JP2013090030A - Authentication management device and authentication management method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication management technique better suitable to store time-authenticated electronic data for an extended period.SOLUTION: Authentication of a clock-time when an electronic file 104 has existed is referred to as a time authentication. An authentication management device 100 includes: a data obtainment part for obtaining an electronic file 104 from a user; a synthesis part for relates the electronic file 104 with a pasteboard file including the file name of the electronic file 104 to generate a clipping PDF file; a time authentication information addition part for adding a new authentication token including information of an authentication clock-time and a hush value of the clipping PDF file to a time-authenticated clipping PDF file in the case of the clipping PDF file being time-authenticated; a data retention part for retaining the new authentication token-added clipping PDF file; and a notification part for notifying the user of completion of the time authentication when the new authentication token is added to the clipping PDF file.

Description

  The present invention relates to a technique for authentication management, and more particularly to a technique for managing time authentication of electronic data.

  “Time authentication” is authentication at the time when electronic data such as an electronic file existed, and is also referred to as electronic date authentication or time stamp. For time authentication, companies in Japan have been provided as system sales or services. Proof of the time when the electronic file existed is considered effective for proof of prior use rights in patent law and proof of prior invention in the United States.

  For example, in Japanese Patent Application Laid-Open No. 2004-228561, when the authentication at the time when electronic data existed is referred to as time authentication, the present applicant acquires a set of electronic data and memo data related thereto from a user via a network. If the time and time of the sachet data generated by the synthesizer and the synthesizer for generating one sachet data including the contents of the memo data acquired by the data acquisition unit and the set of electronic data, and the sachet data generated by the synthesizer, Time authentication information that can be tampered with, including time authentication information that includes authentication time information that has been authenticated in the time authentication and a hash value obtained by hashing the bag data generated by the combining unit. A time authentication information adding unit to be added to the data, an ID changing unit for including information on the authentication time of the packaging data in an ID for specifying the packaging data, and I The wrapper data information of the authenticated time is included in the ID by changing unit, proposes the authentication management apparatus and the return management unit that transmits to the user via the network, comprising: a for.

Japanese Patent No. 4681682

  In the authentication management device described in Patent Document 1, the time-authenticated packaging data is returned to the user. Accordingly, the user stores and manages the time-authenticated packaging data with his / her personal computer (PC) or the like.

Of the time-certified packaging data, intellectual property-related data and the like often need to be stored longer than the useful life of a general PC. For example, data related to intellectual property is generally stored in units of 10 years, whereas the general useful life of a PC determined by a company is 4 to 6 years, depending on the model. Therefore, if the time-authenticated packaging data is stored and managed on the user side, it is necessary to move the packaging data from the old PC to the new PC when updating the PC. However, there is a possibility that the packaging data is lost during this operation.
Or more generally, while the user is operating the PC in a normal operation, there is a possibility that the packaging data may be deleted unintentionally due to an operation error.

  The present invention has been made in view of these problems, and an object thereof is to provide an authentication management technique that is more suitable for long-term storage of electronic data subjected to time authentication.

  One embodiment of the present invention relates to an authentication management apparatus. When the authentication at the time when the electronic data existed is called time authentication, the authentication management device obtains electronic data from the user via the network, and the electronic data acquired by the data acquisition unit. A synthesizing unit that generates clipping data by associating electronic data acquired by the data acquiring unit with a mount file that includes a specified ID that can be searched and / or displayed, and clipping data generated by the synthesizing unit When the time authentication is performed, the time authentication information including the authentication time information that is the time authenticated in the time authentication and the hash value obtained by hashing the clipping data generated by the synthesis unit is time-authenticated. Time authentication information adding unit to be added to clipping data and time authentication information adding unit Therefore, a data holding unit that holds clipping data to which time authentication information is added, and a notification that notifies the user of completion of time authentication via the network when the time authentication information is added to the clipping data by the time authentication information addition unit A section.

  According to this aspect, the clipping data to which the time authentication information is added is held on the authentication management apparatus side, and the user can be notified of the completion of time authentication.

