JP2005286402A - Server and program for encryption key management terminal and program for acquiring encryption key system and method for encryption key management - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an encryption key management server having a higher security intensity. <P>SOLUTION: The server is provided with a user information synchronization means 22 for receiving at least any one of the user name of a user and a department/section to which the user belongs to from a user authentication server 1, and storing the received information as user information 22; a means for generating key information 23 so that the identifier of a file capable of reading any one of the user name or the belonging department/section and an encryption key for making the file into a plain text are correlated to any one of the user name and the belonging department/section, and storing the generated information 23; and a key providing means 24 for reading key information 53 on the basis of an acquiring request of the encryption key to be received from a user terminal 5 of a user if log-in of the user is authenticated by the server 1, extracting the identifier of the file correlated to the user name and the user's belonging department/section and the encryption key, and transmitting them to the user terminal 5. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an encryption key management server and an encryption key management program for managing an encryption key of a shared file that can be referenced from a plurality of terminals, an encryption key acquisition terminal and an encryption key acquisition program for acquiring an encryption key, an encryption key management server, and an encryption The present invention relates to an encryption key management system and an encryption key management method in a key acquisition terminal.

  With the development of information devices in recent years, information devices such as personal computers are used on a daily basis in the work of organizations such as companies and organizations. A computer is assigned to each individual and may be used not only for making proposals and research reports for customers, but also for distributing documents and for censorship. In such a case, it is required that the file can be accessed from a plurality of computers.

  For example, in an organization, a file server is provided in a network domain in which computers participate, and a shared folder and a shared file set in the file server can be accessed from a plurality of clients. It is preferable that those who can access these folders and files are limited according to their attributes. This access right may be provided for each user, or may be provided for each user's job title or department.

  These folders and files are preferably encrypted with an encryption key so that information leakage is prevented and only a predetermined person can view. For example, even if an encrypted file is illegally acquired by a third party without access rights, the file cannot be decrypted without the encryption key, avoiding the worst situation of information leakage be able to.

  However, an encryption key is set for each folder or file, and it is difficult to input the encryption key every time the client accesses the folder or file. In order to increase the encryption strength, it is common to increase the number of bits of the encryption key or increase the types of characters and symbols used for the encryption key. However, if the encryption strength is increased, it is difficult to memorize the encryption key. turn into. Therefore, even if an encryption key is set for each folder or file, it is difficult for the user to store the encryption key for each folder or file. Also, an encryption key may be set for each user, job title, and department, and it is difficult for the user to store and manage all the encryption keys for each file or folder.

Here, a group in which a file operation request from an application program is hooked, encryption / decryption is automatically performed, and a directory to be encrypted and a user list capable of decrypting the encrypted file are set for each user in advance. There is an encryption method (for example, Patent Document 1). Furthermore, in the group encryption method described in Patent Document 1, a group key is generated and returned to the terminal. In the method described in Patent Document 1, a user list that can be decrypted is incorporated, so that even if an unauthorized user tries to decrypt, it is impossible to decrypt.
JP-A-10-260903

  However, in the group encryption method described in Patent Document 1, since the encryption key is returned based on the user list, once the user obtains the encryption key, the encryption key is stolen by an unauthorized user. Even in this case, there is a problem that the file can be decrypted. Accordingly, a method for managing encryption keys with higher security strength is required.

  Accordingly, an object of the present invention is to provide an encryption key management server, an encryption key management program, an encryption key acquisition terminal, an encryption key acquisition program, an encryption key management system, and an encryption key management method with higher security strength.

  In order to solve the above-described problem, the encryption key management server according to the first feature of the present invention receives at least one of the user identifier of the user and the department to which the user belongs from the user authentication server and stores it as user information. Means for storing in the device, reading user information from the storage device, and an identifier of the file that can be read by at least one of the user identifier and the affiliated department, and an encryption key for normalizing the file include the user identifier and the affiliated department A means for generating key information in association with at least one and storing it in the storage device, and a storage device based on an acquisition request for an encryption key received from the user terminal of the user when the user authentication server authenticates the login of the user The key information is read from the file, and the file associated with the user identifier and the user's department Extracts identifier and the encryption key, and means for transmitting to the user terminal.

  Here, the user identifier is a word that uniquely identifies the user, such as a user name or a user ID. The user's department section includes not only the department to which the user belongs, but also all information related to user attributes such as work groups and job titles not related to the department.

