JP2007142504A - Information processing system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an information system wherein a mobile terminal shares data of a PC terminal with the PC terminal via a server while keeping the security. <P>SOLUTION: The information processing system includes: the PC terminal 1 that carries out generation and storage of a first time salt and a PCID (ID unique to a PC), first time transmission of the salt and every time transmission of a hash value of the PCID, every time generation and transmission of a session key and an IV, storage of a password and every time transmission of its hash value, encryption and transmission of data using the session key and the IV, and encryption and transmission of the session key using the salt and the password; the mobile terminal 2 for carrying out storage and every time transmission of the salt and every time transmission of the password; and the network server for executing user authentication, PC authentication and SSL transmission of decoded data using the salt, the password, the session key and the IV and discarding of the salt, and storage and management of the IV, encrypted data, the session key, the password and the PCID. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an information system for sharing data of a PC terminal with a mobile terminal via a server on a network. More specifically, the present invention relates to an information system that secures security and stores PC terminal data in a server on a network. It is related with the information system which takes out the data stored with maintaining with the portable terminal.

Conventionally, a PC (personal computer) terminal connected to a network is accessed by a remote terminal, and the desktop screen of the accessed PC is displayed on the remote terminal, enabling almost all accesses including file access by remote operation. Some applications are known and mobile phones can be used as remote terminals.
In recent years, with the progress of the processing capability of mobile phones and the improvement of screen display resolution, those equipped with a web browser capable of full browsing have appeared, and it is possible to display a web page configured for a PC screen by scrolling or the like. It is becoming. In addition, viewers (display software) for various applications such as word processors (document creation: word processors) created for PCs, spreadsheets, presentations, document files with print images, etc. have appeared, and data created on PCs can be viewed on mobile phones. Opportunities for seamless handling of various applications and data, such as display and processing, without distinction between PCs and mobile phones are expected to increase.
It is currently essential to pay attention to security when handling data on such a network, and SSL (Secure Sockets Layer) is known as a communication system that encrypts and processes packets on the network at the protocol level. PGP (Pretty Good Privacy) or the like is used as an encryption system for the data itself.
As a system for sharing data over a network, access is controlled by user information, and the function of uploading data created by a user through an application distributed over the network, and other users download the uploaded data Patent Document 1 discloses an information processing technique that realizes a function and enables data sharing.

JP 2005-275705 A

  However, in the prior art, in the ubiquitous era, a complementary / fusion relationship between a PC terminal and a portable terminal is established, and a file is accessed by accessing the PC terminal from a portable terminal, which is called “anywhere desktop”. In a network data sharing system composed of PC terminals, portable terminals, servers, etc., when sharing files and folders, although security such as authentication and encryption at each terminal or server alone is maintained to some extent However, the level of network security of the entire system is incomplete, and there has been a problem that intrusions aimed at eavesdropping, spoofing, falsification, destruction, etc. have not necessarily been eliminated.

  Therefore, the present invention uses random number-based user authentication for a PC terminal when accessing a server that stores data, and also transmits encrypted information generated by the PC terminal and encrypted data from the PC terminal. It is an object of the present invention to provide an information system which can be configured so that encrypted information necessary for decryption is discarded from the server each time the received server transmits data to the mobile terminal, thereby eliminating information leakage.

