JP2000172548A - Electronic data management method and device and recording medium of electronic data management program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a means which inhibits a key against a wrong user to discriminate the electronic data to be protected from other data and then prevents the wrong user from recognizing the location of the electronic data to be protected. SOLUTION: When the electronic data are stored, an electronic data dividing part 12 divides the electronic data which are handled as a single source electronic file into at least two or more pieces. An electronic data enciphering part 13 enciphers the divided electronic data, and a divided data management part 14 stores the enciphered electronic data 19 in an electronic data storing part 15 as divided files and also manages the divided data management information 18 on the storage of the divided files. When the electronic data are acquired, the part 14 reads out the data 19 based on the information 18. Then an electronic data decoding part 16 decodes the data 19 and an electronic data reconfiguring part 17 integrates the decoded data 19 to reconfigure them into the original electronic data.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronic data management method and an electronic data management device for securely managing electronic data stored on an electronic computer.

[0002]

2. Description of the Related Art Usually, electronic data is stored as a set of files for each file and managed on an electronic computer. In the management, a name and a creation date and time are assigned to each file so that a set of data can be distinguished from others. Originally, only the legitimate user of the electronic data should be able to use the electronic data. However, when a person other than the authorized user uses the computer in which the electronic data is stored In addition, without any contrivance, the use of the electronic data cannot be restricted. As a countermeasure, it has been considered to encrypt electronic data for each file. However, the management for each file leaves a clue for an unauthorized user to distinguish the electronic data from other electronic data.

[0003]

SUMMARY OF THE INVENTION An object of the present invention is to provide an unauthorized user with a means for sealing a key for distinguishing electronic data to be protected from other electronic data, thereby providing an electronic device to be protected. It is to hinder recognition of the location of data.

[0004]

In the management of electronic data, when storing electronic data, the electronic data stored in one original electronic file is encrypted, and the encrypted data is divided into at least two or more divided files. The file is divided, and attribute information of the divided files and the original electronic file and encryption information are stored. At the time of using (acquiring) the electronic data, a divided file derived from the original electronic file is acquired, the electronic data of the acquired divided file is integrated, and the integrated electronic data is decoded.

Alternatively, when storing electronic data, the electronic data stored in one original electronic file is divided into at least two or more divided files, and the electronic data stored in the divided files is encrypted for each divided file. Then, the divided files, the attribute information of the original electronic file, and the encryption information are stored. When using (acquiring) electronic data, a divided file derived from the original electronic file is acquired, the encrypted data in the divided file is decrypted for each divided file, and the decrypted data is integrated to integrate the electronic data. Make it available.

A program for realizing each of the above processing means by a computer can be stored in an appropriate recording medium such as a computer-readable portable medium memory, a semiconductor memory, and a hard disk.

[0007]

DESCRIPTION OF THE PREFERRED EMBODIMENTS [First Embodiment] As a first embodiment of the present invention, a series of electronic data is divided on an electronic computer, and each divided electronic data is encrypted and managed. An example of the case will be described.

FIG. 1 is a diagram showing a schematic configuration of an electronic data management device according to the first embodiment. In the figure, 10 is an electronic data management device, 11 is an electronic data input / output unit, 12
Is an electronic data division unit, 13 is an electronic data encryption unit, 14
Denotes a divided data management unit, 15 denotes an electronic data storage unit, 16 denotes an electronic data decryption unit, 17 denotes an electronic data reconstructing unit, 18 denotes divided data management information, and 19 denotes encrypted electronic data.

When storing electronic data, the electronic data management device 10 receives the data through the electronic data input / output unit 11 and divides the received data into the electronic data division unit 12.
In, the data is divided into uncorrelated data. Further, the divided data is encrypted in the electronic data encryption unit 13 and sent to the divided data management unit 14. In the divided data management unit 14, the encrypted data (encrypted electronic data 19) is stored in the electronic data storage unit 15, and information on the storage location and division is managed as divided data management information 18.

However, the data divided by the electronic data dividing unit 12 is a data whose size cannot be grasped from one of the divided data and whose relation to other data cannot be inferred.

In general, various encryption methods have been conventionally proposed, and any encryption method may be used in the encryption performed by the electronic data encryption unit 13. For example, when a common key cryptosystem is used, key management can be performed easily. The common key encryption method is an encryption method in which a key to be encrypted and a key to be decrypted are the same key. In contrast, when the public key cryptosystem is applied to the present system, encryption and decryption can be performed by managing two keys. However, public key cryptography generally requires a considerable amount of calculation time, and it is necessary to reduce the time required for calculation using a high-performance computer.

