JP2015162785A - Data utilization apparatus, encryption data distribution system, data utilization method, encryption data distribution method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a data utilization apparatus capable of appropriately operate key information following attribute information that may change with time.SOLUTION: A data utilization apparatus includes: an encryption data control unit that transmits an encryption data request, receives attribute information, encryption data including a decryption condition, and identification information for the encryption data, outputs a decryption key acquisition request, and acquires a decryption key to decrypt the encryption data including the decryption condition; a key control unit that searches for a decryption key, outputs an effective decryption key in the case that the effective decryption key exists, transmits a key generation request in the case that no effective decryption key exists, and receives a decryption key to output the received decryption key; and an attribute control unit that searches for attribute information when having received an attribute information acquisition request, transmits effective attribute information in the case that the effective attribute information exists, and externally receives updated attribute information to transmit the received attribute information in the case that no effective attribute information exists.

Description

  The present invention relates to a data utilization apparatus that decrypts and uses encrypted data, an encrypted data distribution system that distributes encrypted data, a data utilization method, an encrypted data distribution method, and a program.

  For example, in an information system for a mobile terminal, when controlling functions of the mobile terminal such as data browsing or application activation, it is required to control these functions autonomously according to the environment in which the mobile terminal is used. May be. In this case, information (for example, position information and sensor information) related to the surrounding environment of the mobile terminal (user) can be used as attribute information. The attribute information acquired in this way may change with time. As an example of an application that uses attribute information, there is an IP simulcast radio that confirms the location of a terminal by using a connection destination IP address. Non-Patent Document 1 discloses a method for acquiring attribute information in an application that uses attribute information.

Ryota Sato, Yoshimori Chika, Tetsuya Okuda, Shigeru Higuchi, "Implementation and Evaluation of Functional Control Mechanisms for Smartphones in Use Environment", IEICE Technical Report, IEICE, 2013 February, 112, 466 (LOIS2012 69-107), pp. 203-208

  Non-Patent Document 1 discloses a method for acquiring attribute information, but does not organize a method for managing attribute information. Since position information and sensor information may change dynamically depending on the situation, it is necessary to manage how information once acquired is treated as attribute information. For example, the problem is how to manage the cache / valid period / update interval of the attribute information acquired in this way. Further, when key generation is performed based on the acquired attribute information, it is necessary to appropriately operate the key information following attribute information that may change dynamically. Since many conditions that can be taken as attribute information are assumed, it is necessary to deal with a plurality of conditions.

  Therefore, an object of the present invention is to provide a data utilization apparatus that can appropriately operate key information following attribute information that may change with time.

  The data utilization apparatus of the present invention includes an encrypted data control unit and a key control unit.

  The encrypted data control unit transmits the encrypted data request to the encrypted data transmitting device, receives the encrypted data and the identification information of the encrypted data from the encrypted data transmitting device, and receives the decryption key acquisition request as a key. Output to the control unit, obtain the decryption key from the key control unit, and decrypt the encrypted data.

  The key control unit searches for a corresponding decryption key when receiving a decryption key acquisition request, and if there is a corresponding decryption key, outputs the corresponding decryption key to the encrypted data control unit. In some cases, attribute information, which may change with time, and encrypted data identification information are paired, and the paired information is sent to the key generation device as a key generation request and decrypted from the key generation device. The key is received, and the received decryption key is output to the encrypted data control unit.

  According to the data utilization device of the present invention, key information can be appropriately operated following attribute information that may change over time.