In order to achieve the above object, an invention according to claim 1 is an information system for sharing data of a PC terminal with a portable terminal via a network server on a communication network,
The PC terminal generates and stores a salt for the first time, stores the salt for the first time to the network server, and generates and stores the PCID for the first time, and encrypts the PCID with a hash function each time the data is transmitted. PCID processing means for transmitting to the network server each time, common key processing means for generating a session key each time data is transmitted and discarding the session key after data transmission, and initial vector (IV) for block cipher transmission An IV processing means for generating and transmitting the IV to the network server each time, and storing a password set by the user and encrypting the password with a hash function to the network server each time data is transmitted. Using the password processing means to send each time and the session key and IV Encrypting the data with a common key cipher and transmitting the encrypted data, encrypting the session key using the salt and password, and transmitting the encrypted session key and the IV each time the data is transmitted to the network. Encryption processing means for transmitting to the server each time,
The portable terminal has a salt storage means for storing the salt in the portable terminal by a storage means such as a screen memo function, a salt transmission means for transmitting the stored salt every time when logging in to the network server, and a user input Password transmitting means for transmitting a password each time the network server is accessed, and
The network server includes an SSL communication processing unit for PC that performs SSL communication with the PC terminal, and a PCID authentication unit that performs PC authentication using a PCID and password received from the PC terminal and encrypted with a hash function A portable basic authentication means for accepting login from the portable terminal and performing user authentication, a portable SSL communication processing means for performing SSL communication with the portable terminal, a session key received from the PC terminal, and Decryption processing means for decrypting encrypted data using the IV and the salt and password received from the mobile terminal, encrypted data received from the PC terminal, IV, encrypted session Storage and management of keys, passwords encrypted with a hash function, and PCIDs encrypted with a hash function And having a, a database server to carry out.
The PC terminal according to claim 2, wherein the salt processing unit and the PCID processing unit generate a salt and a PCID using a random number, encrypt the generated PCID with a hash function, Send the PCID encrypted with the salt and hash function together with the password encrypted with the hash function to the network server by SSL communication,
The network server stores each authentication information including the PCID received from the PC terminal, the salt, the e-mail address of the portable terminal, and the password in the database if there is no problem in the user authentication by the PCID and password in the PCID authentication means. Thereafter, the PCID encrypted with the hash function received from the PC terminal in the PCID authentication means is transmitted to the e-mail address of the portable terminal by sending an e-mail describing the login URL with the user ID and the one-time variable as arguments. If there is no problem with user authentication using a password, data received from the PC terminal is stored in a database.
Further, the PC terminal according to claim 3 acquires information on each monitoring folder and file in the PC terminal designated by the user, converts the data for displaying the image file to the portable terminal, and the text of the document file Extraction is performed as data to be encrypted together with the folder name and file name, a hash value encrypted by PBE encryption using the salt and password is obtained to encrypt a session key, and an encrypted session key The PCID and password authentication information obtained by encrypting the data to be encrypted using the block cipher IV with a common key encryption method and the attribute information such as the creation date and the update date with a hash function And transmitting to the network server by SSL communication.
The portable terminal according to claim 4 accesses a URL described in an e-mail transmitted from the network server,
The network server extracts a one-time variable from the database based on the user ID received from the mobile terminal and confirms that it matches the one-time variable in the argument of the request URL. The salt is extracted from a database, the salt is embedded in a hidden tag of a Web page, a login screen is formed, transmitted to the mobile terminal by SSL communication, and then the salt is deleted from the database.
In addition, when the portable terminal according to claim 5 receives a user ID and a password set in the PC terminal on the login screen received from the network server, the user ID together with the salt embedded in the hidden tag is included. And the password to the network server via SSL communication,
The network server extracts a password encrypted with a hash function from a database based on the user ID received from the portable terminal by the portable basic authentication means, and the password received from the portable terminal by the portable basic authentication means After confirming that it matches the value encrypted with the hash function, the decryption processing of each monitoring folder and file according to the request is performed based on the received salt and password, and each decrypted The monitoring folder and the file are transmitted to the portable terminal by SSL communication as data capable of reproducing the hierarchical structure on the web browser of the portable terminal.

  According to the present invention, by using PBE, it is impossible to decrypt data unless both the password and the salt are prepared. The key delivery problem that has been considered a disadvantage of the shared key method cannot be divided into password and salt, which is the basis of the key by using PBE, and only the salt is passed by SSL transmission at the first login. The salt is stored in the mobile terminal using a screen memo recording method, which is a function of, and the server discards the salt so that it cannot be obtained by others, and the password is encrypted with a hash function Therefore, even if password information is stolen due to unauthorized intrusion, etc., the original password cannot be decrypted. Data there is an effect that can be referenced from the secure portable terminal.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a configuration diagram of an information system according to an embodiment of the present invention, and FIG. 2 is a configuration diagram showing functions of the information system shown in FIG.
1 and 2, reference numerals 1 and 10 denote PC terminals of a PC data collection client, and reference numeral 10 shown in FIG. 2 describes a PC application that realizes the function. As a PC application for security installed in the PC terminal 1, the PC terminal 1 first generates a salt by random numbers for the first time and stores it in a storage device (not shown) in the PC terminal 1, and then sends a plain to the server. The salt processing means 11 for transmitting the salt in (plain text not encrypted), the initial generation of the PCID (identification ID of the PC terminal) by a random number and the storage in the storage device in the PC terminal 1 are performed, and the generated PCID is each time PCID processing means 12 encrypted with a hash function and transmitted to the server, a session key (common key) is generated each time, and a common key processing means 13 that is discarded every time transmission ends, an IV (initial vector) is generated every time and sent to the server IV processing means 14 for sending, password processing means 1 for saving the password and encrypting it with a hash function each time and sending it to the server , Encrypts the data with the common key encryption using the session key and IV, sends the encrypted data to the server each time, encrypts the session key with the salt and password, and encrypts the encrypted session key and block An encryption processing means 16 for transmitting the encryption IV to the server every time is installed.