It should be noted that any combination of the above-described constituent elements, or those obtained by replacing the constituent elements and expressions of the present invention with each other between apparatuses, methods, systems, computer programs, recording media storing computer programs, and the like are also included in the present invention. It is effective as an embodiment of
Moreover, the case where the implementation subject of each component differs is also effective as an aspect of the present invention. For example, the implementation entity A performs processing from obtaining electronic data to generate clipping data, obtaining time authentication information, and adding time authentication information, and the clipping data to which the time authentication information is added is implemented. For example, the implementation entity B, which is different from the entity A, receives and holds it. More specifically, when the time certificate authority is another entity, the time certificate authority may hold the clipping data to which the time authentication information is added. Furthermore, each component may be constructed in a distributed manner on a virtualized computer system such as cloud computing as well as constructed on a single server.

  According to the present invention, it is possible to provide an authentication management technique that is more suitable for long-term storage of electronic data that has been time-authenticated.

It is the schematic which shows the electronic time authentication system containing the authentication management apparatus which concerns on embodiment. It is a block diagram which shows the function and structure of the authentication management apparatus of FIG. It is a data structure figure which shows an example of the user information holding | maintenance part of FIG. It is a typical screen figure of a login screen. It is a representative screen figure of a new upload screen. It is a flowchart which shows a series of processes in the authentication management apparatus of FIG.

  Hereinafter, the same or equivalent components, members, and processes shown in the drawings are denoted by the same reference numerals, and repeated description is appropriately omitted.

  FIG. 1 is a schematic diagram showing an electronic time authentication system 2 including an authentication management apparatus 100 according to an embodiment. The corporate research and development base 200 has a plurality of engineer terminals 202a to 202d used by engineers. Hereinafter, the engineer may be referred to as a user. The electronic time authentication system 2 gives time authentication to the electronic file generated at the research and development base 200 of the company. The electronic file may be a file in various formats, for example, a text format, an image format, or an audio format.

  The electronic time authentication system 2 includes an authentication management device 100, a PKI time authentication station 302, an archiving time authentication station 304, an archiving storage device 306, a PKICA station 400, and an archiving CA station 401. The authentication management apparatus 100 is connected to a plurality of engineer terminals 202a to 202d via a network such as the Internet (not shown). The authentication management apparatus 100 and each time certificate authority, the PKI time certificate authority 302 and the PKICA station 400, the archiving time certificate authority 304, and the archiving CA station 401 are also connected by a network (not shown).

  Engineers convert experiment notes, experiment data, idea memos, etc. that arise in daily research and development into electronic files using engineer terminals assigned to each person. The engineer uploads the electronic file thus generated to the authentication management apparatus 100 periodically, for example, once a day.

The authentication management apparatus 100 acquires the uploaded electronic file 104, and generates a clipping PDF (Portable Document Format) file including the acquired electronic file 104.
When a public key infrastructure (PKI) method is designated as the authentication method, the authentication management apparatus 100 generates a new authentication hash value 106 of the PKI method by hashing the clipping PDF file according to the PKI method, and for the new authentication. The hash value 106 is transmitted to the external PKI time certificate authority 302.
When the archiving method is designated as the authentication method, the authentication management apparatus 100 generates a new authentication hash value 107 of the archiving method by hashing the clipping PDF file according to the archiving method, and the new authentication hash value 107 is transmitted to the external archiving time certification authority 304.

When the PKI method is designated as the authentication method, the PKI time certificate authority 302 adds time information to the received new authentication hash value 106. It can be said that when the time information is added to the new authentication hash value 106, it is authenticated that the electronic file 104 included in the clipping PDF file exists at that time (hereinafter referred to as authentication time).
The PKI time certificate authority 302 encrypts the new authentication hash value to which the authentication time information is added with the private key of the local station, and transmits the PKI token 108 that can be detected as a result of the encryption to the authentication management apparatus 100. To do.

When the archiving method is designated as the authentication method, the archiving time certificate authority 304 adds authentication time information to the received new authentication hash value 107. The archiving time authentication station 304 stores the new authentication hash value to which the authentication time information is added as an archiving token in the archiving storage device 306 connected to or within the local station. In addition, the archiving time certificate authority 304 transmits the archiving token 109 to the authentication management apparatus 100.
The archiving CA station 401 authenticates whether the archiving time authentication station 304 adds valid authentication time information.

