JP4517608B2 - Data communication system - Google Patents

Description

  The present invention relates to a data communication system using a network.

  As a mechanism for safely transferring data via a public network such as the Internet, a VPN (Virtual Private Network) is widely used. In VPN, an encryption device and a decryption device are installed on the sender side and the receiver side across the public network, the data is encrypted on the sender side and transmitted to the public network, and the encrypted data is sent on the receiver side. Is received and decoded to restore the original transmission data. When VPN is used, even if data flowing on the public network is intercepted, the secret is kept unless the encryption is broken.

  While there are data encryption techniques, there are also unauthorized users who obtain data illegally and decrypt the encryption. Even if the data is encrypted using advanced encryption technology, under the circumstances where the encrypted data is transferred over a public network, an unauthorized user can obtain the encrypted data and There is a risk of deciphering. That is, there is a limit to data security in data transfer using only encryption technology.

  Accordingly, an object of the present invention is to enable data to be transferred more securely via a network.

  In order to achieve the above object, a data communication system according to a preferred aspect of the present invention is a data communication system having a transmission side device, a reception side device, and a communication support device connected to each other via a network. The support apparatus has mediating storage means for storing information necessary for data communication between the transmission-side apparatus and the reception-side apparatus for which a communication contract relationship has been established. A data processing means for generating a transfer data set by performing processing, and a definition file including a restore condition for restoring the original data by performing a restoration process on the transfer data set at the receiving-side apparatus Definition file generation means for generating the transfer data set from the transmission side device for use in the reception side device And the definition file is transmitted to the communication support device and stored in the intermediate storage unit, and the reception side device is configured according to the restoration condition included in the definition file stored in the intermediate storage unit. And a data restoration processing means for restoring the original data by performing a restoration process on the transfer data set.

  According to the above configuration, since the definition file necessary for restoring the original data is managed by the communication support device, even if a third party obtains the transfer data set, the original data is not obtained unless the definition file is obtained. Restoration to becomes impossible.

  Preferably, the communication support device further includes certificate issuing means for issuing certificates of the transmitting device and the receiving device in order to establish the communication contract relationship, and the communication contract relationship Is established by mutual authentication between the transmitting device and the receiving device using the certificate. According to the above configuration, since mutual authentication is performed between the transmission-side device and the reception-side device via the communication support device, data communication is performed after the transmission-side device and the reception-side device establish a mutual trust relationship. It can be carried out.

  Preferably, the processing for the original data includes an encoding process including at least one of a data encryption process and a data compression process, and the restoration condition in the definition file includes a decoding process related to the decoding process corresponding to the encoding process. Processing information is included, and the data restoration processing means performs decoding processing on the transfer data set based on the decoding processing information. Preferably, the transfer data set includes a first data segment and a second data segment, at least one of which is uploaded to a relay server, and the restoration condition in the definition file includes the location of the relay server. Relay server location information is included, and the receiving means downloads the data segment uploaded to the relay server based on the relay server location information.

  Preferably, the transfer data set includes a first data segment and a second data segment, different communication protocols are assigned to the first data segment and the second data segment, and a restoration condition in the definition file is set. Includes protocol information representing a communication protocol of at least one of the first data segment and the second data segment, and the receiving means receives the transfer data based on the protocol information.

  Preferably, the definition file includes a special restriction condition for the transmission side apparatus to control the restoration to the original data in the reception side apparatus. More preferably, the processing for the original data includes a data encryption process, and the special restriction condition in the definition file indicates a condition for providing the encryption key used for the data encryption process. Only when the condition is satisfied, the encryption key is provided to the receiving apparatus. According to the above configuration, since the encryption key is provided to the reception side device only when the provision condition is satisfied, for example, the sender sets the provision condition of the encryption key, and the original data is received by the reception side device. The restoration process can be controlled.

  Preferably, the data processing means divides the original data into a plurality of pieces, a part of each piece of data is lost from each piece, and the pieces are divided into missing pieces and missing pieces, Generating the transfer data set including the plurality of missing source pieces and the plurality of missing piece pieces, the transmitting side device transmits the plurality of missing source pieces to the receiving side device as a first data segment, and Uploading a plurality of missing pieces to the relay server as a second segment, and the receiving side device downloads the plurality of missing pieces from the relay server based on the relay server location information included in the definition file; To do.

  In order to achieve the above object, a communication support apparatus according to a preferred aspect of the present invention provides a communication support apparatus for establishing a communication contract relationship between user terminals connected to each other via a network. Contract information relating to a certificate issuing means for issuing a certificate to a registered user to be used, and a communication contract relationship between the user terminals established by each of the registered users using each certificate Contract information registration means for registering information, and intermediary storage means for storing information necessary for data communication between user terminals for which the communication contract relationship has been established.

