JP2005318162A - Information leakage preventing system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an information leakage capable of preventing a system in such a manner that makes encrypted information hard to decrypt against accesses from other computer than that of a regular client, and limits the access from the regular clients to prevent the information from leaking. <P>SOLUTION: The information leakage preventing system comprises a DB 3 for storing data together with the data ID of the data after encrypting the data by different encrypt keys; a key managing server 2 for storing the encrypt keys for encrypting the data in corresponding to the data ID and decrypt keys for decrypting the encrypted data; and a main server 1 for acquiring corresponding decrypt key to the data ID from the managing server 2 and corresponding encrypted data from the DB 3 upon request of data from a client 4 to output the decrypt key and the encrypted data to the client 4. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an information leakage prevention system in a computer system for managing important information such as customer information, and more particularly, an information leakage prevention system capable of preventing a large amount of information leakage by restricting unauthorized access from legitimate clients. About.

In a conventional computer system for managing customer information and the like, a database storing customer information is managed by a server, and the server provides customer information by access from a client. Here, the client is an authorized client, and the server manages the ID (identifier) and password of the client to be accessed, and does not permit access unless the correct ID and password are input from the client. It has become.
In some cases, access is restricted by biometric authentication using a fingerprint or the like instead of the ID and password.

  The database that stores customer information encrypts the data, provides the encrypted data to the client, and gives the client the decryption key that can decrypt the encrypted data. Even if it is illegally accessed, the encrypted data cannot be decrypted.

JP 2003-271438 A

  However, in the conventional computer system, if an unauthorized person steals an ID and password, access to customer information and the like is permitted, and when the unauthorized person accesses from a legitimate client, a decryption key is stored in the client. Therefore, there is a problem that access to customer information and the like is still allowed and information leakage cannot be prevented sufficiently.

  In addition, the problem of information leakage that has occurred in recent years often involves authorized users who are unauthorized, and in such a case, the above-described system has not been able to cope with them.

  The present invention has been made in view of the above circumstances, and makes it impossible to easily decrypt encrypted information for access from a computer that is not a regular client, and further restricts access from a regular client. It aims at providing the information leakage prevention system which can aim at information leakage prevention by this.

  In the information leakage prevention system, the present invention provides a database for encrypting data with a different encryption key and storing it together with the identifier of the data, an encryption key for encrypting the data in association with the identifier of the data, and the encrypted data A key management server for storing a decryption key for decrypting the data, a decryption key corresponding to the identifier of the data in response to a data request from the client, obtaining the corresponding encrypted data from the database, and decrypting And a main server for outputting the key and the encrypted data to the client.

  The present invention provides an information leakage prevention system in which data is subdivided, the subdivided data portion is encrypted with a different encryption key, stored together with the identifier of the data portion, and the data portion associated with the identifier of the data portion A key management server that stores an encryption key that encrypts the data and a decryption key that decrypts the encrypted data portion, and a decryption corresponding to the identifier of the subdivided data portion of the data in response to a data request from the client It has a main server that obtains a key from a key management server and a corresponding encrypted data portion from a database, and outputs a decryption key and the encrypted data portion to a client.

  According to the present invention, in the information leakage prevention system, the main server holds the decryption key and the encrypted data or the encrypted data portion output to the client, decrypts the encrypted data or the encrypted data portion with the decryption key, and The data is encrypted with another encryption key and stored in the database, and the identifier of the data, the encryption key and the decryption key for decrypting the encrypted data or data portion are output to the key management server.

  The present invention is characterized in that, in the information leakage prevention system, the key management server is limited to output a decryption key of a specific amount or less within a specific time.

  The present invention is characterized in that in the information leakage prevention system, the main server outputs a decryption key equal to or less than a specific amount and corresponding encrypted data or encrypted data portion within a specific time.

  The present invention provides the information leakage prevention system, wherein when the main server decrypts the encrypted data or the encrypted data part in the accessed client, the decrypted data or the data part obtained by the identifier and date of the client is stored. The change instruction information to be changed is added to the decryption key and output to the client.