1 is a block diagram illustrating a device configuration of an encrypted data distribution system according to a first embodiment. 5 is a flowchart showing each operation of a data utilization method executed by the data utilization apparatus according to the first embodiment. FIG. 3 is a block diagram illustrating details of each device included in the encrypted data distribution system according to the first embodiment. FIG. 3 is a block diagram showing details of each configuration included in the data utilization device of the first embodiment. FIG. 3 is a block diagram illustrating details of each component included in the data use device, the encrypted data transmission device, and the key generation device according to the first embodiment. FIG. 4 is a first sequence diagram illustrating a part of the operation of the encrypted data distribution system according to the first embodiment. FIG. 5 is a second sequence diagram illustrating a part of the operation of the encrypted data distribution system according to the first embodiment. FIG. 9 is a third sequence diagram illustrating a part of the operation of the encrypted data distribution system according to the first embodiment. FIG. 10 is a fourth sequence diagram illustrating an update operation of attribute information and a decryption key of the encrypted data distribution system according to the first embodiment.

  Hereinafter, embodiments of the present invention will be described in detail. In addition, the same number is attached | subjected to the structure part which has the same function, and duplication description is abbreviate | omitted.

  The outline of each device included in the encrypted data distribution system of the first embodiment will be described below with reference to FIG. FIG. 1 is a block diagram showing a device configuration of an encrypted data distribution system 1000 according to the present embodiment. As illustrated in FIG. 1, the encrypted data distribution system 1000 according to the present exemplary embodiment includes a data utilization device 1, an encrypted data transmission device 2, an attribute providing device 3, and a key generation device 4. It is assumed that the data use device 1, the encrypted data transmission device 2, the attribute providing device 3, and the key generation device 4 are connected to be communicable wirelessly or wired via the network 9. The attribute providing device 3 can be omitted depending on circumstances. The data utilization device 1 includes an encrypted data control unit 11, a key control unit 12, and an attribute control unit 13.

  Hereinafter, the operation of the data utilization device 1 will be described. The encrypted data control unit 11 transmits an encrypted data request to the encrypted data transmission device 2, and includes encryption information including attribute information that is information that may change with time from the encrypted data transmission device 2 and a decryption condition. The encrypted data and the identification information of the encrypted data are received, the decryption key acquisition request is output to the key control unit 12, the decryption key is acquired from the key control unit 12, and the encrypted data including the decryption condition is decrypted To do. The key control unit 12 searches for the decryption key corresponding to the reception of the decryption key acquisition request, and outputs the corresponding decryption key to the encrypted data control unit 11 when there is a corresponding decryption key. In other cases, if the attribute information is included in the decryption key acquisition request, the key control unit 12 uses the acquired attribute information, and if the attribute information is not included in the decryption key acquisition request. Acquires attribute information from the attribute control unit 13, uses the acquired attribute information, transmits a set of attribute information and identification information of encrypted data to the key generation device 4 as a key generation request, and decrypts from the key generation device 4 The key is received, and the received decryption key is output to the encrypted data control unit 11. The attribute control unit 13 searches the attribute information when receiving an attribute information acquisition request from the encrypted data transmission device 2. If there is valid attribute information, the attribute control unit 13 determines the valid attribute information. In other cases, the latest attribute information is received from the outside (the attribute providing device 3 if the attribute providing device 3 exists), and the received attribute information is sent to the encrypted data transmitting device 2. Send.

  The operation of the data utilization apparatus 1 described above will be described again in time series with reference to the flowchart of FIG. FIG. 2 is a flowchart showing each operation of the data utilization method executed by the data utilization apparatus 1 of this embodiment. As shown in FIG. 2, first, the encrypted data control unit 11 transmits an encrypted data request to the encrypted data transmission device 2 (S11a). Next, the attribute control unit 13 searches for attribute information that is information that may change with time when an attribute information acquisition request is received from the encrypted data transmission device 2, and there is valid attribute information. In this case, valid attribute information is transmitted to the encrypted data transmitting apparatus 2, otherwise the latest attribute information is received from the outside, and the received attribute information is transmitted to the encrypted data transmitting apparatus 2 ( S13). Next, the encrypted data control unit 11 receives the attribute information, the encrypted data including the decryption condition, and the identification information of the encrypted data from the encrypted data transmitting apparatus 2, and controls the decryption key acquisition request. The data is output to the unit 12 (S11b). Next, when the decryption key acquisition request is received, the key control unit 12 searches for a decryption key corresponding to the encrypted data including the decryption condition. The data is output to the encrypted data control unit 11 (S12). In other cases, if the attribute information is included in the decryption key acquisition request, the key control unit 12 uses the acquired attribute information, and if the attribute information is not included in the decryption key acquisition request. Acquires attribute information from the attribute control unit 13, uses the acquired attribute information, transmits a set of attribute information and identification information of encrypted data to the key generation device 4 as a key generation request, and decrypts from the key generation device 4 The key is received, and the received decryption key is output to the encrypted data control unit 11 (S12). Next, the encrypted data control unit 11 acquires a decryption key from the key control unit 12 and decrypts the encrypted data including the decryption condition (S11c).