  In order to achieve the above object, a transmitting apparatus according to a preferred aspect of the present invention performs processing on original data in a transmitting apparatus connected to a receiving apparatus and a communication support apparatus via a network. A data processing means for generating a transfer data set and a definition file generation for generating a definition file including a restoration condition for restoring the original data by performing a restoration process on the transfer data set at the receiving side device And means for transmitting the transfer data set for use by the receiving side apparatus and transmitting the definition file to the communication support apparatus.

  In order to achieve the above object, a receiving-side apparatus according to a preferred aspect of the present invention is a receiving-side apparatus connected to a transmitting-side apparatus and a communication support apparatus via a network. Receiving means for receiving the transfer data set generated by the processing, and the transfer data set according to the restoration condition included in the definition file generated in the transmission side apparatus and stored in the communication support apparatus And data restoration processing means for restoring the original data by performing restoration processing.

  In order to achieve the above object, a data communication method according to a preferred aspect of the present invention is a method of transmitting data from a transmitting device to a receiving device between a transmitting device and a receiving device connected to each other via a network. In the data communication method for transferring the data, the transmitting side device performs encoding processing on the original data to generate transfer data, and the receiving side device performs decoding processing on the transfer data and the original data Generating a definition file including decoding information for restoring data, transmitting the transfer data for use in the receiving-side apparatus, and transmitting the definition file to a communication support apparatus; The side device receives the transfer data and applies the transfer data to the transfer data according to the decode information included in the definition file stored in the communication support device. Is subjected to decoding processing is assumed to restore the original data.

  Preferably, the transmission side device and the reception side device mutually confirm the certificates of the transmission side device and the reception side device issued by the communication support device and perform mutual authentication to establish a communication contract relationship. Then, the transmission side apparatus transmits the transfer data for use in the reception side apparatus based on the communication contract relationship.

  In order to achieve the above object, a program according to a preferred aspect of the present invention is a program for causing a computer to execute a process for establishing a communication contract relationship between user terminals, and a user who uses each of the user terminals. Application information registration step for registering user application information for each user, a certificate issuance step for issuing a certificate to each user who is authorized to register based on the user application information, and the formal registration is permitted. It is assumed that the contract information registration step in which contract information relating to the communication contract relationship between the user terminals established by the users using the respective certificates is registered is executed.

  In order to achieve the above object, a program according to a preferred aspect of the present invention is an encoding process for generating transfer data by performing an encoding process on original data on a computer connected to a communication support apparatus via a network. A definition file generating step for generating a definition file including decoding information for restoring the original data from the transfer data, and transmitting the transfer data for use at a transfer destination, and the definition file Transmitting to the communication support apparatus.

  In order to achieve the above object, a program according to a preferred embodiment of the present invention receives transfer data generated by performing encoding processing on original data to a computer connected to a communication support apparatus via a network. And a decoding process step of performing a decoding process on the transfer data according to the decoding information stored in the communication support apparatus to restore the original data.

  According to the present invention, data can be transferred more securely via a network.

  Preferred embodiments of the present invention will be described below with reference to the drawings.

  FIG. 1 shows a preferred embodiment of a data communication system according to the present invention, and FIG. 1 is a diagram showing the overall configuration thereof. In this system, a transmitting terminal 10 used by a sender, a receiving terminal 12 used by a receiver, a communication support device (certification authority) 14 that supports data communication, and a plurality of relay servers 16 are connected to the Internet 18. Are connected to each other.

  In transferring data from the sender to the receiver, the sender and the receiver each perform user registration with the communication support apparatus 14 (user registration). A user (sender, receiver) who is authorized for formal registration is issued a certificate 60 from the communication support device 14. Then, the sender uses the transmitting terminal 10 and the receiver uses the receiving terminal 12 to confirm that they are users who are officially registered with each other via the communication support device 14 (mutual authentication). ).

  When it is confirmed that the users are registered with each other, the sender uses the transmission side terminal 10 to perform data processing on the transfer target data. By this data processing, the transfer target data is divided into the encrypted piece group 226 and the encrypted missing data 235. Then, the encrypted piece group 226 is transferred to the transmitting terminal 12 via the Internet 18, and the encrypted missing data 235 is transferred to any one of the relay servers 16. Further, the scenario file 140 necessary for restoring the processed transfer target data is transferred to the communication support apparatus 14. The receiving-side terminal 12 refers to the scenario file 140 registered in the communication support apparatus 14 and acquires the encrypted missing data 235 transferred to the relay server 16 and acquires the encrypted piece group 226 that has already been transferred. Data to be transferred is restored from the encrypted missing data 235 (data transfer).

