JP2004158924A - File transfer system, key server apparatus, file sender, file memory, file receiver, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a file transfer system 101, etc. suited for transferring files safely. <P>SOLUTION: A key server apparatus 111 generates a seed, applies a specified random number generating function to the seed to generate a random number and sends the seed and the random number to a file transmitter 121. The file transmitter 121 receives the seed and the random number sent from the key server apparatus 111, encrypting a file to be transferred according to the random number to generate an encrypted file, and sends the seed and the encrypted file to a file memory 131. The file memory 131 receives the seed and the encrypted file sent from the transmitter 121 and stores the seed and the encrypted file. A file receiver 141 acquires the seed and the encrypted file stored in the memory 131, applies the specified random number generating function to the seed to generate the random number, and decrypts the encrypted file according to the random number to obtain the file to be transferred. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
SUMMARY OF THE INVENTION An object of the present invention is to provide a file transfer system, a key server device, a file transmission device, a file storage device, a file reception device suitable for safely transferring a file, and a program realizing these by a computer. And
[0002]
[Prior art]
2. Description of the Related Art Conventionally, various techniques have been proposed in order to ensure the security of communication paths for transferring various types of information using the Internet. For example, HTTPS (Hyper Text Transfer Protocol over SSL) using SSL (Secure Socket Layer) protocol is one example.
[0003]
On the other hand, even when a file is transferred using the SSL protocol or the HTTPS service, an Internet provider business that provides a service for transferring a file from a file transmission side to a file reception side is also active.
[0004]
In this case, the file is transmitted from the transmitting side of the file to the file server of the provider using HTTPS. The file server of the provider stores the transmitted files. The receiving side of the file acquires the file stored in the file server of the provider company. Thus, the file is transmitted.
[0005]
Therefore, the contents of the file transmitted to the malicious provider may be leaked.
[0006]
[Problems to be solved by the invention]
Therefore, there is a strong demand for a technique for easily improving security from a third party who may be in the middle of file transmission via a computer communication network.
[0007]
The present invention has been made in order to solve the above-described problems, and is preferably a file transfer system, a key server device, a file transmission device, a file storage device, a file reception device, which is suitable for performing file transfer safely. It is another object of the present invention to provide a program for realizing these by a computer.
[0008]
[Means for Solving the Problems]
To achieve the above object, the following invention is disclosed in accordance with the principle of the present invention.
[0009]
A file transfer system according to a first aspect of the present invention includes a key server device, a file transmission device, a file storage device, and a file reception device, and is configured as follows.
[0010]
That is, the key server device generates a seed, generates a random number by applying a predetermined random number generation function to the generated seed, and transmits the generated seed and the generated random number to the file transmitting device. .
[0011]
On the other hand, the file transmission device receives the seed transmitted from the key server device and the random number, encrypts the file to be transferred with the received random number, generates an encrypted file, and generates the received seed. And the generated encrypted file are transmitted to the file storage device.
[0012]
Further, the file storage device receives the seed and the encrypted file transmitted from the file transmission device, and stores the received seed and the encrypted file.
[0013]
Then, the file receiving device acquires the seed stored in the file storage device and the encrypted file, generates a random number by applying the predetermined random number generation function to the obtained seed, and generates the seed. The obtained encrypted file is decrypted with the random number to obtain a file to be transferred.
[0014]
Further, the file transfer system of the present invention can be configured as follows.
[0015]
That is, the key server device stores a program for a predetermined random number generation function in association with each of the plurality of file receiving devices.
[0016]
On the other hand, the file transmitting device transmits the destination of the file to be transferred to the key server device before receiving the seed and the random number.
[0017]
Further, the key server device receives the destination of the file to be transferred transmitted from the file transmitting device, acquires the program stored in association with the received destination, and executes the program to generate the key server device. The random number is generated by applying the predetermined random number generation function to the seed.
[0018]
Further, in the file transfer system of the present invention, a communication path used for transmitting an encrypted file from the file transmitting device to the file storage device can be configured to be encrypted.
