JP5217178B2 - Document processing apparatus and program - Google Patents

Description

  The present invention relates to a document processing apparatus that encrypts or decrypts an electronic document, and a program that implements the document processing apparatus using a computer.

  When a document is provided to another person, a specific part of the document may be disclosed to a predetermined person but may not be disclosed to another predetermined person. In such a case, generally, a document in which the corresponding part is erased or hidden and a document that remains are created and distributed. As a prior art of this type, when a copy of a paper document is requested, additional information indicating the degree of confidentiality embedded in the original is extracted, and a personal identification number is input according to the extracted degree of confidentiality. An apparatus that prohibits copying in the case of copying is described in Patent Document 1.

  By the way, today, it is widely performed to create an electronic document using a computer. Since electronic documents are stored on a recording medium such as a magnetic disk, they are not bulky like paper documents and can be easily transmitted using a network. Therefore, electronic documents can be provided to others without printing on paper. There are many cases.

Japanese Patent No. 3607915

  Even when an electronic document is distributed, there may be a portion of the document that is not desired to be disclosed depending on the other party. Therefore, it is desired to set the degree of secrecy for a desired part of the electronic document so that the contents can be concealed.

  The present invention has been made in view of the above problems, and an object of the present invention is to realize a system capable of concealing contents by setting a degree of confidentiality for a desired portion of an electronic document.

The invention described in claim 1
First encryption means for encrypting a plurality of parts of an electronic document using a document encryption key created for each disclosure standard in accordance with disclosure standards set hierarchically for the part;
Using the key encryption key created for each disclosure standard, the document decryption key of the disclosure standard corresponding to each key encryption key and all the document decryption keys of the disclosure standard lower than the disclosure standard A second encryption means for encrypting
Document generation for generating a new electronic document by adding the document decryption key encrypted by the second encryption means to the electronic document whose predetermined part is encrypted by the first encryption means and means, the,
The first encryption means includes
If the object included in the electronic document and including the encryption target part is a separable object, the object is divided to encrypt only the encryption target part, and the object cannot be divided. If it is a possible object, the document processing apparatus is characterized in that the entire object is encrypted .
The invention described in claim 2
An image forming unit for forming an image based on the electronic document on a recording medium;
The image forming unit includes a code image representing a storage location of the data encrypted by the first encryption unit and an image of a portion not encrypted in the electronic document and an encryption by the second encryption unit. The document processing apparatus according to claim 1, wherein a code image representing the converted data is formed on the recording medium.
The invention according to claim 3
Computer
In the encryption process, a plurality of parts of the electronic document are encrypted using a document encryption key created for each disclosure standard according to the disclosure standard set hierarchically for the part . If the object included in the electronic document and including the encryption target part is a separable object, the object is divided to encrypt only the encryption target part, and the object cannot be divided. If it is a possible object, a first encryption means for encrypting the entire object ;
Using the key encryption key created for each disclosure standard, the document decryption key of the disclosure standard corresponding to each key encryption key and all the document decryption keys of the disclosure standard lower than the disclosure standard A second encryption means for encrypting
Document generation for generating a new electronic document by adding the document decryption key encrypted by the second encryption means to the electronic document whose predetermined part is encrypted by the first encryption means As a means
It is a program characterized by functioning.

According to the first aspect of the present invention, an encryption key that is different for each disclosure criterion set hierarchically with respect to a desired portion of an electronic document is used, and the portion to be encrypted is instantiated according to the type of object. By encrypting the range and encrypting each document decryption key corresponding to each disclosure standard, the contents can be concealed by setting the degree of confidentiality for each part.
According to the second aspect of the present invention, even when a cryptographically processed document is printed , the encrypted content can be restored from the printed document.
According to the invention of claim 3, according to the type of object, the range corresponding to the part to be encrypted can be encrypted, and the content can be concealed by setting the degree of confidentiality for the desired part of the electronic document. The system can be realized by a computer.

The best mode for carrying out the present invention (hereinafter referred to as an embodiment) will be described below in detail with reference to the accompanying drawings.
The present invention can take various system configurations. In the present embodiment, a description will be given separately for a document processing apparatus that encrypts and outputs an electronic document, and a document processing apparatus that decrypts and outputs an encrypted electronic document. . In the following description, when it is not necessary to distinguish between the two, it is simply referred to as a document processing device. When it is necessary to distinguish between the two, the former is referred to as an encryption device and the latter is referred to as a decryption device.

