JP2016072769A - Data management system, data management method, and client terminal - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a technology for ensuring security in using cloud storage by reducing a risk of information leakage while considering user convenience.SOLUTION: A client terminal transmits positional information on the client terminal to a management server and acquires an encryption key depending on the positional information to execute processing of encrypting a file or decrypting an encrypted file. The management server, on the other hand, manages a plurality of encryption keys depending on security levels and a policy for determining a security level depending on a position of the client terminal. The management server, on the basis of positional information received from a client terminal and the policy, determines a security level for the client terminal; and executes processing of transmitting an encryption key corresponding to the determined security level, to the client terminal.SELECTED DRAWING: Figure 5

Description

  The present invention relates to a data management system, a data management method, and a client terminal, for example, management of an encryption key used for file encryption / decryption.

  In recent years, studies have been started on using public cloud storage services provided to consumers. The file sharing function provided by the public cloud storage service is one of the advantages of using cloud storage.

  However, many users are worried about security when using public cloud storage for business, and the current situation is limited to personal use. Therefore, as one security measure, a method of encrypting and operating a file stored in the cloud storage is considered. In relation to this, software products that can encrypt files stored in cloud storage are on the market, but there are few products that combine the file sharing function and encryption of public cloud storage services.

  For example, in Patent Document 1, when uploading a file to a cloud storage, the encryption key acquired from the key management server is encrypted, and when downloading the file from the cloud storage, identification information embedded in the encrypted file Describes a system for identifying the type of sharing from the key and decrypting with an appropriate key among the encryption keys acquired from the key management server.

  Patent Document 2 discloses a communication control policy according to physical location information of a mobile communication terminal and location information on the network in order to prevent information stored in the mobile communication terminal from leaking via the network. Describes a network system that applies to the own terminal.

JP 2014-127721 A JP 2013-38716 A

  However, in the system described in Patent Document 1, since access to the cloud storage and the key management server is possible from any location on the network, there is a possibility of leakage of confidential information due to the intention or negligence of the system user. There is.

  In the system described in Patent Document 2, since only the authentication server can be accessed depending on the position of the terminal, leakage of confidential information can be prevented, but the convenience of the system user is remarkably limited, which is not preferable.

  The present invention has been made in view of such a situation, and provides a technique for reducing the risk of information leakage and ensuring security in cloud storage usage while also considering user convenience. is there.

  In order to solve the above problems, in the present invention, the client terminal transmits the location information of the client terminal to the management server, acquires the encryption key corresponding to the location information, and encrypts the file or decrypts the encrypted file. Execute the process. On the other hand, the management server manages a plurality of encryption keys corresponding to the security level and a policy for determining the security level according to the position of the client terminal, and the management server receives from the client terminal. Based on the position information and the policy, a security level of the client terminal is determined, and a process of transmitting an encryption key corresponding to the determined security level to the client terminal is executed.

  Further features related to the present invention will become apparent from the description of the present specification and the accompanying drawings. The embodiments of the present invention can be achieved and realized by elements and combinations of various elements and the following detailed description and appended claims.

  It should be understood that the description herein is merely exemplary and is not intended to limit the scope of the claims or the application of the invention in any way.

  According to the present invention, it is possible to reduce the risk of information leakage and ensure security in cloud storage usage. Further, there is little sacrifice for user convenience.

It is a figure which shows schematic structure of the data management system 1000 by embodiment of this invention. It is a block diagram which shows the detailed function structure of the management server 100 by embodiment of this invention. It is a block diagram which shows the detailed function structure of the client terminal 200 by embodiment of this invention. It is a figure which shows the structural example of the policy 173 stored in the database 170 by embodiment of this invention. It is a figure for demonstrating the outline | summary of the user authentication process of the management server 100 by embodiment of this invention. FIG. 5A shows a process of registering a new user, and FIG. 5B shows a process of authenticating the user after registration. It is a figure for demonstrating the outline | summary of the process which the client terminal 200 encrypts and stores (uploads) the data file 512 to the cloud storage 300 by embodiment of this invention. It is a figure for demonstrating the outline | summary of the process which the client terminal 200 acquires (downloads) the data file 512 from the cloud storage 300, and decodes by embodiment of this invention. It is a figure which shows the structure of the file system on OS (operating system) of the client terminal 200 by embodiment of this invention. 10 is a flowchart for explaining processing in which a client terminal 200 transmits (uploads) a new data file stored in an encrypted folder 630 to the cloud storage 300. 4 is a flowchart for explaining details of processing in which the client terminal 200 downloads an encrypted data file from the cloud storage 300. It is a flowchart for demonstrating the detail of the process which deletes or acquires an encryption key according to the change of the positional information by embodiment of this invention. It is a sequence diagram for demonstrating the specific example at the time of operating with the policy shown by FIG.

  Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In the accompanying drawings, functionally identical elements may be denoted by the same numbers. The attached drawings show specific embodiments and implementation examples based on the principle of the present invention, but these are for understanding the present invention and are not intended to limit the present invention. Not used.

  This embodiment has been described in sufficient detail for those skilled in the art to practice the present invention, but other implementations and configurations are possible without departing from the scope and spirit of the technical idea of the present invention. It is necessary to understand that the configuration and structure can be changed and various elements can be replaced. Therefore, the following description should not be interpreted as being limited to this.

  Furthermore, as will be described later, the embodiment of the present invention may be implemented by software running on a general-purpose computer, or may be implemented by dedicated hardware or a combination of software and hardware.

  In the following description, each information of the present invention will be described in a “table” format. However, the information does not necessarily have to be expressed in a data structure by a table, such as a data structure such as a list, a DB, a queue, or the like. It may be expressed as Therefore, “table”, “list”, “DB”, “queue”, etc. may be simply referred to as “information” to indicate that they do not depend on the data structure.

  In addition, when explaining the contents of each information, the expressions “identification information”, “identifier”, “name”, “name”, “ID” can be used, and these can be replaced with each other. It is.