  In this system, a highly secure data communication technique such as public key cryptography (PKI) is used for communication between the transmitting terminal 10, the receiving terminal 12, and the communication support device 14. Is desirable.

  Hereinafter, the procedures of “user registration”, “mutual authentication”, and “data transfer” will be described in detail with reference to FIGS. In the following description, the reference numerals in FIG. 1 are used for the portions shown in FIG.

  “User Registration” FIG. 2 is a diagram showing a user registration procedure to the communication support apparatus 14 by each user. FIG. 2 shows a registration procedure that each of the user A and the user B executes with the communication support apparatus 14. As shown in FIG. 2, both user A and user B perform user registration in the same procedure.

  First, each user (user A, user B) makes a user application for formal registration to the communication support apparatus 14 (S210). At the time of user application, each user presents information about the user (user information) to the communication support apparatus 14. The user information includes information for identifying the user, such as a user name (individual name, company name, department name) and user address. The user information may be transmitted to the communication support apparatus 14 via the Internet 18 or may be transmitted using a dedicated line. Of course, offline application such as mailing or handing may be used.

  Upon receiving a user application from each user, the certificate issuing unit 20 of the communication support apparatus 14 confirms the user information presented by each user, and issues a certificate 60 and an access right to a user who permits formal registration. (S212). The official registration may be permitted by the operator of the communication support apparatus 14, and the certificate issuing unit 20 may issue the certificate 60 based on the permission.

  The certificate 60 in S212 proves that the user is officially registered in the communication support apparatus 14. The certificate issuing unit 20 issues a certificate 60 for each user who has applied for a user. As shown in FIG. 5, the information about the certificate 60 (certificate information) includes version information 101 of the certificate 60, encryption algorithm 102, issuer information 103, expiration date information 104, user information 105, access right information 106, Related information 107 and the like are included. Other information 108 may be attached as necessary. In addition, it is preferable that digest information 109 is attached to the certificate information 100. That is, the certificate information 100 is encrypted with the private key of the communication support apparatus 14 (110), a digest of the encryption result is generated (111), and information related to the digest is attached to the certificate information 100. A digital signature is given by the communication support apparatus 14.

  Returning to FIG. 2, the access right in S <b> 212 is an authority for each user to access the communication support apparatus 14. The access right includes a user ID and a password for each user to access the communication support apparatus 14. It is included. Then, the communication support apparatus 14 registers the certificate information of the user who has been officially registered in the certificate information storage unit 22 (S214).

  The user who acquires the certificate 60 and the access right (S216) accesses the communication support apparatus 14 using the access right (user ID and password) to the communication support apparatus 14, and downloads the client application to the communication support apparatus 14. A request is made (S218). The client application is an application program that is used when a user who is officially registered in the communication support apparatus 14 performs online information exchange with the communication support apparatus 14.

  When the application program providing unit (AP providing unit) 24 of the communication support apparatus 14 confirms that the user is an officially registered user from the user ID and password sent from the user, the application program providing unit 24 provides the client application to the user (S220). ), The provided client application is installed in each terminal (sending terminal 10 or receiving terminal 10) of the user (S222).

  The installed client application generates an execution key from the certificate 60 and the unique ID of the terminal, transmits the generated execution key to the communication support apparatus 14 (S224), and the communication support apparatus 14 transmits from each terminal of the user. The executed execution key is registered (S226). As a result, the client application installed in each terminal of the user can access the communication support apparatus 14 using the execution key. In the procedure of “mutual authentication” and “data transfer” to be described later, communication between each user terminal and the communication support apparatus 14 is performed via this client application.

  As a result of installing the client application, a contract processing unit 40, an encoding processing unit 42, a scenario file generation unit 44, and a data transmission unit 46 are formed in the transmission side terminal 10. The receiving terminal 10 includes a contract processing unit 50, a decoding processing unit 54, a data receiving unit 52, and a scenario file analysis unit 56.

  As described above, the user registration to the communication support apparatus 14 by each user is completed in the steps shown in FIG. Note that the client application download procedure is not always necessary. For example, a recording medium such as a CD-ROM or DVD-ROM in which the client application program is recorded may be distributed to the user in advance, and the client application program may be installed in each terminal.

  “Mutual Authentication” FIG. 3 is a diagram showing a mutual authentication procedure between users, that is, between a sender and a receiver. First, the sender obtains the user ID of the receiver (ID registered in the communication support apparatus 14) from the receiver (S310). At this time, the receiver may also acquire the sender's user ID and exchange the user ID.

