JP2010045631A - Relay apparatus, communication system and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To authenticate documents to be exchanged without requiring processes such as encryption and signature using a public key cryptography in the side of a personal digital assistant in a communication system. <P>SOLUTION: Document data is formed in a format divided into a "document domain" indicating a document itself and an "attribute domain" indicating an attribute of the document. When the document is edited in a digital assistant 1 to change the contents in the "document domain", a CPU 11 in the digital assistant 1 reads a personal digital assistant identifying code PID from a ROM 12, enters this code in the "attribute domain" of the document data, and transmits the code to a communication terminal 2 via a communication part 17. A CPU 21 in the communication terminal 2 reads a communication terminal identifying code MID from a ROM 22, enters this code in the "attribute domain" in the document data, and then transmits the code to a management server 5. The management server 5 reads the identifying code from the "attribute domain" of this document data received from the communication terminal 2 and compares the code with a terminal registration table 541 of a memory 54 for authentication of the document data. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a relay device, a communication system, and a program.

As information terminals become smaller and lighter, PDAs (Personal Digital Assistants) and the like are widely used as portable information terminals. For example, in a company or government office, it is conceivable to perform a task of circulating a document to an authorized approver and obtaining approval for the document using a portable information terminal such as a PDA. In this case, there is a possibility that a third party who is not an approver impersonates the approver and alters an unapproved document as an approved document. As a method for preventing such “spoofing” and “tampering”, a signature by public key cryptography is used. For example, Patent Literature 1 discloses a mobile terminal that decrypts and authenticates received received information with a public key that includes identification information for identifying an information provider that provides the received information.
JP 2004-186727 A

By the way, in order to reduce the size and weight of a PDA or the like, processing capacity, storage capacity, battery capacity, and the like are often limited as compared with stationary information terminals such as personal computers and workstations. On the other hand, encryption and signature processing using public key cryptography generally requires high processing capacity, a large amount of storage area, processing time, and power. Therefore, when such encryption or signature processing is performed on a portable information terminal such as a PDA, much of the machine power is consumed by the processing, and the original use such as document browsing or editing may be hindered. is there.
Therefore, the present invention provides a mechanism for confirming with a simple configuration that a document to be exchanged has been approved by a legitimate approver.

In order to solve the above-described problem, a relay apparatus according to the present invention is transmitted with transmission means for sequentially transmitting document data to each of a plurality of clients via one of a plurality of types of communication networks. An acquisition means for acquiring communication network specific information specific to a communication network through which the document data passes, and the communication network specific information acquired by the acquisition means every time the document data is transmitted by the transmission means. And a communication network specific information storage means for storing the document data in association with each other according to the order of transmission to each of the clients.
Thereby, the relay apparatus according to the present invention can specify a communication network through which transmitted document data passes.

In the above-described aspect, the information processing apparatus includes a user information storage unit that stores communication network specific information predetermined for each user of the client, and the transmission unit acquires the communication network specific information each time the acquisition unit acquires the communication network specific information. The communication network unique information is compared with the communication network unique information stored in the user information storage means corresponding to the user of the client to whom the document data has been transmitted. It is desirable that the document data is not transmitted to the next sequential client.
Thereby, the relay apparatus according to the present invention can determine whether or not there is an unauthorized operation on the document data, and can prevent the document data on which the unauthorized operation has been performed from being transmitted in the next order.

In the above-described aspect, the information processing apparatus further comprises user information storage means for storing communication network specific information predetermined for each user and time period of the client, and the transmission means receives the communication network specific information by the acquisition means. The communication network specific information corresponding to the time zone including the acquired time and the communication network specific information corresponding to the user of the client to which the document data was transmitted is read from the user information storage means, and the acquired communication network specific information and the acquisition It is desirable that the document data is not transmitted to the next client in the case where the communication network specific information acquired by the means is compared and the two do not match.
Thereby, the relay apparatus according to the present invention can determine whether or not there is an unauthorized operation on the document data, and can prevent the document data on which the unauthorized operation has been performed from being transmitted in the next order.

In addition, a communication system according to the present invention includes a plurality of clients including a reception unit that receives document data transmitted via any one of a plurality of types of communication networks, and a display unit that displays the received document data. And adding means for adding communication network specific information specific to the communication network through which the document data has passed to the document data transmitted to the client, and via any of a plurality of types of the communication networks A transmission unit that sequentially transmits document data to each of the clients; an acquisition unit that acquires communication network specific information added to the document data transmitted from the client; and the document data by the transmission unit The communication network specific information acquired by the acquisition means each time transmission is performed according to the order of transmission to each client. Characterized in that it comprises a relay device and a communication network-specific information storage means for storing in association with the document data.
Thereby, the communication system according to the present invention can specify a communication network through which transmitted document data passes.

In the above aspect, the communication network specific information is client identification information for identifying the client, and the adding means relays transmission of the document data in the client or the communication network. It is desirable to have.
Accordingly, the communication system according to the present invention can determine whether or not there is an unauthorized operation on the document data, and can prevent the document data that has been operated illegally from being transmitted in the next order.

