JP5670386B2 - Data management system - Google Patents

Description

  The present invention relates to a technique for managing access authority to data, and more particularly to a technique that is effective when applied to a data management system that enables dynamic determination of accessible data as viewed from a user or a device. is there.

  In general, for data that can be accessed by multiple users, access authority is set, and data is given to allow appropriate users to access only in an appropriate manner (for example, read, modify, execute, etc.) Access to is controlled. In particular, for example, in CRM (Customer Relationship Management) systems in companies, a large amount of data related to business information related to multiple customers is stored and managed centrally, so that multiple departments and employees can meet their business needs. Therefore, the access authority for each data is set so that each employee can use the data within the permitted range (customer, data type, etc.) only in the permitted mode. It is important to manage.

  Conventionally, for such data access authority, the access authority is normally set for each piece of data. In this case, the number of access authority settings required is simply data (or data type). ) And the number of users (or user groups, etc.), resulting in a very large number, which makes management complicated. In particular, reviewing or changing access authority in accordance with a change of user or a change in business role becomes a very heavy load on an administrator or the like when the number of target users increases.

  In response to such a problem, a technique for automatically setting or changing access authority has been proposed. For example, Japanese Patent Laying-Open No. 2006-92170 (Patent Document 1) discloses a hierarchical position detection device that detects a user's position and a resource accessed by the user, a user's position detected by the hierarchical position detection device, and A location detection / file access DB server that accumulates information about resources to be accessed, and the authority to resources set according to the user's location, and according to the location of the user who accessed the resource and the location of the user By having a server for user location-dependent file authority authentication that authenticates the user's action on the resource based on the authority to the set resource, security is improved and leakage of files and data is prevented. A resource access management system that can be described is described.

  In addition, JP 2009-21627A (Patent Document 2) associates an attribute information storage unit that stores time and attribute information of the user at the time with the content for performing access control for accessing the content. The access right of the user who can access the content is dynamically set based on the result of comparing the attribute information of the content and the attribute information of the content at the specified time and the time stored in the attribute information storage means with the attribute information of the user. Content that can dynamically set and change access restrictions on user content without burdening the user according to time and the user's situation at that time by providing access right control means to change An access control system is described.

  Japanese Unexamined Patent Application Publication No. 2009-294817 (Patent Document 3) describes a recording medium that is different from a storage device in which a file to which access authority is granted is recorded, and a counterpart apparatus (receiving apparatus) is provided. Recording means for recording a file on an available other recording medium (file server, removable medium, etc.), and when the file is recorded on the separate recording medium by the recording means, it is given to the file recorded on the separate recording medium. An access authority resetting means for changing the access authority according to the recording destination of the file, and a receiving device for controlling access to the file recorded on the separate recording medium according to the changed access authority, The access authority granted to the file depends on the file recording destination, such as the file transmission destination, upload destination, and copy destination. Described access authority management device to automatically change.

JP 2006-92170 A JP 2009-211627 A JP 2009-294817 A

  By using techniques such as those described in Patent Documents 1 to 3 above, for example, it is possible to set / change access authority to some extent automatically according to the user's location, time, data recording destination, etc. Become.

  On the other hand, in recent years, high-performance portable terminals such as so-called smartphones and tablet terminals have become widespread, and the number of scenes used in business is increasing. Users such as corporate employees should always carry these terminals not only within the company, but also when they are on the move or on the go, and access data such as internal business information from a remote location using the communication function. Is possible. That is, there are various places where the user accesses the data, and along with this, the surrounding environment (people and objects existing in the vicinity) also varies. Accordingly, the position where the user exists and the surrounding environment and situation (hereinafter, these may be collectively referred to as “peripheral context”) are variously different.

  Therefore, by acquiring information corresponding to the surrounding context at the location where it exists, and dynamically changing the access authority accordingly, it is possible to dynamically set and change the access authority more flexibly and finely It is considered to be. Here, the general access authority for data is set under the condition of what kind of user or group authority is given to certain data, but by considering the peripheral context, for example, a certain situation (peripheral In the case of (context), it is possible to control what kind of authority is given and what data can be accessed. For example, access to target data is possible only when a person is close to a person or a device is close, or conversely, if a person is close, access to the target data is possible. It is thought that the control which makes it impossible becomes possible.

  In this regard, portable terminals that have become widespread in recent years usually have a short-range wireless communication function and can wirelessly communicate with information processing apparatuses including peripheral portable terminals. For one thing, it is possible to easily grasp information on devices existing in the vicinity. In addition, it is easy to grasp the position information of the portable terminal by using these communication functions and the GPS (Global Positioning System) function.