  In the following description, each process in the embodiment of the present invention will be described with “each functional unit (for example, user authentication unit)” as the subject (operation subject), but each functional unit is configured by a program, and the program is executed by the processor. Therefore, the processing may be described using the processor as the subject, since the processing determined by using the memory and the communication port (communication control device) is performed. Further, the processing disclosed with the program as the subject may be processing performed by a computer such as an authentication server or an information processing apparatus. Part or all of the program may be realized by dedicated hardware, or may be modularized. Various programs may be installed in each computer by a program distribution server or a storage medium.

<Configuration of data management system>
FIG. 1 is a diagram showing a schematic configuration of a data management system 1000 according to an embodiment of the present invention. The data management system 1000 includes a management server (also referred to as an authentication server) 100, a client terminal 200, and a cloud storage 300, which are connected via a network 301 such as the Internet. .

  The management server 100 operates as an authentication server that manages a user ID of a user who uses the client terminal 200. Further, as will be described later with reference to FIG. 2, the management server 100 manages an encryption key used when the client terminal 200 encrypts and decrypts a data file.

  The client terminal 200 encrypts the data file using the encryption key acquired from the management server 100, and stores the encrypted data file in the cloud storage 300. In addition, the client terminal 200 decrypts the encrypted data file acquired from the cloud storage 300 using the encryption key acquired from the management server 100. When the client terminal 200 acquires an encryption key from the management server 100, it is necessary to receive authentication by the management server 100. In order to simplify the description, it is assumed that authentication is not necessarily required when accessing the cloud storage 300, but an authentication process may be provided. The client terminal 200 is a computer such as a personal computer or a mobile terminal. Hereinafter, the client terminal 200 is collectively referred to.

  The cloud storage 300 stores the data file encrypted by the client terminal 200. The cloud storage 300 is configured by a storage device connected to the network 301, and can read and write data via the network 301. The provider providing the cloud storage 300 is not necessarily the same as the provider to which the management server 100 (and its constituent elements) and the client terminal 200 belong.

<Configuration of management server>
FIG. 2 is a block diagram showing a detailed functional configuration of the management server 100 according to the embodiment of the present invention. The management server 100 manages the encryption key used when the client terminal 200 encrypts the data file after encrypting it using authentication for each user, and responds to the request from the client terminal 200 with the encryption key. Is sent encrypted.

  The management server 100 includes a CPU (processor) 101 that is a calculation unit that executes various programs, a memory 102 that stores various programs, and an input / output device (as an input device) that inputs instructions and outputs calculation results. A keyboard, a mouse, a microphone, etc., such as a display, a printer, a speaker, etc. as output devices) 103, a communication device 104 for communicating with the client terminal 200 and the cloud storage 300, and a database 170 for storing various data. ing.

  The memory 102 includes a secret key encryption unit 110, a private key encryption unit 120, a general key encryption unit 130, a PW key encryption unit 140, an encryption key transmission unit 150, and a policy management unit 160 as programs. And a database 170. The encryption key transmission unit 150 further includes an authentication unit 151 and a transmission unit 152 as programs. The policy management unit 160 includes a policy transmission / reception unit 161, a policy search unit 162, and a policy setting unit 163 as programs. Functional units other than the database 170 will be described later in FIG. 3 and later.

  The database 170 is a database that manages an encryption key used when the client terminal 200 encrypts a data file. There are three types of encryption keys. The top secret key 1712 is an encryption key that can be acquired only when the client terminal 200 is in-house. The private key 1714 is an encryption key that can be acquired only when the client terminal 200 is on a permitted network. The general key 1716 is an encryption key that can be acquired from any network.

  The database 170 encrypts the above three types of keys using authentication information for each user and stores them as records in a user table 171 provided for each user. Here, to simplify the explanation, it is assumed that the management server 100 authenticates each user with a password, and the above three types of encryption keys are encrypted using the password as an encryption key (hereinafter referred to as a PW key 1718). Shall. Records 1711, 1713, and 1715 are data obtained by encrypting the secret key 1712, the private secret key 1714, and the general key 1716 with the PW key 1718, respectively.

  The user table 171 further encrypts the PW key 1718 for each user with the management key 172 managed only by the system administrator and stores it as a record 1717. The management key 172 is held in a storage area different from the user table 171. For example, it can be stored in the session management area. By duplicating and managing the PW key 1718, even if the user forgets the password, the administrator decrypts the PW key 1718 using the management key 172, and uses this to secret key 1712, The private key 1714 and the general key 1716 can be decrypted, a new password can be issued, and each encryption key can be re-encrypted with the password. That is, even when the encryption key is double-encrypted as shown in FIG. 2, the authentication information can be reissued.

  The database 170 can be configured using a storage device such as a hard disk device. As shown in FIG. 2, the other functional units are realized by executing a program in which these functions are implemented by an arithmetic device such as a CPU (Central Processing Unit). It can also be configured using hardware such as a circuit device. When realized by a program, these functional units are stored in a computer-readable storage medium (for example, a recording device such as a memory, a hard disk, or a solid state drive (SSD), a recording medium such as an IC card, an SD card, or a DVD). be able to.

<Configuration of client terminal>
FIG. 3 is a block diagram illustrating a detailed functional configuration of the client terminal 200 according to the embodiment of the present invention.

  The client terminal 200 is a CPU (processor) 201 that is a calculation unit that executes various programs, a memory 202 that stores various programs, a storage device 250 that stores various data, and inputs instructions and outputs calculation results. Input / output devices (keyboard, mouse, microphone, etc. as input devices, display, printer, speakers, etc. as output devices) 203, and a communication device 204 for communicating with the management server 100.

  The memory 202 includes a terminal location information change detection unit 210, a terminal location information notification unit 220, a policy acquisition unit 230, and a network connection unit 240 as programs. Each unit other than the storage device 250 may be configured as hardware or may be realized as a function on software.