  The authentication management apparatus 100 associates the PKI token 108 received from the PKI time certificate authority 302 or the archiving token 109 (hereinafter collectively referred to as a new authentication token) received from the archiving time certificate authority 304 with the clipping PDF file. In this way, a clipping PDF file associated with the new authentication token is generated as the clipping PDF file 110 with time authentication. The authentication management apparatus 100 holds the clipping PDF file 110 with time authentication in the authentication management apparatus 100 or the holding unit 102 connected to the authentication management apparatus 100, or for example, a cloud service outside the electronic time authentication system 2 Use and hold.

  The authentication management apparatus 100 notifies the technician terminal that is the transmission source of the electronic file 104 by e-mail or the like that the time authentication has been completed. The technician may manage time authentication of the electronic file using the notification.

  In the PKI method, when proving that the electronic file 104 included in the clipping PDF file 110 with time authentication exists at the authentication time, the engineer first downloads the clipping PDF file 110 with time authentication from the authentication management apparatus 100. . The engineer obtains the public key from the PKICA station 400, decrypts the PKI token 108, and takes out the new authentication hash value 106. The hash value calculated by the technician from the clipping PDF file 110 with time authentication is compared with the new authentication hash value 106 extracted from the PKI token 108. If these hash values match, the time authentication is performed. It can be proved that the electronic file included in the attached clipping PDF file 110 exists at the authentication time. In addition, it can be proved that the electronic file has not been changed (tampered) between the authentication time and the present time.

  In the archiving method, when proving that the electronic file included in the clipping PDF file 110 with time authentication exists at the authentication time, the engineer first downloads the clipping PDF file 110 with time authentication from the authentication management apparatus 100. . The engineer compares the archiving token 109 of the time-authenticated clipping PDF file 110 with the archiving token stored in the archiving storage device 306. If they match, it can be proved that the electronic file included in the clipping PDF file 110 with time authentication exists at the authentication time. In addition, it can be proved that the electronic file has not been changed (tampered) between the authentication time and the present time.

  FIG. 2 is a block diagram illustrating the function and configuration of the authentication management apparatus 100. Each block shown here can be realized by hardware such as a computer (CPU) (central processing unit) and other elements and mechanical devices, and software can be realized by a computer program or the like. Here, The functional block realized by those cooperation is drawn. Therefore, it is understood by those skilled in the art who have touched this specification that these functional blocks can be realized in various forms by a combination of hardware and software.

  The authentication management apparatus 100 includes a login unit 40, a data acquisition unit 38, an optical character recognition unit 24, a synthesis unit 14, a hashing unit 16, a time authentication information addition unit 20, an electronic data modification unit 32, A notification unit 28, a user information holding unit 44, and a data holding unit 36 for holding a time-authenticated clipping PDF file are provided.

  FIG. 3 is a data structure diagram illustrating an example of the user information holding unit 44. The user information holding unit 44 holds a user ID, a password, and an e-mail address in association with each other. The user ID is an ID that identifies a user of the authentication management apparatus 100.

Returning to FIG. 2, when the login unit 40 receives a login request from at least one of the plurality of engineer terminals 202a to 202d, the login screen 502 (described later in FIG. 4) is displayed on the monitor of the terminal that issued the login request. Display.
The login unit 40 acquires the user ID and password input on the login screen 502. When the acquired user ID and password pair matches one of the user ID and password pairs registered in the user information holding unit 44, the login unit 40 receives the login and communicates with the terminal that issued the login request. Start a session.
If the acquired set of user ID and password does not match any of the set of user ID and password registered in the user information holding unit 44, the login unit 40 returns an error to the terminal that issued the login request, not allowed.
Note that domain authentication may be used in the login unit 40.

  The data acquisition unit 38 displays a new upload screen 504 (described later in FIG. 5) on the monitor of the engineer terminal where the session is started (hereinafter referred to as an in-session terminal). In the new upload screen 504, the data acquisition unit 38 prompts the user of the terminal in session to select an electronic file subject to time authentication from among the electronic files stored in the terminal in session. The data acquisition unit 38 acquires the electronic file subject to time authentication selected by the user on the new upload screen 504 via the network.