  Next, with reference to FIG. 3, each structure of each apparatus which comprises the encryption data distribution system 1000 of a present Example is demonstrated in detail. FIG. 3 is a block diagram showing details of each device included in the encrypted data distribution system 1000 of this embodiment. In the following description, the attribute providing device 3 will be described as an external device. However, as described above, the attribute providing device 3 is not essential and may exist in the data using device 1 as an attribute providing function. It is sufficient that at least one means for providing information exists as an internal function or an external device. As illustrated in FIG. 3, the encrypted data control unit 11 of the data utilization device 1 includes an encrypted data request unit 111, an encrypted data acquisition unit 112, and an encrypted data decryption unit 113. The key control unit 12 includes a key acquisition unit 121 and a key management unit 122. The attribute control unit 13 includes an attribute acquisition unit 131 and an attribute management unit 132. The encrypted data transmission device 2 includes an encrypted data transmission unit 21 and an attribute request unit 22. The attribute providing device 3 includes an attribute information transmission unit 31. The key generation device 4 includes a key generation unit 41.

  Next, details of each component will be described with reference to FIGS. FIG. 4 is a block diagram showing details of each component included in the data utilization device 1 of this embodiment. FIG. 5 is a block diagram illustrating details of each component included in the data use device 1, the encrypted data transmission device 2, and the key generation device 4 of the present embodiment. As shown in FIG. 4, the encrypted data decryption unit 113 of this embodiment includes a first decryption key acquisition request unit 113a, a decryption unit 113b, and a decryption permission / inhibition determination unit 113c. The key acquisition unit 121 includes a decryption key output unit 121a, a decryption key search unit 121b, a first attribute information acquisition request unit 121c, a first key generation request unit 121d, a first key storage request unit 121e, and a second It includes a key generation request unit 121f and a second key storage request unit 121g. The key management unit 122 includes a key search result notification unit 122a, a first key storage result notification unit 122b, a first attribute information update unit 122c, a retention period update unit 122d, a second decryption key acquisition request unit 122e, A second key storage result notifying unit 122f and a key storage unit 122g are included. The key storage unit 122g stores attribute information and a decryption key, which will be described later. The attribute information is stored together with the expiration date information, and the decryption key is stored together with a retention period described later. The attribute information that has expired and the decryption key that has exceeded the retention period are deleted from the key storage unit 122g. The attribute acquisition unit 131 includes an attribute information search unit 131a, a second attribute information acquisition request unit 131b, an attribute information storage request unit 131c, and an attribute transmission unit 131d.

  As shown in FIG. 5, the attribute management unit 132 includes an attribute search result notification unit 132a, an attribute storage result notification unit 132b, a first attribute output unit 132c, a second attribute information update unit 132d, and a second attribute output. Part 132e and attribute information storage part 132f. The attribute information storage unit 132f stores attribute information, which will be described later, together with expiration date information. The attribute information that has expired is deleted from the attribute information storage unit 132f.