FIG. 1 is a diagram illustrating a hardware configuration example of the document processing apparatus according to the present embodiment.
As shown in FIG. 1, a document processing apparatus 10 of the present embodiment includes a CPU (Central Processing Unit) 11 that performs arithmetic processing, a memory 12 and a magnetic disk device 13 that are storage means, and a display device 14 that is an output means. And a printing mechanism 15. A network interface 16 is provided for exchanging data with an external device. Further, as input means, an input device 17 such as a keyboard, a mouse, and a touch panel and a scanner 18 for reading a paper document are provided.

  CPU11 performs various arithmetic processing by program control. In this embodiment, processing such as processing of an electronic document and generation of an encryption key and a decryption key, which will be described later, are executed. A program for controlling the CPU 11 is held in, for example, the memory 12, and the CPU 11 reads the program from the memory 12 and executes it.

  As the memory 12, a volatile memory such as a RAM (Random Access Memory) and a nonvolatile memory such as a ROM (Read Only Memory) are prepared. The above program is held in a nonvolatile memory. The volatile memory is used for the CPU 11 to temporarily store the calculation result when the process is executed.

  The magnetic disk device 13 holds various setting information, processing results by the CPU 11, electronic documents to be processed, and the like. It is also used to save the stored contents of the memory 12. The above-described program may be held in the magnetic disk device 13 and read from the magnetic disk device 13 to the memory 12 when the device is started so that the CPU 11 reads from the memory 12.

The display device 14 is realized by a liquid crystal display (LCD) or the like, and displays an input operation screen for various processing commands and setting information, and displays and outputs an image of an electronic document.
The printing mechanism 15 is configured to form and output an image or the like to be printed on paper, an image forming means for forming the image or the like to be printed on the paper with an image forming material such as toner, and the paper Transporting means for transporting and discharging after image formation. The image forming method by the image forming means may be any method such as an electrophotographic method, an ink jet method, or an electrostatic induction method.

The network interface 16 is connected to a network such as a LAN (Local Area Network) or the Internet, and acquires an electronic document to be processed, a processing request, information necessary for processing, and the like from an external device, and transmits a processed electronic document. To do.
The input device 17 is operated by the user to input various processing commands and setting information.
The scanner 18 optically reads a document (paper document) formed on a recording medium such as paper.

  The configuration illustrated in FIG. 1 is merely an example of a hardware configuration suitable for realizing the document processing apparatus according to the present embodiment, and the present embodiment is not limited to the configuration illustrated in FIG. For example, the printing mechanism 15 may not be built in, and an image of an electronic document may be transmitted to an external printer device and printed out, or when only an electronic document is acquired as a processing target and a paper document is not read. May be configured such that the scanner 18 is not provided.

FIG. 2 is a diagram showing a functional configuration of an encryption apparatus that encrypts and outputs an electronic document in the document processing apparatus 10 of the present embodiment.
As illustrated in FIG. 2, the encryption apparatus 100 according to the present embodiment includes a document generation unit 110, an encryption key generation unit 120, a display control unit 130, and a print control unit 140. For example, when the encryption apparatus 100 has the hardware configuration shown in FIG. 1, these functions are realized by the CPU 11 and the memory 12 that are program-controlled.

The document generation unit 110 includes an area setting unit 111, a disclosure level setting unit 112, an encryption processing unit 113, and a document composition unit 114.
The area setting unit 111 acquires an electronic document to be processed and sets an area to be encrypted (hereinafter, an encryption target area). For example, the electronic document may be stored in the magnetic disk device 13 of FIG. 1 and read when the document generation unit 110 performs processing, or may be stored in an external document server, and the network interface 16 may be used. You may make it acquire via. In this embodiment, the electronic document format is an XML document. By using XML encryption recommended by W3C (World Wide Web Consortium) for an XML document, it is possible to specify a part (element or content) in the document and encrypt only that part. Note that even a document other than an XML document may be a processing target of the present embodiment as long as the document can be encrypted by designating a specific portion in the document. Details of the method of setting the encryption target area by the area setting unit 111 will be described later.

  The disclosure level setting unit 112 sets a disclosure level for the encryption target area set by the area setting unit 111. The disclosure level is a standard for designating to which viewer the information in the encryption target area is disclosed, and represents the level of confidentiality. Different encryption keys are prepared for each disclosure level.

  The encryption processing unit 113 performs encryption keys (documents) prepared according to the disclosure level set by the disclosure level setting unit 112 for the contents (elements and contents) of the encryption target area set by the region setting unit 111. Encryption process). Also, the decryption key (document decryption key) for decrypting the encrypted contents of the encryption target area is encrypted using the encryption key (key encryption key) prepared for each disclosure level. Do. As will be described in detail later, in the present embodiment, the disclosure level is set hierarchically. Then, the encryption processing unit 113 encrypts information for decrypting information at a disclosure level lower than the disclosure level together with the document decryption key according to the disclosure level. Hereinafter, the document decryption key and the information for decrypting the lower disclosure level information are collectively referred to as decryption encryption information.

