JP2010072916A - Data protection system and data protection method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a data protection system for achieving both keeping secret of confidential information for an online service provider and reduction in system operation costs to be absorbed by a service use organization. <P>SOLUTION: A browser of a client terminal includes a means for, when transmitting data to an online service server, acquiring an encryption script and a cryptographic key from a key management server through a service use organization network, and for acquiring the encrypted data of input data by executing the encryption script, and for transmitting the acquired encrypted data to the online service server, and for, when plotting a data display screen received from the online service server, acquiring a decryption script and the cryptographic key from the key management server, and for acquiring the decrypted data of display data by executing the decryption script, and for drawing the data display screen by using the decrypted data acquired by the means. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a data protection system and a data protection method for preventing confidential information of a service using organization from leaking from a server managed by an online service provider when using an information system provided as an online service.

In recent years, attention has been focused on ASP (Application Service Provider) and SaaS (Software As a Service), which provide an information system as an online service for companies and corporations.
In ASP / SaaS, information service servers and data are managed by online service providers. For this reason, the service use organization can greatly reduce the management and operation cost of the system by replacing the information system that has been operated in the organization with an information system provided by ASP / SaaS.

On the other hand, when using an information system provided by ASP / SaaS, it is a problem to prevent leakage of confidential information from a server managed by an online service provider.
In ASP / SaaS, information assets of multiple organizations that use services are accumulated on a server (online service server) managed by an online service provider. For this reason, the information leakage from the online service server has a great social impact because the damage is caused to a plurality of organizations.
In addition, because of security concerns about leaving confidential information that has been strictly managed within the organization to businesses outside the organization, especially in companies with a high awareness of data protection, the information system provided by ASP / SaaS The current situation is that we are not introducing it.

In recent years, a data protection system has been proposed to prevent the leakage of confidential information from the online service server by making it possible to use the service while keeping the contents of the data secret from the online service server as a countermeasure against the above issues. Has been.
For example, in the following Patent Document 1, in a Web application in which a client terminal and an online service server are connected via a network, a proxy server that intercepts data transmitted and received between the client terminal and the online service server is used. A technique for using a Web application while keeping data secret from a server is disclosed.

  In the prior art described in Patent Document 1, when a request is transmitted from the client terminal to the online service server, the proxy server encrypts the data included in the request and transmits the data to the online service server. Further, when a response is transmitted from the online service server to the client terminal, the proxy server decrypts the data included in the response and transmits the data to the client terminal.

  According to the above prior art, only data encrypted by the proxy server is stored in the online service server. That is, the service using organization can use the service while keeping the content of the data secret from the online service server by managing the proxy server in the organization. Thereby, the service using organization can prevent leakage of confidential information from the online service server.

On the other hand, in recent years, browser script extensions have been proposed for browsers, which are execution environments on the client side of Web applications.
Here, the browser script is a program executed on the browser, for example, JavaScript (registered trademark).
As an example of a browser script extension function, Non-Patent Document 1 discloses a browser function extension plug-in that adds a JavaScript API (Application Program Interface) for realizing a parallel process execution function to a browser.
In the following, the conventional technology of Non-Patent Document 1 is cited as an example of the browser script extended function, and the parallel process execution function and the cross-origin access function provided by the parallel process execution function will be described. This background art is also described in Non-Patent Document 2.

JP 2005-309846 A http://code.google.com/apis/gears/ GoogleGears Start Guide Shunpei Shiraishi

The parallel process execution function is a mechanism for adding a function to execute JavaScript in the background to the browser. The developer of the Web application writes JavaScript using the API provided by the parallel process execution function, downloads it to the browser and executes it, causing the browser to generate a child process, and the child process to create an arbitrary JavaScript file Can be executed. After the execution is completed, the child process returns the execution result to the calling JavaScript, that is, the parent process by inter-process communication.
In addition, the parallel process execution function provides a mechanism called cross-origin access that enables acquisition of Web resources of another origin from JavaScript.

