JP4284715B2 - Data access method - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
According to the present invention, a server device (for example, a WWW server or a database server) that stores data shared by a plurality of people (for example, document data or multimedia data), and the data is received, stored, or used via a network or the like ( For example, in a system comprising terminals that display (for example, VOD, communication karaoke, CATV, TV broadcast, radio broadcast, text broadcast, pager, navigation, notification tower, game distribution, audio recorder, video recorder, etc.) The present invention relates to a data access method that has a function of increasing the speed and preventing unauthorized use of the data.
[0002]
[Prior art]
In the Internet, data is stored in a WWW server, and necessary data is accessed and displayed by the browser software of the terminal. When the same data is displayed, the same data is requested and received from the WWW server every time. As a method for preventing unauthorized use of data, a method is known in which when encrypted data is received and decrypted, the encryption key is obtained from a server and the data is used.
[0003]
For example, application software such as “WORD” from Microsoft Corporation (MICROSOFT) and ACROBAT from Adobe Corporation (ADOBE) has a mechanism that protects document data created by these software by entering a password. Yes.
[0004]
In addition, a mechanism is also known in which an expiration date is set for data, and data is not available when the expiration date is exceeded, as compared with a clock of a personal computer that uses the data.
[0005]
[Problems to be solved by the invention]
In the above conventional method, it is necessary to access the data on the server every time data is required, and it is not considered that the access takes time when there is a lot of traffic on the network. Further, although a password is required every time access is made, there has been no consideration for the problem of unauthorized use in which once a password is entered, a copy can be created in the storage means of the terminal. Further, since the key for decrypting the data is obtained from the server device, the problem that the key may be stolen on the network has not been considered.
[0006]
In the method of providing a password for data, the problem of unauthorized use that anyone can use data on different terminals as long as the data password is known has not been considered. And the method of setting an expiration date for the above data does not consider the problem of unauthorized use that can be used without limitation if the date of the internal clock of the personal computer used is intentionally changed.
[0007]
The first object of the present invention is to store the received data in the terminal device when the terminal device uses data on the server device, so that, for example, a time during which network communication traffic is large can be avoided, and data communication Is to prevent the increase in communication traffic by speeding up or reusing the accumulated data. Further, when using the stored data, the server device is inquired about permission to use the data, and only when it is permitted, the data copied to the terminal device is reused to prevent unauthorized use of the data.
[0008]
A second object of the present invention is to prohibit unauthorized decryption of data by performing encryption and decryption with a secret key held by the terminal device when the copied data is stored in the terminal device. It is in.
[0009]
The third object of the present invention is to limit the use of data at different terminals by specifying the terminals that can use the data.
[0010]
A fourth object of the present invention is to prevent the use of data by changing the date on the terminal device by checking the expiration date of the data having an available expiration date on the server device. is there.
[0011]
[Means for Solving the Problems]
In the data access method of the present invention, in order to achieve the first object, the terminal device accumulates data once from the server device in the storage means of the terminal device at the time of the first access, and at the second access (or every day or In the first access after a certain period of time, the data on the storage means of the terminal is accessed. If the data prohibits unauthorized use, the server device is inquired about the access permission. The terminal device that received the data is authenticated to use the data, and if there is no problem, the terminal device is notified, and the terminal device permits the use of the data. If there is a problem, prohibit the use of data or delete the data.
[0012]
To achieve the second object, when data is copied from the server device to the terminal device, the data is encrypted using a private key of the terminal device, and permission to use the data is obtained from the server device. Only if the data is decrypted. In addition to an encryption method using a key, a method of converting data content different from the original data, such as an original compression method, can also be used.
[0013]
In order to achieve the third object, when the data is requested from the terminal device for the first time, the server device stores the requested terminal device identification number and the data identification number in the distribution list, and the data and data Is transmitted to the terminal device, the terminal device stores the received data and the data identification number in the storage means, and when the terminal device wants to use the data for the second time, from the terminal device, The identification number of the data to be used and the identification number of the terminal are transmitted to the server, and the server device compares the identification number of the terminal device in the distribution list with the identification number of the data. The use is permitted, and if there is a problem, the use of the data is prohibited or the data copied to the terminal device is deleted.