  The document composition unit 114 adds the decryption encryption information encrypted by the encryption processing unit 113 to the electronic document. Details of the data structure of the encrypted decryption encryption information will be described later. An electronic document (an electronic document including encrypted data) generated by the document composition unit 114 is stored in a storage unit such as the magnetic disk device 13 or an external document server.

  The encryption key generation unit 120 generates an encryption key used for encryption processing by the encryption processing unit 113 and a corresponding decryption key. Specifically, the document encryption key used for encrypting the data in the encryption target area, the document decryption key used for decrypting the data encrypted with the document encryption key, and the document decryption key An encryption key for key used for encryption and a decryption key for key used for decrypting data encrypted with the encryption key for key are generated. As described above, in the present embodiment, encryption using different encryption keys is performed according to the disclosure level individually set for each encryption target area. Accordingly, each of the document encryption key, the document decryption key, the key encryption key, and the key decryption key is prepared according to the disclosure level. Hereinafter, the document encryption key, document decryption key, key encryption key, and key decryption key generated for the same disclosure level are referred to as a key set.

  The display control unit 130 reads the electronic document that has been encrypted by the document generation unit 110 from the storage location and displays the electronic document on the display device 14 of FIG. Since the encryption target area of the electronic document is encrypted by the encryption processing unit 113, no meaningful information is displayed on the image displayed on the display.

The print control unit 140 includes a key code generation unit 141, a data location code generation unit 142, a code arrangement determination unit 143, and a document image generation unit 144.
The key code generation unit 141 includes decryption encryption information added to the electronic document to be processed by the document composition unit 114 (a document decryption key corresponding to the document encryption key used for encrypting the encryption target area and A code image representing information for decoding lower level disclosure level information is generated. The key code generation unit 141 also generates a code image of information indicating that this is the key decryption key together with the encrypted decryption encryption information itself. As the code image, an existing code image such as a QR code (Quick Response code) manufactured by Denso Wave may be used.

  The data location code generation unit 142 generates a code image representing the storage location of the encrypted data in each encryption target area in the electronic document. The data storage location is represented by the address if the data is stored in the magnetic disk device 13, and is represented by a URL or the like if the data is stored in an external document server. If it is included and stored, it is represented by the contents of the data itself. As the code image, an existing code image may be used similarly to the code image generated by the key code generation unit 141.

  The code arrangement determination unit 143 determines the arrangement position of the code image generated by the key code generation unit 141 and the data location code generation unit 142. The code image generated by the key code generation unit 141 (encrypted decryption encryption information and information indicating the key decryption key) is not overlapped with the original content of the electronic document, such as the margin of the electronic document. Be placed. The code image generated by the data location code generation unit 142 (information indicating the storage location of the encrypted data in the encryption target area) is included in the margin of the electronic document together with the code image generated by the key code generation unit 141. You may arrange | position and may arrange | position to a corresponding encryption object area | region.

  The document image generation unit 144 reads out the electronic document that has been encrypted by the document generation unit 110 from the storage location, and arranges the code image whose arrangement position is determined by the code arrangement determination unit 143 in the read electronic document, An image of this electronic document is generated. The generated image is sent to, for example, the printing mechanism 15 in FIG. 1 and printed out on a recording medium such as paper.

Next, a flow of an electronic document encryption process performed by the encryption apparatus 100 according to the present embodiment will be described.
FIG. 3 is a flowchart illustrating a procedure in which the encryption apparatus 100 encrypts an electronic document.
Referring to FIG. 3, first, the area setting unit 111 of the document generation unit 110 acquires an electronic document to be processed and displays it on the display device 14 of FIG. 1, for example (step 301). Then, the encryption target area is set according to the operation by the user (step 302). Details of the procedure for setting the encryption target area will be described later.

  Next, the disclosure level setting unit 112 receives input from the user, and sets the disclosure level by paying attention to the encryption target areas set in step 302 in order (step 303). Then, the disclosure level setting unit 112 determines whether or not a key set of the set disclosure level has been generated for the encryption target area for which the disclosure level is set by paying attention (step 304). If the key set has not been generated, the disclosure level setting unit 112 requests the encryption key generation unit 120 to generate a key set of the disclosure level (step 305). If the key set has been generated in step 304 or after the encryption key generation unit 120 has generated the key set, the disclosure level setting unit 112 checks whether there is an unprocessed encryption target area ( Step 306). If there is an unprocessed encryption target area, the process returns to step 303 to repeat the process. If there is no unprocessed encryption target area, the process proceeds to the next step.