Here, the origin is combination information of a protocol, a domain, and a port number of a URL assigned to each Web resource.
For example, the origin of the JavaScript file specified by “http://domainA.com:80/resource/sample.js” is “http://domainA.com:80”.
Many browsers that are currently popular are designed according to a security model called single-origin policy, and browser scripts are restricted from sending HTTP requests to servers other than their origin.

FIG. 8 shows a state in which communication is blocked due to browser communication restrictions when script A arranged on server A attempts to acquire data B by executing a program on server B of another origin. It is an operation | movement conceptual diagram.
As shown in the figure, the script A belonging to the origin “http://domainA.com:80” can access the data A belonging to the same origin (step 802).
On the other hand, data B belonging to another origin “http://domainB.com:80” cannot be accessed because the transmission of the request is blocked by the communication restriction of the browser (step 805).

Next, FIG. 9 shows the operation of cross-origin access using the parallel process execution function.
If the parallel process execution function is used, if script B describing the access processing to data B is placed in advance on server B that receives cross-origin access, script A generates a child process and creates a child process. By executing the script B, the data B can be acquired via the script B.
The outline of the operation of FIG. 9 is shown below.
In step 905, the script A uses the API provided by the parallel process execution function to generate a child process that executes the script B.
In step 906, the script A uses the API provided by the parallel process execution function to perform inter-process communication with the child process, and passes the data A to the child process.
When the child process receives inter-process communication from the parent process, the child process starts execution of the script B specified in step 905.
In step 907, the script B uses the API provided by the parallel process execution function to acquire the origin information of the caller script and confirms that the origin of the caller script is the origin of the server A. If it can be confirmed, the process proceeds to step 908, and if it cannot be confirmed, the process is immediately interrupted. This is a mechanism for preventing access to data B from an unintended server.
In steps 908 to 910, script B accesses server B and acquires data B. Since the script B belongs to the same origin as the server B, the data B can be accessed without being restricted by the communication based on the single origin policy.
In step 911, the script B passes the acquired data B to the parent process script A by inter-process communication.

In the prior art described in Patent Document 1, there is a problem that the system operation cost borne by the service use organization is high.
The conventional technology has a mechanism in which data concealment processing (encryption / decryption processing) is concentrated and executed by the proxy server, and thus there is a problem that the processing load of the data concealment processing of the entire system is concentrated on the proxy server.
Furthermore, this processing load increases dramatically as the number of online services used by the service organization and the number of users using the online service increase, so the service organization maintains the overall system performance. In order to do so, it is necessary to frequently expand the processing performance of the proxy server. Conventionally, the trouble of frequently expanding the processing performance of the proxy server has increased the system operation cost of the service use organization.

  An object of the present invention is to realize a data protection system that achieves both confidential information secrecy for online service providers and reduction of system operation costs borne by service use organizations.

In order to achieve the above object, a data protection system according to the present invention includes a client terminal provided with a browser, an encryption script, a decryption script, and a key management server that stores an encryption key connected by a network within a service using organization, and further an online service. A data protection system for preventing leakage of confidential information from the online service server in a configuration in which the online service server providing the service and the network within the service using organization are connected by a public network such as the Internet,
The browser of the client terminal is
When transmitting data to the online service server, an encryption script and an encryption key are acquired from the key management server via the network within the service using organization, and the encrypted data of the input data is obtained by executing the encryption script. A first means of obtaining;
Second means for transmitting the encrypted data acquired by the first means to the online service server;
When drawing the data display screen received from the online service server, the decryption script and the encryption key are acquired from the key management server via the network within the service using organization, and the decryption script is executed to decrypt the display data. A third means for obtaining completed data;
And fourth means for rendering a data display screen using the decrypted data acquired by the third means.