  According to the present invention, data is encrypted with a different encryption key, a database for storing the data together with the identifier of the data, an encryption key for encrypting the data in association with the identifier of the data, and the encrypted data are decrypted. In response to a data request from a client, a key management server that stores the decryption key, a decryption key corresponding to the identifier of the data is obtained from the key management server, and corresponding encrypted data is obtained from the database, and the decryption key and the encryption are obtained. Since the information leakage prevention system has a main server that outputs data to the client, each data is encrypted with a different encryption key and decrypted with the corresponding decryption key. There is an effect of preventing leakage.

  According to the present invention, data is subdivided, the subdivided data part is encrypted with a different encryption key, the data part is stored in association with the data part identifier, and the data part is encrypted. A key management server for storing an encryption key and a decryption key for decrypting the encrypted data portion, and a key management for a decryption key corresponding to an identifier of the subdivided data portion of the data in response to a data request from the client Since the information leakage prevention system has a main server that obtains the corresponding encrypted data part from the database from the server and outputs the decryption key and the encrypted data part to the client, each data is encrypted with a different encryption key. Because it is decrypted with the corresponding decryption key, information leakage is prevented against unauthorized access from outside. There can be effectively.

  According to the present invention, the main server holds the decryption key output to the client and the encrypted data or the encrypted data portion, decrypts the encrypted data or the encrypted data portion with the decryption key, and uses another encryption key. The information is stored in the database and is stored in the database, and the information leakage prevention system that outputs the decryption key for decrypting the identifier of the data, the encryption key and the encrypted data or the data portion to the key management server is used. Even if the data is accessed, it cannot be decrypted with the previously obtained decryption key, and the corresponding decryption key must be obtained again, so that it is possible to prevent information leakage.

  According to the present invention, since the key management server is configured as the information leakage prevention system that is restricted to output a decryption key of a specific amount or less within a specific time, a large amount of data can be acquired at a time. There is an effect that can be prevented.

  According to the present invention, since the main server is the information leakage prevention system that outputs a decryption key equal to or less than a specific amount and corresponding encrypted data or encrypted data portion within a specific time, a large amount of data is stored. There is an effect that can be prevented from being acquired at once.

  According to the present invention, when the main server decrypts the encrypted data or the encrypted data portion in the accessed client, the change instruction for changing the decrypted data or the data portion obtained by the identifier and date of the client is issued. Since the information leakage prevention system in which information is added to the decryption key and output to the client is used, there is an effect that it is possible to determine when the data is output to which client from the decrypted data.

Embodiments of the present invention will be described with reference to the drawings.
The information leakage prevention system (this system) according to the embodiment of the present invention encrypts each data with a different encryption key in a database storing information, and provides a corresponding decryption key before providing the data to the client. The data is transmitted, and the client decrypts each data with a different decryption key so that the data can be used. As a result, individual data cannot be decrypted without an individual decryption key, and a single decryption key is held in the client as in the prior art, and information leakage can be prevented more than when decryption is performed using it.

  In this system, once data is provided to the client, the data is encrypted with a different encryption key and stored in a database. Thus, even if the client accesses the same data, it cannot be decrypted with the previously obtained decryption key, and the corresponding decryption key must be obtained again, so that information leakage can be prevented.

  In addition, this system does not allow a large amount of data to be downloaded at one time, and only provides a specific amount (for example, customer data for 10 people) of decryption keys at a specific time (for example, 1 minute). Data cannot be obtained by unauthorized persons.

  Furthermore, instead of providing individual decryption keys for individual data, the individual data may be further subdivided, and different decryption keys may be provided for the subdivided data portions. In this way, information leakage can be further prevented.

  Also, in this system, when decrypting data, the data is changed formally (rather than a substantial change in content) according to the change rules required using the date and client identifier. By looking at the information, it is possible to determine when the data is provided to which client.