  According to the encryption key management server according to the first feature of the present invention, an encryption key can be provided based on user authentication in the user authentication server. In addition, since the encryption key for each file identifier is stored in the storage device of the user terminal, the user does not need to store the encryption key for each file or folder.

  The file is preferably a shared file that is stored in a file server that can be connected by a plurality of user terminals and is protected by an encryption key associated with at least one of the user identifier and the assigned department.

  According to this, in a shared file accessible from a plurality of user terminals, the encryption key can be securely distributed to the plurality of user terminals.

  The file is preferably a protected file stored in a storage device inside the user terminal and protected by an encryption key.

  According to this, since the encryption key that encrypts the protected file is also managed by the encryption key management server, even if the user leaves the company or a sudden accident occurs, the administrator etc. can read the encryption key into the protected file by reading the encryption key. Can be accessed.

  The file is preferably a protected file that is stored in a storage device inside the user terminal and protected by a second encryption key that is plainly stored with the encryption key.

  According to this, since the encryption key can be easily worded by the user and the second encryption key can be complicated wording considering the security strength of the protected file, the encryption key and the second encryption key can be used. High security strength can be realized.

  The encryption key management program according to the second aspect of the present invention includes a step of receiving at least one of a user identifier of a user and a department to which the user belongs from a user authentication server, and storing the received information as user information in a storage device; The user information is read from the device, and the file identifier that can be read by at least one of the user identifier and the assigned department, and the encryption key for normalizing the file are associated with at least one of the user identifier and the assigned department. And when the user authentication server authenticates the login of the user, the key information is read from the storage device based on the encryption key acquisition request received from the user terminal of the user, User identifier and identifier of the file associated with the user's department Extracting the key to perform the steps on a computer to be transmitted to the user terminal.

  The file is preferably a shared file that is stored in a file server that can be connected by a plurality of user terminals and is protected by an encryption key associated with at least one of the user identifier and the assigned department.

  The file is preferably a protected file stored in a storage device inside the user terminal and protected by an encryption key.

  The file is preferably a protected file that is stored in a storage device inside the user terminal and protected by a second encryption key that is plainly stored with the encryption key.

  An encryption key acquisition terminal according to a third aspect of the present invention includes: means for transmitting a user identifier and a password input by a user from an input device to a user authentication server, and requesting user authentication in the user authentication server; When the server detects that the user has been authenticated, it sends a user identifier to the encryption key management server, and receives from the encryption key management server a file identifier that can be read by the user and an encryption key that standardizes the file. Means for associating a file identifier with an encryption key to generate key information and storing it in a storage device; and when reading a file at a user terminal, the key information is read from the storage device and the encryption key associated with the file identifier And means for reading out the file and plain-writing with the encryption key.

  An encryption key acquisition program according to a fourth aspect of the present invention includes a step of transmitting a user identifier and a password input by a user from an input device to a user authentication server, requesting user authentication in the user authentication server, and user authentication When the server detects that the user has been authenticated, it sends a user identifier to the encryption key management server, and receives from the encryption key management server a file identifier that can be read by the user and an encryption key that standardizes the file. The step of generating the key information by associating the file identifier with the encryption key and storing it in the storage device, and when reading the file at the user terminal, the key information is read from the storage device and the encryption key associated with the file identifier Extracting the file, reading the file, and plain-printing with the encryption key To be executed in.

  According to a fifth aspect of the present invention, there is provided an encryption key management system comprising: a user authentication server that authenticates a user; and an encryption key management system that includes an encryption key acquisition terminal that requests the user authentication server to authenticate the user. Is read from the storage device, the password associated with the user identifier input by the user is extracted from the first user information, the extracted password and the user terminal Compared with the transmitted password, if they match, the user authentication server provided with means for transmitting the fact that the user has been authenticated to the encryption key acquisition terminal, and the user identifier and password input from the input device by the user To the user authentication server and request user authentication on the user authentication server. If the user and the user authentication server detect that the user is authenticated, the user identifier is transmitted to the encryption key management server, and the file identifier that can be read by the user from the encryption key management server and the encryption that unifies the file. Means for receiving the key and associating the file identifier with the encryption key to generate key information and storing it in the storage device; when reading the file, the key information is read from the storage device and associated with the file identifier An encryption key acquisition terminal having means for extracting an encryption key, reading a file, and plaintating with the encryption key, and receiving a user identifier from the encryption key acquisition terminal, stored in the storage device and synchronized with the first user information The file identifier and the file that can be read by the user generated based on the generated second user information are plainly displayed. The encryption key is provided with means for reading out the key information stored in association with the user identifier from the storage device, extracting the file identifier and encryption key associated with the user identifier, and transmitting them to the encryption key acquisition terminal. A key management server.