  On the other hand, in the prior art as described in the above-mentioned patent documents 1 to 3, access authority can be dynamically set according to the user's own context such as the user's position and time. The use of context is not considered.

  Therefore, an object of the present invention is to dynamically determine data accessible to the user or a specific device according to the content of the surrounding context corresponding to information such as the location where the user exists and the surrounding environment and situation. It is to provide a data management system that can do this. The above and other objects and novel features of the present invention will be apparent from the description of this specification and the accompanying drawings.

  Of the inventions disclosed in this application, the outline of typical ones will be briefly described as follows.

  A data management system according to a representative embodiment of the present invention is a system composed of a plurality of information processing devices, and each information processing device is in a range where communication is possible by performing short-range wireless communication. Only when a peripheral device connection unit that detects an information processing device and the specific other information processing device exists in the communicable range, access to specific data is possible, and according to the type of the information processing device And an output processing unit for outputting the specific data by a predetermined means.

  Among the inventions disclosed in the present application, effects obtained by typical ones will be briefly described as follows.

  That is, according to the exemplary embodiment of the present invention, the user or a specific device accesses the user according to the content of the peripheral context corresponding to information such as the location where the user exists and the surrounding environment and situation. Possible data can be determined dynamically.

It is the figure which showed the outline | summary about the structural example of the data management system which is one embodiment of this invention. It is the figure which showed the outline | summary about the example of the concept which judges the data which can be accessed based on the information of the surrounding context in one embodiment of this invention. It is the figure which showed the outline | summary about the example of the concept which judges the data which can be accessed based on the information of the surrounding context in one embodiment of this invention.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. Note that components having the same function are denoted by the same reference symbols throughout the drawings for describing the embodiment, and the repetitive description thereof will be omitted.

<Overview>
A data management system according to an embodiment of the present invention is a method in which a user such as an employee uses a client such as a portable terminal for data such as business information stored on a server in an in-house CRM system of a company. When accessing via a device, the system dynamically determines accessible data based on information on the peripheral context of the user (client device).

  A client device that is a mobile terminal or other IT device owned by the user has information on its location, surrounding environment and situation (for example, “There are employees A and B nearby” and “ Peripheral context information corresponding to “in a conference room with a projector” is regularly acquired. Based on the information of the peripheral context, data accessible to the client device is dynamically determined.

  2 and 3 are diagrams showing an outline of an example of a concept for determining accessible data based on peripheral context information. In FIG. 2, the surrounding environment and situation can be acquired for each of the client device 20a that is a fixedly arranged projector and the client devices 20b and 20c that are portable terminals owned by the user. The communicable range in short-range wireless communication is schematically indicated by a dotted-line ellipse.

  In the present embodiment, whether or not access to certain data from a certain client device 20 is possible is possible when there is another specific client device 20 around the client device 20. (In addition to the context related to the peripheral client device 20, other contexts such as the location and time zone of the client device 20 can be considered, but are omitted here for convenience of explanation). In other words, certain data can be accessed from these client devices 20 only when one or more corresponding specific client devices 20 are within a range where they can communicate with each other by short-range wireless communication. Control as follows.

  In order to perform such control, in the present embodiment, for example, each client device 20 holds an encryption key unique to each client device 20 or a group to which the client device 20 belongs, and permits access from these client devices 20. The target data is repeatedly encrypted using each encryption key in order according to a predetermined order to obtain final encrypted data 11. The encrypted data 11 can be correctly decrypted only by performing decryption by repeatedly using a plurality of encryption keys used for encryption in the reverse order of encryption. That is, the encrypted data 11 cannot be decrypted unless all the client devices 20 that hold the encryption key used for encryption exist in a mutually communicable area and all necessary encryption keys are collected. The access authority is dynamically controlled by adopting the configuration as described above.

  For example, in FIG. 2, the encrypted data 11 a indicates that access (decryption) is possible when the client devices 20 a and 20 b exist within a range where they can communicate with each other. On the other hand, since the client device 20c does not exist in a range in which the client devices 20a and 20b can communicate with each other, it indicates that the encrypted data 11a cannot be accessed (regardless of whether or not decryption is possible).

  Here, for example, as shown in FIG. 3, when the client device 20c newly enters a range in which communication with the client devices 20a and 20b is possible, all the encryption keys held by these three client devices 20 are used. It shows that the encrypted data 11b that has been encrypted can be accessed (decrypted). At this time, as to whether or not to permit access to the encrypted data 11a from the client device 20c, it is possible to arbitrarily set a rule such as uniform permission / permission or condition or setting conditions.