When returning the divided data, the encrypted electronic data 19 stored in the electronic data storage unit 15 is selected from the divided data management information 18. Next, the electronic data decrypting unit 16 decrypts the encrypted electronic data 19, and the electronic data reconstructing unit 17 integrates and reconstructs the divided electronic data as one electronic data. The reconstructed electronic data is transmitted through the electronic data input / output unit 11.

FIG. 2 is a processing flowchart of the electronic data storage processing according to the first embodiment of the present invention. When storing electronic data, first, the electronic data dividing unit 12
The electronic data is divided by the electronic data encryption unit 13 (step S11), and the electronic data divided by the electronic data encryption unit 13 is encrypted (step S12). The divided data management unit 14 stores the divided data management information 18 regarding the storage location of the encrypted electronic data (step S13), and the divided electronic data 19 is stored in the electronic data storage unit 15.
Is accumulated (step S14).

FIG. 3 is a processing flowchart of the electronic data acquisition processing according to the first embodiment of the present invention. When acquiring the stored electronic data, first, the divided data management information 18 regarding the storage location of the divided and stored electronic data is obtained (step S21), and based on the divided data management information 18, The divided encrypted electronic data 19 is obtained (step S22). Next, the encrypted electronic data 19 is decrypted by the electronic data decryption unit 16 (step S23), and the electronic data is integrated and reconfigured by the electronic data reconfiguration unit 17 (step S24). This makes electronic data available.

In this embodiment, an example is shown in which the encrypted electronic data is divided and managed. However, when the electronic data is divided in this way and the individual data is encrypted, the divided individual data is However, the same encryption key may be used, or management may be performed with one key. In addition, instead of using the encryption key, the data may be encrypted by scrambling the data in a different order.

[Second Embodiment] An example in which encrypted electronic data is divided on an electronic computer and the divided electronic data is managed will be described below as a second embodiment. FIG. 4 is a diagram illustrating a schematic configuration of an electronic data management device according to the second embodiment. In the figure, 20 is an electronic data management device, 21 is an electronic data input / output unit, 22 is an electronic data encryption unit, 23 is an electronic data division unit, 24 is a divided data management unit, 25 is an electronic data storage unit, and 26 is an electronic data storage unit. A data reconstructing unit, 27 is an electronic data decrypting unit, 28 is divided data management information, and 29 is encrypted electronic data.

The electronic data input / output unit 21 inputs and outputs electronic data to be stored. When the application stores and acquires the data using the present apparatus, data exchange with the application is performed via the electronic data input / output unit 21.

The electronic data encryption section 22 encrypts the electronic data received by the electronic data input / output section 21. It does not matter how to perform the encryption. The electronic data division unit 23 divides the electronic data encrypted by the electronic data encryption unit 22. However, when the block encryption is used as the encryption method in the electronic data encryption unit 22, as shown in FIG.
Is a group (block data 32, 33, 34,
35) Since each block is encrypted and treated as one piece of encrypted electronic data 36, each block data is divided.

In the divided data management unit 24, information indicating where the data is to be stored is described in the divided data management information 28, and the encrypted electronic data 29 is stored in the electronic data storage unit 25.

When taking out the electronic data, the encrypted electronic data 29 stored in the electronic data storage unit 25 is taken out based on the divided data management information 28. After the electronic data reconstructing unit 26 reconstructs the encrypted electronic data 29 obtained based on the divided data management information 28, the electronic data decrypting unit 27 decrypts the encrypted electronic data 29 into the original electronic data.

FIG. 6 is a processing flowchart of the electronic data storage processing according to the second embodiment of the present invention. When the electronic data to be stored is input by the electronic data input / output unit 21, the electronic data is first encrypted by the electronic data encryption unit 22 (step S41), and the electronic data encrypted by the electronic data division unit 23 is divided (step S41). S4
2). Next, the divided data management unit 24 stores the divided information and the accumulated information of the electronic data as the divided data management information 28 (step S43), and
To store the encrypted electronic data 29 (step S4).
4).

FIG. 7 is a processing flowchart of the electronic data acquisition processing according to the second embodiment of the present invention. First, the divided data management information 28 indicating how the requested electronic data is stored is acquired (Step S).
51), the encrypted electronic data 29 is acquired based on the divided data management information 28 (step S52). Next, the obtained encrypted electronic data 29 is stored in the divided data management information 2.
8 (step S53), and decrypts the original electronic data before division and encryption (step S54).

[Application Example] Next, as an application example of the present invention,
An example in which electronic data (hereinafter, referred to as a file) created by an application (editor) is divided and managed will be described. In this example, an editor that edits text data such as a program is used as an application, and a text file is used as a file.