In the above aspect, the communication network specific information is device identification information for identifying a transmission relay device that relays transmission of the document data in the communication network, and the adding means includes the transmission relay device. It is desirable to have.
Accordingly, the communication system according to the present invention can determine whether or not there is an unauthorized operation on the document data, and can prevent the document data that has been operated illegally from being transmitted in the next order.

In addition, the program according to the present invention is transmitted from the transmission unit to the transmission control unit that sequentially transmits the document data to each of the plurality of clients via one of a plurality of types of communication networks. An acquisition means for acquiring communication network specific information specific to the communication network through which the document data has passed, and the communication network specific information acquired by the acquisition means each time the document data is transmitted by the transmission control means. This is a program for functioning as storage control means for storing in the storage means in association with the document data in accordance with the order of transmission to each of the clients.
Thereby, the computer that executes the program according to the present invention can specify the communication network through which the transmitted document data passes.

(A: Configuration)
Hereinafter, the configuration of the communication system 9 according to an embodiment of the present invention will be described with reference to the drawings.
(A-1: Overall configuration)
FIG. 1 is a block diagram illustrating an example of the overall configuration of the communication system 9. The information terminals 1A, 1B, and 1C (hereinafter referred to as “information terminal 1” when there is no particular distinction are collectively referred to as “information terminal 1”) are terminals for browsing and editing document data indicating a document. For example, PDA. Communication terminals 2A, 2B, 2C (hereinafter referred to collectively as “communication terminal 2” if there is no need to distinguish between them) are communication devices configured to be connectable to information terminal 1 by wire or wirelessly Information is exchanged between the information terminal 1 and the corresponding communication networks 3A, 3B, 3C. In the figure, the information terminal 1A is connected to the communication terminal 2A, the information terminal 1B is connected to the communication terminal 2B, and the information terminal 1C is connected to the communication terminal 2C. A plurality of communication networks 3A, 3B, 3C (hereinafter referred to as “communication network 3” when there is no need to distinguish between them) is a mobile phone communication network or a PHS (Personal Handy-phone System) network. And a wireless local area network (LAN). A communication terminal that communicates via a mobile phone communication network is a mobile phone, a communication terminal that communicates via a PHS network is a PHS terminal, and a communication terminal that communicates via a wireless LAN is a wireless LAN. It is a terminal. The network 4 is an information communication line connected to each communication network 3 and is, for example, the Internet. The management server 5 is a computer or the like connected to the network 4 and manages the registration information of the user of the information terminal 1, document data handled by the information terminal 1, and the like. It functions as a relay device that communicates with the communication terminal 2.

(A-2: Configuration of communication network)
FIG. 2 is a block diagram illustrating an example of the communication network 3. The communication network 3 illustrated in the figure is a mobile phone communication network. The home location register 31 stores subscriber information of the communication terminal 2 (in this case, a mobile phone) and manages position information of the communication terminal 2. The gateway mobile switching center 32 performs interconnection with the network 4, public lines, and other companies' networks. The mobile switching center 33 tracks the movement of the communication terminal 2 and provides a communication line switching service. Base stations 331-1, 331-2, and 331-3 (hereinafter referred to collectively as “base station 331” when there is no need for distinction) perform wireless communication with communication terminal 2. Do. The base station 331 is provided for each predetermined area, and a plurality of base stations 331 are connected to the mobile switching center 33. The home location register 31, the gateway mobile switching center 32 and the mobile switching center 33 are connected by a communication line 30. For simplicity of explanation, only one mobile switching center 33 is shown in the figure, but a plurality of mobile switching centers 33 may be connected to the communication line 30.

(A-3: Configuration of information terminal and communication terminal)
FIG. 3 is a block diagram illustrating an example of the configuration of the information terminal 1 and the communication terminal 2.
First, the configuration of the information terminal 1 will be described. The CPU 11 controls each part of the information terminal 1 by reading and executing a boot loader stored in the ROM 12 and a computer program stored in the storage unit 14. The ROM 12 is a read-only nonvolatile storage device composed of a semiconductor element or the like. The ROM 12 stores a boot loader for loading a basic operating system (OS) stored in the storage unit 14 into a random access memory (RAM) 13 and a basic input / output system (BIOS). The ROM 12 stores an information terminal identification symbol PID as identification information unique to the information terminal 1. The information terminal identification symbol PID is, for example, the manufacturing number of the information terminal 1. The RAM 13 is used as a work area when the CPU 11 executes a program. The storage unit 14 is a nonvolatile storage unit such as an EEPROM (Electrically Erasable Programmable Read Only Memory), and stores a program read by the CPU 11, document data representing a document, and the like. The operation unit 15 includes operation elements such as operation buttons for inputting various instructions. The operation unit 15 receives an operation by a user and supplies a signal corresponding to the operation content to the CPU 11. The display unit 16 displays a document or the like represented by document data in response to an instruction from the CPU 11. The display unit 16 has a display surface composed of a plurality of pixels, for example. This display surface is constituted by a display body such as a cholesteric liquid crystal, for example. The communication unit 17 is a communication unit for communicating with the communication terminal 2. The communication unit 17 is, for example, a serial interface compliant with the USB (Universal Serial Bus) standard, a wireless interface compliant with IrDA (Infrared Data Association), Bluetooth (registered trademark), or the like. The above configuration is mutually connected by a bus 19.