  When the sender inputs the user ID of the receiver to the transmitting terminal 10, the contract processing unit 40 inquires of the communication support apparatus 14 about the receiver's information (S312). Based on the user ID of the recipient sent from the sending terminal 10, the communication support device 14 is the user information (user name, address, etc.) regarding the recipient of the certificate information registered in the certificate information storage unit 22. And the user information is provided to the sender (S314).

  Based on the user information of the receiver acquired from the communication support device 14, the sender is a true receiver who is officially registered in the communication support device 14, that is, that the sender is a real partner who wants to transmit. Check. The sender who has confirmed the receiver notifies the communication support apparatus 14 via the contract processing unit 40 that the receiver is a true receiver and wants to perform data transmission to the receiver (transmission request) ( S316). Upon receiving the transmission request, the communication support apparatus 14 registers the transmission request (S318).

  The receiver acquires the transmission request of the sender and the certificate 60 of the sender from the communication support apparatus 14 (S320). The receiver is always in a state where the information of the communication support apparatus 14 can be pulled out (always connected state), and grasps in real time that the registration information of the communication support apparatus 14 has been changed. The receiver confirms from the sender certificate 60 acquired from the communication support apparatus 14 that the sender is a true sender officially registered in the communication support apparatus 14 (S322). If the receiver approves the transmission request from the transmitter, the receiver informs the communication support apparatus 14 that the data transmission from the transmitter has been approved (reception permission) via the contract processing unit 50 (S324). At this time, the recipient's own certificate 60 is attached to the sender's certificate 60. If the receiver does not approve the data transmission from the sender, the reception can be rejected.

  Based on the reception permission of the receiver, the communication support apparatus 14 registers the contract information between the users (between the sender and the receiver) in the contract information storage unit 26 and informs the sender that the receiver has permitted the reception. Report (S326), and the sender confirms the reception permission (S328).

  As a result, a contract between the sender, the receiver, and the communication support device 14 is established. That is, contract information that the sender is a user who has the transmission right and that the transmission right is for the receiver is registered in the communication support apparatus 14, and the sender and the receiver also have this contract information. Hold. As shown in FIG. 6, the contract information includes contract key information 121, issuer information 122, contract expiration date information 123, sender information 124, receiver information 125, related information 126, and the like. Other information 127 may be attached as necessary. The contract information 120 is preferably accompanied by digest information 128. That is, the contract information 120 is encrypted with the private key of the communication support apparatus 14 (129), a digest of the encryption result is generated (130), and information related to the digest is attached to the contract information 120, thereby supporting communication support. A digital signature is provided by the device 14.

  The “data transfer” sender sends the data to be transferred to the recipients who have mutually authenticated each other. At this time, after performing the encoding process on the data to be transferred, the processed data is sent to the receiver. Forward. The encoding process is executed by the encoding processing unit 42 of the transmitting terminal 10. Therefore, the encoding process executed by the encoding processing unit 42 will be described.

  FIG. 8 is a diagram for explaining an encoding process for transfer target data. First, the encoding processing unit 42 compresses the transfer target data 200 according to a predetermined data compression algorithm (S100). Each time data transfer processing is performed, it is possible to dynamically switch the compression method and compression parameters at the time of this compression. Then, an encryption key for specifying the compression method and compression parameters is also generated.

  Further, an MD5 (Message Digest 5: RFC1321) value 202 of the transfer target data 200 is also generated. This MD5 value 202 is used for verification of the correctness when the transfer target data 200 is restored on the receiving side (receiving side terminal 12).

  Then, the compressed data 205 generated by the compression is divided into m pieces (m is an integer of 2 or more) pieces 210 (P1, P2,..., Pm) (S102). The number m of pieces to be divided is determined according to a predetermined algorithm based on the line capacity that the sender can use for uploading at that time.

  Next, a part of the data portion 212 is deleted from each of the divided pieces 210 (P1, P2,..., Pm) (S104). The data portions 212 that are missing from each piece 210 are arranged in the order according to the number of the piece that is missing and are grouped together as missing data 230.

  Next, the encoding processing unit 42 performs data compression and encryption processing on each missing piece 215 (P1 ′, P2 ′,..., Pm ′) generated by the missing processing (S104) (S106). ). The MD5 value 225 of each encrypted piece 220 (P1 ″, P2 ″,..., Pm ″) generated as a result is also generated. Data composed of all encrypted pieces 220 and all MD5 values 225 The group is an encrypted piece group 226.