It is assumed that a file management program having each means shown in FIG. 1 or 2 is registered in the editor. The registration to the editor is premised on the plug-in method that starts as a helper program dedicated to the editor, but it goes without saying that the daemon program method that resides on the computer (the program is always running) may be used. FIG. 8A shows a program configuration example in the case of the plug-in system, and FIG. 8B shows a program configuration example in the case of the daemon program system. In particular, in the case of the daemon program system shown in FIG.
It is also possible to receive a file storage request from a program other than 3.

When saving the electronic data of the edited text, the editor requests the file management program to perform a file saving process. The file management program checks whether the requested file exists from the file management table stored in advance, and if the requested file does not exist,
The file management information is newly registered in the file management table. This file management table stores the divided data management information 18 of FIG. 1 or the divided data management information 28 of FIG.
Is a table that holds.

FIG. 9 shows an example of divided data management information managed by the file management table. The components of the file management table include a file name to be saved, an encryption key for encrypting the file, the number of file divisions, and the names of the divided files. As shown in FIG. 10, a file name to be divided and stored can be distributed and stored on a network by specifying a storage destination such as an absolute path at the same time as the file name.

If the file has already been registered, a variable based on the file name is created, and the file is encrypted as an encryption key. When generating an encryption key from a file name, a general random number generation function may be used, or an encryption key may be directly generated from a file name. For example, it is also possible to convert the file name into ASCII code, extract the first bit of each character, and use it as a new character code. Since the ASCII code is one character in one byte, it is possible to delete surplus data when there is a large number and to complement it with 0 when there is not enough. If the head of the file name is the same, the file can be separated by, for example, taking an exclusive OR with the date and time of storage.

Next, the encrypted file is divided.
When a block cipher is used for encryption, a specific bit pattern may be detected depending on the encryption method because the data is encrypted as a set of data for each bit unit. In this case, it is necessary to divide the original data so that it is not known.

For example, one bit is extracted from the encrypted data for each encrypted block unit, and is set as one file. When encrypting in 56-bit units, 56 files are created.

In the case of encryption after division, if the data to be encrypted is an ASCII code, each character is represented in units of 1 byte, and therefore, is extracted for each bit of each code (character). , Save as one file.
The first bit of each character is treated as one divided file. In this case, since 1 byte = 8 bits, eight divided files are generated.

FIG. 11 shows an example of encryption by converting a character data bit string. “10110110” and the like represent characters in a bit string. FIG.
1 (A) is an example of electronic data to be stored, FIG.
(B) is an example of the divided and encrypted electronic data.
In this example, the first bit of each character of the electronic data 50 is sequentially extracted, and a character bit string 10110011...
And By doing this for each bit,
Divided files 51 to 58 each consisting of a set of data of the first to eighth bits are generated.

Next, the divided data is given a file name that can be inferred to be one file from each other, stored in a storage device, and the information is recorded in a file management table. The file may be named arbitrarily by the program based on the number of divisions and the file name.

When acquiring electronic data when using electronic data, the file management program extracts the file name of the divided data from the file management table and acquires each divided file. Next, an encryption key generated based on the file name is obtained, and the encrypted electronic data is decrypted. Further, the original data is restored and the file is reconstructed according to the divided method.

In this example, the management of the encryption key is performed by a file management program, and is used only within the program.
That is, the encryption key is not notified to the outside in response to a request from another application or the like. When the program ends, the program itself uses the encryption key to encrypt the file management table shown in FIG. 9 including the encryption key, and saves the file as a file.

The above-described file management program has a plug-in method suitable for application-dependent storage, but a daemon program for use by other applications and services. By using this method, this method can be easily used. In this case, it is needless to say that in order to prevent an unauthorized user (or an application or a service) from accessing the file, it is necessary to prove the legitimacy of the file access using an existing security method such as user authentication.

[0036]

As described above, according to the present invention,
By dividing and managing electronic data in advance on an electronic computer, it becomes possible for a person other than a legitimate electronic data user to make it difficult to obtain electronic data that has been easily obtained conventionally.

Further, by encrypting the electronic data to be divided in advance, it becomes difficult to restore the encrypted and divided electronic data.

Further, by encrypting each of the divided electronic data, it becomes difficult to restore the divided and encrypted electronic data.

[Brief description of the drawings]

FIG. 1 is a diagram illustrating a schematic configuration of an electronic data management device according to a first embodiment of the present invention.

FIG. 2 is a processing flowchart of electronic data storage processing according to the first embodiment.

FIG. 3 is a processing flowchart of electronic data acquisition processing according to the first embodiment.