[0014]
In order to achieve the fourth object, the server device stores the data expiration date and the data identification number in the distribution list when the data is requested from the terminal device for the first time, and adds the data and data identification number. The terminal device stores the received data and the identification number of the data in the storage means. When the terminal device wants to use the data for the second time or later, the identification number of the data used from the terminal device is stored. The server device compares the expiration date of the data corresponding to the data identification number of the distribution list that matches the data identification number for which data usage was inquired from the terminal device, and the clock of the server device, If the data is within the validity period, the terminal device is allowed to use the data, and if there is a problem, the data usage is prohibited or the data copied to the terminal device is deleted.
[0015]
DETAILED DESCRIPTION OF THE INVENTION
FIG. 1 is a block diagram showing a first embodiment of the present invention, FIG. 2 is an example of a distribution list of the first embodiment of the present invention, and FIG. 3 is an example of a file structure of the first embodiment of the present invention. is there.
[0016]
In FIG. 1, reference numeral 10 denotes a server device, and a receiving means 12 for receiving an identification number of a transmitted file, an identification number of a destination terminal, a distribution list 11 for storing the expiration date of the file, an inquiry request from the terminal device, and the like. Authenticating means 13 for receiving and judging inquiry about the use of a file from a terminal, transmitting means 14 for transmitting a file or the like to a terminal apparatus, storage means 15 for storing a file to be transmitted to a plurality of terminal apparatuses, and outputting the current date and time A clock 16 is included.
[0017]
Reference numeral 20 denotes a terminal device, receiving means 21 for receiving a file from the server, encryption means 23 for encrypting the received file, storage means 23 for storing the encrypted file, and based on the encrypted file Decryption means 24 to return, display means 25 for displaying data in the file, inquiry means 26 for inquiring of the server whether the file can be used, transmission means 27 for transmitting an inquiry signal to the server, an identification number that is different for each terminal device Has terminal number 28. The server 10 and the terminal 20 are connected by a communication network 17 such as a LAN, wireless communication, or a public line.
[0018]
In FIG. 2, 30 is the identification number of the file, 31 is the identification number of the distribution destination terminal, and 32 is the expiration date of the file. In FIG. 3, 33 is an identifier for identifying whether a file requires authentication, and 34 is data actually used.
[0019]
Next, the operation of each part in FIG. 1 will be described based on the flowcharts in FIGS. In the present embodiment, description will be made by taking as an example a system in which data in a file is document data, a file transmitted by a server in response to a request from a terminal device is received, and document data in the file is displayed on a display portion of the terminal device. Of course, the present invention does not limit the type of data in the file.
[0020]
When the terminal device 20 desires to receive a file for the first time (70), the server device 10 transmits a terminal number 28 together with the file request to the server device 10 (82), and the server device 10 receives a file reception request (50) from the terminal device 20 ) Is determined whether the corresponding file can be transmitted (51). If the file can be transmitted, the identification number of the file to be transmitted to the distribution list 11 is set to the file number 30, and the terminal number 28 of the terminal that made the request. Is recorded in the distribution destination 31, and if the file has an expiration date, the expiration date is recorded in the expiration date 32 (52). Further, the file to be transmitted is read from the storage means 15, the file identification number 30 and the identifier 33 that requires authentication are added (FIG. 3), and the file is transmitted to the requested terminal device 20 (54).
[0021]
When the file is received (76), the terminal device 20 encrypts the received file with the encryption means 22 (77) and stores it in the storage means 23 (78). At the same time, the encrypted file stored by the storage means 23 is decrypted (79) by the decryption means 24 and displayed (80) by the display means 25.
[0022]
If transmission is not possible in the process 51 of the server, a notification indicating that transmission is not possible is sent to the terminal device 20 (53), and the terminal device 20 displays that reception is not possible (81).