Next, the configuration of the information leakage prevention system (this system) according to the embodiment of the present invention will be described with reference to FIG. FIG. 1 is a configuration block diagram of an information leakage prevention system according to an embodiment of the present invention.
As shown in FIG. 1, the present system includes a main server 1, a key management server 2, a database (DB) 3, and a plurality of clients 4 connected to a network.
The network may be the Internet or an intranet.

  The main server 1 is a server that manages data such as customer information stored in the DB 3, and encrypts the individual data in the DB 3, as well as an identifier (data ID) of the data and an encryption key that encrypts the data. And the decryption key information for decrypting the data is output to the key management server 2.

  Further, when there is an access request from the regular client 4 to the DB 3, the main server 1 outputs the requested data ID to the key management server 2 and receives an input of the corresponding decryption key, and there is an access request. The decryption key is transmitted to the client 4. Subsequently, the main server 1 reads the encrypted data of the data ID from the DB 3 and transmits it to the client 4 that has requested access. The main server 1 does not provide the client 4 with data for which a decryption key cannot be obtained from the key management server 2.

  The encrypted data transmitted to the client 4 is temporarily stored in the main server 1, and then the main server 1 transmits the encrypted data, and also the decryption key input from the key management server 2 with the temporarily stored encrypted data. The encrypted data is decrypted using the encryption key generated separately and stored in the DB 3, and the data ID, the encrypted encryption key, and the decryption key for decryption are stored in the key management server 2. Output.

  As shown in FIG. 1, the main server 1 includes a control unit 11 that controls the entire process, a main memory 12 that operates a processing program and temporarily stores data, and a hard disk (HDD) that stores the program and the like. 13 and an interface unit 14 for connecting to the outside.

The HDD 13 stores a processing program for executing the above-described processing. The processing program is read from the HDD 13 by the control unit 11, loaded into the main memory 12, expanded, and processed.
A processing program executed by the control unit 11 includes (1) generating an encryption key and a decryption key, encrypting data in the DB 3 with the encryption key, and obtaining a data ID, an encryption key, and a decryption key. And output to the key management server 2 via the interface unit 14, and (2) upon receiving a data access request from the client 4, the data ID of the data is output to the key management server 2 via the interface unit 14. The decryption key corresponding to the data ID is acquired from the key management server 2 and transmitted to the client 4 via the interface unit 14, and then the encrypted data corresponding to the data ID is transmitted from the DB 3 via the interface unit 14. (3) Decrypt the data to be transmitted with the decryption key input from the key management server 2 and encrypt with the newly generated encryption key , And outputs and stores the DB3, data ID and the encryption key, the decryption key to the key management server 2.

  The key management server 2 stores the encryption key and the decryption key in the key management table corresponding to the data ID (data ID) stored in the DB 3. As shown in FIG. 2, the key management table stores an encryption key and a decryption key for each data ID. FIG. 2 is a schematic diagram of the key management table.

Further, since the encryption key and the decryption key corresponding to the data ID are input from the main server 1, the key management server 2 updates the key management table with the encryption key and the decryption key.
When the key management server 2 receives a decryption key output request for a specific data ID from the main server 1, the key management server 2 outputs a decryption key corresponding to the data ID to the main server 1. However, the key management server 2 is controlled so that only a decryption key having a specific amount or less is output within a specific time.
Within the specific time, the main server 1 may be controlled to output only a decryption key having a specific amount or less.

  As shown in FIG. 1, the key management server 2 includes a control unit 21 that controls the overall processing, a main memory 22 that operates a processing program and temporarily stores data, and a hard disk (HDD that stores the program). ) 23 and an interface unit 24 for connecting to the outside.

The HDD 23 stores a processing program for executing the above-described processing. The control unit 21 reads the processing program from the HDD 23, loads it into the main memory 22, expands it, and enables processing.
The processing realized by the processing program operating in the control unit 21 of the key management server 2 includes (1) storing the data ID, encryption key, and decryption key transmitted from the main server 1 in association with each other (2 ) A decryption key corresponding to a decryption key output request of the specific data ID from the main server 1 is output. (3) The decryption keys to be output are limited to a specific number within a specific time.