PBE (Password Based Encryption) encryption based on a password regards a password as a kind of key data, and generates an encryption key based on this key data. PKCS # that uses only the lower 8 bits of each character 5 and PKCS # 5 that use all 16 bits of each character are known.
In the case of password encryption, instead of simply using a hash value (digest value) obtained by a hash algorithm (hash function) such as MD (Message Digest) 5, data of about 8 bytes in advance ( A more perturbed key can be generated by adding a salt to obtain the digest value. A hash function may be applied repeatedly.

  The common key (session key) is a key belonging to a symmetric encryption method, and is also called a symmetric key, a shared key, a secret key, or the like. As a symmetric encryption method, DES (Data Encryption Standard), a secret key encryption method developed by IBM, was selected by the National Institute of Standards and Technology (NIST), and developed by a Belgian mathematician as a next-generation encryption standard to replace DES. AES (Advanced Encryption Standard) using the private key encryption algorithm Rijndahl, FEAL (Fast data Encipherment Algorithm), developed by NTT, and IDEA (Dr. RC (Ron's Code) series, etc. developed by him.

In addition, various methods such as waiting for dependency between blocks have been proposed in order to avoid the possibility of encryption being broken by a statistical method based on the frequency of frequently appearing character sets. If
・ Plain text data is divided into blocks (m1, m2,...).
Prepare data IV (initial vector) equal to the block length called the initial vector.
Encrypt the exclusive logical ring of m1 and IV (c1).
Encrypt the exclusive logical ring of m2 and c1 (c2).
Encrypt the exclusive logical ring of m3 and c2 (c3).
Thereafter, the same processing is repeated, and the obtained concatenation of c1, c2,.
There are CFB modes and OFB modes that improve this CBC mode (ECB mode: a method of simply encrypting each block) and can avoid error propagation even if a certain part in the ciphertext cannot be transmitted correctly.

The salt processing means 11 generates a salt of a random number by a pseudo random number generator at the time of initial setting, and permanently stores it in a storage device in the PC terminal 1. This salt is sent to the server on the plain at the first time.
The PCID processing means 12 generates a PCID by a random number or unique ID generation algorithm, stores it permanently in the PC terminal 1, and transmits a hash value encrypted by a hash function to the server. The PCID transmitted to the server is encrypted with a hash function every time.
The common key processing means 13 generates a session key (common key) with random numbers every time data is transmitted, and discards it every time data transmission ends. The session key generated at this time is used together with the IV as a common key encryption key when encrypting the data, and simultaneously encrypted with a salt and a password and transmitted to the server together with the block cipher IV every time the data is transmitted. Plain transmission.
As described above, when the first plaintext block is encrypted, the IV processing means 14 inserts a bit string as an initial vector (IV) instead because there is no previous block. Then, this IV is generated every time and is transmitted to the server in a plain manner.
The password processing means 15 stores a password arbitrarily set by the user in the PC terminal 1, inputs it into a one-way hash function, obtains an encrypted hash value, and transmits it to the server every time data is transmitted. This password is salted and encrypted with a hash function and used as a key to encrypt the session key.

The encryption processing means 16 encrypts the data with the common key encryption using the session key generated by the common key processing means 13 and the IV generated by the IV processing means 14 and transmits the data in plain, and the salt processing means 11 The session key is encrypted using the generated salt and the password set by the user, and the encrypted session key and IV are transmitted in a plain manner every time.
Here, when the salt and password stored in the PC terminal 1 are stolen, it becomes possible for another person to decrypt the data, but the salt and password are stored only in the PC terminal 1, This is the same as accessing the PC1 terminal directly and stealing data, and is not a drawback in this system.

