JP2009027642A - Encrypted content management device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an encrypted content management device capable of changing the protective strength according to the degree of secrecy of an electronic content. <P>SOLUTION: When the degree of secrecy of the electronic content A is changed, the protective strength encrypted by using an original key length (X-bit) allocated to the encrypted electronic content A is calculated using the amount of calculation C<SB>0</SB>required for decrypting an encryption system using the key length. The amount of calculation C<SB>N</SB>modified according to the change of the degree of secrecy is calculated on the basis of the amount of calculation C<SB>0</SB>. The new protective strength (Y-bit) according to the changed degree of secrecy is calculated. Thus, the electronic content A is reencrypted. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an encrypted content management technique for encrypting and managing electronic content including confidential information.

  Public key encryption uses a separate key (procedure) for content encryption and decryption to enhance the confidentiality of the encryption. Since this key length corresponds to content encryption and decryption, the longer the key length of the encryption key, the larger the amount of calculation of encryption / decryption. Therefore, the key length is used for content with high protection strength. However, since the calculation time increases in proportion to the calculation amount, the key length corresponding to the contents is required.

  The key length of the encryption key used for conventional content protection is set in advance. For example, in the International version of Microsoft Internet Explorer 4.x, three types of fixed RAS ciphers of 512, 768, and 1024 bits are used as public key ciphers. That is, the user mechanically uses a predetermined length key for encryption.

  Patent Document 1 discloses a certificate transmission device that newly generates an encryption key when content is transferred. On the other hand, Patent Document 2 discloses a technique for newly updating a public key on the user side when updating a public key certificate.

JP2006-40299 JP 2006-607779 A

  Electronic content with high confidentiality needs to be protected with a corresponding protection strength, but the confidentiality may change depending on the passage of time and other factors. In the conventional method, a preset key length is used according to the confidentiality, and even if the confidentiality is changed, the encryption strength applied to the electronic content is changed according to the new confidentiality. I couldn't. For this reason, it cannot be said that protection according to the confidentiality of the content is always performed. For example, even if the electronic content has a considerably reduced confidentiality, the encryption key is long and the processing is more than necessary for decrypting the electronic content. It sometimes took time.

  The present invention solves the above-described conventional problems. When the confidentiality of the electronic content to be encrypted is changed, the encrypted content can protect the content according to the changed confidentiality. It is an object to provide a management apparatus, an encrypted content management method, an encrypted content management program, and an encrypted content management system.

  An encrypted content management apparatus according to the present invention manages electronic content by encrypting it, and includes an encryption setting means for encrypting the electronic content based on a protection strength corresponding to a predetermined confidentiality, When the sensitivity of the converted electronic content is changed, a first calculation means for calculating a calculation amount necessary for decrypting the encrypted electronic content, and a new one corresponding to the changed sensitivity Second calculation means for calculating a strong protection strength based on the calculation amount, and a re-encryption means for re-encrypting the electronic content based on the new protection strength.

  Preferably, the protection strength is the length of the encryption key, the confidentiality is a protection period of the electronic content, and the change of the confidentiality in this case is a difference between the protection periods.

  The encrypted content management apparatus further includes a storage unit that stores the encrypted electronic content, and an input unit that inputs a change in confidentiality of the encrypted electronic content, and the first calculation unit includes the first calculation unit, When the confidentiality change is input from the input unit, the calculation amount of the encrypted electronic content stored in the storage unit may be calculated.

  The confidentiality further includes electronic content value, electronic content distribution route information, electronic content using device information, user profile information, or a combination thereof, and the protection strength is determined based on the confidentiality. It may be.

  An encrypted content management system according to the present invention includes the above-described encrypted content management device and a user terminal that transmits and receives information to and from the encrypted content management device. The user terminal stores encrypted electronic content. Requesting means for requesting and receiving means for receiving the encrypted electronic content, and the encrypted content management apparatus, when requested by the requesting means, determines the sensitivity of the encrypted content from the input means. Enter changes.

  Preferably, the encrypted content management device includes sending means for sending difference information between the unique information of the user terminal and the encryption key of the encrypted electronic content, and the user terminal receives the sent difference information. Means and decryption means for decrypting the encrypted electronic content based on the received difference information.

  Preferably, the user terminal further includes a user credential means for certifying the user credential and a display means for displaying the decrypted electronic content, and the encrypted content management apparatus is certified by the user credential means. User authentication means for authenticating the user is included. The user terminal may be, for example, a personal computer or a portable terminal that can transmit and receive data.