The first means includes
Means for receiving a data input screen including an encryption request script from the online service server and executing the encryption request script in response to completion of data input to the data input screen by a user;
By executing the encryption request script, the input data input on the data input screen is collected, a child process of the browser is generated and the collected input data is transmitted to the child process, and the input data is used as an argument to the child process. Means for executing the cryptographic script;
Means for executing an authentication means of a caller script by executing an encryption script by a child process, and obtaining an encryption key from the key management server when the authentication is successful;
By executing the encryption script by the child process, the input data is encrypted with the acquired encryption key to generate encrypted data, and the generated encrypted data is used as the execution result to the encryption request script that is the caller of the child process. And means for transmitting.

Also, the third means is
Means for receiving a data display screen including a decryption request script and encrypted data from the online service server, and executing the decryption request script in response to occurrence of a screen drawing process of the data display screen;
By executing the decryption request script, the encrypted data included in the data display screen is collected, the child data of the browser is generated and the collected data is transmitted to the child process, and the encrypted data Means for causing the child process to execute the decryption script using as an argument,
Means for executing an authentication means of a caller script by executing a decryption script by a child process, and obtaining an encryption key from a key management server when authentication is successful;
By executing the decryption script by the child process, the encrypted data is decrypted with the acquired encryption key to generate decrypted data, and the generated decrypted data is used as the execution result to the decryption request script that is the caller of the child process. And means for transmitting.

Further, the caller script authentication means comprises:
The key management server includes means for storing a cross-access permission list that describes a combination of URL protocol, domain, and port number of a caller script that permits access;
The browser
Means for acquiring the cross-access permission list from the key management server by executing an encryption script or a decryption script;
Means for acquiring combination information of the protocol, domain, and port number of the URL of the caller script that generated the child process by executing the encryption script or the decryption script;
By executing the encryption script or the decryption script, it is confirmed whether the combination information of the acquired caller script of the child process is included in the cross access permission list. If included, the authentication result of the caller script Is determined to be successful, and if not included, the authentication result of the caller script is determined to be failure.

A data protection method according to the present invention includes: an online service server that provides an online service by connecting a client terminal including a browser, an encryption script, a decryption script, and a key management server that stores an encryption key through a network within a service use organization; A data protection method for preventing leakage of confidential information from the online service server in a configuration in which the network in the service using organization is connected by a public network such as the Internet,
The browser of the client terminal is
When transmitting data to the online service server, an encryption script and an encryption key are acquired from the key management server via the network within the service using organization, and the encrypted data of the input data is obtained by executing the encryption script. A first step of acquiring;
A second step of transmitting the encrypted data acquired in the first step to the online service server;
When drawing the data display screen received from the online service server, the decryption script and the encryption key are acquired from the key management server via the network within the service using organization, and the decryption script is executed to decrypt the display data. A third step of obtaining completed data;
And a fourth step of drawing a data display screen using the decrypted data acquired in the third step.

The first step includes
Receiving a data input screen including an encryption request script from the online service server, and executing the encryption request script in response to completion of data input to the data input screen by a user;
By executing the encryption request script, the input data input on the data input screen is collected, a child process of the browser is generated and the collected input data is transmitted to the child process, and the input data is used as an argument to the child process. Executing the cryptographic script;
Executing an authentication means of a caller script by executing an encryption script by a child process, and obtaining an encryption key from the key management server when authentication is successful;
By executing the encryption script by the child process, the input data is encrypted with the acquired encryption key to generate encrypted data, and the generated encrypted data is used as the execution result to the encryption request script that is the caller of the child process. And a step of transmitting.

The third step is
Receiving a data display screen including a decryption request script and encrypted data from the online service server, and executing the decryption request script in response to occurrence of a screen drawing process of the data display screen;
By executing the decryption request script, the encrypted data included in the data display screen is collected, the child data of the browser is generated and the collected data is transmitted to the child process, and the encrypted data Having the child process execute the decryption script with as an argument;
By executing the calling script authentication means by executing the decryption script by the child process, and when the authentication is successful, obtaining an encryption key from the key management server;
By executing the decryption script by the child process, the encrypted data is decrypted with the obtained encryption key to generate the decrypted data, and the decrypted request script which is the caller of the child process is generated using the generated decrypted data as the execution result. And the step of transmitting to.