  The encryption key management method according to the sixth aspect of the present invention relates to the step of transmitting the user identifier and password input by the user from the user terminal to the user authentication server, and associating the user identifier and password with the user authentication server. The first user information stored in the user authentication server is read out from the storage device of the user authentication server, and the password associated with the user identifier input by the user is extracted from the first user information. The password transmitted from the terminal is compared, and if they match, the step of transmitting the fact that the user has been authenticated to the user terminal, and if the user terminal detects that the user has been authenticated, the user identifier is encrypted. Sending to the management server and the user at the encryption key management server When the bespoke is received, the identifier of the file that can be read by the user generated based on the second user information stored in the storage device of the encryption key management server synchronized with the first user information, and the file The key information stored in association with the user identifier is read from the storage device of the encryption key management server, and the file identifier and encryption key associated with the user identifier are extracted and transmitted to the user terminal. And receiving the file identifier and encryption key associated with the user identifier at the user terminal, storing them as key information in the storage device of the user terminal, and storing the user terminal when reading the file at the user terminal Reads key information from the device, extracts the encryption key associated with the file identifier, And a step of plaintext with the encryption key reads the.

  Therefore, according to the present invention, it is possible to provide an encryption key management server, an encryption key management program, an encryption key acquisition terminal, an encryption key acquisition program, an encryption key management system, and an encryption key management method with higher security strength.

  Next, embodiments of the present invention will be described with reference to the drawings. In the following description of the drawings, the same or similar parts are denoted by the same or similar reference numerals.

(First embodiment)
As shown in FIG. 1, the encryption key management system according to the first embodiment of the present invention includes a user authentication server 1, an encryption key management server 2, a file server 3, a key manager terminal 4, and user terminals 5 and 6. It has. These terminals are connected to each other by a communication network 7 such as an in-house LAN.

  As shown in FIG. 2, the encryption key management server 2 according to the preferred embodiment of the present invention includes a central processing control device 101, a ROM (Read Only Memory) 102, a RAM (Random Access Memory) 103, and an input / output interface 109. Are connected via the bus 110. An input device 104, a display device 105, a communication control device 106, a storage device 107, and a removable disk 108 are connected to the input / output interface 109.

  The central processing control device 101 reads and executes a boot program for starting the encryption key management server 2 from the ROM 102 based on an input signal from the input device 104, and further reads an operating system stored in the storage device 107. Further, the central processing control device 101 controls various devices based on input signals from the input device 104, the communication control device 106, etc., and reads programs and data stored in the RAM 103, the storage device 107, etc. into the RAM 103. A processing device that loads and implements a series of processes to be described later, such as data calculation or processing, based on a program command read from the RAM 103.

  The input device 104 includes input devices such as a keyboard and a mouse through which an operator inputs various operations. The input device 104 generates an input signal based on the operation of the operator, and inputs via the input / output interface 109 and the bus 110. It is transmitted to the central processing control apparatus 101. The display device 105 is a CRT (Cathode Ray Tube) display, a liquid crystal display, or the like. The display device 105 receives an output signal to be displayed on the display device 105 from the central processing control device 101 via the bus 110 and the input / output interface 109. It is a device that displays the processing result of the control device 101 and the like. The communication control device 106 is a device such as a LAN card or a modem, and is a device that connects the encryption key management server 2 to a communication network such as the Internet or a LAN. Data transmitted / received to / from the communication network via the communication control device 106 is transmitted / received to / from the central processing control device 101 via the input / output interface and bus 110 as an input signal or an output signal.

  The storage device 107 is a magnetic disk device, and stores programs and data executed by the central processing control device 101. The removable disk 108 is an optical disk or a flexible disk, and signals read / written by the disk drive are transmitted / received to / from the central processing control apparatus 101 via the input / output interface 109 and the bus 110.