[0019]
A file transfer system according to another aspect of the present invention includes a file transmission device, a file storage device, and a file reception device, and is configured as follows.
[0020]
That is, the file receiving device generates a seed, generates a random number by applying a predetermined random number generation function to the generated seed, and transmits the generated seed and the generated random number to the file transmitting device. .
[0021]
On the other hand, the file transmitting device receives the seed transmitted from the file receiving device and the random number, encrypts the file to be transferred with the received random number, generates an encrypted file, and generates the received seed. And the generated encrypted file are transmitted to the file storage device.
[0022]
Further, the file storage device receives the seed and the encrypted file transmitted from the file transmission device, and stores the received seed and the encrypted file.
[0023]
Then, the file receiving device acquires the seed stored in the file storage device and the encrypted file, generates a random number by applying the predetermined random number generation function to the obtained seed, and generates the seed. The obtained encrypted file is decrypted with the random number to obtain a file to be transferred.
[0024]
Further, in the file transfer system of the present invention, a communication path used for transmitting an encrypted file from the file transmitting device to the file storage device can be configured to be encrypted.
[0025]
A key server device according to another aspect of the present invention is a key server device in the above file transfer system.
[0026]
A file transmission device according to another aspect of the present invention is a file transmission device in the above file transfer system.
[0027]
A file receiving device according to another aspect of the present invention is a file receiving device in the above file transfer system.
[0028]
A program according to another aspect of the present invention is configured to function as any of the above key server device, the above file transmitting device, or the above file receiving device.
[0029]
The program can be recorded on various computer-readable information recording media such as a flexible disk, a CD-ROM (Compact Disk Only Memory), a DVD-ROM (Digital Versatile Disk ROM), and distributed and sold. Can be distributed and sold via a computer communication network such as the Internet.
[0030]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, an embodiment of the present invention will be described. Note that the embodiments described below are for explanation, and do not limit the scope of the present invention. Therefore, those skilled in the art can adopt embodiments in which each of these elements or all elements are replaced with equivalents, but these embodiments are also included in the scope of the present invention.
[0031]
(First Embodiment)
FIG. 1 is a schematic diagram showing a schematic configuration of the file transfer system according to the first embodiment of the present invention. Hereinafter, description will be made with reference to this figure.
[0032]
The file transfer system 101 includes a key server device 111, a file transmission device 121, a file storage device 131, and a file reception device 141.
[0033]
To transfer a file from the file transmission device 121 to the file reception device 141, first, information is uploaded from the file transmission device 121 to the file storage device 131, and the file storage device 131 accumulates the information. This is performed by downloading the stored information from the server to the file receiving device 141.
[0034]
At this time, the following configuration is adopted to prevent the third party operating the file storage device 131 from knowing the contents of the file to be transferred.
[0035]
FIG. 2 is a flowchart illustrating a procedure of processing executed in the file transmission device 121. FIG. 3 is a flowchart illustrating a procedure of processing executed in the key server device 111. FIG. 4 is a flowchart illustrating a procedure of processing executed in the file storage device 131. FIG. 5 is a flowchart illustrating a procedure of processing executed in the file receiving device 141. FIG. 6 is a response diagram of various messages exchanged between them. Hereinafter, description will be made with reference to these drawings as appropriate.
[0036]
First, the file transmitting device 121 transmits the destination of the file to be transferred to the key server device 111 (Step S201). In the present embodiment, the identifier associated with the file receiving device 141 (a company name, an IP (Internet Protocol) address, or the like, as long as the operator of the file receiving device 141 can be specified) may be used as the file. Will be transmitted as the destination.
[0037]
On the other hand, the key server device 111 stores a program for a predetermined random number generation function in advance in association with the identifier. The “program” is a binary or script form that can be actually executed, a parameter indicating which of a plurality of random number generators prepared in advance is used, various parameters given to the random number generator, or a combination thereof. It may be.