FIG. 4 is a diagram illustrating a schematic configuration of an electronic data management device according to a second embodiment of the present invention.

FIG. 5 is a diagram illustrating an example of a block cipher.

FIG. 6 is a processing flowchart of electronic data storage processing according to the second embodiment.

FIG. 7 is a processing flowchart of electronic data acquisition processing according to the second embodiment.

FIG. 8 is a diagram for describing an example of cooperation with an application.

FIG. 9 shows divided data management information (file management table).
It is a figure showing the example of.

FIG. 10 is a diagram showing an example of names at the time of saving a divided file.

FIG. 11 is a diagram illustrating an example of encryption by converting a character data bit string.

[Explanation of symbols]

 10, 20 Electronic data management device 11, 21 Electronic data input / output unit 12, 23 Electronic data division unit 13, 22, Electronic data encryption unit 14, 24 Divided data management unit 15, 25 Electronic data storage unit 16, 27 Electronic data decryption Unit 17, 26 Electronic data reconstructing unit 18, 28 Divided data management information 19, 29 Encrypted electronic data

Continuing on the front page (72) Inventor: Hoshiko Watanabe 3-19-2 Nishi-Shinjuku, Shinjuku-ku, Tokyo Nippon Telegraph and Telephone Corporation (72) Inventor: Noboru Sonehara 3-19-2, Nishi-Shinjuku, Shinjuku-ku, Tokyo Nippon Telegraph and Telephone Corporation F-term (reference) 5B017 AA07 BA07 BB02 CA16 5B065 BA00 PA04 PA16 5B082 GA02 GA11 5J104 AA12 JA03 JA07 NA02 NA30 PA14

Claims (6)

[Claims] 1. An electronic data management method for managing electronic data processed on a computer, comprising: inputting a series of electronic data to be stored; encrypting the electronic data; Dividing the divided files into two or more divided files, storing the divided files and storing management information relating to the accumulation, acquiring the divided files based on the management information, Integrating the electronic data of the file and reconstructing the encrypted data before the division;
An electronic data management method, comprising: decoding the reconstructed electronic data; and outputting the decoded electronic data. 2. An electronic data management method for managing electronic data processed on a computer, comprising: inputting a series of electronic data to be stored; and dividing the electronic data into at least two or more electronic data. A step of encrypting the divided electronic data for each divided data, a step of storing the encrypted divided data as a divided file, and a step of storing management information relating to the storage; Obtaining the divided file, and converting the obtained electronic data of the divided file into
A decoding process for each divided file; a process of integrating the decoded data of each divided file to reconstruct original electronic data; and a process of outputting the reconstructed electronic data. Electronic data management method. 3. An electronic data management apparatus for managing electronic data processed on a computer, comprising: means for inputting / outputting electronic data treated as one original electronic file; Means for encrypting, means for dividing the encrypted data into at least two or more divided files, means for storing the divided files and managing management information relating to the storage, and means for storing the original data based on the management information. Means for acquiring the divided file derived from an electronic file, means for integrating and reconstructing the acquired electronic data of the divided file, and means for decoding the reconstructed electronic data. Electronic data management device. 4. An electronic data management device for managing electronic data processed on a computer, comprising: means for inputting / outputting electronic data treated as one original electronic file; Means for dividing at least two or more pieces of electronic data; means for encrypting the divided electronic data for each divided data; storing the encrypted divided data as a divided file; Means for managing the divided files derived from the original electronic file based on the management information; means for decoding the acquired electronic data of the divided files for each divided file; Means for integrating decrypted data for each and reconstructing the original electronic data. 5. A recording medium on which a program for managing electronic data processed on a computer is recorded.
A process of encrypting electronic data handled as original electronic files, a process of dividing the encrypted data into at least two or more divided files, storing the divided files, and storing management information relating to the storage. Processing to obtain the divided file derived from the original electronic file based on the management information; processing to integrate and reconstruct the electronic data of the obtained divided file;
An electronic data management program recording medium, wherein a program for causing a computer to execute the process of decoding the reconstructed electronic data is recorded. 6. A recording medium on which a program for managing electronic data processed on a computer is recorded.
A process of dividing electronic data treated as individual original electronic files into at least two or more electronic data, a process of encrypting the divided electronic data for each divided data,
Storing the encrypted divided data as a divided file and storing management information relating to the storage; acquiring the divided file derived from the original electronic file based on the management information; A program for causing a computer to execute a process of decoding the electronic data of the divided file for each divided file and a process of integrating the decoded data for each divided file and reconstructing the original electronic data are recorded. Characteristic electronic data management program recording medium.