  The storage device 107 of the encryption key management server 2 according to the preferred embodiment of the present invention stores an encryption key management program and information such as second user information 22 and key information 23. Further, the user information synchronization means 21 and the key providing means 24 are installed in the encryption key management server 2 by the encryption key management program being read and executed by the central processing control device 101 of the encryption key management server 2.

  In this way, the encryption key management server 2 is realized by installing a software program such as an encryption key management program in a general computer and executing the software program in the central processing control device. Similarly, for the user authentication server 1, the file server 3, the key manager terminal 4, and the user terminals 5 and 6, a predetermined software program is installed in a general computer, and the software program is executed in the central processing control device. It is realized by.

  The user authentication server 1 includes user terminals 5 and 6 to a management domain provided on the communication network 7 based on user names and passwords transmitted from the user terminals 5 and 6 and the key manager terminal 4 and the key management. 1 is a server for authenticating login of the user terminal 4 or the like, and includes first user information 11 and user authentication means 12.

  Here, the user name is not limited to the user name, but may be any wording that can uniquely identify the user such as a user ID. For example, examples of the user name include “administrator”, “guest”, and “kumazaki”, and examples of the user ID include “S-XXXXXXX-111”.

  As shown in FIG. 3, the first user information 11 includes, for each user who can access the communication network 7 managed by the user authentication server 1, the user's department, the access authority to the user's file or folder, and the user's communication. A login password necessary for accessing the network 7 is stored. Here, the department to which the user belongs is stored, but in addition, when the access authority is set according to the set work group or title regardless of the department to which the user belongs, the title of the user may also be stored. .

  The user authentication means 12 reads out the first user information 11 stored in association with the user name and password from the storage device, and reads the password associated with the user name input by the user from the first user information 11. The extracted password and the password transmitted from the user terminal are compared, and if they match, the user terminal 5 or 6 (encryption key acquisition terminal) or key manager terminal indicates that the user has been authenticated. 4 is a means to transmit to

  The encryption key management server 2 includes user information synchronization means 21, second user information 22, key information 23, and key provision means 24.

  The user information synchronization unit 21 is a unit that downloads information related to only the user name and the assigned department from the user information 11 of the user authentication server 1, creates second user information 22, and stores the second user information 22 in the storage device 107. . The user information synchronization means 21 may be started and automatically executed at a preset time, or may be executed based on an instruction input from an input device such as the key manager terminal 4. Since the login password stored in the first user information 11 is security information unique to the user authentication server 1, the user information synchronization means 21 of the encryption key management server 2 does not download the login password, and does not download the login password. Only user information necessary for setting access rights and encryption keys, and user attribute information such as departments are extracted and downloaded.

  Here, the second user information 22 is user information synchronized with the first user information 11 stored in the storage device of the user authentication server 1. As shown in FIG. 4, the second user information 22 stores a user name and department, and these information are synchronized with the first user information 11 of the user authentication server 1.

  The key information 23 reads, for example, the second user information 22 from the storage device 107 based on the authority for each folder or file input from the key manager terminal 4, and at least one of the user name and the assigned department section. An identifier of the file that can be used and an encryption key for plainly locating the file are information that is generated in association with at least one of the user name and the assigned department and is stored in the storage device 107. As shown in FIG. 5, the key information 23 is stored in association with a target folder or file, an access right to the folder or file, and an encryption key for each department or user name. The access authority here is set for each action that can be executed by the user, such as an authority to read a file and an authority to update a file, and the encryption key may be stored based on the action. Further, in the key information 23, a new group that does not exist in the first user information 11 may be created independently, and a user name may be associated with the new group to set an access authority to a file or folder. In the key information 23, whether or not a file or folder can be accessed for each user may be set, or only the files and folders that can be accessed for each user without providing an access authority item as shown in FIG. It may be registered.

  When the user authentication server 1 authenticates the login of the user, the key providing unit 24 reads the key information 23 from the storage device 107 based on the encryption key acquisition request received from the user terminal 5 or 6 of the user. The file identifier and the encryption key associated with the user name and the user's department are extracted and transmitted to the user terminal 5 or 6. For example, when receiving an encryption key acquisition request including the user name of the logged-in user from the user terminal 5, the key providing unit 24 reads the key information 23, and identifies the file or folder accessible by the user, The encryption key is extracted and transmitted to the user terminal 5. Furthermore, referring to the user information 22, the access authority given to the attribute such as the department to which the user belongs is read out, and the identifier of the file or folder set to be accessible by the department and the encryption key Is preferably extracted and transmitted to the user terminal 5.