  2 and 20 are mobile terminals such as a mobile phone equipped with a Web browser, and 20 shown in FIG. 2 is an application of a mobile terminal that realizes the function of receiving and acquiring data stored in the server by the PC terminal 1 It is. The mobile terminal 2 has a Web browser function, and a salt storage unit 21 that stores the salt acquired from the server using the screen memo function or the like in the mobile terminal 2, and the server from the mobile terminal 2 using the stored salt. The salt transmission means 22 that transmits in plain each time when logging in to access the password, the password transmission means 23 that transmits the password input by the user every time a data request is made, and the server based on the salt and password sent after user authentication Data receiving means 24 for receiving the decrypted data transmitted from the server, and decryption processing means 25 for receiving the encrypted data transmitted from the server and decrypting the data on the portable terminal 2 side. .

Reference numeral 8 denotes a network server, which is composed of a PC Web server 3, a portable Web server 4, a database (DB) server 5, and an application server 7 that realizes necessary functions in cooperation with these servers. A server group connected to the PC terminal 1 and the mobile terminal 2 via the communication network 9.
The PC web servers 3 and 30 combine public key encryption, private key encryption, digital certificate, hash function, etc., and SSL communication processing means 31 using SSL that maintains security at the protocol level, PCID encrypted with the hash function, and PCID authentication means 32 for performing random number-based PCID authentication using a password and using random number-based PCID authentication that is difficult to guess by others can prevent “spoofing” that is a drawback of basic authentication. . However, if the PCID stored in the PC terminal 1 is stolen, “spoofing” by another person becomes possible. However, since the PCID is stored only in the PC terminal 1, the PCID 1 is directly accessed to transfer the data. This is the same as being stolen and not a drawback of the system.

  In the description of the PC terminal 1, there is a place where various information is transmitted as a plane in contrast to the encrypted data. However, as described above, protocol level security is also used in combination with SSL communication. Is possible. SSL can be used transparently without any particular attention from an application using a higher-level protocol such as HTTP (HTTP: Hypertext Transfer Protocol Security). Currently, SSL (Transport Layer Security) 1.0, which has been improved based on SSL 3.0, is standardized by IETF (Internet Engineering Task Force) as RFC (Request For Comment) 2246.

  The DB servers 5 and 50 store salt, password, session key, data encrypted with the common key encryption using IV, store the initial vector (IV) for block encryption, and store the session key encrypted with the common key encryption. The database 6 is stored, stored with a password encrypted with a one-way hash function, and stored with a PCID encrypted with a one-way hash function, and the encrypted elements are stored in a distributed manner. As a result, even if data leaks from the database 6, it is possible to prevent leakage of information because the constituent elements alone cannot be decrypted because, for example, a salt and a password are necessary for decryption.

  The portable web servers 4 and 40 include a basic authentication unit 41 that performs basic authentication using a user name and a password, an SSL communication processing unit 42, a session key and IV received from the PC terminal 1, and a salt and password received from the portable terminal 1. And a decryption processing means 43 for decrypting the encrypted data by a common key encryption method. If the decryption process fails, authentication is rejected. Therefore, even if the password is leaked or guessed, access is not possible from a terminal other than the terminal where the salt is stored, so that security is ensured.

  On the other hand, 71 is a search (term index) storing means for storing index data for data search, and 72 is in response to a search request from the PC terminal 1 or the portable terminal 2, and decomposes the search phrase into terms, Search calculation having a function of encrypting each term with a one-way hash function or the like, searching and retrieving the encrypted index data stored in the database 6 as a search engine term index, and calculating the degree of coincidence with the search term Means. When the calculation by the search calculation means 72 is completed, the information is passed to the decryption processing means 43, and the decryption process is taken over.

Next, the processing operation will be described with reference to FIGS.
FIG. 3 is a flowchart of processing of the terminal and server of the information system shown in FIG. 1, and FIG. 4 is a diagram showing a communication procedure between the terminal and server of the information system shown in FIG.
Referring to FIG. 3, first, application software is started on the PC terminal 1, the mobile mail address of the mobile terminal 2 sharing the data is specified, a password is set, and data is transferred between the PC terminal 1 and the mobile terminal 2. A monitoring folder to be shared is designated (step S101).
Subsequently, the PC terminal 1 generates an ID (PCID) and a salt with a random number, and stores them in the PC terminal 1 as they are. The salt is kept as it is, and the PCID is encrypted with a hash function, and transmitted to the network server 8 by SSL together with the mobile mail address and the password encrypted with the hash function (step S102).
The processing during this time is the content of communication (S11) from the PC terminal 1 to the PC Web server 3 (network server 8) in FIG.

