JP2017129737A - Communication information management device, communication information management system, communication information management method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve anonymity of a person concerned in communication.SOLUTION: A communication information management device comprises: a storage part for storing a fragment of communication information as information to be used for communication; a transmission part for, when receiving an inquiry segment obtained by segmenting an inquiry to the communication information from a terminal, transmitting the segment of the communication information corresponding to the inquiry segment among the segments of the communication information stored in the storage part to the terminal; and a transfer part for, when the segment of the communication information corresponding to the inquiry segment is not stored in the storage part, transferring the inquiry segment to a restoration device which restores the inquiry from the inquiry segment by rewriting an address of the transmission source of the inquiry segment.SELECTED DRAWING: Figure 5

Description

  The present invention relates to a communication information management device, a communication information management system, a communication information management method, and a program.

  Conventionally, techniques for realizing anonymous communication have been proposed, and some of them have been put to practical use on the Internet. Here, anonymous communication refers to concealing the fact of who and when communicated from other than the two parties of the transmission source and the destination that are directly involved in the communication. As a technique for realizing anonymous communication on the Internet, Tor shown in Non-Patent Document 1 is used.

  On the other hand, a secret calculation technique for performing statistical processing of data with encryption has been studied (for example, Non-Patent Document 2). Secret calculation technology divides the data that you want to keep secret into multiple fragment files, encrypts them, and stores each fragment file on a separate server or cloud, so that multiple fragment files can be restored and decrypted. Reduce the risk of information leakage. Furthermore, statistical processing such as information retrieval, addition, and average value calculation can be realized with the encrypted fragment file. If the secret calculation technology is used, secondary use of these data becomes possible while keeping the contents of the data secret from the server or cloud operator holding the data. Therefore, the secret calculation technique is an effective technique for utilizing privacy-sensitive data and highly confidential / anonymity data.

Roger Dingledine, Nick Mathewson, and Paul Syverson, Tor: The Second-Generation Onion Router. In USENIX Security, 2004, Internet (URL: http://static.usenix.org/event/sec04/tech/dingledine.html) “Secret Computation Technology” that allows highly confidential data to be used safely and securely, March 2014 issue of NTT Technical Journal, p.67-70, Internet <URL: http://www.ntt.co.jp/ journal / 1403 / files / jn201403067.pdf>

  However, in actual communication, in addition to a form in which a sender and a receiver communicate directly, such as access to a Web server, a form in which content is acquired from a cache server, such as a CDN (Content Delivery Network), is also common. Is used.

  Even when the sender communicates directly with the receiver, in a general communication protocol, it is necessary to acquire information necessary for communication from various servers existing in the network before starting communication. For example, in communication on the Internet, preprocessing such as DNS (Domain Name System) that acquires an IP address corresponding to a URL of a Web site or a public key necessary for communication is acquired from a directory server.

  Even if the communication from the sender to the receiver itself is concealed by using anonymous communication technology such as Tor, provided by a third party such as content acquisition from CDN, inquiry to DNS, encryption key acquisition, etc. If the process of acquiring information from the cache server or the like is not anonymized, there is a possibility that a third party can guess the sender and receiver related to communication.

  In addition, information that does not exist in the cache server is generally obtained by making an inquiry to a higher-level server existing in the Internet or the like. If this inquiry is not anonymized, for example, FIG. As shown in FIG. 4, there is a possibility that another third party providing the higher-level server can guess that communication has been performed between the transmission source terminal and the destination terminal.

  The present invention has been made in view of the above points, and an object thereof is to improve the anonymity of parties to communication.

  Therefore, in order to solve the above problem, the communication information management apparatus receives from the terminal a storage unit that stores a fragment of communication information that is information used for communication, and a query fragment obtained by fragmenting a query for the communication information. Of the communication information fragments stored in the storage unit, a transmission unit that transmits a communication information fragment corresponding to the inquiry fragment to the terminal, and a communication information fragment corresponding to the inquiry fragment stored in the storage unit A transfer unit that rewrites the address of the transmission source of the inquiry fragment and transfers the inquiry fragment from the inquiry fragment to a restoration device that restores the inquiry.

