JPH09179768A - File ciphering system and file deciphering system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide high security as a system by transferring a key for ciphering or deciphering a file on a network in a ciphered state. SOLUTION: A server control means 1220 receives ciphering request information, drives a secret key generation means 1240 and makes a secret key 1320 corresponding to the file intrinsic to the ciphering request information be generated. The secret key 1320 corresponding to the is stored along with a corresponding file name 1410 in a key and file correspondence chart 1250 so as to recognize the correspondence relation. In the meantime, the secret key 1320 corresponding to the file is ciphered by a secret key system ciphering means 1230. The ciphered secret key 1320 corresponding to the file is sent through the network 1000 to a computer 1100 by the server control means 1220. The computer 1100 receives the ciphered secret key 1320 corresponding to the the and deciphers it by using the corresponding key of a key storage means 1310 in a secret key system ciphering/deciphering means 1130.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a secret key encryption system under server management on a computer network that facilitates handling of keys of a secret key encryption method by a computer network and a server device.

[0002]

2. Description of the Related Art Conventionally, in a system in which information resources can be mutually used from a remote place via a network, unauthorized access to computer resources and information resources can be prevented while protecting the interests of users (that is, users). Various methods have been attempted for security to prevent data from being stolen or destroyed.

In a document disclosing an encryption method by server management for security measures on a computer network, which is one of them, for example, a network is used as disclosed in Japanese Patent Laid-Open No. 7-66803. A "user authentication function" that uses a "secret key" for each process (that is, a user terminal or client device), and a secret key and a "shared encryption key" that are group-managed on the server device. There is a "secret key cryptosystem" technology constructed so that "broadcast communication" can be performed within a predetermined group defined in advance.

In addition to the above, for example, JP-A-7-385.
According to Japanese Patent Publication No. 55, each computer (that is, a user terminal or a client device) has a predetermined key management table forming a “tree structure” on the other side with which mutual communication is performed, and encryption is performed using a so-called “public key”. There is also a technology related to the "public key cryptosystem" that is constructed to perform encryption.

[0005]

As described above, among the documents which teach the conventional encryption method by server management on a computer network, there are passwords and users for interprocess communication of group members constituting the network. User management and system security methods based on an access authentication method that requires an ID, a "public key encryption method" or a "common secret key encryption method" incorporating the "secret key encryption method" described above have already been disclosed.

[0006] However, there is a fundamental problem in security measures for resources by means of a key. For example, when a secret key physically flows as data on a computer network, the secret key itself is sent to a third party by a line monitor or the like. There is a possibility that this key will be used easily. Further, even in the encryption method using the public key, there is an undeniable risk that information about the public key will be viewed or decrypted by a third party due to inadequacy of confidential storage of management information such as the key management table.

As described above, in the literature relating to the prior art, further, the handling of systemization by only the secret key cryptosystem and the secret key cryptosystem different for each file holding the information resource and the automatic key management in the network security are mentioned. In terms of "sharing" the encrypted file between that file and a specific user, and managing the private key corresponding to that file, "easy management for the user", "easy system management / configuration" There is no description about the viewpoint of "improvement of
Sufficient consideration has not been made in consideration of operational aspects as well as confidentiality on the system.

Therefore, the present invention is made by paying attention to these listed points of view, and the purpose thereof is to make the following matters as the main purposes. First, in the encryption method in a computer network system that connects a plurality of computers, the "file key encryption system and decryption system" that reduces the risk of secret information being passed to a third party over the network. Is to provide.

Secondly, it is to provide a "file key encryption system and a decryption system" for a wide range of users who are not bound by the model of a computer used as a user terminal for constructing a network.