  The file that can be accessed by the user set by the key providing means 24 is stored in the file server 3 that can be connected by a plurality of user terminals 5 or 6 and is associated with at least one of the user name and the department to which the user belongs. It is a shared file or folder that is protected by.

  The file server 3 includes a storage device in which a shared file 31 accessible from a plurality of user terminals 5 or 6 is stored. The shared file 31 is stored in association with a folder, a directory, or the like, like a normal file. The shared file 31 can be read by the user terminal 6 if the user of the user terminal 5 and the user of the user terminal 6 have read / write authority, for example.

  The key manager terminal 4 includes shared file encryption means 41 and authority setting means 42.

  The shared file encryption unit 41 is a unit that encrypts the shared file 31 stored in the storage device of the file server 3 with an encryption key set for each file or folder. The encryption key used for encryption is managed by the key information 23 of the encryption key management server 2.

  The authority setting unit 42 is a unit that sets an encryption key for each user, department, file, or folder, generates key information, and stores it as the key information 23 in the storage device 107 of the encryption key management server 2. The key information 23 of the encryption key management server 2 may be created by associating the encryption key with the access authority for each user or file set by the management of the key administrator terminal 4. Alternatively, the encryption key management server 2 itself may generate the information based on the second user information 22 or a preset access authority to the shared file 31.

  The user terminal 5 includes a user authentication request unit 51, a key acquisition unit 52, key information 53, and a shared file decryption unit 54. The user terminal 6 has the same configuration as the user terminal 5.

  The user authentication request unit 51 is a unit 51 that transmits the user name and password input from the input device by the user to the user authentication server 1 and requests user authentication in the user authentication server 1.

  When the key acquisition unit 52 detects that the user is authenticated by the user authentication server 1, the key acquisition unit 52 transmits the user name to the encryption key management server 2, and the identifier of the file that can be read from the encryption key management server 2 by the user It is a means for receiving an encryption key for plain file and generating key information 53 by associating the identifier of the file with the encryption key and storing it in the storage device. The key acquisition means 52 may be executed by hooking the reception result of the user authentication request transmitted by the user authentication request means 51, or the user terminal 5 or 6 has been able to log on to the communication network 7. May be executed upon detection. As described above, the key acquisition unit 52 is preferably executed after confirming that the user terminal 5 or 6 is authenticated by the user authentication server 1.

  The key information 53 stores an encryption key set for each file or folder stored in the shared file 31.

  When the file of the shared file 31 is read by the user terminal 5, the shared file decryption unit 54 reads the key information 53 from the storage device, extracts the encryption key associated with the file identifier, reads the file and reads the encryption key. It is a means to make a peaceful culture. For example, the shared file decryption unit 54 minimizes the operation performed by the user by hooking a disk input / output command of an encrypted file or folder and automatically performing encryption or decryption processing. For example, when an encrypted file is read from the disk and stored in the memory, it is decrypted by hooking the disk input / output instruction, and when the file stored in the memory is written to the disk, the disk input / output instruction is hooked. And encrypt.

  Next, processing of the encryption key management system according to the first embodiment of the present invention will be described with reference to FIG. Here, the case where the user terminal 5 obtains the encryption key will be described, but the same applies to the user terminal 6.

  First, in step S <b> 101, an authentication request is transmitted to the user authentication server 1 by the user authentication request unit 51 of the user terminal 5. At this time, in the user terminal 5, for example, a login request message is generated based on a user name and a login password input from the input device by the user and transmitted to the user authentication server 1.

  When receiving the login request message from the user terminal 5, the user authentication server 1 refers to the first user information 11 to determine whether or not the user name and the password match, and in step S102, the authentication result is displayed as the user Transmit to terminal 5. Here, a case where the user authentication server 1 can authenticate the user of the user terminal 5 will be described.