  Next, the encryption processing unit 113 encrypts each encryption target area set in the electronic document using a document encryption key in accordance with the disclosure level set for each area (step 307). . Also, the document decryption key corresponding to the document encryption key used for the encryption in step 307 is encrypted using the corresponding key encryption key (step 308). At this time, information for decrypting information lower than the disclosure level is also encrypted. Details of the document decryption key encryption procedure will be described later.

Thereafter, the document composition unit 114 adds the encrypted decryption encryption information generated by the encryption processing unit 113 to the electronic document encrypted with respect to the encryption target area (step 309). Then, the document synthesizing unit 114 stores the generated electronic document that has been subjected to encryption processing in a storage unit such as the magnetic disk device 13 in FIG.
Apart from the above-described flow of encryption processing, the key decryption key in the key set generated by the encryption key generation unit 120 is distributed to the viewer of the electronic document. An access level corresponding to the disclosure level of the encrypted information is designated for the viewer, and a decryption key for a key corresponding to the disclosure level is distributed according to the access level of each viewer. Thus, each viewer can decrypt and browse the encrypted information of the disclosure level corresponding to his / her access level. A configuration and a decryption method for decrypting encrypted information will be described later.

Here, the method for setting the encryption target area by the area setting unit 111 described in step 302 will be described in detail.
FIG. 4 is a diagram illustrating an example of an electronic document to be processed, and FIG. 5 is a diagram illustrating a state in which an encryption target area and a disclosure level are set and encrypted in the electronic document of FIG.
In the electronic document shown in FIG. 4, a list of purchased products is described, and information on four items of a product name, a supplier, a purchase price, and a sales price is described for each product. Referring to FIG. 5, encryption is performed with the supplier as disclosure level 1 and the purchase price as disclosure level 2 in the list.

FIG. 6 is a flowchart for explaining the procedure for setting the encryption target area by the area setting unit 111.
As shown in the flowchart of FIG. 6, upon receiving an area selection operation performed by the user (step 601), the area setting unit 111 calculates coordinates in the electronic document of the selected area (step 602). The area selection is performed, for example, by surrounding a desired area with an input device 17 such as a mouse on the image of the electronic document displayed on the display device 14 shown in FIG. The coordinates in the electronic document are coordinates set when the image of the electronic document is displayed on the display device 14.

  Next, the area setting unit 111 determines whether or not an object exists in the selected area (step 603). If the object does not exist, the process ends because there is no object to be encrypted. On the other hand, if the object exists, the area setting unit 111 determines whether or not the object is completely included in the selected area (step 604). If the object is completely included in the selected area, the encryption target area is set assuming that the entire object has been selected (step 605).

  If the object is not completely included in the selected area, the area setting unit 111 next determines the type of the object (step 606). Here, for example, it is classified into a text object, an image object, a vector object, and the like.

  Next, the area setting unit 111 determines whether or not the object can be divided in the selected area and outside the area (step 607). If the object cannot be divided, the encryption target area is set assuming that the entire object has been selected (step 605). On the other hand, if the object is a separable object, the object is divided, and the encryption target area is set assuming that only a portion (object) in the selected area is selected (step 608).

FIG. 7 is a diagram illustrating an object dividing method according to this embodiment. FIG. 7A shows a state before division, and FIG. 7B shows a state after division.
In FIG. 7A, a text object, an image object (raster image), and a vector object are described, and for each object, a region is selected so as to include a part thereof (in the figure, The area enclosed by the dashed rectangle is the selected area). Since the text object can be divided in units of characters, the process of step 608 in FIG. 6 is performed, and as shown in FIG. 7B, characters included in the selected area and characters not included in the selected area are divided. Thus, the former is set as the encryption target area. Since the image object of the raster image can be divided at an arbitrary place, the process of step 608 in FIG. 6 is performed, and as shown in FIG. 7B, the part included in the selection area and the part not included in the selection area And the former is set as the encryption target area. Since the vector object cannot be divided, the process of step 605 in FIG. 6 is performed, and as shown in FIG. 7B, the entire object is set as an encryption target area without being divided.

  In this way, the encryption target area is set, and encryption is performed after step 303 in FIG. The object dividing method described with reference to FIGS. 6 and 7 is merely an example of a method for setting an encryption target area. In addition to the above method, for example, a method of setting the entire object in the selected area as an encryption target area regardless of the type of object, and encrypting the object if the selected area includes 50% or more of the entire object. Any method such as a method of setting as a target region may be selected.