[0010]

In order to solve the above problems and achieve the object, the system of the present invention comprises the following means. That is, according to the invention of claim 1, in a file encryption system for encrypting a file processed on a computer network system including a computer, a server device, and a network connecting these, the server device comprises:
File-corresponding private key generating means for generating a file-corresponding private key corresponding to the file name of a file to be encrypted, and a computer-specific key which receives a designation of the computer-specific ID from the computer and generates a key unique to the computer Key generating means, key encryption means for encrypting the file-corresponding private key based on the computer unique key, and sending means for transmitting the encrypted file-corresponding private key to the computer via the network The computer includes a key storage unit that stores the computer unique key prior to encryption of the file, and the encrypted file-corresponding secret based on the computer unique key in the key storage unit. It is provided with key decryption means for decrypting a key and file encryption means for encrypting the file based on the decrypted private key corresponding to the file.

According to this configuration, the file encryption key (file-corresponding private key) is used to encrypt the file.
Is generated on the server side, encrypted, and then sent to the computer via the network. The computer side decrypts it to obtain the original file encryption key. The file is encrypted using this encryption key. The file encryption key is encrypted with a key unique to the computer (computer unique key), and the computer stores this computer unique key in advance, so it can be decrypted.

According to a second aspect of the present invention, in the file decryption system for decrypting an encrypted file processed on a computer network system including a computer, a server device, and a network connecting these, the server device is , A file-corresponding private key generating means for generating a file-corresponding private key corresponding to the file name of the encrypted file, and designation of the computer-specific ID from the computer, and generating a key unique to the computer. Computer unique key generation means, key encryption means for encrypting the file corresponding private key based on the computer unique key, and sending of the encrypted file corresponding private key to the computer via the network Means, the computer is
Key storage means for storing the computer unique key prior to encryption of the file, and key decryption means for decrypting the encrypted file-corresponding private key based on the computer unique key in the key storage means. And a file decryption unit that decrypts the encrypted file based on the decrypted private key corresponding to the file.

According to this structure, in order to decrypt the file, the file encryption key (file-corresponding private key)
Is generated on the server side, encrypted, and then sent to the computer via the network. The computer side decrypts it to obtain the original file encryption key. The file is decrypted using this encryption key. The file encryption key is encrypted with a key unique to the computer (computer unique key), and the computer stores this computer unique key in advance, so it can be decrypted.

According to a third aspect of the present invention, in the file encryption system for encrypting a file processed on a computer network system including a computer, a server device, and a network connecting these, the server device encrypts the file. File-corresponding private key generating means for generating a file-corresponding private key corresponding to the file name of a file, and a user-specific key which receives a designation of an ID unique to the user of the computer from the computer and generates a key unique to the user Key generating means, key encryption means for encrypting the file-corresponding private key based on the user unique key, and sending means for sending the encrypted file-corresponding private key to the computer via the network. And a key storage means for storing the user unique key prior to encryption of the file. Key decryption means for decrypting the encrypted file-corresponding private key based on the user unique key in the key storage means, and encryption of the file on the basis of the decrypted file-corresponding private key And a file encryption means.

According to this structure, in order to encrypt the file, the file encryption key (file-corresponding private key)
Is generated on the server side, encrypted, and then sent to the computer via the network. The computer side decrypts it to obtain the original file encryption key. The file is encrypted using this encryption key. The file encryption key is encrypted with a user-specific key (user-specific key), and the computer stores this user-specific key in advance, so it can be decrypted.

[0016]

BEST MODE FOR CARRYING OUT THE INVENTION

(First Embodiment) FIG. 1 shows a block diagram of a network system according to a first embodiment of the present invention. That is, (Configuration 1) A computer 1100 and a server device 1200 are connected to the computer network 1000 so that they can communicate with each other. The computer and the server device are each 1 in FIG.
Although only one unit is connected, two or more units having the same configuration may be connected on the network. However, the number of server devices is equal to or less than the number of computers. The type of computer network used does not matter. For example, a communication line such as a common line or a LAN (local area network) may be used. Also,
When there are a plurality of computers 1100, the server device may be incorporated in some of them.