If there is no problem in the user authentication using the PCID and password encrypted by the hash function from the PC terminal 1, the network server 8 stores these authentication information (PCID, salt, mobile mail address, password) in the database 6. (Step S103).
After each authentication information received from the PC terminal 1 is stored in the database 6, a user ID that is auto-incremented from the database 6 is acquired and returned to the PC terminal 1, and a login URL with the user ID and a one-time variable as arguments An e-mail describing (Uniform Resource Locator) is generated and transmitted to the mobile mail address (step S104), and the mobile terminal 2 is notified that it can be accessed.
The communication procedure during this period includes the communication between the PC Web server 3 and the DB server 5 shown in FIG. 4 (S12, S13), the communication from the PC Web server 3 to the PC terminal 1 (S14), and the PC Web server. 3 is communication (S15) from 3 to the portable terminal 2.

Next, the PC terminal 1 acquires and encrypts information on folders and files in the hierarchy below the folder designated as the monitoring folder by the user. At that time, the image file is converted into a display size suitable for the display screen of the mobile phone and encrypted. The document file is encrypted by extracting text from the document file. As common processing for folders and files, encryption of folders and file names is also performed. For data encryption, a BPE that generates an encryption key by regarding a password as a kind of key data is used. As described in the encryption processing means 16, a salt, a password, an encrypted session key, and a block are used. Using the encryption IV, encryption is performed by a secret key method such as AES (step S105).
The network server 8 includes information such as the encrypted file name and its contents, the encrypted folder name, the creation date and update date of each folder and file together with the authentication information (PCID and password encrypted with a hash function). Is transmitted by SSL (step S106).
This is the communication (S16) from the PC terminal 1 to the PC Web server 3 shown in FIG.

If there is no problem in the user authentication using the PCID and password encrypted by the hash function from the PC terminal 1 in step S106, the network server 8 stores the data received from the PC terminal 1 in the database 6, An e-mail describing the completion of data reception from the terminal 1 is generated and transmitted to the portable terminal 2 for notification (step S107).
This is the communication (S17, S18) between the PC Web server 3 and the DB server 5 and the communication from the PC Web server 3 to the portable terminal 2 (S19) shown in FIG.

Subsequently, the PC terminal 1 continues monitoring the status of each designated monitoring folder according to whether to log off or shut down (step S108), and notifies the server if there is a change (step S108). S110). When the PC terminal 1 is started up again after logoff or shutdown, the application software becomes resident at the same time as activation (step S109), and the folder monitoring state of step S110 is entered.
This is communication (S20) from the PC terminal 1 to the PC Web server 3 and communication from the PC Web server 3 to the DB server 5 (S21) shown in FIG.

Next, when the mobile terminal 2 is the first access to the network server 8 (step S111), the login is performed with the user ID and the one-time variable described in the e-mail transmitted from the network server 8 as arguments. The URL is accessed (step S112).
This is communication (S22) from the portable terminal 2 to the portable Web server 4 shown in FIG.

When the mobile server 2 accesses the login page, the network server 8 extracts the corresponding one-time variable from the database 6 using the user ID as a key, and extracts the one-time variable as an argument of the request URL and the one-time extracted from the DB 6. After confirming that the variables match, the mobile terminal 2 extracts a salt from the DB using the user ID as a key, embeds the extracted salt in a hidden tag to generate a web page that forms a login screen, and generates a web page. Send to. Immediately after that, the salt is deleted from the DB (step S113).
This is communication (S23) from the DB server 5 to the portable Web server 4 and communication (S24) from the portable Web server 4 to the portable terminal 2 shown in FIG.

The mobile terminal 2 stores the login screen web page sent from the network server 8 with the salt embedded in the hidden tag in the mobile terminal 2 using the screen memo function (step S114), and calls the stored screen memo. Click the login button to perform SSL communication with the network server 8. On the Web display screen of the portable terminal 2, the user ID and password are asked. At that time, the user ID displayed on the login screen and the password set in the PC terminal 1 are input. At this time, the salt embedded in the hidden tag of the Web page is also posted to the network server 8 at the same time (step S115). Once the login screen is saved by the screen memo function, the processing of steps S112 and S114 can be omitted and the processing can be shifted to step S115 at the next access.
Note that transmission of data by HTTP and HTTPS includes a GET command transmitted as an argument of the URL and a POST command transmitted separately from the URL, which are specified in the form tag of the Web page. In order to maintain more security, a POST command that transmits data separately from the URL is desirable.
This process is communication (S25) from the portable terminal 2 to the portable Web server 4 in FIG.