Next, the decryption encryption information encryption method described in step 308 will be described in detail.
FIG. 8 is a diagram for explaining the concept of the decryption encryption information encryption method according to this embodiment. FIG. 8A shows a generated key set, and FIGS. 8B and 8C show examples of the data structure of encrypted encryption information for decryption.
As shown in FIG. 8A, it is assumed that two disclosure levels are set by the disclosure level setting unit 112 and corresponding key sets are generated.

  In the present embodiment, the disclosure level is set hierarchically. That is, two different disclosure levels have a higher and lower relationship, and a viewer who can browse information of a higher disclosure level can also browse information of a lower disclosure level. In other words, the viewer can browse all information of the disclosure level corresponding to his / her access level and the disclosure level lower than the disclosure level. In FIG. 8A, it is assumed that disclosure level 2 is higher than disclosure level 1.

  In the example shown in FIG. 8B, the decryption encryption information includes document decryption keys at all disclosure levels equal to or lower than the set disclosure level. Therefore, in FIG. 8B, the decryption encryption information that can be decrypted with the decryption level 1 key is only the disclosure level 1 document decryption key. Also, the decryption encryption information that can be decrypted with the decryption level 2 key decryption key is the disclosure level 2 document decryption key and the lower level disclosure level 1 document decryption key. In this case, the viewer of the access level corresponding to the disclosure level 1 uses the distributed disclosure level 1 key decryption key to decrypt the disclosure level 1 document decryption key, and uses the document decryption key. The contents of the encryption target area of the disclosure level 1 are decrypted and browsed. In addition, the viewer of the access level corresponding to the disclosure level 2 uses the distributed decryption key for the disclosure level 2 to decrypt the decryption key for the disclosure level 2 and the document for the disclosure level 1, and decrypts this document decryption key. The contents of the encryption target area of disclosure level 2 and disclosure level 1 are decrypted and browsed using.

FIG. 9 is a flowchart for explaining a procedure for generating the decryption encryption information as shown in FIG.
In this case, the encryption processing unit 113 first pays attention to the highest disclosure level among the disclosure levels set for the encryption target area of the electronic document to be processed (step 901). Then, using the encryption key for the key at the disclosure level, all the decryption keys for documents below the disclosure level are encrypted (step 902). Next, the encryption processing unit 113 checks whether or not the processing in steps 901 and 902 has been performed on all the disclosure levels set in the electronic document (step 903). If there is an unprocessed disclosure level, the process returns to step 901, focusing on the highest disclosure level among the unprocessed disclosure levels, and repeating the process. If the processing has been performed for all the disclosure levels, finally, the encryption processing unit 113 synthesizes the generated decryption encryption information for each disclosure level and passes it to the document composition unit 114 (step 904).

  In the example shown in FIG. 8C, the decryption encryption information includes the set decryption level document decryption key and the key decryption keys at all disclosure levels lower than the disclosure level. Accordingly, in FIG. 8C, the decryption encryption information that can be decrypted with the disclosure level 1 key decryption key is only the disclosure level 1 document decryption key as in the case of FIG. 8B. Also, the decryption encryption information that can be decrypted with the disclosure level 2 key decryption key is the disclosure level 2 document decryption key and the lower disclosure level 1 key decryption key. In this case, the viewer of the access level corresponding to the disclosure level 1 decrypts and browses the contents of the encryption target area of the disclosure level 1 as in the case of FIG. 8B.

  The viewer of the access level corresponding to the disclosure level 2 uses the distributed disclosure level 2 key decryption key to decrypt the disclosure level 2 document decryption key and the disclosure level 1 key decryption key. The decryption level 1 decryption encryption information is decrypted using the level 1 key decryption key to obtain a disclosure level 1 document decryption key. Then, the contents of the encryption target areas of the disclosure level 2 and the disclosure level 1 are decrypted and browsed using these document decryption keys.

FIG. 10 is a flowchart for explaining a procedure for generating the decryption encryption information as shown in FIG.
In this case, the encryption processing unit 113 first pays attention to the highest disclosure level among the disclosure levels set for the encryption target area of the electronic document to be processed (step 1001), and is 1 higher than the disclosure level. A disclosure level lower than the hierarchy is specified (step 1002). Next, the encryption processing unit 113 uses the disclosure-level key encryption key focused in step 1001, the document-level decryption key for the disclosure level, and the key-level decryption key for the disclosure level one level lower than that specified in step 1002. Is encrypted (step 1003). Next, the encryption processing unit 113 checks whether or not the processing of steps 1001 to 1003 has been performed for all the disclosure levels set in the electronic document (step 1004). If there is an unprocessed disclosure level, the process returns to step 1001, focusing on the highest disclosure level among the unprocessed disclosure levels, and the process is repeated. If the processing has been performed for all the disclosure levels, finally, the encryption processing unit 113 synthesizes the generated decryption encryption information for each disclosure level and passes it to the document composition unit 114 (step 1005).