  An encrypted content management program according to the present invention is for managing electronic content by encrypting the electronic content, encryption setting means for encrypting the electronic content based on a protection strength corresponding to a predetermined confidentiality, and encryption A first calculation means for calculating a calculation amount necessary for decrypting the encrypted electronic content when the sensitivity of the electronic content is changed, and a new one corresponding to the changed sensitivity A second calculating unit that calculates a protection strength based on the calculation amount; and a re-encrypting unit that re-encrypts the electronic content based on the new protection strength.

  An encrypted content management method for encrypting and managing electronic content according to the present invention includes a step of encrypting electronic content based on a protection strength corresponding to a predetermined sensitivity, and a step of encrypting the electronic content. When the confidentiality is changed, a calculation amount necessary for decrypting the encrypted electronic content is calculated, and a new protection strength corresponding to the changed confidentiality is calculated based on the calculated amount. And re-encrypting the electronic content based on the new protection strength.

  According to the present invention, when the confidentiality is changed, a new protection strength is calculated from the amount of calculation required for decrypting the encrypted electronic content, and the re-encryption is performed. The protective strength can be changed according to the sensitivity. As a result, it is possible to manage the electronic content encrypted with the protection strength according to the confidentiality and to decrypt the encrypted electronic content with the processing time corresponding to the confidentiality. An objective and reliable method of changing the protection strength (key length) based on the time evaluation can be provided.

  FIG. 1 is an operation flow for explaining an outline of the encrypted content management apparatus according to the present embodiment. First, the electronic content A including confidential information is created (step S11). The electronic content A is not limited in its format or the like, and can include documents, tables, figures, and the like. For the created electronic content A, the protection strength is set according to the sensitivity (step S12). The confidentiality is set by the protection period of the electronic content, the value of the electronic content, the route information of the electronic content distribution, the device usage information of the electronic content, the user profile information, or a combination thereof.

  Next, the protection strength (encryption key length) corresponding to the confidentiality is determined (step S13). If the confidentiality is high, the protection strength is high and the length of the encryption key is long. Conversely, if the confidentiality is low, the protection strength is low and the length of the encryption key is short. Here, it is assumed that the encryption key length is determined to be X bits. Next, the electronic content A to be encrypted with X bits is encrypted (step S14) and stored in a storage device or the like.

  When the encrypted electronic content stored in the storage device is provided to the user, it is determined whether or not the sensitivity of the electronic content has changed (step S15). For example, when the confidentiality is an electronic content protection period, the confidentiality is changed according to the remaining period of the protection period. In addition to this, changes in confidentiality occur due to additions / deletions of important confidential information, changes in security policies of companies that manage electronic contents, and the like. The determination may be performed automatically or by user input. Further, the user may instruct a change in confidentiality.

When there is a change in confidentiality, the protection strength is corrected by the following method, and the electronic content A is re-encrypted. First, a calculation amount C ₀ necessary for decrypting the electronic content A encrypted with the protection strength X bits is calculated (step S16). As the change of the calculated amount C ₀ and confidentiality required decryption (e.g. extension, shortening the protection period), to calculate the amount of C _N calculated is corrected (step S17). The modified amount of calculation C _N, changes secrecy level is reflected. For example, protection period confidentiality is lowered becomes more corrected calculation amount C _N is reduced shorter, also decreases protect strength accordingly.

Next, a new protective intensity from the modified computational C _N, i.e. key length Y bits is calculated (step S18), and electronic content A is re-encrypted by the encryption key of Y bits (step S19). In this way, when the confidentiality is changed, the protection strength of the electronic content can be changed as appropriate. Thereby, the user can process the electronic content in a processing time corresponding to the confidentiality.

  FIG. 2 is a diagram showing a comparative example of (a) the encryption processing of electronic content according to the prior art and (b) the encryption processing according to the present embodiment. As shown in FIG. 2A, the electronic content 20 is encrypted with an encryption key of 768 bits, and the protection strength is appropriate for the electronic content. However, when highly secure information is added to the content of the electronic content 20 and the electronic content 22 has a high security level, the encryption key 768 bits has a low protection strength and cannot be said to be sufficient. On the other hand, when highly secure information is deleted and the electronic content 24 has a low confidentiality, the protection level is too high with the encryption key as it is, and more processing time is required.