  Next, the configuration of the communication terminal 2 will be described. The CPU 21, RAM 23, storage unit 24, operation unit 25, display unit 26, and bus 29 have the same configurations as the CPU 11, RAM 13, storage unit 14, operation unit 15, display unit 16, and bus 19 provided in the information terminal 1, respectively. However, the ROM 22 does not store the information terminal identification symbol PID, but stores the communication terminal identification symbol MID for identifying the communication terminal 2. The communication unit 27 includes a first communication unit 271 and a second communication unit 272. The first communication unit 271 is a communication unit that performs communication with the communication unit 17 of the information terminal 1. The first communication unit 271 has the same configuration as that of the communication unit 17 of the information terminal 1 and thus will not be described. The second communication unit 272 is a communication unit that communicates with the communication network 3. For example, various modems, wireless communication circuits compliant with IMT-2000, wireless interfaces compliant with IrDA, Bluetooth (registered trademark), and the like. Etc.

  As shown in the figure, the information terminal 1 and the communication terminal 2 are connected to each other, thereby functioning as a client that exchanges document data with the management server 5 via the communication network 3 and the network 4. The information terminal identification symbol PID stored in the ROM 12 and the communication terminal identification symbol MID stored in the ROM 22 are entered in the document data by the information terminal 1 and the communication terminal 2, respectively, when the document data passes through this client. Is done. That is, the set of the information terminal identification symbol PID and the communication terminal identification symbol MID is an example of communication network unique information unique to the communication network through which the transmitted document data is passed.

(A-4: Configuration of management server)
FIG. 4 is a block diagram illustrating an example of the management server 5. The CPU 51 and the RAM 53 have the same configuration as the CPU 11 and the RAM 13 included in the information terminal 1, respectively, but the information terminal identification symbol PID is not stored in the ROM 52. The communication unit 57 is a communication unit that performs communication with the network 4. The communication unit 57 is an example of a transmission unit that sequentially transmits document data to each of a plurality of clients via one of a plurality of types of communication networks 3 via the network 4. The storage unit 54 is a large-capacity storage unit such as a hard disk drive, and stores a program read by the CPU 51. In addition, the storage unit 54 stores a terminal registration table 541.

(A-5: Configuration of terminal registration table)
FIG. 5 is a diagram illustrating an example of the terminal registration table 541. As shown in the figure, the terminal registration table 541 includes a user identification symbol for identifying a user, an information terminal identification symbol PID of the information terminal 1 owned by the user, and a communication terminal of the communication terminal 2 owned by the user. An identification symbol MID is described in association with it. The combination of the information terminal identification symbol PID and the communication terminal identification symbol MID described in the terminal registration table 541 is regular user information indicating regular user information predetermined for each user identification symbol by an administrator or the like.

  For example, the user identification symbol “U01” is associated with “P001” as the information terminal identification symbol PID, and is associated with “W001” indicating the wireless LAN device as the communication terminal identification symbol MID. The user identification symbol “U02” is associated with “P002” as the information terminal identification symbol PID, and is associated with “M001” indicating the mobile phone as the communication terminal identification symbol MID. The user identification symbol “U03” is associated with “P003” as the information terminal identification symbol PID, and is associated with “H001” indicating the PHS terminal as the communication terminal identification symbol MID. The user identification symbol “U04” is associated with “P004” as the information terminal identification symbol PID, and “W002” indicating the wireless LAN device and “H002” indicating the PHS terminal as the communication terminal identification symbol MID. Are associated. In this case, as a combination of the information terminal identification symbol PID and the communication terminal identification symbol MID, “P004” and “W002” and “P004” and “H002” are all registered in the terminal registration table 541 as regular user information. Will be. Note that the communication terminal identification symbol MID is actually a telephone number “090-xxx-xxxx” in the case of a mobile phone, and is actually a telephone number “0” in the case of a PHS terminal. In the case of a wireless LAN terminal, it is actually a MAC address.

(B: Operation)
Next, operation | movement of the communication system 9 which is one Embodiment of this invention is demonstrated.
FIGS. 6A, 6B, and 6C are sequence diagrams showing operations at the time of approval in the communication system 9. FIG. FIG. 6A shows an operation in which the management server 5 exchanges document data with a client composed of the communication terminal 2A and the information terminal 1A. FIG. 6B is a sequence diagram following FIG. 6A, and shows an operation in which the management server 5 exchanges document data with a client configured by the communication terminal 2B and the information terminal 1B. FIG. 6C is a sequence diagram following FIG. 6B, and shows an operation in which the management server 5 exchanges document data with a client constituted by the communication terminal 2 </ b> C and the information terminal 1 </ b> C. Thus, the communication system 9 operates in the order described in FIG. 6A → FIG. 6B → FIG. 6C.