Further, the caller script authentication means comprises:
The key management server includes a step of storing a cross-access permission list in which URL, protocol, domain, and port number combination information of a caller script that permits access is stored;
The browser
Obtaining the cross access permission list from the key management server by executing an encryption script or a decryption script;
Acquiring the URL, protocol, domain, and port number combination information of the caller script that generated the child process by executing the encryption script or the decryption script;
By executing the encryption script or the decryption script, it is confirmed whether the combination information of the acquired caller script of the child process is included in the cross access permission list. If included, the authentication result of the caller script Is determined to be successful, and if not included, the authentication result of the caller script is determined to be failure.

In the data protection system according to the present invention, the browser operated by each service user executes the data concealment processing (encryption / decryption processing) in a distributed manner. The key management server managed by the service using organization performs only the process of providing the encryption script, the decryption script, and the encryption key to the browser, and does not execute the data concealment process. For this reason, the processing load concerning data secrecy is not concentrated on the server, and the processing load on the key management server can be reduced as compared with the proxy server of the prior art.
Therefore, the service using organization does not need to frequently expand the server processing performance in order to maintain the system performance, and can reduce the investment cost for the server processing performance expansion.
As described above, it is possible to realize a data protection system that achieves both confidentiality of confidential information to online service providers and reduction of system operation costs borne by the service using organization.

Hereinafter, an embodiment for carrying out the present invention will be specifically described with reference to the drawings.
In the present embodiment, a description will be given of a mode for realizing data secrecy with respect to an online service server for a browser in which a browser function expansion plug-in is installed in advance. However, in implementing the present invention, if a browser having the same function as the browser function expansion plug-in is used, it is not necessary to install the plug-in, and the present invention is limited to the present embodiment using the plug-in. It is not something.
FIG. 1 is a system configuration diagram showing an embodiment of a data protection system according to the present invention.
In the data protection system according to the present embodiment, the client terminal 101 and the key management server 102 are connected by a service-use organization network 105, and the service-use organization network 105 is connected to the online service server 103 via the public network 104. Take the configuration to connect.

The client terminal 101 is a terminal operated by a user who uses the service in the service using organization. The client terminal 101 includes a browser 106 in which a browser function expansion plug-in 107 is installed.
The key management server 102 is a server managed by the service user organization, and stores information necessary for executing data encryption / decryption processing and provides the information to the browser 106.
The key management server 102 includes an encryption script 108, a decryption script 109, a cross access permission list 110, an encryption key management table 111, and an encryption key providing Web service 112.
The cross access permission list 110 is a file used for authentication processing of a caller script executed by the encryption script 108 and the decryption script 109. In the cross access permission list 110, origin information of a caller script that permits execution of the encryption script 108 and the decryption script 109 is described.

The online service server 103 is a server managed by an online service provider, and stores a web application program provided as a service to a service use organization.
The online service server 103 includes a web application program 113 including an encryption request script 115 and a decryption request script 116, and a database 114 that stores data handled by the web application.
Here, the encryption request script 115 included in the web application program 113 is incorporated into the web application program 113 so that the browser 106 is executed immediately before transmitting data from the client terminal 101 to the online service server 103.
The decryption request script 116 included in the web application program 113 is incorporated into the web application program 113 so that the browser 106 is executed immediately before the screen information is acquired from the online service server 103 and displayed.
The public network 104 is a network such as the Internet or VPN that connects between an online service provider and a service using organization. The service use company organization network 105 is a network managed by the service use organization, while the public network 104 is a network not managed by the service use organization.

FIG. 2 is a diagram illustrating a table configuration example of the encryption key management table 111.
In FIG. 2, a web application URL 201 is a URL such as a top page of a web application provided by an online service provider. In the data protection system of the present invention, the Web application URL is used as an identifier for uniquely identifying a service provided by an online service provider.
The user ID 202 is an identifier for uniquely identifying a user who uses a Web application issued by an online service provider to a service user.
The encryption key 203 is key information used for data encryption / decryption processing executed by the encryption script 108 and the decryption script 109.