  The terminal position information change detection unit 210 is a device or a program that executes processing for detecting a change in the position of the client terminal 200. In this specification, this “position” means the position of the client terminal 200 on the network, the physical position, or a combination thereof. For example, the position on the network by the IP address assigned to the network connection unit 240, the physical position of the client terminal 200 on the earth detected by the GPS device included in the client terminal 200, the wireless LAN to which the client terminal 200 is connected This corresponds to network and physical positions based on information such as SSID (Service Set ID) and MAC address of the access point, or a combination of these positions.

  The terminal position information change detection unit 210 refers to the terminal position change threshold information 251 stored in the storage device 250, and detects a change in the position of the own terminal (a position on the network based on the IP address and a physical position based on the GPS). To do. That is, the terminal location information change detection unit 210 compares the network location and physical location based on the IP address with the terminal location change threshold information 251, and any of the positions is described in the terminal location change threshold information 251. When it is no longer satisfied, it is detected that the position has changed. The terminal position change threshold information 251 will be described later.

  The terminal location information notification unit 220 is a device or program that executes processing for notifying the terminal location information detected by the terminal location information change detection unit 210. Each time a change in the terminal position is detected, the management server 100 is notified of the terminal position information.

  The policy acquisition unit 230 is a device or program that executes processing for acquiring policy information 254 from the policy transmission / reception unit 161 (FIG. 2) of the management server 100.

  The network connection unit 240 is a device that connects the client terminal 200 and the network 301. For example, a wired LAN (Local Area Network) device, a wireless LAN device, a 3G (third generation mobile communication system) wireless device, and a 4G (fourth) This corresponds to a generation mobile communication system) wireless device or the like.

  The storage device 250 is used for storing information necessary for realizing communication control according to the present embodiment. For example, terminal position change threshold information 251, terminal identification information 252, authentication server address information 253, and policy information 254 are stored. The storage device 250 may store arbitrary information (not shown).

  The terminal position change threshold information 251 is information used by the terminal position information change detection unit 210 to determine whether or not a change has occurred in the position of the client terminal 200 (own terminal). The terminal position change threshold information 251 includes, for example, (1) a latitude / longitude range in which a company building is included, (2) an IP address range assigned to the network connection unit 240 of the client terminal 200 in the in-house network, (3) Both of them are stored.

  For example, if the terminal position change threshold information 251 stores a latitude / longitude range that includes a building of an organization to which a user such as a company belongs, a GPS observation value provided in the client terminal 200 is stored. When out of the latitude / longitude range, the terminal position information change detection unit 210 detects the movement of the client terminal 200 (own terminal) from the inside of the company to the outside.

  The terminal identification information 252 is information that uniquely identifies the client terminal 200. For example, the terminal unique number of the client terminal 200, a combination of a user name and a password, the MAC address of the network connection unit 240 of the client terminal 200, Combinations are equivalent.

  The authentication server address information 253 is given by the IP address or domain name of the management server 100.

  Although details of the policy information 254 will be described later, the conditions applied to the communication control of the client terminal 200 are equivalent.

<Example of policy configuration>
FIG. 4 is a diagram showing a configuration example of the policy 173 stored in the database 170 according to the embodiment of the present invention. The policy 173 may be set for each user, but here, it is assumed that the policy 173 is set as common information in the system.

  The policy 173 includes a policy name 401, a network location range 402, a physical location range 403, and a sensitivity 404 as configuration information. FIG. 4 shows three pieces of policy information 405 to 407 as an example. Each time the client terminal 200 logs in to the management server 100 or detects a change in the position of the client terminal 200, the client terminal 200 acquires the latest policy 173 and stores it in the policy information 254.

  In the policy information 405, the IP address assigned to the network connection unit 240 is included in the network location range 402 “192.168.0.0/24”, and the physical location of the client terminal 200 by the GPS is physical. If it is included in the target location range 403 “Latitude / longitude range where the building is included”, the network is recognized as “in-house network”, and the encryption key with the confidentiality “confidential / private / general” is acquired. Indicates permission.

  As a situation where the policy information 405 is applicable, for example, there is a case where the client terminal 200 is used in-house and the client terminal 200 is connected to the in-house Wi-Fi access point.

  In the policy information 406, the IP address assigned to the network connection unit 240 is included in the network location range 402 “10.0.0.0/24”, and the physical location of the client terminal 200 by the GPS is arbitrary. The network is recognized as a “permitted network” and the acquisition of an encryption key whose confidentiality is “confidential / general” is permitted.

  An example of a situation where the policy information 406 is applicable is a case where the client terminal 200 is used outside the company but is connected to a network that is permitted in advance.

  The policy information 407 recognizes the network as an “external network” regardless of the position on the network by the IP address assigned to the network connection unit 240 and the physical position by the GPS, and the sensitivity is “general”. It indicates that the acquisition of a certain encryption key is permitted.

  A situation in which the policy information 407 is applicable includes a case where the company is connected to an internal network and an arbitrary network that does not apply to the internal network.

<Overview of user authentication processing>
FIG. 5 is a diagram for explaining the outline of the user authentication process of the management server 100 according to the embodiment of the present invention. FIG. 5A shows a process of registering a new user, and FIG. 5B shows a process of authenticating the user after registration. In the following, each process will be described with an example of a process related to user_A.

  The user_A who is the user of the client terminal 200 accesses the management server 100 and requests to register user_A as a new user. In the following, it is assumed that the management server 100 automatically issues a password.

  When the authentication unit 151 receives a request for registering user_A, which is a new user, from the client terminal 200, the authentication unit 151 issues a password user_A_PW corresponding to user_A and holds the corresponding relationship. Thereafter, user_A can log in to the management server 100 using the password user_A_PW. The process of registering a new user may be automated, or may be registered after it is determined whether or not the user may be newly registered through an administrator.

  The authentication unit 151 generates the secret key 1712 of user_A using, for example, a random number. Similarly, a private key 1714 and a general key 1716 are generated. The management key 172 is generated in advance by an appropriate method.