  When the user terminal 5 receives the authentication result, the user terminal 5 logs in to the network, and in step S103, the authentication result obtained by authenticating the user of the user terminal 5 by the key acquisition unit 52 is hooked. When the authentication result is hooked in step S103, the key acquisition means 52 transmits a shared file encryption key acquisition request to the encryption key management server 2 in step S104. At this time, the key acquisition means 52 transmits the user name logged on to the user terminal 5 to the encryption key management server 2. When the encryption key management server 2 receives the shared file encryption key request from the user terminal 5, based on the user name received by the key providing unit 24, the identifier of the shared file or shared folder accessible by the user, that is, the file name And the folder name and the encryption key for encrypting or decrypting them are extracted from the key information 23. Furthermore, in step S105, the key providing unit 24 transmits the shared file identifier and the encryption key in association with the user terminal 5, and the key obtaining unit 52 of the user terminal 5 stores the key information 53 in the storage device.

  On the other hand, when the user of the user terminal 5 gives an instruction to access the shared file 31 stored in the file server 3 from the input device, in step S106, the user terminal 5 identifies the shared file 31 input from the input device. Is transmitted to the file server 3, and a request for acquiring the shared file is transmitted. The file server 3 extracts a file corresponding to the shared file identifier from the shared file 31 based on the shared file identifier of the shared file request received in step S <b> 107 and transmits the file to the user terminal 5. The shared file transmitted here is an encrypted file.

  Next, in step S108, the disk input / output command for the shared file is hooked, the encryption key of the file is read from the key information 53 and decrypted, and the shared file is encrypted with the encryption key and written to the disk.

  As described above, in the preferred embodiment of the present invention, the encryption key is transmitted to the user authenticated by the user authentication server 1. Thereby, authentication by two servers, the user authentication server 1 and the encryption key management server 2, becomes possible, and the security strength can be remarkably improved.

  Also, by implementing user authentication and key management on separate servers, an administrator can be placed on each server. Therefore, if you try to acquire access rights to the file by unauthorized means such as acquiring an administrator, you will need to acquire two administrators together, which improves durability against attacks such as acquisition be able to.

  In addition, usually through two stages of user authentication for logging in to the network and user authentication for acquiring the encryption key, the encryption key can be acquired only by logging in to the network. Performance and operability can be dramatically improved. Furthermore, only the password for logging in to the network needs to be stored, and the user can also enjoy the advantage of not having to store the encryption key for each file or folder. Furthermore, since the encryption key is stored in the storage device of the user terminal 5 and does not need to be stored by the user, the encryption key can be made longer and more complicated.

  As described above, according to the encryption key management system according to the preferred embodiment of the present invention, the encryption key can be managed with higher security strength.

(Second Embodiment)
Next, an encryption key management system according to the second embodiment of the present invention will be described with reference to FIG.

  The encryption key management system according to the second embodiment of the present invention includes a protection file 55 in the user terminal 5, and is different in that the encryption key management server 2 manages the encryption key of the protection file 55.

  That is, the user terminal 5 according to the second embodiment of the present invention includes a protected file 55, a protected file decryption unit 56, a protected file encryption key 57, and a protected file encryption key upload unit 58.

  The protected file 55 is a file that is stored in a storage device inside the user terminal 5 and protected by the protected file encryption key 57. When reading the protected file 55, the user inputs the protected file encryption key and temporarily stores it in the storage device, and the protected file 55 is decrypted with the protected file encryption key 57 and read into the memory. When the user terminal 5 is used by a plurality of users, the protected file 55 and the protected file encryption key 57 are preferably set for each user.

  The protected file encryption key 57 is an encryption key for decrypting or encrypting the protected file 55. The protected file encryption key 57 is stored in the protected file encryption key 57 by being input by the user.

  The protected file encryption key upload means 58 is means for uploading the encryption key stored in the protection file encryption key 57 to the encryption key management server 2. When receiving the data based on the protected file encryption key 57, the encryption key management server 2 stores the protected file encryption key in the key information 23. When the protection file 55 is set for each user, a protection file encryption key is preferably stored for each user. The protected file encryption key upload means 58 preferably uploads to the encryption key management server 2 when the user terminal 5 is connected to the communication network 7 and authenticated by the user authentication server 1.

  Alternatively, the protection file 55 may be encrypted through two-stage encryption by setting a second encryption key. For example, a second encryption key (not shown) is plainly written with the encryption key stored in the protection file encryption key 57, and the protection file 55 is encrypted with the plainly-written second encryption key. good. At this time, the protection file 55 is stored in the storage device inside the user terminal 5 and is protected with the second encryption key that is plainly stored with the protection file encryption key 57.

