TWI244849B - An internal business data decryption method - Google Patents
An internal business data decryption method Download PDFInfo
- Publication number
- TWI244849B TWI244849B TW92120898A TW92120898A TWI244849B TW I244849 B TWI244849 B TW I244849B TW 92120898 A TW92120898 A TW 92120898A TW 92120898 A TW92120898 A TW 92120898A TW I244849 B TWI244849 B TW I244849B
- Authority
- TW
- Taiwan
- Prior art keywords
- server
- user
- file
- data
- enterprise
- Prior art date
Links
Landscapes
- Storage Device Security (AREA)
Abstract
Description
9 44 129 44 12
說明本業 I發 八止 [ 除 五 P 明 解 以 用 clfh-f 種 - 是 別 特 法 方 的 密 解。 J案法 域檔方 領種的 術一密 技為加 之係料 屬明資 所發内 技 訊 時 符 業 生 企 端 所 逯 譬 訊 逯 存 稱Explain that the industry I issued eight only [except five P clear explanation to use clfh-f species-is the secret solution of the special method. The case law of the case law of J case is a combination of materials and techniques. It belongs to the internal technical news issued by Mingzi, and it belongs to the industry company.
第5頁 先前技術】 術$,技—日千里的今日,資訊處理裝置與通訊相關的 η置的功能亦越來越多元化,同時在=訊 合現内無不加強其資訊處理裝置的週邊設備來 正努;提;U,以提升企業的競爭力;不過,當企 出其他相關的安全控邊…同時’也相對地衍 業二rt所使用、的分散式系統,大多都透過 與-個伺 以造成管理不Α Γ 貝枓的流量相當驚人, 過網:/ f而,近年來為了避免企業内部資料 如:防火於;子:供了-些手段來解決上述的問題, 安全系:來;:::=網Γ控、防毒程式的資 過網際網路讓資料腦病毒或是企業員工 設備讓資料外$並=& 二對於利外接式錯 卡、zip、外接犬辟:別的保護方法,如:磁碟片、記 不過針對上述門題光碟燒錄等等。 :用以追縱資it:專利公告號第343301號,發明名 讹外机狀況之資訊保全系統及方法一案, 1244849 五、發明說明(2) 的在於按照不同的保全 其重點在於只要當企= =與伺服器端聯絡,取 端執行加密的動作然後 過這種方式對於企業内 降低網路的速度,因為 的連線,此時系統的資 傳送下,也會浪費很多 该專利案並未針對加密 案’對於現今的技術面 企業最重要的兩項資產 兩項資產,如何保護南 作者非常重要的任務與 以加密,當加密資料回 況下達成,實為一具有 有提出解決的手段,該發明案的目 策略來執行不同的資料保護方法, 内部資料要外流時,使用者端就必 得授權後才放行,或是透過伺服器 將假的資料回傳至使用者端,但透 部區域網路會有很大的負荷,甚至 在一龐大的企業,會同時有相當多 源便會被佔據,在資訊一來一回的 企業員工的時間,更進一步來說, 過後檔案進行解密提出新的解決方 來看’著實不應會有類似的情況。 如上所述,人才與資訊是現代 ’所有企業莫不努力創造、保護這 科技公司的業務機密已成為資訊工 極大的挑戰,讓企業内資料對外可 流時’也可在不降低系統資源的情 實用性之思考方向。 【發明内容】 的方=,本發明提供—種用以解除企業内資料加密 ,利用使用去ί目的為將系統加密過的檔案資料加以解密 在企業内部祛田〔、機辨識碼來分辨權限,讓資料僅可 1文用’並可而广々 根據本發明所揭霞的Η &控未經授權軟體之執行。 、用以解除企業内資料加密的方法Page 5 Prior Techniques] Today, the technology—the daily life of information—the functions of information processing devices and communication-related devices are becoming more and more diversified. At the same time, the surroundings of information processing devices must be strengthened. The equipment comes straight; U is used to enhance the competitiveness of the enterprise; however, when other related security control edges are developed ... At the same time, the decentralized systems used by the industry rt are also mostly related to- The traffic that caused the management to fail is quite astonishing. Crossing the net: / f. In recent years, in order to avoid internal information of enterprises such as: fire prevention; sub: provide some means to solve the above problems, the security department: Come :::: == Internet control, anti-virus programs that use the Internet to allow data brain viruses or corporate employee equipment to keep data out of the $$ = & Second, for external error cards, zips, external dogs: Do Protection methods, such as: magnetic discs, but ca n’t remember the disc burning for the above topics, and so on. : Used to chase funds it: Patent Bulletin No. 343301, the case of information preservation system and method for the status of the external machine of the invention name, 1244849 V. The description of the invention (2) is based on the different preservation and its focus is on = = Contact the server, take the encryption action and then take this method to reduce the speed of the network in the enterprise. Because of the connection, the system's data transmission at this time will also waste a lot of this patent case. Regarding the encryption case, for the two most important assets and assets of today's technical companies, how to protect the author ’s very important task and encryption. When the encrypted data is returned, it is a means to propose solutions. The purpose of this invention is to implement different data protection methods. When internal data is to be flowed out, the user must authorize it before releasing it, or return fake data to the user through the server. There will be a lot of load on the Internet. Even in a large enterprise, quite a lot of sources will be occupied at the same time. At the time of the employees of the company, once the information is returned, Furthermore, after the file is decrypted view put forward new solutions' should not really have a similar situation. As mentioned above, talents and information are modern. 'All companies must work hard to create and protect the business secrets of this technology company. It has become a great challenge for information workers. The direction of sexual thinking. [Summary of the invention] Fang =, the present invention provides a method for de-encrypting the data in the enterprise, using the purpose of the file to decrypt the system encrypted file data to decrypt the field within the enterprise [machine identification code to distinguish permissions, Let the data be used only in one text, and can be widely used to control the execution of unauthorized software according to the present invention. Method for de-encrypting data in the enterprise
