JP4465952B2 - Document management system and method - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a document management system and method To the law In particular, a document management system and method for managing confidential documents To the law Related.
[0002]
[Prior art]
In recent years, with the development of computer technology, various documents have been digitized. Recently, with the development of network technology, it has become possible to easily exchange and distribute digitized documents. In particular, since the Internet has become widely used, documents can be exchanged and distributed over a wide range.
[0003]
However, as the distribution amount of digitized documents increases, the opportunity for information leakage from these documents has also increased, and prevention of information leakage is becoming a new issue in companies and the like.
[0004]
Information leakage from documents occurs in various situations, such as unauthorized acquisition of documents stored on servers, eavesdropping during transmission during document distribution, negligence or intention of the right document acquisition rights Can do. For this reason, techniques for preventing information leakage in various situations have been proposed.
[0005]
As such a technique, there is a technique in which a document is stored and transmitted by performing encryption at a level set according to the confidentiality of the document (for example, see Patent Document 1).
[0006]
In addition, there is a method in which access authority and usage authority control of a document to be distributed is set as a policy and registered in a policy server. The access authority is set for each user or group, for each time, and for each network (domain). For the use authority, it is possible to set whether printing / posting is possible. In addition, the policy server can easily remove or change authority after document distribution.
[0007]
[Patent Document 1]
JP-A-7-295589
[0008]
[Problems to be solved by the invention]
As described above, many conventional techniques perform encryption processing on a document when protecting the document. There are various methods for encrypting documents, such as using a common key for both encryption and decryption, and using different keys for encryption and decryption. Management is an important issue.
[0009]
For example, when transmitting a key via a network, it is conceivable that the key is illegally acquired during the transmission. In addition, when the key is managed by a server or the like, it is necessary to consider a mechanism for preventing the loss of the key, a mechanism for dealing with an attack on the server, or the like.
[0010]
In addition, when encrypting a document, it may be necessary to set an authorized person who can view the document, or it may be necessary to perform an encryption process according to the number of authorized persons. It may take a lot of time and effort.
[0011]
Therefore, the present invention provides a document management system and method capable of easily and appropriately managing documents according to their sensitivity. The law The purpose is to provide.
[0012]
[Means for Solving the Problems]
In order to achieve the above-described object, the invention of claim 1 is a document management system for managing a document that needs to maintain confidentiality, and includes information for designating a person who is permitted to view the document. , Prove the legitimacy of the authorized person A public encryption key that is unique to the viewer is also included Manage confidentiality policy with certificates And control permission and disapproval of confidential documents based on confidentiality policy Obtaining a confidentiality policy from the management device and the confidentiality policy managed by the management device And generating a common encryption key, encrypting the document to be confidentialized with the generated common encryption key, encrypting the common encryption key with the public encryption key included in the certificate of the acquired confidentiality policy, and Attach the encrypted common encryption key to the encrypted document A security device for performing security processing of a document including encryption processing; and Viewing the decrypted confidential document on the condition that it has a private encryption key corresponding to the public encryption key and is permitted to view the confidential document by the management device Equipment and It is characterized by comprising.
[0013]
The invention of claim 2 is the invention of claim 1, The confidentiality policy includes image information to be pasted on a confidentiality target document, and the confidentiality processing includes processing to paste an image based on the confidentiality policy on the confidentiality target document. It is characterized by that.
[0014]
The invention of claim 3 In the invention of claim 1, the management device permits the browsing device to browse a confidential document within a predetermined period, and the browsing device is within the predetermined period. Decrypt and display the confidential document without obtaining permission again from the management device It is characterized by that.
[0015]
The invention of claim 4 2. The security policy according to claim 1, wherein the confidentiality policy includes a period for browsing confidential documents, and the management apparatus controls browsing of the confidential documents by the browsing apparatus based on the browsing period. It is characterized by that.
[0016]
The invention of claim 5 In the invention of claim 1, the confidentiality policy includes confidentiality document printability information, and the management device performs confidentialized document printing processing by the browsing device based on the printability information. Control It is characterized by that.