Here, the creator of the document determines the order of the approver who circulates the document, and describes the order in the document data. The circulation order is “U01 → U02 → U04” in terms of user identification symbols.
The management server 5 identifies the communication terminal identification symbol MID “W001” corresponding to the user identification symbol “U01” from the circulation order described in the document data and the terminal registration table 541 of the storage unit 54, and the network 4 and the communication network 3 is transmitted to the communication terminal 2A corresponding to the communication terminal identification symbol MID “W001” (step S101). The communication terminal 2A transmits the document data received from the management server 5 to the information terminal 1A (step S102). In the information terminal 1A, the operation unit 15 receives an operation by the user and supplies a signal corresponding to the operation content to the CPU 11, and the CPU 11 performs a process corresponding to the signal. In response to such user operation, for example, the document represented by the document data is displayed on the display unit 16 and the document is edited (step S103). The document data indicating the document has a structure in which a “document area” indicating the document itself and an “attribute area” indicating the attribute of the document are divided. The document editing performed by the information terminal 1A means changing the contents of the “document area”, for example, adding or deleting a sentence, or making an unapproved document approved. When the document is edited in the information terminal 1A, the CPU 11 of the information terminal 1A reads the information terminal identification symbol PID from the ROM 12, fills in the “attribute area” of the document data, and newly stores it in the storage unit 14 (step S104). ). That is, the CPU 11 is an example of an adding unit that adds, to the document data transmitted to the client, communication network unique information unique to the communication network through which the document data has passed. Then, the CPU 11 of the information terminal 1A transmits the document data in which the information terminal identification symbol PID is entered via the communication unit 17 to the communication terminal 2A (step S105).

  The CPU 21 of the communication terminal 2A reads the communication terminal identification symbol MID from the ROM 22, fills it in the “attribute area” of the document data received from the information terminal 1A, and newly stores it in the storage unit 24 (step S106). That is, the CPU 21 is also an example of an adding unit that adds communication network specific information specific to the communication network through which the document data has passed to the document data transmitted to the client. Then, the CPU 21 of the communication terminal 2A manages the document data in which the communication terminal identification symbol MID and the information terminal identification symbol PID are entered from the second communication unit 272 of the communication unit 27 via the communication network 3 and the network 4. It transmits to the server 5 (step S107). The CPU 51 of the management server 5 extracts the communication terminal identification symbol MID and the information terminal identification symbol PID from this document data received from the communication terminal 2A. That is, the CPU 51 is an example of an acquisition unit that acquires communication network specific information specific to a communication network through which document data to be transmitted passes. Then, the CPU 51 refers to the terminal registration table 541 of the storage unit 54 and determines whether or not the combination of these extracted identification symbols matches the regular user information described in association with the terminal registration table 541. By determining, it is determined whether there is an unauthorized operation on the document data (step S108). For example, in the case of the terminal registration table 541 illustrated in FIG. 5, if the information terminal identification symbol PID extracted from the document data is “P001” and the communication terminal identification symbol MID is “W001”, the CPU 51 And the regular user information described in association with each other in the terminal registration table 541 are determined to match. In this case, if the information terminal identification symbol PID extracted from the document data is “P004”, the communication terminal identification symbol MID extracted from the document data as a pair is either “W002” or “H002”. Even if it exists, CPU51 judges that the combination of these identification symbols and the regular user information described by matching in the terminal registration table 541 correspond.

  If it is determined that the combination of identification information matches the regular user information (step S108; YES), the CPU 51 of the management server 5 stores the document data in the storage unit 54 as regular document data that has not been fraudulent. Store (step S109). In other words, the storage unit 54 is an example of a storage unit that stores the communication network specific information acquired by the CPU 51 each time document data is transmitted by the communication unit 57 in association with the document data in accordance with the transmission order to each client. It is. On the other hand, if it is determined that the combination of identification information and the regular user information do not match (step S108; NO), the CPU 51 of the management server 5 assumes that the document data is fraudulent and prevents fraud. Is performed (step S110). The process for preventing fraud means that the document data is not transmitted in the next order. In addition to this, as processing for preventing fraud, the CPU 51 stores, for example, the document data that has been fraudulent in a predetermined storage area of the storage unit 54, or displays a display unit for the user of the management server 5. An image showing a warning may be displayed by (not shown).

  Next, the CPU 51 of the management server 5 transmits the regular document data stored in the storage unit 54 in step S109 to the client constituted by the communication terminal 2B and the information terminal 1B via the network 4 and the communication network 3 ( Step S111). Henceforth, operation | movement of step S111-S120 is the same as step S101-S110 mentioned above. Further, the CPU 51 of the management server 5 transmits the regular document data stored in the storage unit 54 in step S119 to the client constituted by the communication terminal 2C and the information terminal 1C via the network 4 and the communication network 3 (step S119). S121). The operations in steps S121 to S130 are the same as those in steps S101 to S110 described above. As described above, in step S127, the management server 5 receives from the communication terminal 2C document data edited or approved in the order of the information terminal 1A → the information terminal 1B → the information terminal 1C.

  FIG. 7 is a conceptual diagram showing document data received from the communication terminal 2C by the management server 5 by performing the above operation three times. In the “document area” of these document data, information indicating the contents of the document is described. In the “attribute area” of the document data shown in FIG. 7A, “U01 → U02 → U04”, which is the circulation procedure entered at the time of document creation, and “P001 → W001 → P002 → M001 → P004” entered at the time of circulation. H002 "is described. The CPU 51 of the management server 5 compares the description content of this “attribute area” with the terminal registration table 541 of the storage unit 54 (step S108), and “P001” and “W001”, “P002” and “M001” and “ Since it is determined that “P004” and “H002” are associated with each other (step S128; YES), this document data is stored in the storage unit 54 as normal document data that is not fraudulent (step S129). .