  According to this, in addition to protecting the protection file 55 by double encryption, an encryption key is set so that the user can store the protection file encryption key input by the user, and the protection file encryption key is input. In addition, since the second encryption key can be decrypted, the number of bits of the second encryption key can be increased or the number of characters to be used can be increased. Thereby, the protection file 55 is protected at a higher security level.

  As described above, according to the encryption key management system according to the second embodiment of the present invention, by providing a protection file in the user terminal 5, it is possible to ensure high security even when a plurality of computers are shared. it can.

  Further, by uploading the protected file encryption value to the encryption key management server 2, even if the user of the user terminal 5 retires or there is an accident, the administrator of the encryption key management server 2 stores the protection file 55. By reading the encryption key, the protected file 55 can be accessed.

(Other embodiments)
As described above, the first and second embodiments of the present invention have been described. However, it should not be understood that the description and drawings constituting a part of this disclosure limit the present invention. From this disclosure, various alternative embodiments, examples, and operational techniques will be apparent to those skilled in the art.

  It goes without saying that the present invention includes various embodiments not described herein. Therefore, the technical scope of the present invention is defined only by the invention specifying matters according to the scope of claims reasonable from the above description.

It is a system configuration figure of the encryption key management system concerning a 1st embodiment of the present invention. It is a block diagram of the encryption key management server which concerns on the 1st Embodiment of this invention. It is an example of the user information which the user authentication server which concerns on the 1st Embodiment of this invention manages. It is an example of the user information which the encryption key management server which concerns on the 1st Embodiment of this invention manages. It is an example of the key information which the encryption key management server which concerns on the 1st Embodiment of this invention manages. It is the sequence diagram which showed the process of the encryption key management system which concerns on the 1st Embodiment of this invention. It is a system configuration figure of the encryption key management system concerning a 2nd embodiment of the present invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... User authentication server 2 ... Encryption key management server 3 ... File server 4 ... Key manager terminal 5, 6 ... User terminal 7 ... Communication network 11 ... First user information 12 ... User authentication means 21 ... User information synchronization means 22 ... Second user information 23 ... Key information 24 ... Key providing means 31 ... Shared file 41 ... Shared file encryption means 42 ... Authority setting means 51 ... User authentication request means 52 ... Key acquisition means 53 ... Key information 54 ... Shared file Decryption means 55 ... Protected file 56 ... Protected file decryption means 57 ... Protected file encryption key 58 ... Protected file encryption key upload means 101 ... Central processing controller 102 ... ROM
103 ... RAM
104 ... Input device 105 ... Display device 106 ... Communication control device 107 ... Storage device 108 ... Removable disk 109 ... Input / output interface 110 ... Bus

Claims (12)