Hereinafter, the operation of the system will be described. However, it is assumed that a user ID and a password necessary for using the service are issued in advance by each online service provider to each user of the service using organization.
Further, it is assumed that origin information of the Web application URL used by the service using organization is set in advance in the cross access permission list 110 stored in the key management server 102 by the system administrator of the service using organization.
In addition, the system administrator of the service using organization generates the encryption key 203 for each Web application URL 201 of the service to be used and the user ID 202 for using the service, and associates them with each other and registers them in the encryption key management table 111. It shall be.
In this embodiment, it is assumed that the encryption request script 116 is executed when the data transmission button is pressed on the data input screen generated by the Web application program 113.
In this embodiment, it is assumed that the decryption request script 117 is executed in response to a screen load event that is generated when the browser displays the data display screen generated by the Web application program 113.

First, the flow of the entire system will be described with reference to FIG.
Steps 301 to 303 are processes in which the browser 106 acquires a cookie including a user ID necessary for an encryption key acquisition process from the key management server 102.
A user operates the browser 106 to access the online service server 103. Then, login to the service is attempted using the user ID and password issued by the online service provider (step 301).
The online service server 103 authenticates the user with the user ID and password. If the authentication is successful, the online service server 103 generates a cookie including the user ID and transmits it to the browser 106. If the authentication fails, the browser 106 is notified that the authentication has failed and the processing is immediately interrupted (step 302).
The browser 106 stores a cookie including the user ID acquired in step 302 (step 303).
Steps 304 to 308 are processes for encrypting data when the browser 106 transmits data to the online service server 103.
In response to the user's operation, the browser 106 transmits a data input screen display request to the online service server 103 (step 304).
The online service server 103 transmits a data input screen including the encryption request script to the browser 106 as shown in the screen example of FIG. 6 (step 305).

Here, the data input screen will be described with reference to FIG.
The data input screen includes at least a form for a user to input data, a data transmission button 601 for the user to confirm data input, and an encryption request script 116. The encryption request script 116 is incorporated in the data input screen so as to be executed when the user presses the data transmission button 601.
When the user completes data input to the form on the data input screen, the user presses the data transmission button 601. Thereby, the encryption request script 116 is executed (step 306).
The encryption request script 116 downloads and executes the encryption script 108 stored in the key management server 102 by cross-origin access, and encrypts the data input to the form by the user as the execution result. get. Thereafter, the acquired encrypted data is transmitted to the online service server 103 (step 307).

The online service server 103 stores the encrypted data acquired in step 307 in the database 114 (step 308).
Steps 309 to 313 are processes for decrypting data when the browser 106 acquires encrypted data from the online service server 103 and displays a screen.
In response to the user's operation, the browser 106 transmits a display request for the data display screen to the online service server 103 (step 309).
The online service server 103 acquires data requested by the user from the database 114. Here, since the encrypted data is stored in the database 114 by the process of step 308, the online service server 103 acquires the encrypted data from the database 114 (step 310).
The online service server 103 transmits a data display screen including the encrypted data acquired in step 310 and the decryption request script to the browser 106.
Here, the encrypted data is stored in a JavaScript variable in the source code constituting the data display screen and transmitted to the browser 106 (step 311).

When the reception of the data display screen is completed, the browser 106 generates a screen load event for the data display screen. In response to the occurrence of this screen load event, the browser 106 executes the decryption request script 116 (step 312).
The decryption request script 116 downloads and executes the decryption script 109 stored in the key management server 102 by cross-origin access, and acquires decrypted data obtained by decrypting the encrypted data as an execution result. Then, using the acquired decrypted data, a data display screen shown in FIG. 7 is configured and displayed on the browser 106 (step 313).