  When the electronic file acquired by the data acquisition unit 38 includes an image of a document, the optical character recognition unit 24 converts the image into a file that can be edited by a computer, for example, a text file. A known OCR (Optical Character Recognition) technique may be used for this conversion.

  The synthesizing unit 14 generates a mount PDF file that includes an ID for identifying the electronic file acquired by the data acquiring unit 38, that is, a file name in a form that can be searched and / or displayed. The synthesizing unit 14 generates a clipping PDF file by attaching the electronic file acquired by the data acquiring unit 38 to the mount PDF file. At this time, if a text format file is obtained as a result of conversion by the optical character recognition unit 24, the synthesis unit 14 attaches the text format file to the mount PDF file.

  The hashing unit 16 hashes the clipping PDF file generated by the synthesizing unit 14 using a predetermined hash function based on an authentication method that may be selected in advance by the user, and obtains a new authentication hash value. The hashing unit 16 transmits the new authentication hash value to the PKI time certificate authority 302 when the PKI method is selected, and to the archiving time certificate authority 304 when the archiving method is selected. .

The time authentication information adding unit 20 acquires a new authentication token corresponding to the new authentication hash value transmitted by the hashing unit 16 from the time certificate authority. The time authentication information adding unit 20 adds the acquired new authentication token to the clipping PDF file generated by the combining unit 14 and corresponding to the acquired new authentication token. In particular, the time authentication information adding unit 20 embeds a new authentication token in the clipping PDF file.
The time authentication information adding unit 20 causes the data holding unit 36 to hold a clipping PDF file with time authentication, which is a clipping PDF file in which a new authentication token is embedded.

  The electronic data modification unit 32 modifies the electronic file by adding, that is, writing, the authentication time information included in the new authentication token to the corresponding electronic file. The modified electronic file may include authentication time information in a displayable format.

  When the new authentication token is embedded in the clipping PDF file by the time authentication information adding unit 20, the notification unit 28 notifies the user of completion of time authentication via the network. There are at least the following four modes of notification.

1. The time authentication information adding unit 20 generates a copy of the token before embedding the new authentication token. The notification unit 28 extracts authentication time information from the token copy. The notification unit 28 notifies the information of the extracted authentication time to the transmission source of the electronic file included in the clipping PDF file with time authentication. The notification unit 28 refers to the user information holding unit 44 to obtain the email address of the user who sent the electronic file, and sends an email containing the file name and authentication time information of the electronic file to the email address. You may send it.

2. The notification unit 28 generates a sending file by removing the electronic file from the clipping PDF file with time authentication. The notification unit 28 transmits the generated file for transmission to the user. This transmission may be realized, for example, in the form of being attached to an e-mail, or may be realized by guiding the user to a predetermined download site.

3. The notification unit 28 performs a predetermined compression process on the clipping PDF file with time authentication to generate a compressed file. This compression process is desirably a compression process that can achieve a higher degree of compression. The notification unit 28 transmits the compressed file to the user. This transmission may be realized, for example, in the form of being attached to an e-mail, or may be realized by guiding the user to a predetermined download site. Note that the compressed file for storage is preferably a compressed file that has been subjected to a reversible compression process in consideration of a case where time authentication is verified later.

4). The notification unit 28 transmits the electronic file modified by the electronic data modification unit 32 to the transmission source user.

  In these cases, in notification of completion of time authentication, the notification unit 28 transmits data of a smaller size different from the clipping PDF file with time authentication to the user. Therefore, the storage capacity required for the user can be reduced. When verification is necessary, the original clipping PDF file with time authentication may be obtained from the electronic time authentication system 2 each time. If it is stored in a compressed form, you may order a thawed one.

  FIG. 4 is a representative screen diagram of the login screen 502. The login screen 502 includes a user ID input area 530, a password input area 532, and an OK button 534. When a user ID is input in the user ID input area 530 and a password is input in the password input area 532 and the OK button 534 is pressed, the login unit 40 acquires the input user ID and password.