FIG. 11 is a diagram illustrating a functional configuration of a decryption apparatus that decrypts and outputs an encrypted electronic document in the document processing apparatus 10 according to the present embodiment.
As shown in FIG. 11, the decryption apparatus 200 according to the present embodiment includes a document processing unit 210 for acquiring and decrypting an encrypted electronic document, a display control unit 220 for displaying the electronic document on a display, And a print control unit 230 for printing out the electronic document. For example, when the decoding device 200 has the hardware configuration shown in FIG. 1, these functions are realized by the CPU 11 and the memory 12 that are program controlled.

The document processing unit 210 includes a key decryption key acquisition unit 211, a document decryption key extraction unit 212, a decryption processing unit 213, a code decryption unit 214, and a data acquisition unit 215.
The key decryption key acquisition unit 211 receives an input of a key decryption key. The key decryption key is distributed to the viewer according to the access level. This key decryption key may be provided in the form of a browser password. For example, the viewer operates the input device 17 of FIG. 1 to input the key decryption key.

  The document decryption key extraction unit 212 uses the key decryption key acquired by the key decryption key acquisition unit 211 to extract a corresponding document decryption key below the disclosure level from the electronic document. Details of the method for extracting the document decryption key will be described later.

  The decryption processing unit 213 uses the document decryption key for each disclosure level acquired by the document decryption key extraction unit 212 to decrypt the contents described in the corresponding disclosure level encryption target area in the electronic document. To do. The electronic document decrypted by the decryption processing unit 213 is stored in a storage unit such as the magnetic disk device 13 or an external document server.

  The code decoding unit 214 reads the content of the code image described in the printed electronic document. For example, the code image is acquired from an image of an electronic document optically obtained by the scanner 18 of FIG. As described above with respect to the print control unit 140 of the encryption apparatus 100, the code image includes a code image representing the decryption encryption information and a code image representing the storage location of the encrypted data (content of the encryption target area). There is.

  The data acquisition unit 215 accesses the storage location of the encrypted data acquired by the code decryption unit 214, and acquires the corresponding encrypted data. In an image obtained by optically obtaining a printed electronic document, no meaningful information can be obtained from the encrypted encryption target area. Therefore, the data acquisition unit 215 acquires encrypted data corresponding to this encryption target area. In this case, the decryption processing unit 213 decrypts the encrypted data acquired by the data acquisition unit 215 for the contents of the encryption target area.

  The display control unit 220 is the same as the display control unit 130 of the encryption apparatus 100 described with reference to FIG. 2, reads out an electronic document that has been encrypted by the document generation unit 110 from its storage location, for example, FIG. It is displayed on the display device 14. Of the encryption target area of the electronic document, the original contents of the corresponding area are displayed for the part decrypted by the decryption processing unit 213.

  The print control unit 230 includes a key code generation unit 141, a data location code generation unit 142, a code arrangement determination unit 143, and a document image generation unit 144. These components are the same as those in the print control unit 140 of the encryption apparatus 100 described with reference to FIG. For this reason, the same reference numerals are given and description thereof is omitted. The decryption device 200 decrypts the encrypted electronic document, but the encryption target area to be decrypted is limited by the access level of the viewer (that is, by the disclosure level of the input key decryption key), Some areas are printed encrypted. Therefore, the key code generation unit 141, the data location code generation unit 142, and the code arrangement determination unit 143 are also required.

Next, the flow of an electronic document decryption process performed by the decryption apparatus 200 according to this embodiment will be described.
FIG. 12 is a flowchart showing a procedure for the decryption apparatus 200 to decrypt the electronic document.
As an initial state, it is assumed that the decryption apparatus 200 has already acquired an electronic document to be processed (an electronic document that has been encrypted). This electronic document is acquired by, for example, receiving from an external server or reading from the magnetic disk device 13 via the network interface 16 shown in FIG.