The network server 8 determines the connection client based on the IP address of the transmission source and the transmission destination that are coming to connect by SSL communication, and distributes them to the PC Web server 3 and the portable Web server 4 as shown in FIG. (Step S116) In the case of the mobile terminal 2, the password encrypted with the corresponding hash function is extracted from the database 6 based on the user ID transmitted from the mobile terminal 2, and the password received from the mobile terminal 2 is extracted with the hash function. User authentication is performed by comparing the encrypted value with the password extracted from the database 6. If there is no problem in the user authentication, then, based on the salt and password posted from the portable terminal 2, the folders and files under each monitoring folder according to the request are extracted from the database 6 and the extracted data is decrypted. Processing is performed, and the hierarchical structure of each monitoring folder is converted to data that can be reproduced by the mobile browser and transmitted to the mobile terminal 2. If the decryption process fails, authentication is rejected. Therefore, even if another person obtains the user ID and password, it is impossible to log in unless the salt stored in the mobile terminal 2 is known. (Step S117).
In FIG. 4, this processing is communication from the DB server 5 to the portable Web server 4 (S26) and communication from the portable Web server 4 to the portable terminal 2 (S27).

In the mobile terminal 2 that has received the contents of each monitoring folder from the network server 8, the hierarchical structure of the folders and files is reproduced, and according to the operation, the session information is held with the one-time session variable as an argument, Authentication and decryption processing requests are made (step S118).
In addition, when the connection is the PC terminal 1 in the determination in step S116, the network server 8 updates the contents of the database 6 based on the information notified from the PC terminal 1 (step S120).
In this way, the folder and file data of the PC terminal 1 are reproduced in the portable terminal 2 while maintaining the security, maintaining the hierarchical structure through the network, and “desktop everywhere” is realized.

  As described above, in the present embodiment, the mobile terminal 2 is assumed to be a terminal that uses a “mobile browser” that is installed in a mobile phone and browses a mobile site, such as “i-mode” and “EZweb”. Any form may be used as long as it is intended to further expand the Web function in cooperation with the terminal 1 and the network server 8, and the mobile device that can browse the Web site is not limited to the mobile phone. For example, a mobile browser “PSP” is also equipped with a Web browser. In addition, if the wireless LAN function built into the cellular phone is used, data stored in the PC terminal can be accessed from outside via the access points installed in each place and facility. Can be shared by portable terminals while maintaining the hierarchical structure.

  Furthermore, in this embodiment, a portable terminal that can browse a website has been assumed, but instead of storing the salt in a hidden tag, the salt is applied to a portable terminal that can execute an application such as “i-appli”. Decryption processing can also be performed on the mobile terminal by embedding it in or distributing an application with salt storage or reference means in the mobile terminal so that the application can refer to the salt within the mobile terminal. By completing the processing in the portable terminal, it becomes possible to maintain higher security.

It is a block diagram of the information system by one Embodiment of this invention. It is a block diagram which shows the function of the information system shown in FIG. It is a flowchart of a process of the terminal and server of the information system shown in FIG. It is a figure which shows the communication procedure between the terminal of the information system shown in FIG. 1, and a server.

Explanation of symbols

1, 10 PC terminal (PC data collection client, PC application)
2, 20 Mobile terminal (mobile terminal application)
3 PC Web Server 4 Portable Web Server 5, 50 DB (Database) Server 6 Database 7 Application Server 8 Network Server 9 Communication Network 11 Salt Processing Unit 12 PCID Processing Unit 13 Common Key (Session Key) Processing Unit 14 IV (Initial) Vector) processing means 15 password processing means 16 encryption processing means 21 salt storage means 22 salt transmission means 23 password transmission means 24 data reception means 25, 43 decryption processing means 30 PC web server 40 portable web server 41 basic authentication means 31, 42 SSL communication processing means 32 PCID authentication means 51 Encrypted data storage means 52 IV storage means 53 Encrypted session key storage means 54 Encrypted password storage means 55 Encrypted PC ID storage means 71 Search storage means (search engine)
72 Calculation means for search (search engine)