$ 6頁 1244849 五、發明說明(3) ,至少包含下列步驟:透、 及其維護功能,然後使用服器端建立伺服器端資料庫 端進行連線,接下來使用,依據不同選擇模式與伺服器 資料,其後使用者端偵、' 端取得及確認伺服器端最新之 案至使用者端之命令,、而^否有外接式儲存設備要存入檔 ,確認之後透過使用者$用者端判斷檔案是否為安全檔 辨識碼與使用者代號及檔安送接收介面傳送使用端之機器 送接收介面並傳送至飼‘=,=頭(Header)至伺服器端傳 使用端之機器辨識碼與:^貝料庫,然後伺服器端判斷 案之記錄檔存入伺服器 代唬是否正確,便將寫入檔 號傳送適當之解密字串^ ; ^伺服器端根據使用者代 端傳送接收介面傳送該送接收介®,伺服器 面並送入該使用者端,“:::該使用者端傳送接收介 以解密並還原為一般標, 過解密字串將安全檔加 有關本發明之蟑细向二 取後將一般標存入使用者端。 七細内容及技術,兹就配合圖式說明如下。 【實施方式】 本發明係為一種用以解除企 參照第1圖,第]Rm内貝枓加岔的方法,請 夺统芊構Η Ϊ 以解除企業内資料加密之 了本發明之基本架構,其說明如下: 者端200所構成,而使用者端2。。與;:〇與用 1 G 0完_ ^ n ^ ^ 連…稭由泫伺服态端 100…錄所有寫出與寫入的動作,並提供用以解密之$ 6 页 1244849 V. Description of the invention (3), including at least the following steps: transparent, and its maintenance function, and then using the server to create a server database connection to connect, and then use, according to different selection modes and servo Server data, and then the client detects, confirms and confirms the latest server-to-user command to the client, and ^ does any external storage device need to be saved to the file. After confirmation, the user $ user The terminal determines whether the file is a security file identification code, a user code, and a file sending and receiving interface. The sending machine sends and receives the interface and sends it to the server. '=, = Header to the server sends the client's machine identification code. And: ^ shell database, and then the server-side judgment file is stored in the server to determine whether it is correct, and then write the file number to send the appropriate decryption string ^; ^ the server-side sends and receives according to the user-side The interface sends the sending and receiving media ®, and the server sends it to the client. "::: The client sends and receives media to decrypt and restore it to a normal standard. The decrypted string adds the security file to the sender. After the cockroach is taken in two, the general standard is stored in the user's terminal. The seven details and techniques are described below in conjunction with the drawings. [Embodiment] The present invention is a method for lifting an enterprise by referring to FIG. For the method of adding internal forks in Rm, please win the system structure to remove the encryption of the data in the enterprise. The basic structure of the present invention is described below. It is composed of the client 200 and the user 2 .... 〇 And use 1 G 0 to complete _ ^ n ^ ^ ... from the servo state terminal 100 ... record all write and write actions, and provide for decryption
第7頁 1244849 五、發明說明(4) ----- 授權碼,此外透過使用者端2 〇 〇加密所寫出檔案與授權碼 將安全檔予以解密,以避免企業資料外流,讓資料僅可在 企業内部使用,並可全面管控未經授權軟體之執行,其中 伺服态端1 0 〇係用以接收傳送資料,並整合管理企業内部 之資料,儲存了安全設定、使用者端20 0的使用記錄,^ 及更新使用者端20 0中該安全設定資料之功能,特別是指 分析安全檔解密要件的資訊與解密字串,並包含了(1)管 理介面模組110、(2)伺服器端資料庫丨20、(3)動態目錄模 、、且1 3 0及(4 )伺服器端傳送接收介面1 4 〇,進一步說明如下、 (1)管理介面模組11 0,係提供一管理介面,讓系統操 作人員可直接下達指令並管理伺服器端1〇〇。 (2 )伺服器端資料庫1 2 〇,係提供一空間存放伺服器端 1 〇 〇之資料與其他外來輸入的資料,並使其資料可直接存 取。 (3) 動態目錄模組i3〇(Active Directory),係可透過 輕里目錄存取通訊協定(Lightweight Directory Access Protocol ; LDPA)取得企業員工及部門群組資料,並回存 至伺服器端資料庫1 2 〇。 (4) 伺服器端傳送接收介面14〇,係接收使用者端1〇() 之資料並回存至伺服器端資料庫1 2 0及傳送伺服器端1 〇 〇所 欲發出之資料。 而該使用者端2〇〇,係用以接收傳送資料,並透過安 全設定進行寫出一般檔及安全檔的作業與安全檔回流時解Page 7 of 1244849 V. Description of the invention (4) ----- Authorization code, in addition to encrypting the file and authorization code written by the user end 2000 to decrypt the security file to avoid the outflow of corporate data and let the data only It can be used inside the enterprise, and can fully control the execution of unauthorized software. The server terminal 100 is used to receive and transmit data, and integrates and manages the internal data of the enterprise. It stores the security settings and user terminal 200. The use record, ^, and the function of updating the security setting data in the user terminal 200, especially the information and decryption string for analyzing the decryption requirements of the security file, and includes (1) the management interface module 110, (2) the servo Server-side database 丨 20, (3) dynamic directory module, and 1 3 0 and (4) server-side transmission and receiving interface 1 4 0, further explained as follows, (1) management interface module 11 0, which provides a Management interface, allowing system operators to directly issue instructions and manage server-side 100. (2) The server-side database 1220 provides a space for storing server-side data and other externally input data, and makes it directly accessible. (3) Active Directory module i30 (Active Directory), which can obtain enterprise employee and department group data through Lightweight Directory Access Protocol (LDPA), and save it to the server-side database 1 2 0. (4) The server-side transmission and receiving interface 14o is used to receive the data from the user-side 10 () and return it to the server-side database 120 and the data sent by the server-side 100. The user terminal 200 is used to receive and transmit data, and write the general file and the security file through the security settings.