  Anonymity of communication parties can be improved.

It is a figure for demonstrating the problem of a prior art. It is a figure which shows the structural example of the network system in embodiment of this invention. It is a figure which shows the hardware structural example of the fragment | piece server in embodiment of this invention. It is a figure which shows the function structural example of a transmission source terminal. It is a figure which shows the function structural example of a fragment server. It is a figure which shows the function structural example of an iterative inquiry apparatus. It is a figure which shows the function structural example of a registration apparatus. It is a sequence diagram for demonstrating an example of the process sequence at the time of the inquiry of communication information. It is a sequence diagram for demonstrating an example of the process sequence regarding a repetitive inquiry. It is a sequence diagram for demonstrating an example of the process sequence performed regarding the inquiry of DNS. It is a figure for demonstrating the effect of embodiment of this invention.

  In the embodiment of the present invention, a terminal (hereinafter referred to as “source terminal 50”) that wants to communicate with communicates information (hereinafter referred to as “destination terminal 60”) that is necessary for communication with a terminal (hereinafter referred to as “destination terminal 60”). Hereinafter, the secret calculation technique is applied to a process of acquiring “communication information” from a third party server other than the transmission source terminal 50 and the destination terminal 60. Thereby, since the communication information stored in the server is divided as a fragment file and further encrypted, the content of the communication information can be concealed from the server (third party). Moreover, the content of the inquiry message is also concealed by dividing the message when the transmission source terminal 50 inquires the communication information by the secret calculation technique. As a result, in addition to eavesdropping on the network, it is difficult to acquire logs on network devices and servers. Furthermore, the server that received the inquiry about the communication information can answer the requested communication information without knowing the contents of the inquiry by the secret calculation technology, so that the inquiry contents on the server side can be concealed. Become.

  That is, the communication information itself stored in the server, the message content for inquiring the communication information, and the response are all kept secret, so what information the transmission source terminal 50 is trying to acquire and where to communicate. It becomes difficult for a third party to guess whether he is trying to do so.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 2 is a diagram showing a configuration example of the network system in the embodiment of the present invention. The network system 1 shown in FIG. 2 has a configuration for concealing communication between the transmission source terminal 50 and the destination terminal 60 from a third party, and fragment servers 10a, 10b, and 10c (hereinafter, unless they are distinguished from each other, (Referred to as “fragment server 10”), an iterative inquiry device 20, a registration device 30, and a host server 40.

  In each fragment server 10, fragment files obtained by dividing communication information (hereinafter referred to as “communication information fragments”) are distributed and stored. The communication information may be the cached content itself or information required in advance of communication (such as the location and address of the destination terminal 60, public key information necessary for encrypting communication with the destination terminal 60). However, the present invention is not limited to this. In the present embodiment, an example in which three fragment servers 10 are used will be described. However, any number of fragment servers 10 may be used as long as the number is two or more.

  The transmission source terminal 50 inquires of each fragment server 10 about a fragment of communication information using a secret calculation technique.

  The iterative inquiry device 20 is an information processing device (for example, a computer) that inquires the host server 40 about the communication information when the fragment of the communication information that has received the inquiry does not exist in the fragment server 10. An inquiry is made from the iterative inquiry device 20 to the upper server 40 using a normal protocol without using a secret calculation.

  When the registration device 30 receives a communication information registration request from a terminal that holds communication information, such as the destination terminal 60, or from the iterative inquiry device 20 that has acquired the communication information from the host server 40, the registration device 30 fragments the communication information to be registered. And an information processing apparatus (for example, a computer) that encrypts and generates fragments of communication information and distributes and registers each fragment in the fragment server 10.