  The encoding processing unit 42 also performs compression / encryption processing on the missing data 230 to generate encrypted missing data 235 (Px). Here, in the piece part missing process (S104), if the place and size to be deleted are fixed, the receiving side can easily restore the missing part of each piece, but the security is weakened instead. Therefore, it is also preferable to change the method of missing processing (such as missing location and missing size) for each data transfer process.

  As described above, in the encoding processing unit 42, the transfer target data is divided into the encrypted piece group 226 and the encrypted missing data 235, and the encrypted piece group 226 is transferred to the receiving terminal 12 and the encrypted missing data 235. Is transferred to the relay server 16.

  Next, data transmission / reception between users will be described with reference to FIG. FIG. 4 is a diagram showing a data transmission procedure between users. First, the sender inquires of the communication support apparatus 14 whether or not the receiver has canceled the contract via the transmission side terminal 10 (S410). Upon receiving the inquiry, the communication support apparatus 14 confirms that the receiver continues the contract based on the contract information registered in the contract information storage unit 26 (S412). 8) is provided to the transmitting terminal 10 (S414), and the transmitting terminal 10 acquires it (S416). As the relay server 16, various servers capable of processing data upload and download requests such as an ftp server and an smpt server can be used. There are many servers on the Internet 18 that provide file upload / download services. Since these existing servers can be used as the relay server 16, information on the available relay servers 16 can be obtained. The data is provided from the communication support device 14 to the transmitting terminal 10.

  The sender who has confirmed that the receiver has continued the contract and is ready to transfer data causes the encoding processing unit 42 to execute the encoding process (see FIG. 8) for the transfer target data (S418). Further, the scenario file generation unit 44 generates a scenario file 140 including information for restoring the transfer target data to the original data (S420). The scenario file 140 will be described in detail later.

  The data transmission unit 46 transmits the encrypted piece group 226 to the recipient via the Internet 18. Further, the data transmission unit 46 uploads the encryption missing data 235 to the relay server 16 designated by the communication support apparatus 14 based on the information of the relay server 16 acquired in S414. Then, the generated scenario file 140 and the encryption key used for the encoding process are transmitted to the communication support apparatus 14 (S422). The communication support apparatus 14 registers the scenario file 140 in the media storage unit 28 and manages the encryption key with the encryption key management unit 30 (S424). At this time, the encrypted piece group 226 is preferably transferred by a transfer protocol different from that of the encrypted piece 220.

  Note that the encrypted piece group 226 may be transferred to the receiving terminal 12 via the relay server 16. In this case, the plurality of encrypted pieces 220 are distributed and transferred to the relay server 16 different from the encryption missing data 235. Information regarding the relay server 16 in which the encrypted piece 220 is stored is provided, for example, to the receiving terminal 12 via the communication support device 14, and the data receiving unit 52 of the receiving terminal 12 is based on the information regarding the relay server 16. The plurality of encrypted pieces 220 are collected, and the encrypted piece group 226 is acquired.

  When the encrypted piece group 226 is acquired, the scenario file analysis unit 56 of the receiving terminal 12 analyzes the scenario file 140 registered in the communication support apparatus 14 (S426), and decodes based on the scenario file 140 The unit 54 combines the transfer target data (S428).

  The information included in the scenario file 140 and the usage method will be described with reference to FIG. As shown in FIG. 7, the scenario file 140 includes contract information 141, scenario number 142, expiration date information 143, data expiration date information 144, alternative route information 145, restoration method information 146, transmission data information 147, and the like. ing. Other information 148 may be attached as necessary. Further, it is preferable that digest information 149 is attached to the scenario file 140. That is, the scenario file 140 is encrypted with the private key of the communication support device 14 (150), a digest of the encryption result is generated (151), and information related to the digest is attached to the scenario file 140, thereby supporting communication support. A digital signature is provided by the device 14. The scenario file 140 is generated for each transfer target data when the transfer target data is transferred stepwise over a plurality of times.

  The separate path information 145 indicates the storage status of the encryption missing data 235 (eg, which protocol is transferred to which relay server 16). The data receiving unit 52 of the receiving side terminal 12 acquires the encryption missing data 235 based on the different path information 145.

  In the expiration date information 143, the use start date and time and the use end date and time of the encryption key used when encrypting the transfer target data are set. In order for the decoding processing unit 54 to restore the transfer target data, an encryption key is required every time the transfer target data is opened. The encryption key management unit 30 of the communication support apparatus 14 does not provide the encryption key to the receiving terminal 12 until the use start date / time is reached. In other words, it is possible to restrict the receiver from restoring the data to be transferred, and the sender transfers most of the data to be transferred to the receiver in advance as an encrypted piece group 226 and only opens it. It becomes possible to restrict (prohibit). For this reason, it is possible to effectively use network traffic by avoiding transferring a large amount of data at a time and transferring the data stepwise in advance.