[0017]
The invention of claim 6 A document management method for managing a document that requires confidentiality, wherein the management device certifies the authorized person of browsing and the legitimacy of the permitted person of browsing, and includes a public encryption key unique to the permitted person of browsing. A confidential policy including a certificate is stored and managed in the storage means, and the confidentiality device acquires the confidential policy managed by the management device via the communication means, and the arithmetic processing using the common encryption key by the arithmetic means The document to be confidentialized is encrypted with the encryption method, and the common encryption key is encrypted by a calculation process using a public encryption key included in the acquired certificate of the confidential policy, and the encrypted common encryption key is encrypted. The confidential processing of the document including the encryption processing to be attached to the converted document is executed, the browsing device stores the secret encryption key corresponding to the public encryption key in the storage means, and the management via the communication means Confidential statement from device View on the condition that obtains information that allows the displays to decode the secret of document It is characterized by that.
[0018]
The invention of claim 7 In the invention of claim 6, the confidentiality policy includes a period for browsing confidential documents, and controls browsing of confidential documents based on the period for browsing. It is characterized by that.
[0019]
The invention of claim 8 In the invention of claim 6, the confidentiality policy includes information on whether or not to print a confidential document, and controls printing processing of the confidential document based on the information on whether or not to print. It is characterized by that.
[0043]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, the document management system and method according to the present invention Legal An embodiment will be described in detail with reference to the accompanying drawings.
[0044]
FIG. 1 is a block diagram showing a basic configuration example of a document management system according to the present invention. As shown in the figure, the document management system is used by a management server 1 for managing various information used for document management, a client 2 used by an administrator of the document management system, and a document creator. A client 3 (3-1 to 3-n) and a client 4 (4-1 to 4-m) used by a document viewer are connected via a network 5.
[0045]
FIG. 2 is a block diagram showing a configuration example when the document management system shown in FIG. 1 is actually used. As shown in the figure, the document management system is used by a management server 1 for managing various information used for document management, a client 2 used by an administrator of the document management system, and a document creator. A client 3 and a client 4 used by a document viewer are connected via the Internet 6. In the configuration shown in the figure, the number of clients 3 and 4 is set to 1 for simplification of explanation, but a plurality of clients 3 and 4 can be used. Further, the number of clients 2 used by the administrator is not necessarily one.
[0046]
In this configuration, the management server 1 manages confidential policies in the document management system, and also manages each user's authentication, document attributes, history, logs, and the like.
[0047]
The client 2 is operated by the administrator of the document management system, and the administrator sets or changes the confidential policy managed by the management server 1 and browses the log. In the client 2, dedicated software for performing these processes may be operated, but these processes may be performed by a general-purpose web browser. When a general-purpose web browser is used on the client 2, the management server 1 operates the web server.
[0048]
The client 3 is operated by a document creator, and performs encryption processing for converting the created document into a confidential document. In the encryption process, a confidential policy managed by the management server 1 is used.
[0049]
The client 4 is operated by a document viewer and performs a decryption process for browsing a confidential document.
[0050]
Note that the client 3 and the client 4 may have both functions described below.
[0051]
Next, details of each unit constituting the document management system shown in FIG. 2 will be described. First, details of the management server 1 will be described.
[0052]
The management server 1 manages confidential policies, and performs authentication processing for each user, management of document attributes, control of whether or not to view a document based on the document attributes, management of processing history for documents, management of log information, and the like. Do.
[0053]
The confidential policy is set by an administrator who operates the client 2, and has settings such as an authorized person to view the document, a pasted image on the document, whether or not to allow printing, and a viewing time limit.
[0054]
3 and 4 are diagrams showing an example of the configuration of the confidential policy. A plurality of confidential policies can be set in the management server 1. For example, a confidential policy 10A shown in FIG. 3, a confidential policy 10B shown in FIG. 4A, and a confidential policy 10C shown in FIG. 4B are set. The These confidential policies 10A and the like can be given arbitrary names (in the figure, they are classified as confidential policy A, confidential policy B, and confidential policy C, respectively).
