JP2007304888A - File management device, file management method, and program for achieving these - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a file management device capable of guaranteeing revision information even if a file becomes independent from the management, a file management method, and a program for achieving these. <P>SOLUTION: In a management server 10, a feature value calculation section 16 applies a hash function as a one-way function to the contents of a file of new version, and calculates the hash function obtained in this manner as a feature value. A feature value coupling section 17 creates a coupled value by coupling the feature value of the file of new version to that of the file of old version. Certification information creating section 18 creates certification information including the coupled value. Then, a storage section (storage means) 19 stores the certification information such as a digital signature created by the certification information creating section 18 in association with the file of new version. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a file management apparatus that manages file revision information, a file management method, and a program that implements these.

In a file (electronic file) such as a document file or an image file, there are many occasions where the content is revised, so it is necessary to manage revision information such as whether the file has been revised (so-called version management). As a technique for managing revision information, for example, there are a technique for storing files before and after revision in a management system, a technique for including information such as revision contents in one file, and the like.
JP 2003-216601 A Japanese Patent Laid-Open No. 10-123950

  However, in the method of storing the file before and after the revision in the management system, once the file is taken out from the management system, the file becomes independent from the management of the management system, and the revision information cannot be guaranteed.

  On the other hand, with the method of including information such as revision contents in one file, revision information can be guaranteed even if the file is independent from the management of the management system, but the file structure becomes complicated as revisions are repeated. In addition, the file size increases.

  In particular, in the case of image files, it is difficult to extract revision contents (differences) from files before and after revision, so both pieces of data are required to manage revision information, and the file size increases particularly. End up.

  Patent Document 1 discloses a technique for extracting difference data before and after text data revision for a document file, signing the updated text data and difference data, and including them in the document file. However, since the document file includes differential data and each is signed, the file structure becomes more complicated and the file size increases as revisions are repeated.

  The present invention has been made in view of the above problems, and provides a file management apparatus, a file management method, and a program for realizing the file management apparatus capable of guaranteeing revision information even if the file is independent from the management. Is one of its purposes.

  In order to solve the above problems, a file management apparatus of the present invention is a file management apparatus that manages file revision information, and a calculation unit that calculates a feature value determined based on file contents from a revised file; Generating means for generating certification information including the characteristic value of the revised file and the characteristic value of the file before being revised, and storing means for saving the certification information in association with the revised file. Features.

  Here, the feature value is calculated as a hash value by applying a hash function to the file contents.

  The file management method of the present invention is a file management method for managing file revision information, a calculation step for calculating feature values determined based on file contents from the revised file, and the revised file. And generating a certification information including the characteristic value of the file and the characteristic value of the file before being revised, and a saving step of saving the certification information in association with the revised file.

  Further, the program of the present invention includes a calculation step for calculating a feature value determined based on a file content from a revised file on a computer, a feature value of the revised file, and a feature value of the file before being revised. And a saving step for saving the certification information in association with the revised file.

  According to the present invention, the certification information stored in association with the revised file includes the feature value of the file before revision together with the feature value of the revised file. Independently, it is possible to obtain a guarantee about the contents of the revised file based on the feature value of the revised file included in the certification information, and the feature value of the revised file contained in the certification information. Based on the feature values of the file before being revised, a guarantee can be obtained for revision information between the revised file and the file before being revised.

  Embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a block diagram showing a configuration of a management server 10 as a file management device and a configuration of a personal computer (PC) 20 as a file verification device. The management server 10 manages revision information (version information) on files (electronic files) such as document files and image files, and the files managed here are independent of the management of the management server 10. Even version information is guaranteed. The PC 20 verifies version information about a file independent from the management of the management server 10.

[File management device]
A configuration of the management server 10 will be described. As shown in FIG. 1, the management server 10 is connected to a control unit 11 that performs overall control, an operation unit 12 that includes a mouse and a keyboard, a display unit 13 that includes an LCD, and the like. And a storage unit 15 including a drive device such as an HDD and a semiconductor memory such as a flash memory.

