JP2000155717A - Data base sharing system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve the security of the data base contents of a data base sharing system. SOLUTION: A data base processing part 12 receives information as data base contents in a plain form format from a web server 11, converts it to a cipher format by a ciphering and deciphering module 31, and writes it in a cipher format in a storage device 32. A user when using the data base sharing system 10 should be authenticated by a server-side authentication module 13 and a security management device 14 through the IC card 19 that the user bears. For the IC-card authenticated user, information in the cipher format is read out of the storage device 32 and converted to a plain format by the ciphering and deciphering module 31, and its contents are shown. An unauthenticated hacker is unable to obtain information because of its cipher format even if getting and copying the data base contents by breaking into the system through its firewall.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a database cooperative use system which allows a large number of users to use a database of, for example, a patient requiring care or a patient or a database of a company while ensuring security. is there.

[0002]

2. Description of the Related Art A database cooperative use system is known in which a large number of specific users connect to a common database server via each terminal and cooperate with a database. In such a database cooperative use system, in order to ensure security, each user is required to input a password, or a firewall is constructed.

[0003]

The problems of the conventional database cooperative utilization system are as follows. (A) If a hacker enters a password or passes through a firewall, the contents of the database may be viewed or copied by the hacker. (B) Since the recording of the database in the storage device is performed in a set fixed length unit, useless areas are scattered depending on data, and the storage area becomes enormous as the number of records to be recorded increases. Also, the search time is extended. (C) A block cipher represented by the DES type cipher developed by IBM has a structure in which large-scale data processing takes time because data is sequentially encrypted in series in key length units, which is disadvantageous for high-speed data retrieval. It is.

An object of the present invention is to provide a database cooperative utilization system which can overcome the above-mentioned problems.

[0005]

The database cooperative use system (10) of the present invention has the following (a) to (f). (A) Encrypting means for converting data from a plain format to an encrypted format (b) Decrypting means for converting the data in the encrypted format generated by the encrypting means (31) into a plain format (c) A database in a plain format Writing means (30) for converting the contents into an encryption form by the encryption means (31) and writing the database contents in the encryption form to the storage means (32) (d) Reading the database contents in the encryption form from the storage means (32) (E) A genuine card which should be possessed by a user of the database as a database user by converting the data into a flat format by the decoding means (31) and outputting the contents of the database in the flat form. (1
Authentication means (13) for authenticating use of 9) (f) A flat-format database output by a flat-format data output means for a user authenticated by the authentication means (13) as being able to present database contents. Presentation means (11) for presenting contents to the user

The card (19) is usually an IC card. The database contents include not only character information but also image information and audio information. Plain format data is text written in ASCII code or JIS code for characters, or GIF for images.
, JPEG, etc., refers to a data storage format commonly used in commercially available applications, and the encryption format data is a file that has been encrypted in a flat format using an encryption key and has a file containing the data. Is opened using the file-opening application,
Define the meaning of the data contained in the file as unknown. That is, the meaning of the content of the data in the encrypted format cannot be known unless the file containing the data is opened and the data is further decrypted with the decryption key. This database cooperative use system (1
The database to which (0) is applied includes, for example, a database for a person requiring care, a database for collecting medical record information of each patient in a hospital, and a database for collecting confidential information in a company or the like. Entering a database for care recipients, a database for patient chart information, and a database for company confidential information,
Updates and browsing are restricted to specific individuals with confidentiality obligations.

The encryption and decryption of the contents of the database in the storage means (32) is usually performed by encrypting and decrypting each cell of the database (a unit uniquely determined by records and fields in the database). . The database to which this system is applied is not only a two-dimensional database in which a cell is specified by one record and one field, but also a cell by one record and two or more fields. Is also included in a three-dimensional or more database.

[0008] In this way, the contents of the database are converted into an encrypted form and stored in the storage means (32), so that a hacker can enter a password or break through a firewall,
Even if the database in the storage means (32) can be opened and peeped or downloaded, the data to be peeped or copied as long as the IC card (19) to be possessed by the database user is not authenticated. Is an encrypted form, so that the confidentiality of the database contents is maintained.

[0009] The database cooperative use system of the present invention
According to (10), the encryption and decryption processes of the encryption means (31) and the decryption means (31) are performed using MUMPS (JIS X
3011).

MUMPS as a programming language is A
It is established in each standard of NSI / ISO / JIS. When this MUMPS is used for a database content writing program, data is recorded in a variable length that varies with the length of the data, so that useless areas are prevented from being generated in the storage means (32), and efficient storage is achieved. it can. Also, MU
By the MPS, the database of the storage means (32) is not a relational database but a tree-structured database, and in data search, the search time can be greatly reduced by using a hierarchically structured index.