IIIIII
1244849 五、發明說明(5) 密的作業,以達解除資料加密的功能,並包含了( 1 )核心 功能模組2 1 0、( 2 )使用者端資料庫2 2 0、( 3 )使用者介面模 組2 3 0及(4)使用者端傳送接收介面24 0,進一步說明如下 C1 )核心功能模組2 1 〇,你均 ,小口又&厂 者端2 0 0資料外流,透過安全設定判別該一般檔與安全檔 之差異並決定處理的方式,讓欲進入使用者端之資料可以 使用;一般槽係指未經由加密之檔案並以明文方式呈現。 (2 )使用者端資料庫2 2 〇,係提供一空間存放使用者端 2 0 0之資料與其他外來輸入的資料,並可直接存取該安全 槽’該安全播係指經由加密之檔案並以密文方式呈現。 (3)使用者介面模組23〇 ,係為一使用者介面,可在從 伺服裔端100取得安全設定與解密字串之後對一安全檔解 岔,讓安全檔回覆成為一般檔,讓操作者可方便使用。 - ϋ使用六者端傳迗接收介面240,係接收伺服器端100 ;至使用者端資料庫22°及傳送使用者糊所 特定設定係包含按照不同使用者名稱及電腦上 使用者端2 0 0所用之加密 及對稱式的加密,而非對、式可為非對稱式的加密 (㈣、m演算法及擴圓=是公開金錄 的加密可以是Blow fish、. 1 •、的,、中之一,而對稱式 CAST-128 及RC2 的其中之—Γ1Ρ 6 DES、DES、IDEA、RC5、 1244849 五、發明說明(β)1244849 V. Description of the invention (5) Secret operation to achieve the function of de-encrypting data, and includes (1) core function module 2 1 0, (2) user database 2 2 0, (3) use The user interface module 2 3 0 and (4) the user terminal sends and receives the interface 24 0, and further explains the following C1) The core function module 2 1 0, you all, Xiaokou and the manufacturer side 2 0 0 data outflow, through The security settings discriminate the difference between the general file and the security file and decide the processing method so that the data to be accessed by the user can be used; the general slot refers to the unencrypted file and presented in clear text. (2) The user database 2 220 is to provide a space for storing the data of the client 200 and other externally input data, and can directly access the secure slot. The secure broadcast refers to encrypted files And presented in cipher text. (3) The user interface module 23 is a user interface, which can resolve a security file after obtaining the security setting and decryption string from the server 100, so that the security file response becomes a normal file, allowing the operation Can be easily used. -六 Using the six-party transmission interface 迗 Receiving interface 240, which is the receiving server 100; To the user-side database 22 °, and the specific settings of the transmission user paste include different user names and user terminals on the computer 2 0 0 The encryption used and symmetric encryption, instead of pairwise, the encryption can be asymmetric encryption (㈣, m algorithm and rounding = encryption of public records can be Blow fish,. 1 • ,,,, One of them, and one of the symmetrical forms CAST-128 and RC2—Γ1P 6 DES, DES, IDEA, RC5, 1244849 5. Description of the invention (β)
、MO、卜接式儲存設備3 0 0可從軟碟•、光碟機、ZIP 連H萬用串列匯流排㈤僧⑷serial Bus (Par a 1 1 e 1 p、至萬用串列匯流排連接線、並行埠連接線 資訊儲存带、人串:埠連接線(Seria:l Port)及移動式 于攻置的組合中任意擇一。 一圮錄^ ^伺服器端1〇〇存放了 一寫出檔案之記錄檔,此 辨識碼:使Sint:寫出棺案之時間、電腦機器 資料結構)及隨機Λ'Λ 案名稱、棺案拇指紋(MD5 安全2 ® ’第2 ®為本發明之使用者端解開 端m使:絡端2°二:;;::者端傳送㈣^ 的狀態,當安全=卜用 各山以士田文王才田攸外接式儲存設備30 0欲移動至使用者 I二il會透過前述之解密方式,將此-安全檔解秘而 、在—般檔350,讓其他人可開啟解密一般檔350,並合 以月1方式呈現,讓任何人都可閱讀。 曰 j參照圖示,第3圖為本發明伺服器端與複數個 端、間之關係圖,本圖主要是說明企業内部一個伺服 =1〇〇係透過伺服器端傳送接收介面14〇與分別複數個使 端20 0a〜20〇n的使用者端傳送接收介面24〇a〜24〇n加以 絡,^資料的傳送與接收更為迅速。 外 明參閱第4 — a圖到第4 一 d圖,係為本發明用以 企業内資料加密方法之流程圖,說明如下: 解除 第10頁 1244849 五、發明說明(7) 甘祕:^ ^過伺服器端1 0 0建立一伺服器端資料庫1 2 0及 =、σ此(步驟4 0 0 ),此時請看步驟A,並參閱第5圖, 圖:、、本發明伺服器端建立伺服器端資料庫之細部流程 圖;辣之後,先建立一管理介面模組11〇使其可進入該 伺服為鳊貝料庫120執行存取功能(步驟4〇2),接著透過一 動,杈組130取得企業員工及部門群組資料(步驟404 ) ,最後才將將該資料存入該伺服器端資料庫12〇(步驟4〇6) 二然後再回到第4 —a圖延續步驟4〇〇之後的流程,一使用 者端20 0依據不同模式選擇與該伺服器端1〇〇進行連線(步 驟410)連線的模式可分為主動連線模式(步驟4⑸或 是被動連線模式(步驟420 ),分別進入步驟B與步驟c,這 兩種連線的模式待陳述完第4 —a圖、第4 —b圖、第4 — c圖及第4 -d圖再敘,當連線完成之後,該使用者端2〇〇 取得及確認該伺服器端100最新之資料(步驟43〇),缺後 該使用者端200偵測是否有一外接式儲存設備3〇〇要存入一 檔案至一使用者端20 0之命令(步驟44〇),若沒有,則該使 用者端持續監控(步驟450);若有要存入一檔案至一使用 者端2 0 0 ;該使用者端20 0判斷該檔案是否為一安全檔(步 驟460 ),若不是安全檔,則直接將該檔案存入至硬碟中 (步驟470 : ·’若是安全檔,則透過一使用者端傳送接收介 面240傳送該使用端之一機器辨識碼與一使用者代號及該 檔案之一檔頭至一伺服器端傳送接收介面14〇並傳送至該 =服器端資料庫(步驟480 ),此一檔頭(Header)紀錄一加 密方式、-解密私鑰在該伺服器端的索引、一該安全檔產, MO , buffer-type storage device 3 0 0 can be connected from floppy disk, CD-ROM drive, ZIP H universal serial bus ㈤ ⑷ serial bus (Par a 1 1 e 1 p, to universal serial bus connection You can choose any combination of cable, parallel port connection line information storage belt, human string: port connection line (Seria: l Port), and mobile type. One record ^ ^ server end 100 stores a write The record file of the file, this identification code: make Sint: the time when the coffin case was written, the computer machine data structure) and the random Λ'Λ case name, the thumbprint