First, an outline of encryption / decryption of this network system will be described. In order to encrypt a file in the computer 1100, first, a "file corresponding private key" is created. The "file-corresponding private key" is created in the server device 1200 at the request of the computer 1100. The server device 1200 is a “file corresponding private key”
Network 100 after storing and encrypting
It returns to the computer 1100 through 0. Calculator 1100
Then, decrypt the encrypted "File-compatible private key" and use the decrypted "File-compatible private key" to "File".
To encrypt. At this point, the decrypted “file corresponding private key” in the computer 1100 is erased.

Next, in order to decrypt the encrypted "file", the "file-corresponding private key" stored in the server device 1200 is read and encrypted, and then the network 1
000 to return to the computer 1100. The computer 1100 decrypts the encrypted “file-corresponding private key” and decrypts the “file” with the decrypted “file-corresponding secret key”.

Next, a detailed description will be given of the configuration of this network system. First, the details of the computer 1100 that functions as a client for the server device 1200 will be described. The request identification ID storage means 1110 is a computer 110.
A unique request identification ID for identifying 0 is stored. The file storage unit 1420 stores several files that store information resources that are desired to be kept secret by encryption.
The file name assigning unit 1410 sets a unique file name for each file and stores the file name. The client control unit 1120 controls the entire file encryption / decryption operation in the computer 1100.
The request identification ID and the file name are sent to the server device 1220 side via this means. The file encryption / decryption operation is directly performed by the secret key encryption / decryption means 113.
Performed at 0. Client corresponding key storage means 1310
Is a computer 1100 for decrypting the encrypted file-corresponding private key for encrypting the file.
It stores a unique client key. The file-corresponding private key storage means 1320 temporarily stores the file-corresponding private key created by the server device 1220.

On the other hand, the server device 1200 uses the request identification I
Table showing the correspondence between D and the client corresponding key
It has a client identification ID table 1210 stored in the following format. Table 1210 shows that a plurality of computers 1100 (11
In this case, a request identification ID 1110 unique to each computer and a client corresponding key 1310 are stored in advance. The secret key generating means 1240 generates a file-corresponding secret key for encrypting a file by using a random number. The private key type encryption means 1230 encrypts the generated file corresponding private key. The key file correspondence table 1250 stores the file name to be encrypted and the file corresponding private key for encrypting the file having the file name in association with each other. The server control means 1220
Operations related to file encryption performed by the server device 1200, such as generation of a file-corresponding private key, encryption of a file-corresponding secret key, and creation of a key-file correspondence table, and a file from the key-file correspondence table at the time of decryption Controls the entire operation such as retrieval of the corresponding private key and encryption of the retrieved file.

(Operation 1) (Encryption operation) The client control means 1120 of the computer 1100 sends the encryption request information to the server control means 1220 of the server device 1200 via the computer network 1000. The encryption request information includes the file name of the file to be encrypted and the request identification ID of the computer 1100.

The server control means 1220 receives the encryption request information and drives the secret key generation means 1240 to generate a file-corresponding secret key unique to the encryption request information. This file-corresponding private key 1320 is the corresponding file name 1
It is stored together with 410 in the key file correspondence table 1250 so that the correspondence can be seen.

On the other hand, the private key corresponding to the file is encrypted by the private key system encryption means 1230. The client identification ID table 1210 is used for this encryption.
The request identification ID of the encryption request information is sent to the client identification ID table 1210 and the corresponding client corresponding key is searched. The retrieved client-corresponding key is a key unique to the computer 1100, and the file-corresponding private key is encrypted with the key. The encrypted file-corresponding private key is sent to the network 100 by the server control means 1220.
It is sent to the computer 1100 via 0.