[0011] The database cooperative use system of the present invention
According to (10), the encryption and decryption algorithm is SXA
L / MBAL (ISO 9979).

SXAL / MBAL is developed by Laurel Intelligent Systems Co., Ltd. and registered in ISO9979 as an encryption algorithm. Variable-length encryption processing is possible, and high-speed encryption can be realized by batch encryption.

[0013] The database cooperative use system of the present invention
According to (10), the presentation means (11) is provided as a web server (11), and the user operates the storage means (32) from a terminal (18) connected to the web server (11) via a transmission line (25). Using a database, the web server (11) and the terminal (18) exchange data by encryption.

The transmission path (25) includes an intranet and the Internet. Since the data transmitted on the transmission path (25) is encrypted, it is prevented from leaking from the transmission path (25). The search instruction issued by the user at the terminal (18) is based on the encryption data for the transmission path (25) (the encryption data for the transmission path (25) is different from the encryption algorithm used by the encryption means (31)). It may be made by an encryption algorithm or may be made by the same encryption algorithm.) To the web server (11), and the web server (11) sends the encrypted data for the transmission path (25). Is decrypted and sent to the writing means (30). Conversely, the contents of the flat-format database output by the flat-format data output means are converted into encrypted data for the transmission path (25) in the web server (11),
It is sent to the terminal (18) via the transmission line (25).

A database cooperative use system according to the present invention
According to (10), the terminal (18) is equipped with a browser, and the user operates the web server (11) by the browser of the terminal (18).
Various search instructions are issued on the database use screen called from the user to the terminal (18), and search results are received.

Using the browser of the terminal (18), the terminal (18)
The database usage screen called from the web server (11) is also sent from the web server (11) to the terminal (18) in an encrypted format for the transmission path (25), and the terminal (18) converts the data into flat format data. After the conversion, it is displayed on the terminal (18) in a flat format.

[0017] The database cooperative use system of the present invention.
According to (10), the genuine card (19) is an IC card (19) which also serves as an authentication means for authenticating the user when using the browser in the terminal (18).

Since the user can be connected to the target Web server (11) after being authenticated by the authentication means at the terminal (18), the security of the database is enhanced. It is preferable that the user is authenticated by reading the IC card possessed by the user into the terminal (18). In addition, information for authentication is recorded on the IC card,
Preferably, the encryption key is changed for each session to generate an encryption format for the transmission path (25).

[0019]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is an overall view of a cooperative database system 10. The web server 11 sends and receives flat data to and from the database processing unit 12. The transmitted / received data includes a search command from the user, data related to a search result answer to the user, and the like. The server-side authentication module 13 and the security management device 14 select a user for cooperative use and authenticate the operating authority of the database. Further, for encryption communication on the transmission path 25, an encryption key is generated for each session. The proxy module 23 transmits / receives data to / from an external computer on behalf of the web server 11 when the web server 11 transmits / receives data to / from an external computer to / from the web server 11 disconnected from the outside, or caches data. To reduce the load of the web server 11 on the network, encrypt data to be output to the transmission path 25, and
Decrypts the encrypted data input from. The web server 11 and the terminal 18 are connected to each other by a transmission line 25 so as to realize 1: a large number of connection relationships. The web server 11 and the terminal 18 are connected to the transmission path 25 via the proxy module 23 and the encryption module 24 on each side. The transmission path 25 is, for example, a LAN, an intranet, the Internet, or the like. Server-side authentication module 13
Performs authentication that the user of the terminal 18 uses the genuine IC card 19 based on the data from the Proxy module 23.

FIG. 2 is a block diagram of the contents of the database processing unit 12. The database program execution unit 30 executes a program described by MUMPS as a programming language. The encryption / decryption module 31 is provided by SXAL / MBAL (Laurel Intelligent Systems Co., Ltd.).
PA)), and the encryption and decryption algorithm is also MUMPS.
And are incorporated in the database program execution unit 30. Database program execution unit 30
Means that each cell of the database ("cell")
Is defined as a database data unit determined by records and fields. ) Is input in a text format as one of the flat formats, is converted into an encryption format by an encryption algorithm, and is written in the storage device 32 with the information in the encryption format. The database program execution unit 30 also
Various commands (eg, a search command or a search formula) for using the storage device are input from the web server 11, and the command is executed. Database program execution unit 30
Although the data of each cell read from the storage device 32 is in an encryption format, the database program execution unit 30 decrypts the search result and the like by the decryption algorithm of the encryption / decryption module 31, and the web server 11 in the flat format. Pass to