[0055]
The confidential policy has a hierarchical structure, in which an authorized person for browsing, an image to be attached to a document, whether or not printing is possible, a viewing time limit, and the like are set. For example, in the confidential policy 10A, a role 11A and a role 11B are set as browsing authorized persons. The role is a group of authorized users, and the authorized person 12A is included in the role 11A. Further, the roll 11B further includes a roll 11C, and together with this, a viewing authorized person 12B and a viewing authorized person 12C are included. The role 11C includes a browsing permitted person 12D and a browsing permitted person 12E. Note that an arbitrary name can be assigned to the roll 11A or the like (in the figure, it is referred to as a roll A or the like). In addition, in the permitted viewing person 12A and the like, it is described as permitted viewing person A and the like in the figure, but actually, information that can identify the permitted viewing person such as the name and the user name of the permitted viewing person is set. Has been.
[0056]
In addition, the viewing-permitted person 12A or the like includes a digital certificate of the corresponding viewing-permitted person or information for obtaining the digital certificate. In other words, the confidential policy may be configured to include the digital certificate of the authorized person, or may be configured to include information for acquiring the digital certificate without including the digital certificate itself. This digital certificate may be issued by the management server 1 or may be issued by another certification authority. When the digital certificate is obtained based on the information, the acquisition destination is the management server. 1 or other certification body.
[0057]
Also, in the confidential policy 10A, a pasting image 13A and a pasting image 13B are set as pasting images to a document, a printing permission / non-permission setting 14A is set as printing permission / prohibition control information, and a browsing deadline information 15A is set as document browsing deadline information. . In the pasted image 13A and pasted image 13B, information for generating an image to be pasted on a document or an image to be pasted on a document is set. The image to be pasted on the document is, for example, pasted on a predetermined area 18 of the document shown in FIG. 5A, and includes information including information shown in FIG. 5B or FIG. There is something like the symbol shown in. In the print permission / inhibition setting 14A, information as to whether or not to permit document printing is set. In the browsing time limit information 15A, a time limit for permitting browsing of the document is set. This time limit may be common to all viewing permitters set in the confidential policy 10A, or may be different for each viewing permitting user.
[0058]
Similarly, the confidential policy 10B is set with a roll 11C including a browsing permitted person 12D and a browsing permitted person 12E, and a pasted image 13B and a browsing time limit 15B are set. The confidential policy 10C includes a browsing permitted person 12A. The roll 11A to be included is set. As is clear from the configuration of the confidential policy 10B and the confidential policy 10C, the setting of the pasted image and the setting of the viewing time limit are arbitrary.
[0059]
The authentication process for each user in the management server 1 is performed using a digital certificate. The digital certificate may be issued by the management server 1 or may be issued by another certification authority. This digital certificate is set in the client 2, the client 3, and the client 4. When the management server 1 is accessed from these, the digital certificate is presented and user authentication is performed.
[0060]
Document attributes are managed by receiving the attributes of the document together with identification information for identifying the document from the client 3 when the client 3 makes the document confidential. The attributes managed here are information such as the viewing time limit of the document and whether or not printing is possible.
[0061]
When a document viewer tries to browse a document with the client 4, the document browsing control receives document identification information from the client 4 and browses based on this identification information and managed document attributes. The client 4 is notified of whether or not printing is possible and whether or not printing is possible.
[0062]
The management of processing history for a document is performed by receiving processing information when the document is browsed or printed by the client 4 and storing and receiving the processing information. This history is presented when there is an inquiry from the document creator or the like.
[0063]
Log information management is performed by accumulating and managing log information generated each time the above-described processes are performed, and presenting this when there is an inquiry from an administrator or the like.
[0064]
Next, details of the client 3 will be described. The client 3 is operated by the document creator, and makes the document confidential. The confidential processing of the document may be performed by operating dedicated software on the client 3, or by operating software provided as a plug-in of general-purpose document processing software such as a word processor on the client 3. Also good.
[0065]
Here, the confidential processing of the document by the client 3 will be described. First, the operation flow of the client 3 by the creator will be described. FIG. 6 is a flowchart showing a flow of operation of the client 3 by the creator.