  On the other hand, as described above, in the present embodiment, when the electronic content 20 becomes the highly sensitive electronic content 22, for example, the electronic content 22 is re-encrypted with a length of the encryption key of 1024 bits. When the electronic content 24 has a low confidentiality, the electronic content 24 is re-encrypted with a length of, for example, an encryption key 512 bits. This ensures that the electronic content is always encrypted at an appropriate protection level.

  Next, a preferred embodiment to which the present invention is applied will be described. FIG. 3 is a diagram illustrating a configuration example of the drawing information information management system, and schematically illustrates a relationship between a server and a user involved in distribution and browsing of electronic content in which drawing information is described. The drawing information management system includes a company A that manages drawing information, a user B that uses the drawing information, and a portable information terminal D that receives the drawing information. The company A includes a drawing information management server E and a security server F. Yes.

  Next, an example of encryption in the drawing information management system will be described in detail. User B who is an employee in charge of product maintenance of company A downloads confidential file C containing drawing information to portable information terminal D used by user B, and performs browsing operations on this confidential file for product maintenance. Assume that

  The drawing information is stored in the storage device 58 of the drawing information management server E, and the drawing information includes confidential information related to a product under development by the company A or a product sold after the development. If it leaks, it will be a leak of important technology of Company A. Therefore, not only is there any restriction on the information that can be downloaded to the employee's personal digital assistant D in case of theft or loss, but the protection specification period of at least 30 years is set for the confidential file containing the drawing information. The Depending on the sensitivity, for example, a 2048-bit public key is used for encryption.

  As mentioned above, there are strict restrictions on drawing information, but due to technological progress, information that has been reduced in confidentiality can be changed to a shorter protection strength and downloaded to the employee's personal digital assistant. Is allowed.

  The drawing information management server E has a function of authenticating the user B accessing the drawing information management server E and restricting the use range of confidential information based on the qualifications the user has. The drawing information management server E acquires user qualification information and security guideline information necessary for specifying a user's usable range from the security server F using a communication network such as a LAN.

  The mobile information terminal D used by the user B has a user authentication function, a decryption function for converting the encrypted file into plain text, and a software tamper resistance function for preventing the plain text and the encryption key from being leaked. It is installed. The software anti-damper function is described in, for example, “Software tamper-proof technology”, June 2003 issue of Information Processing. Furthermore, the portable information terminal D is equipped with a viewer whose security is ensured by the software tamper resistance function, and the user B can perform browsing and searching operations of the encrypted file using these viewers. .

  Further, the drawing information management system uses an electronic ticket method. The electronic ticket method used here registers the device-specific information of the portable information terminal D owned by the user with the security server F, and the server F uses the difference information between the device-specific information and the encryption key used for protecting confidential information. Can be issued to the user as an electronic ticket. Registration of device specific information is performed by a program protected by a tamper resistant function of the device, after creating a secure route such as VPN for communication with the server based on a user instruction, Without leaking device-specific information to the user.

  In addition, the device-specific information, the decrypted confidential file, and the common key used for encrypting the confidential file are always protected by the software tamper resistance function. Information from the device is blocked. In addition, the above electronic ticket method uses computational difficulty such as prime factorization or discrete logarithm problem, so that the user himself / herself and the third party can use the difference information for user device-specific information or confidential file protection. It is computationally difficult to calculate the encryption key information that is present, effectively preventing the confidential file and the accompanying confidential information from being leaked.

  FIG. 4 is a diagram illustrating a configuration example of the drawing information management server E. The drawing information management server E includes an input device 52 for inputting information by operation of a keyboard or the like, a display device 54 for displaying information such as characters and figures on a display, a ROM or a RAM, and authenticates a user or uses an encryption key. Including a main storage device 56 for storing a program for calculating the length, issuing an electronic ticket, encrypting drawing information with an encryption key, various data, and a large-capacity storage device such as a hard disk, A storage device 58 for storing electronic contents such as confidential drawings and documents to be encrypted, a central processing unit (CPU) 60 for controlling each unit in accordance with a program stored in the main storage device 56, and a bus connecting them 62 is included.

  FIG. 5 is a block diagram functionally showing the drawing information management system shown in FIG. The portable information terminal D is, for example, a user credential means 130 for certifying user qualification by a user password or login, etc., encrypted information received from the drawing information management server E such as an encrypted confidential file including encrypted content and an electronic ticket. It includes drawing information / electronic ticket receiving means 131, encrypted confidential file decrypting means 132 for decrypting the encrypted confidential file, and display means 133 for displaying the decrypted confidential file. Note that the user qualification means 130 may use an electronic certificate, smart card, IC card, or the like for proof of the user's content use qualification.