  For example, in the case of performing decryption by using all the encryption keys collected from all the client devices 20 existing in a mutually communicable range, in the example of FIG. 3, the encryption key held by the client device 20c is used. However, the encrypted data 11a is correctly decrypted when all the encryption keys are used except when the encryption key is the same as the encryption key held by the client device 20b or 20c (for example, the encryption key common to a predetermined group). It becomes impossible to become. On the other hand, for each pattern of a combination that extracts all or some of the collected encryption keys, the same decryption is performed using the encryption key included in the combination, and access is possible if the decryption can be correctly performed with any of the patterns. When the configuration that enables the encryption is used, the encrypted data 11a can be accessed from each client device 20 even when there is an encryption key (client device 20) unnecessary for the decryption. .

  As described above, in the present embodiment, as the configuration for controlling access to the target data depending on whether or not the client device 20 necessary as the peripheral context exists in the vicinity, the access to the encrypted data 11 is directly performed. The access control is not limited, but the access control is performed based on whether or not the encrypted data 11 can be correctly decrypted by using the encryption keys held by the client devices 20 existing in the vicinity, but is not limited thereto. For example, a known secret sharing technique such as (k, n) threshold type secret sharing is used to divide the original data into n pieces of divided data (the original data cannot be restored unless k or more are collected), and these The divided data may be configured to be held by each client device 20 instead of the encryption key.

<System configuration>
FIG. 1 is a diagram showing an outline of a configuration example of a data management system according to an embodiment of the present invention. The data management system 1 is connected to the data management server 10 that is a server system that stores data such as business information in an in-house system such as a CRM system, and the data management server 10 via a network 30 such as the Internet or an intranet. A configuration having one or more client devices 20 (20a, 20b, and 20c in the example of FIG. 1) that can be used. In this embodiment, a system for managing access to data such as business information in an in-house system such as a CRM system will be described. However, the present invention is not limited to this, and data is stored and access to this is managed. It can be applied to any system that does.

  The data management server 10 includes, for example, a general file server, NAS (Network Attached Storage), a virtual server in a cloud computing environment, and the like. The data management server 10 uses encrypted data 11 obtained by encrypting data such as business information as a database, Store as a file. Since the encrypted data 11 is encrypted by a predetermined method described later, access (reading) itself to the encrypted data 11 is not particularly limited.

  In this embodiment, the data management server 10 is used as a storage location for the encrypted data 11. However, each client device 20 distributes at least the encrypted data 11 that can be accessed by itself. A (Peer-to-Peer) configuration may be used. Thereby, the data management server 10 is not required, and the configuration can be simple and easy to manage.

  The client device 20 is an information processing apparatus such as a PC, a tablet terminal, a smartphone, or a mobile phone. For example, an intelligent peripheral device that also has a function as an information processing device (information processing function for data such as the encrypted data 11), such as the projector shown in the client device 20a of FIG. The client device 20 held by the user is preferably a portable portable terminal (20b, c in the example of FIG. 1) such as a smartphone. The client device 20 includes, for example, a key management unit 21, a peripheral device connection unit 22, a location information acquisition unit 23, a time acquisition unit 24, and an output processing unit 25 that are implemented by software or hardware such as an integrated circuit. Have.

  The key management unit 21 holds an encryption key unique to the target client device 20 or a user or group that owns the client device 20. The encryption key may be a common key method or a public key method. A plurality of encryption keys may be managed so that different encryption keys are used for each day of the week or time period. A separate encryption key may be used for each user who uses the target client device 20.

  The peripheral device connection unit 22 communicates with other client devices 20 (20b and 20c in the example of FIG. 1) in the vicinity, such as Bluetooth (registered trademark) and RFID (Radio Frequency IDentification). By performing distance wireless communication, it is detected that the client device 20 exists in the vicinity (that is, a communicable range where radio waves reach), and peripheral device information (information relating to the client device 20 existing in the vicinity) as a peripheral context is detected. To get. For example, when each employee in the company has a client device 20 composed of a portable terminal, this is equivalent to grasping other employees in the vicinity.

  The peripheral device connection unit 22 further exchanges data including encryption keys managed by the key management unit 21 of both the client device 20a and the peripheral client devices 20b and 20c. Thereby, the encryption keys held by the peripheral client devices 20b and 20c can be collected.

  Note that the communication protocol for short-range wireless communication between the client devices 20 is not particularly limited. For example, each client device 20 periodically transmits its own device identification information, encryption key, and the like. While notifying, various methods such as waiting for notifications from other peripheral devices can be appropriately employed.