  When the use start date and time is reached with the standard clock in the communication support device 14, the receiver can acquire the encryption key from the encryption key management unit 30. The recipient who has acquired the encryption key performs the reverse process of the encoding process described with reference to FIG. 8, that is, the decoding process such as the encryption demodulation process, the decompression process and the data combination process, and opens the transfer target data. (Composite). It should be noted that the restoration method information 146 included in the scenario file 140 indicates information related to the encoding processing method when the encoded data to be transferred is encoded on the receiver side, and the user is based on the restoration method information. Execute the encoding process.

  Further, when the use end date and time of the standard clock in the communication support apparatus 14 has passed, the encryption key management unit 30 prohibits the provision of the encryption key, and as a result, the receiver cannot obtain the encryption key and opens the transfer target data. I can't do that.

  By using the scenario file 140, the sender can set various conditions for the receiver to open the transfer target data. For example, the opening order of the transfer target data can be specified using the other information 148. That is, when the transfer target data is transferred stepwise over a plurality of times, the second transfer target data can be opened only when the first transfer target data is opened. In addition, it is possible to define the conditions for providing the encryption key from the communication support apparatus 14 to the receiver.

  In addition, for example, in the encoding process of the transfer target data, different encryption processes are performed for each encrypted piece 220, and the encryption demodulation process for each encrypted piece 220 is set in the restoration method information 146, thereby transferring the data. It is also possible to increase the safety of the target data.

  Alternatively, the sender provides the MD5 value generated for each encrypted piece 220 (reference numeral 225 in FIG. 8), and the receiver calculates the MD5 value of each restored encrypted piece 220 and is provided by the sender. It is also possible to check whether each encrypted piece 220 has been correctly restored by checking whether it matches the MD5 value. In addition, the sender provides the MD5 value of the entire transfer target data (reference numeral 202 in FIG. 8), and the receiver calculates the MD5 value of the restored transfer target data and confirms the match with the provided MD5 value. Thus, it is also possible to detect tampering by a third party on the transfer target data. In this way, by using the scenario file 140, the sender can set various conditions for the receiver to open the transfer target data, increase the reliability of the data, and the like.

  As described above, the data communication system shown in FIG. 1 has been described in detail. In the system configuration of FIG. 1, a communication relay device is provided between each terminal of the transmission side terminal 10 and the reception side terminal 12 and the Internet 18. A highly secure data communication system may be configured. For example, when transmitting / receiving data to be transferred between the transmission-side terminal 10 and the reception-side terminal 12, when the encrypted piece group 226 is transferred via the plurality of relay servers 16, the transmission-side terminal 10 and the reception-side terminal 12 are It is desirable that each relay server 16 be actively accessed. In other words, the communication relay device connected to the transmission side terminal 10 is connected to each relay server 16 via the Internet 18 only when the encrypted piece group 226 is uploaded, and the communication relay device connected to the reception side terminal 12 is Only when the encrypted piece group 226 is downloaded, it is connected to each relay server 16 via the Internet 18. In this way, by connecting to the Internet 18 only when uploading and downloading, it is possible to connect from the outside via the Internet 18 compared to a communication method in which a communication port must always be opened. The possibility of intrusion can be greatly reduced.

It is a figure which shows the whole structure of the communication system which concerns on this invention. It is a figure which shows the user registration procedure to a communication assistance apparatus. It is a figure which shows the contract procedure between users. It is a figure which shows the data transmission procedure between users. It is a figure for demonstrating certificate information. It is a figure for demonstrating contract information. It is a figure for demonstrating a scenario file. It is a figure for demonstrating an encoding process.

Explanation of symbols

  10 transmitting terminal, 12 receiving terminal, 14 communication support device, 16 relay server, 18 Internet.

