JP2007324726A - File share server apparatus, client apparatus, printer, file share system, and file share program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a file transfer system with high security by mounting TCPs 2 to client apparatuses A and a file share server apparatus B. <P>SOLUTION: The client apparatus A and the file share server apparatus B are connected to a network 40. The client apparatus A and the file share server apparatus B are provided with: input apparatuses 31A, 31B; output apparatuses (display apparatuses) 32A, 32B; file share system management application sections 34A, 34B and TCP 2 drivers 35A, 35B in addition to existing file share application sections 33A, 33B, respectively, and also provided with storage media 36A, 36B for storing mutually received files. TCP 2 drivers 35A, 35B comprise TCP 2 cores 37A, 37B, file share system cores 38A, 38B, and storage media 39A, 39B, respectively. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention protects against eavesdropping, leakage, spoofing, falsification, etc., in which mutual authentication and encryption can be performed without changing the host application in file communication between a client device, a file sharing server device, and a printing device. The present invention relates to a strong file sharing server device, a client device, and a printing device.

  In recent years, communication using the Internet is rapidly spreading in society because anyone can access a computer on a network by connecting it to a network as long as it has a personal computer. On the other hand, with the spread of Internet communication, there are social problems such as hackers and crackers intruding into other people's computer systems to steal software, data, tamper and destroy. It is getting bigger.

  As a specific example of unauthorized tampering, first, there is a system tampering that sends a large number of messages from the network and hinders the operation of the computer system so that the central system can no longer be used. If the host is overloaded due to this interference, the system may go down.

  In addition, there is an illegal interception of “illegal access and impersonation” that obtains a host password, steals confidential information, or alters or destroys information. Some of these obstructions mean that the information held by the computer can be rewritten and the person can fall. In addition, fraudulent acts called spyware that sneak into specific computers and exploit personal sensitive data such as email addresses and passwords have also occurred. In this way, it is impossible to deny the possibility that so-called eavesdropping is frequently performed in which the contents of a database held by a computer connected to a network are illegally stolen.

  In addition, there is no risk of cyber terrorism caused by intentional stealing of personal information or cyber terrorism lurking inside the company at the site or server operator.

  In addition, fraudulent disturbances such as sending "viruses" that are programs that cause computer problems to other people's computers have recently been increasing. This sent virus infects a computer that used e-mail at home, and when it is connected to the company, the entire company computer is infected, or the virus destroys files in the computer. There are also problems such as bringing down the entire network.

  Therefore, in communication over the Internet using conventional TCP / IP (Transmission Control Protocol / Internet Protocol) or UDP (User Datagram Protocol), IPsec ( Encrypted communication called IPSEC: Security Architecture for Internet Protocol (SSL) or Secure Socket Layer (SSL) is used.

  A feature of IPsec is that not only a specific application is encrypted but all communications transmitted from the host are encrypted at the IP level. As a result, the user can perform secure communication without being aware of the application. In addition, IPsec can change the encryption algorithm to be used without changing its own mechanism so that it can be used in the future.

  Further, by using SSL, the client and the server can authenticate each other on the network, and it is possible to exchange highly confidential information such as credit card information. This prevents data eavesdropping, replay attacks (attack of eavesdropping on data flowing over the network and repeatedly sending data), spoofing (communication by pretending to be the person), data tampering, etc. be able to.

  In the encrypted communication used in the present invention, an encryption function is added to the TCP layer in the transport layer (OSI fourth layer). This transport layer is a protocol layer for realizing an error-free virtual communication path between two processes executed on each node. Although data can be sent at the network layer, there is no guarantee that the data will reach the other party. There is no guarantee that the data will arrive correctly in the order of transmission.

  Therefore, the transport layer provides an error-free communication path for ease of use for applications. An example in which an encryption function is added to the transport layer of the fourth layer and a communication system that is strong against unauthorized intrusion from the outside is realized by the present inventors before the world. . The inventors have named this encrypted communication system “TCP2” (see Patent Document 1).

International Publication WO2005 / 015828 Pamphlet

  However, the invention described in Patent Document 1 is limited to a general encryption communication system, communication method, communication apparatus, and communication program using TCP2, and a file sharing system equipped with TCP2 has not yet been realized. An object of the present invention is to provide a file sharing server device, a client device, and a printing device to which an encryption function is added using a communication system using “TCP2” previously proposed by the inventors. That is, a file sharing server device and a client device that implements TCP2 in a file sharing transmission side client, a reception side file sharing server device, and a printing device, and enables end-to-end encrypted transmission / reception It is to provide a printing apparatus.

  In order to solve the above problems and achieve the object of the present invention, the invention described in claim 1 is a file sharing server device used when storing information generated by a client device via a network. In addition, when communication of digitized information is performed by adding an encryption function to the TCP or UDP protocol located in the transport layer in the client device, at least encryption and decryption logic corresponding to the client device is provided. An arrangement means for deciding, a communication means for decoding and receiving a packet as an information unit from the client device according to the decoding logic decided by the arrangement means, and a storage means for saving the packet as the decoded information unit And encryption using the TCP or UDP protocol of the transport layer with the client device And a file sharing server device and performs communication based on the decoding logic.

  In order to achieve the object of the present invention, the invention described in claim 2 is a file sharing server device used when information generated by a client device is stored via a network, and is transferred by the client device. Arrangement means for negotiating at least encryption and decryption logic corresponding to the client apparatus when the encryption function is added to the TCP or UDP protocol positioned in the port layer to perform communication of the electronic information, and the client apparatus Communication means for receiving the encrypted data without decrypting the file data portion according to the decryption logic decided by the decision means, and the packet as the information unit not decrypted Storage means for storing the ciphertext as it is, and a transport layer between the client device A file sharing server device and performs communication based on the encryption and decryption logic using the TCP or UDP protocol.

  In order to achieve the object of the present invention, the invention described in claim 3 is a file sharing server device used when information generated by a client device is stored via a network, and is transferred by the client device. Arrangement means for negotiating at least encryption and decryption logic corresponding to the client apparatus when the encryption function is added to the TCP or UDP protocol positioned in the port layer to perform communication of the electronic information, and the client apparatus Communication means for receiving the encrypted data without decrypting the file data portion according to the decryption logic decided by the decision means, and the packet as the information unit not decrypted An application that has been approved by the agreement means. When using the file data including a packet as an information unit that was not decrypted, a file sharing server apparatus characterized by use in decoding according to the decryption logic arranged by arrangement unit.

  In order to achieve the object of the present invention, the invention described in claim 4 is a file sharing server device used when printing information generated by a client device via a network, wherein the client device converts the information. Arrangement means for negotiating at least encryption and decryption logic corresponding to the client apparatus when the encryption function is added to the TCP or UDP protocol positioned in the port layer to perform communication of the electronic information, and the client apparatus A communication unit that decodes and receives a packet as an information unit from an agreement unit according to a decoding logic, and a printing unit that prints a packet as a decoded information unit. Encryption and decryption logic using transport layer TCP or UDP protocol A file sharing server device and performs communication based.

  Furthermore, in the file sharing server device according to claim 5, the encryption and decryption logic that can be a candidate for the agreement by the means for determining the encryption and decryption logic is stored in a memory or a circuit, and the agreement that is stored or implemented It further comprises logic changing means for periodically changing encryption and decryption logic which can be candidates.

  In the file sharing server device according to claim 6, the means for determining the encryption and decryption logic can determine that the plaintext is handled without encryption in relation to the encryption and decryption logic. It is a thing.

  In order to achieve the object of the present invention, the invention described in claim 7 is a client device that downloads information stored in a file sharing server device via a network, and is transferred by the file sharing server device. Arrangement means for negotiating the corresponding encryption and decryption logic with at least the file sharing server device when adding the encryption function to the TCP or UDP protocol located in the port layer and communicating electronic information, A file sharing server comprising: a communication unit that decodes and receives a packet as an information unit from the file sharing server device according to a decoding logic decided by the decision unit; and a storage unit that saves the decoded packet as an information unit. Use the transport layer TCP or UDP protocol A client device and performs communication based on and decoding logic.

  In order to achieve an object of the present invention, an invention described in claim 8 is a client device for downloading information stored in a file sharing server device via a network, wherein the file sharing server device uses the transport layer. If the encryption function is added to the TCP or UDP protocol located in the network and communication of digitized information is performed, the agreement means for negotiating the encryption and decryption logic corresponding to at least the file sharing server device, and file sharing Of the packet as the information unit from the server device, the communication means for receiving the encrypted data without decrypting the file data portion according to the decryption logic decided by the decision means, and the information unit as the information unit not decrypted Storage means for storing the packet as ciphertext, and between the file sharing server device A client device and performs communication based on the encryption and decryption logic using the TCP or UDP protocol of the transport layer.