  On the other hand, “P001 → W001 → P002 → M001 → P003 → H002” is described in the “attribute area” of the document data shown in FIG. The CPU 51 compares the description content with the terminal registration table 541 in the same manner as described above (step S128). Since “P003” and “H002” are not associated with the terminal registration table 541, “ It is determined that each piece of identification information described in the “attribute area” is not associated (step S128; NO). Therefore, the CPU 51 performs a process for preventing fraud, assuming that the document data is fraudulent (step S130). This is because, for example, a user who has stolen the communication terminal 2C having the communication terminal identification symbol MID “H002” connects it to the information terminal 1 having the information terminal identification symbol PID “P003” and uses the user identification symbol “U04”. For example, when trying to impersonate an identified user.

  In the “attribute area” of the document data shown in FIG. 7C, “P001 → W001 → P002 → M001 → P004 → H001” is described. Also in this case, since “P004” and “H001” are not associated with each other in the terminal registration table 541, the CPU 51 performs a process for preventing fraud, assuming that the document data is fraudulent (step S130). ). As a result, the user discriminates the document data that has been fraudulent from the document data that has not been fraudulent. This is because, for example, a user who has stolen the information terminal 1C having the information terminal identification symbol PID “P004” connects it to the communication terminal 2 having the communication terminal identification symbol MID “H001” and uses the user identification symbol “U04”. For example, when trying to impersonate an identified user.

  Note that “P001 → W001 → P002 → M001 → P004 → W002” is described in the “attribute area” of the document data shown in FIG. 7D, which is “document data” in FIG. This is different from the description content of the “attribute area”. However, since both “H002” and “W002” are associated and registered as communication terminal identification symbols MID for the user identified by the user identification symbol “U04”, this document data is illegal. Treated as not.

(C: Modification)
The above-described embodiment may be modified as follows.
(Modification 1) In the above-described embodiment, the CPU 21 of the communication terminal 2 reads the communication terminal identification symbol MID from the ROM 22, fills in the “attribute area” of the document data, and newly stores it in the storage unit 24. However, the communication terminal identification symbol MID may be entered in the document data not by the communication terminal 2 but by an apparatus constituting the communication network 3. A transmission relay device (for example, the mobile switching center 33 in the case of a cellular phone communication network) that transmits document data in the communication network 3 performs routing in the network, and thus knows the communication terminal identification symbol MID of the communication terminal 2. Can do. Therefore, this transmission relay device enters the communication terminal identification symbol MID in the document data. FIG. 8 is a sequence diagram showing an operation flow of the communication system 9 in the first modification. Since the flow of this operation is the same as that in FIG. 6A for steps S101 to S105 and steps S108 to S110, description thereof will be omitted. When the document data in which the information terminal identification symbol PID is entered in step S105 is received from the information terminal 1A, the communication terminal 2A transmits the document data to the communication network 3 as it is (step S201). When the document data is received from the communication terminal 2A, the communication network 3 enters the communication terminal identification symbol MID in the “attribute area” of the document data. Specifically, one of the transmission relay devices constituting the communication network 3 enters the communication terminal identification symbol MID in the document data (step S202). The document data in which the communication terminal identification symbol MID is entered is transmitted from the communication network 3 to the network 4 (step S203), and is transmitted from the network 4 to the management server 5 (step S204). Then, the CPU 51 of the management server 5 makes the same determination as in step S108 shown in FIG. 6 for this document data received from the network 4.

  When the transmission relay device that constitutes the communication network 3 receives document data from the communication terminal 2, since the communication path from the communication terminal 2 A to the management server 5 has already been established, the transmission relay device that constitutes the communication network 3 is The communication terminal identification symbol MID of the communication terminal 2A may be extracted from this communication path and entered in the document data. In general, since it is difficult for an unauthorized communication terminal to impersonate a regular communication terminal with respect to the communication network 3, by writing the communication terminal identification symbol MID in the document data by the communication network 3 in this way, The safety of the communication system 9 is improved.

(Modification 2) In the above embodiment, when document data is transmitted from the management server 5 to the information terminal 1 (hereinafter referred to as download), identification information is entered in the “attribute area” of the document data. However, the entry is made only when the document data is transmitted from the information terminal 1 to the management server 5 (hereinafter referred to as upload). Identification information may be entered in the “attribute area”. In this case, even if the communication path is different between download and upload, if the combination of identification information written in the “attribute area” of the document data is described as information on the authorized user in the terminal registration table 541, Treated as regular document data.

  For example, as shown in FIG. 5, the information terminal identification symbol PID “P004” of the information terminal 1 owned by the user with the user identification symbol “U04” includes two communication terminal identification symbols MID “W002” and “H002”. Are associated. Therefore, when downloading, a user identified by the user identification symbol “U04” combines the information terminal 1 having the information terminal identification symbol PID “P004” and the communication terminal 2 having the communication terminal identification symbol MID “W002”. Even when the information terminal 1 and the communication terminal 2 having the communication terminal identification symbol MID “H002” are used in combination at the time of use and upload, these combinations are both registered in the terminal registration table 541. This document data is handled as having not been tampered with. Thereby, for example, a user who has registered a plurality of communication terminals 2 in one owned information terminal 1 downloads document data from the management server 5 using a wireless LAN device having a high download communication speed. When the document data that has been approved is uploaded to the management server 5 on a mobile phone with a wide communication range after the document is viewed and approved on the go, the document data is stored as a regular one, so that the user Increases the degree of freedom of equipment selection.