A method of using the database cooperative use system 10 will be described. When using the terminal 18, the user sets the IC card 19 in a card reader near the terminal 18, and inputs his / her password. Only when the IC card 19 is present and the data in the IC card 19 matches the password, the user is determined to be authenticated at the terminal 18 and the browser for using the database cooperative use system 10 is Be able to start. When the browser starts on the terminal device 18, the browser requests connection to the web server 11 via the transmission path 25. Including this request, data transmission between the terminal device 18 and the web server 11 via the transmission path 25 is performed using data encrypted by the proxy module 23 and the encryption module 24.
The user connects his terminal 18 to the Prox through the transmission path 25.
When connected to the y module 23, the ID as normal authentication for login is read from the IC card 19, and is sent from the terminal 18 to the proxy module 23 via the transmission path 25. Further, the Proxy module 23 receives the information of the IC card 19 from the encryption module 24 via the transmission path 25, and the information is decrypted into a flat format and sent to the server-side authentication module 13. Server-side authentication module 13
Authenticates that the user has the access right to the Web server from the information of the IC card 19, and authenticates that the user is registered as a database user. Proxy module
The above-mentioned SXAL / MBAL is also used as the encryption / decryption algorithm used in the encryption module 23 and the encryption module 24. When the IC card authentication is completed, the server-side authentication module 13 uses the random number generated by the security management device 14 as a session encryption key via the transmission
To establish a cryptographic communication with the terminal 18 via the transmission path 25. In this way, a different encryption key is set for each session, and even if the transmission path 25 is the Internet, it can be used in terms of security equivalent to a dedicated transmission path. When the server-side authentication module 13 authenticates the connection with the terminal 18, the terminal 18 or the web server 11 is connected, and the database use screen is displayed on the web server 11 via the transmission path 25.
Is called to the terminal 18 and displayed on the terminal 18. The user executes a predetermined search request and views the search result on the usage screen.

The contents of the database in the storage device 32 are encrypted, and the IC card 19, which is required to be possessed by each user as a user of the database cooperative use system 10, is not authenticated by the server-side authentication module 13. As long as hackers do not use data in flat format,
It is difficult to decipher even if the storage device 32 is opened by invading the inside of the storage device 32.

[Brief description of the drawings]

FIG. 1 is an overall view of a database cooperative use system 10;

FIG. 2 is a block diagram of the contents of a database processing unit 12;

[Description of Signs] 10 Database cooperative utilization system 11 Web server (providing means) 13 Server-side authentication module (authentication means) 14 Security management device 18 Terminal 19 IC card (genuine card) 25 Transmission path 30 Database program execution unit ( (Writing means) 31 encryption / decryption module (encryption means decryption means) 32 storage device (storage means)

 ──────────────────────────────────────────────────の Continuation of the front page (71) Applicant 598160063 Yoshikazu Okada 3-8-2-104 Morinosato, Atsugi-shi, Kanagawa (72) Inventor Hirokazu Okubo 1-14-6 Dogenzaka, Shibuya-ku, Tokyo Kenwood Co., Ltd. (72) Inventor Takashi Ogasawara 1-14-6 Dogenzaka, Shibuya-ku, Tokyo F-term in Kenwood Co., Ltd. (Reference) EE03 HH35 JJ01 JZ09 LL03

Claims (6)

[Claims] 1. An encryption unit for converting data from a plain format to an encrypted format, and a decryption unit for converting the data in the encrypted format generated by the encryption unit into a flat format. (C) writing means for converting the plain-format database contents into an encryption form by the encryption means (31) and writing the database contents in the encryption form to the storage means (32)
(30), (d) flat format data output means for reading the database content in the encryption format from the storage means (32), converting the content into a flat format by the decryption means (31) and outputting the database content in the flat format, (E) authentication means (13) for authenticating to the user of the database that the user is using a genuine card (19) to be possessed as a database user; and (f) authentication means (13). ) Is provided with a presentation means (11) for presenting to the user the flat database contents output by the flat data output means for a user authenticated as being able to present the database contents. Database cooperative usage system. 2. The encryption means (31) and the decryption means
In the encryption and decryption processing of (31), the MUMPS (JI
2. The database cooperative use system according to claim 1, wherein a program described by SX3011) is used. 3. The encryption and decryption algorithm is S
3. The database cooperative use system according to claim 2, wherein the system is XAL / MBAL (ISO 9979). 4. The presenting means (11) is provided as a web server (11), and a user operates the storage means (32) from a terminal (18) connected to the web server (11) via a transmission line (25). , The web server (11) and the terminal
4. The database cooperative use system according to claim 1, wherein data is exchanged by encryption with (18). 5. The terminal (18) is provided with a browser, and a user can use the browser of the terminal (18) to call up the database using screen from the web server (11) to the terminal (18). 5. The system according to claim 4, wherein various search instructions are issued and search results are received. 6. The authentic card (19) is stored in the terminal (1).
6. The system according to claim 5, wherein said IC card is an IC card which also functions as an authentication means for authenticating a user when using said browser in said step 8).