  In order to achieve the object of the present invention, an invention described in claim 9 is a client device for downloading information stored in a file sharing server device via a network, wherein the file sharing server device uses the transport layer. If the encryption function is added to the TCP or UDP protocol located in the network and communication of digitized information is performed, the agreement means for negotiating the encryption and decryption logic corresponding to at least the file sharing server device, and file sharing Of the packet as the information unit from the server device, the communication means for receiving the encrypted data without decrypting the file data portion according to the decryption logic decided by the decision means, and the information unit as the information unit not decrypted Storage means for storing the packet as ciphertext, and an application that has been authenticated by the agreement means. When using the file data including a packet as an information unit application was not decoded, the use by decoding according to the decryption logic arranged by the arrangement means is a client apparatus according to claim.

  Furthermore, in the client device according to claim 10, encryption and decryption logic that can be an agreement candidate by the means for determining encryption and decryption logic is stored in a memory or a circuit, and becomes an agreement candidate that is stored or implemented. It further comprises logic changing means for periodically changing possible encryption and decryption logic.

  In the client device according to claim 11, the means for determining the encryption and decryption logic can determine that the plaintext is handled without encryption in relation to the encryption and decryption logic. Is.

  In order to achieve the object of the present invention, an invention described in claim 12 is a printing device used when printing information generated by a client device via a network, and the client device converts the information. Arrangement means for negotiating at least encryption and decryption logic corresponding to the client apparatus when the encryption function is added to the TCP or UDP protocol positioned in the port layer to perform communication of the electronic information, and the client apparatus Communication means for decoding and receiving the packet as an information unit from the decision means according to the decoding logic, storage means for saving the packet as the decoded information unit, and packet as the decoded information unit Printing means for printing, and TCP or TCP of the transport layer with the client device. A printing apparatus and performs communication based on the encryption and decryption logic using the UDP protocol.

  In order to achieve the object of the present invention, a thirteenth aspect of the present invention is a printing device used when printing information generated by a client device via a network, wherein the client device uses a transport layer. When an encryption function is added to the TCP or UDP protocol located in the network and communication of digitized information is performed, an agreement means for negotiating corresponding encryption and decryption logic with at least the client device, and from the client device Of the packets as information units, the communication means for receiving the encrypted data without decrypting the file data portion according to the decryption logic decided by the decision means, and the packet as the information unit not decrypted in the ciphertext Storage means for storing the file as it is, and file data including a packet as an information unit that has not been decrypted. And printing means for decrypting and printing using an application that has been authenticated by the agreement means when printing, and encrypting and decrypting with the client device using TCP or UDP protocol of the transport layer A printing apparatus that performs communication based on logic.

  In the printing apparatus according to claim 14, encryption and decryption logic that can be an agreement candidate by the means for determining the encryption and decryption logic is stored in a memory or a circuit, and becomes an agreement candidate that is stored or implemented. It further comprises logic changing means for periodically changing possible encryption and decryption logic.

  In the printing apparatus according to claim 15, the means for determining the encryption and decryption logic can determine that the plaintext is handled without encryption in relation to the encryption and decryption logic. Is.

  A file sharing system according to a sixteenth aspect is a file sharing system that performs file sharing and shared printing between a client device and a file sharing server device via a network, and the client device and the file sharing server device include: In addition to the existing file sharing application unit, a TCP2 driver having a TCP2 core and a file sharing system core and a file sharing system management application unit are provided. The TCP2 core of the TCP2 driver is a client device or a file sharing server device. The file sharing command and the file sharing response code packet sent from is confirmed and sent to the file sharing system core. The file sharing system core exchanges the key between the client device and the file sharing server device. And performing encryption or decryption of a file sharing command and a file sharing response code sent from the client device or the file sharing server device based on various setting information stored in the storage medium. File transfer is performed with the ciphertext from the server device, and the file sharing system management application unit sets whether or not to decrypt the encrypted file data sent to the file sharing system core And setting information stored in the storage medium of the file sharing system core is stored as information indicating whether or not to perform decoding set by the setting unit.

A file sharing program according to a seventeenth aspect is a program used in a file sharing system that performs file sharing and shared printing between a client device mounted with a TCP2 driver and a file sharing server device mounted with a TCP2 driver. That is, the file sharing program of the present invention is characterized by causing the computer of the client device and the file sharing server device to execute the following procedure.
(A) a procedure for setting the decryption or decryption of the received encrypted file data;
(B) A procedure for creating a key element value held by the client device or the file sharing server device itself based on the setting information;
(C) A new key is generated in both the client device and the file sharing server device from the key source value added to the received file sharing command message or file sharing response message and the key source value held by the device itself. And replacement procedure,
(D) A procedure for sending a file sharing response code and file data in encrypted form from the file sharing server device to the client device.
(E) A procedure for sending a file sharing command and file data in encrypted form from the client device to the file sharing server device.

  According to the file sharing server device, the client device, and the printing device of the present invention, the file data between the client device, the file sharing server device, and the printing device can be transferred while encrypted using the TCP2 function. Because it is possible, only the authorized person can know the contents of the file without being known to others.

Hereinafter, exemplary embodiments of the present invention will be described with reference to the drawings.
FIG. 1 shows a TCP2 protocol stack used in an encrypted communication system applied to a file sharing server apparatus, client apparatus, and printing apparatus of the present invention.

<Description of TCP2 protocol stack>
In this protocol stack, NIC (Network Interface Card) drivers 11 are arranged in layers corresponding to the seven physical layers (first layer) and the data link layer (second layer) of OSI. This driver is a driver for connecting hardware such as a computer to a network, and its contents are data transmission / reception control software. For example, a LAN board or a LAN card for connecting to Ethernet (registered trademark) corresponds to this.

  In the third network layer, there is an IP emulator 13 partially extending to the transport layer (fourth layer). In the portion extending to the transport layer, the function as a transport is not implemented, and only the function of the network layer is provided to the session layer (fifth layer). The IP emulator 13 functions to switch between “IPsec on CP” 13b and “IP on CP” 13a, which are protocols for performing encrypted communication, depending on the application. Here, “on CP” indicates that it is subject to monitoring, destruction, disconnection or passage restriction of “entry” and “attack” by a cracking protector (CP), or that can be set. ing.

  Further, ARP on CP (Address Resolution Protocol on Cracking Protector) is arranged in the network layer. This ARP on CP is a protocol used to obtain a MAC (Media Access Control) address, which is a physical address of Ethernet (registered trademark), from an IP address provided with protection measures against a cracker. The MAC is a transmission control technique used in a LAN or the like called medium access control, and is used as a technique for specifying a frame transmission / reception method, a frame format, error correction, and the like as a data transmission / reception unit.

  Here, the IP emulator 13 is software or firmware for matching various security functions according to the present invention with a conventional IP peripheral stack. That is, the IP emulator 13 includes software, firmware, or hardware for matching with an Internet Control Message Protocol (ICMP) 14a, an Internet Group Management Protocol (IGMP) 14b, TCP 15, UDP 16, and a socket interface 17. (Electronic circuit, electronic component).

  This IP emulator 13 can perform adaptation processing before and after IPsec encryption / decryption and addition / authentication of necessary authentication information. ICMP is a protocol for transferring IP error messages and control messages, and IGMP controls a group of hosts configured to efficiently deliver or receive the same data to a plurality of hosts. It is a protocol to do.

  Further, a TCP emulator 15 and a UDP emulator 16 are arranged on the transport layer (fourth layer) above the IP emulator 13. The TCP emulator 15 functions to switch between “TCPsec on CP” 15b which is a protocol for performing encrypted communication and “TCP on CP” 15a which is a normal communication protocol. Similarly, the UDP emulator 16 functions to switch between “UDPsec on CP” 16b which is a protocol for performing encrypted communication and “UDP on CP” 16a which is a normal communication protocol.

  The most characteristic feature of TCP2 is that TCPsec15b and UDPsec16b encrypted communication protocols are installed in the transport layer (fourth layer).

  In the upper session layer (fifth layer) of the transport layer (fourth layer), a socket interface 17 for exchanging data with protocols such as TCP and UDP is provided. The meaning of this socket means a network address that combines an IP address corresponding to an address in the network of the computer and a port number that is a sub-address of the IP address as described above. Actually, it is composed of a single software program module (execution program, etc.) or a single hardware module (electronic circuit, electronic component, etc.) that collectively adds or deletes a series of headers.

  The TCP emulator 15 has a function of preventing data leakage / falsification in the transport layer, that is, a TCPsec 15b having functions such as encryption, integrity authentication and partner authentication, and such encryption, integrity authentication, and partner It has a function of distributing packets to any one of the normal protocols TCP15a having no function such as authentication. Further, since both the TCPsec 15b and the TCP 15a are provided with a cracking protector (CP), it is possible to realize a function of protecting against “entry” and “attack” by a cracker, regardless of which one is selected. The TCP emulator 15 also serves as an interface with a socket, which is an upper layer.