  The encrypted data transmission unit 21 of the encrypted data transmission device 2 includes a third attribute information acquisition request unit 21a and a data transmission unit 21b. The attribute request unit 22 includes an encrypted data output unit 22a and a fourth attribute information acquisition request unit 22b. The key generation unit 41 of the key generation device 4 includes a first decryption key generation unit 41a, a first decryption key transmission unit 41b, a second decryption key generation unit 41c, and a second decryption key transmission unit 41d.

  Hereinafter, the first sequence which is a part of the operation of the encrypted data distribution system 1000 according to the present embodiment will be described with reference to FIG. FIG. 6 is a first sequence diagram illustrating a part of the operation of the encrypted data distribution system 1000 according to the present embodiment. In the first sequence diagram, the entire operation of the encrypted data distribution system 1000 of the present embodiment is described, but the details of the operations shown in the second sequence diagram and the third sequence diagram included in the middle are described. It is omitted. In the figure, the first sequence diagram is represented as “sequence (1)”, the second sequence diagram is represented as “sequence (2)”, and the third sequence diagram is represented as “sequence (3)”. Is done. A box with “ref” in a sequence diagram is a symbol indicating that another sequence diagram shown in the box should be referred to. A box with “alt” in the figure is a symbol indicating that any operation divided by a dotted line in the box is executed by a conditional branch.

  As illustrated in FIG. 6, first, the encrypted data request unit 111 transmits an encrypted data request to the encrypted data transmission device 2 (S111). When receiving the encrypted data request, the third attribute information acquisition request unit 21a of the encrypted data transmission unit 21 of the encrypted data transmission device 2 transmits an attribute information acquisition request to the attribute request unit 22 (S21a). The attribute request unit 22 acquires or receives attribute information that is information that may change with time (second sequence described later). The encrypted data output unit 22a of the attribute request unit 22 outputs the acquired or received attribute information and encrypted data including the decryption condition (S22a). The data transmission unit 21b of the encrypted data transmission unit 21 transmits the attribute information, the encrypted data including the decryption condition, and the identification information of the encrypted data to the encrypted data control unit 11 (S21b).

  The encrypted data acquisition unit 112 of the encrypted data control unit 11 receives the attribute information, the encrypted data including the decryption conditions, and the identification information of the encrypted data from the encrypted data transmission device 2, and receives the decryption request. Output (S112). The first decryption key acquisition request unit 113a of the encrypted data decryption unit 113 acquires the decryption request and outputs the decryption key acquisition request to the key control unit 12 (S113a). Before executing the decryption key acquisition request (S113a), the decryptability determination unit 113c may determine whether the encrypted data can be decrypted by comparing the acquired attribute information with the decryption conditions included in the encrypted data. As a result of the determination as to whether or not decryption is possible, the decryption permission / inhibition determination unit 113c returns a result indicating that the decryption is impossible to the encrypted data acquisition unit 112 and ends. When the key acquisition unit 121 of the key control unit 12 receives the decryption key acquisition request, the key acquisition unit 121 acquires or receives the decryption key (a third sequence described later). Next, the decryption key output unit 121a of the key acquisition unit 121 outputs the acquired or received decryption key to the encrypted data control unit 11 (S121a). Next, the decryption unit 113b of the encrypted data decryption unit 113 of the encrypted data control unit 11 acquires the decryption key from the key control unit 12, and decrypts the encrypted data including the decryption conditions (S113b). The above is the first sequence.

  Next, a second sequence that is a part of the operation of the encrypted data distribution system 1000 of this embodiment will be described with reference to FIG. FIG. 7 is a second sequence diagram illustrating a part of the operation of the encrypted data distribution system 1000 according to the present embodiment.