  The secret key encryption unit 110 encrypts the secret key 1712 using the password user_A_PW or a value uniquely derived therefrom as the PW key 1718 and stores it as a record 1711 in the user table 171. The correspondence between user_A and the record 1711 may be defined by, for example, associating the user ID of user_A with the record 1711 or by creating a user table 171 for each user.

  Similarly, the private key encryption unit 120 and the general key encryption unit 130 encrypt the private key 1714 and the general key 1716 using the PW key 1718 and store them as records 1713 and 1715, respectively. The PW key encryption unit 140 copies the PW key 1718, encrypts it with the management key 172, and stores it as a record 1717.

  When the user of the client terminal 200 encrypts or decrypts a data file, first, it is necessary to log in to the management server 100 and acquire each encryption key. The user transmits the user ID user_A, the password user_A_PW, and the location information on the network notified from the terminal location information notification unit 220 to the management server 100 via the client terminal 200. The authentication unit 151 performs authentication processing using the user ID, password, and location information on the network. When the authentication is permitted, the transmission unit 152 obtains, from the database 170, a key permitted to be acquired by the policy from the top secret key 1712, the external secret key 1714, and the general key 1716 as a key corresponding to the location information on the user and the network. Read and transmit to the client terminal 200. However, these keys remain encrypted by the PW key 1718.

  When the change in the position information is detected by the terminal position information change detection unit 210, the client terminal 200 acquires and deletes the encryption key according to the content of the policy information 254. For example, when the client terminal 200 moves from a position corresponding to the in-house network 405 of FIG. 4 to a position corresponding to the permitted network 406, the secret key 1712 is deleted from the acquired encryption keys. On the other hand, when the client terminal 200 moves from a position corresponding to the permitted network 406 to a position corresponding to the in-house network 405, a secret key is acquired. In this case, authentication processing may be automatically performed using the user ID user_A and password user_A_PW stored internally, or the user may be allowed to perform authentication processing again.

<Overview of file upload processing>
FIG. 6 is a diagram for explaining an outline of processing in which the client terminal 200 encrypts the data file 512 and stores (uploads) it in the cloud storage 300 according to the embodiment of the present invention. Here, it is assumed that a data file 512 that is desired to be viewed only within the company is used.

  Before storing the data file 512 in the cloud storage 300, the user logs in to the management server 100 in advance as described with reference to FIG. 5 and acquires the encryption key permitted to be acquired by the policy 173. The client terminal 200 decrypts each record acquired from the management server 100 using the password user_A_PW, and acquires an encryption key. Since the data file 512 can be browsed only within the company, the user selects the top secret key 1712 as an encryption key for encrypting the data file 512. The client terminal 200 encrypts the data file 512 using the secret key 1712 and creates an encrypted data file 511. The client terminal 200 stores (transmits) the encrypted data file 511 in the cloud storage 300.

  Similarly, when it is desired that the data file 512 can be viewed on the permitted network, the user selects the private key 1714 as an encryption key for encrypting the data file 512. When the user wants to view the data file 512 on an arbitrary network, the user selects the general key 1716 as an encryption key for encrypting the data file 512. The client terminal 200 encrypts the data file 512 using the selected encryption key and stores it in the cloud storage 300.

  When the client terminal 200 encrypts the data file 512, the client terminal 200 embeds in the encrypted data file 511 information indicating which of the three types of encryption keys is used. However, since it is sufficient to know the type of the encryption key, there is no need to embed information that individually specifies each encryption key.

<Overview of file download processing>
FIG. 7 is a diagram for explaining an outline of processing in which the client terminal 200 acquires (downloads) the data file 512 from the cloud storage 300 and decrypts the data file 512 according to the embodiment of the present invention. Here, as in FIG. 6, it is assumed that a data file 512 that is desired to be viewable only within the company is used.

  Before acquiring the data file 512 from the cloud storage 300, the user acquires from the management server 100 an encryption key that is permitted to be acquired in advance by the policy 173, as in FIG. The client terminal 200 decrypts each encryption key.

  The user accesses the cloud storage 300 via the client terminal 200 and acquires the encrypted data file 511. In the encrypted data file 511, information indicating that the file is encrypted using a secret key is embedded. Therefore, the client terminal 200 attempts to decrypt the encrypted data file 511 using the top secret key 1712 of user_A. When the encrypted data file 511 is encrypted with the user_A's secret key 1712, the encrypted data file 511 can be decrypted.

  Similarly, when the data file 512 is a file encrypted with the private key 1714, the client terminal 200 decrypts the encrypted data file 511 using the private key 1714. When the data file 512 is a file encrypted with the general key 1716, the client terminal 200 decrypts the encrypted data file 511 using the general key 1716.

<File system configuration>
FIG. 8 is a diagram showing a configuration of a file system on the OS (Operating System) of the client terminal 200 according to the embodiment of the present invention. The client terminal 200 can encrypt or decrypt individual data files 512 as described with reference to FIGS. 6 to 7, but the user needs to select an encryption key each time. Burdens for them. Therefore, the client terminal 200 can collectively encrypt or decrypt data files stored under a predetermined folder on the file system, and further synchronize the files with the cloud storage 300. FIG. 8 illustrates an example of the folder structure. The file system of the client terminal 200 includes a synchronization folder 620 that stores an encrypted file and an encryption folder 630 that stores a plain text file to be encrypted.

(I) The synchronization folder 620 is a folder for storing a data file (encrypted file) transmitted from the client terminal 200 to the cloud storage 300 or acquired from the cloud storage 300 by the client terminal 200. The client terminal 200 constantly monitors the synchronization folder 620. When a new data file is stored in the synchronization folder 620, the client terminal 200 transmits the data file to the cloud storage 300. In addition, the client terminal 200 periodically connects to the cloud storage 300 as necessary, and when a new encrypted data file exists, downloads it and stores it in the synchronization folder 620.

