JP2008123070A - Thin client system, and display program for client terminal in thin client system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enable a server manager to control the use range of user data since user data can be used only within use restriction decided by the server manager even by a regular user. <P>SOLUTION: This data carry-out thin client system includes a server 300; a client terminal 200 connected through a network 400 to the server; and a security card 100 connected to the client terminal. A display application 123 acquires use restriction information 112 set with the use restriction of user data 313 by a server manager from the server, and selects user data to be downloaded from this, and stores the initialization of the use restriction information and use management information 113 in a security card, and downloads the selected user data from a server to the security card. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a thin client system and a client terminal display program in the thin client system.

A thin client system is a system that operates by connecting to a server from a terminal, and a network is indispensable.
Therefore, a general thin client system includes a server and a client terminal connected to a network. User data and applications exist only on the server, and the client terminal is provided with a minimum function. Yes. In other words, the application is executed on the server, the execution result is encrypted, and exchanged with the client terminal via the network. The client terminal only performs mouse input, key input, and screen output.
Therefore, since the client terminal does not have any extra functions, the user data is controlled by the server, and the safety of the user data is ensured as follows.

First, the client terminal performs authentication when connecting to the server, and only the regular user is allowed to access user data on the server.
Second, user data output is limited to the server, and is not output to an external medium such as a USB memory or a CD-R connected to the client terminal, so that even a regular user cannot take out user data other than the client terminal.

Further, in order to improve the convenience for the user, a thin client system is provided by distributing a security card containing an OS program, a terminal control program and authentication information to the user, and connecting the security card to an unspecified client terminal. Patent Document 1 discloses a system that can provide the above.
JP 2005-235159 A

However, in the thin client system, when user data is stored in an external medium and then taken out for reference, the user data is stored in the external medium from the server. If it was a regular user, there was a problem that it could be used without limitation.
Moreover, since the user data taken out can be used even if it is stored in another medium, information leakage is likely to occur.
Furthermore, since there is no means for the server administrator to know the usage result of the user data that has been taken out, the server administrator cannot confirm whether or not the user data is being used illegally.
Therefore, the present invention provides a technique that allows a server administrator to control the range of use of user data because user data can be used only within the usage restrictions set by the server administrator even for authorized users. For the purpose.

  In order to solve the above problems, the present invention provides a thin client system comprising a server, a client terminal connected to the server via a network, and a security card connected to the client terminal, wherein the server The storage device has user data that can be browsed by the user at the client terminal, and a browsing restriction list master that stores management information of downloading restrictions of the user data and browsing restrictions of downloaded user data, and the security The card causes the client terminal to execute control of user data downloaded from the server, management information downloaded from the server, download of the user data from the server, and browsing based on the management information. Display app, including The display application is read by the client terminal, and when there is a user data download request through an input device of the client terminal, the management information of the server is stored. A procedure for downloading the user data from the server based on the security card and storing the user data in the security card, and when the client terminal is not connected to the network, the user data browsing request via the input device of the client terminal And causing the client terminal to execute a procedure of reading user data from the storage area based on management information stored in the storage area of the security card and displaying the user data on the display device of the client terminal. Features.

  According to the present invention, even if the user is a regular user, user data can be used only within the usage restrictions set by the server administrator, so the server administrator can control the usage range of the user data.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

(System configuration 1)
FIG. 1 is a block diagram showing a configuration of a thin client system 1 when downloading user data according to the present embodiment.
As shown in FIG. 1, in the thin client system 1 according to the present embodiment, a client terminal 200 and a server 300 are connected via a network 400, and user data 313 on the server 300 is connected to the client terminal 200. Download to. The client terminal 200 and the security card 100 can be connected by a connection circuit 130 mounted on the security card 100 and the client terminal 200.

The server 300 includes a storage device 310. The storage device 310 includes authentication information 311 used for user authentication, download restrictions on user data 313 that can be downloaded from the server 300 on the client terminal 200, and browsing of downloaded user data 124. A browsing restriction list master 312 in which restriction management information is stored, user data 313 that can be browsed by the user on the client terminal 200, and user data download history 314 are stored.
The authentication information 311 stores a combination of the terminal ID 215 of the client terminal 200, the card ID 117 of the security card 100, and the user ID of the user that can be connected to the server 300.