  The second sequence diagram starts after execution of step S21a in the first sequence diagram. As shown in FIG. 7, the fourth attribute information acquisition request unit 22b of the attribute request unit 22 transmits an attribute information acquisition request to the attribute control unit 13 (S22b). When receiving the attribute information acquisition request, the attribute information search unit 131a of the attribute acquisition unit 131 of the attribute control unit 13 outputs the attribute information search request to the attribute management unit 132 (S131a). The attribute search result notification unit 132a of the attribute management unit 132 acquires the attribute information search request, searches the attribute information storage unit 132f for attribute information, and notifies the attribute information search result (S132a). When there is valid attribute information (the expiration date has not been exceeded) ([search result: attribute information exists] in the figure), the attribute transmission unit 131d of the attribute acquisition unit 131 encrypts the valid attribute information. The data is transmitted to the data transmission device 2 (S131d).

  On the other hand, in other cases ([search result: no attribute information] in the figure), the second attribute information acquisition request unit 131b of the attribute acquisition unit 131 transmits an attribute information acquisition request to the attribute providing device 3 (S131b). ). When receiving the attribute information acquisition request from the attribute control unit 13, the attribute information transmission unit 31 of the attribute providing device 3 transmits the latest attribute information to the attribute control unit 13 (S31).

  The attribute information storage request unit 131c of the attribute acquisition unit 131 of the attribute control unit 13 receives the attribute information from the attribute providing device 3, and outputs an attribute information storage request (S131c). The attribute storage result notifying unit 132b of the attribute management unit 132 acquires the attribute information storage request and receives the attribute information received from the attribute providing apparatus 3 and the expiration date information newly set for the attribute information. The data is stored in the storage unit 132f and a storage result notification is output (S132b). At this time, the attribute storage result notification unit 132b discards the old attribute information that has exceeded the expiration date in the attribute information storage unit 132f. The attribute transmission unit 131d of the attribute acquisition unit 131 acquires the storage result notification and transmits the received attribute information to the encrypted data transmission device 2 (S131d). The above is the second sequence. After the end of the second sequence, the operation continues from step S22a in the first sequence diagram. The point in the second sequence is that the acquired attribute information is managed and stored together with the expiration date information, and the attribute information that has passed the expiration date is discarded. This sequence can also correspond to a combination of a plurality of attribute information.

  Next, a third sequence that is a part of the operation of the encrypted data distribution system 1000 according to the present embodiment will be described with reference to FIG. FIG. 8 is a third sequence diagram illustrating a part of the operation of the encrypted data distribution system 1000 according to the present embodiment. The third sequence diagram starts after execution of step S113a in the first sequence diagram. When the decryption key search unit 121b of the key acquisition unit 121 of the key control unit 12 acquires the decryption key acquisition request, the decryption key search request is output (S121b). When acquiring the decryption key search request, the key search result notifying unit 122a of the key management unit 122 searches for the decryption key in the key storage unit 122g and notifies the search result of the decryption key (S122a). When there is a valid decryption key (the retention period has not been exceeded) ([search result: key present] in the figure), the process returns to the first sequence, and the decryption key output unit 121a of the key acquisition unit 121 acquires The decrypted key is output to the encrypted data control unit 11 (S121a).

  On the other hand, in other cases ([search result: no key] in the figure), the process further branches into two patterns. When attribute information is acquired by a decryption key acquisition request, a key generation request is made using the attribute information. When the attribute information is not acquired by the decryption key acquisition request, the first attribute information acquisition request unit 121c of the key acquisition unit 121 outputs the attribute information acquisition request to the attribute control unit 13 (S121c). Note that step S121c is an operation when attribute information is received from the attribute control unit 13 in a pull type. When the attribute information is received from the attribute control unit 13 in the push type, step S121c can be omitted. The first attribute output unit 132c of the attribute management unit 132 of the attribute control unit 13 outputs the attribute information stored in the attribute information storage unit 132f (in the case of a pull type, acquires an attribute information acquisition request) ( S132c). The first key generation request unit 121d of the key acquisition unit 121 of the key control unit 12 transmits a set of attribute information acquired by any method and identification information of the encrypted data to the key generation device 4 as a key generation request. (S121d). The first decryption key generation unit 41a of the key generation unit 41 of the key generation device 4 generates a decryption key when receiving a key generation request from the key control unit 12 (S41a). The first decryption key transmission unit 41b of the key generation unit 41 transmits the generated decryption key to the key control unit 12 (S41b).