  Although the position information acquisition unit 23 is not particularly limited, for example, the position in relation to the reader is grasped by a function for acquiring latitude / longitude information by a GPS sensor or a short-range wireless communication function such as Felica (registered trademark). A function (for example, an entrance system using an employee ID card), a function for obtaining an approximate position in relation to an access point by acquiring information on an SSID (Service Set IDentifier) of an access point that can be detected by a wireless LAN function, The position information as the peripheral context (or one piece of information for obtaining this) is acquired by the function of grasping the approximate position from the IP address information of the client device 20 or the like. In order to make it possible to grasp position information in various places and situations, a plurality of these functions / devices may be used or combined according to the situation (for example, underground with poor GPS signal conditions) Etc., use the SSID of the wireless LAN).

  The time acquisition unit 24 acquires the current time from the internal clock of the client device 20 by using a function such as an OS, for example. Time information may also be included in the surrounding context (or one piece of information for obtaining it). In addition to the above-described units, it is also possible to obtain information that can be included in the peripheral context by a device such as another sensor or a processing unit.

  The output processing unit 25 decrypts the target encrypted data 11 using the encryption key based on an instruction from the user and correctly decrypts the obtained output data 11 ′ when the client device 20 Output by appropriate means according to the characteristics of For example, when the client device 20 has a display for display such as a PC or a smartphone, the target output data 11 ′ is processed by an appropriate application program using a function such as an OS, and the result is displayed on the display.

  When the client device 20 is, for example, a projector as in the example of FIG. 1, the contents of the output data 11 'are automatically reproduced and projected by an appropriate application program by the function of the projector. Further, when the client device 20 is a printer, the output data 11 ′ is handled by an output method corresponding to the device type of the client device 20, such as printing out.

  In the example of FIG. 1, the output processing unit 25 of the client device 20a as a projector independently obtains the output data 11 ′ from the encrypted data 11, and projects (outputs) the output data 11 ′. It is not limited to the configuration. For example, it is obtained by the output processing unit 25 of another client device (for example, the client device 20c) that exists around the client device 20a that is a projector and can access the encrypted data 11 in the same manner as the client device 20a. The output data 11 ′ may be acquired by the peripheral device connection unit 22 of the client device 20 a by short-range wireless communication and projected by the output processing unit 25.

  When the target encrypted data 11 is decrypted, the output processing unit 25 uses its own encryption key managed by the key management unit 21 and other client devices existing in the periphery acquired via the peripheral device connection unit 22 Using the encryption keys respectively managed by the 20 key management units 21, the encrypted data 11 is decrypted according to a predetermined rule to obtain output data 11 ′. For example, each encryption key is ordered according to a predetermined order (for example, ascending order of binary values of data), and the encrypted data 11 is repeatedly decrypted using the encryption key in the reverse order of the order.

  There are various methods for determining whether or not the decryption has been correctly performed. For example, a header is added to the original data of the encrypted data 11, and a known character string for checking is added to the header. By setting, it can be determined whether or not the decryption has been correctly performed depending on whether or not the check character string appears in the header portion of the finally decrypted data. If decryption cannot be performed correctly, an error message indicating that the user does not have access authority to the target encrypted data 11 is output.

  In this embodiment, encryption and decryption processing using an encryption key is performed in each client device 20, but the encryption key (public key) is transmitted to the data management server 10 and stored in advance. Alternatively, the data management server 10 may be configured to perform processing for decrypting the target encrypted data 11.

  In the data management system 1 as described above, first, each client device 20 periodically searches for the presence or absence of the client device 20 existing in the vicinity by the peripheral device connection unit 22 as detection of the peripheral context. When the presence of a peripheral client device 20 is detected, the client device 20 is requested to send an encryption key, and the encryption key is acquired.

  Thereafter, for example, when a request for access to the specific encrypted data 11 on the data management server 10 is received from the user, the client device 20 acquires the encrypted data 11, and in response to this, the output processing unit 25. Thus, decryption is sequentially performed in a predetermined order using the encryption key acquired from the peripheral client device 20 and the encryption key held in its own key management unit 21. Similar decryption may be performed using a combination pattern obtained by extracting all or part of the encryption key. If it can be correctly decoded, it can be accessed, and the obtained data is output as output data 11 'by a predetermined output method. When determining whether or not access is possible, the position information acquired by the position information acquisition unit 23, the time information acquired by the time acquisition unit 24, and the like may be considered as conditions.