  Referring to FIG. 12, first, the key decryption key acquisition unit 211 of the document processing unit 210 receives an input of the key decryption key by the viewer (step 1201). Further, the document decryption key extraction unit 212 takes in the electronic document to be processed (step 1202), and extracts the decryption encryption information from the electronic document (step 1203). If the encryption information for decryption is not added to the electronic document to be processed (No in step 1204), the electronic document is not encrypted, and the display control unit 220 and the print control unit 230 output the image of the electronic document as it is. (Display or printing) (Step 1211).

  On the other hand, if the decryption encryption information is added to the electronic document to be processed (Yes in step 1204), the document decryption key extraction unit 212 decrypts using the key decryption key acquired in step 1201. The encryption information is decrypted and the document decryption key is extracted (step 1205). Details of the document decryption key extraction procedure will be described later.

  Next, the decryption processing unit 213 detects an encryption target area in the electronic document (step 1206). Then, the disclosure level set in the extracted encryption target area is checked (steps 1207 and 1208), and the content of the encryption target area is extracted using the document decryption key corresponding to the disclosure level extracted in step 1205. Is restored (step 1209). The information indicating the disclosure level of the encryption target area may be added to the electronic document in association with the encrypted area when the contents of the encryption target area are encrypted. In this case, the information indicating the disclosure level can be read from the electronic document to know the disclosure level of the corresponding encryption target area. Further, the contents of the encryption target area may be decrypted by trying all the decryption keys for the document obtained in step 1205 without adding information indicating the disclosure level to the electronic document.

  Steps 1206 to 1209 are repeated, and if there is no encryption target area that can be decrypted with the document decryption key extracted in step 1205 (No in step 1207), the display control unit 220 and the print control unit 230 perform electronic document processing. Are generated (step 1210) and output (step 1211).

Next, the method for extracting the document decryption key by the document decryption key extraction unit 212 described in step 1205 will be described in detail.
FIG. 13 is a flowchart for explaining a procedure for extracting a document decryption key when decryption encryption information is added in the format shown in FIG.
In this case, the document decryption key extraction unit 212 first pays attention to one of the decryption encryption information added to the electronic document to be processed (step 1301), and the key decryption key acquired in step 1201 of FIG. (Step 1302). If the decryption is successful and the document decryption key is obtained (Yes in step 1303), all the obtained document decryption keys and the respective disclosure levels are associated with each other and stored, for example, in the memory 12 of FIG. 1304).

  On the other hand, if the decryption fails and the document decryption key cannot be obtained (No in step 1303), the operation after step 1301 is repeated, paying attention to the other decryption encryption information. If the decryption with the key decryption key acquired at step 1201 in FIG. 12 fails for all the decryption encryption information, there is no information below the disclosure level of the key decryption key, so the processing ends. (Step 1305).

FIG. 14 is a flowchart for explaining a procedure for extracting a document decryption key when decryption encryption information is added in the format shown in FIG.
In this case, the document decryption key extraction unit 212 first focuses on one of the decryption encryption information added to the electronic document to be processed (step 1401), and the key decryption key acquired in step 1201 of FIG. (Step 1402). If the decryption is successful and the document decryption key is obtained (Yes in step 1403), the document decryption key and the disclosure level are associated with each other and held in, for example, the memory 12 of FIG. 1 (step 1404). Here, if only the document decryption key is decrypted in step 1402 (No in step 1405), information on the other disclosure level that can be decrypted (that is, a disclosure level lower than the key decryption key used for decryption). Since no exists, the process ends.

  If the key decryption key for decrypting the decryption encryption information of the lower disclosure level is decrypted together with the document decryption key in step 1402 (Yes in step 1405), the document decryption key extracting unit 212 then proceeds to step 1402. Paying attention to the decryption encryption information one level lower than the decryption encryption information decrypted in 1402 (step 1406), decryption is performed using the key decryption key decrypted in step 1402 (step 1407). If the decryption is successful and the document decryption key is obtained (Yes in step 1408), the process returns to step 1404, and the document decryption key and the disclosure level are associated with each other, for example, in the memory 12 of FIG. Hold. On the other hand, if the decryption fails and the document decryption key is not obtained (No in step 1408), there is no information below the disclosure level of the decryption key for the key, and the process is terminated.

  In step 1403, when the decryption fails and the document decryption key is not obtained, attention is sequentially paid to other decryption encryption information, and the operations after step 1401 are repeated. If the decryption with the key decryption key acquired at step 1201 in FIG. 12 fails for all the decryption encryption information, there is no information below the disclosure level of the key decryption key, so the processing ends. (Step 1409).