(Modification 3) In the above-described embodiment, the identification information to be entered in the document data is the information terminal identification symbol PID and the communication terminal identification symbol MID. You may add to. For example, identification information (for example, a MAC address or an IP address) indicating a transmission relay device such as a router that relays transmission of document data in the network 4, a base station or a mobile switching center that relays document data in the communication network 3, etc. Identification information (for example, area code or station number) of the transmission relay apparatus may be entered in the document data. In other words, when the communication network specific information is device identification information for identifying a transmission relay device that relays transmission of document data in the communication network, the adding means for adding the communication network specific information to the document data is The transmission relay device is provided. Here, the communication network specific information unique to the communication network is dynamically determined depending on the position of the communication terminal 2 and the degree of congestion of the communication line. For example, the MAC address of the relay device is determined by selecting the relay device so that the congestion state of the communication line is not deteriorated when the communication path is established. The base station is determined by the position where the communication terminal 2 is placed. Even in such a case, the communication network specific information is stored in association with the document data in the information terminal 1 and the management server 5 respectively, and the stored contents are collated later, whereby the communication system 9 The user may determine whether or not the communication path of the document data is normal. For example, even if a third party obtains the description content of the “document area” of the document data illegally and attempts to tamper with it and upload it to the management server 5, the information terminal 1 and the communication terminal 2 used by the third party. Enters the information terminal identification symbol PID and the communication terminal identification symbol MID each indicating its own device in the document data, so that the communication network unique information stored in association with the document data in the information terminal 1 and the management server 5 respectively. Will not match. Thereby, the user of the communication system 9 may determine that there has been an unauthorized operation on the document data.

(Modification 4) In the above-described embodiment, the communication network specific information is entered in the document data, but in addition to this, time information indicating the time at which communication was performed may be entered. As a result, the information entered in the “attribute area” of the document data is specific to the time when the communication was performed, and is distinguished from the document data communicated at other times. The security against the so-called replay attack to be transmitted can be improved.

(Modification 5) In the above-described embodiment, the terminal registration table 541 has a constant content regardless of the time zone, but a terminal registration table 541 having a different content according to the time zone may be used. By writing the time information in the document data in addition to the identification information as described above, the CPU 51 of the management server 5 refers to the “attribute area” of the document data, so that the communication path of the document data and the time Determine if it was sent to Then, the CPU 51 reads the terminal registration table 541 in the time zone corresponding to the time when the document data was transmitted from the storage unit 54 and refers to it, so that the illegal correspondence to the document data can be performed with the correspondence of the identification information corresponding to the time zone. Determine if there is an operation.

  For example, FIG. 9 is a diagram illustrating an example of the terminal registration table 541 that varies according to the time zone in the fifth modification. 9A shows the terminal registration table 541a in the time zone from 9 o'clock to 12 o'clock (hereinafter referred to as time zone A), and FIG. 9B shows the time zone from 12 o'clock to 17:00 (hereinafter referred to as time zone A). , Terminal registration table 541b in time zone B). As shown in the figure, the information terminal identification symbol PID “P004” corresponds to “W002” as the communication terminal identification symbol MID in the terminal registration table 541a and “H002” as the communication terminal identification symbol MID in the terminal registration table 541b. It is attached. The user indicated by the user identification symbol “U04” uses a wireless LAN device with the communication terminal identification symbol MID “W002” as the communication terminal 2 in the time zone A due to work location, work content, schedule, and the like. In the time zone B, the PHS terminal having the communication terminal identification symbol MID “H002” is used as the communication terminal 2. Therefore, even if the information terminal 1 having the information terminal identification symbol PID “P004” used by the user is stolen, the CPU 51 of the management server 5 does not select the communication terminal 2 corresponding to the time zone for transmitting the document data. Since the unauthorized operation is detected, the safety of the communication system 9 is improved.

  In the above-described modification, the plurality of terminal registration tables 541 are stored in the storage unit 54 for each of a plurality of predetermined time zones, but the time zones may not be predetermined. . For example, the time zone of the terminal registration table 541 may be determined in conjunction with the user schedule, attendance management table, and the like. Hereinafter, it is assumed that the user is managed by an attendance management system or the like. Each user who is a member of a company has an IC card in which user identification information for identifying an individual such as an employee number is stored. The user is held by holding the IC card at the entrance of a company facility. A reading device for reading the user identification information is provided. This reading device is connected to the management server 5, and the CPU 51 of the management server 5 stores the time when each user enters and exits the facility (hereinafter referred to as “outing situation”) in the storage unit 54. On the other hand, in the storage unit 54, as a terminal registration table 541, a terminal registration table 541c for in-house work indicating a combination of terminals when the user is working in the company, and a combination of terminals when the user is out The terminal registration table 541d for going out is stored. When the CPU 51 receives the document data, the CPU 51 identifies the current time by a timer built in the CPU 51, and refers to each user's going-out situation stored in the storage unit 54 and the terminal registration tables 541c and 541d. Thus, the combination of the information terminal identification symbol PID and the communication terminal identification symbol MID according to whether or not each user has gone out is specified. Then, the specified combination may be compared with the communication network specific information entered in the “attribute area” of the document data to determine whether or not the document data is illegally operated.