  The drawing information management server E receives a user certificate from the portable information terminal D, authenticates the user, authenticates the user 110, sends a user ID to the user ID receiving means 120 of the security server F, and sends user ID 111, user information And user security information receiving means 112 for receiving security guideline information from the user security information sending means 121 of the security server F, encryption key length calculating means 113 for calculating the length of the encryption key from the amount of calculation required for content decryption, Drawing information encrypting means 114 for encrypting drawing information using the calculated encryption key, electronic ticket creating means 115 for creating an electronic ticket, encrypted content, encrypted confidential file, electronic ticket, and other information such as a portable information terminal Encrypted drawing information sent to D Including the packet sending means 116.

  The security server F includes a user ID receiving unit 120 that receives a user ID from the drawing information management server E, and a user / security information sending unit 121 that sends user information and security guideline information to the customer information management server E. Note that the portable information terminal D, the drawing information management server E, and the security server F are connected by a network such as a LAN or wireless communication, and can transmit and receive data to and from each other.

  Next, the operation of the drawing information management system will be described with reference to the flowchart shown in FIG. First, when the user B tries to view the drawing information from the portable information terminal D, when the user B accesses the drawing information management server E, the user qualification means 130 of the portable information terminal D causes the user to contact the drawing information management server E. Send credentials. The drawing information management server E authenticates the user B by the user authentication unit 110 (step S201). When the user authentication is completed, the drawing information management server E accesses the security server F and sends the user ID to the security server F by the user ID sending means 111 (step S202). The security server F receives the user ID by the user ID receiving means 120, and in response to this, the sending means 121 for user information etc. manages the drawing for determining the value of the user qualification information and confidential information for the corresponding user. The security guideline information including the estimated record unit price is sent to the drawing management server E.

  The drawing information management server E receives user information and security guideline information via the user / security information receiving means 112 (step S203), and determines the range of usable drawing information for the user B based on the received information. (Step S204).

Next, in the drawing information management server E, the encryption key length calculation unit 113 creates an encryption key for the drawing information (confidential file) (step S205). Here, it is assumed that the drawing information has already been encrypted with the RAS encryption key length K ₀ in accordance with the initial sensitivity. The encryption key calculation means 113 calculates a decryption calculation amount C ₀ , which is a calculation amount necessary for decrypting the encrypted drawing information, from the following equation 1 from the key length K ₀ .

Next, the encryption key length calculation unit 113 calculates the correction calculation amount C _N from Equation 2 using the protection period correction information T _N and the decryption calculation amount C ₀ included in the security guideline information acquired from the security server F. . The protection period correction information _TN corresponds to a change in sensitivity with respect to the drawing information. Next, the encryption key length calculation unit 113 obtains the key length K _N corrected from the corrected calculation amount C _N from Equation 3. The modified calculation amount C _N is the calculation amount of the number field sieving method that is the best attack method for the cryptographic system that depends on the difficulty of prime factorization such as RAS.

  Next, the drawing information encryption unit 114 creates a 160-bit random number, for example, and encrypts the drawing information after using it as an encryption key of a common key encryption used to encrypt the drawing information (step S206). ). Further, this common key is encrypted using the public key of the RAS encryption, and this is attached to the encrypted confidential file. Next, the electronic ticket creating means 115 creates an electronic ticket based on the difference between the encryption key and the device ID of the portable information terminal (step S207), and the encrypted drawing information / electronic ticket sending means 116 encrypts the electronic ticket and the encrypted information. The encrypted confidential file with the shared key attached is sent to user B (step S208).

  Next, search and browsing of the encrypted confidential file by user B will be described with reference to the flowchart of FIG. The user B accesses the customer information management server E using the portable information terminal D (step S301), and the drawing information management server indicates that the user qualification means 130 has the qualification to use drawing information using an electronic certificate or the like. Prove to E. At the same time, the device ID for identifying the portable information terminal D that the user B intends to use the drawing information is sent to the drawing information management server E, and the drawing information management server E uses the user authentication means 110 to authenticate the user B. Is performed (step S302). Thereafter, the user B receives the encrypted search target information part, the encrypted confidential file, and the electronic ticket sent by the encrypted drawing information / electronic ticket sending means 116 of the drawing information management server E, and the receiving means 131 of the portable information terminal D. Is received (step 303).

