresponding to the time-out authentication processing. The program according to any one of 6 to 9. An authentication processing method for executing an authentication process when accessing a cryptographic file stored in a folder using a computer that executes a program,
The encrypted file is encrypted with a common encryption key for each folder,
An access detecting means for detecting access to the encrypted file;
An access block means temporarily blocking access to the encrypted file when the access detecting means detects access to the encrypted file;
An authenticating unit executing an authentication process in a state where the access is blocked;
An access permission unit, if the result of the authentication process is successful, releases the access block to the encrypted file and permits access to the encrypted file; if the result of the authentication process is an authentication failure, A process of prohibiting access to the encrypted file;
An encryption processing unit decrypting an encrypted file permitted to be accessed using the common encryption key;
An authentication processing method comprising: An authentication processing system that executes authentication processing when writing a file in a confidential folder using a computer that executes a program,
The files in the confidential folder are encrypted with a common encryption key,
Access detecting means for detecting a file writing operation to the confidential folder;
Access block means for temporarily blocking writing of the file when the access detecting means detects the file writing operation;
Authentication means for executing authentication processing in a state where the writing is blocked;
An access permission means for releasing the block of writing when the result of the authentication processing is successful, and prohibiting writing of the file to the confidential folder when the result of the authentication processing is authentication failure;
Using the common encryption key, encrypting the unblocked file and writing to the confidential folder;
An authentication processing system comprising:

Images