  Not only when the access request for the encrypted data 11 is received from the user, but for example, encryption of a predetermined range on the data management server 10 (for example, one stored in a storage location such as a predetermined folder) periodically The output processing unit 25 may determine whether the data 11 is accessible (whether it can be correctly decrypted), and a list of the encrypted data 11 that can be accessed may be created.

  When the output data is updated by the user, or when the user newly creates data, the encryption key obtained from all the surrounding or specific client devices and the own key management unit The encryption data 11 is created by sequentially repeating the encryption in a predetermined order (for example, ascending order of binary values of the encryption key data) using the encryption key held in 21. The obtained encrypted data 11 is stored on the data management server 10.

  As described above, according to the data management system 1 which is an embodiment of the present invention, for example, a user can use a portable terminal or the like for encrypted data 11 stored on the data management server 10. When accessing via the client device 20, it is possible to dynamically determine accessible data based on the peripheral context information of the client device 20. It is also possible to automatically control the output method depending on the type of client device 20 that outputs the output data 11 ′ (for example, a projector, a printer, a PC, a smartphone, etc.).

  As a result, it is possible to dynamically narrow down the data that can be used according to the surrounding context, and it is possible to dynamically set up the usage environment for the data to be used. Can be improved. In addition, if the specific client device 20 (or user) is not in the vicinity, the target encrypted data 11 cannot be accessed. In other words, the target client device 20 (encryption key) lacks even one target. Since control is performed so that the encrypted data 11 cannot be accessed, unauthorized access to the encrypted data 11 can be prevented and security can be improved.

  As mentioned above, the invention made by the present inventor has been specifically described based on the embodiment. However, the present invention is not limited to the embodiment, and various modifications can be made without departing from the scope of the invention. Needless to say. For example, the above-described embodiment has been described in detail for easy understanding of the present invention, and is not necessarily limited to the one having all the configurations described. In addition, it is possible to add, delete, and replace other configurations for a part of the configuration of the above-described embodiment.

  Each of the above-described configurations, functions, processing units, processing means, and the like may be realized by hardware by designing a part or all of them with, for example, an integrated circuit. Each of the above-described configurations, functions, and the like may be realized by software by interpreting and executing a program that realizes each function by the processor. Information such as programs, tables, and files for realizing each function can be stored in a recording device such as a memory, a hard disk, or an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

  Moreover, in each said figure, the control line and the information line have shown what is considered necessary for description, and do not necessarily show all the control lines and information lines on mounting. Actually, it may be considered that almost all the components are connected to each other.

  INDUSTRIAL APPLICABILITY The present invention can be used for a data management system that can dynamically determine data accessible from a user or a device.

1 ... Data management system,
10 ... Data management server 11, 11a-c ... Encrypted data, 11 '... Output data,
20, 20a to c ... client device, 21 ... key management unit, 22 ... peripheral device connection unit, 23 ... location information acquisition unit, 24 ... time acquisition unit, 25 ... output processing unit,
30 ... Network.

Claims (4)

A data management system comprising a plurality of information processing devices,
Each of the information processing devices includes a peripheral device connection unit that detects other information processing devices existing in a communicable range by performing short-range wireless communication;
A key management unit for storing an encryption key unique to the information processing apparatus or a user who owns the information processing apparatus or a group to which the user belongs;
Access to specific data is possible only when the specific other information processing device exists in the communicable range, and the specific data is output by a predetermined unit according to the type of the information processing device. have a and the output processing unit,
The specific data is encrypted by sequentially applying encryption keys stored in the key management unit of one or more of the information processing devices that can access the specific data in a predetermined order,
The peripheral device connection unit collects encryption keys stored in the key management unit of the other information processing apparatus existing in the communicable range;
The output processing unit, for the specific data, includes all or part of an encryption key stored in the key management unit and an encryption key stored in the other information processing apparatus collected by the peripheral device connection unit. When it is successfully applied and decrypted in reverse order of the predetermined order and correctly decrypted, it is possible to access the specific data on the assumption that the specific other information processing apparatus exists in the communicable range. A data management system characterized by The data management system according to claim 1 ,
The data management system, wherein the specific data is stored on a data management server to which the information processing apparatuses are connected via a network. The data management system according to claim 1 or 2 ,
A data management system, wherein a part or all of the information processing apparatus is a peripheral device having an information processing function. In the data management system according to any one of claims 1 to 3 ,
Each of the information processing devices further includes a position information acquisition unit that acquires information related to its location, and a time acquisition unit that acquires time information,
The output processing unit is acquired by the information on the location acquired by the location information acquisition unit and / or the time acquisition unit in addition to the existence of the specific other information processing device in the communicable range. A data management system for determining whether or not access to the specific data is possible based on the time information.

Images