  The user B searches and browses the encrypted confidential file using the viewer of the portable information terminal D protected by the tamper-proof function, so that the electronic ticket, encryption received by the encrypted drawing information / electronic ticket receiving means 131 is used. The encrypted confidential file and the encrypted search target information part are registered in the viewer (step S304).

  These processes performed by the portable information terminal D are performed while keeping all confidential information in the tamper-resistant area of the viewer. User B cannot know the common key or device-specific information, but once he obtains an electronic ticket, it cannot be accessed to the customer information management server E during the expiration date. In this case, it is possible to search and browse the information in the encrypted search target information section and the confidential file using a dedicated viewer installed in the portable information terminal D.

  When the user B makes a browsing request for drawing information (step S305), the viewer of the portable information terminal D displays the drawing information corresponding to the ID of the drawing by the confidential file display means 133. The viewer extracts the drawing record corresponding to the specified drawing ID in the drawing record file decoded using the electronic ticket registered for displaying the drawing information, and displays the drawing record extracted in the table format on the display unit. To do. User B can view the drawing record based on the information displayed on the viewer (step S306).

In the above method, it is assumed that the number of years subject to protection of drawing information that can be used by employee B is changed from T ₀ = 30 (years) to T _N = 5 (years), and server E is used with an encryption key of Ko = 2048 bits. Assume that the drawing information stored in is encrypted. At this time, if the length of the encryption key for encrypting the drawing information is calculated by the above method, K _N = 1429 bits.

  As described above, the appropriate strength is maintained by calculating a new protection strength according to the changed confidentiality from the protection strength realized using the original key length assigned to the encrypted content. It can be seen that the encryption key length can be reset. Furthermore, in the embodiment of the present invention, there is a secondary effect of speeding up the encryption process. Assuming that the decryption time of the RSA cipher is proportional to the cube of the key length, the decryption time of the RSA cipher is substantially about 1/3 times by the above method. According to this embodiment, an appropriate key can be reset and a large speed can be achieved. This makes it possible to realize a simple drawing information management system using a low-speed device such as a notebook PC or a mobile phone, which has been difficult in the past, with strong copyright protection and confidential information protection.

In the above embodiment, the RSA cipher is used particularly for the protection of confidential files. However, the same effect can be obtained by using other public key ciphers such as ElGamal cipher, elliptic curve cipher, and NTRU. . Further, the mathematical formula (4) can be used as a calculation formula for setting the modified key length K _N.

  In addition, a corrected version of Equation 4 can also be used. Ψ (x, y) is a positive integer equal to or less than x, and indicates the number of prime factors that do not exceed y. Methods for calculating Ψ (x, y) include, for example, [1] Math. Camp., 66, p. 1729-1742, 1997 [2] Math. Camp., 73, p. 1013-1022, 2004, and the like. .

  In the above embodiment, it is assumed that RAS encryption is used, but public key encryption such as ElGamal encryption, elliptic curve encryption, and NTRU may be used.

  Next, an encryption key setting method when changing the protection designation period of the confidential file describing the customer information to a long period by changing the security policy of the company A will be described. The basic configuration is the same as described above, customer information is also stored in the drawing information management server E in the form of a confidential file, and each confidential file is encrypted using an RAS encryption using an encryption key of at least 1024 bits. It has become.

For example, the confidential file F1 includes important privacy information of the customer, is encrypted by RAS encryption using an encryption key having a key length K ₀ = 1524 bits, and the protection designation period is set to T ₀ = 5 years Has been. A case will be described in which the protection designation period of the confidential file F1 is extended to 30 years in accordance with a new security policy. At this time, the decryption calculation amount C ₀ is obtained from the key length K ₀ of the original RAS cipher according to the above equation (1), and the correction calculation amount _CN is calculated from the decryption calculation amount C ₀ according to the equation (2). According to (3) or (4), the calculated key length based on the modified calculation amount C _N is K _N = 2182 bits. As a result, the confidential file F1 can be protected with the protection strength corresponding to the protection designation period of 30 years.

Next, it does not contain any important privacy information about the customer, it is encrypted by RSA encryption using an encryption key with a key length of K ₀ = 1024 bits, and the protection designation period is designated as To = 3 years before the change A case where the designated protection period for the confidential file F2 is changed will be described. In the new security policy, it is assumed that the protection designation period of the confidential file F1 that does not include important privacy information is extended to T _N = 15 years. In this case, the new key length K _N corresponding to the protection designation period of 15 years is calculated as 1256 bits using the equations (1), (2), and (3) as described above.