  A subfolder can be provided in the synchronization folder 620. It is desirable that the folder / file configuration in the synchronization folder 620 and the folder / file configuration on the cloud storage 300 are synchronized.

  When the client terminal 200 uses a plurality of cloud storages 300, a subfolder corresponding to each cloud storage 300 is provided in the synchronization folder 620, and synchronization processing can be performed for each cloud storage 300. The subfolders 621 and 622 illustrated in FIG. 8 correspond to the two cloud storages 300 (Cloud Storage A and Cloud Storage B).

(Ii) The encryption folder 630 stores a data file (plain text file) to be encrypted before the client terminal 200 transmits it to the cloud storage 300, or a data file obtained by decrypting the encrypted data file acquired from the cloud storage 300 Is a folder for storing The client terminal 200 constantly monitors the encryption folder 630. When a new data file is stored in the encryption folder 630, the client terminal 200 encrypts the data file and stores it in the synchronization folder 620. The data file stored in the synchronization folder 620 is transmitted to the cloud storage 300 as described above. In addition, when a new encrypted data file is stored in the synchronization folder 620, the client terminal 200 decrypts the encrypted data file and stores it in the encrypted folder 630.

(Iii) The client terminal 200 synchronizes the folder / file configuration in the encrypted folder 630 with the file / folder configuration in the synchronization folder 620. Therefore, when there are subfolders for each of the plurality of cloud storages 300 in the synchronization folder 620, the same folder structure is created in the encryption folder 630. Subfolders 631 and 632 correspond to subfolders 621 and 622, respectively. However, the extension of the file can be changed as appropriate in order to distinguish whether it is encrypted or not. FIG. 8 shows an example in which an extension “.crypto” is added to the encrypted data file in addition to the original “file name + extension”.

(Iv) Next, a method for distinguishing encryption keys to be used will be described. The key for encrypting the file is set for each encrypted folder 630 by the user. For example, a data file placed in a folder corresponding to the private key 1714 is encrypted using the private key 1714. In FIG. 8, the folder “Internal” in the subfolder 632 corresponds to this. A data file placed in a folder corresponding to the general key 1716 is encrypted using the general key 1716. Although not shown in FIG. 8, a folder corresponding to the general key 1716 can be provided. Data files that do not fall under these conditions are encrypted using the secret key 1712.

  When the client terminal 200 acquires a new encrypted data file from the cloud storage 300, as described in FIG. 7, information indicating which type of encryption key should be used is embedded in the encrypted data file. Therefore, the encrypted data file can be decrypted using the encryption key corresponding to the information. Alternatively, as in the case of encrypting the data file, for example, the data file in the folder storing the data file encrypted with the private key 1714 may be decrypted using the private key 1714.

  If the correspondence between the information embedded in the encrypted data file and the folder is inconsistent, how to process is defined separately in a setting file or the like and processed according to the setting. For example, when an encrypted data file in which information indicating that encryption is performed using the private key 1714 is stored in a folder in which the data file encrypted with the confidential key 1712 is stored, the confidential data is stored. It is possible to employ a method in which decryption is attempted using both the key 1712 and the external key 1714 and the decryption is successful. Alternatively, the encrypted data file can be stored in the encrypted folder 630 without being decrypted. This process can be applied in steps S905 to S910 described later.

(V) When uploading a file to the cloud storage 300, when the user stores the target file in the encryption folder 630, the target file is encrypted, stored in the synchronization folder 620, and transmitted to the cloud storage 300. Stored.

  When downloading a file from the cloud storage 300, the encrypted data file is transmitted from the cloud storage 300 to the client terminal and stored in the synchronization folder 630. For example, when the user moves from the inside of the company to the outside, the number of keys that can be used for decryption decreases (when the user moves from outside the company to the company, the number of keys that can be used for decryption increases). Therefore, the file to be decrypted with the secret key is not decrypted only by acquiring the encrypted data file outside the company. Then, after the user returns to the office, the encrypted data file is automatically decrypted and the plain text file may be stored in the encrypted folder 630.

<Details of file upload processing>
FIG. 9 is a flowchart for explaining processing in which the client terminal 200 transmits (uploads) a new data file stored in the encrypted folder 630 to the cloud storage 300. Hereinafter, each step of FIG. 9 will be described.

(I) Step S901
When the user inputs authentication information (user ID and password), the client terminal 200 transmits the authentication information together with the location information of the client terminal 200 on the network to the management server 100.

(Ii) Steps S902 to S903
The authentication unit 151 of the management server 100 performs user authentication using the authentication information received from the client terminal 200 (S902). When the authentication is rejected, a response indicating that is transmitted to the client terminal 200, the client terminal 200 displays a dialog indicating that the user authentication has failed (S903), and this flowchart ends. If authentication is permitted, the process proceeds to step S904.

(Iii) Step S904
The transmission unit 152 acquires the top secret key 1712, the external secret key 1714, and the general key 1716 from the database 170 according to the user and location information on the network, and transmits them to the client terminal 200. However, as described with reference to FIG. 2, since these three keys are encrypted by the PW key 1718, the client terminal 200 decrypts these encryption keys using the authentication information of the user.

(Iv) Step S905
The client terminal 200 compares the file configuration stored in the synchronization folder 620 with the file configuration stored in the encryption folder 630, and an addition or update occurs in the file configuration stored in the synchronization folder 620. It is determined whether or not. If addition or update has occurred, the process proceeds to step S906, and if not, the process skips to step S907.

(V) Step S906
Based on the information embedded in the encrypted data file, the client terminal 200 decrypts the encrypted data file using the corresponding encryption key and copies it to the encrypted folder 630. If the encrypted data file in the synchronization folder 620 has been deleted, the corresponding data file in the encrypted folder 630 is deleted.

(Vi) Step S907
The client terminal 200 periodically checks whether the file configuration in the encrypted folder 630 has been added or updated. If addition or update has occurred, the process proceeds to step S908. If not, the process skips to step S909.