Claims (5)

An information system for sharing data of a PC terminal with a mobile terminal via a network server on a communication network,
PC terminal
A salt processing means for generating and storing the salt for the first time and transmitting the salt to the network server for the first time;
PCID processing means for generating and storing a PCID for the first time, and transmitting a value obtained by encrypting the PCID with a hash function to the network server every time data is transmitted;
A common key processing means for generating a session key each time data is transmitted and discarding the session key after data transmission;
An IV processing means for generating an initial vector (IV) for block encryption every time data is transmitted and transmitting the IV to the network server each time;
A password processing means for storing a password set by a user and transmitting a value obtained by encrypting the password with a hash function to the network server each time data is transmitted;
The session key and IV are used to encrypt data using a common key encryption, and the encrypted data is transmitted, and the session key is encrypted using the salt and password, and the encrypted session key and IV And an encryption processing means for transmitting to the network server every time data is transmitted,
Mobile devices
Salt storage means for storing the salt in the portable terminal by storage means such as a screen memo function;
A salt transmission means for transmitting the stored salt every time when logging in to the network server;
Password transmitting means for transmitting the password entered by the user each time the network server is accessed, and
The network server is
SSL communication processing means for PC for performing SSL communication with the PC terminal;
PCID authentication means for performing PC authentication using a PCID and password received from the PC terminal and encrypted with a hash function;
Portable basic authentication means for accepting login from the portable terminal and performing user authentication;
Portable SSL communication processing means for performing SSL communication with the portable terminal;
Decryption processing means for decrypting encrypted data using the session key and IV received from the PC terminal and the salt and password received from the mobile terminal;
A database server for storing and managing the encrypted data received from the PC terminal, the IV, the encrypted session key, the password encrypted with the hash function, and the PCID encrypted with the hash function; An information processing system comprising: The PC terminal generates a salt and a PCID using random numbers by the salt processing means and the PCID processing means, encrypts the generated PCID with a hash function, and encrypts the e-mail address of the mobile terminal and the password encrypted with the hash function A PCID encrypted with the salt and hash function is transmitted to the network server by SSL communication,
The network server stores each authentication information including the PCID received from the PC terminal, the salt, the e-mail address of the portable terminal, and the password in the database if there is no problem in the user authentication by the PCID and password in the PCID authentication means. After that, an e-mail describing a login URL with a user ID and a one-time variable as an argument is sent to the e-mail address of the mobile terminal,
2. The data received from the PC terminal is stored in a database if there is no problem in user authentication based on the PCID and password encrypted with the hash function received from the PC terminal in the PCID authentication means. Information processing system. The PC terminal obtains information on each monitoring folder and file in the PC terminal designated by the user, performs data conversion of the image file for portable terminal display and text extraction of the document file, and the folder name and The data to be encrypted along with the file name,
A hash value encrypted by PBE encryption using the salt and password is obtained to encrypt a session key, and the data to be encrypted is shared using the encrypted session key and block cipher IV. 2. The data encrypted in step (b) and attribute information such as a creation date and an update date are transmitted to the network server together with the PCID and password authentication information encrypted by a hash function by SSL communication. Information processing system described in 1. The mobile terminal accesses the URL described in the e-mail transmitted from the network server,
The network server extracts a one-time variable from the database based on the user ID received from the mobile terminal and confirms that it matches the one-time variable in the argument of the request URL. 3. The salt is extracted from a database, the salt is embedded in a hidden tag of a web page, a login screen is formed and transmitted to the mobile terminal by SSL communication, and then the salt is deleted from the database. Information processing system described in 1. When there is a user ID and a password set in the PC terminal on the login screen received from the network server, the portable terminal transmits the user ID and password to the network server together with the salt embedded in the hidden tag. Send by communication,
The network server extracts a password encrypted with a hash function from a database based on the user ID received from the portable terminal by the portable basic authentication means, and obtains the password received from the portable terminal by the portable basic authentication means. After confirming that it matches the value encrypted with the hash function, each monitoring folder and file are decrypted according to the request based on the received salt and password, and each decrypted monitoring 5. The information processing system according to claim 4, wherein the folder and the file are transmitted to the portable terminal by SSL communication as data capable of reproducing a hierarchical structure on a web browser of the portable terminal.

Images