  As described above, the appropriate strength is maintained by calculating a new protection strength according to the changed confidentiality from the protection strength realized using the original key length assigned to the encrypted content. It can be seen that the encryption key length can be reset.

  The embodiment described above is an exemplification, and the scope of the present invention should not be construed in a limited manner, and can be realized by other methods within the scope satisfying the constituent requirements of the present invention. Needless to say. The content to be encrypted is not limited to drawings, and may include documents, tables, data, and the like. Furthermore, the method for encrypting the content may be a method other than the RSA encryption. Furthermore, although the drawing information management system of a present Example showed the example from which the user B searches from the portable information terminal D etc., you may make it search not only from this but from a server or a personal computer.

It is a figure explaining the outline | summary of the encrypted content management apparatus in embodiment of this invention. It is a figure explaining operation | movement of the encryption content management apparatus in this Embodiment compared with the conventional method. It is a figure which shows the structural example of the drawing information information management system of a present Example. It is a block diagram which shows the structural example of the drawing information management server of FIG. It is a figure which shows the functional structure of the drawing information management server of FIG. It is an operation | movement flowchart of a drawing information management server. It is an operation | movement flowchart of a portable information terminal.

Explanation of symbols

20: Initial electronic content 22: Electronic content with increased confidentiality 24: Electronic content with decreased confidentiality A: Company B: User D: Portable information terminal E: Drawing information management server F: Security server

Claims (10)

An encrypted content management apparatus for encrypting and managing electronic content,
Encryption setting means for encrypting electronic content based on a protection strength according to a predetermined confidentiality;
A first calculating means for calculating a calculation amount necessary for decrypting the encrypted electronic content when the sensitivity of the encrypted electronic content is changed;
A second calculating means for calculating a new protection strength corresponding to the changed confidentiality based on the calculation amount;
Re-encrypting means for re-encrypting electronic content based on the new protection strength;
An encrypted content management apparatus. The encrypted content management apparatus according to claim 1, wherein the protection strength includes a length of an encryption key. The encrypted content management apparatus according to claim 1, wherein the confidentiality is a protection period of electronic content, and the change in confidentiality is a difference between the protection periods. The encrypted content management apparatus further includes a storage unit that stores the encrypted electronic content, and an input unit that inputs a change in confidentiality of the encrypted electronic content, and the first calculation unit includes the first calculation unit, The encrypted content management apparatus according to claim 1, wherein when the confidentiality change is input from the input unit, the calculation amount of the encrypted electronic content stored in the storage unit is calculated. The confidentiality further includes electronic content value, electronic content distribution route information, electronic content using device information, user profile information, or a combination thereof, and the protection strength is determined based on the confidentiality. The encrypted content management apparatus according to any one of claims 1 to 4. An encrypted content management device according to any one of claims 1 to 5,
A user terminal that sends and receives information to and from the encrypted content management device,
The user terminal includes request means for requesting encrypted electronic content,
Receiving means for receiving encrypted electronic content,
The encrypted content management system, wherein when requested by the request unit, the encrypted content management device inputs a change in confidentiality of the encrypted content from the input unit. The encrypted content management device includes sending means for sending difference information between the unique information of the user terminal and the encryption key of the encrypted electronic content,
The user terminal includes a receiving means for receiving the sent difference information;
The encrypted content management system according to claim 6, further comprising decryption means for decrypting the electronic content encrypted based on the received difference information. The user terminal further includes a user credential means for certifying user qualification and a display means for displaying the decrypted electronic content, and the encrypted content management apparatus identifies the user certified by the user credential means. The encrypted content management system according to claim 7, further comprising user authentication means for authenticating. An encrypted content management program for encrypting and managing electronic content,
Encryption setting means for encrypting electronic content based on a protection strength according to a predetermined confidentiality;
A first calculating means for calculating a calculation amount necessary for decrypting the encrypted electronic content when the sensitivity of the encrypted electronic content is changed;
A second calculating means for calculating a new protection strength corresponding to the changed confidentiality based on the calculation amount;
Re-encrypting means for re-encrypting electronic content based on the new protection strength;
An encrypted content management program. An encrypted content management method for encrypting and managing electronic content,
Encrypting electronic content based on a protection strength according to a predetermined confidentiality;
Calculating the amount of computation required to decrypt the encrypted electronic content when the sensitivity of the encrypted electronic content is changed;
Calculating a new protection strength according to the changed sensitivity based on the calculation amount;
Re-encrypting the electronic content based on the new strength of protection;
An encrypted content management method comprising:

Images