  The host server 40 is, for example, a DNS (Domain Name System) authoritative DNS server and manages communication information. The host server 40 is a computer that also holds communication information that does not exist in the local network N1 (that is, the fragment server 10).

  In the present embodiment, it is assumed that a business operator that provides the fragment server 10 provides an anonymous communication service to a user holding the transmission source terminal 50. That is, it is assumed that there is a minimum trust relationship between the user holding the transmission source terminal 50 and the business operator providing the fragment server 10 by a contract or the like. On the other hand, the third party that provides the upper server 40 may not have any relationship with the user holding the transmission source terminal 50.

  FIG. 3 is a diagram illustrating a hardware configuration example of the fragment server according to the embodiment of the present invention. The fragment server 10 in FIG. 3 includes a drive device 100, an auxiliary storage device 102, a memory device 103, a CPU 104, an interface device 105, and the like that are connected to each other via a bus B.

  A program for realizing processing in the fragment server 10 is provided by a recording medium 101 such as a CD-ROM. When the recording medium 101 storing the program is set in the drive device 100, the program is installed from the recording medium 101 to the auxiliary storage device 102 via the drive device 100. However, the program need not be installed from the recording medium 101 and may be downloaded from another computer via a network. The auxiliary storage device 102 stores the installed program and also stores necessary files and data.

  The memory device 103 reads the program from the auxiliary storage device 102 and stores it when there is an instruction to start the program. The CPU 104 executes functions related to the fragment server 10 in accordance with the program stored in the memory device 103. The interface device 105 is used as an interface for connecting to a network.

  The iterative inquiry device 20, the registration device 30, the upper server 40, the transmission source terminal 50, and the destination terminal 60 may also have hardware as shown in FIG. Further, the iterative inquiry device 20 and the registration device 30 may be realized using a common computer.

  FIG. 4 is a diagram illustrating a functional configuration example of the transmission source terminal. In FIG. 4, the transmission source terminal 50 includes an application 51, a secret calculation unit 52, an inquiry unit 53, and the like. Each of these units is realized by processing that causes the CPU of the transmission source terminal 50 to execute one or more programs installed in the transmission source terminal 50.

  The application 51 communicates with the destination terminal 60. As an example of the application 51, a DNS resolver that acquires an IP address corresponding to a URL (Uniform Resource Locator) of the destination terminal 60, an application that performs encryption with the destination terminal 60, an encryption protocol, and the content itself are acquired. CDN (Contents Delivery Network) application and the like.

  The secret calculation unit 52 divides and encrypts the inquiry contents of the communication information from the application 51 into a plurality of fragments (hereinafter referred to as “inquiry fragments”) by the secret calculation function. For example, each IP address query fragment corresponding to a domain name includes information indicating a part of the domain name. The information indicating a part of the domain name is not necessarily a part as a character string. It may be possible to derive the domain name by combining each part by a bit operation or the like. Note that “division / encryption” refers to a state in which the processes of “division” and “encryption” are executed without distinction in the process of fragmenting the inquiry content. However, “division” and “encryption” may be executed with distinction.

  The secret calculation unit 52 also restores and decrypts the communication information fragment that is the inquiry result received from the inquiry unit 53, and returns the restored and decrypted communication information to the application 51. “Restoration / decryption” refers to a state in which the processes of “restoration” and “decryption” are executed without distinction in the process of restoring a fragment to communication information. However, “restoration” and “decryption” may be executed with distinction. The communication information fragment is information indicating a part of the IP address if the communication information is an IP address, for example. The information indicating a part of the IP address is information from which the IP address can be derived by combining each part by a bit operation or the like.