  FIG. 5 is a representative screen diagram of the new upload screen 504. The new upload screen 504 includes an upload target file name input area 536, a reference button 538, an upload execution button 540, a file list area 542, a delete button 544, and a next button 546. In the upload target file name input area 536, the file name of the electronic file subject to time authentication is input by browsing the storage area of the terminal during the session by pressing the direct input or browse button 538. When the upload execution button 540 is pressed, the electronic file having the file name input in the upload target file name input area 536 is uploaded from the terminal in session to the authentication management apparatus 100. The file list area 542 displays information on the uploaded electronic file such as the file name and capacity. When the delete button 544 is pressed, the upload of the electronic file selected in the file list area 542 is cancelled. When the next button 546 is pressed, the screen changes. At this time, the data acquisition unit 38 acquires the electronic file uploaded so far.

  In the above-described embodiment, examples of the holding unit are a hard disk and a memory. Based on the description in this specification, each unit is realized by a CPU (not shown), an installed application program module, a system program module, a memory that temporarily stores the contents of data read from the hard disk, and the like. It is understood by those skilled in the art who have touched this specification that they can do this.

  The operation of the authentication management apparatus 100 configured as above will be described. FIG. 6 is a flowchart showing a series of processing in the authentication management apparatus 100. The data acquisition unit 38 acquires an electronic file from the user via the network (S202). The synthesizing unit 14 generates a clipping PDF file including the acquired electronic file (S204). The time authentication information adding unit 20 embeds a new authentication token in the clipping PDF file (S206). The time authentication information adding unit 20 registers the clipping PDF file with time authentication in the data holding unit 36 (S208). The notification unit 28 notifies the user of completion of time authentication (S210).

  According to the authentication management apparatus 100 according to the present embodiment, after the time authentication of the electronic file, the user is notified of the completion of the time authentication, and the clipping PDF file with time authentication itself is a holding unit on the electronic time authentication system 2 side. 102 or the data holding unit 36. Therefore, the user can easily acquire the clipping PDF file with time authentication by making an inquiry to the electronic time authentication system 2 based on the notification. Thereby, it is possible to reduce the possibility that the clipping PDF file with time authentication is lost due to circumstances of the user terminal such as updating of the user terminal.

  In particular, in many cases, intellectual property-related electronic files usually need to be stored longer than the useful life of a general PC. Furthermore, there is generally an expiration date for time authentication, and it is necessary to update the authentication each time the expiration date comes. Therefore, the number of electronic files to be stored and managed increases with each update. In such a situation, the user uses the authentication management service using the authentication management apparatus according to the present embodiment, so that the user can use the time-authenticated clipping PDF file or the one whose time authentication has been updated. Since it is not necessary to save, the storage capacity of the user terminal can be saved. Further, the capacity required for communication between the electronic time authentication system 2 and the user terminal can be reduced.

  In addition, by holding the time-authenticated clipping PDF file in the electronic time authentication system 2, the electronic time authentication system 2 can cope with the search for the file.

  In recent years, cloud services for data storage have been provided by various business operators. Here, when each company and each individual uses such a cloud service for storing a time-authenticated clipping PDF file, the capacity used by each company is relatively small and often expensive. On the other hand, in the authentication management apparatus 100 according to the present embodiment, when storing a clipping PDF file with time authentication using such a cloud service, many clipping PDF files with time authentication stored by many users. Can be stored together in the cloud, which can be cost effective.

  In recent years, in order to ensure objectivity, an increasing number of companies store important information in the company in an external storage service. The authentication management service using the authentication management apparatus 100 according to the present embodiment matches such a flow, and can be advantageous in securing the objectivity of the clipping PDF file with time authentication.

  From the experience of the inventor as a person skilled in the art, it is relatively rare for a user to verify the time authentication of a time-recognized clipping PDF file, and most time-recognized clipping PDF files are stored for a long time without being verified. It becomes. In such a situation, the present inventor is more likely to save the time authentication on the electronic time authentication system 2 side as in the present embodiment than to save the clipping PDF file with time authentication on the user side. I came up with the idea of more efficiently managing the attached clipping PDF files.