[0038]
As the random number generation function, any function that generates a “random number” when given a “seed” can be used. For example, the following can be adopted.
(1) Joint law. In the simplest congruential method, a random number is obtained by repeatedly multiplying a certain number by another number a certain number of times. By doing so, duplication between the file receiving devices 141 can be avoided as much as possible.
(2) MT (Mersenne Trister) method. By using either one of seed for random number generation and a random number generated by repetition as a parameter and using either one as a seed, duplication between file receiving devices 141 is avoided as much as possible. be able to.
[0039]
The number of random numbers generated by such an algorithm may be one, or a sequence of random numbers may be generated and used as a “random number”.
[0040]
Note that this “program” needs to be shared between the key server device 111 and the file receiving device 141. Typically, the key server device 111 provides a “program” that does not overlap with each other to the file receiving device 141 of each company, and stores the program in advance in association with the identifier.
[0041]
For example, when the MT method is adopted, a “seed” is selected from a seed space of 4096 bytes (about 30,000 bits). Therefore, if the length of the output random number sequence is shorter than 4096 bytes (for example, If it is 1024 bytes), information will be lost because the number of bytes is reduced, so it is impossible to calculate “seed” from the random number sequence. In the round-robin calculation, it is necessary to perform a test of the power of 2 to the 30,000th power, so that it is possible to ensure security higher than the key length of the existing public key / private key.
[0042]
When receiving the destination identifier of the file to be transferred transmitted from the file transmission device 121 (step S301), the key server device 111 acquires the program stored in association with the identifier (step S302).
[0043]
Next, the key server device 111 generates a seed (step S303). The above-described algorithm may be used for the generation of the seed, or the transmission / reception time of the identifier, the generation time of the seed, the process ID (Identifier) of the program used for the generation of the seed, the destination identifier, and the file transmission device 121 The assigned identifier and the information generated by combining the information may be used. For example, when this information is viewed as a byte string, various hash functions are applied to the information, its checksum, its MD (Message Digest) 5 value, its CRC (Cyclic Redundancy Check) value, and the like. Can be adopted.
[0044]
Then, by executing the program acquired in step S302, a predetermined random number generation function is applied to the generated seed to generate a random number used for encrypting the file (step S304).
[0045]
Then, the generated seed and the generated random number are transmitted to the file transmitting device 121 (step S305).
[0046]
On the other hand, the file transmitting device 121 receives the seed and the random number transmitted from the key server device 111 (Step S202).
[0047]
Then, the file to be transferred is encrypted with the received random number to generate an encrypted file (step S203). As a method of encrypting a file with a random number, various techniques such as techniques used in various block ciphers can be used.
[0048]
Then, the received seed and the generated encrypted file are transmitted to the file storage device 131 (step S204). It is desirable that the communication between the file transmission device 121 and the file storage device 131 be performed through an encrypted communication path. For example, a communication path based on the HTTPS protocol can be adopted. Thus, it is possible to prevent the encrypted file from being leaked to a third party.
[0049]
Further, the file storage device 131 receives the seed transmitted from the file transmission device 121 and the encrypted file (step S401). Then, the received seed and the encrypted file are stored (step S402).
[0050]
Then, when the file receiving device 141 transmits the acquisition request to the file storage device 131 (step S501), the file storage device 131 receives the request (step S403), and stores the stored seed and the encrypted file in the file. The response is sent to the receiving device 141 (step S404).
[0051]
On the other hand, the file receiving device 141 receives this response and acquires the seed and the encrypted file (step S502). It is desirable that the communication between the file receiving device 141 and the file storage device 131 is also performed through an encrypted communication channel such as a communication channel using the HTTPS protocol.
[0052]
Then, for the obtained seed, a predetermined random number generation function is used by using a prepared program (typically, a program provided in advance from the key server device 111 for the file receiving device 141 without duplication). Is applied to generate a random number (step S503). This random number should be the same as the one generated by the key server device 111 in step S304 or the one used by the file transmitting device 121 to generate the encrypted file in step S203.