Next, details of the operations of the encryption request script 115 and the encryption script 108 executed in step 307 will be described with reference to FIG.
In FIG. 4, steps 401 to 403 and steps 412 to 413 are operations of the encryption request script 115, and steps 404 to 411 are operations of the encryption script 108.
The encryption script 108 is executed by a child process generated by the encryption request script 115.
When the encryption request script 115 is executed by pressing the data transmission button 601 in step 306, the encryption request script 115 collects and acquires form input data input to the form (step 401). Data collection is performed by, for example, JavaScript access using a DOM (Document Object Model) function.

Next, the encryption request script 115 generates a child process for executing the encryption script 108 by using the API of the parallel process execution function provided by the browser function extension plug-in 107 (step 402).
The encryption request script 115 acquires the Web application URL from the page being accessed, and the user ID from the cookie stored in the browser 106 in step 303. Then, the form input data acquired in step 401 is added to these and transmitted to the child process by inter-process communication.
Upon receiving this inter-process communication, the child process downloads the encryption script 108 from the key management server 102 and starts executing it (step 403).

Steps 404 to 407 are caller script authentication processing.
The encryption script 108 transmits an acquisition request for the cross access permission list 110 to the key management server 102 (step 404).
The key management server 102 acquires the cross access permission list 110 (step 405).
The key management server 102 transmits the cross access permission list 110 acquired in step 405 to the browser 106 (step 406).

The cryptographic script 108 acquires the origin information of the calling script of the child process using the API provided by the parallel process execution function, and the acquired origin information is included in the cross access permission list 110 acquired in step 406. Check if it is. If the origin information is included in the cross access permission list 110, the process proceeds to step 408. If not included, the browser is notified that the encryption has failed, and the processing is immediately terminated (step 407).
When the encryption script 108 is executed according to the present embodiment, the origin information of the child process call source script is the origin of the encryption request script, that is, the origin of the web application URL of the service used by the user. Become. Since the origin of the Web application URL is described in advance in the cross access permission list 110 by the system administrator of the service using organization, the authentication process of the caller script is successful.

Steps 408 to 410 are processing for acquiring an encryption key from the key management server 102.
The encryption script 108 calls the encryption key providing Web service 112 provided by the key management server 102 using the user ID and Web application URL acquired in Step 403 as arguments (Step 408).
When receiving the web application URL and the user ID, the encryption key providing web service 112 acquires the encryption key 203 stored in association with the combination of the received web application URL and the user ID from the encryption key management table ( Step 409).
The encryption key providing Web service 112 transmits the encryption key acquired in step 409 to the browser 106 (step 410).

The encryption script 108 encrypts the form input data acquired in step 403 using the encryption key acquired in step 410, and generates encrypted data (step 411).
The encryption script 108 transmits the encrypted data acquired in step 411 to the encryption request script 115 by inter-process communication (step 412).
The encryption request script 115 transmits the encrypted data acquired in step 412 to the online service server 103 (step 413).

Next, details of operations of the decryption request script 116 and the decryption script 109 executed in step 313 will be described with reference to FIG.
In FIG. 5, steps 501 to 503 and steps 512 to 513 are operations of the decryption request script 116, and steps 504 to 511 are operations of the decryption script 109.
The decryption script 109 is executed by a child process generated by the decryption request script 116.
When the decryption request script 116 is executed due to the occurrence of the screen load event of the data display screen in step 312, the decryption request script 116 reads the JavaScript variable storing the encrypted data from the source code constituting the data display screen. The encrypted data is acquired (step 501).

Next, the decryption request script 116 generates a child process for executing the decryption script 109 using the API of the parallel process execution function provided by the browser function expansion plug-in 107 (step 502).
The decryption request script 109 acquires the Web application URL from the page being accessed, and the user ID from the cookie stored in the browser 106 in step 303. Then, the encrypted data acquired in step 501 is added to these and transmitted to the child process by inter-process communication. When receiving the inter-process communication, the child process starts executing the decryption script 109 (step 503).