  The control unit 11 is configured as a computer mainly including a CPU, and includes a ROM that stores programs and data necessary for the operation of the CPU, a RAM that is a work area of the CPU, and the like.

  In the storage unit 15, a management database 15D for storing files of each version is constructed. Information for proving version information is given to the file stored here. The management database 15D may be outside the device of the management server 10.

  The main function of the management server 10 will be described. FIG. 2 is a block diagram illustrating the operation of the management server 10. Here, the feature value calculation unit 16, the feature value combination unit 17, the proof information generation unit 18, and the storage unit 19 are realized by the operation of the CPU of the control unit 11.

  In the management server 10, when a change is made to the contents of the file stored in the management database 15D on the management server 10 or through the PC 20 or the like, a new version file (revised file) is created, and Is performed.

  The feature value calculation unit (calculation means) 16 applies a hash function, which is a one-way function, to the file contents of the new version file, and calculates a hash value obtained thereby as a feature value. A publicly known hash function can be used as appropriate. By using the hash function, the feature value can be a file having a size smaller than the file size, and an increase in the size of the certification information can be suppressed.

  The feature value calculation unit 16 also applies a hash function to the file contents of the old version file (the file before being revised) and calculates a hash value as a feature value. Alternatively, if a feature value of an old version file already exists in the management database 15D, the feature value can be used without newly calculating.

  The feature value combining unit 17 combines the feature value of the new version file and the feature value of the old version file to create a combined value.

  A combined value can be created by combining a plurality of feature values according to a combining rule such as the order of connection. For example, feature values can be linked in version order. As a result, at the time of verification, a combined value for verification is created from the file stored in the management database 15D according to the same process (the same hash function, the same combined rule), and if both match, it becomes the verification target. It is proved that the file is a new version of the file and revised from the old version.

  Further, the feature values included in the combined value can be included so as to be identifiable. According to this, each feature value is calculated by using the same hash function from the file stored in the management database 15D without creating a combined value for verification. It is proved that the file is a new version of the file and revised from the old version.

  FIG. 4 to FIG. 6 are explanatory diagrams showing examples of creating a combined value.

  In the first creation example shown in FIG. 4, the hash value of the file immediately before the revision among the files of the old version is combined with the hash value of the file of the new version. For example, when the new version is version 3, the hash value 2 is calculated from the file contents (text) of version 2, the hash value 3 is calculated from the file contents of version 3, and these are concatenated.

  The second creation example shown in FIG. 5 combines the hash values of all the old version files with the hash value of the new version file. For example, when the new version is version 3, the hash values 1 and 2 are calculated from the file contents (text) of versions 1 and 2, respectively, the hash value 3 is calculated from the file contents of version 3, and these are connected. .

  In the third creation example shown in FIG. 6, the value of certification information such as a signature attached to the old version file is combined as a feature value with the hash value of the new version file. For example, when the new version is version 3, the hash value 3 is calculated from the file contents (text) of version 3 and is linked to the signature value 2 assigned to version 2.

  As described above, using the combined value of the feature value of the new version file and the feature value of the old version file is applied to an image file that requires a large amount of processing to extract the difference between the file contents. Is particularly effective.

  The proof information generation unit (generation means) 18 generates proof information including a combined value obtained by connecting the feature value of the new version file and the feature value of the old version file.

  The certification information refers to information for guaranteeing information such as file contents, creator (revision), revision date, and the like, and includes electronic signatures and time stamps. Certification information such as an electronic signature and a time stamp can be appropriately selected or combined depending on the content to be guaranteed. Moreover, a high degree of guarantee can be obtained by using certification information issued by a third party organization.

  The case of a digital signature, which is one of methods for realizing an electronic signature, will be described as an example. The certification information generation unit 18 performs a digital signature using the public key cryptosystem on the combined value, and saves the digital signature and the signer's digital certificate in the storage unit 19 as certification information. This proves the person who created (revised) the file and ensures that the contents of the file have not been tampered with.