Claims (16)

In a data communication system having a transmission side device, a reception side device, and a communication support device connected to each other via a network,
The communication support device includes:
An intermediary storage means for storing information necessary for data communication between the transmission-side apparatus and the reception-side apparatus for which a communication contract relationship has been established;
The transmitting device is:
Data processing means for processing the original data and generating a transfer data set;
A definition file generating means for generating a definition file including a restoration condition for restoring the original data by performing a restoration process on the transfer data set in the reception side device;
Have
The transfer data set is transmitted from the transmission side device for use in the reception side device, and the definition file is transmitted to the communication support device and stored in the intermediate storage unit,
The receiving side device
Data restoration processing means for restoring the original data by performing restoration processing on the transfer data set according to a restoration condition included in a definition file stored in the intermediate storage means;
I have a,
The processing for the original data includes a data encryption process,
The definition file includes a provision condition of an encryption key used for the data encryption process as a special restriction condition for the transmission side apparatus to control the restoration to the original data in the reception side apparatus,
When the transfer data set is transferred stepwise over a plurality of times, the encryption is performed so that the second transfer data set can be restored only when the first transfer data set is restored. Key provision conditions are specified,
A data communication system. The data communication system according to claim 1, wherein
The communication support device includes:
In order to establish the communication contract relationship, it further comprises certificate issuing means for issuing certificates of the transmitting device and the receiving device,
The communication contract relationship is established by mutual authentication between the transmitting device and the receiving device using the certificate.
A data communication system. The data communication system according to claim 1, wherein
Wherein the processing to the original data contains encoding process and a data encryption processing and data compression processing,
The restoration condition in the definition file includes decoding processing information related to the decoding processing corresponding to the encoding processing,
The data restoration processing means executes a decoding process on the transfer data set based on the decoding process information.
A data communication system. The data communication system according to claim 1, wherein
The transfer data set includes a first data segment and a second data segment, at least one of which is uploaded to a relay server,
The restoration condition in the definition file includes relay server location information indicating the location of the relay server,
The receiving means downloads the data segment uploaded to the relay server based on the relay server location information.
A data communication system. The data communication system according to claim 1, wherein
The transfer data set includes a first data segment and a second data segment, and the first data segment and the second data segment are assigned different communication protocols,
The restoration condition in the definition file includes protocol information representing a communication protocol of at least one of the first data segment and the second data segment,
The receiving means receives the transfer data based on the protocol information;
A data communication system. The data communication system according to claim 1, wherein
The definition file includes a special restriction condition for the transmission side device to control restoration to the original data in the reception side device.
A data communication system. The data communication system according to claim 6, wherein
The processing for the original data includes a data encryption process,
The special restriction condition in the definition file indicates the provision condition of the encryption key used for the data encryption process, and the encryption key is provided to the receiving apparatus only when the provision condition is satisfied. The
A data communication system. The data communication system according to claim 1, wherein
The data processing means divides the original data into a plurality of pieces, deletes a part of the data from each piece, divides each piece into a missing original piece and a missing piece, Generating the transfer data set including the missing piece and the plurality of missing pieces;
The transmitting device transmits the plurality of missing source pieces to the receiving device as a first data segment, and uploads the plurality of missing pieces to a relay server as a second segment,
The receiving device downloads the plurality of missing pieces from the relay server based on relay server location information included in the definition file;
A data communication system. In a communication support apparatus that establishes a communication contract relationship between user terminals connected to each other via a network,
A certificate issuing means for issuing a certificate to an officially registered user using each of the user terminals;
Contract information registration means for registering contract information related to a communication contract relationship between the user terminals established between the officially registered users using respective certificates;
Media storage means for storing information necessary for data communication between user terminals for which the communication contract relationship has been established;
I have a,
In data communication between the user terminals,
The transmitting-side user terminal performs data encryption processing on the original data to generate a transfer data set, and the receiving-side user terminal performs restoration processing on the transfer data set to restore the original data. Generate a definition file that contains the restore conditions for
The transfer data set is transmitted from the transmission-side user terminal for use in the reception-side user terminal, and the definition file is transmitted to the communication support apparatus and stored in the intermediary storage unit,
The definition file includes a provision condition for the encryption key used for the data encryption process as a special restriction condition for the transmission-side user terminal to control the restoration to the original data in the reception-side user terminal. And
When the transfer data set is transferred stepwise over a plurality of times, the encryption is performed so that the second transfer data set can be restored only when the first transfer data set is restored. Key provision conditions are specified,
A communication support apparatus characterized by the above. In a transmission side device connected to a reception side device and a communication support device via a network,
Data processing means for processing the original data and generating a transfer data set;
A definition file generating means for generating a definition file including a restoration condition for restoring the original data by performing a restoration process on the transfer data set in the reception side device;