The authentication process of the calling script from steps 504 to 507 of the decryption script 109 and the encryption key acquisition processing from steps 508 to 510 are respectively the steps 404 to 407 and steps 408 to 510 of the encryption script 108. Since this is the same as the above process, the description of the process is omitted.
The decryption script 109 decrypts the encrypted data acquired in step 503 with the encryption key acquired in step 510 to generate decrypted data (step 511).
The decryption script 109 transmits the decrypted data acquired in step 511 to the decryption request script 116 that is a process call source by inter-process communication (step 512).
The decryption request script 116 replaces the encrypted data on the data display screen with the decrypted data acquired in step 502, configures the data display screen, and displays it on the browser 106 (step 513).
The data display screen is configured by, for example, JavaScript access using the DOM function.

In the above embodiment, the user ID issued by the online service provider is used as the identifier for uniquely identifying the user. However, this may be a hash value of the user ID that is the result of executing the hash function with the user ID as an argument.
In this case, the system administrator of the service using organization receives a notification of the user ID and the hash value calculated from the user ID in advance from the online service provider, and registers the acquired hash value in the key management table 111 instead of the user ID 202. It shall be.
In step 302, if the user authentication is successful, the online service server 103 calculates a hash value of the user ID, generates a cookie including the hash value of the user ID, and transmits it. Hereinafter, all the processes using the user ID in the above embodiment are executed as processes using the hash value of the user ID.

1 is a system configuration diagram showing an embodiment of a data protection system according to the present invention. It is a figure which shows the table structure of a key management table. It is a flowchart which shows the process of the whole data protection system. It is a flowchart which shows the process of an encryption request script and an encryption script. It is a flowchart which shows the process of a decoding request script and a decoding script. It is a screen example of the data input screen which a browser displays. It is a screen example of the data display screen which a browser displays. It is a flowchart which shows the communication restriction | limiting based on the single origin policy of a browser. It is a flowchart which shows the operation | movement of the cross origin access using a parallel process execution function.

Explanation of symbols

101 Client terminal 102 Key management server 103 Online service server 108 Encryption script 109 Decryption script 111 Encryption key management table 115 Encryption request script 116 Decryption request script

Claims (8)