[0053]
Next, the obtained encrypted file is decrypted using the generated random number to obtain a file to be transferred (step S504).
[0054]
In the present embodiment, the seeds and random numbers generated by the key server device 111 are temporary, and the possibility of overlapping each other is extremely low. Even if the seeds and the encrypted file are leaked to a third party (including the business of the file storage device 131), it is difficult to know the random number. Since a different random number is used, security can be improved.
[0055]
Further, the transfer of the encrypted file between the file device 121 and the file storage device 131 is performed through an encrypted communication path, so that leakage to a third party can be prevented as much as possible.
[0056]
Further, if the communication path for requesting a random number to the key server device 111 and the communication path for file transfer to the file storage device 131 are different, security can be further improved.
[0057]
Hereinafter, the method of the present embodiment will be compared with other existing technologies.
[0058]
First, in the public key method, "encryption is not possible in file units""Even if a public key / private key set is created in file units, it is necessary to manage key sets by the number of files"" In the case of addressing to a person, it is necessary to create a file for each address. " However, according to the present technology, file-by-file encryption is easy, and key management for each file is unnecessary.
[0059]
In the file-based common key method, it is necessary to generate keys for the number of files, and if the management of this key is left to the key server device, the file receiving device must restore the key to the key server device. Communication is required, and speeding up is difficult. However, according to the present technology, such a disadvantage does not occur.
[0060]
As a modification of the present embodiment, when the file receiving apparatus 141 logs in to the key server apparatus 111 so as to satisfy a predetermined security condition and transmits a seed, the key server apparatus 111 transmits a random number sequence corresponding to the seed. It is also possible to adopt a method of being available. Even in this case, if the key server device 111 holds a random number generation algorithm for each file receiving device 141, it is not necessary to manage a common key for each file.
[0061]
(Other embodiments)
In the above embodiment, by using the key server device 111, the management of the random number generation function and the processing of generating the seeds and the random numbers are outsourced from the file receiving device 141 company to the key server device 111 company. However, in the present embodiment, the file receiving device 141 itself performs these processes.
[0062]
FIG. 7 is a schematic diagram illustrating a schematic configuration of the file transfer system according to the present embodiment. The file transfer system 101 according to the present embodiment includes a file transmission device 121, a file storage device 131, and a file reception device 141. FIG. 8 is a response diagram of a message exchanged between them.
[0063]
First, the file transmission device 121 and the file reception device 141 secure a communication path that does not involve the file storage device 131, or a communication method that has a very low possibility of the contents being leaked to the file storage device 131. For example, a technology such as HTTPS communication can be used.
[0064]
Then, the file receiving device 141 generates a seed, generates a random number by applying a predetermined random number generation function to the generated seed, and compares the generated seed and the generated random number with this communication method. , To the file transmission device 121.
[0065]
On the other hand, the file transmitting device 121 receives the seed and the random number transmitted from the file receiving device 141 by this communication method, encrypts the file to be transferred with the received random number, and converts the encrypted file into an encrypted file. The generated and received seed and the generated encrypted file are transmitted to the file storage device 131.
[0066]
Further, the file storage device 131 receives the seed transmitted from the file transmission device 121 and the encrypted file, and stores the received seed and the encrypted file.
[0067]
Then, the file receiving device 141 acquires the seeds stored in the file storage device 131 and the encrypted file, generates a random number by applying the predetermined random number generation function to the obtained seeds, By using the generated random numbers, the obtained encrypted file is decrypted to obtain a file to be transferred.
[0068]
【The invention's effect】
As described above, according to the present invention, a file transfer system 101, a key server device 111, a file transmission device 121, a file storage device 131, a file reception device 141, and a file transfer system 101 suitable for performing file transfer safely. It is possible to provide a program for realizing these by a computer.
[Brief description of the drawings]
FIG. 1 is a schematic diagram illustrating a schematic configuration of a file transfer system according to a first embodiment of the present invention.