of the coffin case (MD5 Security 2 ® '第 2 ® is the invention that the end user to unlock the side m: 2 ° two network end: ;; :: ^ iv transmitted by the terminal state, when the safety = Bu-hill with disabilities to Yau Tin Tin King Wen only external storage device 300 to be used to move I will use the aforementioned decryption method to unsecure this security file and put it in the normal file 350, so that others can open and decrypt the normal file 350, which will be presented in a monthly manner so that anyone can read it. With reference to the figure, Figure 3 is a diagram of the relationship between the server end and the multiple ends of the present invention. This figure mainly illustrates the internal A server = 1 00 is transmitted through the server-side transmission and reception interface 14 and a plurality of user-side transmission and reception interfaces 24 0a to 2 00n respectively, and the data transmission Receiving is more rapid. Refer to Figures 4-a to 4-d for details, which is a flowchart of the method for encrypting data in an enterprise according to the present invention, which is explained as follows: Page 10 1244849 V. Description of the invention (7 ) Secret: ^ ^ Create a server-side database 1 2 0 and = σ through the server end 1 0 0 (step 4 0 0), at this time, please see step A, and refer to Figure 5, Figure: 1. The detailed flowchart of the server-side database for the server-side of the present invention. After the server is created, firstly, a management interface module 11 is established so that it can enter the servo to perform the access function for the shellfish database 120 (step 4). 2) Then, through a move, the branch group 130 obtains the information of the enterprise employee and the department group (step 404), and finally stores the data in the server-side database 12 (step 4 06), and then returns to Figure 4-a continues the process after step 400, a user terminal 200 selects according to different modes The connection mode (step 410) with the server end 100 can be divided into an active connection mode (step 4) or a passive connection mode (step 420), and enters step B and step c, respectively. This connection mode is to be described in Figures 4-a, 4-b, 4-c, and 4-d. When the connection is completed, the user terminal 2000 obtains and confirms The latest information of the server 100 (step 43), and the client 200 detects whether there is an external storage device 300. A command to save a file to a client 200 (step 44). ), If not, the user terminal continuously monitors (step 450); if there is a file to be stored in a user terminal 200; the user terminal 200 determines whether the file is a secure file (step 460) ), If it is not a security file, directly save the file to the hard disk (step 470: · 'If it is a security file, send a machine identification code and a use of the user through a user-end transmission and receiving interface 240 The user code and a file header of the file are sent to a server-side transmitting and receiving interface 14 and sent to the server. = Server-side database (step 480), this header records a method of encryption,-the index of the decryption private key on the server, a security file
第11頁 1244849Page 11 1244849
生日期與時間及將該一般檔加密成該安全檔之使用者名稱 ,然後该伺服器端1 0 〇判斷該使用端2 〇 〇之一機器辨識碼與 使用者代號是否正確(步驟4 9 〇 ),若不正確,則該使用 者端2Q0拒絕將該安全檔回復成--般檔並將該安全檔存 入至硬碟中(步驟5〇〇),接下來該使用者端2〇〇判斷是否有 一解除該安全擋加密的命令(步驟5 1〇),若沒有解除該安 全檔加密的命令,則該使用者端2〇〇持續監控(步驟52〇), 並重回步驟510,若有解除該安全檔加密的命令,則重 步驟460。 五、發明說明(8) 該機器辨識碼係指特定之使用者端2〇〇的電腦上特定 的機器序號,回到步驟49 0之後,若機器辨識碼與使用者 代正確,則將一寫入檔案之記錄檔存入伺服器端資料庫 120/步驟5 30 ),存完之後,該伺服器端1〇〇根據該使用者 代號傳送適當之一解密字串至該伺服器端傳送接收介面 1 40 (步驟540 ),此一解密字串係按照安全檔不同的加密方 式來以相對的的方式解密,然後該伺服器端傳送接收二面 140傳迗該解密字串至該使用者端傳送接收介面24〇並送入 該,=者端200 (步驟5 5 0 ),接下來該使用者端2〇〇透過該 、解串將該安全槽加以解密並還原為該一般播(步驟5 60 ),、^。後,將該一般檔存入該使用者端(步驟570),並結束 接著來說明步驟B之後的流程,請相第6 _a圖盘第 m ί、6 ~a圖為本發明使用者端主動連線模式之細 。