Means for receiving from the user authentication server at least one of the user identifier of the user and the department to which the user belongs, and storing it in the storage device as user information;
The user information is read from the storage device, and at least one of the user identifier and the assigned department section can be read, and an encryption key for plainly writing the file includes at least the user identifier and the assigned department section. Means for generating key information in association with one and storing it in the storage device;
When the user authentication is authenticated by the user authentication server, the key information is read from the storage device based on the encryption key acquisition request received from the user terminal of the user, and the user identifier of the user and the user An encryption key management server, comprising: means for extracting an identifier of the file and the encryption key associated with the belonging department and transmitting them to the user terminal.   The file is a shared file stored in a file server connectable by a plurality of user terminals and protected by an encryption key associated with at least one of the user identifier and a department to which the user belongs. 1. The encryption key management server according to 1.   The encryption key management server according to claim 1, wherein the file is a protected file stored in a storage device inside the user terminal and protected by the encryption key.   3. The encryption according to claim 1, wherein the file is a protected file that is stored in a storage device inside the user terminal and protected by a second encryption key that is plainly stored with the encryption key. Key management server. Receiving at least one of the user identifier of the user and the department to which the user belongs from the user authentication server, and storing it in a storage device as user information;
The user information is read from the storage device, and at least one of the user identifier and the assigned department section can be read, and an encryption key for plainly writing the file includes at least the user identifier and the assigned department section. Generating key information in association with one and storing it in the storage device;
When the user authentication is authenticated by the user authentication server, the key information is read from the storage device based on the encryption key acquisition request received from the user terminal of the user, and the user identifier of the user and the user An encryption key management program for causing a computer to execute the step of extracting the identifier of the file and the encryption key associated with the belonging department of the user and transmitting them to the user terminal.   The file is a shared file stored in a file server connectable by a plurality of user terminals and protected by an encryption key associated with at least one of the user identifier and a department to which the user belongs. 5. The encryption key management program according to 5.   7. The encryption key management program according to claim 5, wherein the file is a protected file stored in a storage device inside the user terminal and protected by the encryption key.   The encryption according to claim 5 or 6, wherein the file is a protected file that is stored in a storage device inside the user terminal and protected by a second encryption key that is plainly stored with the encryption key. Key management program. Means for transmitting a user identifier and a password input from an input device by a user to a user authentication server, and requesting authentication of the user in the user authentication server;
When detecting that the user is authenticated by the user authentication server, the user identifier is transmitted to an encryption key management server, and the identifier of the file that can be read by the user and the file are averaged from the encryption key management server. Means for receiving an encryption key to culture, associating the identifier of the file with the encryption key to generate key information and storing it in a storage device;
Means for reading out the file at the user terminal, reading out the key information from the storage device, extracting the encryption key associated with the identifier of the file, reading out the file and unambiguously using the encryption key; An encryption key acquisition terminal comprising: Transmitting a user identifier and password input from an input device by a user to a user authentication server, and requesting authentication of the user in the user authentication server;
When detecting that the user is authenticated by the user authentication server, the user identifier is transmitted to an encryption key management server, and the identifier of the file that can be read by the user and the file are averaged from the encryption key management server. Receiving an encryption key to culture, associating the identifier of the file with the encryption key to generate key information and storing it in a storage device;
When reading the file at the user terminal, reading the key information from the storage device, extracting the encryption key associated with the identifier of the file, reading the file and plain-printing with the encryption key; An encryption key acquisition program for causing a computer to execute In an encryption key management system comprising a user authentication server that authenticates a user, and an encryption key acquisition terminal that requests the user authentication server to authenticate the user,
First user information stored in association with a user identifier and a password is read from the storage device, and a password associated with the user identifier input by the user is extracted from the first user information and extracted. A user authentication server comprising means for transmitting, to the encryption key acquisition terminal, the fact that the user has been authenticated if the password and the password transmitted from the user terminal match,
Means for transmitting a user identifier and password input from the input device by the user to the user authentication server, and requesting authentication of the user in the user authentication server;
When detecting that the user is authenticated by the user authentication server, the user identifier is transmitted to an encryption key management server, and the identifier of the file that can be read by the user and the file are averaged from the encryption key management server. Means for receiving an encryption key to culture, associating the identifier of the file with the encryption key to generate key information and storing it in a storage device;
When reading the file, the key information is read from the storage device, the encryption key associated with the identifier of the file is extracted, the file is read, and means for reading out the file with the encryption key is provided. A key acquisition terminal;
When the user identifier is received from the encryption key acquisition terminal, an identifier of the file that can be read by the user generated based on the second user information stored in the storage device and synchronized with the first user information; And reading out key information stored in association with the user identifier from the storage device, and extracting the identifier and encryption key of the file associated with the user identifier, and An encryption key management system comprising: an encryption key management server comprising means for transmitting to an acquisition terminal. A user identifier and a password input by the user are transmitted from the user terminal to the user authentication server;
In the user authentication server, the first user information stored in association with the user identifier and password is read from the storage device of the user authentication server, and the password associated with the user identifier input by the user is A step of extracting from the first user information, comparing the extracted password with the password transmitted from the user terminal, and transmitting the fact that the user has been authenticated to the user terminal if they match. When,
When detecting that the user is authenticated at the user terminal, transmitting the user identifier to an encryption key management server;
When the user identifier is received at the encryption key management server, the user generated based on the second user information stored in the storage device of the encryption key management server synchronized with the first user information is read. And the key information stored in association with the user identifier is read from the storage device of the encryption key management server and is associated with the user identifier. Extracting the identifier and encryption key of the file and transmitting them to the user terminal;
In the user terminal, when receiving the identifier and encryption key of the file associated with the user identifier, storing the key information in the storage device of the user terminal;
When reading out the file at the user terminal, the key information is read out from the storage device of the user terminal, the encryption key associated with the identifier of the file is extracted, the file is read out, and the plaintext is read with the encryption key. An encryption key management method comprising the steps of:

Images