(Vii) Step S908
The client terminal 200 encrypts the data file added or updated in the encryption folder 630 with the corresponding encryption key and copies it to the synchronization folder 620. The client terminal 200 uploads the encrypted data file copied to the synchronization folder 620 to the cloud storage 300.

(Viii) Steps S909 to S910
The client terminal 200 determines whether or not the user has logged out (S909). If the user has logged out, the monitoring of the encrypted folder 630 is terminated. If not logged out, the process returns to step S905, and the same process is repeated (S910).

<Details of file download processing>
FIG. 10 is a flowchart for explaining details of the process in which the client terminal 200 downloads the encrypted data file from the cloud storage 300. Since steps S1001 to S1004 are the same as steps S901 to S904 in FIG. 9, only step S1005 and subsequent steps will be described below.

(I) Step S1005
The client terminal 200 stores the encrypted data file downloaded from the cloud storage 300 in the synchronization folder 620. The client terminal 200 identifies the encryption key to be used in the decryption process by confirming the identification information embedded in the encrypted data file downloaded from the cloud storage 300.

(Ii) Steps S1006 to S1010
The client terminal 200 decrypts the encrypted data file using the corresponding encryption key based on the determination result in step S1005. The data file obtained by the decryption is stored in a corresponding folder in the encryption folder 630.

<Details of encryption key deletion / acquisition processing according to location information>
(1) Processing Contents FIG. 11 is a flowchart for explaining details of processing for deleting or acquiring an encryption key according to a change in position information according to the embodiment of the present invention.

(I) Step S1101
When the terminal location information change detection unit 210 detects a change in the location of the client terminal 200, the terminal location information notification unit 220 stores the location information (IP address and physical location information) of the client terminal 200 after the location change. To 100. The management server 100 transmits the latest policy 173 to the client terminal 200.

(Ii) Step S1102
When the latest policy 173 transmitted from the management server 100 can be acquired, the policy acquisition unit 230 holds the policy as the latest policy information 254.

(Iii) Step S1103
The terminal location information change detection unit 210 determines whether or not the latest policy 173 has been successfully acquired. If successful (Yes in step S1103), the process proceeds to step S1104. If it has failed (No in step S1103), the process proceeds to step S1105.

(Iv) Step S1104
The terminal location information change detection unit 210 refers to the latest policy (policy information 254).

(V) Step S1105
The terminal position information change detection unit 210 refers to a previously acquired policy (policy information 254).

(Vi) Step S1106
The terminal location information change detection unit 210 refers to the policy information 254 and collates the current location information of the client terminal 200 with the policy information 254 to obtain information on the sensitivity of the encryption key that can be obtained. For example, when the client terminal 200 moves from the in-house network 405 to the permission network 406, only the private key and general key can be used.

(Vii) Step S1107
The terminal location information change detection unit 210 determines whether or not it holds a key that cannot be acquired based on the current policy. If a key that cannot be acquired is held (Yes in step S1107), the process proceeds to step S1108. If not held (No in step S1107), the process proceeds to step S1109. For example, in the example of (vi), since it has a “top secret key” that cannot be acquired in the permitted network, the process proceeds to step S1108.

(Viii) Step S1108
The terminal position information change detection unit 210 deletes a key that cannot be acquired at the current position (policy name 401) of the client terminal 200. That is, in the above example, the “top secret key” is deleted.

(Ix) Step S1109
The terminal position information change detection unit 210 determines whether there is a key that can be used at the current position (policy name 401) of the client terminal 200 but is not held. If there is a key that can be used but is not held (Yes in step S1109), the process proceeds to step S1110. For example, when the client terminal 200 moves from the permitted network 406 to the in-house network 405, it becomes a key that is not held even though the secret key can be used. If the key is already held (No in step S1109), this flowchart ends.

(X) Step S1110
The terminal location information change detection unit 210 acquires a key that can be acquired from the management server 100.

(2) Specific Example FIG. 12 is a sequence diagram for explaining a specific example in the case of operating with the policy shown in FIG.

(I) Sequence 1
It is assumed that when the client terminal 200 is located in the in-house network, the management server 100 is authenticated by a user operation. At this time, it is assumed that the client terminal 200 does not hold any encryption key.

(Ii) Sequence 2
When the authentication is completed, the policy acquisition unit 230 of the client terminal 200 acquires the latest policy 173 from the management server 100 and holds it as policy information 254. At this point, the encryption key has not yet been acquired.

(Iii) Sequence 3
The terminal location information change detection unit 210 of the client terminal 200 determines that the policy (policy name 401) is the in-house network 405 from the current location information of the client terminal 200, and responds to the confidentiality 404 of the in-house network from the management server 100. To obtain a top secret key, a private key, and a general key. Here, the encryption key is acquired for the first time.

(Iv) Sequence 4
It is assumed that the user holding the client terminal 200 has moved from the internal network to the external network by moving the physical location or changing the IP address. Simply moving the network does not change the encryption key that is held, and the encryption keys held at this time are a top secret key, a private key, and a general key.

(V) Sequence 5
Since the terminal position information change detection unit 210 has moved to the external network, the policy information 254 is referred to, and the secret key and the external secret key are deleted from the acquired encryption keys (the top secret key, the external secret key, and the general key). . Therefore, at this point, the client terminal 200 holds only the general key.

(Vi) Sequence 6
Subsequently, it is assumed that the user changes the IP address and moves from the external network to the permitted network. At this point of moving the network, the client terminal 200 is still in a state of holding only the general key.

(Vii) Sequence 7
Since the terminal location information change detection unit 210 has moved to the permitted network, the terminal location information change detection unit 210 refers to the policy information 254 and acquires an external private key from among the unobtained encryption keys (a top secret key and an external private key) from the management server 100. Therefore, at this point, the client terminal 200 holds the private secret key and the general key.

  As described above, in the client terminal 200 according to the embodiment of the present invention, an encryption key can be acquired or deleted according to a change in the position (IP address and physical position) of the client terminal 200 and used. The keys that can be restricted are limited.