圖(一)及第6 —b圖為本發明使用者端主動連線模The date and time of birth and the user name of the security file are encrypted, and then the server 100 determines whether the machine identification code and user code of the user 200 are correct (step 4 9 〇). ), If it is not correct, the client 2Q0 refuses to restore the security file to a normal file and saves the security file to the hard disk (step 500), and then the user terminal 200 It is determined whether there is a command to cancel the encryption of the security file (step 51), if there is no command to cancel the encryption of the security file, the user terminal 200 continuously monitors (step 52), and returns to step 510, if If there is a command to unencrypt the security file, step 460 is repeated. V. Description of the invention (8) The machine identification code refers to the specific machine serial number on the computer of the specific user terminal 2000. After returning to step 49, if the machine identification code is correct with the user, it will be written The log file of the input file is stored in the server-side database 120 / step 5 30). After saving, the server-side 100 transmits an appropriate decryption string to the server-side transmission and receiving interface according to the user code. 1 40 (step 540), this decryption string is decrypted in a relative manner according to different encryption methods of the security file, and then the server side transmits and receives 140 and the decryption string is transmitted to the user side. The receiving interface 24 and sends it to == 200 (step 5 50), and then the user 200 decrypts the secure slot and restores it to the normal broadcast (step 5 60) ) ,, ^. After that, the general file is stored in the user terminal (step 570), and then the process after step B is explained. Please refer to the 6th _a chart and the 6th chart. This is the initiative of the user terminal of the present invention. Details of the connection mode. Figure (a) and Figure 6-b show the active connection mode of the user end of the present invention
第12頁 1244849 五、發明說明(9) 式之::广程圖(二),言兒明如下: 用者=:!特:(先牛透二:使用者端資料庫22。取得該使 面…發送」同用Λ名二接八:透過, 過一伺服器端值〆、、,姐#人叩“步驟6〇2) ’發送完畢之後透 進入該伺服号端J料庫二:1 牛40接收該同步資料之命令並 料庫12〇比對;驟604) ’其後該祠服器端資 則回報-錯誤Λ特自欲疋否正確(步驟606 ),若該特徵有誤, 用者端20(uH/^j吏Λ者端2〇〇(步驟62〇),此時該使 外流(步驟622 =:貧料庫2 20設定限制以避免資料 資料庫120 ^ 右 徵正確無誤,則透過該伺服器端 (牛驟6斷該使用者端資料庫22G是否需進行同步比對 則:V若該使用者端資料庫2 20不需要進行同步比對 驟6、〇Γ 4樓案之記錄樓存入該祠服器端資料庫12〇(步 驟640),右该使用者端資料庫22〇需要進行同步比對,則 ==服器端資料庫12〇更新的資料透過該祠服器端傳送 接收;i面140進行傳送(步驟63〇),最後該使用者端傳送 接收;I面2 4 0進行接收並存入該使用者端資料庫2 2 〇 (步驟 6 3 2 ),並結束本流程。 本圖之主動連線模式的觸發之時機可從該使用者端 2 00需要向該伺服器端100取回資料或是開機後第一次網路 連通或是泫使用者端2 〇 〇自由設定一時間週期中任意一種 接著來說明步驟c之後的詳細流程,步驟c可分為透過Page 12 of 1244849 V. Description of the invention (9) The formula is: wide-range map (2), the words are as follows: User = :! Special: (First Niu Tou 2: User-end database 22. Get the proxy "Send ... Send" with the same name, then connect to eight: through, after a server end value 〆 ,,, sister # 人 叩 "step 6〇 2) 'After the transmission is completed, enter the server's terminal J library two: 1 The cow 40 receives the command of the synchronization data and compares it with the database 120; step 604) 'After that, the temple server will report back the error-whether it is correct or not (step 606). If the feature is incorrect, The user side 20 (uH / ^ j Λ 者 者 端 200 (step 62)), at this time it should be outflowed (step 622 =: poor material library 2 20 set a limit to avoid the data library 120 ^ right sign is correct , Then use the server end to determine whether the user database 22G needs to be synchronized. If the user database 2 20 does not need to be synchronized, step 6, 〇Γ 4th floor The record building of the case is stored in the server-side database 12 (step 640), and the right-side user-side database 22 needs to be synchronized. Then == the server-side database 12o updates the data. Pass and receive through the temple server; i-side 140 transmits (step 63), and finally the user transmits and receives; I-side 2 40 receives and stores it in the user database 2 2 0 (step 6). 3 2), and the process is ended. The timing of triggering the active connection mode in this figure can be retrieved from the user end 200 to the server end 100 or the first network connection after booting or泫 User terminal 2000 is free to set any one of a time period. Next, the detailed process after step c will be explained. Step c can be divided into