[0066]
First, the creator creates or edits a document (step 101). When the creation or editing of the document is completed, the creator instructs the confidentiality of the document from a menu or the like (step 102). As a result, the client 3 accesses the management server 1. In this case, since it is necessary to present a digital certificate, this is applicable when a plurality of digital certificates are set in the client 3. A digital certificate is selected (step 103). Then, the client 3 acquires a list of confidential policies from the management server 1 and presents it to the creator. In response, the creator selects a desired confidentiality policy (step 104). When the creator selects the confidential policy, the client 3 performs confidentialization of the document according to the selected confidential policy. Thereafter, the creator distributes the confidential document using e-mail or the like (step 105), and ends the operation.
[0067]
By the way, when selecting the confidential policy, the creator confirms the details of the confidential policy if the content cannot be determined only by the list display. At that time, the details of the confidential policy can be displayed in various formats. One of the display formats is a method for displaying the hierarchical structure of the confidential policy as it is. In this case, for example, when the confidential policy 10A shown in FIG. 3 is displayed, first, as shown in FIG. 7A, the first hierarchy is displayed. Here, when the creator selects the role B, as shown in FIG. 7B, the next hierarchy is displayed. Further, as another display method, there is a method of enumerating and displaying each permitted viewer in parallel without displaying a role. In this case, when the confidential policy 10A is displayed, a display as shown in FIG. Further, when the browsing deadline and the print permission / inhibition are set for each browsing authorized person, the display is as shown in FIG.
[0068]
Next, the flow of processing for document confidentiality by the client 3 will be described. FIG. 8 is a flowchart showing a flow of document confidentialization processing by the client 3.
[0069]
When the client 3 receives an instruction operation for document confidentiality processing by the creator, the client 3 accesses the management server 1 and performs authentication processing (step 151). In this authentication processing, the corresponding digital certificate is managed. Present to server 1. If the authentication is successful, the client 3 acquires a list of confidential policies from the management server 1 and displays it (step 152).
[0070]
Thereafter, when the secret policy is selected by the creator, the selected secret policy is acquired from the management server 1 (step 153). At this time, the client 3 also obtains from the management server 1 or the like a digital certificate of a viewing-permitted person included in the confidential policy or a digital certificate specified from the confidential policy. Then, the pasted image is pasted on the document based on the acquired confidentiality policy (step 154), and attributes such as setting of whether printing is permitted are set on the document (step 155). However, the processing of step 154 and step 155 is not necessarily executed (for example, when a pasted image is not included in the confidential policy).
[0071]
Next, the client 3 generates a common key for encrypting the document (step 156). This common key is arbitrarily generated by the client 3. However, the common key does not necessarily have to be generated at this timing, and a previously generated one may be held and acquired. Then, the document is encrypted with the generated or acquired common key (step 157).
[0072]
Subsequently, the client 3 encrypts the common key obtained by encrypting the document by using the public key included in the digital certificate of the viewing-permitted person who has previously obtained (step 158). The encryption of the common key is executed using each public key according to the number of authorized users. Then, the encrypted common key (there may be a plurality of cases) and the encrypted document are synthesized (step 159). Thereafter, document information such as identification information for identifying the document is sent to the management server 1 (step 160). The document confidentialization process ends.
[0073]
Here, the document confidentialization process executed by the client 3 will be described in detail. FIG. 9 is a diagram for explaining the flow of confidential processing of a document.
[0074]
In document confidentiality processing by the client 3, first, a common key 31 for performing encryption processing on the document 30 to be confidentialized is generated or acquired in advance, and this common key is acquired. The document 30 is encrypted at 31 to obtain an encrypted document 32. Next, the common key 31 is encrypted using the public key 34 (34A, 34B, 34C) attached to each of the digital certificates 33 (33A, 33B, 33C) acquired from the management server 1 or the like. This public key 34 is unique to each authorized person who is certified by the digital certificate 33. Next, the client 3 synthesizes the encrypted common key 35 (35A, 35B, 35C) obtained by encrypting the common key 31 with the public key 34 and the encrypted document 32 previously encrypted, thereby obtaining a confidential document. 36 is obtained, and the confidential processing of the document is completed.
[0075]
As described above, the confidential document 36 is composed of the encrypted document 32 and the encrypted common key 35. In order to obtain the original document 30 from the confidential document 36, the encrypted common key 35 is decrypted. A secret key is required for the user, and this secret key is possessed only by each authorized viewer. If the common key 31 can be obtained by decrypting the encrypted common key 35 with the secret key, the encrypted document 32 can be decrypted, and the original document 30 can be obtained. Details of browsing the confidential document 36 (including decryption processing) will be described later.