Transmitting means for transmitting the transfer data set for use in the receiving apparatus, and transmitting the definition file to the communication support apparatus;
I have a,
The processing for the original data includes a data encryption process,
The definition file includes a provision condition of an encryption key used for the data encryption process as a special restriction condition for the transmission side apparatus to control the restoration to the original data in the reception side apparatus,
When the transfer data set is transferred stepwise over a plurality of times, the encryption is performed so that the second transfer data set can be restored only when the first transfer data set is restored. Key provision conditions are specified,
A transmission-side device characterized by the above. In a receiving device connected to a transmitting device and a communication support device via a network,
Receiving means for receiving a transfer data set generated by processing the original data in the transmission side device;
Data restoration processing means for restoring the original data by performing a restoration process on the transfer data set according to a restoration condition included in a definition file generated by the transmission side device and stored in the communication support device;
I have a,
The processing for the original data includes a data encryption process,
The definition file includes provision conditions for the encryption key used for the data encryption process as a special restriction condition for the transmission side apparatus to control the restoration to the original data in the reception side apparatus,
When the transfer data set is transferred stepwise over a plurality of times, the encryption is performed so that the second transfer data set can be restored only when the first transfer data set is restored. Key provision conditions are specified,
A receiving-side device. In a data communication method for transferring data from a transmitting apparatus to a receiving apparatus between a transmitting apparatus and a receiving apparatus connected to each other via a network,
The transmitting device is:
Encode the original data to generate transfer data,
The receiving apparatus performs a decoding process on the transfer data to generate a definition file including decoding information for restoring the original data,
Sending the transfer data for use at the receiving device, and sending the definition file to a communication support device,
The receiving side device
Receiving the transfer data;
In accordance with the decoding information included in the definition file stored in the communication support device, the transfer data is subjected to a decoding process to restore the original data ,
The encoding process for the original data includes a data encryption process,
The definition file includes a provision condition of an encryption key used for the data encryption process as a special restriction condition for the transmission side apparatus to control the restoration to the original data in the reception side apparatus,
Providing the encryption key so that the second transfer data can be restored only when the first transfer data is restored when the transfer data is transferred stepwise over a plurality of times Conditions are defined,
A data communication method characterized by the above. The data communication method according to claim 12,
The transmission side device and the reception side device establish a communication contract relationship by mutually confirming each certificate of the transmission side device and the reception side device issued by the communication support device, and performing mutual authentication.
The transmitting device transmits the transfer data for use in the receiving device based on the communication contract relationship;
A data communication method characterized by the above. A program for causing a computer to execute processing for establishing a communication contract relationship between user terminals,
Application information registration step in which user application information for each user using each user terminal is registered;
A certificate issuance step for issuing a certificate to each user permitted to be officially registered based on the user application information;
A contract information registration step in which contract information related to a communication contract relationship between the user terminals established by each authorized user using the respective certificates is registered;
An intermediary storage step in which information necessary for data communication between user terminals with which the communication contract relationship is established is stored;
To the computer,
In data communication between the user terminals,
The transmitting-side user terminal performs data encryption processing on the original data to generate a transfer data set, and the receiving-side user terminal performs restoration processing on the transfer data set to restore the original data. Generate a definition file that contains the restore conditions for
The transfer data set is transmitted from the transmitting user terminal for use in the receiving user terminal, and the definition file is stored in the intermediate storage step,
The definition file includes a provision condition for the encryption key used for the data encryption process as a special restriction condition for the transmission-side user terminal to control the restoration to the original data in the reception-side user terminal. And
When the transfer data set is transferred stepwise over a plurality of times, the encryption is performed so that the second transfer data set can be restored only when the first transfer data set is restored. Key provision conditions are specified,
A program characterized by that . To a computer connected to a communication support apparatus via a network,
An encoding process step for encoding the original data to generate transfer data;
A definition file generation step for generating a definition file including decoding information for restoring the original data from the transfer data;
Transmitting the transfer data for use at a transfer destination, and transmitting the definition file to the communication support device;
A program for executing,
The encoding process for the original data includes a data encryption process,
The definition file includes a provision condition for an encryption key used for the data encryption process as a special restriction condition for governing restoration to the original data at the transfer destination,
Providing the encryption key so that the second transfer data can be restored only when the first transfer data is restored when the transfer data is transferred stepwise over a plurality of times Conditions are defined,
A program characterized by that . To a computer connected to a communication support apparatus via a network,
A receiving step for receiving the transfer data generated by encoding the original data;
A decoding process step of restoring the original data by performing a decoding process on the transfer data according to the decoding information included in the definition file stored in the communication support device;
A program for executing,
The encoding process for the original data includes a data encryption process,
The definition file includes conditions for providing an encryption key used for the data encryption process,
Providing the encryption key so that the second transfer data can be restored only when the first transfer data is restored when the transfer data is transferred stepwise over a plurality of times Conditions are defined,
A program characterized by that .

Images