第13頁 1244849 五、發明說明(10) 伺服器端1 0 0通知改變設定(步驟c 、 100傳送改變設定(步驟C2),如圖 f直接透過伺服器端 ,第7 —a圖為本發明使用者端 a圖及第7 -b圖 器端通知改變設定的細部流程圖運、银7 =且透過伺服 用=被動連線模式且直接透過飼服θ為二= 細部流程圖,說明如下: 、改鲶έ又疋的 步驟C1之後,該伺服器端1〇〇判 # 是否有變更安全設定(步驟70 0 ),若沒二面杈, 則該伺服器端100持續監控(步驟7 ,又艾女产設定, 徨槔拉w入二Μ 2 j服為知10 0透過该伺服器端 傳达接收介面丨40通知各使用者端2〇〇需改變安全設定(步 驟720),然後各使用者端2〇〇透過該使用者端傳送接收介 面240接收該通知訊號並向該伺服器端傳送接收介面14〇要 求取回新的安全设定(步驟7 3 〇 ),最後,該伺服器端丨〇 〇透 過該管理介面模組1 1 〇回傳新的安全設定給該使用者端2〇〇 ’該使用者端200並存入至該使用者端資料庫22〇 (步驟 740 ),並結束ci之流程。Page 13 1244849 V. Description of the invention (10) The server side 1 0 0 notifies the change setting (steps c and 100) to transmit the change setting (step C2), as shown in Figure f through the server side directly. Figure 7-a shows the invention Detailed flow chart of the user side a and the 7th-b chart device notification of changing the settings, silver 7 = and through the servo = passive connection mode and directly through feeding θ = 2 = detailed flow chart, explained as follows: After changing the step C1, the server end 100 judges whether the security settings have been changed (step 70 0). If there is no two-sided control, the server end 100 continuously monitors (step 7, and Ai women's production settings, pull the two into the 2M 2 j service to know 10 0 through the server-side communication receiving interface 丨 40 notify each user terminal 200 that the security settings need to be changed (step 720), and then use each The user side 200 receives the notification signal through the user-side transmission and receiving interface 240 and sends the receiving interface 14 to the server side to request to retrieve the new security settings (step 73), and finally, the server side丨 〇〇 Pass back the new security settings through the management interface module 1 1 〇 Give the client 200 'the client 200 and store it in the client database 22 (step 740), and end the process of ci.
步驟C2之後,該伺服器端1〇〇判斷一管理介面模組n〇 是否有變更安全設定(步驟750 ),若沒有變更安全設定, 則該伺服器端持續監控;若有變更安全設定,則透過該伺 服器端傳送接收介面1 4 0直接傳送新的安全設定至該使用 者‘傳送接收介面240(步驟770),最後,該使用者端傳送 接收介面2 4 0將新的安全設定存入該使用者端資料庫2 2 0 (步驟780 )。After step C2, the server 100 judges whether a management interface module no has changed the security setting (step 750). If the security setting is not changed, the server continuously monitors; if the security setting is changed, then Through the server-side transmission and reception interface 1 4 0, the new security settings are directly transmitted to the user's transmission and reception interface 240 (step 770). Finally, the user-side transmission and reception interface 2 4 0 stores the new security settings in The client database 2 2 0 (step 780).
第14頁 1244849Page 14 1244849
第15頁 1244849 圖式簡單說明 【圖式簡單說明】 第1圖為本發明用以解除企業内資料加密之系統架構圖; 第2圖為本發明之使用者端解開安全檔之示意圖; 第3圖為本發明伺服器端與複數個使用者端連間之關係 圖; 第4 — a圖為本發明用以解除企業内資料加密方法之流程 圖(一), 第4 — b圖為本發明用以解除企業内資料加密方法之流程 圖(二), 第4 — c圖為本發明用以解除企業内資料加密方法之流程 圖(三); 第4 一 d圖為本發明用以解除企業内資料加密方法之流程 圖(四); 第5圖為本發明伺服器端建立伺服器端資料庫之細部流程 圖; 第6 — a圖為本發明使用者端主動連線模式之細部流程圖 (一); 第6 — b圖為本發明使用者端主動連線模式之細部流程圖 (二); 第7 — a圖為本發明使用者端被動連線模式且透過伺服器 端通知改變設定的細部流程圖;及 第7 — b圖為本發明使用者端被動連線模式且直接透過伺 月艮器端傳送改變設定的細部流程圖。Page 15 1244849 Brief description of the drawings [Simplified description of the drawings] Fig. 1 is a system architecture diagram of the present invention for de-encrypting data in an enterprise; Fig. 2 is a schematic diagram of a user end unlocking a security file of the present invention; Fig. 3 is a relationship diagram between the server end and a plurality of user ends of the present invention; Fig. 4-a is a flowchart (a) of the method for de-encrypting data in an enterprise of the present invention, and Fig. 4-b is this Flow chart of the method for de-encrypting data in an enterprise (II), Fig. 4-c is a flow chart of the method for de-encrypting data in an enterprise (C) Flow chart (4) of the method for encrypting data in the enterprise; Figure 5 is a detailed flow chart of establishing a server-side database on the server side of the present invention; Figure 6-a is a detailed flow chart of the active connection mode of the user end of the present invention Figure (a); Figure 6-b is a detailed flow chart of the active connection mode of the user terminal of the present invention (II); Figure 7-a is the passive connection mode of the user terminal of the present invention and notification of changes through the server Set-up details ; And of 7 - b Pictured passive user terminal connected mode of the present invention and transmits the setting change detailed flow directly through the servo Burgundy month end.