[0076]
By applying such confidentialization processing to the document, it is possible to distribute the same confidential document to a plurality of authorized users. On the other hand, for example, when a document is encrypted with a public key corresponding to each authorized person, an encrypted document corresponding to the number of authorized persons is generated. It becomes complicated.
[0077]
Next, details of the client 4 will be described. The client 4 is operated by a document viewer and releases the confidentiality of the document. This declassification processing of the document may be performed by operating dedicated software on the client 4, and software provided as a plug-in of general-purpose document processing software such as a word processor is operated on the client 4. You may go.
[0078]
Here, the process of declassifying the document by the client 4 will be described. First, the flow of operations of the client 4 by the viewer will be described. FIG. 10 is a flowchart showing the flow of operation of the client 4 by the viewer.
[0079]
First, the viewer selects a document to browse (step 201). If the selected document is a confidential document, the client 4 accesses the management server 1. At this time, since a digital certificate must be presented, a plurality of digital certificates are set in the client 4. If so, the corresponding digital certificate is selected (step 202). Then, when the client 4 receives the browsing permission notification from the management server 1, the confidentiality of the document is canceled and displayed, and the viewer browses the document (step 203), and the operation ends. At this time, the client 4 expands the confidential document on the memory, but does not store it on a disk or the like. Then, document storage in a state where confidentiality is released is prohibited.
[0080]
Next, the flow of processing for declassifying a document by the client 4 will be described. FIG. 11 is a flowchart showing the flow of the declassification process of the document by the client 4.
[0081]
When the client 4 accepts a document browsing instruction operation by the viewer, the client 4 accesses the management server 1 and performs an authentication process (step 251). In this authentication process, the client 4 sends the corresponding digital certificate to the management server 1. Present. If the authentication is successful, the client 4 transmits document identification information to the management server 1 and confirms that browsing of the document is permitted (step 252). As a result of the confirmation, if browsing is not permitted, the processing is immediately terminated. If browsing is permitted, information on whether printing is possible is also acquired.
[0082]
As a result of the confirmation, if browsing of the document is permitted, the encryption common key is extracted from the confidential document (step 253), and the extracted encryption common key is decrypted with the secret key (step 254). Then, the encrypted document is decrypted with the decrypted common key, and the decrypted document is displayed to allow the viewer to browse (step 255). Then, processing information for notifying that the confidentiality of the document has been released is sent to the management server 1 (step 256). Thereafter, when the viewer does not print the document, the client 4 ends the document declassification process.
[0083]
When the viewer instructs printing of the document, the client 4 executes printing processing on the condition that printing is permitted (step 257), and notifies that the document has been printed. The processing information is sent to the management server 1 (step 258), and the confidentiality release processing for the document is terminated.
[0084]
Here, the declassification processing of the document that is executed by the client 4 will be described in detail. FIG. 12 is a diagram for explaining the flow of the declassification process of a document.
[0085]
In the declassification processing of the document by the client 4, first, a corresponding one of the encryption common keys 35 included in the confidential document 36, for example, encryption, is used by using the private key of the viewer himself / herself that the client 4 has. The common key 35B is decrypted to obtain the common key 31. Then, the encrypted document 32 is decrypted using the common key 31 to obtain the original document 30. At this time, the client 4 only expands the document 30 on the memory, does not store it on a disk or the like, and does not store it as the document 30. Of course, since the confidential document 36 is stored on the disc or the like, the confidential document 36 can be declassified again and browsed as necessary. However, the confidentiality of the confidential document 36 can be canceled within a period during which browsing is permitted.
[0086]
Next, information exchanged between the management server 1, the client 3, and the client 4 in the above-described document confidentiality processing and confidentiality cancellation processing will be described. FIG. 13 is a diagram illustrating a flow of information exchanged between the management server 1, the client 3, and the client 4.
[0087]
When a document is classified, first, a digital certificate is presented as authentication information from the client 3 to the management server 1 (step 301). The management server 1 authenticates the client 3 based on this authentication information, and when the authentication is successful, a response to that effect is returned to the client 3.