(Modification 6) In the above-described embodiment, the management server 5 did not determine whether or not to transmit / receive document data, but transmits / receives document data based on a communication path for transmitting / receiving document data. It may be determined whether or not. For example, in connection-type transmission control protocols such as TCP (Transmission Control Protocol), document data is transmitted and received after establishing a communication path through a procedure such as a three-way handshake method. 5 obtains information of the established communication path as communication network specific information. Then, the CPU 51 of the management server 5 compares the communication network specific information with the description contents of the terminal registration table 541 of the storage unit 54, and only sends and receives document data if they match. Good. As a result, document data is not transmitted / received via a communication path established by an unauthorized operation, so that the possibility of document data leakage is reduced.

(Modification 7) In the embodiment described above, the communication network specific information to be entered in the “attribute area” of the document data is the communication path information itself, but is uniquely determined by the communication path through which the document data is transmitted. Any information may be used as long as it is information specific to the communication network through which the document data to be transmitted passes. For example, it may be a hash value calculated from communication path information. In this case, the CPU 11 of the information terminal 1, the CPU 21 of the communication terminal 2, or the CPU 51 of the management server 5 may calculate the hash value of the document data.

(Modification 8) In the above-described embodiment, the CPU 51 of the management server 5 did not perform processing such as encryption or signature using public key encryption, but may perform these processing. For example, when downloading, that is, when document data or the like is transmitted from the management server 5 to the information terminal 1, the CPU 11 of the information terminal 1 stores the communication network specific information in the storage unit 14, and the CPU 51 of the management server 5 performs this communication. The route information or the like may be encrypted with its own private key, written in the “attribute area” of the document data, and transmitted to the information terminal 1. When verifying the document data, the verifier uses the communication path information stored in the storage unit 14 of the information terminal 1 and the information entered in the “attribute area” of the document data to the public key of the management server. It may be determined that the document data is genuine when they match with the data decrypted in step.

(Modification 9) In the above-described embodiment, the document data has a structure in which “document area” indicating the document itself and “attribute area” indicating the attribute of the document are divided, and the communication path information is Although this "attribute area" has been entered, other modes may be used. A document identification symbol for identifying the document data is entered in the “attribute area” of the document data, and the communication path information may be transmitted / received in association with the document identification symbol. In other words, the communication network unique information only needs to be associated with the document data without writing the communication network unique information in the document data.

(Modification 10) In the embodiment described above, every time the CPU 51 of the management server 5 receives document data from each client constituted by the communication terminal 2 and the information terminal 1, the CPU 51 checks whether or not the document data has been illegally operated. Although it has been determined (steps S108, S118, S128), this need not be determined every time document data is received. For example, the CPU 51 of the management server 5 may determine whether or not there is an unauthorized operation on the document data after exchanging the document data for a predetermined number of times (three times, etc.). This may be determined when the document data is verified.
In the above-described embodiment, the CPU 51 of the management server 5 refers to the terminal registration table 541 in the storage unit 54 and corresponds to the combination of identification symbols extracted from the “attribute area” of the document data in the terminal registration table 541. Although it is determined whether or not there is an unauthorized operation on the document data by determining whether or not the regular user information described in the description matches, the management server 5 itself does not need to make this determination. . For example, a device different from the management server 5 may perform this collation, and the contents of the “attribute area” of the document data and the terminal registration table 541 are displayed by display means (not shown) provided in the management server 5. It may be displayed, and the administrator may check it visually.

  Further, in the above-described embodiment, if the combination of the information terminal identification symbol PID and the communication terminal identification symbol MID is described in the terminal registration table 541, it is determined that there is no unauthorized operation on the document data. The presence or absence of an illegal operation on the document data may be determined based on other conditions. For example, the order in which the document data is actually circulated is identified from the order of the identification symbols entered in the “attribute area” of the document data, and this is the circulation procedure entered in the “attribute area” of the document data at the time of document creation. This determination may be made based on whether or not they match. More specifically, the terminal registration table 541 shown in FIG. 5 is arranged according to the order in which the document data is circulated, and the order of the identification symbols written in the document data does not match this order. It is assumed that the document data is invalid. For example, as shown in FIG. 7A, when “P001 → W001 → P002 → M001 → P004 → H002” is described in the “attribute area” of the document data, an unauthorized operation on the document data is performed. If it is determined that there is not, but each combination is the same, but “P002 → M001 → P001 → W001 → P004 → H002” is described in the “attribute area” of the document data, the document It is determined that there is an unauthorized operation on the data. This is because the information terminal identification symbol PID “P002” is described before the information terminal identification symbol PID “P001”.