第16頁 1244849 圖式簡單說明 〔符號說明 100 110 120 130 140 200 200a〜200η 210 220 230 240 240a〜240η 250 300 350 步驟400 步驟402 步驟404 步驟406 步驟410 伺服器端 管理介面模組 伺服器端資料庫 動態目錄模組 伺服器端傳送接收介面 使用者端 使用者端 核心功能模組 使用者端資料庫 使用者介面模組 使用者端傳送接收介面 使用者端傳送接收介面 硬碟 外接式儲存設備 解密一般檔 透過一伺服器端建立一伺服器端資料庫 及其維護功能 建立一管理介面模組使其可進入該伺服 器端資料庫執行存取功能 透過一動態目錄模組取得企業員工及部門群 組資料 將該資料存入該彳司服裔端資料庫 一使用者端依據不同模式選擇與該伺服器端Page 16 1244849 Brief description of the diagram [Symbol description 100 110 120 130 140 200 200a ~ 200η 210 220 230 240 240a ~ 240η 250 300 350 Step 400 Step 402 Step 404 Step 406 Step 410 Server-side management interface module Server-side Database dynamic directory module server-side transmission and reception interface user-side core function module user-side database user interface module user-side transmission and reception interface user-side transmission and reception interface hard disk external storage device Decrypt a general file. A server-side database and a maintenance function are established through a server-side. A management interface module is established so that it can enter the server-side database to perform access functions. Enterprise employees and departments are obtained through a dynamic directory module. The group data stores the data into the server-side database of a company. A client chooses the server side according to different modes.
第17頁 1244849 進行連線 圖式簡單說明 步 驟41 5 主 動 連 線 模 式 步 驟4 2 0 被 動 連 線 模 式 步 驟4 3 0 該 使 用 者 端 取 料 步 驟44 0 該 使 用 者 端 偵 存 入 一 檔 案 至 步 驟4 5 0 該 使 用 者 端 持 步 驟4 6 0 該 使 用 者 端 判 步 驟4 7 0 直 接 將 該 檔 案 步 驟4 8 0 透 過 一 使 用 者 之 — 機 器 辨 識 一 檔 頭 至 一 伺 該 伺 服 器 端 資 步 驟490 該 伺 服 器 端 判 一 使 用 者 代 號 步 驟5 0 0 將 該 使 用 者 端 稽 並 將 該 安 全 步 驟5 10 該 使 用 者 端 判 的 命 令 步 驟5 2 0 該 使 用 者 端 持 步 驟5 3 0 將 一 寫 入 檔 案 步 驟54 0 該 伺 服 器 端 根 解 密 字 串 至 該 得及確認該伺服器端最新之資 測是否有一外接式儲存設備要 一使用者端之命令 續監控 斷該檔案是否為一安全檔 存入至硬碟中 端傳送接收介面傳送該使用端 碼與一使用者代號及該檔案之 服器端傳送接收介面並傳送至 料庫 斷該使用端之一機器辨識碼與 是否正確 拒絕將該安全檔回復成——般 檔存入至硬碟中 斷是否有一解除該安全槽加密 續監控 之記錄檔存入伺服器端資料庫 據該使用者代號傳送適當之一 伺服器端傳送接收介面Page 17 1244849 Simple description of the connection diagram Step 41 5 Active connection mode step 4 2 0 Passive connection mode step 4 3 0 The client-side picking step 44 0 The client-side saves a file to the step 4 5 0 The user side holds step 4 6 0 The user side judges step 4 7 0 The file is directly passed to step 4 8 0 Through a user's — the machine recognizes a file to a server side of the server. Step 490 The server end judges a user code step 5 0 0 checks the user end and checks the security step 5 10 the user side orders a command step 5 2 0 the user side holds a step 5 3 0 writes a File step 54 0 The server end decrypts the string to get the latest information from the server. Check if there is an external storage device. A client command is required to continue to monitor whether the file is stored in a secure file. To the middle end of the hard disk sending and receiving interface to send the client Code and a user code and the server-side transmission and receiving interface of the file and send it to the library to determine whether a machine identification code on the user side and whether the security file is correctly refused to be restored to the normal file are saved to the hard disk interrupt Whether there is a log file for deactivating the security slot encryption and continued monitoring is stored in the server-side database and an appropriate server-side sending and receiving interface is sent according to the user code.
第18頁 1244849 圖式簡單說明 步驟5 5 0 步驟5 6 0 步驟5 7 0 步驟6 0 0 步驟6 0 2 步驟6 0 4 步驟6 0 6 步驟6 1 0 步驟6 2 0 步驟6 2 2 步驟6 3 0 步驟6 3 2 步驟6 4 0 步驟700 該伺服器端傳送接收介面傳送該解密字串至 該使用者端傳送接收介面並送入該使用者端 該使用者端透過該解密字串將該安全檔加以 解密並還原為該一般檔 將該一般檔存入該使用者端 透過一使用者端資料庫取得該使用者端之一 特徵 透過一使用者端傳送接收介面發送一同步資 料之命令 透過一伺服器端傳送接收介面接收該同步資 料之命令並進入該伺服器端資料庫 該伺服器端資料庫比對該特徵是否正確 透過該伺服器端資料庫判斷該使用者端資料 庫是否需進行同步比對 回報一錯誤訊息至該使用者端 該使用者端針對該使用者端資料庫設定限制 以避免資料外流 將該伺服器端資料庫更新的資料透過該伺服 器端傳送接收介面進行傳送 使用者端傳送接收介面進行接收並存入該使 用者端資料庫 將該寫出檔案之記錄檔存入該伺服器端資料 庫 該伺服器端判斷一管理介面模組是否有變更Page 18 1244849 The diagram briefly explains step 5 5 0 step 5 6 0 step 5 7 0 step 6 0 0 step 6 0 2 step 6 0 4 step 6 0 6 step 6 1 0 step 6 2 0 step 6 2 2 step 6 3 0 step 6 3 2 step 6 4 0 step 700 The server-side transmitting and receiving interface sends the decrypted string to the user-side transmitting and receiving interface and sends it to the user-side. The user-side sends the decrypted string through the decrypted string. The security file is decrypted and restored to the general file. The general file is stored in the user terminal. A characteristic of the user terminal is obtained through a user terminal database. A command for transmitting synchronous data is transmitted through a user terminal receiving interface. A server-side transmitting and receiving interface receives the command for synchronizing the data and enters the server-side database. The server-side database compares the feature correctly with the server-side database to determine whether the client-side database needs Perform a synchronous comparison and report an error message to the client. The client sets a limit on the client database to avoid data outflow. The server-side database updates the data through the server. The server-side transmitting and receiving interface performs transmission. The user-side transmitting and receiving interface performs receiving and stores in the user-side database. The log file of the written file is stored in the server-side database. The server-side determines a management interface module. Are there any changes