  The first key storage request unit 121e of the key acquisition unit 121 of the key control unit 12 receives the decryption key from the key generation device 4 and outputs a key storage request (S121e). The first key storage result notifying unit 122b of the key management unit 122 obtains the key storage request, and uses the decryption key received from the key generation device 4 as a key along with the retention period newly set for the received decryption key. The attribute information stored in the storage unit 122g and acquired from the attribute control unit 13 is stored in the key storage unit 122g together with the expiration date information newly set therein, and the storage result notification is output (S122b). The above is the third sequence. After the end of the third sequence, the operation continues from step S121a in the first sequence diagram. The point in the third sequence is that the key acquisition unit 121 normally uses a locally cached decryption key (stored in the key storage unit 122g), but if there is no local decryption key, the attribute management unit Inquiring new attribute information to 132, managing and storing the decryption key acquired by the key management unit 122 together with the retention period, and determining the retention period of the decryption key based on the expiration date information of the original attribute information It is. By operating the third sequence in this way, the corresponding decryption key can be updated in cooperation with the update of attribute information that may change dynamically.

  Next, the attribute information and decryption key update operation of the encrypted data distribution system 1000 of this embodiment will be described with reference to FIG. FIG. 9 is a fourth sequence diagram illustrating the update operation of the attribute information and the decryption key of the encrypted data distribution system 1000 according to this embodiment. As shown in FIG. 9, the second attribute information update unit 132 d of the attribute management unit 132 of the attribute control unit 13 discards attribute information that has passed a predetermined expiration date, and obtains the latest attribute information from the attribute providing device 3. By acquiring, the attribute information is updated (S132d). The latest attribute information is stored in the attribute information storage unit 132f together with new expiration date information. The second attribute output unit 132e of the attribute management unit 132 outputs the updated attribute information (S132e). The first attribute information update unit 122c of the key management unit 122 of the key control unit 12 discards the attribute information that has passed the expiration date stored in the key storage unit 122g and newly outputs the latest information output from the attribute control unit 13. By acquiring the attribute information, the attribute information is updated (S122c). The latest attribute information is stored in the key storage unit 122g together with new expiration date information. The holding period update unit 122d of the key management unit 122 updates the holding period of the decryption key (S122d). The latest decryption key to be described later is stored in the key storage unit 122g together with a new holding period. Next, the second decryption key acquisition request unit 122e of the key management unit 122 outputs a decryption key acquisition request to the key acquisition unit 121 (S122e). The second key generation request unit 121f of the key acquisition unit 121 transmits a key generation request to the key generation device 4 (S121f). The second decryption key generation unit 41c of the key generation unit 41 of the key generation device 4 generates a decryption key when receiving a key generation request from the key control unit 12 (S41c). The second decryption key transmission unit 41d of the key generation unit 41 transmits the generated decryption key to the key control unit 12 (S41d). The second key storage request unit 121g of the key acquisition unit 121 of the key control unit 12 receives a new decryption key from the key generation device 4 and outputs a key storage request (S121g). The second key storage result notifying unit 122f of the key management unit 122 acquires the key storage request, stores the new decryption key received from the key generation device 4 in the key storage unit 122g together with a new holding period, and stores the new decryption key. The result notification is output to the key acquisition unit 121 (S122f). The point in the fourth sequence is that, when the attribute information is updated, key generation is performed regardless of the presence or absence of a decryption key acquisition request. Note that only the attribute information may be held as the latest information. In this case, the key update sequence from step S122d to step S122f is not performed. The key management unit updates the attribute information and its expiration date, deletes the corresponding key information, and ends. If the key update operation is omitted, the overhead of the key generation process can be reduced.