[0023]
When the terminal device 20 requests the use of the file for the second time or later, the inquiry means 26 requests the server device to inquire about the use of the file, and the identification number 30 and the terminal number 28 of the file to be used simultaneously are the server device. 10 (71). When there is a request for inquiry (55), the server 10 receives the authentication unit 13 from the distribution list 13 simultaneously with the terminal number registered in the distribution destination 31 from the identification number 30 of the corresponding file and the inquiry request. Compared with the terminal number 28 of the terminal device 20 (57), if it does not match, the terminal device 20 is notified of the authentication failure (60). If they match, the expiration date 32 of the distribution list 13 is compared with the clock 16 (58). If the expiration date has passed, the terminal device 20 is notified of the authentication failure (60). If it is within the validity period, the terminal device 20 is notified of successful authentication (59).
[0024]
When the terminal device 20 receives the authentication failure, the terminal device 20 deletes the corresponding file (73). When the authentication success is received, the corresponding file is decrypted (74) by the decryption means 24 and displayed (75) by the display means 25.
[0025]
【The invention's effect】
According to the present invention, data once accessed to the server device is accumulated in the storage means of the terminal, and the use permission of the accumulated data is obtained by inquiring the server from the terminal for the second and subsequent data. For access, the amount of data required for an inquiry is extremely small compared to the accumulated data, so the communication load on the network is small and the response to the inquiry is fast, so that the data usage can be accelerated.
[0026]
According to the present invention, when the received data is stored in the storage means of the terminal device, the stored data can be decrypted by encrypting and storing the data unless the server device permits the use of the data. Therefore, unauthorized use can be prevented.
[0027]
According to the present invention, by using a unique terminal number and a data identification number that a terminal has for managing inquiries about data usage to a server device, the terminal device that is different from the terminal device that acquired the data can be used. Use of data can be restricted.
[0028]
According to the present invention, since the expiration date of data can be managed based on the clock of the server device in managing the expiration date of data, the time of the terminal device is changed illegally and the data is illegally used. Can be prevented.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a first embodiment of the present invention.
FIG. 2 is an explanatory diagram showing an example of a distribution list according to the first embodiment of this invention.
FIG. 3 is an explanatory diagram showing an example of a file structure according to the first embodiment of this invention.
FIG. 4 is a flowchart showing the operation of the server apparatus according to the first embodiment of this invention.
FIG. 5 is a flowchart showing the operation of the terminal device according to the first embodiment of the present invention.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 11 ... Distribution list, 13 ... Authentication means, 15 ... Memory | storage means, 16 ... Clock, 22 ... Encryption means, 24 ... Decryption means, 26 ... Inquiry means, 28 ... Terminal number.

Claims (3)

In a server client system comprising a client device that stores a data file and is connected via a network to a server device that transmits the requested data file, requests the server for the required data file, and receives the requested data file The server device transmits the requested data file to the client device in accordance with the request of the client device, the client device stores the received data file by the storage means, and simultaneously stores the data file by the storage means ; and The encrypted data file is decrypted using a decryption means and displayed by a display means;
When the received data is used for the second time or later, the server device issues a use authentication request to the server device, the server device performs authentication according to the authentication request, notifies the client device of the result of the authorization request, and the client device A data access method, wherein the apparatus uses a received data file according to a result.   2. The data access method according to claim 1, wherein the client device includes means for encrypting the received data file, stores the encrypted data file by the means for storing, and uses the data file for authentication. A data access method characterized in that if the data transfer is successful, the data file can be decrypted and used.   2. The data access method according to claim 1, wherein when the data file is requested for the first time from the client device, the server device stores the unique identification number of the client device and the identification number of the data file in the distribution list. When the authentication request for using the data file is received from the client device together with the identification number of the client device and the identification number of the data file, the identification number is stored in the distribution list of the server device. A data access method characterized in that a client device can use a data file when authentication is successful in comparison with an identification number.

Images