  In addition, since the digital signature as certification information includes a combined value obtained by concatenating the feature value of the new version file and the feature value of the old version file, in addition to the guarantee as described above, The file version information is also guaranteed. That is, at the time of verification, a verification combined value is created from the file stored in the management database 15D according to the same process, and if both match, the file to be verified is a new version file and the old version file Proved to be revised from the file.

  Then, as shown in FIG. 7, the storage unit (storage unit) 19 stores the certification information such as the digital signature generated by the certification information generation unit 18 in the management database 15D in association with the new version file. As a result, the version information of the new version file is guaranteed even if it is independent from the management of the management server 10.

  The operation of the management server 10 will be described. FIG. 8 is a flowchart showing the operation (file management method) of the management server 10. A program for realizing this operation is stored in the ROM of the control unit 11, for example, and is read out and processed by the CPU.

  The operation (file management method) of the management server 10 includes a feature value calculating step (S12 to S14), a feature value combining step (S15), a certification information generating step (S16 to S17), and a storing step (S18). Is included.

  Specifically, when the file is revised (S11: YES), the management server 10 selects a hash value calculation method (hash function) or allows the user to select a file (S12). A hash value is calculated from each version of the file (S13, S14). Then, the management server 10 combines these hash values to obtain a combined value (S15). Thereafter, the management server 10 selects the type of certification information or allows the user to select it (S16), generates certification information including a combined value (S17), and saves the certification information in association with the new version file. (S18).

[File verification device]
The PC 20 verifies version information about a file independent from the management of the management server 10.

  The configuration of the PC 20 will be described. As shown in FIG. 1, the PC 20 includes a control unit 21 that performs overall control, an operation unit 22 that includes a mouse and a keyboard, a display unit 23 that includes an LCD, and the like. And a communication unit 24.

  The control unit 21 is configured as a computer mainly including a CPU, and includes a ROM that stores programs and data necessary for the operation of the CPU, a RAM that is a work area of the CPU, and the like.

  The main function of the PC 20 will be described. FIG. 3 is a block diagram showing the operation of the PC 20. Here, the extraction unit 26, the acquisition unit 27, the combination unit 28, and the verification unit 29 are realized by the operation of the CPU of the control unit 21.

  The PC 20 stores, from the proof information stored in association with the file to be verified, the extraction unit 26 that extracts the value included in the proof information, the revised file and the file before being revised. The acquisition unit 27 for acquiring the feature value of the revised file and the feature value of the file before the revision from the database 15D, the value included in the certification information, and the By comparing the feature value and the feature value of the file before the revision, the file to be verified is the revised file and the revised file from the file before the revision. And a verification unit 29 that recognizes that there is.

  As described above, since the proof information including the binding value is stored in association with the file managed by the management server 10, the extraction unit 26 is stored in association with the file to be verified. The value included in the certification information is extracted from the certification information. Specifically, if the file has a digital signature, the combined value encrypted as the digital signature is decrypted with the public key.

  On the other hand, the acquisition unit 27 accesses the management database 15D and acquires the feature value of each version of the stored file. Here, if the feature value is a hash value, a hash value is calculated for each version of the file stored in the management database 15D by applying a hash function to the file contents. The combining unit 28 combines the feature values acquired by the acquiring unit 27.

  Then, the verification unit 29 compares the value extracted from the certification information of the file to be verified by the extraction unit 26 with the value obtained by combining the feature values acquired by the acquisition unit 27 by the combining unit 28. Verifies the version information of the file to be verified. If the two match, it is ensured that the file to be verified is a new version of the file and a revision from the old version (version information).

  In other words, the version information of the file to be verified is guaranteed, and the certification information can ensure that the file to be verified is a new version file. When the certification information is a digital signature, the creator (revision) of the file to be verified is certified, and it is guaranteed that the file to be verified has not been falsified from the contents of the new version of the file.

  Specific examples of the verification method for the combined value obtained by the creation examples shown in FIGS. 4 to 6 will be described.