[0088]
Subsequently, the client 3 requests acquisition of the confidential policy list information set in the management server 1 (step 302), and in response thereto, the management server 1 transmits the confidential policy list information to the client 3. (Step 303).
[0089]
Next, the client 3 transmits an acquisition request for the confidential policy selected by the creator to the management server 1 (step 304), and the management server 1 transmits the selected confidential policy to the client 3 in response thereto (step 304). 305).
[0090]
Thereafter, when the confidentiality of the document is executed by the client 3, document information including identification information of the document is transmitted from the client 3 to the management server 1 (step 306), and the confidential document is transmitted from the client 3. It is transmitted to the client 4 (step 307).
[0091]
Thereafter, when the declassification processing of the document is performed by the client 4, a digital certificate is presented as authentication information from the client 4 to the management server 1 (step 308). The management server 1 authenticates the client 4 based on this authentication information, and when the authentication is successful, a response to that effect is returned to the client 4.
[0092]
Subsequently, the client 4 transmits document information including identification information of the document to be declassified to the management server 1 (step 309). The management server 1 confirms whether or not the document can be browsed based on the received document information, and if browsing is possible, transmits permission information permitting browsing to the client 4 (step 310). When the client 4 permitted to view the document releases the confidentiality of the document, processing information indicating that fact is transmitted from the client 4 to the management server 1.
[0093]
By the way, it is conceivable that the client 4 may not be able to connect to the management server 1, that is, when it is desired to browse a confidential document in an offline state. As a method of coping with such a request, by providing a certain effective period for the browsing permission notified from the management server 1 to the client 4, once the client 4 receives permission for browsing, the client 4 can perform a certain period of time. It is possible to browse confidential documents offline for a period of time. Processing of the client 4 in this case will be described.
[0094]
FIG. 14 is a flowchart showing the flow of the document declassification processing by the client 4 in the offline state.
[0095]
When the client 4 accepts a document browsing instruction operation by the viewer, the client 4 confirms whether the management server 1 can be accessed. If access to the management server 1 is possible (YES in step 401), the above-described processing is performed to release the confidentiality of the document.
[0096]
On the other hand, if the access to the management server 1 from the client 4 is impossible (NO in step 401), the client 4 confirms the browsing permission information when the confidentialization of the document is first canceled (step 401). 402). As a result of the confirmation, if the current browsing is permitted, that is, if the previously received browsing permission is within the valid period (YES in step 403), the encrypted common key is extracted from the confidential document (step 405). ) Decrypt the extracted encrypted common key with the secret key (step 406). Then, the encrypted document is decrypted with the decrypted common key, and the decrypted document is displayed to allow the viewer to browse (step 407). Then, processing information for notifying that the confidentiality of the document has been released is accumulated (step 408), and the confidentiality releasing processing of the document is terminated. The accumulated processing information is transmitted to the management server 1 when access to the management server 1 becomes possible later. If the browsing permission received first is invalid (NO in step 404), the client 4 naturally terminates the process because browsing of the document is not permitted.
[0097]
In this way, even when the client 4 releases the confidentiality of the document offline with the management server 1, the release of the confidentiality requires the secret key of the viewer who is permitted to view the document. The declassification by a third party is impossible. In other words, it can be said that the processing when the client 4 is online with the management server 1 has double security.
[0098]
【The invention's effect】
As described above, according to the present invention, the confidential policy including the designation of the person who is permitted to view the document is managed by the management server, and the creating client that creates the confidential document acquires the confidential policy from the management server. Execute confidential document processing including encryption of documents and pasting of images based on the confidential policy, manage information on confidential documents on the management server, and whether the management server can view or print Therefore, the creator of the confidential document can make the document confidential by simply selecting a desired confidential policy from the confidential policies managed by the management server.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a basic configuration example of a document management system according to the present invention.
FIG. 2 is a block diagram showing a configuration example when the document management system shown in FIG. 1 is actually used.
FIG. 3 is a diagram (1) illustrating a configuration example of a confidential policy.
FIG. 4 is a diagram (2) illustrating a configuration example of a confidential policy.