  The inquiry unit 53 transmits an inquiry fragment to each fragment server 10 registered in advance, or receives a fragment of communication information obtained as an inquiry result from each fragment server 10. The inquiry unit 53 knows a rule as to which inquiry fragment should be transmitted to which fragment server 10. For example, the first query fragment generated by the secret calculation unit 52 corresponds to the fragment server 10a, the second query fragment generated corresponds to the fragment server 10b, and the third query fragment generated is The inquiring unit 53 knows that it corresponds to the fragment server 10c.

  FIG. 5 is a diagram illustrating a functional configuration example of the fragment server. In FIG. 5, the fragment server 10 includes an inquiry reception unit 11, a secret calculation unit 12, an iterative inquiry request unit 13, and a fragment registration reception unit 14. Each of these units is realized by processing that one or more programs installed in the fragment server 10 cause the CPU 104 of the fragment server 10 to execute. The fragment server 10 also has a fragment DB (Data Base) 15. The fragment DB 15 can be realized using, for example, the auxiliary storage device 102 of the fragment server 10 or the like.

  The inquiry reception unit 11 receives an inquiry fragment of communication information from the transmission source terminal 50, and acquires a fragment of communication information that matches the inquiry fragment from communication information fragments stored in its own fragment DB 15. The acquired fragment is transmitted to the transmission source terminal 50. When searching the fragment DB 15, the secret calculation unit 12 is used. The secret calculation unit 12 uses a secret calculation technique to search for a fragment of communication information while being encrypted without decrypting the inquiry fragment.

  The fragment DB 15 stores communication information fragments. For example, when the fragment server 10 is a DNS server, the fragment DB 15 stores fragments such as A records.

  The iterative inquiry request unit 13 sends an inquiry of communication information to the upper server 40 to the iterative inquiry device 20 when there is no communication information fragment corresponding to the inquiry fragment received by the inquiry accepting unit 11 in its own fragment DB 15. Request. For example, when a fragment of an IP address corresponding to a DNS inquiry fragment is not stored in the fragment DB 15, an example of inquiring the upper server 40 as a higher authority DNS server, or an inquiry fragment is supported. There is an example in which when a fragment of content is not stored in the fragment DB 15, an inquiry for acquiring the content is performed from the upper server 40 which is another server. The iterative inquiry request unit 13 transfers the inquiry fragment received from the transmission source terminal 50 to the iterative inquiry device 20 as it is without decoding it. However, the repetitive inquiry request unit 13 rewrites the transmission source address of the inquiry fragment packet from the IP address of the transmission source terminal 50 to the IP address of the fragment server 10 itself. By doing so, the inquiry source transmission source terminal 50 is concealed from the upper server 40.

  The fragment registration receiving unit 14 registers the communication information fragment in the fragment DB 15 of the fragment server 10 in response to a request from the registration device 30. A fragment of communication information received from the registration device 30 is stored in the fragment DB 15 as it is.

  FIG. 6 is a diagram illustrating a functional configuration example of the iterative inquiry device. In FIG. 6, the iterative inquiry device 20 includes an iterative inquiry accepting unit 21, a secret sharing unit 22, a higher-order inquiry unit 23, a registration request unit 24, and the like. Each of these units is realized by processing that one or more programs installed in the iterative inquiry device 20 cause the CPU of the iterative inquiry device 20 to execute.

  The repetitive inquiry reception unit 21 receives an inquiry fragment from each fragment server 10.

  The secret sharing unit 22 restores / decrypts each query fragment, and inputs the restored query content to the upper query unit 23.

  The upper inquiry unit 23 transfers the restored inquiry content to an appropriate external upper server 40 using a normal communication protocol. In the example of DNS, the process which performs a repeated inquiry to an authoritative DNS server corresponds as a DNS resolver. The high-order inquiry unit 23 changes the high-order server 40 that is the inquiry destination or changes the protocol used for the inquiry according to the content or type of the communication information to be inquired.

  The registration request unit 24 requests the registration device 30 to register the result (communication information) obtained by the inquiry from the upper inquiry unit 23 to the upper server 40 in the fragment DB 15 of each fragment server 10.