  Further, as described above, TCP has an error compensation function, whereas UDP does not have an error compensation function, but has a feature that the transfer speed is correspondingly faster and a broadcast function is provided. As with the TCP emulator 15, the UDP emulator 16 has a function of preventing data leakage / falsification, that is, a UDPsec 16b having functions such as encryption, integrity authentication and counterpart authentication, and such encryption, integrity authentication, And has a function of distributing the packet to any one of the normal protocols UDP 16a having no function such as counterpart authentication.

  As shown in FIG. 1, socket 17, TCP emulator 15, UDP emulator 16, "TCPsec on CP" 15b, "UDPsec on CP" 16b, "TCP on CP" 15a, "UDP on CP" 16a, "ICMP on CP" ”14 a,“ IGMP on CP ”14 b, IP emulator 13,“ IP on CP ”13 a, and“ ARPonCP ”12 are protocol stacks for performing encryption processing applied to the present invention. These protocol stacks are collectively called TCP2 (see Patent Document 1).

  TCP2, which plays a central role in the file sharing system applied to the file sharing server device, client device, and printing device of the present invention, is a CP (cracking) standard protocol of TCP, UDP, IP, IPsec, ICMP, IGMP, and ARP. (Protect) can be implemented to prevent attacks from communication on each protocol stack and attacks from application programs (Trojan horses, program tampering, unauthorized use by authorized users).

  Also, in TCP2, a TCP emulator 15 is mounted, and this TCP emulator 15 is outward-facing to maintain compatibility when viewed from the socket 17 in the session layer and the IP emulator 13 in the network layer. It can look the same as standard TCP. Actually, the TCP2 function is executed by switching between TCP and TCPsec. TCPsec is an encryption and authentication function in the transport layer.

  Similarly, in TCP 2, a UDP emulator 16 is mounted, and the UDP emulator 16 is externally connected in order to maintain compatibility when viewed from a socket 17 that is a session layer and an IP emulator 13 that is a network layer. Can be viewed as standard UDP. Actually, as a function of TCP2, UDP and UDPsec are switched and executed. However, since UDPsec is a function that is not used in the file sharing server apparatus, client apparatus, and printing apparatus of the present invention, it will not be described in the following description.

  Next, TCPsec15b, which is a function that prevents “data leakage”, which is a particularly important function in TCP2, will be described. As an encryption / decryption method (algorithm, logic (logic)) for TCPsec15b, a known secret key (common key) encryption algorithm is used.

  In addition, as a TCPsec15b encryption method used in the file sharing server device, client device, and printing device of the present invention, encryption methods such as FEAL (Fast Data Encipherment Algorithm), MISTY, and AES (Advanced Encryption Standard) are also used. It is also possible to use a secret encryption / decryption algorithm created independently. Here, FEAL is an encryption method developed by Nippon Telegraph and Telephone Corporation (at that time), and is a secret key type encryption method that uses the same key for encryption and decryption.

  Next, for example, MISTY is used as an encryption method used for TCP2. This MISTY encrypts data divided into 64-bit blocks in the same manner as IDEA. The key length is 128 bits. The same program is used for encryption and decryption as in DES. As described above, as the encryption method of TCPsec15b applied to the present invention, various known secret key encryption algorithms can be adopted, and a secret key (common key) encryption developed independently by the user. A scheme can also be used.

  Furthermore, as a method of “party authentication” and “integrity authentication” to prevent so-called “spoofing” and “data falsification”, an algorithm using a public key or pre-shared, for example, MD5 Authentication algorithms such as (Message Digest 5) and SHA1 (Secure Hash Algorithm 1) are used. An algorithm using a unique one-way function may be employed instead of such a known authentication algorithm.

  This MD5 is one of hash functions (one-way summarization functions) used for authentication and digital signatures, generates a fixed-length hash value based on the original text, and compares it at both ends of the communication path. It is possible to detect whether the original text has been tampered with during communication. This hash value takes a value like a pseudo random number, and based on this value, the original text cannot be reproduced. It is also difficult to create another message that generates the same hash value.

  SHA1 is also one of hash functions used for authentication, digital signatures, etc., and generates a 160-bit hash value from the original text of 2 <64> bits or less and compares it at both ends of the communication path. It detects the alteration of the original text. This authentication algorithm is also employed in IPsec, which is a typical example of conventional encrypted communication on the Internet.

  These authentication algorithms are designed to enable secure key exchange using the DH (Diffie-Hellman) public key distribution method or the IKE (Internet Key Exchange) protocol (UDP 500) similar to IPsec. Moreover, it is scheduled by a protocol driver program (TCPsec15b, UDPsec16b, etc.) so that the encryption / integrity authentication algorithm (logic) itself and the key set / domain for that purpose are changed periodically.

<Description of TCP2 data packet structure>
Next, a packet structure of data used in the file sharing server apparatus, client apparatus, and printing apparatus of the present invention, its encryption range, and application range of integrity authentication will be described with reference to FIG.

  FIG. 2 shows the TCPsec / IP packet structure, encryption range, and application range of integrity authentication. As shown in FIG. 2, the TCP header 22 and the TCPsec additional information 23 immediately follow the IP header 21, and the application data 24 continues. After the application data 24, a TCPsec additional trailer 25 and TCPsec additional authentication data 26 are arranged. The TCPsec additional trailer 25 is information that supports encrypted data such as a blank of data generated by block cipher, the length of the blank, and the number of the next header.

  Depending on the encryption / authentication algorithm used, this information, which is a characteristic of TCPsec, can be distributed to header fields that are not used by TCPsec / IP, etc., or an independent prior arrangement that cannot be calculated or estimated from individual packets. (Negotiation) can be omitted.

  Further, by constructing a TCPsec / IP packet as shown in FIG. 2 using TCP corresponding to the upper layer of the IP layer and a protocol field not using IP, the packet is more packetized than the IPsec packet focusing only on the lower layer IP. The length can be easily reduced. Here, the encryption range is application data 24 and a TCPsec additional trailer 25 as shown in the figure, and the TCPsec additional information 26 is added to the authentication range in addition to the encryption range.

<Description of Functional Block Diagram of File Sharing System Using TCP2>
Next, a first embodiment of a file sharing system using TCP2 applied to the present invention, particularly a file sharing system for performing communication between a client device and a file sharing server device will be described with reference to the drawings. .

  FIG. 3 is a block diagram of an embodiment of a client device and a file sharing server device used in the file sharing system applied to the present invention. The client device and the file sharing server device have the same block configuration diagram, but in order to distinguish them, the symbol “A” is added to the client device, and the symbol “B” is added to the file sharing server device. To do. The client device A and the file sharing server device B are connected to the network 40.

  First, the configuration of the client device A will be described. The client device A includes a file sharing system management application unit 34A and a TCP2 driver 35A in addition to the input device 31A, the output device (display device) 32A, and the existing file sharing application unit 33A. In addition, a storage medium 36A for storing a file received from the file sharing server apparatus B is provided.

  The TCP2 driver 35A includes a TCP2 core 37A described in FIG. 4, a file sharing system core 38A and a storage medium 39A described in FIG. The storage medium 39A is a storage medium that is different from the storage medium 36A that the client apparatus A normally has, and stores various kinds of information that will be described later in a state encrypted with the secret key that the file sharing system core 38A has. It is.

  Here, the file sharing server apparatus B is also connected to the network 40 to which the client apparatus A is connected, and files are transferred between the client apparatus A and the file sharing server apparatus B via the network 40. Since the configuration of the file sharing server apparatus B is the same as that of the client apparatus A, the description thereof is omitted.

  Next, the operation of the client apparatus A shown in FIG. 3 will be briefly described. Details will be described with reference to FIGS.

  First, the encrypted file data transmitted from the file sharing server apparatus B via the network 40 is sent to the TCP2 core 37AA of the TCP2 driver 35A installed in the client apparatus A. The TCP2 core 37A confirms that the packet is a file sharing port packet, and then sends the file data to the file sharing system core 38A. Then, the file sharing system core 38A performs the processing described later and sends it to the existing file sharing application unit 33A.

  The file sharing system core 38A is a part that analyzes the file sharing message sent from the file sharing server apparatus B and encrypts or decrypts the message. Further, key generation and key exchange are performed in the file sharing system core 38A. Further, the file sharing system core 38A is connected to a storage medium 39A, and the IP address and port number of the file sharing server device are stored in the storage medium 39A.

  The storage medium 39A stores various setting information, user IDs and passwords, and key information. Similar information is stored in the storage medium 39B of the file sharing server apparatus B, but the port number of the client apparatus A is not stored. Only the IP address of client device A is stored.

  Further, the file sharing system core 38A is connected to the file sharing system management application unit 34A. This file sharing system management application unit 34A is a part for managing information of the communication partner, and among the file data received from the file sharing server apparatus B, “whether to decrypt or not to decrypt file information other than directory information” Set.