The client identification ID table 1210 and the key file correspondence table 1250 are linked by a unique tag 1610 indicating a correspondence relationship. The unique tag 1610 is represented by alphabets (a, b, c ...) And indicates that the same alphabets have a corresponding relationship. The unique tag 1610 may be omitted. However, in that case, the file name of the file to be encrypted, the secret key, the request identification ID for which the encryption is requested, and the client corresponding key corresponding thereto are stored in one table in association with each other.

The computer 1100 receives the encrypted file-corresponding private key, and the private key encryption / decryption means 1
In 130, the client corresponding key storage means 1310
The file-corresponding private key is decrypted using the client-corresponding key. The decrypted private key corresponding to the file is stored in the private key storage unit 1320 corresponding to the file.

Next, the secret key type encryption / decryption means 11
Reference numeral 30 encrypts the file having the file name corresponding to the file-corresponding private key by using the decrypted file-corresponding private key. When the encryption of the file is completed, the file-corresponding private key in the file-corresponding private key storage means 1320 is erased. Therefore, after the deletion, it becomes impossible to decrypt the encrypted file by the computer 1100 alone. The encrypted file is stored in the file storage means 142.
0, and is transferred to other computers on the network as needed.

(Decryption Operation) When the computer 1100 attempts to decrypt an encrypted file, it sends decryption request information to the server device 1220. The decryption request information is
The file name of the file to be decrypted and the request identification ID of the computer 1100. Here, the file name is input using an input means such as a keyboard. Upon receiving the decryption request information, the server device 1220 firstly, the client identification ID table 1210 and the key file correspondence table 12
See 50. File name sent and request identification I
If the unique tags 1610 corresponding to D match each other, it is determined that the computer having the request identification ID has the right access right to the designated file, and the file name designated from the key file correspondence table 1250 is used. The corresponding file corresponding private key is searched and the client identification ID table 12
The corresponding client corresponding key 1310 is searched from 10 and the file corresponding secret key is encrypted by the secret key encryption means 1230 using this. The encrypted file-corresponding private key is sent to the computer 1100 via the network 1000.

The private key type encryption / decryption means 1130 of the computer 1100 stores the encrypted file-corresponding private key in the client-corresponding key storage means 13 in the same manner as at the time of encryption.
Decrypt using the client corresponding key of 10. After that, the specified file is decrypted using the decrypted private key corresponding to the file. When the file is decrypted,
The file corresponding private key in the file corresponding private key storage means 1320 is erased. Private key encryption / decryption means 1
130 can be implemented in either hardware or software.

The file to be encrypted or decrypted is on the computer 1100 or the server device 1220.
It is stored above. The file 1420 in the computer 1100 is the computer network 1000.
It may be provided in another accessible device above.

(Effect 1) According to the first embodiment, the file encryption / decryption key (file-corresponding private key) is transferred on the network in an encrypted state, and therefore, on the network. Even if a third party etc. can obtain the private key corresponding to the file, the file is not decrypted. Also, the file encryption / decryption key (file-corresponding private key) is unique to each file, so even if a third party could obtain one file-corresponding private key, Other files cannot be decrypted. That is,
High confidentiality as a system can be obtained.

Further, since the file encryption / decryption key (file-corresponding private key) is not stored on the computer side as a client, the user side can obtain operability without being aware of the key.

Further, the keys for file encryption and decryption (file-corresponding private key) are collectively managed on the server side, and the operability for the user is good. (Second Embodiment) (Structure 2) The second embodiment of FIG. 2 is almost the same as the first embodiment, and therefore only different parts will be described. In the first embodiment, a unique request identification ID for identifying the computer 1100
And a client corresponding key unique to the computer 1100 for decrypting the encrypted file corresponding private key. On the other hand, the user ID is used instead of the request identification ID, and the user key is used instead of the client corresponding key. While the request identification ID and the client corresponding key are unique to the computer 1100 (client), the user ID and user key are IDs and keys unique to each user independently of the client. The user ID and the user key are input means such as a keyboard (2110, 2310).
Is input from the outside of the computer 2100 using, and stored in a storage unit (not shown).

