JP2016072769A5

JP2016072769A5 -

Info

Publication number: JP2016072769A5
Application number: JP2014199202A
Authority: JP
Filing date: 2014-09-29
Publication date: 2017-04-06
Anticipated expiration: 2034-09-29

Claims

A data management system having a management server for performing user authentication, at least one client terminal, and a cloud storage for storing files,
The client terminal is
Sending the location information of the client terminal to the management server;
Acquires the encryption key corresponding to the position information to decrypt the encrypted or encrypted file to file,
The management server
Managing a plurality of encryption keys according to the security level and a policy for determining the security level according to the position of the client terminal;
Wherein based on the policy and the position information received from the class Ia cement terminal, it determines the security level of the client terminal, and transmits the encryption key corresponding to a security level that is the determined to the client terminal,
A data management system characterized by that.

In claim 1,
The data management system, wherein the location information includes information on an IP address of the client terminal and information on a physical location of the client terminal.

In claim 1,
The management server has a secret key that is an encryption key for encrypting and decrypting a data file that can be viewed only on a specific network and a specific physical location, and is viewed only on an authorized network A private key that is an encryption key for encrypting and decrypting data files that can be encrypted, and a data file that can be viewed on any network and at any physical location are encrypted and decrypted A data management system that manages a general key that is an encryption key to be managed.

In claim 3,
The management server (i) when the client terminal operates on the specific network and is in a specific physical position, all of the top secret key, the private secret key, and the general key are all stored in the client terminal (Ii) when the client terminal is operating on the permitted network, only the private key and the general key are transmitted to the client terminal; and (iii) the client terminal A data management system characterized in that when operating on a network and in any physical location, only the general key is transmitted to the client terminal.

In claim 1,
Said client terminal, when detecting a change in the position information of the client terminal after obtaining the encryption key corresponding to the security level based on the position information, corresponding to the security level based on the position information after the change If the previous security level is higher than the current security level, at least one of the previously acquired encryption keys is deleted, and if the previous security level is lower than the current security level, the encryption key is deleted. A data management system characterized by acquiring a missing encryption key from a management server.

In claim 4,
When the client terminal is operating on the permitted network and downloads a data file that can be decrypted only with the secret key, the client terminal can identify the specific network and the specific network from the permitted network. The data management system is characterized in that the secret key is acquired from the management server and the downloaded data file is automatically decrypted using the acquired secret key when the data is moved to a physical location.

A data management method between a management server that performs user authentication, at least one client terminal, and a cloud storage that stores files,
The management server manages a plurality of encryption keys according to a security level and a policy for determining a security level according to the position of the client terminal,
The client terminal transmitting position information of the client terminal to the management server;
The management server, the based on the policy and the position information received from the class Ia cement terminal, determines the security level of the client terminal, the encryption key corresponding to a security level that is the determined to the client terminal Sending, and
A step wherein the client terminal, for receiving an encryption key corresponding to the position information from the management server decrypts the encrypted or encrypted file to file,
A data management method characterized by comprising:

In claim 7,
The location information includes information on an IP address of the client terminal and information on a physical location of the client terminal.

In claim 7,
The management server has a secret key that is an encryption key for encrypting and decrypting a data file that can be viewed only on a specific network and a specific physical location, and is viewed only on an authorized network. A private key that is an encryption key for encrypting and decrypting data files that can be encrypted, and a data file that can be viewed on any network and at any physical location are encrypted and decrypted A data management method for managing a general key that is an encryption key to be managed.

In claim 9,
The management server (i) when the client terminal operates on the specific network and is in a specific physical position, all of the top secret key, the private secret key, and the general key are all stored in the client terminal (Ii) when the client terminal is operating on the permitted network, only the private key and the general key are transmitted to the client terminal; and (iii) the client terminal A data management method characterized by transmitting only the general key to the client terminal when operating on a network and in any physical location.

In claim 7,
Furthermore, when said client terminal, it detects a change in the position information of the client terminal after obtaining the encryption key corresponding to the security level based on the position information, the security level based on the position information after the change Identifying an encryption key corresponding to
When the previous security level is higher than the current security level, the client terminal deletes at least one of the previously obtained encryption keys, and when the previous security level is lower than the current security level, the management server Obtaining a missing cryptographic key from
A data management method characterized by comprising:

In claim 10,
Further, when the client terminal downloads a data file that can be decrypted only with the secret key when operating on the permitted network, the specific network and the specific physical are downloaded from the permitted network. A data management method comprising the steps of: obtaining the secret key from the management server when the user moves to a specific location; and automatically decrypting the downloaded data file using the obtained secret key .

A client terminal that communicates with a management server that performs user authentication and a cloud storage that stores files,
A memory for storing various programs;
A processor that reads and executes various programs from the memory,
The processor is
Sending the location information of the client terminal to the management server;
Receiving a plurality of encryption keys according to a security level and a policy for determining a security level according to a position of the client terminal from the management server;
Encrypting a file or decrypting an encrypted file based on an encryption key corresponding to the location information;
A client terminal characterized by that.

In claim 13,
The location information includes information on an IP address of the client terminal and information on a physical location of the client terminal.

In claim 13,
The processor includes a secret key that is an encryption key for encrypting and decrypting a data file that can be viewed only on a specific network and at a specific physical location from the management server, and an allowed network A private key, which is an encryption key for encrypting and decrypting data files that can only be viewed on the Internet, and data files that can be viewed on any network and at any physical location are encrypted. A client terminal that receives a general key that is an encryption key to be encrypted and decrypted.

In claim 15,
The processor, from the management server, (i) when the client terminal operates on the specific network and is in a specific physical location, all of the top secret key, the private secret key, and the general key (Ii) when the client terminal is operating on the authorized network, only the private key and the general key are received; and (iii) the client terminal operates on the arbitrary network And the client terminal receives only the general key when in the arbitrary physical location.

In claim 13,
Wherein the processor, when detecting a change in the position information of the client terminal after obtaining the encryption key corresponding to the security level based on the position information, corresponding to the security level based on the position information after the change The encryption key is specified. When the previous security level is higher than the current security level, at least one of the previously acquired encryption keys is deleted, and when the previous security level is lower than the current security level, the management is performed. A client terminal characterized by acquiring a missing encryption key from a server.

In claim 16,
When the client terminal downloads a data file that can be decrypted only by the secret key when the client terminal is operating on the permitted network, the processor transmits the specific network and the specific network from the permitted network. A client terminal, wherein when moved to a physical position, the secret key is acquired from the management server, and the downloaded data file is automatically decrypted using the acquired secret key.