  In this system, the main server 1 and the key management server 2 are separate devices. However, a server in which the main server 1 and the key management server 2 are integrated may be provided so that the above-described processing is all performed by one server.

  The database (DB) 3 stores data such as customer information together with a data ID. The data is encrypted with the encryption key generated by the main server 1. When the data is read out, it is encrypted with another encryption key.

The client 4 is a computer that accesses the main server 1 via the network. When the access to the data in the DB 3 is requested, the client 4 receives the data ID and the decryption key from the main server 1 and then the data ID and the encrypted data are encrypted. Receive data.
Then, the client 4 decrypts the received encrypted data using the received decryption key.

  When the client 4 updates the data, the data ID and the update data are transmitted to the main server 1, and the main server 1 encrypts the update data with a new encryption key and stores it in the DB 3.

  Although not shown in FIG. 1, the client 4 displays a control unit for executing processing, a main memory for executing a program, a storage unit such as an HDD, and data, as with the main server 1. A display unit for inputting data, an input unit for inputting a data transmission request, and an interface unit connected to the network.

Next, the flow of processing in the control unit 11 of the main server 1 will be described with reference to FIG. FIG. 3 is a flowchart showing processing of the control unit 11 of the main server 1.
As shown in FIG. 3, when receiving a data A transmission request from the client 4 (S1), the control unit 11 reads the data ID of the data A and outputs it to the key management server 2 (S2).

  Then, the decryption key corresponding to the data ID is received from the key management server 2, and the decryption key is transmitted to the client 4 together with the data ID (S3). Further, the data A corresponding to the data ID is read from the DB 3, and the data A is transmitted together with the data ID to the client 4 (S4). Here, the decryption key received from the key management server 2 and the data A read from the DB 3 are temporarily stored in the main memory 12 of the main server 1.

Next, the control unit 11 once decrypts the data A stored in the main memory 12 with the decryption key, and then encrypts the data A with another newly created encryption key and stores it in the DB 3 (S5). Then, the encryption key and decryption key corresponding to the encrypted data A are output to the key management server 2 together with the data ID (S6).
The control unit 11 of the main server 1 performs the above processing.

Further, when decrypted by the client 4, processing may be performed so that a part of the data is changed according to a specific rule.
Specifically, the encrypted data received by the decryption program operating on the client 4 is decrypted with the received decryption key. At the time of decryption, the data decrypted with the information added to the decryption key is decrypted. Change formally.

For example, if the information added to the decryption key is instruction (change instruction) information for changing the first half-width “-” of the address to full-width “-”, the address of the decrypted customer information is, for example, “Tokyo Change Meguro-ku Himonya 1-1- ○ to “Meguro-ku Himonya 1-1- ○” and output.
The contents of the change instruction include inserting a half-width space between the specific character and the following character, or changing the number of some characters from half-width to full-width.

The acquisition of the change instruction information will be described with reference to FIG. FIG. 4 is an explanatory diagram showing an outline of acquisition of a change instruction in this system.
A rule table as shown in FIG. 4 is prepared in advance in the HDD 13 of the main server 1, and when a specific number is obtained by the date and the user ID in the control unit 11, the contents of the change instruction corresponding to the number are displayed. It reads from the rule table, adds the change instruction information to the decryption key input from the key management server 2 and transmits it.
In the example of FIG. 4, the change instruction (7) is acquired by the number of the end obtained by adding a part of the date and a part of the ID number.

  The decryption program installed in the client 4 decrypts the data encrypted by the decryption key, decrypts the added change instruction information, and changes the data format according to the information. It has become. Of course, the change instruction information is decoded only inside the decryption program and is not displayed to the outside or becomes a character symbol that cannot be identified even if displayed.

  Although the change instruction information is added to the decryption key, the change instruction information is added to the encrypted data, and the decrypted data is changed according to the change instruction information when the encrypted data is decrypted. It may be.