  The configuration and operation of the authentication management apparatus according to the embodiment have been described above. These embodiments are exemplifications, and it is understood by those skilled in the art that various modifications can be made to each component and combination of processes, and such modifications are within the scope of the present invention. .

  In the embodiment, the case where the PKI time certification authority 302 and the archiving time certification authority 304 are external time certification authorities has been described. However, the present invention is not limited to this. It may have the function of at least one of the stations 304.

  In the embodiment, the case has been described in which the time authentication is performed on the electronic file attached to the clipping PDF file by performing the time authentication, but the present invention is not limited to this. For example, the electronic file may be directly time-authenticated without using the clipping PDF file.

  DESCRIPTION OF SYMBOLS 14 Composition part, 20 Time authentication information addition part, 24 Optical character recognition part, 28 Notification part, 32 Electronic data modification part, 36 Data holding part, 38 Data acquisition part, 100 Authentication management apparatus

Claims (8)

When the authentication of the time when electronic data existed is called time authentication,
A data acquisition unit for acquiring electronic data from a user via a network;
Clipping data is generated by associating the electronic data acquired by the data acquisition unit with a mount file that includes an ID specifying the electronic data acquired by the data acquisition unit in a form that can be searched and / or displayed. A synthesis unit;
When the clipping data generated by the combining unit is time-authenticated, authentication time information that is the time authenticated in the time authentication and a hash value obtained by hashing the clipping data generated by the combining unit A time authentication information adding unit for adding the time authentication information including the time authentication clipping data to the time-authenticated clipping data;
A data holding unit for holding clipping data to which time authentication information is added by the time authentication information adding unit;
An authentication management apparatus comprising: a notification unit that notifies a user of completion of time authentication via a network when time authentication information is added to clipping data by the time authentication information adding unit.   The authentication management apparatus according to claim 1, wherein the notification unit notifies the user of information on authentication time.   3. The authentication management apparatus according to claim 1, wherein the notification unit transmits data obtained by removing electronic data from clipping data to which time authentication information is added by the time authentication information adding unit to the user. When the electronic data acquired by the data acquisition unit includes an image of a document, it further comprises an optical character recognition unit that converts the image into data in a format that can be edited by a computer.
The authentication management apparatus according to claim 1, wherein the combining unit associates data obtained as a result of conversion by the optical character recognition unit with the mount file.   5. The notification unit according to claim 1, wherein the notification unit performs a predetermined compression process on the clipping data to which the time authentication information is added by the time authentication information addition unit, and transmits the compressed data obtained as a result to the user. The authentication management device according to any one of the above. An electronic data modification unit that modifies the electronic data by adding the information of the authentication time included in the time authentication information to the electronic data acquired by the data acquisition unit;
6. The authentication management apparatus according to claim 1, wherein the notification unit transmits electronic data modified by the electronic data modification unit to a user. When the authentication of the time when electronic data existed is called time authentication,
Obtaining electronic data from a user via a network;
Generating clipping data by associating the acquired electronic data with a mount file that includes an ID identifying the acquired electronic data in a form that can be searched and / or displayed;
When the generated clipping data is time-authenticated, time authentication information including authentication time information that is the time authenticated in the time authentication and a hash value obtained by hashing the generated clipping data, Adding to time-recognized clipping data;
Holding clipping data to which time authentication information is added; and
And a step of notifying a user of completion of time authentication via a network when time authentication information is added to clipping data. When the authentication of the time when electronic data existed is called time authentication,
A function of acquiring electronic data from a user via a network;
A function of generating clipping data by associating the acquired electronic data with a mount file that includes an ID that identifies the acquired electronic data in a form that can be searched and / or displayed; and
When the generated clipping data is time-authenticated, time authentication information including authentication time information that is the time authenticated in the time authentication and a hash value obtained by hashing the generated clipping data, A function to add to time-certified clipping data,
A function to hold clipping data with time authentication information added,
A computer program for causing a computer to realize a function of notifying a user of completion of time authentication via a network when time authentication information is added to clipping data.

Images