  According to the data utilization apparatus 1 and the encrypted data distribution system 1000 of the present embodiment, attribute information (information related to the user's surrounding environment such as position information and sensor information) that may change with time can be obtained at appropriate intervals. Providing a check mechanism with functions such as updating and erasing after a certain period of time can ensure proper operation of attribute information. In addition, efficient operation such as a sensor function can be realized. Further, by providing a management function for the decryption key generated by the attribute information, it is possible to generate a key asynchronously with the user request, and to improve the efficiency of the system. Further, connection with the key generation device 4 is not necessarily required when a user requests. In addition, by using high-performance encryption (functional encryption), encrypted data can be controlled (encrypted / decrypted) using attribute information as a key, making decryption control of encrypted data more flexible. (No user authentication required).

  The various processes described above are not only executed in time series according to the description, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the processes. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  Further, when the above-described configuration is realized by a computer, processing contents of functions that each device should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

Claims (7)

Sending an encrypted data request to the encrypted data transmitting device, receiving the encrypted data and the identification information of the encrypted data from the encrypted data transmitting device, and outputting a decryption key acquisition request to the key control unit, An encrypted data control unit for obtaining a decryption key from the key control unit and decrypting the encrypted data;
The decryption key corresponding to the reception of the decryption key acquisition request is searched, and if there is the corresponding decryption key, the corresponding decryption key is output to the encrypted data control unit, In some cases, attribute information that may change with time and identification information of the encrypted data are paired, and the paired information is transmitted to the key generation apparatus as a key generation request, and the key generation is performed. A key control unit that receives the decryption key from a device and outputs the received decryption key to the encrypted data control unit;
Including data utilization device. An encrypted data distribution system including a data utilization device, an encrypted data transmission device, and a key generation device,
The data utilization device includes an encrypted data control unit and a key control unit,
The encrypted data control unit
Sends an encrypted data request to the encrypted data transmission device, receives encrypted data and identification information of the encrypted data from the encrypted data transmission device, and outputs a decryption key acquisition request to the key control unit And obtaining a decryption key from the key control unit, decrypting the encrypted data,
The key control unit
The decryption key corresponding to the reception of the decryption key acquisition request is searched, and if there is the corresponding decryption key, the corresponding decryption key is output to the encrypted data control unit, In some cases, attribute information, which may change over time, and identification information of the encrypted data are paired, and the paired information is transmitted as a key generation request to the key generation apparatus, and the key Receiving the decryption key from the generation device, and outputting the received decryption key to the encrypted data control unit;
The encrypted data transmission device is:
When the encrypted data request is received, the encrypted data and identification information of the encrypted data are transmitted to the encrypted data control unit,
The key generation device includes:
An encrypted data distribution system that generates the decryption key and transmits it to the key control unit when the key generation request is received from the key control unit. An encrypted data distribution system including a data utilization device, an encrypted data transmission device, an attribute providing device, and a key generation device,
The data utilization device includes an encrypted data control unit, a key control unit, and an attribute control unit,
The encrypted data control unit
Sends an encrypted data request to the encrypted data transmission device, receives encrypted data and identification information of the encrypted data from the encrypted data transmission device, and outputs a decryption key acquisition request to the key control unit And obtaining a decryption key from the key control unit, decrypting the encrypted data,
The key control unit
The decryption key corresponding to the reception of the decryption key acquisition request is searched, and if there is the corresponding decryption key, the corresponding decryption key is output to the encrypted data control unit, In some cases, attribute information, which may change over time, and identification information of the encrypted data are paired, and the paired information is transmitted as a key generation request to the key generation apparatus, and the key Receiving the decryption key from the generation device, and outputting the received decryption key to the encrypted data control unit;
The attribute control unit
Sending an attribute information acquisition request to the attribute providing device, receiving the attribute information from the attribute providing device;