The configuration and operation of the embodiment of the client device A according to the present invention have been described above. However, the file sharing server device B operates almost the same as the client device A, and thus the description thereof is omitted here.
Next, specific examples of each element constituting the client apparatus A will be described based on the block diagrams of FIGS. 4 to 6 and the flowcharts of FIGS. 7 to 14.

  FIG. 4 is a functional block diagram for explaining the TCP2 core 37 that is a component of the TCP2 driver 35 in more detail. Since the client apparatus A and the file sharing server apparatus B have the same configuration, A and B added in FIG. 3 are omitted and given the same reference numerals.

  As shown in FIG. 4, the TCP2 core 37 receives a port search request from the file sharing system core 38 and searches for a specified port, and also receives a hook request from the file sharing system core 38. A hook processing unit 43 that hooks a packet that matches the request is provided.

  A file sharing command message packet confirmation unit 44 that receives a message packet of a file sharing command from the existing file sharing application unit 33 of the client apparatus A and confirms that it is a message packet of the file sharing command and a response message thereof. A confirmation unit 45 is provided with a file sharing response message packet for confirmation. The file sharing command message confirmation unit 44 and the file sharing response message packet confirmation unit 45 further include a packet intercept unit 46 that connects the file sharing system core 38 to the file sharing system message core 38.

  The hook processing unit 43 is a part that performs processing for supplementing a hook request from the file sharing system core 38 (a request to catch a predetermined packet when it is received). That is, in the hook processing unit 43, in cooperation with the file sharing command message packet confirmation unit 44, when an IP address or port with a hook request is confirmed in advance, it is captured and sent to the file sharing system core 38.

  Similarly, when the confirmation unit 45 of the file sharing response message packet confirms each message packet, it is captured by the hook processing unit 43 and the result is sent to the file sharing system core 38 via the packet intercepting unit 46. send. The above is the configuration and operation of the TCP2 core 37.

  Next, the configuration and operation of the file sharing system core 38 will be described with reference to FIG. The same components as those in FIG. 3 and FIG.

  The file sharing system core 38 analyzes and authenticates the file sharing command message packet sent from the TCP2 core 37, and the file sharing command message packet analyzed and authenticated by the authentication / analyzing unit 50. An encryption unit 51 for encryption, a decryption unit 52 for decrypting a file sharing command message packet analyzed and authenticated by the authentication / analysis unit 50, and a key exchange unit 53 for exchanging keys between client devices. It has.

  Further, as described above, in the client device A, the storage medium 39A connected to the file sharing system core 38A includes various setting information, user ID and password, IP address and port number of the file sharing server, key information, and the like. Is stored in an encrypted state. Here, the storage medium 39A is distinguished from the storage medium 39B of the file sharing server apparatus B. The storage medium 39B of the file sharing server apparatus B stores the IP address of the client but does not store the port number. Because.

  Further, the file sharing system core 38 includes an interface unit 54 for connecting to the file sharing system management application unit 34. The storage medium 39 of the file sharing system core 38 is connected to the file sharing system management application unit 34 via the interface unit 54.

  The operation of the file sharing system core 38 shown in FIG. 5 will be described below. As described above, the command message packet hooked by the TCP 2 core 37 based on the hook request from the file sharing system core 38 is sent from the TCP 2 core 37 to the authentication / analysis unit 50 of the file sharing system core 38.

  The encryption unit 51 of the file sharing system core 38 encrypts the file sharing command message packet analyzed by the authentication / analysis unit 50, and sends the file sharing command message packet to the file sharing server device B ( Or it is sent to the client device A).

  The decrypting unit 52 decrypts the file sharing command message authenticated by the authenticating / analyzing unit 50, and the existing file sharing application unit 33 (not shown) or the file sharing server device B (or client) via the TCP2 core 37. To device A). The key exchange unit 53 is a part that performs key exchange between the client device A and the file sharing server device B.

  Next, the configuration and operation of the file sharing system management application unit 34 will be described with reference to FIG. Since the configuration of the file sharing system management application unit 34 does not change between the client device A and the file sharing server device B, description will be made without adding ‘A’ representing a client and server ‘B’ indicating only a number.

  The file sharing system management application unit 34 is software that connects the file sharing system core 38 to the input device 31 and the output device 32. The interface 61, the user registration unit 62, the communication partner information management unit 63, and the ciphertext file The display unit 64 and the input / output control unit 65 display plaintext.

When the user registration is performed by the file sharing system core 38 from the input / output control unit 65 via the interface 61 and the user registration is completed, a user registration completion notification is sent from the file sharing system core 38 to the user registration unit 62 via the interface 61. Sent to recognize that user registration and key exchange have been completed.
The plain text display unit 64 has a function of changing a file stored in the storage medium 39 in cipher text into plain text and displaying the file on the display screen of the output device 32.

  In addition, the communication partner information management unit 63 receives communication partner information from the file sharing system core 38 and manages it. In addition, the setting unit 66 sets whether to decode file information other than the directory information in the file data received from the file sharing server apparatus B.

<Description of file sharing system flow (client side: first time)>
Next, the flow (first time) of the file sharing system on the client side will be described with reference to FIGS. Here, “first time” means that this procedure is not necessary after the second time. The description here is centered on the description of the operation of the TCP2 driver 35A on the client device A side. Therefore, the description will be given with “A” representing the client side, and the description of the system on the file sharing server side described later (“B”). It will be distinguished from 'added).

  First, in the setting unit 66A of the file sharing system management application unit 34A of the client device A, decryption / non-decryption of data received from the file sharing server device B is set (step S1). This setting can also be acquired from a TCP2 download server. It is also possible to obtain the setting data from an FD, CD, or USB memory that stores the setting data.

  The file sharing system core 38A creates a key source value based on the setting information sent from the file sharing system management application unit 34A, and stores it in the storage medium 39A (step S2). Then, a search request for the designated communication port is made from the file sharing system core 38A to the TCP2 core 37A. In response to this search request, the TCP2 core 37A searches for a designated communication port (step S3).

  Here, the file sharing application unit 33A connects to the file sharing server apparatus B (step S4), and further uses the SMB / CIFS (Server Message Block / Common Internet File System) protocol with the file sharing server apparatus B. Negotiate. With this negotiation message, the TCP2 core 37A receives this message, recognizes that it is a file sharing port, and notifies the file sharing system core 38A of the search result (step S5). The negotiation packet is sent to the file sharing system core 38A.

  The file sharing system core 38A receives the search result of the TCP2 core 37A, requests the TCP2 core 37A to intercept the packet, adds a key element value to the negotiation packet, and sends it to the file sharing server apparatus B (step S6). ).

  In response to the request from the file sharing system core 38A, the TCP2 core 37A starts intercepting the packet (step S7). Subsequently, a negotiation response message is issued from the file sharing server apparatus B to the client apparatus A. The TCP2 core 37A confirms the message packet of the negotiation response, and sends the result to the file sharing system core 38A (step S8).

  The file sharing system core 38A analyzes the negotiation response message by the authentication / analysis unit 50A, and calculates a new key from the key element value added to the response message and the key element value stored in the file sharing system core. Is generated. This key generation is performed by the key exchange unit 53A in the file sharing system core 38A. This newly generated key is stored in the storage medium 39A. Further, the IP address and port number of the file sharing server device B are stored in the storage medium 39A (step S9). Then, the negotiation response sent from the file sharing server device B is sent to the file sharing application unit 33A.

  Next, a message for session setup (logon to the server) is transmitted from the file sharing application unit 33A to the file sharing server apparatus B. At this time, the TCP2 core 37A confirms the packet of this session setup message (step S10), and sends the session setup message from the file sharing application unit 33A to the file sharing system core 38A.

  The file sharing system core 38A analyzes the session setup message, and temporarily stores (temporarily stores) the user ID and password in the storage medium 39A (see FIG. 5) (step S11). Here, “temporarily storing” means storing at a stage where the authentication is not performed by confirming a password or the like, that is, a stage before the formal saving after the authentication. Then, the session setup message packet is encrypted and sent to the file sharing server apparatus B.

  Next, the file sharing server apparatus B that has received this session setup message issues a session setup response to the client apparatus A. At this time, the TCP2 core 37A confirms the packet of this session setup response and sends it to the file sharing system core 38A (step S12). The file sharing system core 38A analyzes the session setup response message and decrypts the ciphertext (step S13). Then, the user ID and password stored in the storage medium 39A are formally stored. Further, a session setup response is sent to the file sharing application unit 33A.

  Subsequently, the file sharing application unit 33A starts tree setup. That is, when the shared resource of the shared server is as shown in FIG. 9, for example, connection to the SERVER01 resource is performed. This tree setup message is transmitted to the file sharing server apparatus B, and this is confirmed by the TCP2 core 37A (step S14). Then, the TCP2 core 37A sends the confirmed message to the file sharing system core 38A.