  FIG. 7 is a diagram illustrating a functional configuration example of the registration apparatus. In FIG. 7, the registration device 30 includes a registration receiving unit 31, a secret sharing unit 32, a fragment registration requesting unit 33, and the like. Each of these units is realized by processing that one or more programs installed in the registration apparatus 30 cause the CPU of the registration apparatus 30 to execute.

  The registration receiving unit 31 receives a communication information registration request from the iterative inquiry device 20, the destination terminal 60, or the like.

  The secret sharing unit 32 divides the communication information received by the registration receiving unit 31 into a plurality of (in this embodiment, three) pieces, encrypts each piece, and converts the encrypted pieces of communication information into pieces. Input to the registration request unit 33.

  The fragment registration request unit 33 transmits the fragment of the communication information to be registered received from the secret sharing unit 32 to each fragment server 10. The fragment registration request unit 33 knows a rule as to which fragment of communication information should be transmitted to which fragment server 10. For example, the first fragment generated by the secret sharing unit 32 corresponds to the fragment server 10a, the second fragment generated corresponds to the fragment server 10b, and the third fragment generated is the fragment server. The fragment registration request unit 33 knows that it corresponds to 10c. The rules known by the fragment registration request unit 33 correspond to the rules known by the inquiry unit 53.

  It should be noted that the secret calculation unit 52 and the secret calculation unit 12 (hereinafter simply referred to as “secret calculation unit” when they are not distinguished from each other), and the secret sharing unit 22 and the secret distribution unit 32 (hereinafter, when both are not distinguished from each other, simply The “secret sharing unit” is mainly different in the following points.

  The secret calculation unit searches the fragment DB 15 based on the divided / encrypted inquiry fragment to acquire the corresponding communication information fragment, and restores / decrypts the communication information fragment as the inquiry result to restore the original A function of extracting communication information. That is, the secret calculation unit not only simply divides / restores and encrypts / decrypts, but also searches for a fragment of related communication information from the divided inquiry fragments, or extracts a plurality of divided pieces of communication information. A function of restoring the original communication information in combination.

  On the other hand, the secret sharing unit has only a function of dividing / encrypting single information into a plurality of fragments and a function of restoring / decrypting the pieces of information from the fragments into the original information.

  Hereinafter, a processing procedure executed in the network system 1 will be described. FIG. 8 is a sequence diagram for explaining an example of a processing procedure when inquiring communication information.

  In step S1, the application 51 of the transmission source terminal 50 generates communication information inquiry contents. Subsequently, the secret calculation unit 52 of the transmission source terminal 50 divides and encrypts the inquiry content to generate a plurality of inquiry fragments (S2). Subsequently, the inquiry unit 53 of the transmission source terminal 50 transmits one corresponding inquiry fragment to each of all the fragment servers 10 (S3).

  In the fragment servers 10a to 10c, when the inquiry reception unit 11 receives the inquiry fragment transmitted to each of the fragment servers 10a to 10c, the secret calculation unit 12 converts the communication information fragment stored in its fragment DB 15 into the inquiry fragment. A corresponding piece of communication information is searched (S4).

  If the fragment of communication information corresponding to the inquiry fragment is not stored in the fragment DB 15, each fragment server 10 transfers the inquiry fragment to the repetitive inquiry device 20 (S5). Details of step S5 will be described later.

  On the other hand, when the communication information fragment corresponding to the inquiry fragment is searched in each fragment server 10, the inquiry reception unit 11 of each fragment server 10 refers to the searched communication information fragment (hereinafter referred to as “result fragment”). ) Is transmitted to the transmission source terminal 50 as an inquiry result (S6). Note that the result fragment itself is divided and encrypted with respect to the original communication information. When the inquiry unit 53 of the transmission source terminal 50 receives the result fragments from all the fragment servers 10, each result fragment is restored and decoded (S7). As a result, complete communication information, which is an inquiry result for the inquiry content, is obtained (S8).