The encrypted data transmission device is:
When the encrypted data request is received, the encrypted data and identification information of the encrypted data are transmitted to the encrypted data control unit,
The attribute providing device includes:
When the attribute information acquisition request is received from the attribute control unit, the latest attribute information is transmitted to the attribute control unit,
The key generation device includes:
An encrypted data distribution system that generates the decryption key and transmits it to the key control unit when the key generation request is received from the key control unit. The encrypted data control unit
Sending the encrypted data request to the encrypted data transmitting device, receiving the encrypted data and the identification information of the encrypted data, outputting the decryption key acquisition request to the key control unit,
The key control unit
When the decryption key acquisition request is received, the corresponding decryption key is searched, and if there is the corresponding decryption key, the corresponding decryption key is output to the encrypted data control unit, In some cases, attribute information that may change with time and identification information of the encrypted data are paired, and the paired information is transmitted to the key generation apparatus as a key generation request, and the key generation is performed. Receiving the decryption key from a device, and outputting the received decryption key to the encrypted data control unit;
The encrypted data control unit
A data utilization method for obtaining the decryption key from the key control unit and decrypting the encrypted data. An encrypted data distribution method executed by a data utilization device, an encrypted data transmission device, and a key generation device,
The data utilization device includes an encrypted data control unit and a key control unit,
The encrypted data control unit
Sending an encrypted data request to the encrypted data transmitting device;
The encrypted data transmission device is:
Sending the encrypted data and identification information of the encrypted data to the encrypted data control unit;
The encrypted data control unit
Receiving the encrypted data and the identification information of the encrypted data from the encrypted data transmitting device, and outputting a decryption key acquisition request to the key control unit;
The key control unit
When a decryption key corresponding to the reception of the decryption key acquisition request is searched and the corresponding decryption key is present, the corresponding decryption key is output to the encrypted data control unit, otherwise Is a set of attribute information, which is information that may change over time, and identification information of the encrypted data, and sends the set information to the key generation device as a key generation request.
The key generation device includes:
When the key generation request is received from the key control unit, the decryption key is generated and transmitted to the key control unit,
The key control unit
Receiving the decryption key from the key generation device, and outputting the received decryption key to the encrypted data control unit;
The encrypted data control unit
An encrypted data distribution method for obtaining the decryption key from the key control unit and decrypting the encrypted data. An encrypted data distribution method executed by a data use device, an encrypted data transmission device, an attribute providing device, and a key generation device,
The data utilization device includes an encrypted data control unit, a key control unit, and an attribute control unit,
The encrypted data control unit
Sending an encrypted data request to the encrypted data transmitting device;
The attribute control unit
Send an attribute information acquisition request to the attribute providing device,
The attribute providing device includes:
When the attribute information acquisition request is received from the attribute control unit, the latest attribute information that is likely to change with time is sent to the attribute control unit,
The attribute control unit
Receiving the attribute information from the attribute providing device;
The encrypted data transmission device is:
Sending the encrypted data and identification information of the encrypted data to the encrypted data control unit;
The encrypted data control unit
Receiving the encrypted data and identification information of the encrypted data from the encrypted data transmitting device, and outputting a decryption key acquisition request to the key control unit;
The key control unit
When a decryption key corresponding to the reception of the decryption key acquisition request is searched and the corresponding decryption key is present, the corresponding decryption key is output to the encrypted data control unit, otherwise The attribute information and the identification information of the encrypted data are paired, and the paired information is transmitted to the key generation apparatus as a key generation request,
The key generation device includes:
When the key generation request is received from the key control unit, the decryption key is generated and transmitted to the key control unit,
The key control unit
Receiving the decryption key from the key generation device, and outputting the received decryption key to the encrypted data control unit;
The encrypted data control unit
An encrypted data distribution method for obtaining the decryption key from the key control unit and decrypting the encrypted data.   The program for functioning a computer as a data utilization apparatus of Claim 1.

Images