  The file sharing system core 38A analyzes the tree setup message and encrypts the packet (step S15). Then, the file sharing system core 38A sends the encrypted tree setup message to the file sharing server apparatus B.

  In response to this, the file sharing server apparatus B establishes connection of the SERVER01 resource and sends a tree setup response to the client apparatus A. At this time, the TCP2 core 37A confirms this response packet and sends it to the file sharing system core 38A (step S16). The file sharing system core 38A analyzes the tree setup response message and decodes the packet (step S17). Then, the decrypted packet is sent to the file sharing application unit 33A.

  Subsequently, the file sharing application unit 33A continues tree setup in response to the session setup response. That is, when the shared resource of the shared server is as shown in FIG. 9 described above, this time, connection to the next share1 resource of SERVER01 is performed. This tree setup message is transmitted to the file sharing server apparatus B, and this is confirmed by the TCP2 core 37A (step S18). Then, the TCP2 core 37A sends the confirmed message to the file sharing system core 38A.

  The file sharing system core 38A analyzes the tree setup message and encrypts the packet (step S19). Then, the file sharing system core 38A sends the encrypted tree setup message to the file sharing server apparatus B.

  In response to this, the file sharing server apparatus B establishes a connection for the Share1 resource and sends a tree setup response to the client apparatus A. At this time, the TCP2 core 37A confirms this response packet and sends it to the file sharing system core 38A (step S20). The file sharing system core 38A analyzes the tree setup response message and decodes the packet (step S21). Then, the decrypted packet is sent to the file sharing application unit 33A.

  The tree setup is performed by the processing so far. When the number of tree hierarchies is three or more, the tree setup of a necessary number of hierarchies is performed by repeating the processes shown in steps S14 to S17 or steps S18 to S21. Then, after the above tree setup process, the flow (first time) of the file sharing system on the client side continues in FIG.

  Next, the file sharing application unit 33A sends a file creation request command to the shared file server apparatus B. At this time, the TCP2 core 37A receives this command, and the TCP2 core 37A confirms the packet of the file creation request message and sends it to the file sharing system core 38A (step S22). The file sharing system core 38A analyzes the file creation request message and encrypts it. Then, the encrypted file creation request message is sent to the file sharing server device B (step S23).

  In response to this, the file sharing server apparatus B generates a file creation response. The TCP2 core 37A confirms the packet of this file creation response message and sends it to the file sharing system core 38A (step S24). The file sharing system core 38A analyzes the file creation response message by the authentication / analysis unit 50, and decrypts the message encrypted by the decryption unit 52 (step S25). Then, this response message is sent to the file sharing application unit 33A.

  Next, the file sharing application unit 33A writes file data. At this time, the TCP2 core 37A confirms the packet of the write message in the file data and sends it to the file sharing system core 38A (step S26). The file sharing system core 38A analyzes the file data write message by the authentication / analysis unit 50A, and performs encryption processing of the packet (file data) (step S27). Then, this packet (file data) is sent to the file sharing server apparatus B.

  In response to this, the file sharing server apparatus B transmits a file data write response. In the response code message confirmation unit 45A, the TCP2 core 37A confirms the packet of the file data write response message and sends it to the file sharing system core 38A (step S28). The file sharing system core 38A analyzes the write response message by the authentication / analysis unit 50A, decrypts the encrypted packet, and sends it to the file sharing application unit 33A (step S29).

  Thus, the writing of the file data is completed. Therefore, finally, a termination process is performed from the file sharing application unit 33A toward the file sharing server apparatus B. In this end processing, first, a tree cutting command is sent from the file sharing application unit 33A, and the TCP2 core 37A checks this command with the file sharing command message checking unit 44A and sends it to the file sharing system core 38A. (Step S30).

  The file sharing system core 38A analyzes the tree cut message by the authentication / analysis unit 50A, encrypts the message, and sends it to the file sharing server B connected to the network 40 (step S30). In response to this, a tree disconnection response is sent from the file sharing server device B to the TCP2 core 37A. The TCP2 core 37A confirms the packet of the tree cut response (step S32), and sends the result to the file sharing system core 38A.

  The file sharing system core 38A analyzes and decodes the tree disconnection response message from the TCP2 core 37A, and sends it to the file sharing application unit 33A (step S33). In response to this, the client apparatus A sends a session disconnection response to the TCP2 core 37A. The TCP2 core 37A confirms this session disconnection response packet (step S34), and sends the result to the file sharing system core 38A.

  The file sharing system core 38A analyzes and encrypts the session disconnection response message from the TCP2 core 37A, and sends it to the file sharing server B (step S35). Then, a session disconnection response is sent from the file sharing server device B to the TCP2 core 37A. The TCP2 core 37A confirms this session disconnection response packet (step S36), and sends the result to the file sharing system core 38A.

The file sharing system core 38A analyzes and decrypts the session disconnection response message from the TCP2 core 37A, and sends it to the file sharing application unit 33A (step S37). At this stage, the TCP communication control session between the client apparatus A and the file sharing server apparatus B is disconnected.
The above is the description of the flow (first time only) on the client side of the file sharing system.

<Description of file sharing system flow (server side: first time)>
Next, the flow (first time) of the file sharing system on the server side will be described based on FIG. 10 and FIG. The explanation here is the same as the explanation on the client side explained in FIG. 7 and FIG. 8, but the explanation here is mainly about the operation of the TCP2 driver 35B on the file sharing server apparatus B side. A description will be given with 'B' representing the server side. Further, in order to make it easy to understand the correspondence relationship after FIG. 7 and FIG.

  Therefore, first, the data decryption / non-decryption is set in the setting unit 66B of the file sharing system management application unit 34B of the file sharing server device B (step S41). This setting can also be acquired from a TCP2 download server. It is also possible to obtain the setting data from an FD, CD, or USB memory that stores the setting data.

  The file sharing system core 38B creates a key source value based on the setting information sent from the file sharing system management application unit 34B, and stores it in the storage medium 39B (step S42). Then, a search request for the designated communication port is made from the file sharing system core 38B to the TCP2 core 37B. In response to this search request, the TCP2 core 37B searches for the designated communication port (step S43).

  Here, the SMB / CIFS (Server Message Block / Common Internet File System) protocol is negotiated between the client apparatus A and the file sharing server apparatus B on the network (step S44). Based on this negotiation message, the TCP2 core 37B recognizes that it is a file sharing port, and notifies the file sharing system core 38B of the search result (step S45). The negotiation packet is sent to the file sharing system core 38B.

  The file sharing system core 38B receives the search result of the TCP2 core 37B, requests the TCP2 core 37B to intercept the packet, and stores the key element value added to the message and the key element stored in the file sharing system core. A new key is generated from the value. This key generation is performed by the key exchange unit 53B in the file sharing system core 38B. This newly generated key is stored in the storage medium 39B. Further, the IP address of the client device A is stored in the storage medium 39B (step S46). Then, the packet is sent to the file sharing application unit 33B.

  In response to the request from the file sharing system core 38B, the TCP2 core 37B starts intercepting the packet (step S47). Subsequently, a negotiation response message is issued from the file sharing application unit 33B. The TCP2 core 37B confirms the message packet of the negotiation response, and sends the result to the file sharing system core 38B (step S48).

  The file sharing system core 38B analyzes the negotiation response message by the authentication / analysis unit 50B, and adds the key element value stored in the storage medium 39B to the packet (step S49). Then, a negotiation response is sent to the client device A.

  Next, a session setup (logon to the server) message from the client apparatus A is received by the TCP2 core 37B. The TCP2 core 37B confirms the packet of the session setup message (step S50), and sends the session setup message from the file sharing application unit 33B to the file sharing system core 38B.

  The file sharing system core 38B analyzes the session setup message, and temporarily stores (temporarily stores) the user ID and password in the storage medium 39B (see FIG. 5) (step S51). Here, “temporarily storing” means storing at a stage where the authentication is not performed by confirming a password or the like, that is, a stage before the formal saving after the authentication. Then, the packet of the session setup message is decrypted and sent to the file sharing application unit 33B.

  In response to this, the file sharing application unit 33B issues a session setup response. The TCP2 core 37B confirms the packet of the session setup response and sends it to the file sharing system core 38B (step S52). The file sharing system core 38B analyzes and encrypts the negotiation response message (step S53). Then, the user ID and password stored in the storage medium 39B are formally stored. Further, a session setup response is sent to the client device A.

  Next, the client apparatus A starts tree setup in response to the session setup response. That is, when the shared resource of the shared server is as shown in FIG. 9, for example, connection to the SERVER01 resource is performed. This tree setup message is transmitted and confirmed by the TCP2 core 37B (step S54). Then, the TCP2 core 37B sends the confirmed message to the file sharing system core 38B.