  As described above, the document processing apparatus 10 of the present embodiment has been described separately for the encryption apparatus 100 and the decryption apparatus 200, but the present embodiment is not limited to the above-described configuration. For example, a device having both functions of the encryption device 100 and the decryption device 200 may be used, or a means for print output (the print control unit 140 of the encryption device 100 and the print control unit 230 of the decryption device 200, FIG. It is also possible to adopt an apparatus configuration that performs only display display without providing one printing mechanism 15). Alternatively, on the contrary, a display configuration (display control unit 130 of the encryption device 100, display control unit 220 of the decryption device 200, and the display device 14 of FIG. 1) is not provided, and the device configuration performs only print output. good.

It is a figure which shows the hardware structural example of the document processing apparatus of this embodiment. It is a figure which shows the function structure of the encryption apparatus of this embodiment. It is a flowchart which shows the procedure in which the encryption apparatus of this embodiment encrypts an electronic document. It is a figure which shows the example of the electronic document which is a process target of this embodiment. FIG. 5 is a diagram illustrating a state where an encryption target area and a disclosure level are set and encrypted in the electronic document of FIG. 4. It is a flowchart explaining the setting procedure of the encryption object area | region by the area | region setting part of this embodiment. It is a figure explaining the division method of an object in this embodiment. It is a figure explaining the concept of the encryption method of the encryption information for decoding in this embodiment. It is a flowchart explaining the procedure which produces | generates the encryption information for decoding as shown in FIG.8 (B). It is a flowchart explaining the procedure which produces | generates the encryption information for decoding as shown in FIG.8 (C). It is a figure which shows the function structure of the decoding apparatus of this embodiment. It is a flowchart which shows the procedure in which the decoding apparatus of this embodiment decodes an electronic document. FIG. 9 is a flowchart for explaining a procedure for extracting a document decryption key when decryption encryption information is added in the format shown in FIG. FIG. 9 is a flowchart for explaining a procedure for extracting a document decryption key when decryption encryption information is added in the format shown in FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 ... Document processing apparatus, 11 ... CPU, 12 ... Memory, 13 ... Magnetic disk apparatus, 14 ... Display apparatus, 15 ... Printing mechanism, 16 ... Network interface, 17 ... Input device, 18 ... Scanner, 100 ... Encryption apparatus, DESCRIPTION OF SYMBOLS 110 ... Document generation part, 111 ... Area setting part, 112 ... Disclosure level setting part, 113 ... Encryption processing part, 114 ... Document composition part, 120 ... Encryption key generation part, 130, 220 ... Display control part, 140, 230 ... Print control unit 141 ... Key code generation unit 142 ... Data location code generation unit 143 ... Code arrangement determination unit 144 144 Document image generation unit 200 ... Decryption device 210 ... Document processing unit 211 ... Decryption key for key Acquisition unit 212... Document decryption key extraction unit 213. Decryption processing unit 214 214 Code decryption unit 215 Data acquisition unit

Claims (3)

First encryption means for encrypting a plurality of parts of an electronic document using a document encryption key created for each disclosure standard in accordance with disclosure standards set hierarchically for the part;
Using the key encryption key created for each disclosure standard, the document decryption key of the disclosure standard corresponding to each key encryption key and all the document decryption keys of the disclosure standard lower than the disclosure standard A second encryption means for encrypting
Document generation for generating a new electronic document by adding the document decryption key encrypted by the second encryption means to the electronic document whose predetermined part is encrypted by the first encryption means and means, the,
The first encryption means includes
If the object included in the electronic document and including the encryption target part is a separable object, the object is divided to encrypt only the encryption target part, and the object cannot be divided. A document processing apparatus that encrypts the entire object if it is a possible object . An image forming unit for forming an image based on the electronic document on a recording medium;
The image forming unit includes a code image representing a storage location of the data encrypted by the first encryption unit and an image of a portion not encrypted in the electronic document and an encryption by the second encryption unit. The document processing apparatus according to claim 1, wherein a code image representing the converted data is formed on the recording medium. Computer
In the encryption process, a plurality of parts of the electronic document are encrypted using a document encryption key created for each disclosure standard according to the disclosure standard set hierarchically for the part . If the object included in the electronic document and including the encryption target part is a separable object, the object is divided to encrypt only the encryption target part, and the object cannot be divided. If it is a possible object, a first encryption means for encrypting the entire object ;
Using the key encryption key created for each disclosure standard, the document decryption key of the disclosure standard corresponding to each key encryption key and all the document decryption keys of the disclosure standard lower than the disclosure standard A second encryption means for encrypting
Document generation for generating a new electronic document by adding the document decryption key encrypted by the second encryption means to the electronic document whose predetermined part is encrypted by the first encryption means As a means
A program characterized by functioning.

Images