FIG. 2 is a flowchart showing a flow of processing executed in the file transmission device of the file transfer system according to the first embodiment of the present invention.
FIG. 3 is a flowchart illustrating a flow of processing executed in the key server device of the file transfer system according to the first embodiment of the present invention.
FIG. 4 is a flowchart showing a flow of processing executed in the file storage device of the file transfer system according to the first embodiment of the present invention.
FIG. 5 is a flowchart showing a flow of processing executed in the file receiving device of the file transfer system according to the first embodiment of the present invention.
FIG. 6 is a response diagram of a message in the file transfer system according to the first embodiment of the present invention.
FIG. 7 is a schematic diagram showing a schematic configuration of a file transfer system according to another embodiment of the present invention.
FIG. 8 is a response diagram of a message in the file transfer system according to another embodiment of the present invention.
[Explanation of symbols]
101 File transfer system 111 Key server device 121 File transmission device 131 File storage device 141 File reception device

Claims (9)

A file transfer system including a key server device, a file transmission device, a file storage device, and a file reception device,
(A) The key server device comprises:
Generate seeds,
Applying a predetermined random number generation function to the generated seed to generate a random number,
Transmitting the generated seed and the generated random number to the file transmission device,
(B) the file transmitting device includes:
Receiving the seed and the random number transmitted from the key server device,
With the received random numbers, encrypt the file to be transferred to generate an encrypted file,
Transmitting the received seed and the generated encrypted file to the file storage device,
(C) the file storage device comprises:
Receiving the seed transmitted from the file transmitting device and the encrypted file,
Storing the received seed and the encrypted file,
(D) the file receiving device includes:
Acquiring the seeds and the encrypted file stored in the file storage device,
A random number is generated by applying the predetermined random number generation function to the obtained seed,
Using the generated random number, the obtained encrypted file is decrypted to obtain a file to be transferred. The file transfer system according to claim 1, wherein
(D) the key server device comprises:
A program for a predetermined random number generation function is stored in association with each of the plurality of file receiving devices,
(E) The file transmitting device includes:
Prior to receiving the seed and the random number, a destination of a file to be transferred is transmitted to the key server device,
(F) The key server device comprises:
Receiving the destination of the file to be transferred transmitted from the file transmitting device,
Obtaining a program stored in association with the received destination,
A random number is generated by applying the predetermined random number generation function to the generated seed by executing the program. The file transfer system according to claim 1 or 2,
A communication path used for transmitting an encrypted file from the file transmission device to the file storage device is encrypted. A file transfer system including a file transmission device, a file storage device, and a file reception device,
(A) The file receiving device includes:
Generate seeds,
Applying a predetermined random number generation function to the generated seed to generate a random number,
Transmitting the generated seed and the generated random number to the file transmission device,
(B) the file transmitting device includes:
Receiving the seed and the random number transmitted from the file receiving device,
With the received random numbers, encrypt the file to be transferred to generate an encrypted file,
Transmitting the received seed and the generated encrypted file to the file storage device,
(C) the file storage device comprises:
Receiving the seed transmitted from the file transmitting device and the encrypted file,
Storing the received seed and the encrypted file,
(D) the file receiving device includes:
Acquiring the seeds and the encrypted file stored in the file storage device,
A random number is generated by applying the predetermined random number generation function to the obtained seed,
Using the generated random number, the obtained encrypted file is decrypted to obtain a file to be transferred. The file transfer system according to claim 4, wherein
A communication path used for transmitting an encrypted file from the file transmission device to the file storage device is encrypted. A key server device in the file transfer system according to claim 1. A file transmission device in the file transfer system according to claim 1. A file receiving device in the file transfer system according to claim 1. A non-transitory computer-readable storage medium storing a program that causes a computer to function as one of the key server device according to claim 6, the file transmitting device according to claim 7, and the file receiving device according to claim 8.

Images