  The file sharing system core 38B analyzes the tree setup message and decrypts the encrypted packet (step S55). Then, the decrypted tree setup message is sent to the file sharing application unit 33B.

  In response, the file sharing application unit 33B establishes a connection to the SERVER01 resource and sends a tree setup response to the client device A. At this time, the TCP2 core 37B confirms this response packet and sends it to the file sharing system core 38B (step S56). The file sharing system core 38B analyzes the tree setup response message and encrypts the packet (step S57). Then, it sends a tree setup response packet to the client device A.

  Subsequently, the client apparatus A continues the tree setup in response to the session setup response. That is, when the shared resource of the shared server is as shown in FIG. 9 described above, this time, connection to the next share1 resource of SERVER01 is performed. This tree setup message is transmitted and confirmed by the TCP2 core 37B (step S58). Then, the TCP2 core 37B sends the confirmed message to the file sharing system core 38B.

  The file sharing system core 38B analyzes the tree setup message and decrypts the packet (step S59). Then, the file sharing system core 38B sends the decrypted tree setup message to the file sharing application unit 33B.

  In response, the file sharing application unit 33B establishes a connection to the share1 resource and sends a tree setup response to the client device A. At this time, the TCP2 core 37B confirms this response packet and sends it to the file sharing system core 38B (step S60). The file sharing system core 38B analyzes the tree setup response message and encrypts the packet (step S61). Then, it sends a tree setup response packet to the client device A.

  The tree setup is performed by the processing so far. When the number of tree hierarchies is three or more, the tree setup of a necessary number of hierarchies is performed by repeating the processes shown in steps S54 to 57 or steps S58 to 61. Then, after the above tree setup process, the flow (first time) of the file sharing system on the file sharing server side continues in FIG.

  Next, the client apparatus A sends a file creation request command to the shared server apparatus B. At this time, the TCP2 core 37B receives this command, confirms the packet of the file creation request message, and sends it to the file sharing system core 38B (step S62). The file sharing system core 38B analyzes and decrypts the file creation request message. Then, the decrypted file creation request message is sent to the file sharing application unit 33B (step S63).

  In response, the file sharing application unit 33B generates a file creation response. The TCP2 core 37B confirms the packet of this file creation response message and sends it to the file sharing system core 38B (step S64). The file sharing system core 38B analyzes the file creation response message by the authentication / analysis unit 50 and performs message encryption processing (step S65). Then, this response message is sent to the client apparatus A.

  Next, the client apparatus A writes file data. The TCP2 core 37B confirms the packet of the write message in the file data and sends it to the file sharing system core 38B (step S66). The file sharing system core 38B analyzes the file data write message by the authentication / analysis unit 50B, and performs processing of decrypting / not decrypting the packet (file data) according to the setting (step S67). Then, this packet (file data) is sent to the file sharing application unit 33B.

  In response to this, the file sharing application unit 33B transmits a file data write response. In the response code message confirmation unit 45B, the TCP2 core 37B confirms the packet of the file data write response message and sends it to the file sharing system core 38B (step S68). The file sharing system core 38B analyzes the write response message by the authentication / analysis unit 50B, encrypts the packet, and sends it to the client device A (step S69).

  Thus, the writing of the file data is completed. Therefore, finally, a termination process is performed from the client apparatus A toward the file sharing application unit 33B. In this end processing, first, a tree cutting command is sent from the client device A, and the TCP2 core 37B confirms this command by the file sharing command message confirmation unit 44B, and sends this to the file sharing system core 38B (step). S70).

  The file sharing system core 38B analyzes the tree cut message by the authentication / analysis unit 50B, decrypts the message, and sends it to the file sharing application unit 33B (step S71). In response to this, a tree disconnection response is sent from the file sharing application unit 33B to the TCP2 core 37B. The TCP2 core 37B confirms the packet of the tree cut response (step S72) and sends the result to the file sharing system core 38B.

  The file sharing system core 38B analyzes and encrypts the tree disconnection response message from the TCP2 core 37B, and sends it to the client apparatus A (step S73). In response to this, the client apparatus A sends a session disconnection response to the TCP2 core 37B. The TCP2 core 37B confirms this session disconnection response packet (step S74) and sends the result to the file sharing system core 38B.

  The file sharing system core 38B analyzes and decrypts the session disconnection response message from the TCP2 core 37B and sends it to the file sharing application unit 33B (step S75). Then, a session disconnection response is sent from the file sharing application unit 33B to the TCP2 core 37B. The TCP2 core 37B confirms this session disconnection response packet (step S76), and sends the result to the file sharing system core 38B.

The file sharing system core 38B analyzes and encrypts the session disconnection response message from the TCP2 core 37B, and sends it to the client apparatus A (step S77). At this stage, the TCP communication control session between the client apparatus A and the file sharing server apparatus B is disconnected.
The above is the description of the flow (first time only) on the server side of the file sharing system.

  The first flow on the client side (FIGS. 7 and 8) and the server side (FIGS. 10 and 11) of the file sharing system has been described above. Next, the flow after the second time will be described. Since most of the flow after the second time is the same as the flow of FIGS. 7, 8, 10, and 11, only the changed portion will be described in the following description.

<Description of file sharing system flow (client side: second and later)>
First, the flow (second and subsequent times) of the file sharing system on the client side will be described with reference to FIGS. Similarly to the first time, the TCP2 driver 35, the TCP2 core 37, the file sharing system core 38, etc. on the client device A side will be described with “A” representing the client side, and will be described later. Will be described with “B” added.

  Here, steps S1 and S2 are unnecessary after the second time, and first, a file sharing hook request is issued from the file sharing system core 38A of the client apparatus A to the TCP2 core 37A. In response to this hook request, the TCP2 core 37A captures (hooks) the IP addresses and port numbers of the registered file sharing servers of all users (step S3 ').

  Therefore, the file sharing application unit 33A connects to the file sharing server apparatus B (step S4), and further negotiates with the file sharing server apparatus B for the SMB / CIFS (Server Message Block / Common Internet File System) protocol. I do. By this negotiation message, the TCP2 core 37A recognizes that the message is a file sharing message, hooks the packet, and notifies the file sharing system core 38A (step S5 '). The negotiation packet is sent to the file sharing system core 38A.

  Upon receiving the notification from the TCP2 core 37A, the file sharing system core 38A requests the TCP2 core 37A to intercept the packet, and encrypts the packet and sends it to the file sharing server apparatus B (step S6 ′).

  In response to the request from the file sharing system core 38A, the TCP2 core 37A starts intercepting the packet (step S7). Subsequently, a negotiation response message is issued from the file sharing server apparatus B to the client apparatus A. The TCP2 core 37A confirms the message packet of the negotiation response, and sends the result to the file sharing system core 38A (step S8).

  The file sharing system core 38A analyzes the negotiation response message by the authentication / analysis unit 50A, and decrypts the encrypted packet (step S9 '). Then, the negotiation response sent from the file sharing server device B is sent to the file sharing application unit 33A. Next, a message for session setup (logon to the server) is transmitted from the file sharing application unit 33A to the file sharing server apparatus B.

  At this time, the TCP2 core 37A confirms the packet of this session setup message (step S10), and sends the session setup message from the file sharing application unit 33A to the file sharing system core 38A. The file sharing system core 38A analyzes the session setup message, encrypts the packet of the session setup message, and sends it to the file sharing server apparatus B (step S11 ′).

  In response to this, the file sharing server apparatus B issues a session setup response. The TCP2 core 37A confirms the session setup response packet and sends it to the file sharing system core 38A (step S12). The file sharing system core 38A analyzes the negotiation response message and decrypts the encrypted packet (step S13 ′). Then, a session setup response is sent to the file sharing application unit 33A.

The file sharing application unit 33A starts tree setup in response to the session setup response. Hereinafter, the processing in steps S14 to S37 is the same as that in FIGS. Thereby, a tree setup (steps S14 to S21) and a file creation request (steps S22 to S25) are performed, and file data is written (steps S26 to S29). Further, tree cutting (steps S30 to S33) and session cutting (steps S34 to S37) are performed, and the process ends.
The above is the description of the flow (second and subsequent times) on the client side of the file sharing system.

<Description of server-side flow of file sharing system (second and later)>
Next, the flow on the server side of the file sharing system (from the second time on) will be described with reference to FIGS. The explanation here is almost the same as the explanation on the client side (second and subsequent times) explained in FIG. 12 and FIG. 13, but the explanation centers on the explanation of the operation of the TCP2 driver 35B on the file sharing server apparatus B side. Therefore, a description will be given with 'B' representing the file sharing server side.

  Here, steps S41 and S42 are unnecessary after the second time. First, a file sharing hook request is issued from the file sharing system core 38B of the file sharing server apparatus B to the TCP2 core 37B. The TCP2 core 37B receives this hook request and captures (hooks) the IP addresses of all registered clients 'clients (step S43').