  Next, details of step S5 will be described. FIG. 9 is a sequence diagram for explaining an example of a processing procedure related to the repetitive inquiry.

  When the communication information fragment corresponding to the inquiry fragment does not exist in the fragment DB 15, the iterative inquiry request unit 13 of each fragment server 10 transmits the inquiry fragment to the iterative inquiry device 20 as it is (S11). However, the repetitive inquiry request unit 13 rewrites the transmission source of the inquiry fragment from the transmission source terminal 50 to the address of each fragment server 10, thereby indicating to the upper server 40 that the transmission source of the inquiry fragment is the transmission source terminal 50. Conceal it.

  When the iterative inquiry receiving unit 21 of the iterative inquiry device 20 receives each inquiry fragment, the secret sharing unit 22 restores and decrypts each inquiry fragment (S12). As a result, the upper inquiry unit 23 can obtain the inquiry content. Therefore, the upper inquiry unit 23 transmits the inquiry content to the upper server 40 (S13). Since the inquiry content is implemented by a normal protocol, the upper server 40 can know the inquiry content. However, since the address of the transmission source of the packet constituting the inquiry is the address of the repetitive inquiry device 20, It is difficult for the upper server 40 to specify that the inquiry source is the transmission source terminal 50.

  Subsequently, the upper server 40 returns the communication information corresponding to the inquiry content to the iterative inquiry device 20 as an inquiry result (S14).

  When the upper inquiry unit 23 of the iterative inquiry device 20 receives the communication information as the inquiry result, the secret sharing unit 22 fragments the communication information by dividing and encrypting the communication information (S19). Subsequently, the repetitive inquiry receiving unit 21 transmits each piece of communication information fragment (result fragment) to each fragment server 10 (S20).

  It should be noted that step S6 and subsequent steps in FIG. 8 are executed for the communication information fragment transmitted in step S20.

  When the query result obtained by the iterative inquiry device 20 from the upper server 40 is registered in the fragment DB 15 of the fragment server 10 (for example, when it is cached), following the step S14, the iterative inquiry device 20 The registration request unit 24 transmits a communication information registration request as an inquiry result to the registration device 30 (S15).

  When the registration request receiving unit of the registration device 30 receives the communication information, the secret sharing unit 32 fragments the communication information by dividing / encrypting the communication information (S16). Subsequently, the fragment registration request unit 33 transmits each communication information fragment to the fragment registration reception unit 14 of each fragment server 10 (S17). Upon receiving the communication information fragment, the fragment registration receiving unit 14 of each fragment server 10 registers the communication information fragment in its own fragment DB 15 (S18).

  Next, a processing procedure when the present embodiment is applied to a DNS inquiry will be described. FIG. 10 is a sequence diagram for explaining an example of a processing procedure executed regarding a DNS inquiry. 10, steps corresponding to the steps of FIG. 8 or FIG. 9 are given step numbers obtained by adding 30 to the step numbers of FIG. 8 or FIG. In FIG. 10, the transmission source terminal 50 corresponds to a DNS stub resolver.

  The secret calculation unit 52 of the transmission source terminal 50 requests the DNS inquiry contents for obtaining an IP address corresponding to the domain name from the application 51 (request to tell the IP address corresponding to the domain name: example.com). ) (S31) is divided and encrypted (S32). As a result, three query fragments each including information indicating a part of “example.com” are generated. The inquiry unit 53 transmits each inquiry fragment to each fragment server 10 operating as a DNS cache server (S33). At this time, each inquiry fragment is transmitted to the corresponding fragment server 10.

  Each fragment server 10 searches the fragment DB 15 (S34), and if there is a fragment of the A record corresponding to the inquiry fragment, the fragment is returned to the transmission source terminal 50 (S36). When the inquiry unit 53 of the transmission source terminal 50 receives the result fragments from all the fragment servers 10, the secret calculation unit 52 restores and decrypts each result fragment to obtain A record = 192.0.2.1.