第19頁Page 19
1244849 安全設定 圖式簡單說明 步 驟71 0 該 伺 服 器 端 持 步 驟7 2 0 該 伺 服 器 端 透 知 各 使 用 者 端 步 驟73 0 該 各 使 用 者 端 收 該 通 知 訊 號 要 求 取 回 新 的 步 驟740 該 伺 服 器 端 透 全 -irJX. 5又 定 給 該 使 該 使 用 者 端 資 步 驟7 5 0 該 飼 服 器 端 判 安 全 設 定 步 驟760 該 伺 服 器 端 持 步 驟770 透 過 該 伺 服 器 安 全 設 定 至 該 步 驟780 該 使 用 者 端 傳 入 該 使 用 者 端 續監控 過該伺服器端傳送接收介面通 需改變安全設定 透過該使用者端傳送接收面接 並向該伺服器端傳送接收介面 安全設定 過該管理介面模組回傳新的安 用者端,該使用者端並存入至 料庫 斷一管理介面模組是否有變更 續監控 端傳送接收介面直接傳送新的 使用者端傳送接收介面 送接收介面將新的安全設定存 資料庫1244849 Simple illustration of security setting step 71 0 The server supports step 7 2 0 The server knows each user step 73 0 Each user receives the notification signal and requests to retrieve a new step 740 The server The server-side full-irJX. 5 is given to make the user-side funding step 7 50 0 the feeder-side judgment security setting step 760 the server-side holding step 770 through the server security settings to the step 780 the The client sends in the client to continuously monitor the server-side transmit and receive interface. The security settings need to be changed. The user-side sends and receives the interface and sends the server-side receive interface to the server. The security settings pass through the management interface module. Send a new user side, and the user side is stored in the warehouse. If there is a change in the management interface module, continue to monitor the sending and receiving interface. Directly send the new user. Sending and receiving interface. Sending and receiving interface to the new security. Settings database
第20頁Page 20
Claims (1)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
TW92120898A TWI244849B (en) | 2003-07-30 | 2003-07-30 | An internal business data decryption method |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
TW92120898A TWI244849B (en) | 2003-07-30 | 2003-07-30 | An internal business data decryption method |
Publications (2)
Publication Number | Publication Date |
---|---|
TW200505197A TW200505197A (en) | 2005-02-01 |
TWI244849B true TWI244849B (en) | 2005-12-01 |
Family
ID=37154916
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
TW92120898A TWI244849B (en) | 2003-07-30 | 2003-07-30 | An internal business data decryption method |
Country Status (1)
Country | Link |
---|---|
TW (1) | TWI244849B (en) |
-
2003
- 2003-07-30 TW TW92120898A patent/TWI244849B/en not_active IP Right Cessation
Also Published As
Publication number | Publication date |
---|---|
TW200505197A (en) | 2005-02-01 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
JP6835999B2 (en) | Virtual service provider zone | |
JP6609010B2 (en) | Multiple permission data security and access | |
US7565683B1 (en) | Method and system for implementing changes to security policies in a distributed security system | |
US20050138371A1 (en) | Method and system for distribution of notifications in file security systems | |
EP3866388A1 (en) | Sharing encrypted documents within and outside an organization | |
JP5298599B2 (en) | Secure pre-caching with local superdistribution and key exchange | |
JP2021022945A (en) | Data security using request-supplied keys | |
US7478418B2 (en) | Guaranteed delivery of changes to security policies in a distributed system | |
CN101919202B (en) | Information distribution system and program for the same | |
US20130061054A1 (en) | Method to control and limit readability of electronic documents | |
CN101647006A (en) | Be used for method of data backup and system | |
GB2446169A (en) | Granular accessibility to data in a distributed and/or corporate network | |
EP2354996B1 (en) | Apparatus and method for remote processing while securing classified data | |
US9053130B2 (en) | Binary data store | |
Lu et al. | A Fine‐Grained IoT Data Access Control Scheme Combining Attribute‐Based Encryption and Blockchain | |
WO2018232071A1 (en) | User authentication in a dead drop network domain | |
EP3282670B1 (en) | Maintaining data security in a network device | |
US11222126B2 (en) | Community governed end to end encrypted multi-tenancy system to perform tactical and permanent database and communication operations | |
TW200830200A (en) | Information security management system and method for electronic document | |
Wang et al. | Data transmission and access protection of community medical internet of things | |
TWI244849B (en) | An internal business data decryption method | |
US20220207177A1 (en) | Community Governed End to End Encrypted Multi-Tenancy System to Perform Tactical and Permanent Database and Communication Operations | |
JPH09139735A (en) | Ciphering data communication system | |
WO2008065346A2 (en) | Secure messaging and data sharing | |
US20230177209A1 (en) | Distributed Communication Network |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
MK4A | Expiration of patent term of an invention patent |