  Therefore, the client apparatus A connects to the file sharing server apparatus B (step S44), and negotiates the SMB / CIFS (Server Message Block / Common Internet File System) protocol with the file sharing server apparatus B. By this negotiation message, the TCP2 core 37B recognizes that the message is a file sharing message, hooks the packet, and notifies the file sharing system core 38B (step S45 '). The negotiation packet is sent to the file sharing system core 38B.

  Upon receiving the notification from the TCP2 core 37B, the file sharing system core 38B requests the TCP2 core 37B to intercept the packet (step S46 ′).

  In response to the request from the file sharing system core 38B, the TCP2 core 37B starts intercepting the packet (step S47). Subsequently, a negotiation response message is issued from the file sharing application unit 33B. The TCP2 core 37B confirms the message packet of the negotiation response, and sends the result to the file sharing system core 38B (step S48).

  The file sharing system core 38B analyzes the negotiation response message by the authentication / analysis unit 50B, and encrypts the packet (step S49 ′). Then, the negotiation response sent from the file sharing application unit 33B is sent to the client apparatus A. Next, a message for session setup (logon to the server) is transmitted from the client device A to the file sharing server device B.

  At this time, the TCP2 core 37B confirms the packet of this session setup message (step S50), and sends the session setup message from the client apparatus A to the file sharing system core 38B. The file sharing system core 38B analyzes the session setup message, decodes the packet of the session setup message, and sends it to the file sharing application unit 33B (step S51 ′).

  In response to this, the file sharing application unit 33B issues a session setup response. The TCP2 core 37B confirms the packet of the session setup response and sends it to the file sharing system core 38B (step S52). The file sharing system core 38B analyzes the negotiation response message and encrypts the packet (step S53 ′). Then, a session setup response is sent to the client device A.

The client apparatus A starts tree setup in response to the session setup response. Hereinafter, the processes of steps S14 to S37 are the same as those in FIGS. Thereby, a tree setup (steps S54 to S61) and a file creation request (steps S62 to S65) are performed, and file data is written (steps S66 to S69). Further, tree cutting (steps S70 to S73) and session cutting (steps S74 to S77) are performed, and the process ends.
The above is the description of the flow (second and subsequent times) on the server side of the file sharing system.

<Description of application examples of file sharing system>
Finally, a flow of the file sharing system when printing is described as an application example of the file sharing system. That is, in the embodiment for printing by applying the present invention, for example, in the block diagram shown in FIG. 3, a printing means (printer) is provided as the output device 32B of the server device B.

  First, the flow (in the case of printing) of the file sharing system on the client side will be described with reference to FIG. Similarly to the description so far, the TCP2 driver 35, the TCP2 core 37, the file sharing system core 38, etc. on the client apparatus A side are described with “A” representing the client side, and will be described later. A description will be given with 'B' added to the side system. The processing up to tree setup (step S21) is the same as in FIGS. Accordingly, the following processing is common to the first time and the second time and thereafter.

  In FIG. 16, the file sharing application section 33 </ b> A sends a print spool open request command to the file sharing server apparatus B. At this time, the TCP2 core 37A confirms the packet of the print spool open request message and sends it to the file sharing system core 38A (step S82). The file sharing system core 38A analyzes and encrypts the print spool open request message. Then, this encrypted print spool open request message is sent to the file sharing server apparatus B (step S83).

  In response to this, the file sharing server apparatus B generates a print spool open response. The TCP2 core 37A confirms the packet of the print spool open response message and sends it to the file sharing system core 38A (step S84). In the file sharing system core 38A, the authentication / analysis unit 50 analyzes the print spool open response message, and decrypts the message encrypted by the decryption unit 52 (step S85). Then, this response message is sent to the file sharing application unit 33A.

  Next, the file sharing application unit 33A writes print data. The TCP2 core 37A confirms the packet of the write message in the print data and sends it to the file sharing system core 38A (step S86). In the file sharing system core 38A, the authentication / analysis unit 50A analyzes the print data write message, and performs encryption processing of the packet (print data) (step S87). Then, this packet (print data) is sent to the file sharing server apparatus B.

  In response to this, the file sharing server apparatus B transmits a print data write response. The TCP2 core 37A confirms the print data write response message packet in the response code message confirmation unit 45A and sends it to the file sharing system core 38A (step S88). The file sharing system core 38A analyzes the write response message by the authentication / analysis unit 50A, decrypts the encrypted packet, and sends it to the file sharing application unit 33A (step S89).

Thus, the print data writing is completed. Furthermore, the subsequent tree cutting (steps S30 to S33) and session cutting (steps S34 to S37) processing is the same as in FIG. 8 and FIG.
The above is the description of the flow (in the case of printing) on the client side of the file sharing system.

  Next, the flow of the file sharing system on the server side (in the case of printing) will be described based on FIG. Since the description here is centered on the operation of the TCP2 driver 35B on the file sharing server apparatus B side, it will be described with “B” representing the server side. The processing up to the tree setup (step S61) is the same as that in FIGS. Accordingly, the following processing is common to the first time and the second time and thereafter.

  In FIG. 17, the client apparatus A sends a print spool open request command to the file sharing server apparatus B. At this time, the TCP2 core 37B confirms the packet of the print spool open request message and sends it to the file sharing system core 38B (step S92). The file sharing system core 38B analyzes and decrypts the print spool open request message. Then, the decrypted print spool open request message is sent to the file sharing application unit 33B (step S93).

  In response, the file sharing application unit 33B generates a print spool open response. The TCP2 core 37B confirms the packet of the print spool open response message and sends it to the file sharing system core 38B (step S94). In the file sharing system core 38B, the authentication / analysis unit 50 analyzes the print spool open response message and performs message encryption processing (step S95). Then, this response message is sent to the client apparatus A.

  Next, the client apparatus A writes print data. The TCP2 core 37B confirms the packet of the write message in the print data and sends it to the file sharing system core 38B (step S96). The file sharing system core 38B analyzes the print data writing message by the authentication / analysis unit 50B, and performs decryption processing (step S97). Then, this packet (print data) is sent to the file sharing application unit 33B.

  In response to this, the file sharing application section 33B transmits a print data write response. In the response code message confirmation unit 45B, the TCP2 core 37B confirms the packet of the print data write response message and sends it to the file sharing system core 38B (step S98). The file sharing system core 38B analyzes the write response message by the authentication / analysis unit 50B, encrypts the packet, and sends the packet to the client apparatus A (step S99).

Thus, the print data writing is completed. Further, the subsequent tree cutting (steps S70 to S73) and session cutting (steps S74 to S77) are the same as those in FIG. 11 and FIG. In the case of this printing, after the session disconnection process is completed, the file sharing application unit 33B sends the print data to the printing means (printer) to perform printing (step S100).
This completes the description of the flow (in the case of printing) on the server side of the file sharing system.

  As described above, since the file sharing server device, client device, and printing device of the present invention perform file transfer using TCP2 having a high security function, compared with file sharing communication by existing encryption processing, In particular, it provides extremely powerful defenses against data leaks, tampering, impersonation, intrusion and attacks.

  It goes without saying that the present invention is not limited to the embodiment described above, and includes more embodiments without departing from the gist of the present invention described in the claims.

It is a figure which shows the protocol stack of TCP2 used for the file sharing system applied to this invention. It is a figure which shows the structure of the message packet used for the file sharing system applied to this invention. It is a block block diagram in the file sharing system containing the client apparatus A and the file sharing server apparatus B of this invention. It is a block block diagram for demonstrating the outline of the TCP2 core which is a component of the file sharing system of this invention. It is a block block diagram for demonstrating the outline of the file sharing system core which is a component of the file sharing system of this invention. It is a block block diagram for demonstrating the outline of the file sharing system management application part which is a component of the file sharing system of this invention. It is a flowchart which shows a part of flow (first time) by the side of the client in the file sharing system of this invention. It is a flowchart which shows a part of flow (first time) by the side of the client in the file sharing system of this invention. It is explanatory drawing of the tree structure for description of this invention. It is a flowchart which shows a part of flow (first time) by the side of the server in the file sharing system of this invention. It is a flowchart which shows a part of flow (first time) by the side of the server in the file sharing system of this invention. It is a flowchart which shows a part of flow (2nd time and after) on the client side in the file sharing system of this invention. It is a flowchart which shows a part of flow (2nd time and after) on the client side in the file sharing system of this invention. It is a flowchart which shows a part of flow (2nd time or later) by the side of the server in the file sharing system of this invention. It is a flowchart which shows a part of flow (2nd time or later) by the side of the server in the file sharing system of this invention. It is a flowchart which shows a part of flow (in the case of printing) on the client side in the file sharing system of this invention. It is a flowchart which shows a part of flow (in the case of printing) by the side of the server in the file sharing system of this invention.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 31 ... Input device, 32 ... Output device, 33 ... Existing file sharing application part, 34 ... File sharing system management application part, 35 ... TCP2 driver, 36, 39 ... Storage medium, 37 ... TCP2 core, 38 ... File sharing system Core, 40 ... Network, 50 ... Authentication / analysis unit, 51 ... Encryption unit, 52 ... Decryption unit, 53 ... Key exchange unit, 54, 61 ... Interface, 62 ... User registration unit, 63 ... Communication partner information management unit 65, input / output control unit, 66 ... setting unit