  On the other hand, when the fragment of the A record corresponding to the inquiry fragment does not exist in the fragment DB 15 of each fragment server 10 in step S34, the repetitive inquiry request unit 13 of each fragment server 10 transmits the inquiry fragment to the repetitive inquiry device 20. (S41). At this time, the source address of the inquiry fragment is rewritten from the source terminal 50 to the address of each fragment server 10, so that the inquiry source 20 and the upper server 40, which is an upper authority DNS server, Leakage can be prevented.

  When the repetitive inquiry receiving unit 21 of the repetitive inquiry device 20 receives the inquiry fragments from each fragment server 10, the secret sharing unit 22 restores and decrypts them (S42). Subsequently, after confirming the domain name that is the content of the inquiry, the upper inquiry unit 23 sends a DNS query to the upper server 40, which is an appropriate authoritative DNS server, to make an inquiry (S43). Since the iterative inquiry device 20 operates as a DNS full service resolver, an inquiry to the upper server 40 by the DNS query may occur a plurality of times.

  When the upper query unit 23 of the iterative query device 20 receives the A record as an answer to the DNS query (S44), the secret sharing unit 22 divides and encrypts the A record to generate a result fragment (S49). Subsequently, the repetitive inquiry receiving unit 21 transmits each result fragment to the fragment server 10 (S48). Subsequently, step S36 and subsequent steps are executed.

  In FIG. 10, the registration procedure to each fragment server 10 corresponding to S15 to S18 in FIG. 9 is omitted, but the registration procedure is similarly performed as necessary.

  As described above, according to the present embodiment, it is possible to anonymize the acquisition of communication information stored in the fragment server 10 provided by a third party that is not the transmission source terminal 50 and the destination terminal 60, and Tor By combining with existing anonymous communication technology such as, it is possible to completely anonymize from the acquisition of communication information to actual communication.

  That is, as shown in FIG. 11, between the transmission source terminal 50 and the fragment server 10, the secret calculation technique is applied to conceal where the transmission source terminal 50 is trying to communicate. Then, who is trying to communicate is hidden. As a result, there is no third party other than the transmission source terminal 50 and the destination terminal 60 that can simultaneously estimate both “who is trying to communicate” and “where is communication”. Anonymity of communication can be guaranteed. As a result, the anonymity of the parties to communication can be improved.

  In the present embodiment, the fragment server 10 is an example of a communication information management device. The fragment DB 15 is an example of a storage unit. The inquiry reception unit 11 is an example of a transmission unit and a first transmission unit. The repetitive inquiry request unit 13 is an example of a transfer unit. The secret calculation unit 12 is an example of a search unit. The iterative inquiry device 20 is an example of a restoration device. The secret sharing unit 22 is an example of a restoration unit and a division unit. The upper inquiry unit 23 is an example of an acquisition unit. The repetitive inquiry reception unit 21 is an example of a second transmission unit. The host server 40 is an example of an information management device different from the plurality of communication information management devices.

  As mentioned above, although the Example of this invention was explained in full detail, this invention is not limited to such specific embodiment, In the range of the summary of this invention described in the claim, various deformation | transformation・ Change is possible.

DESCRIPTION OF SYMBOLS 1 Network system 10 Fragment server 11 Inquiry reception part 12 Secret calculation part 13 Iterative inquiry request part 14 Fragment registration reception part 15 Fragment DB
20 Iterative Query Device 21 Iterative Query Accepting Unit 22 Secret Sharing Unit 23 Higher Query Unit 24 Registration Requesting Unit 30 Registration Device 31 Registration Accepting Unit 32 Secret Sharing Unit 33 Fragment Registration Requesting Unit 40 Host Server 50 Source Terminal 51 Application 52 Secret Calculation Unit 53 Inquiry Unit 60 Destination Terminal 100 Drive Device 101 Recording Medium 102 Auxiliary Storage Device 103 Memory Device 104 CPU
105 Interface device B bus

Claims (7)

A storage unit for storing a piece of communication information which is information used for communication;
A transmission unit that, when receiving an inquiry fragment obtained by fragmenting an inquiry about the communication information from a terminal, transmits a communication information fragment corresponding to the inquiry fragment among the communication information fragments stored in the storage unit to the terminal. When,
When a fragment of communication information corresponding to the inquiry fragment is not stored in the storage unit, the inquiry fragment is rewritten from the inquiry fragment to a restoration device by rewriting the address of the inquiry fragment transmission source. A transfer unit to transfer,
A communication information management device comprising: The communication information fragment stored in the storage unit is encrypted,
When the encrypted inquiry fragment is received, a search unit that retrieves the encrypted communication information fragment from the storage unit without decrypting the inquiry fragment;
The communication information management apparatus according to claim 1, further comprising: A communication information management system including a plurality of communication information management devices and a restoration device,
The communication information management device includes:
A storage unit for storing a piece of communication information which is information used for communication;
When an inquiry fragment obtained by fragmenting an inquiry about the communication information is received from the terminal, a communication information fragment corresponding to the inquiry fragment among the communication information fragments stored in the storage unit is transmitted to the terminal. The transmitter of
A transfer unit that rewrites the address of the transmission source of the inquiry fragment and transfers the inquiry fragment to the restoration device when the communication information fragment corresponding to the inquiry fragment is not stored in the storage unit; ,
The restoration device
A restoration unit for restoring the inquiry based on the plurality of inquiry fragments transferred from the plurality of communication information management devices;
An acquisition unit that transmits the restored inquiry to an information management device different from the plurality of communication information management devices, and acquires communication information corresponding to the inquiry from the information management device;
A dividing unit for dividing the communication information into a plurality of pieces;
A second transmission unit that transmits the divided pieces of communication information to the plurality of communication information management devices;
A communication information management system characterized by that. When an inquiry fragment obtained by fragmenting an inquiry about communication information used for communication is received from the terminal, a communication information fragment corresponding to the inquiry fragment is transmitted to the terminal among the communication information fragments stored in the storage unit. Sending procedure,
When a fragment of communication information corresponding to the inquiry fragment is not stored in the storage unit, the inquiry fragment is rewritten from the inquiry fragment to a restoration device by rewriting the address of the inquiry fragment transmission source. A transfer procedure to transfer,
A communication information management method characterized in that a computer executes. The communication information fragment stored in the storage unit is encrypted,
When the encrypted inquiry fragment is received, a search procedure for retrieving the encrypted communication information fragment from the storage unit without decrypting the inquiry fragment;
5. The communication information management method according to claim 4, wherein the computer executes. A communication information management method executed by a plurality of communication information management devices and a restoration device,
The communication information management device is
When an inquiry fragment obtained by fragmenting an inquiry about communication information used for communication is received from the terminal, a communication information fragment corresponding to the inquiry fragment is transmitted to the terminal among the communication information fragments stored in the storage unit. A first transmission procedure;
When a fragment of communication information corresponding to the inquiry fragment is not stored in the storage unit, a transfer procedure for rewriting the transmission source address of the inquiry fragment and transferring the inquiry fragment to the restoration device is executed. ,
The restoration device is
A restoration procedure for restoring the inquiry based on the plurality of inquiry fragments transferred from the plurality of communication information management devices;
An acquisition procedure for transmitting the restored inquiry to another information management device and obtaining communication information corresponding to the inquiry from the other information management device;
A division procedure for dividing the communication information into a plurality of pieces;
Executing a second transmission procedure for transmitting the divided pieces of communication information to the plurality of communication information management devices;
A communication information management method.   A program causing a computer to function as each unit according to claim 1.

Images