<Summary>
(I) In the present invention, it is possible to set a confidentiality to an encryption key for encrypting a file. For example, a single key for encrypting a file used by an individual has been sufficient in the past, but it can be selected from encryption keys set with confidentiality such as “confidential”, “private secret”, and “general”. In addition, it is possible to control an encryption key that can be acquired using physical location information of a PC or mobile terminal and location information on a network. For example, if you log in to the key management server from the internal network, you can get all the encryption keys, but if you log in from the network permitted by the policy, the confidentiality of “confidential” and “general” is set Only the encryption key can be acquired, and when logging in from another network, only the encryption key with “general” sensitivity set can be acquired. Further, the encryption key is controlled when the location information on the network changes. For example, when switching from an in-house network to a network permitted by policy, the “confidential” encryption key and the file decrypted with the “confidential” encryption key are deleted. This prevents a secret file from being referred to outside the company and an encryption key for decrypting the secret file from being leaked outside the company, thereby improving the security of the data file on the cloud storage. That is, according to the present invention, it is possible to control the physical position where the file can be encrypted and decrypted and the position on the network according to the sensitivity of the information. Further, it is possible to prevent the encryption key from leaking out of the physical location where the acquisition of the encryption key is permitted by the policy and the location on the network.

(Ii) The present invention is not limited to the above-described embodiment, and includes various modifications. The above embodiment has been described in detail for easy understanding of the present invention, and is not necessarily limited to the one having all the configurations described. A part of the configuration of one embodiment can be replaced with the configuration of another embodiment. The configuration of another embodiment can be added to the configuration of a certain embodiment. Further, with respect to a part of the configuration of each embodiment, another configuration can be added, deleted, or replaced.

  For example, in the above embodiment, an encryption method in which the encryption key and the decryption key are the same is assumed. However, the present invention can also be applied when the encryption key and the decryption key are different (for example, a public key encryption method). In this case, the management server 100 manages each pair of the encryption key and the decryption key, and the client terminal 200 may notify the management server 100 which one of the encryption key and the decryption key is required. .

  Further, a finer policy can be applied by combining the top secret key 1712, the external secret key 1714, and the general key 1716 with service sharing and system sharing described in Patent Document 1.

  Further, in this specification, it is assumed that the cloud storage is used, but a file server or a private cloud storage can be used as a storage location of the encrypted file.

  Furthermore, in the above embodiment, the password is exemplified as the authentication information for authenticating the user. However, if the client terminal 200 can decrypt each encryption key, other authentication information can be used.

  In the above embodiment, Windows (registered trademark) is assumed as the folder configuration, but a similar mechanism can be provided on other OSs.

(Iii) The present invention can also be realized by software program codes that implement the functions of the embodiments. In this case, a storage medium in which the program code is recorded is provided to the system or apparatus, and the computer (or CPU or MPU) of the system or apparatus reads the program code stored in the storage medium. In this case, the program code itself read from the storage medium realizes the functions of the above-described embodiments, and the program code itself and the storage medium storing the program code constitute the present invention. As a storage medium for supplying such program code, for example, a flexible disk, CD-ROM, DVD-ROM, hard disk, optical disk, magneto-optical disk, CD-R, magnetic tape, nonvolatile memory card, ROM Etc. are used.

  Also, based on the instruction of the program code, an OS (operating system) running on the computer performs part or all of the actual processing, and the functions of the above-described embodiments are realized by the processing. May be. Further, after the program code read from the storage medium is written in the memory on the computer, the computer CPU or the like performs part or all of the actual processing based on the instruction of the program code. Thus, the functions of the above-described embodiments may be realized.

  Further, by distributing the program code of the software that realizes the functions of the embodiment via a network, it is stored in a storage means such as a hard disk or memory of a system or apparatus, or a storage medium such as a CD-RW or CD-R And the computer (or CPU or MPU) of the system or apparatus may read and execute the program code stored in the storage means or the storage medium when used.

  Finally, it should be understood that the processes and techniques described herein are not inherently related to any particular apparatus, and can be implemented by any suitable combination of components. In addition, various types of devices for general purpose can be used in accordance with the teachings described herein. It may prove useful to build a dedicated device to perform the method steps described herein. Various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiments. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, constituent elements over different embodiments may be appropriately combined. Although the present invention has been described with reference to specific examples, these are in all respects illustrative rather than restrictive. Those skilled in the art will appreciate that there are numerous combinations of hardware, software, and firmware that are suitable for implementing the present invention. For example, the described software can be implemented in a wide range of programs or script languages such as assembler, C / C ++, perl, shell, PHP, Java (registered trademark).

  Furthermore, in the above-described embodiment, control lines and information lines are those that are considered necessary for explanation, and not all control lines and information lines on the product are necessarily shown. All the components may be connected to each other.

100 ... Management server 101 ... CPU
DESCRIPTION OF SYMBOLS 102 ... Memory 103 ... Input / output device 104 ... Communication device 110 ... Top secret key encryption part 120 ... Private key encryption part 130 ... General key encryption part 140 ... PW Key encryption unit 150 ... Encryption key transmission unit 160 ... Policy management unit 170 ... Database 172 ... Management key 173 ... Policy 200 ... Client terminal 201 ... CPU
202 ... Memory 203 ... Input / output device 204 ... Communication device 210 ... Terminal location information change detection unit 220 ... Terminal location information notification unit 230 ... Policy acquisition unit 240 ... Network connection Unit 250 ... Storage device 300 ... Cloud storage 301 ... Network

Claims (18)