Claims (17)

A file sharing server device used when storing information generated by a client device via a network,
When performing encryption information communication by adding an encryption function to the TCP or UDP protocol located in the transport layer in the client device,
Means for negotiating corresponding encryption and decryption logic with at least the client device;
A communication means for decoding and receiving a packet as an information unit from the client device according to the decoding logic negotiated by the agreement means;
Storage means for storing the decrypted packet as the information unit,
A file sharing server apparatus that performs communication based on the encryption and decryption logic using the transport layer TCP or UDP protocol with the client apparatus. A file sharing server device used when storing information generated by a client device via a network,
When performing encryption information communication by adding an encryption function to the TCP or UDP protocol located in the transport layer in the client device,
Means for negotiating corresponding encryption and decryption logic with at least the client device;
Communication means for receiving the file data portion as a ciphertext without decryption according to the decryption logic negotiated by the agreement means in the packet as an information unit from the client device;
Storage means for storing the packet as the information unit that has not been decrypted in the form of ciphertext, and
A file sharing server apparatus that performs communication based on the encryption and decryption logic using the transport layer TCP or UDP protocol with the client apparatus. A file sharing server device used when storing information generated by a client device via a network,
When performing encryption information communication by adding an encryption function to the TCP or UDP protocol located in the transport layer in the client device,
Means for negotiating corresponding encryption and decryption logic with at least the client device;
Communication means for receiving the file data portion as a ciphertext without decryption according to the decryption logic negotiated by the agreement means in the packet as an information unit from the client device;
Storage means for storing the packet as the information unit that has not been decrypted in the form of ciphertext, and
When the application that has been authenticated by the agreement means uses the file data including the packet as the information unit that has not been decrypted, the application is decrypted and used according to the decryption logic decided by the agreement means. File sharing server device. A file sharing server device used when printing information generated by a client device via a network,
When performing encryption information communication by adding an encryption function to the TCP or UDP protocol located in the transport layer in the client device,
Means for negotiating corresponding encryption and decryption logic with at least the client device;
A communication means for decoding and receiving a packet as an information unit from the client device according to the decoding logic negotiated by the agreement means;
Printing means for printing the decrypted packet as the information unit,
A file sharing server apparatus that performs communication based on the encryption and decryption logic using the transport layer TCP or UDP protocol with the client apparatus. The encryption and decryption logic that can be an agreement candidate by the encryption and decryption logic agreement means is stored in a memory or a circuit,
The file sharing server apparatus according to any one of claims 1 to 4, further comprising: a logic changing unit that periodically changes encryption and decryption logic that can be stored or implemented arrangement candidates. 6. The encryption / decryption logic decision means can decide to handle plaintext without encryption in relation to the encryption / decryption logic. The file sharing server device described. A client device that downloads information stored in a file sharing server device via a network,
In the case where communication of digitized information is performed by adding an encryption function to the TCP or UDP protocol located in the transport layer in the file sharing server device,
Arranging means for negotiating corresponding encryption and decryption logic with at least the file sharing server device;
Communication means for decoding and receiving a packet as an information unit from the file sharing server device according to the decoding logic negotiated by the agreement means;
Storing means for storing the decrypted packet as the information unit,
A client device that performs communication based on the encryption and decryption logic using the transport layer TCP or UDP protocol with the file sharing server device. A client device that downloads information stored in a file sharing server device via a network,
In the case where communication of digitized information is performed by adding an encryption function to the TCP or UDP protocol located in the transport layer in the file sharing server device,
Arranging means for negotiating corresponding encryption and decryption logic with at least the file sharing server device;
Communication means for receiving the file data part as it is without decryption according to the decryption logic negotiated by the agreement means, out of the packet as an information unit from the file sharing server device,
Storage means for storing the packet as the information unit that has not been decrypted in the form of ciphertext, and
A client device that performs communication based on the encryption and decryption logic using the transport layer TCP or UDP protocol with the file sharing server device. A client device that downloads information stored in a file sharing server device via a network,
In the case where communication of digitized information is performed by adding an encryption function to the TCP or UDP protocol located in the transport layer in the file sharing server device,
Arranging means for negotiating corresponding encryption and decryption logic with at least the file sharing server device;
Communication means for receiving the file data part as it is without decryption according to the decryption logic negotiated by the agreement means, out of the packet as an information unit from the file sharing server device,
Storage means for storing the packet as the information unit that has not been decrypted in the form of ciphertext, and
When the application that has been authenticated by the agreement means uses the file data including the packet as the information unit that has not been decrypted, the application is decrypted and used according to the decryption logic decided by the agreement means. Client device. The encryption and decryption logic that can be an agreement candidate by the encryption and decryption logic agreement means is stored in a memory or a circuit,
10. The client device according to claim 7, further comprising logic changing means for periodically changing encryption and decryption logic that can be stored or implemented arrangement candidates. 11. The encryption / decryption logic agreement means according to claim 7, wherein the encryption / decryption logic agreement means can decide to handle plaintext without encryption in relation to the encryption / decryption logic. The client device described. A printing device used when printing information generated by a client device via a network,
When performing encryption information communication by adding an encryption function to the TCP or UDP protocol located in the transport layer in the client device,
Means for negotiating corresponding encryption and decryption logic with at least the client device;
A communication means for decoding and receiving a packet as an information unit from the client device according to the decoding logic negotiated by the agreement means;
Storage means for storing the decrypted packet as the information unit;
Printing means for printing the decrypted packet as the information unit,
A printing apparatus that performs communication based on the encryption and decryption logic using the transport layer TCP or UDP protocol with the client apparatus. A printing device used when printing information generated by a client device via a network,
When performing encryption information communication by adding an encryption function to the TCP or UDP protocol located in the transport layer in the client device,
Means for negotiating corresponding encryption and decryption logic with at least the client device;
Communication means for receiving the file data portion as a ciphertext without decryption according to the decryption logic negotiated by the agreement means in the packet as an information unit from the client device;
Storage means for storing the packet as the information unit that has not been decrypted in the form of ciphertext;
Printing means for decoding and printing using an application authenticated by the agreement means when printing file data including a packet as the information unit that has not been decrypted, and
A printing apparatus that performs communication based on the encryption and decryption logic using the transport layer TCP or UDP protocol with the client apparatus. The encryption and decryption logic that can be an agreement candidate by the encryption and decryption logic agreement means is stored in a memory or a circuit,
14. The printing apparatus according to claim 12, further comprising logic changing means for periodically changing encryption and decryption logic that can be stored or implemented arrangement candidates. 15. The means for negotiating encryption and decryption logic can negotiate that plain text is handled without encryption in relation to the encryption and decryption logic. The printing apparatus as described. A file sharing system that performs file sharing and shared printing between a client device and a file sharing server device via a network,
In the client device and the server device,
In addition to the existing file sharing application part, a TCP2 driver having a TCP2 core and a file sharing system core, and a file sharing system management application part are provided,
The TCP2 core of the TCP2 driver confirms a file sharing command and a file sharing response code packet transmitted from the client device or the server device, and transmits the packet to the file sharing system core.
The file sharing system core is:
Key exchange between the client device and the server device, and encryption of a file sharing command and a file sharing response code sent from the client device or the server device based on various setting information stored in a storage medium Or, performing decryption, performing file transfer by ciphertext between the client device and the server device,
The file sharing system management application unit
Information about whether to decrypt or not to decrypt the encrypted file data sent to the file sharing system core, and whether to decrypt or not set by the setting unit Is stored in the storage medium of the file sharing system core as setting information,
A file sharing system characterized in that ciphertext file data received and stored by the file sharing application unit is displayed in plaintext. A program used in a file sharing system that performs file sharing and shared printing between a client device that implements a TCP2 driver and a file sharing server device that implements a TCP2 driver,
A computer program for causing a computer of the client device and the file sharing server device to execute the following procedure.
(A) a procedure for setting the decryption or decryption of the received file data;
(B) A procedure for creating a key element value held by the client device or the file sharing server device itself based on the setting information;
(C) A new key is generated in both the client device and the file sharing server device from the key source value added to the received file sharing command message or file sharing response message and the key source value held by the device itself. And replacement procedure,
(D) a procedure for sending a file sharing response code and file data in encrypted form from the file sharing server device to the client device;
(E) A procedure for sending a file sharing command and file data in encrypted form from the client device to the file sharing server device.

Images