A client terminal provided with a browser and an encryption script, a decryption script, and a key management server that stores an encryption key are connected by a network that uses a service, and an online service server that provides an online service and the network that uses the service A data protection system for preventing leakage of confidential information from the online service server in a configuration connected by a public network such as the Internet,
The browser of the client terminal is
When transmitting data to the online service server, an encryption script and an encryption key are acquired from the key management server via the network within the service using organization, and the encrypted data of the input data is obtained by executing the encryption script. A first means of obtaining;
Second means for transmitting the encrypted data acquired by the first means to the online service server;
When drawing the data display screen received from the online service server, the decryption script and the encryption key are acquired from the key management server via the network within the service using organization, and the decryption script is executed to decrypt the display data. A third means for obtaining completed data;
And a fourth means for rendering a data display screen using the decrypted data acquired by the third means. The first means comprises:
Means for receiving a data input screen including an encryption request script from the online service server and executing the encryption request script in response to completion of data input to the data input screen by a user;
By executing the encryption request script, the input data input on the data input screen is collected, a child process of the browser is generated and the collected input data is transmitted to the child process, and the input data is used as an argument to the child process. Means for executing the cryptographic script;
Means for executing an authentication means of a caller script by executing an encryption script by a child process, and obtaining an encryption key from the key management server when the authentication is successful;
By executing the encryption script by the child process, the input data is encrypted with the acquired encryption key to generate encrypted data, and the generated encrypted data is used as the execution result to the encryption request script that is the caller of the child process. The data protection system according to claim 1, further comprising means for transmitting. The third means is
Means for receiving a data display screen including a decryption request script and encrypted data from the online service server, and executing the decryption request script in response to occurrence of a screen drawing process of the data display screen;
By executing the decryption request script, the encrypted data included in the data display screen is collected, the child data of the browser is generated and the collected data is transmitted to the child process, and the encrypted data Means for causing the child process to execute the decryption script using as an argument,
Means for executing an authentication means of a caller script by executing a decryption script by a child process, and obtaining an encryption key from a key management server when authentication is successful;
By executing the decryption script by the child process, the encrypted data is decrypted with the acquired encryption key to generate decrypted data, and the generated decrypted data is sent to the decryption request script that is the caller of the child process as the execution result The data protection system according to claim 1, further comprising: The caller script authentication means comprises:
The key management server includes means for storing a cross-access permission list that describes a combination of URL protocol, domain, and port number of a caller script that permits access;
The browser
Means for acquiring the cross-access permission list from the key management server by executing an encryption script or a decryption script;
Means for acquiring combination information of the protocol, domain, and port number of the URL of the caller script that generated the child process by executing the encryption script or the decryption script;
By executing the encryption script or the decryption script, it is confirmed whether the combination information of the acquired caller script of the child process is included in the cross access permission list. If included, the authentication result of the caller script 4. The data protection system according to claim 2, further comprising means for determining that the authentication result of the caller script is a failure if the authentication result of the caller script is not included. A client terminal provided with a browser and an encryption script, a decryption script, and a key management server that stores an encryption key are connected by a network that uses a service, and an online service server that provides an online service and the network that uses the service A data protection method for preventing leakage of confidential information from the online service server in a configuration connected by a public network such as the Internet,
The browser of the client terminal is
When transmitting data to the online service server, an encryption script and an encryption key are acquired from the key management server via the network within the service using organization, and the encrypted data of the input data is obtained by executing the encryption script. A first step of acquiring;
A second step of transmitting the encrypted data acquired in the first step to the online service server;
When drawing the data display screen received from the online service server, the decryption script and the encryption key are acquired from the key management server via the network within the service using organization, and the decryption script is executed to decrypt the display data. A third step of obtaining completed data;
And a fourth step of drawing a data display screen using the decrypted data acquired in the third step. The first step comprises:
Receiving a data input screen including an encryption request script from the online service server, and executing the encryption request script in response to completion of data input to the data input screen by a user;
By executing the encryption request script, the input data input on the data input screen is collected, a child process of the browser is generated and the collected input data is transmitted to the child process, and the input data is used as an argument to the child process. Executing the cryptographic script;
Executing an authentication means of a caller script by executing an encryption script by a child process, and obtaining an encryption key from the key management server when authentication is successful;
By executing the encryption script by the child process, the input data is encrypted with the acquired encryption key to generate encrypted data, and the generated encrypted data is used as the execution result to the encryption request script that is the caller of the child process. The data protection method according to claim 5, further comprising: a transmitting step. The third step is
Receiving a data display screen including a decryption request script and encrypted data from the online service server, and executing the decryption request script in response to occurrence of a screen drawing process of the data display screen;
By executing the decryption request script, the encrypted data included in the data display screen is collected, the child data of the browser is generated and the collected data is transmitted to the child process, and the encrypted data Having the child process execute the decryption script with as an argument;
By executing the calling script authentication means by executing the decryption script by the child process, and when the authentication is successful, obtaining an encryption key from the key management server;
By executing the decryption script by the child process, the encrypted data is decrypted with the obtained encryption key to generate the decrypted data, and the decrypted request script which is the caller of the child process is generated using the generated decrypted data as the execution result. The data protection method according to any one of claims 5 to 6, further comprising: The caller script authentication means comprises:
The key management server includes a step of storing a cross-access permission list in which URL, protocol, domain, and port number combination information of a caller script that permits access is stored;
The browser
Obtaining the cross access permission list from the key management server by executing an encryption script or a decryption script;
Acquiring the URL, protocol, domain, and port number combination information of the caller script that generated the child process by executing the encryption script or the decryption script;
By executing the encryption script or the decryption script, it is confirmed whether the combination information of the acquired caller script of the child process is included in the cross access permission list. If included, the authentication result of the caller script The data protection method according to any one of claims 6 to 7, further comprising: determining that the authentication result of the caller script is a failure if it is not included.

Images