A data management system having a management server for performing user authentication, at least one client terminal, and a cloud storage for storing files,
The client terminal is
Sending the location information of the client terminal to the management server;
Obtain an encryption key according to the location information and encrypt the file or decrypt the encrypted file,
The management server
Managing a plurality of encryption keys according to the security level and a policy for determining the security level according to the position of the client terminal;
Based on the location information received from the client terminal and the policy, the security level of the client terminal is determined, and an encryption key corresponding to the determined security level is transmitted to the client terminal.
A data management system characterized by that. In claim 1,
The data management system, wherein the location information includes information on an IP address of the client terminal and information on a physical location of the client terminal. In claim 1,
The management server has a secret key that is an encryption key for encrypting and decrypting a data file that can be viewed only on a specific network and a specific physical location, and is viewed only on an authorized network A private key that is an encryption key for encrypting and decrypting data files that can be encrypted, and a data file that can be viewed on any network and at any physical location are encrypted and decrypted A data management system that manages a general key that is an encryption key to be managed. In claim 3,
The management server (i) when the client terminal operates on the specific network and is in a specific physical position, all of the top secret key, the private secret key, and the general key are all stored in the client terminal (Ii) when the client terminal is operating on the permitted network, only the private key and the general key are transmitted to the client terminal; and (iii) the client terminal A data management system characterized in that when operating on a network and in any physical location, only the general key is transmitted to the client terminal. In claim 1,
When the client terminal detects a change in the position information of the client terminal after acquiring the encryption key corresponding to the security level based on the position information, the client terminal corresponds to the security level based on the position information after the change. The encryption key is specified. When the previous security level is higher than the current security level, at least one of the previously acquired encryption keys is deleted, and when the previous security level is lower than the current security level, the management is performed. A data management system characterized by acquiring an insufficient encryption key from a server. In claim 4,
When the client terminal is operating on the permitted network and downloads a data file that can be decrypted only with the secret key, the client terminal can identify the specific network and the specific network from the permitted network. The data management system is characterized in that the secret key is acquired from the management server and the downloaded data file is automatically decrypted using the acquired secret key when the data is moved to a physical location. A data management method between a management server that performs user authentication, at least one client terminal, and a cloud storage that stores files,
The management server manages a plurality of encryption keys according to a security level and a policy for determining a security level according to the position of the client terminal,
The client terminal transmitting position information of the client terminal to the management server;
The management server determines a security level of the client terminal based on the location information received from the client terminal and the policy, and transmits an encryption key corresponding to the determined security level to the client terminal. And steps to
The client terminal receives an encryption key corresponding to the location information from the management server, and encrypts a file or decrypts an encrypted file;
A data management method characterized by comprising: In claim 7,
The location information includes information on an IP address of the client terminal and information on a physical location of the client terminal. In claim 7,
The management server has a secret key that is an encryption key for encrypting and decrypting a data file that can be viewed only on a specific network and a specific physical location, and is viewed only on an authorized network. A private key that is an encryption key for encrypting and decrypting data files that can be encrypted, and a data file that can be viewed on any network and at any physical location are encrypted and decrypted A data management method for managing a general key that is an encryption key to be managed. In claim 9,
The management server (i) when the client terminal operates on the specific network and is in a specific physical position, all of the top secret key, the private secret key, and the general key are all stored in the client terminal (Ii) when the client terminal is operating on the permitted network, only the private key and the general key are transmitted to the client terminal; and (iii) the client terminal A data management method characterized by transmitting only the general key to the client terminal when operating on a network and in any physical location. In claim 7,
Further, when the client terminal detects a change in the position information of the client terminal after obtaining the encryption key corresponding to the security level based on the position information, the security level is set to the security level based on the position information after the change. Identifying a corresponding encryption key;
When the previous security level is higher than the current security level, the client terminal deletes at least one of the previously obtained encryption keys, and when the previous security level is lower than the current security level, the management server Obtaining a missing cryptographic key from
A data management method characterized by comprising: In claim 10,
Further, when the client terminal downloads a data file that can be decrypted only with the secret key when operating on the permitted network, the specific network and the specific physical are downloaded from the permitted network. A data management method comprising the steps of: obtaining the secret key from the management server when the user moves to a specific location; and automatically decrypting the downloaded data file using the obtained secret key . A client terminal that communicates with a management server that performs user authentication and a cloud storage that stores files,
A memory for storing various programs;
A processor that reads and executes various programs from the memory,
The processor is
Sending the location information of the client terminal to the management server;
Receiving a plurality of encryption keys according to a security level and a policy for determining a security level according to a position of the client terminal from the management server;
Encrypting a file or decrypting an encrypted file based on an encryption key corresponding to the location information;
A client terminal characterized by that. In claim 13,
The location information includes information on an IP address of the client terminal and information on a physical location of the client terminal. In claim 13,
The processor includes a secret key that is an encryption key for encrypting and decrypting a data file that can be viewed only on a specific network and at a specific physical location from the management server, and an authorized network. A private key, which is an encryption key for encrypting and decrypting data files that can only be viewed on the Internet, and a data file that can be viewed on any network and at any physical location are encrypted. A client terminal that receives a general key that is an encryption key to be encrypted and decrypted. In claim 15,
The processor, from the management server, (i) when the client terminal operates on the specific network and is in a specific physical location, all of the top secret key, the private secret key, and the general key (Ii) when the client terminal is operating on the authorized network, only the private key and the general key are received; and (iii) the client terminal operates on the arbitrary network And the client terminal receives only the general key when in the arbitrary physical location. In claim 13,
When the processor detects a change in the position information of the client terminal after acquiring the encryption key corresponding to the security level based on the position information, the processor corresponds to the encryption corresponding to the security level based on the position information after the change. A key is specified, and if the previous security level is higher than the current security level, at least one of the previously obtained encryption keys is deleted, and if the previous security level is lower than the current security level, the management server A client terminal characterized in that an insufficient encryption key is obtained from the client. In claim 16,
When the client terminal downloads a data file that can be decrypted only by the secret key when the client terminal is operating on the permitted network, the processor transmits the specific network and the specific network from the permitted network. A client terminal, wherein when moved to a physical position, the secret key is acquired from the management server, and the downloaded data file is automatically decrypted using the acquired secret key.

Images