Further, the file name is determined by the computer 2100 itself in the first embodiment, but here, the computer 21
The user determines the value outside 00 and inputs it using the input means (2410).

In response to these changes, the client identification ID table 1210 replaces the user identification ID table 2210. The request identification ID 1110 is shown in this table 2210.
A user ID 2111 in place of the above and a user key 2250 in place of the client corresponding key are stored.

The file storage means 2420 is connected to the outside of the computer 2100 as a file server 2510 on the network 2000. The user key 2310
May be created from the user ID 2111 on the computer.

The unique tag 2610 may be omitted.
However, in that case, the file name of the file to be encrypted, the secret key, the user ID of the user who requested the encryption, and the user key corresponding thereto are all stored in one table in association with each other.

(Operation 2) The description is omitted because it is almost the same as that of the first embodiment. The user identification ID and the user key are input at the same time as the file name when the file encryption / decryption operation is started. To decrypt the file-corresponding private key 3250 with the computer 3100, the computer 31
The user key 3310 stored on the 00 side is used.

(Effect 2) According to the second embodiment, in addition to the effect described in the description of the first embodiment, the file can be encrypted / decrypted on a user basis independently of the computer (client). Therefore, it becomes possible to handle files without being restricted by a specific computer.

(Third Embodiment) (Structure 3) Since the third embodiment of FIG. 3 is almost the same as the second embodiment, only different parts will be described. The computer 3100 according to the third embodiment receives a decryption right user ID, and specifies a decryption right user ID that gives a plurality of different users access rights regarding decryption.
The designating means 3111 is added. Server device 320
0 corresponds to the addition and the key file correspondence table 332
A plurality of unique tags 3610 within 0 can be set.

(Operation 3) In addition to the operation of encrypting / decrypting a file in the second embodiment, the operation of FIG. 3 includes an operation for permitting only the designated user to decrypt the file. Is added.

First, for each user ID registered in this network system, on the user identification ID table 3210, a unique tag 3610 (alphabet a,
b, c ...) are given. Here, with the input of the file name of the encrypted file, the user ID and the user ID of the person who wants to give permission to decrypt the file
(Decryption right user ID) is input. Similar to the above embodiment, when the file corresponding private key is created by receiving the encryption request information, the file name and the file corresponding private key are stored in the key file correspondence table 3320. A unique tag corresponding to the user ID and the decryption right user ID is stored. For example, the correspondence table 33 in FIG.
The unique tag on the second line of 20 is (a, b, d), which is a file created by the person with the user ID of a, and b
And d are permitted to decrypt the file.

Therefore, at the time of decryption, the user name is always input together with the file name, and it is judged whether or not this user ID has the decryption right. That is, the key file correspondence table 33
The user ID that is given the decryption right to the file name to be decrypted is read from 20, and the input user I
See the agreement with D. If there is a match, the file-corresponding private key corresponding to the file name is read, the user key corresponding to the user ID is read from the user identification ID table 3210, the file-corresponding secret key is encrypted using this user key, and then stored in the computer 3100. send. However, if there is no match, it is determined that the user is not given the decryption right, and that effect is returned to the computer 3100.

The user key 3310 may be created on the computer from the user ID 3111. Further, the unique tag 3610 may be omitted. However, in that case, the file name of the file to be encrypted, the secret key, the user ID of the user who requested the encryption, and the user key corresponding thereto are all stored in one table in association with each other.

(Effect 3) According to the third embodiment, in addition to the effect described in the description of the second embodiment, there is an effect that one file can be shared among a plurality of users who are given permission. In other words, it is possible to manage hierarchically encrypted files.

In each of the embodiments described above, a general secret key encryption method, for example, a secret key generation module may be used. (Modification) The “encryption method” and “decryption method” of the first to third embodiments described above may use a general secret key encryption method, for example, existing secret key generation. Modules may be used.