  In this system, each data is encrypted with a different encryption key and decrypted with a corresponding decryption key. However, the data is further subdivided, each part is encrypted with a different encryption key, and each part has a corresponding decryption key. You may make it decode by.

  According to this system, the main server 1 encrypts data such as customer information with different encryption keys for each data, and transmits the corresponding decryption key before transmitting the encrypted data to the client 4. Since the encrypted data received is decrypted with the corresponding decryption key received, even if an unauthorized person accesses the encrypted data in DB3, the encrypted data is not easily decrypted. There is an effect.

  In addition, according to the present system, even if one decryption key is transmitted to the client 4, only the requested encrypted data can be decrypted, so that there is no possibility that a large amount of data is decrypted with one decryption key. is there.

  Further, according to the present system, since the key management server 2 issues only a specific number or less of the decryption keys within a specific time, there is no fear that a large amount of data is downloaded, and there is no risk from the authorized client 4 Even with access, there is an effect that a large amount of data is not taken out.

  Further, according to the present invention, when the encrypted data is decrypted by the client 4, a part of the decrypted data is formally changed by the added change instruction information. There is an effect that it is easy to specify the access date and time and the information of the accessor.

  According to the present invention, data such as customer information to be managed is not decrypted by unauthorized access from outside, and the amount that can be downloaded even by regular access is limited by the number of decryption keys to prevent information leakage. It is suitable for a possible information leakage prevention system.

1 is a configuration block diagram of an information leakage prevention system according to an embodiment of the present invention. It is the schematic of a key management table. It is a flowchart which shows the process of the control part 11 of the main server 1. FIG. It is explanatory drawing which shows the outline of acquisition of the change instruction | indication in this system.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Main server, 2 ... Key management server, 3 ... DB, 4 ... Client, 11 ... Control part, 12 ... Main memory, 13 ... HDD, 14 ... Interface part, 21 ... Control part, 22 ... Main memory, 23 ... HDD, 24 ... interface section

Claims (6)

A database that encrypts the data with a different encryption key and stores it together with an identifier for the data;
A key management server that stores an encryption key for encrypting the data in association with the identifier of the data and a decryption key for decrypting the encrypted data;
In response to a data request from the client, the decryption key corresponding to the identifier of the data is obtained from the key management server, the corresponding encrypted data is obtained from the database, and the decryption key and the encrypted data are output to the client. An information leakage prevention system comprising a main server. A database that subdivides data, encrypts the subdivided data portion with a different encryption key, and stores it together with an identifier of the data portion;
A key management server that stores an encryption key that encrypts the data portion in association with the identifier of the data portion and a decryption key that decrypts the encrypted data portion;
In response to a data request from a client, a decryption key corresponding to an identifier of a subdivided data portion of the data is obtained from the key management server, a corresponding encrypted data portion is obtained from the database, and the decryption key and the encryption are obtained. An information leakage prevention system comprising: a main server that outputs a data portion to the client.   The main server holds the decryption key and the encrypted data or the encrypted data portion to be output to the client, decrypts the encrypted data or the encrypted data portion with the decryption key, and further encrypts it with another encryption key. 3. The information leakage according to claim 1, wherein the information is stored in a database, and an identifier of the data, and a decryption key for decrypting the encrypted data and encrypted data or a data portion are output to a key management server. Prevention system.   4. The information leakage prevention system according to claim 1, wherein the key management server is limited to output a decryption key having a specific amount or less within a specific time.   5. The information leakage prevention system according to claim 1, wherein the main server outputs a decryption key equal to or less than a specific amount and corresponding encrypted data or encrypted data portion within a specific time. .   When the main server decrypts the encrypted data or the encrypted data portion in the accessed client, the main server uses, as a decryption key, the change instruction information for changing the decrypted data or the data portion obtained by the client identifier and date. The information leakage prevention system according to any one of claims 1 to 5, wherein the information leakage is added and output to the client.

Images