  For the combined value created in the first creation example of FIG. 4, hash values are calculated from the new version file and the version immediately before revision stored in the management database 15D, and these are combined and verified. Compare with the value extracted from the target file. For example, when verifying whether the file to be verified is a version 3 file, while decrypting the combined value with the signature 3 public key from the signature stored in association with the file to be verified The hash values 2 and 3 are calculated from the version 2 and 3 files stored in the management database 15D, respectively, and these are connected to compare them.

  For the combined value created by the second creation example of FIG. 5, the hash value is calculated from the new version file and all the old version files stored in the management database 15D, and these are combined, Compare with the value extracted from the file to be verified. For example, when verifying whether the file to be verified is a version 3 file, while decrypting the combined value with the signature 3 public key from the signature stored in association with the file to be verified Then, hash values 1 to 3 are calculated from the files of versions 1 to 3 stored in the management database 15D, and these are concatenated to compare them.

  For the combined value created in the third creation example of FIG. 6, a hash value is calculated from the new version file stored in the management database 15D, and the proof information such as the signature attached to the old version file Are obtained, combined, and compared with the value extracted from the file to be verified. For example, when verifying whether the file to be verified is a version 3 file, while decrypting the combined value with the signature 3 public key from the signature stored in association with the file to be verified Then, the hash value 3 is calculated from the version 3 file stored in the management database 15D, the signature value 2 is obtained from the version 2 file, these are connected, and the two are compared.

  The operation of the PC 20 will be described. FIG. 9 is a flowchart showing the operation (file verification method) of the PC 20. A program for realizing this operation is stored, for example, in the ROM of the control unit 21, and is read out and processed by the CPU.

  The operation (file verification method) of the PC 20 includes an extraction step (S21), an acquisition step (S22), a combining step (S23), and a verification step (S24).

  Specifically, the PC 20 extracts a value included in the certification information from the certification information stored in association with the file to be verified (S21). Further, the PC 20 acquires the feature value of the new version file and the feature value of the old version file from the management database 15D (S22), and combines them (S23). Then, the PC 20 verifies the version information of the file to be verified by comparing the value extracted in S21 with the value combined in S23 (S24).

It is a block diagram showing the structure of a file management apparatus and a file verification apparatus. It is a block diagram showing operation | movement of a file management apparatus. It is a block diagram showing operation | movement of a file verification apparatus. It is explanatory drawing showing the 1st example of creation of a combined value. It is explanatory drawing showing the 2nd creation example of a combined value. It is explanatory drawing showing the 3rd example of creation of a combined value. It is explanatory drawing showing the signature including a combined value. It is a flowchart showing operation | movement of a file management apparatus. It is a flowchart showing operation | movement of a file verification apparatus.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 10 Management server, 11 Control part, 12 Operation part, 13 Display part, 14 Communication part, 15 Storage part, 15D Management database, 16 Feature value calculation part (calculation means), 17 Feature value coupling part, 18 Proof information generation part ( Generation unit), 19 storage unit (storage unit), 20 PC, 21 control unit, 22 operation unit, 23 display unit, 24 communication unit, 26 extraction unit (extraction unit), 27 acquisition unit (acquisition unit), 28 coupling unit 29 Verification unit (verification means).

Claims (4)

A file management device for managing file revision information,
A calculation means for calculating a feature value determined based on the file contents from the revised file;
Generating means for generating certification information including the revised feature value of the file and the feature value of the file before being revised;
Storage means for storing the certification information in association with the revised file;
A file management apparatus comprising:   The file management apparatus according to claim 1, wherein the feature value is calculated as a hash value by applying a hash function to the file content. A file management method for managing file revision information,
A calculation step for calculating feature values determined based on the file contents from the revised file;
Generating the certification information including the revised feature value of the file and the feature value of the file before being revised;
Storing the certification information in association with the revised file;
A file management method comprising: On the computer,
A calculation step for calculating feature values determined based on the file contents from the revised file;
Generating the certification information including the revised feature value of the file and the feature value of the file before being revised;
Storing the certification information in association with the revised file;
A program for running

Images