As the computer network system according to the present invention, in addition to a public line such as a general telephone network or a packet switching network, it is possible to perform multimedia communication including a company network, an inter-company network, and a satellite communication network. It may be the Internet or the like, and is not limited to a communication protocol or a machine type of a computer as a communication terminal, and the method provided by the present invention is provided in an upper layer (that is, an application layer) related to data communication. It only needs to be in an executable environment.

Further, the file server may be a relational database system or the like in which related data is made into a database in addition to storing and holding information resources in file units.

Besides, various modifications can be made without departing from the scope of the present invention. Note that the following inventive concept is derived from the above embodiment. (1) In a file encryption system that encrypts a file processed on a computer network system including a computer, a server device, and a network that connects them, the server device corresponds to the file name of the file to be encrypted. File-corresponding private key generating means for generating a file-corresponding private key, computer-unique key generating means for receiving a designation of the computer-specific ID from the computer and generating a key peculiar to the computer, and the file-corresponding secret key Is provided with a key encryption means for encrypting based on the computer unique key, and a sending means for sending the encrypted file-corresponding private key to the computer via the network,
The computer is configured to decrypt the encrypted file-corresponding private key based on a key storage unit that stores the computer unique key prior to encryption of the file, and the computer unique key in the key storage unit. A file encryption system, comprising: a key decryption unit for performing encryption and a file encryption unit that encrypts the file based on the decrypted private key corresponding to the file.

(2) In a file decryption system for decrypting an encrypted file processed on a computer network system including a computer, a server device, and a network connecting them, the server device is encrypted. File private key generation means for generating a file private key corresponding to the file name of the file, and a computer unique key generation for receiving a designation of the computer unique ID from the computer and generating a key unique to the computer Means, a key encryption means for encrypting the file-corresponding private key based on the computer unique key, and a sending means for transmitting the encrypted file-corresponding secret key to the computer via the network. The computer has a key storage unit for storing the computer unique key prior to encryption of the file, and the key storage. Key decryption means for decrypting the encrypted file-corresponding private key based on the computer unique key in the storage means, and decryption of the encrypted file on the basis of the decrypted file-corresponding private key A file decoding system comprising: a file decoding means for converting the file into a file. (Items (1) and (2) correspond to the first embodiment).

(3) In a file encryption system for encrypting a file processed on a computer network system including a computer, a server device, and a network connecting them, the server device is a file name of a file to be encrypted. File-corresponding private key generating means for generating a file-corresponding private key corresponding to, and user-unique key generating means for receiving a designation of an ID unique to the user of the computer from the computer and generating a key unique to the user. A key encryption unit that encrypts the file-corresponding private key based on the user unique key; and a sending unit that sends the encrypted file-corresponding private key to the computer via the network, The computer has a key storage unit for storing the user unique key prior to encryption of the file, and a key storage unit. A key decryption means for decrypting the encrypted file-corresponding private key based on the user unique key in the step, and a file encryption for encrypting the file on the basis of the decrypted file-corresponding private key A file encryption system comprising means.

(4) In a file decryption system for decrypting an encrypted file processed on a computer network system including a computer, a server device, and a network connecting them, the server device is encrypted. File private key generation means for generating a file private key corresponding to the file name of the file, and user unique key generation for receiving a designation of the user unique ID from the computer and generating a key unique to the user Means, key encryption means for encrypting the file-corresponding private key based on the user unique key, and sending means for sending the encrypted file-corresponding private key to the computer via the network. The computer stores the user unique key prior to decrypting the file, and the key storage means. Key decryption means for decrypting the encrypted file-corresponding private key based on the user unique key in the storage means, and decryption of the encrypted file on the basis of the decrypted file-corresponding private key A file decoding system comprising: a file decoding means for converting the file into a file.