FIG. 5 is a diagram for explaining a pasting image.
FIG. 6 is a flowchart showing a flow of operation of the client 3 by the creator.
FIG. 7 is a diagram showing a display example of a confidential policy to a creator.
FIG. 8 is a flowchart showing a flow of document confidentialization processing by the client 3;
FIG. 9 is a diagram for explaining the flow of a confidentialization process of a document.
FIG. 10 is a flowchart showing a flow of operations of the client 4 by a viewer.
FIG. 11 is a flowchart illustrating a flow of a document declassification process performed by a client.
FIG. 12 is a diagram for explaining the flow of a declassification process of a document.
13 is a diagram showing a flow of information exchanged between the management server 1, the client 3, and the client 4. FIG.
FIG. 14 is a flowchart showing a flow of a document declassification process by the client 4 in an offline state.
[Explanation of symbols]
1 management server
2 clients
3, 3-1 to 3-n client
4, 4-1 to 4-m client
5 network
6 Internet
10A, 10B, 10C Confidential policy
11A, 11B, 11C roll
12A, 12B, 12C, 12D, 12E
13A, 13B pasted image
14A Print availability setting
15A, 15B Viewing deadline information
18 areas
30 documents
31 Common key
32 Encrypted documents
33A, 33B, 33C Digital certificate
34A, 34B, 34C Public key
35A, 35B, 35C Encryption common key
36 Confidential documents
37 private key

Claims (8)

A document management system for managing documents that require confidentiality,
And management and information specifying the browsing-permitted person to the document, the confidentiality policy and a certificate that contains the unique public encryption key to browse the authorized person with to prove the validity of the view the authorized person, on the basis of confidential policy A management device that controls permission and disapproval of browsing confidential documents ;
Obtaining a confidentiality policy from the confidentiality policy managed by the management apparatus, generating a common encryption key, encrypting a confidential document with the generated common encryption key, and certifying the acquired confidentiality policy A confidentiality device for performing a confidentiality process of a document including an encryption process for encrypting with a public encryption key included in the document and attaching the encrypted common encryption key to the encrypted document ;
A browsing device that has a secret encryption key corresponding to the public encryption key and decrypts and displays the classified document on condition that browsing of the classified document is permitted by the management device document management system characterized by comprising and. The confidential policy includes image information to be pasted on a confidential document.
The confidential process, the document management system according to claim 1, characterized in that it comprises a process of pasting an image based on the confidential policy document confidentiality of interest. The management device permits the browsing device to browse a confidential document within a predetermined period,
The viewing device, the on condition that is within a predetermined time period, documents of claim 1, wherein the displaying by decoding the secret of documents without obtaining permission again from the management device Management system. The confidentiality policy includes a period for browsing confidential documents,
The management apparatus, a document management system according to claim 1, wherein the controlling the viewing of sensitive of documents by the viewing device based on the access limit. The confidentiality policy includes confidentiality document printability information,
The management apparatus, a document management system according to claim 1, wherein the controlling the printing process of the confidential of documents by the viewing device based on the print or not information. A document management method for managing documents that require confidentiality,
The management device stores in the storage means and manages the confidential policy including the designation of the authorized person to view the document and the validity of the authorized person and the certificate including the public encryption key unique to the authorized person. ,
The security device acquires a security policy managed by the management device via the communication unit, encrypts a confidentiality target document by a calculation process using the common encryption key by the calculation unit, and uses the common encryption key. A document confidentiality process including an encryption process in which the encrypted common encryption key is attached to the encrypted document is encrypted by a calculation process using a public encryption key included in the acquired confidentiality policy certificate. Run,
On condition that the browsing device stores the secret encryption key corresponding to the public encryption key in the storage unit, and has acquired information permitting browsing of the confidential document from the management unit via the communication unit A document management method comprising: decrypting and displaying the classified document. The document management method according to claim 6 , wherein the confidentiality policy includes a period for browsing the classified document, and the browsing of the classified document is controlled based on the period for browsing. 7. The document management method according to claim 6 , wherein the confidential policy includes information on whether or not to print a confidential document, and print processing of the confidential document is controlled based on the information on whether or not to print.

Images