  The document data circulation procedure is entered in the “attribute area” of the document data by the creator of the document at the time of document creation, but may be entered in the “document area” of the document data. The circulation procedure of the document data may not be entered in the document data, and may be stored in the storage unit 54 of the management server 5 in association with the document data. Further, for example, in determining whether there has been an unauthorized operation on the document data, the determination is made with reference to only the combination of the information terminal identification symbol PID and the communication terminal identification symbol MID without referring to the circulation procedure of the document data. In this case, the document data circulation procedure may not be stored.

(Modification 11) The programs executed by the CPU 11 of the information terminal 1, the CPU 21 of the communication terminal 2, and the CPU 51 of the management server 5 are a magnetic recording medium such as a magnetic tape and a magnetic disk, an optical recording medium such as an optical disk, and a magneto-optical medium. It may be provided in a state stored in a recording medium readable by a computer device such as a recording medium or a semiconductor memory. It is also possible to download this program via a network such as the Internet. Various devices other than the CPU can be applied as the control means for performing such control. For example, a dedicated processor may be used.

It is a block diagram which shows an example of the whole structure of a communication system. It is a block diagram which shows an example of a communication network. It is a block diagram which shows an example of a structure of an information terminal and a communication terminal. It is a block diagram which shows an example of a management server. It is a figure which shows an example of a terminal registration table. It is a sequence diagram which shows the operation | movement of communication by a communication system. It is a sequence diagram which shows the operation | movement of communication by a communication system. It is a sequence diagram which shows the operation | movement of communication by a communication system. It is a conceptual diagram which shows the document data which the management server received from the communication terminal. FIG. 10 is a sequence diagram showing a flow of operations of the communication system in Modification 1. It is a figure which shows an example of the terminal registration table in the modification 5.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Information terminal, 11 ... CPU, 12 ... ROM, 13 ... RAM, 14 ... Memory | storage part, 15 ... Operation part, 16 ... Display part, 17 ... Communication part, 19 ... Bus, 2 ... Communication terminal, 21 ... CPU, 22 ... ROM, 23 ... RAM, 24 ... storage unit, 25 ... operation unit, 27 ... communication unit, 271 ... first communication unit, 272 ... second communication unit, 29 ... bus, 3 ... communication network, 30 ... communication line , 31 ... Home location register, 32 ... Gateway mobile exchange, 33 ... Mobile exchange, 331 ... Base station, 4 ... Network, 5 ... Management server, 51 ... CPU, 52 ... ROM, 53 ... RAM, 54 ... Storage unit 541 ... terminal registration table, 541a ... terminal registration table, 541b ... terminal registration table, 57 ... communication unit, 9 ... communication system, MID ... communication terminal identification symbol, PID ... information terminal identification symbol.

Claims (7)

Transmission means for sequentially transmitting document data to each of a plurality of clients via any of a plurality of types of communication networks;
Acquisition means for acquiring communication network specific information specific to the communication network through which the document data to be transmitted has passed;
Communication network specific information for storing the communication network specific information acquired by the acquisition means each time transmission of the document data is performed in association with the document data in accordance with the order of transmission to each of the clients. And a storage means. User information storage means for storing communication network specific information predetermined for each user of the client;
Each time the transmission unit acquires the communication network specific information by the acquisition unit, the transmission unit stores the acquired communication network specific information and the user information storage unit corresponding to the user of the client to which the document data is transmitted. 2. The relay apparatus according to claim 1, wherein the document data is not transmitted to the next sequential client when the two are not matched when the communication network specific information is compared. . User information storage means for storing communication network specific information predetermined for each user and time zone of the client;
The transmission means includes a time zone including a time at which the communication network specific information is acquired by the acquisition means, and the communication network specific information corresponding to a user of the client to which the document data is transmitted. The communication network unique information read out from the communication network is compared with the communication network unique information acquired by the acquisition means, and if the two do not match, the document data is transmitted to the next client in sequence. The relay device according to claim 1, wherein the relay device is not provided. A plurality of clients having receiving means for receiving document data transmitted via any of a plurality of types of communication networks, and display means for displaying the received document data;
Adding means for adding communication network specific information specific to the communication network through which the document data has passed to the document data transmitted to the client;
Transmission means for sequentially transmitting document data to each of the clients via any one of the plurality of types of communication networks, and communication network specific information added to the document data transmitted from the clients An acquisition unit for acquiring and the communication network specific information acquired by the acquisition unit each time transmission of the document data by the transmission unit is associated with the document data in accordance with the order of transmission to each of the clients. A communication system comprising: a relay device having communication network unique information storage means for storing. The communication network specific information is client identification information for identifying the client in the communication network,
The communication system according to claim 4, wherein the adding unit includes a transmission relay device that relays transmission of the document data in the client or the communication network. The communication network specific information is device identification information for identifying a transmission relay device that relays transmission of the document data in the communication network,
The communication system according to claim 4, wherein the adding unit is provided in the transmission relay device. Transmission control means for sequentially sending document data to each of a plurality of clients from a transmission means via any of a plurality of types of communication networks;
Acquisition means for acquiring communication network specific information specific to the communication network through which the document data to be transmitted has passed;
Each time the document data is transmitted by the transmission control unit, the communication network specific information acquired by the acquiring unit is stored in the storage unit in association with the document data in accordance with the transmission order to each of the clients. A program for functioning as memory control means.

Images