According to this structure, in order to decrypt the file, the file encryption key (file-corresponding private key)
Is generated on the server side, encrypted, and then sent to the computer via the network. The computer side decrypts it to obtain the original file encryption key. The file is decrypted using this encryption key. The file encryption key is encrypted with a user-specific key (user-specific key), and the computer stores this user-specific key in advance, so it can be decrypted. (Items (3) and (4) correspond to the second and third embodiments).

(5) Further, the computer is provided with a designating unit for designating a user ID that gives permission to decrypt the encrypted file, and the server device includes the file name of the encrypted file and the file name of the encrypted file. The file encryption system according to item (3), further comprising a storage unit that stores the user ID designated by the designation unit in association with each other.

(6) A file encryption / decryption system comprising the file encryption system according to item (5) and the file decryption system according to item (4),
Further, the server device includes means for determining whether the user ID unique to the user given from the computer is a user ID permitted to decrypt the file name of the file to be decrypted, and the user ID not permitted. The file encryption / decryption system is characterized in that the user unique key is not generated by the user unique key generating means when it is determined that

(7) In a file encryption / decryption system including the file encryption system according to item (5) and the file decryption system according to item (4),
Further, the server device permits decryption by seeing a match between the user ID unique to the user given from the computer and the user ID corresponding to the file name of the file to be decrypted read from the storage means. And a user ID determining means for determining whether the user ID is a given user ID.

According to the configurations of (5) to (7), the ID of the user who is given the permission of decryption is stored in association with the file name of the file to be encrypted. Therefore, the decryption can be rejected for the user ID for whom the permission is not given at the time of decryption. In particular, by designating a plurality of user IDs, one file can be shared by a plurality of people. (Items (5) to (7) correspond to the third embodiment).

(8) The computer unique key generating means stores the computer unique ID and the computer unique key corresponding to the ID to clarify the correspondence between the two and store them prior to the encryption of the file. The file encryption system according to item (1), further comprising means.

(9) The file corresponding key generating means is
The computer is provided with a first storage unit that stores the file name of the encrypted file and the file-corresponding private key corresponding to the file name prior to decrypting the file by clarifying the correspondence between them. The unique key generating means is provided with a second storage means for storing the ID unique to the computer and the computer unique key corresponding to the ID to clarify the correspondence between them and to decrypt the file. (2) The file decoding system according to the item (2).

(10) The user unique key generating means is
A storage unit is provided for storing the ID unique to the user and the user unique key corresponding to the ID prior to the encryption of the file by clarifying the correspondence between the two. File encryption system described.

(11) The file-corresponding key generation means makes clear the correspondence between the encrypted file name of the file and the file-corresponding private key corresponding to the file name to decrypt the file. The user unique key generating means is provided with a first storage means for storing the data in advance, and the user unique key generating means decrypts the file by clarifying the correspondence between the user unique ID and the user unique key corresponding to the ID. The file decoding system according to item (4), characterized in that the file decoding system is provided with a second storage means for storing the data in advance.

(12) The server device comprises storage means for storing the file-corresponding private key, and the computer comprises means for erasing the decrypted file-corresponding private key from the computer. The file encryption system according to the item (1).

According to this configuration, the file-corresponding private key is centrally managed on the server side, and if the computer side specifies the file name, the encrypted file can be reproduced without being aware of the corresponding secret key. , File handling becomes easy.

[0063]

As described above, according to the file encryption system and the file decryption system of claims 1 to 3 of the present invention, the file encryption or decryption key (file-corresponding private key) is Since the data is transferred over the network in an encrypted state, even if a third party on the network can obtain the private key corresponding to the file, the file is not decrypted. Also, the file encryption / decryption key (file-corresponding private key) is unique to each file, so even if a third party could obtain one file-corresponding private key, Other files cannot be decrypted. In other words, high confidentiality as a system can be obtained.

Further, according to the invention of claim 3, the file can be encrypted or decrypted on a user-by-user basis independently of the computer (client), so that the file can be handled without being restricted by a specific computer. Become.