  The client terminal 200 identifies a CPU 211, a volatile memory 212, an input device 213 such as a keyboard, a mouse, and a touch panel, a display device 214 such as a CRT (Cathode Ray Tube) and an LCD (Liquid Crystal Display), and the terminal. And a storage device 216 that stores a terminal ID 215 for the purpose.

The security card 100 includes an IC chip 110 having tamper resistance and a non-volatile external storage area 120.
The IC chip 110 stores a list of authentication information 111 and a list of browsing (display) restrictions (terminal ID, browsing upper limit, browsing deadline) when browsing user data having a user data name that can be browsed for each user ID. Restriction list 112, browsing management information 113 for storing the number of times of browsing the user data for each user ID, user data name, and terminal ID 215, browsing history 114 for storing the browsing log, and encrypted user A decryption key 115 for decrypting the data 124, a viewer application loader 116, and a card ID 117 for identifying a security card are stored.
By storing these pieces of information in the IC chip 110 having tamper resistance, it is possible to prevent tampering and leakage of each information such as modification and analysis.
The external storage area 120 is downloaded from the OS 300, a terminal control program 122 for communicating with the server 300, a viewer application 123 for controlling user data download, browsing, and browsing management, and is encrypted by being downloaded from the server 300. User data 124 is stored. Note that the Viewer application 123 is encrypted. By encrypting the Viewer application 123 and user data 124, data theft and information leakage can be prevented.

The authentication information 111 stores combinations of user IDs, passwords, a card ID 117 of the security card 100, and a terminal ID 215 of the client terminal 200 that can log in to the client terminal 200. .
The browsing management information 113 stores the number of times of browsing corresponding to a combination of a user data name, a user ID, and a terminal ID.
The decryption key 115 is stored in the tamper-resistant IC chip 110 and is not disclosed to the user, thereby preventing the decryption key 115 from being stolen and leaked.

The viewer application loader 116 causes the CPU 211 to decrypt the encrypted viewer application 123, load it into the memory 212, and execute the viewer application 123.
The Viewer application 123 browses the user data name selected by the user and the viewing restrictions among the user data names and the viewing restrictions stored in the server 300 that can be downloaded from the client terminal 200 by the user who has logged into the client terminal 200. The data is stored in the restriction list 112, the number of times of browsing is initialized and stored in the browsing management information 113, and user data of the user data name selected by the user is downloaded from the server 300 to the security card 100. Here, the Viewer application 123 causes the CPU 211 to execute these operations.
The detailed movement of the Viewer application 123 will be described later.
Here, the decryption key of the Viewer application 123 may be built in the Viewer application loader 116 or may be held outside the Viewer application loader 116 as long as it is within the IC chip.

  In this embodiment, the viewer application 123 and the user data 124 are encrypted and stored in the external storage area 120. This is generally an IC having tamper resistance compared to the external storage area 120 such as a flash memory. This is because the storage capacity of the chip 110 is very small. When the storage capacity of the IC chip 110 is sufficiently large, the viewer application 123 and the user data 124 may be stored in the IC chip 110 without being encrypted.

(Browsing restriction list master)
FIG. 2 is a table configuration diagram showing an example of a browse restriction list master stored in the server. The viewing restriction list master 312 stores management information of user data download restrictions and viewing restrictions.
The browsing restriction list master 312 stores the user data name 31, the user ID 32 of the user of the client terminal 200, the card ID 33 of the security card 100, the terminal ID 34 of the client terminal 200, the browsing count upper limit 35, and the browsing deadline 36. Yes. In addition, the browsing time limit 36 is memorize | stored by the date for a year, month, day, for example.

(System configuration 2)
FIG. 3 is a block diagram showing a configuration of the thin client system 1 when browsing (displaying) downloaded user data according to the present embodiment.

  The difference from FIG. 1 is that the client terminal 200 is not connected to the network 400. That is, this configuration shows a system configuration when the client terminal 200 browses (displays) the user data 124 downloaded to the connected security card 100 on the display device 214. For this reason, the same components as those of the thin client system 1 shown in FIG.

Further, the Viewer application 123 read by the client terminal 200 acquires the browsing count of the user data 124 and the browsing limit data (the browsing count upper limit, the browsing deadline) from the browsing restriction list 112 and the browsing management information 113, and Based on the number of browsing times and the browsing restriction data, it is determined whether or not the user data 124 is restricted. If not, the user data 124 selected by the user for browsing from the user data 124 is selected. The browsing management information 113 is updated by adding 1 to the browsing count, and the user data 124 is displayed on the display device 214. Here, the Viewer application 123 causes the CPU 211 to execute these operations.
The detailed movement of the Viewer application 123 will be described later.

(Download process)
FIG. 4 is a sequence diagram showing a procedure for downloading user data from the server 300 to the IC card 100 according to the present embodiment. The procedure for downloading user data from the server 300 to the security card 100 will be described with reference to FIGS. Here, in the client terminal 200, the OS program 121 is loaded from the external storage area 120, and the terminal control program 122 is further activated, and a login screen (not shown) is displayed. When the user inputs the user ID and password from the login screen, the terminal control program 122 performs user authentication and assumes that the authentication is successful. At this time, the user authentication is stored in the authentication information 111 based on the input user ID, password, card ID 117 stored in the IC chip, and terminal ID 215 stored in the client terminal 200. The user ID, the password, the card ID, and the terminal ID that can log in to the existing client terminal 200 are determined based on whether all the items match.

  First, in the client terminal 200, the Viewer application loader 116 is read from the security card 100 into the memory 212 and activated in accordance with a user instruction (step S4001).

The viewer application loader 116 reads the encrypted viewer application 123 stored in the external storage area 120 from the security card 100 into the memory 212, decrypts the viewer application 123, and causes the CPU 211 to execute the decrypted viewer application 123 (step S4002). ).
Since the Viewer application 123 is encrypted until it is executed and is decrypted when it is executed, the Viewer application 123 can be prevented from being falsified.

  The following process is performed by the Viewer application 123. The terminal control program 122 performs communication between the client terminal 200 and the server 300. Here, the operations of the viewer application 123 and the terminal control program 122 are executed by the CPU 211.

  The Viewer application 123 checks whether or not the client terminal 200 is connected to the server 300 (step S4003). If it is not connected to the server 300, the process proceeds to step S5001 shown in FIG. 5, and if it is connected to the server 300, the following processing is performed.

  The Viewer application 123 sends a request for sending a restriction request list including the user ID acquired when the user logs in to the client terminal 200 and the card ID 117 stored in the IC chip 110 to the server 300. (Step S4004).

The server 300 from the browsing restriction list master 312, the user data name 31 that can be browsed in the line where the user ID included in the received browsing restriction list sending request notification and the card ID 117 match, and the browsing restriction. A certain terminal ID 34, the upper limit of the number of browsing times 35, and the browsing time limit 36 are acquired, a browsing-restricted browsing list is created, and transmitted to the client terminal 200 (step S4005). The browsing restriction list that can be browsed is a list of browsing restrictions that the user can browse from the client terminal 200.
The Viewer application 123 of the client terminal 200 receives the browsing restriction list from the server 300 and displays the received browsing restriction list (display data) on the display device 214 (step S4006).

  The user acquires the user data name 31 to be downloaded and the browsing restriction selected via the input device 213 from the browseable browsing restriction list displayed (step S4007).

  Next, the Viewer application 123 updates the browsing restriction list 112 and the browsing management information 113 of the IC chip 110 in the security card 100 based on the user data name 31 and the browsing restriction (selection result) selected by the user ( In step S4008), the selection result is notified to the server 300 (step S4009). Here, in the browsing restriction list 112 to be updated, the selection result, that is, the user data name, the user ID, the terminal ID, the browsing frequency upper limit, and the browsing deadline are stored. In the browsing management information 113 to be updated, the number of browsing times corresponding to the selected user data name, user ID, and terminal ID is stored as zero.

Here, the Viewer application 123 can rewrite the browsing restriction list 112 when the client terminal 200 is connected to the server 300, but rewrites the browsing restriction list 112 when the client terminal 200 is not connected to the server 300. I can't.
As a result, unauthorized persons cannot maliciously rewrite user data browsing restrictions, and cannot be used beyond the browsing restrictions restricted by the server administrator, preventing falsification and leakage of information. can do. Further, since information is stored in the IC chip 110 having tamper resistance, the stored information can be prevented from being falsified and leaked.

The server 300 adds the selection result and the download date and time as a log to the download history 314 of the server 300 (step S4010).
Thereby, since the log is left in the server 300 when the user data is downloaded, there is an effect that the server administrator can confirm who took the user data and when.

  The Viewer application 123 downloads user data having a user data name included in the selection result from the server 300 to the memory 212 (step S4011). At this time, when a different user downloads the same user data as the user data once downloaded, the user data is not downloaded from the server 300. That is, the viewer application 123 updates the browsing restriction list 112 and the browsing management information 113 (step S4008), but searches the browsing management information 113 for the number of user data names to be downloaded, and there are two or more cases. Does not download the user data having the user data name from the server 300.

  The Viewer application 123 encrypts the downloaded user data on the memory 212 with the encryption key, stores it in the external storage area as the user data 124, and stores the decryption key 115 in the IC chip (step S4012). Thereafter, the user data on the memory 212 is erased.

Here, the encryption key for user data is unique to the security card 100 by adding a random number, a card ID 117 or the like to the encryption key. As a result, even if the user data 124 is copied to another security card 100, it cannot be decrypted.
In addition, for example, the decryption key and the encryption key can be used by the already disclosed common key method or public key method.

  By downloading the user data 313 on the server 300 according to the present embodiment to the security card 100 connected to the client terminal 200, the user can display the user data 124 even in an environment where the user cannot connect to the network 400. Become. Moreover, even if it is a regular user, user data can be downloaded only within the limits set by the administrator, and further, since it cannot be displayed, it is possible to improve safety such as leakage of user data.

(Display processing)
FIG. 5 is a sequence diagram showing a procedure when displaying downloaded user data in the present embodiment.
In FIG. 4, the Viewer application 123 checks whether or not the client terminal 200 is connected to the server 300 (step S4003). If the client application 200 is not connected to the server 300, the process proceeds to step S5001 shown in FIG.

  The following processing is performed by the Viewer application 123. Here, the operation of the Viewer application 123 is executed by the CPU 211.

The Viewer application 123 acquires the browsing restriction list 112 and the browsing management information 113 from the security card 100, and displays the names of user data permitted to be browsed on the display device 214 (step S5001).
Here, whether or not browsing of user data is permitted is confirmed by the following procedure.
First, based on the user ID and the terminal ID 215, the user data name and the number of browsing times are acquired from the browsing management information 113.
Next, based on the acquired user data name, user ID, and terminal ID 215, the upper limit of browsing times and the browsing time limit are acquired from the browsing restriction list 112.
The browsing count acquired from the browsing management information 113 is compared with the browsing count upper limit acquired from the browsing restriction list 112. When the browsing count is less than the browsing count upper limit, In the present or future case, the acquired user data name is user data that is permitted to be browsed. On the other hand, if any one of the conditions is not satisfied, the user data is not permitted to be browsed.

  The viewer application 123 acquires the user data name to be browsed selected from the list of user data names displayed on the display device 214 by the user and the selection result via the input device 213 (step S5002).

The Viewer application 123 updates the browsing management information 113 (step S5003). In other words, 1 is added to the number of browsing times of the browsing management information 113 in which the user data name selected by the user, the user ID, and the terminal ID match, and updated.
Also, the Viewer application 123 adds a log to the browsing history 114 (step S5004). The log includes the browsing date, user data name, user ID, and terminal ID.

  Next, the Viewer application 123 acquires the user data 124 selected by the user and the decryption key 115 for decrypting the user data 124 from the security card 100 to the memory 212 (step S5005), and decrypts the user data 124. The decryption key 115 decrypts the data and displays it on the display device 214 (step S5006). Thereby, the user data 124 stored in the security card 100 can be displayed.

Here, if the user data 124 in the external storage area 120 is copied to another security card 100, the decryption key 115 is unique to the IC chip, so the user data 124 does not match the decryption key 115. As a result, the user data 124 cannot be normally displayed.
Thereby, the Viewer application 123 cannot display the user data 124 normally, and there is an effect that information leakage hardly occurs.

In addition to displaying the user data 124, the viewer application 123 may allow the user to edit the user data 124 and overwrite the same user data 124 area in the external storage area 120. At this time, the Viewer application 123 has an editing function and a saving function in addition to the browsing function, and in the case of the saving function, saving to a storage medium other than the security card 100 in which the user data 124 to be edited exists, and saving to the network Make upload impossible.
This has the effect that information leakage can be prevented.

  By the display procedure of the downloaded user data 124 in the present embodiment, browsing can be restricted under the management of the server administrator, and unauthorized use of user data can be prevented.

It is a block diagram which shows the structure of a thin client system when downloading the user data which concerns on this Embodiment. It is a block diagram which shows the structure of a thin client system when displaying the downloaded user data based on this Embodiment. It is a table block diagram which shows an example of the browsing restriction list master memorize | stored in the server. It is a sequence diagram which shows the procedure at the time of downloading user data. It is a sequence diagram which shows the procedure when displaying the downloaded user data.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Thin client system 100 Security card 110 IC chip 112 View restriction list 113 View management information 120 External storage area 123 Viewer application 124 User data 200 Client terminal 400 Network 300 Server 312 View restriction list master 313 User data 314 Download history

Claims (7)

A thin client system comprising: a server; a client terminal connected to the server via a network; and a security card connected to the client terminal,
The server
The storage device has user data that can be browsed by the user at the client terminal, and a browsing restriction list master that stores management information for downloading restrictions of the user data and browsing restrictions of downloaded user data,
The security card is
User data downloaded from the server;
Management information downloaded from the server;
A display application for causing the client terminal to execute control of downloading the user data from the server and browsing based on the management information;
Including a storage area for storing,
The display application is read by the client terminal,
When there is a download request for the user data by a user operation via the input device of the client terminal, the user data is downloaded from the server based on the management information of the server and stored in the security card;
When the client terminal is not connected to the network and there is a request for browsing the user data via the input device of the client terminal, the client terminal is based on the management information stored in the storage area of the security card. A thin client system that causes the client terminal to execute a procedure of reading user data from a storage area and displaying the user data on a display device of the client terminal. The thin client system according to claim 1,
The storage area of the security card connected to the client terminal is
A non-volatile external storage area and a tamper-resistant IC chip,
The IC chip is
A thin client system, comprising: management information for viewing restriction, and a decryption key for decrypting encrypted user data for which the viewing application has been requested. The thin client system according to claim 1 or 2,
The display application is
When there is a download request for the user data on the client terminal, the server is notified of the user data browsing restriction,
The server
A thin client system, wherein the browsing restriction of the notified user data is stored in a download history stored in the storage device. The thin client system according to claim 2,
The external storage area stores an encrypted display application,
The IC chip is
The client terminal further has a display application loader for decrypting and executing the encrypted display application,
The display application is
A thin client system which is decrypted and executed by the display application loader. A server having a storage unit that stores user data that can be browsed by the user, and management information for downloading restrictions on the user data and viewing restrictions on the downloaded user data;
A client terminal connected to the server via a network;
A storage area for storing user data and management information downloaded from the server, and a security card connected to the client terminal;
Used for thin client systems comprising
A program for a thin client terminal that functions by being read from the security card to the client terminal,
The program is
When there is a download request for the user data by a user operation via the input device of the client terminal, the user data is downloaded from the server based on the management information of the server and stored in the security card;
When the client terminal is not connected to the network and there is a request for browsing the user data through the input device of the client terminal, based on the management information stored in the storage area of the security card A procedure for reading user data from the storage area and displaying it on the display device of the client terminal,
Is executed by the client terminal. A display program for a client terminal. A display program for a client terminal in the thin client system according to claim 5,
The display application is
A display program for a client terminal that determines whether or not the client terminal and the server are unconnected, and when not connected, does not rewrite the browsing restriction list stored in the security card. A display program for a client terminal in the thin client system according to claim 5,
The display program for a client terminal, wherein the display application does not output the user data to a storage medium other than a security card or a network.

Images