[Brief description of the drawings]

FIG. 1 is a system configuration diagram showing a configuration of a network system including a server device according to a first embodiment of the present invention.

FIG. 2 is a system configuration diagram showing a configuration of a network system including a server device according to a second embodiment of the present invention.

FIG. 3 is a system configuration diagram showing a configuration of a network system including a server device according to a third embodiment of the present invention.

[Explanation of symbols]

 1000 ... Computer network, 1100 ... Computer, 1120 ... Client control means, 1130 ... Secret key encryption means, 1200 ... Server device, 1210 ... Client identification ID table, 1220 ... Server control means, 1230 ... Secret key encryption means , 1240 ... Private key generation means, 1250 ... Key file correspondence table, 2000 ... Computer network, 2100 ... Computer, 2120 ... Client control means, 2130 ... Secret key encryption means, 2200 ... Server device, 2210 ... User identification ID table , 2220 ... Server control means, 2230 ... Secret key encryption means, 2240 ... Secret key generation means, 2320 ... Key file correspondence table, 2420 ... File, 2510 ... File server, 3000 ... Computer network, 3 00 ... Calculator, 3120 ... Client control means, 3130 ... Secret key encryption means, 3200 ... Server device, 3210 ... User identification ID table, 3220 ... Server control means, 3230 ... Secret key encryption means, 3240 ... Secret key Generating means, 3320 ... Key file correspondence table, 3420 ... File, 3510 ... File server.

Continuation of the front page (51) Int.Cl. ⁶ Identification code Office reference number FI Technical display location H04L 9/16 H04L 9/00 643

Claims (3)

[Claims] 1. A file encryption system for encrypting a file processed on a computer network system comprising a computer, a server device, and a network for connecting them, wherein the server device has a file name of a file to be encrypted. File-corresponding private key generating means for generating a corresponding file-corresponding private key, and a designation of the computer-specific ID from the computer,
A computer unique key generating means for generating a key unique to the computer, a key encryption means for encrypting the file corresponding secret key based on the computer unique key, and the encrypted file corresponding secret key for the computer A sending means for sending to the computer via a network, wherein the computer, the key storing means for storing the computer unique key prior to encryption of the file, the computer unique key in the key storage means Based on the encrypted file-corresponding private key, and a file encryption means for encrypting the file based on the decrypted file-corresponding private key. And a file encryption system. 2. A file decryption system for decrypting an encrypted file processed on a computer network system comprising a computer, a server device, and a network connecting them, wherein the server device is encrypted. File-corresponding private key generating means for generating a file-corresponding private key corresponding to the file name of the file, and receiving the designation of the computer-specific ID from the computer,
A computer unique key generating means for generating a key unique to the computer, a key encryption means for encrypting the file corresponding secret key based on the computer unique key, and the encrypted file corresponding secret key for the computer A sending means for sending to the computer via a network, wherein the computer, the key storing means for storing the computer unique key prior to encryption of the file, the computer unique key in the key storage means And a file decryption unit for decrypting the encrypted file based on the decrypted file-corresponding private key. A file decoding system characterized in that 3. A file encryption system for encrypting a file processed on a computer network system comprising a computer, a server device, and a network for connecting them, wherein the server device uses a file name of the file to be encrypted. File corresponding secret key generating means for generating a corresponding file corresponding secret key; user unique key generating means for receiving a designation of an ID unique to the user of the computer from the computer and generating a key unique to the user; And a key encryption unit for encrypting the file-corresponding private key based on the user unique key; and a sending unit for transmitting the encrypted file-corresponding private key to the computer via the network. Is a key storage unit that stores the user unique key prior to the encryption of the file; A key decryption unit that decrypts the encrypted file-corresponding private key based on the user unique key therein, and a file encryption unit that encrypts the file based on the decrypted file-corresponding private key A file encryption system comprising: