WO2023119554A1 - Control method, information processing device, and control program - Google Patents

Abstract

The present invention suppresses illicit acquisition of key information.　An information processing device (10) receives a request for key information (16). The information processing device (10): saves input data and permits execution of a procedure (15); and uses a database (13), which is protected by a database management program (14) that restricts the readout of saved input data, to acquire information items (24, 25, 26) saved in the database (13) from a node (21, 22, 23). The information processing device (10) restores the key information (16) in the database (13) by executing a procedure (15) on the saved information items (24, 25, 26). The information processing device (10) outputs the database (13) including the key information (16) in response to the request.

Description

Control method, information processing device and control program

The present invention relates to a control method, an information processing device, and a control program.

The information processing system may encrypt and protect the stored data so that it is not leaked to third parties. When reading data, the information processing system temporarily decrypts the encrypted data using the key information. An information processing system may use a common key of common key cryptography or a secret key of public key cryptography as key information. However, if the key information is leaked to a third party, the encrypted data will be illegally decrypted. Therefore, it is important for an information processing system to safely manage key information.

In addition, multiple distributed data for restoring confidential information are generated from the confidential information, distributed to multiple terminal devices and transmitted, and multiple distributed data are collected from multiple terminal devices in response to requests for confidential information. A communication device has been proposed that restores secret information by

JP 2013-127647 A

As a method of managing key information, an information processing system distributes and arranges a plurality of pieces of information used for restoring key information to a plurality of nodes, and collects information from a plurality of nodes each time key information is requested. A possible method is to restore the key information by However, there is a risk of unauthorized acquisition of key information by a third party due to an attacker intruding into an information processing device that restores key information, or an administrator of the information processing device maliciously leaking information. Accordingly, in one aspect, an object of the present invention is to prevent unauthorized acquisition of key information.

In one aspect, a control method is provided in which a computer executes the following processes. Accepts a request for key information used to decrypt encrypted data. Elements used to recover key information using a database protected by a database management program that permits the storage of input data, the execution of procedures that transform stored input data, and restricts the reading of stored input data Information stored in a database is obtained from a plurality of nodes each having at least one of information and logic information indicating a conversion method of element information. The key information is restored in the database by executing the procedure on the information stored in the database. Outputs a database containing key information in response to a request. Also, in one aspect, an information processing apparatus having a storage unit and a processing unit is provided. Also, in one aspect, a control program to be executed by a computer is provided.

In one aspect, unauthorized acquisition of key information is deterred.
The above and other objects, features and advantages of the present invention will become apparent from the following description taken in conjunction with the accompanying drawings which represent exemplary preferred embodiments of the invention.

1 is a diagram for explaining an information processing device according to a first embodiment; FIG. It is a figure which shows the example of the information processing system of 2nd Embodiment. It is a block diagram which shows the hardware example of a server apparatus. FIG. 4 is a diagram showing an example of key element information generated from an encryption key; It is a figure which shows the example of arrangement|positioning of the key element information to a server apparatus. 4 is a block diagram showing an example structure of a data capsule; FIG. It is a figure which shows the example of the table contained in a database. It is a figure which shows the example of the procedure definition contained in a database. FIG. 4 is a diagram showing an example of authority definitions contained in a database; FIG. 10 is a diagram showing an example of restoration of an encryption key; FIG. 11 is a diagram (continued) showing an example of restoration of an encryption key; It is a block diagram which shows the software structural example of a server apparatus. FIG. 10 is a flowchart showing an example procedure of encryption key restoration; FIG. FIG. 11 is a flowchart (continued) showing an example of a procedure of encryption key restoration; FIG.

Hereinafter, this embodiment will be described with reference to the drawings.
[First embodiment]
A first embodiment will be described.

FIG. 1 is a diagram for explaining an information processing apparatus according to the first embodiment.
The information processing apparatus 10 according to the first embodiment manages key information used for decrypting encrypted data. The information processing device 10 may be a client device or a server device. The information processing device 10 may be called a computer, key management device, or control device.

The information processing device 10 has a storage unit 11 and a processing unit 12 . The storage unit 11 may be a volatile semiconductor memory such as a RAM (Random Access Memory), or may be a non-volatile storage such as a HDD (Hard Disk Drive) or flash memory. The processing unit 12 is, for example, a processor such as a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), or a DSP (Digital Signal Processor). However, the processing unit 12 may include an electronic circuit such as ASIC (Application Specific Integrated Circuit) or FPGA (Field Programmable Gate Array). The processor executes programs stored in a memory such as a RAM (which may be the storage unit 11), for example. A collection of processors may be referred to as a multiprocessor or simply as a "processor."

The storage unit 11 stores a database 13 and a database management program 14. The database 13 and database management program 14 may be combined as package data. This package data may be called a data capsule.

The database 13 is accessed through the database management program 14. The database 13 stores data. Database 13 may correspond to a data file or group of data files. The database 13 may be a relational database or a non-relational database such as a tree type or network type. Database 13 may be encrypted by database management program 14 .

The database management program 14 manages the database 13. The database management program 14 protects the database 13 by restricting types of access to the database 13 . The database management program 14 permits external input data to be stored in the database 13 .

In addition, the database management program 14 permits the execution of the procedure 15 that converts the input data saved in the database 13. The procedure 15 is, for example, a stored procedure registered in the database management program 14 in advance, and is a program that defines the processing procedure for the database 13 . The procedure 15 may output the conversion result data to the outside or store it in the database 13 . However, the procedure 15 does not output the input data itself before conversion to the outside. Further, the processing procedure itself of the procedure 15 is not disclosed to the outside. The database management program 14 may encrypt and retain management information indicating the definition of the procedure 15 .

On the other hand, the database management program 14 restricts reading of the input data saved in the database 13. The database management program 14 may limit users who can save input data in the database 13 or limit users who can execute the procedure 15 . The database management program 14 may encrypt and hold management information indicating the definition of user access rights, and may restrict changes to the management information after the start of operation.

The processing unit 12 accepts a request for the key information 16 used to decrypt the encrypted data. The request may be generated inside the information processing device 10 or received from outside the information processing device 10 . The processing unit 12 may receive package data including the database 13 and the database management program 14 from the information processing device that requests the key information 16 .

The processing unit 12 uses the database 13 and the database management program 14 to collect information 24, 25, 26 from the nodes 21, 22, 23. At this time, the information 24 , 25 , 26 are obtained while being stored in the database 13 . For example, the processing unit 12 causes the nodes 21 , 22 and 23 to store the information 24 , 25 and 26 in the database 13 via the database management program 14 . Therefore, the information processing apparatus 10 does not read the information 24, 25, 26 from the database 13 and does not recognize the contents of the information 24, 25, 26. FIG.

The nodes 21 , 22 , 23 are information processing devices different from the information processing device 10 . The nodes 21, 22 and 23 may be client devices or server devices. Nodes 21, 22, 23 may be called computers or member devices. Although the number of nodes is three in the first embodiment, the number of nodes may be two or more. Each of the nodes 21, 22, and 23 has at least one of element information used to restore the key information 16 and logic information indicating a conversion method of the element information. Node 21 has information 24 , node 22 has information 25 and node 23 has information 26 . The information processing device requesting the key information 16 may be any one of the nodes 21, 22, and 23. FIG.

In order to acquire the information 24, 25, 26, the processing unit 12 executes the database management program 14 as a server process, and provides application interfaces for storing the information 24, 25, 26 in the database 13 to the nodes 21, 22, 26. 23 may be disclosed. Alternatively, the processing unit 12 may transmit the package data including the database 13 or the database 13 and the database management program 14 to the nodes 21, 22, and 23 in order and have them reply. In addition, the processing unit 12 may copy the package data including the database 13 or the database 13 and the database management program 14 and transmit them in parallel to the nodes 21, 22, and 23, and have them reply. In that case, the processing unit 12 uses the procedure 15 to integrate the duplicated contents of the database 13 .

The processing unit 12 restores the key information 16 in the database 13 by executing the procedure 15 on the information 24, 25, and 26 stored in the database 13. The key information 16 is, for example, a common key for common key cryptography or a secret key for public key cryptography. In the process of restoring the key information 16 , the information processing apparatus 10 does not read the information 24 , 25 , 26 or the key information 16 from the database 13 and does not recognize the contents of the information 24 , 25 , 26 or the key information 16 . Also, the information processing apparatus 10 does not recognize the conversion logic defined in the procedure 15 .

At this time, the procedure 15 may generate post-conversion information by performing numerical calculations such as combination, four arithmetic operations, and logic operations on the information 24, 25, and 26 as conversion logic. This converted information may be the key information 16 . Also, this post-conversion information may be position information indicating the position of the key information 16 . When the position information is generated, the processing unit 12 may cause the database 13 to store the key information 16 indicated by the position information. One of the nodes 21, 22, and 23 may have the key information 16 indicated by the position information.

The processing unit 12 outputs the database 13 including the key information 16 as a response to the request for the key information 16. For example, the processing unit 12 transmits the database 13 to the information processing device that requested the key information 16 . The processing unit 12 may output package data including the database 13 and database management program 14 . Note that the database management program 14 may be set so as to permit the information processing device that is the output destination of the database 13 to extract the key information 16 from the database 13 .

As described above, the information processing apparatus 10 of the first embodiment acquires the information 24, 25, 26 from the nodes 21, 22, 23 while being stored in the database 13. The information processing device 10 restores the key information 16 in the database 13 by executing the procedure 15 on the information 24 , 25 and 26 saved in the database 13 . The information processing device 10 then outputs the database 13 including the key information 16 .

As a result, even in the process of collecting the information 24, 25, 26 and restoring the key information 16, the information 24, 25, 26, the key information 16 and the conversion logic are protected through the database 13 and the database management program 14. Therefore, even if an attacker intrudes into the information processing device 10 or the administrator of the information processing device 10 maliciously leaks information, there is a risk that the key information 16 will be illegally obtained by a third party. descend. As a result, the risk of unauthorized decryption of the encrypted data using the key information 16 is reduced, and data security is improved.

The information processing apparatus 10 may acquire package data including the database 13 and the database management program 14 from the source of the request for the key information 16, or may return the package data with the key information 16 stored. good. This enhances the protection of database 13 under the control of the requestor of key information 16 .

The database management program 14 permits the nodes 21, 22, and 23 to store the information 24, 25, and 26, permits the information processing apparatus 10 to execute the procedure 15, and extracts the key information 16 from the database 13. It may be set to allow first. As a result, access authority sufficient to restore the key information 16 is set, and a balance between facilitation of the procedure for restoring the key information 16 and protection of the key information 16 is achieved.

Further, the information processing apparatus 10 may generate location information from the information 24, 25, 26 using the procedure 15, and based on the location information, from one of the nodes 21, 22, 23, the database The key information 16 may be obtained while it is stored in 13 . This further reduces the risk of leakage of the key information 16 .

[Second embodiment]
Next, a second embodiment will be described.
FIG. 2 is a diagram illustrating an example of an information processing system according to the second embodiment.

The information processing system of the second embodiment distributes and manages encryption keys for data encryption and decryption through cooperation among multiple server devices, thereby reducing the risk of leakage of encryption keys. This reduces the risk of data leakage. The encryption key of the second embodiment is a common key of common key cryptography. However, the encryption key may be a public key and a private key of public key cryptography. The information processing system has a key management server 31 , member servers 32 , 33 and 34 , clerks servers 35 , 36 and 37 and a key verification server 38 which are connected to a network 30 . The network may include a LAN (Local Area Network) or the Internet. The key management server 31 corresponds to the information processing device 10 of the first embodiment.

The key management server 31, member servers 32, 33, 34, clerks servers 35, 36, 37, and key verification server 38 are server computers. The key management server 31, member servers 32, 33, 34, clerk servers 35, 36, 37, and key verification server 38 may be included in an on-premises system owned by the user, or may be located in a data center. , may be included in a so-called cloud system.

The member servers 32, 33, 34 may correspond to different users, and the clerks servers 35, 36, 37 may correspond to different users. A user may be a member company. The key management server 31, member servers 32, 33, 34, clerk servers 35, 36, 37, and key verification server 38 may be dynamically selected from a group of servers, and have roles described below. A group of servers may take turns taking charge.

The key management server 31 controls the anonymization and restoration of encryption keys used by users. Key management server 31 receives a request for an encryption key from one of member servers 32 , 33 , 34 . The key management server 31 does not store the encryption key itself. Each time an encryption key is requested, the key management server 31 collects information from the member servers 32, 33, 34 and the clerks servers 35, 36, 37, restores and transmits the encryption key for the requesting member server. do.

The member servers 32, 33, and 34 use encryption keys to encrypt and decrypt data. Member servers 32, 33, and 34 use encryption keys different from each other. The member servers 32, 33, and 34 provide the key management server 31 with the encryption key in advance and do not store the encryption key itself locally. When using the encryption key, the member servers 32 , 33 , and 34 request the encryption key from the key management server 31 and encrypt and decrypt data with the encryption key received from the key management server 31 . After using the encryption key, the member servers 32, 33 and 34 discard the encryption key.

In addition, member servers 32, 33, and 34 store information distributed from key management server 31, and transmit information to key management server 31 in response to requests from key management server 31. The information distributed to the member servers 32, 33, 34 includes a double key generated by encrypting the encryption key. The encryption key is encrypted with individual keys that differ between member servers. The individual key is a common key for common key cryptography. However, the individual key may be a public key and a private key of public key cryptography. Duplex keys are exchanged among the member servers 32 , 33 , 34 . Therefore, a duplicate key for one member server is stored in another member server.

In addition, the member servers 32, 33, and 34 store trap keys and dummy keys, which will be described later, in addition to duplicated keys. Since the duplicated key, the trap key, and the dummy key are mixed, the position of the duplicated key must be specified correctly to read the duplicated key. The information distributed to the member servers 32, 33, 34 includes location information for specifying the location of the duplicated key. The member servers 32, 33, 34 correspond to the nodes 21, 22, 23 of the first embodiment.

Clerk servers 35, 36, and 37 protect individual keys for decrypting encryption keys. Clerk servers 35 , 36 and 37 store information distributed from key management server 31 and transmit information to key management server 31 in response to requests from key management server 31 . The information distributed to the clerk servers 35, 36, 37 includes individual keys.

The clerks servers 35, 36, and 37 also store trap keys and dummy keys in addition to individual keys. Since the individual key, the trap key, and the dummy key are mixed, the position of the individual key must be specified correctly to read the individual key. The information distributed to the clerk servers 35, 36, 37 includes location information for specifying the location of the individual key.

The key verification server 38 determines the key type in response to requests from the member servers 32, 33, and 34 and the clerks servers 35, 36, and 37. The key verification server 38 determines whether the bit string received from the clerk servers 35, 36 and 37 corresponds to an individual key, a trap key or a dummy key according to a preset determination algorithm. Further, the key verification server 38 determines whether the bit strings received from the member servers 32, 33, and 34 correspond to the duplicated key, the trap key, or the dummy key according to a preset determination algorithm.

Regarding the duplicated key, the key verification server 38 may determine the key type from the bit string before decryption, or may determine the key type from the bit string after decryption. Also, the decryption of the duplicated key may be performed by the member servers 32, 33, and 34, or may be performed by the key verification server . The key verification server 38 responds with the determined key type. However, if the determined key type is a trap key, the key verification server 38 performs trap processing. Trap processing includes outputting an alert indicating a possible security attack. The alert output destination is, for example, the key management server 31 . Trap handling also involves intentionally delaying responses. This delays the gathering of information to the attacker if the attacker specifies the wrong location.

In the second embodiment, a data capsule, which will be described later, is used to prevent the encryption key and various information for restoring the encryption key from leaking from the key management server 31 . A member server that requests an encryption key generates a data capsule and transmits it to the key management server 31 . This data capsule is also used for communication between the key management server 31 and member servers 32 , 33 and 34 and communication between the key management server 31 and clerks servers 35 , 36 and 37 . The requesting member server receives the data capsule containing the encryption key from the key management server 31 .

However, a member server that requests an encryption key may request a data capsule generation server (not shown) to generate a data capsule instead of generating a data capsule by itself. In this case, the data capsule generation server performs settings for the data capsule as described later, and provides the data capsule to the member server requesting the encryption key.

FIG. 3 is a block diagram showing an example of hardware of the server device.
The key management server 31 has a CPU 101, a RAM 102, an HDD 103, a GPU 104, an input interface 105, a media reader 106 and a communication interface 107 connected to a bus. Member servers 32 , 33 , 34 , clerk servers 35 , 36 , 37 and key verification server 38 may have hardware similar to key management server 31 . A CPU 101 corresponds to the processing unit 12 of the first embodiment. A RAM 102 or HDD 103 corresponds to the storage unit 11 of the first embodiment.

The CPU 101 is a processor that executes program instructions. The CPU 101 loads at least part of the programs and data stored in the HDD 103 into the RAM 102 and executes the programs. The key management server 31 may have multiple processors.

The RAM 102 is a volatile semiconductor memory that temporarily stores programs executed by the CPU 101 and data used for calculations by the CPU 101 . The key management server 31 may have a type of volatile memory other than RAM.

The HDD 103 is a nonvolatile storage that stores software programs such as an OS (Operating System), middleware, application software, and data. The key management server 31 may have other types of non-volatile storage such as flash memory and SSD (Solid State Drive).

The GPU 104 is a processor that performs image processing in cooperation with the CPU 101 and outputs images to the display device 111 connected to the key management server 31 . The display device 111 is, for example, a CRT (Cathode Ray Tube) display, a liquid crystal display, an organic EL (Electro Luminescence) display, or a projector. Other types of output devices such as printers may be connected to the key management server 31 .

The input interface 105 receives input signals from the input device 112 connected to the key management server 31 . The input device 112 is, for example, a mouse, touch panel, or keyboard. A plurality of input devices may be connected to the key management server 31 .

The medium reader 106 is a reading device that reads programs and data recorded on the recording medium 113 . The recording medium 113 is, for example, a magnetic disk, an optical disk, or a semiconductor memory. Magnetic disks include flexible disks (FDs) and HDDs. Optical discs include CDs (Compact Discs) and DVDs (Digital Versatile Discs). A medium reader 106 copies the program and data read from the recording medium 113 to another recording medium such as the RAM 102 or HDD 103 . The read program may be executed by CPU 101 .

The recording medium 113 may be a portable recording medium. Recording medium 113 may be used to distribute programs and data. Recording medium 113 and HDD 103 may also be referred to as computer-readable recording media.

The communication interface 107 communicates with the member servers 32, 33 and 34 and the clerks servers 35, 36 and 37 via the network 30. The communication interface 107 may be a wired communication interface connected to a wired communication device such as a switch or router, or a wireless communication interface connected to a wireless communication device such as a base station or access point.

Next, key element information for restoring the encryption key will be described.
FIG. 4 is a diagram showing an example of key element information generated from an encryption key.
The key management server 31 acquires three encryption keys corresponding to the member servers 32 , 33 and 34 from the member servers 32 , 33 and 34 . The encryption key 41 is the encryption key of the member server 32 . The key management server 31 generates three individual keys corresponding to the member servers 32 , 33 and 34 . The individual key 42 is an individual key corresponding to the member server 32 . The key management server 31 encrypts the three encryption keys with the corresponding individual keys to generate three duplicate keys. Duplex key 43 is generated by encrypting encryption key 41 with individual key 42 .

The key management server 31 generates three duplicate key lists and three duplicate key position information from the three duplicate keys. Each duplicate key list includes one duplicate key, multiple trap keys, and multiple dummy keys. The three duplicated key lists are distributed to different member servers. Duplex key list 46 is distributed to member servers 32 . Preferably, the duplicate key list 46 does not include the duplicate key 43 of the member server 32 .

Each piece of duplicated key position information is fragmentary information for calculating the position of the duplicated key in the three duplicated key lists. All three pieces of duplicated key location information are used to calculate the position of any duplicated key. The three duplicated key location information are distributed to different member servers. The duplicated key location information 47 is distributed to the member servers 32 .

Also, the key management server 31 generates three individual key lists and three individual key position information from the three individual keys. Each individual key list includes one individual key, multiple trap keys, and multiple dummy keys. Three separate key lists are distributed to different clerk servers. The individual key list 44 is distributed to the clerk server 35 . This individual key list 44 preferably does not include the individual keys 42 of the member servers 35 .

Each piece of individual key position information is fragmentary information for calculating the position of the individual key in the three individual key lists. All three pieces of individual key location information are used to calculate the location of any individual key. The three individual key locations are distributed to different clerk servers. The individual key location information 45 is distributed to the clerk server 35 .

FIG. 5 is a diagram showing an example of arrangement of key element information in a server device.
The clerk server 35 stores individual key position information 141 and an individual key list 144 . The clerk server 36 stores individual key location information 142 and an individual key list 145 . The clerk server 37 stores individual key position information 143 and an individual key list 146 .

The key management server 31 generates random numbers by the number of clerk servers times the number of individual keys. Here, the key management server 31 generates 3×3=9 random numbers. In the second embodiment, each random number has one digit to simplify the explanation, but each random number may have two or more digits. The key management server 31 assigns three random numbers to each of the three individual keys. The key management server 31 inputs three random numbers into a hash function to calculate the correct position for each individual key.

A hash function is defined, for example, as the sum of even random numbers x the product of odd random numbers. The key management server 31 determines the length of the individual key lists 144, 145, 146, that is, the number of enumerated keys. If the position calculated by the hash function exceeds the length of the individual key lists 144, 145, 146, the key management server 31 may regenerate random numbers. Also, the positions of different individual keys are preferably different. If the positions of different individual keys collide, the key management server 31 may regenerate the random number.

For example, the key management server 31 generates random numbers "1", "2" and "3" for the individual key of the member server 32, generates random numbers "1", "1" and "2" for the individual key for the member server 33, Random numbers “1”, “2”, and “2” are generated for the individual key of the member server 34 . The position of the individual key of the member server 32 is 2×(1×3)=6, the position of the individual key of the member server 33 is 2×(1×1)=2, and the position of the individual key of the member server 34 is (2+2). x1=4.

The key management server 31 generates the individual key position information 143 so as to include the first random number among the three random numbers assigned to each individual key, and generates the individual key position information 141 so as to include the second random number. Then, the individual key position information 142 is generated so as to include the third random number. For example, the individual key position information 143 is "1" "1" "1", the individual key position information 141 is "2" "1" "2", and the individual key position information 142 is "3" "2" "2". be.

The key management server 31 also generates individual key lists 144, 145, and 146 based on the three individual keys and the three correct positions calculated above. For example, individual key list 146 contains the individual key for member server 32 in the correct position #6. Individual key list 144 contains the individual key for member server 33 in the correct position #2. Individual key list 145 contains the individual key for member server 34 in the correct position #4.

Here, in each of the individual key lists 144, 145, and 146, dummy keys are arranged at positions where individual keys are arranged in other individual key lists. Further, each of the individual key lists 144, 145, and 146 arranges the trap key in a position where no individual key is arranged in any of the other individual key lists. For example, the individual key list 146 includes dummy keys at #2 and #4 and trap keys at #1, #3 and #5. The individual key list 144 includes dummy keys in #4 and #6 and trap keys in #1, #3 and #5. The individual key list 145 includes dummy keys in #2 and #6 and trap keys in #1, #3 and #5.

The key management server 31 randomly distributes the individual key location information 141, 142, 143 to the clerk servers 35, 36, 37. The key management server 31 also randomly distributes the individual key lists 144 , 145 , 146 to the clerk servers 35 , 36 , 37 . The key management server 31 does not need to record the shuffle results of the distribution destinations.

The member server 32 stores duplicated key location information 151 and a duplicated key list 154 . Member server 33 stores dual key location information 152 and dual key list 155 . Member server 34 stores dual key location information 153 and dual key list 156 .

The key management server 31 generates random numbers equal to the number of member servers times the number of duplicated keys. Here, the key management server 31 generates 3×3=9 random numbers. The key management server 31 assigns three random numbers to each of the three duplicated keys. The key management server 31 inputs three random numbers into a hash function for each duplicated key to calculate the correct position. The hash function for the duplicate key may be the same as or different from the hash function for the individual key. For example, the hash function for the duplicate key is the sum of even random numbers times the product of odd random numbers, just like the hash function for individual keys.

The key management server 31 determines the lengths of the duplicated key lists 154, 155, and 156. If the position calculated by the hash function exceeds the length of the duplicated key lists 154, 155, 156, the key management server 31 may regenerate the random number. Also, it is preferable that the positions of different duplicated keys are different. If the positions of different duplicated keys collide, the key management server 31 may regenerate the random number.

For example, the key management server 31 generates random numbers “1”, “2”, and “2” for the duplicated key of the member server 32, generates random numbers “3”, “2”, and “1” for the duplicated key of the member server 33, Random numbers "1", "1", and "2" of the duplicated key of the member server 34 are generated. The position of the duplicated key of the member server 32 is (2+2)×1=4, the position of the duplicated key of the member server 33 is 2×(1×3)=6, and the position of the duplicated key of the member server 34 is 2×(1× 1)=2.

Key management server 31 generates duplicated key position information 153 to include the first random number among the three random numbers assigned to each duplicated key, and generates duplicated key position information 151 to include the second random number. and generate duplicate key position information 152 so as to include the third random number. For example, the duplicate key position information 153 is "1" "3" "1", the duplicate key position information 151 is "2" "2" "1", and the duplicate key position information 152 is "2" "1" "2". be.

The key management server 31 also generates duplicate key lists 154, 155, and 156 based on the three duplicate keys and the three correct positions calculated above. For example, the dual key list 156 contains the dual key for member server 32 in the correct position #4. Duplicate key list 154 contains the duplicate key for member server 33 in the correct position #6. Duplicate key list 155 contains the duplicate key for member server 34 at #2 as indicated by the correct location.

Here, each of the duplicated key lists 154, 155, and 156 places a dummy key at the position where the duplicated key is placed in the other duplicated key lists. Further, each of the duplicated key lists 154, 155, and 156 arranges the trap key at a position where no duplicated key is arranged in any of the other duplicated key lists. For example, the duplicate key list 156 includes dummy keys at #2 and #6 and trap keys at #1, #3 and #5. Duplex key list 154 includes dummy keys in #2 and #4 and trap keys in #1, #3 and #5. Duplex key list 155 includes dummy keys in #4 and #6, and trap keys in #1, #3 and #5.

The key management server 31 randomly distributes the duplicated key location information 151, 152, 153 to the member servers 32, 33, 34. Also, the key management server 31 randomly distributes the duplicated key lists 154 , 155 , 156 to the member servers 32 , 33 , 34 . The key management server 31 does not need to record the shuffle results of the distribution destinations.

Next, we will explain the data capsule. The data capsule contains an encrypted database and a database management system (DBMS program) that provides limited access to the database.

FIG. 6 is a block diagram showing an example structure of a data capsule.
Data capsule 130 includes management information file 131 , data file 132 , DBMS program 133 , erasure program 134 and container program 135 . Note that the data file 132 corresponds to the database 13 of the first embodiment. The DBMS program 133 corresponds to the database management program 14 of the first embodiment.

The management information file 131 is a file in which management information used for controlling access to the database is described. The management information file 131 contains the file path of the data file 132 . The management information file 131 also includes user definitions 136 , authority definitions 137 , data structure definitions 138 and procedure definitions 139 .

The user definition 136 indicates users who can access the database. The user may be identified by the user name, the server name or role ID of the server device, or the communication address of the server device. The authority definition 137 indicates the type of data manipulation permitted for each user. For example, whether or not data retrieval, data insertion, data update, and data deletion are allowed in the database is defined. Also, stored procedures that can be executed by each user among the registered stored procedures are specified.

The data structure definition 138 indicates the table structure of the relational database. Although the data capsule 130 uses a relational database, a non-relational database such as a tree-type database or a network-type database may be used.

A procedure definition 139 indicates a stored procedure. A stored procedure is a program describing a series of data processing that is difficult to describe in a single SQL statement. A stored procedure is described using a procedure description language that extends SQL. When a stored procedure call instruction is received instead of an SQL statement, the stored procedure is executed. Appropriate use of stored procedures restricts the data stored in the database itself from being output to the outside of the data capsule 130 .

The management information file 131 is encrypted. The unit of encryption may be coarse granularity such as the entire management information file 131, or fine granularity in which each item of the management information file 131 is a unit such as the user definition 136 and the authority definition 137. FIG.

The data file 132 is a file containing records of relational database tables. Data file 132 is encrypted. The unit of encryption may be coarse granularity, such as the entire data file 132, or fine granularity, such as table units or record units.

The DBMS program 133 is a restricted version of the DBMS program whose functions are restricted compared to normal DBMS programs. The DBMS program 133 does not have the function of changing the management information file 131. FIG. In addition, the DBMS program 133 may not have the function of executing some of the data operations such as data retrieval, data insertion, data update and data deletion, such as data update and data deletion.

The DBMS program 133 provides the user with limited access to the data file 132. The DBMS program 133 receives a request message from the user and, based on the user definition 136 and authority definition 137, confirms that the contents of the request message are within the user's authority. The DBMS program 133 then executes the SQL statement included in the request message or the stored procedure specified by the request message for the relational table included in the data file 132 .

When the data capsule 130 is generated, the management information file 131 and the data file 132 are generated and encrypted using a normal version of the DBMS program whose functions are not restricted. At this time, a user definition 136, an authority definition 137, a data structure definition 138 and a procedure definition 139 suitable for realizing the encryption key recovery flow to be described later are set. After that, the normal version of the DBMS program is replaced with the DBMS program 133 .

The deletion program 134 is a program that deletes the management information file 131 and the data file 132 in order to prevent data leakage according to instructions from the container program 135 . The deletion program 134 first deletes the management information file 131 and then deletes the data file 132 . Deletion of the management information file 131 and the data file 132 is performed by overwriting a specific bit in the storage area in which the management information file 131 and the data file 132 are stored in order to make it unrestorable.

The container program 135 is a representative program for encapsulating the data capsule 130 into a single file. When attempting to start the data capsule 130, the container program 135 is executed first. The container program 135 performs user authentication using a user ID and password when started. The container program 135 may hold account information indicating correspondence between user IDs and correct passwords. If user authentication succeeds, the container program 135 starts the DBMS program 133 .

Also, the container program 135 starts status confirmation to continuously confirm that the data capsule 130 is not being used illegally. When container program 135 detects an event of possible unauthorized use of data capsule 130 , container program 135 decides to invalidate data capsule 130 and invokes erasure program 134 .

For status confirmation, the container program 135 periodically communicates with a monitoring server (not shown) after startup. The monitoring server may be the data encapsulation server or the member server that requested the encryption key. If a communication failure is detected, container program 135 decides to disable data capsule 130 . Also, the container program 135 confirms that the current time has not expired. The container program 135 may hold expiration date information for the data capsule 130 . If the current time has passed the expiration date, the container program 135 decides to invalidate the data capsule 130 .

Also, the container program 135 monitors the result of user authentication for the data capsule 130 to detect unauthorized access. If the results of multiple user authentications correspond to a specific pattern, the container program 135 determines that there is a possibility of unauthorized intrusion and decides to invalidate the data capsule 130 . A pattern of unauthorized intrusion is, for example, that the number of user authentication failures exceeds a threshold within time T1, and that user authentication succeeds within time T2.

When the key verification server 38 outputs an alert, the container program 135 may regard the alert as a failure of user authentication. Also, when the key verification server 38 outputs an alert, the container program 135 may decide to invalidate the data capsule 130 . To do so, for example, container program 135 receives an alert from key verification server 38 . The state confirmation detects the possibility that the data capsule 130 has been transferred to an unauthorized person or that the data capsule 130 has been illegally accessed by an unauthorized person.

FIG. 7 is a diagram showing an example of a table included in the database.
The data file 132 includes a clerk table 161, a member table 162, an encryption key table 163, an individual key position table 164, an individual key table 165, and a dual key position table 166 as relational database tables.

The clerk table 161 and member table 162 are created when the data capsule 130 is generated and are not updated. The encryption key table 163, the individual key position table 164, the individual key table 165, and the duplex key position table 166 are empty when the data capsule 130 is generated. Records are inserted into the individual key position table 164 and the individual key table 165 from the clerk servers 35 , 36 and 37 . Records are inserted from the member servers 32 , 33 , 34 into the encryption key table 163 and the duplicated key position table 166 .

The clerk table 161 is a table that stores identifiers of all clerk servers that have individual key location information and individual key lists. Identifiers of the clerk servers 35 , 36 and 37 are registered in the clerk table 161 . The member table 162 is a table that stores identifiers of all member servers that have dual key location information and a dual key list. Identifiers of the member servers 32 , 33 , 34 are registered in the member table 162 . The identifiers of the member servers 32, 33, 34 and the clerks servers 35, 36, 37 may be server names, role IDs, or server addresses.

The encryption key table 163 is a table that stores the restored encryption key. Any one of the member servers 32 , 33 , 34 inserts the requested encryption key into the encryption key table 163 . Other member servers insert a False record into the encryption key table 163 indicating that the requested encryption key was not found. However, other member servers may not insert records into the encryption key table 163 .

The individual key position table 164 is a table that stores individual key position information. The clerk servers 35 , 36 , 37 insert records into the individual key location table 164 . Each record in the individual key location table 164 includes a clerk identifier and individual key location information. The clerk identifier indicates the clerk server that stores the individual key location information. The individual key position information includes three numerical values corresponding to three individual keys. Based on the individual key position table 164, three indices are calculated that indicate the positions of the three individual keys in the individual key list.

The individual key table 165 is a table that stores individual keys. The clerk servers 35 , 36 , 37 insert records into the individual key table 165 . Each record in the individual key table 165 includes a clerk identifier, member identifier, individual key and target flag. The clerk identifier indicates the clerk server that stores the individual key. The member identifier indicates for which member server the individual key is intended. The target flag indicates whether or not the individual key corresponds to the member server that requested the encryption key this time. The target flag is written by the key management server 31 that has accepted the request for the encryption key.

As will be described later, the key management server 31 requests three individual keys corresponding to three member identifiers from each of the clerk servers 35, 36, and 37. Each clerk server outputs the correct individual key for at most one member identifier, and outputs False for other member identifiers, indicating that no individual key was found. Each clerk server may insert a False record into the individual key table 165 for a member identifier for which an individual key was not found, or may not insert a record into the individual key table 165 .

The duplicate key position table 166 is a table that stores duplicate key position information. Member servers 32 , 33 , 34 insert records into duplicated key location table 166 . Each record in the duplicated key location table 166 includes a member identifier and duplicated key location information. The member identifier indicates the member server that stores the dual key location information. The duplicate key location information contains a single numerical value for the desired duplicate key. Based on the duplicated key position table 166, an index indicating the position of the desired duplicated key in the duplicated key list is calculated.

FIG. 8 is a diagram showing an example of procedure definitions contained in the database.
A stored procedure as described below is registered in the procedure definition 139 . Input, output and processing outline of each stored procedure are described here. Procedure definition 139 actually includes a program written in a procedure description language. Procedure definition 139 includes stored procedures 171-178.

The stored procedure 171 indicates completion of individual key position communication. The stored procedure 171 is called when a record is inserted into the individual key position table 164 . The stored procedure 171 collates the clerk table 161 and the individual key location table 164 to determine whether individual key location information has been received from all clerk servers. The stored procedure 171 outputs True or False indicating the determination result.

The stored procedure 172 indicates individual key position calculation. The stored procedure 172 is called when the stored procedure 171 outputs True. The stored procedure 172 synthesizes the individual key position information contained in the individual key position table 164 and calculates an index indicating the individual key position of each member server. For example, the stored procedure 172 calculates the sum of even numbers times the product of odd numbers for each member server. Stored procedure 172 outputs the calculated individual key position. Note that the logic for calculating the individual key position is hidden in the stored procedure 172 and is not disclosed to the outside.

The stored procedure 173 indicates completion of individual key communication. The stored procedure 173 is called when a record is inserted into the individual key table 165 . Stored procedure 173 also receives a target member identifier indicating the member server that requested the encryption key. The stored procedure 173 collates the clerk table 161 and the individual key table 165 to determine whether the individual key read results have been received from all the clerk servers. The stored procedure 173 outputs True or False indicating the determination result. Also, when the determination result is True, the stored procedure 173 rewrites the target flag corresponding to the target member identifier in the individual key table 165 to True.

The stored procedure 174 indicates individual key output. The stored procedure 174 reads individual keys whose target flag is True from the individual key table 165 . The stored procedure 174 outputs the read individual key. However, the stored procedure 174 may execute specific processing using the individual key instead of outputting the individual key. Also, instead of defining stored procedures 174 , data capsule 130 may allow specific users to retrieve data from individual key table 165 .

The stored procedure 175 indicates completion of duplicate key location communication. The stored procedure 175 is called when a record is inserted into the duplicated key position table 166 . The stored procedure 175 collates the member table 162 and the duplicated key location table 166 to determine whether duplicated key location information has been received from all member servers. The stored procedure 175 outputs True or False indicating the determination result.

The stored procedure 176 indicates duplicate key position calculation. The stored procedure 176 is called when the stored procedure 175 outputs True. The stored procedure 176 synthesizes the duplicated key position information contained in the duplicated key position table 166 and calculates an index indicating the duplicated key position of the target member. For example, stored procedure 176 computes the sum of even times the product of odd. Stored procedure 176 outputs the calculated duplicated key position. Note that the logic for calculating the duplicated key position is hidden in the stored procedure 176 and is not disclosed to the outside.

The stored procedure 177 indicates the completion of encryption key communication. The stored procedure 177 is called when a record is inserted into the encryption key table 163 . The stored procedure 177 collates the member table 162 and the encryption key table 163 to determine whether or not the encryption key reading results have been received from all the member servers. The stored procedure 177 outputs True or False indicating the determination result.

The stored procedure 178 indicates the encryption key output. The stored procedure 178 reads the encryption key from the encryption key table 163 and outputs the read encryption key. However, instead of defining stored procedures 178 , data capsule 130 may allow specific users to retrieve data from encryption key table 163 .

FIG. 9 is a diagram showing an example of authority definitions contained in the database.
The authority definition 137 gives the following access authority to the key management server 31, the member servers 32, 33 and 34 and the clerks servers 35, 36 and 37.

The key management server 31 is permitted to execute stored procedures excluding individual key output and encryption key output, that is, stored procedures 171, 172, 173, 175, 176, and 177. Therefore, the key management server 31 can acquire the individual key position and the duplicate key position from the data capsule 130 . On the other hand, the key management server 31 is prohibited from inserting data into the table and retrieving data from the table.

Clerk servers 35, 36, and 37 are permitted to insert data into tables. On the other hand, clerk servers 35, 36 and 37 are prohibited from retrieving data from tables and executing stored procedures.

　The member servers 32, 33, and 34 are permitted to insert data into the table. Also, the member servers 32, 33, and 34 are permitted to execute the stored procedure 174 indicating individual key output. The member server 32 is also permitted to execute a stored procedure 178 that indicates encryption key output. On the other hand, member servers 32, 33 and 34 are prohibited from retrieving data from tables and executing other stored procedures. However, instead of executing the stored procedure 174, data retrieval from the individual key table 165 may be permitted. Data retrieval from the encryption key table 163 may be permitted instead of executing the stored procedure 178 .

Next, the flow for restoring the encryption key will be described.
FIG. 10 is a diagram showing an example of restoration of an encryption key.
The member server 32 requests the encryption key from the key management server 31 . At this time, the member server 32 transmits the data capsule 130 to the key management server 31 . The key management server 31 activates the DBMS program 133 as a server process and exposes the application interface of the DBMS program 133 to the member servers 32 , 33 , 34 and the clerks servers 35 , 36 , 37 . This allows the member servers 32, 33, 34 and the clerks servers 35, 36, 37 to access the same database.

However, the key management server 31 can also sequentially transmit and retrieve the data capsule 130 between the member servers 32, 33, and 34 and the clerks servers 35, 36, and 37. Also, the key management server 31 may copy the data capsule 130 and transmit it to the member servers 32 , 33 , 34 and the clerks servers 35 , 36 , 37 . In that case, the key management server 31 may use a stored procedure to aggregate the data of the collected duplicates into one data capsule.

The key management server 31 requests the individual key location information from the clerk servers 35, 36, and 37 in parallel. The clerk server 35 inserts the individual key location information 141 into the data capsule 130 . The clerk server 36 inserts the individual key location information 142 into the data capsule 130 . The clerk server 37 inserts the individual key location information 143 into the data capsule 130 .

The key management server 31 executes the stored procedure 172. The stored procedure 172 inputs the first numerical value included in the individual key position information 141, 142, 143 to the hash function to calculate the individual key position of the member server 32. FIG. Also, the stored procedure 172 inputs the second numerical value to the hash function to calculate the individual key position of the member server 33, and inputs the third numerical value to the hash function to calculate the individual key position of the member server 34. . The key management server 31 acquires "6", "2", and "4" as the individual key positions of the member servers 32, 33, and 34 from the stored procedure 172. FIG. At this time, the individual key location information 141 , 142 , 143 and the logic for synthesizing them are protected from the key management server 31 .

The key management server 31 does not know in which clerk server the individual keys of the member servers 32, 33, and 34 reside. Therefore, the key management server 31 designates individual key positions "6", "2", and "4", and requests individual keys from the clerks servers 35, 36, and 37 in parallel.

The clerk server 35 extracts the keys of the individual key positions "6", "2" and "4" from the individual key list 144. The clerk server 35 inquires of the key verification server 38 whether the extracted key is an individual key. Since none of the keys at the individual key positions "6", "2", and "4" are trap keys, the response from the key verification server 38 to the clerk server 35 is not delayed. The clerk server 35 inserts into the data capsule 130 an extraction failure for individual key position "6," an individual key for individual key position "2," and an extraction failure for individual key position "4." do.

Similarly, the clerk server 36 extracts the keys of the individual key positions "6", "2" and "4" from the individual key list 145. Clerk server 36 inserts into data capsule 130 an extraction failure for individual key position "6", an extraction failure for individual key position "2", and an individual key for individual key position "4". do. The clerk server 37 extracts the keys of the individual key positions “6”, “2” and “4” from the individual key list 146 . Clerk server 37 inserts into data capsule 130 an individual key for individual key position "6," an extraction failure for individual key position "2," and an extraction failure for individual key position "4." do.

The key management server 31 specifies the member identifier of the member server 32 and executes the stored procedure 173 . Stored procedure 173 removes extraction failure information from data capsule 130 . This leaves the data capsule 130 with three individual keys corresponding to the member servers 32 , 33 , 34 . The stored procedure 173 marks the individual key corresponding to the member identifier of the member server 32 among the three individual keys. At this time, the individual key is protected from the key management server 31 .

FIG. 11 is a diagram (continued) showing an example of restoration of the encryption key.
The key management server 31 requests the member servers 32, 33, and 34 in parallel for the numerical values related to the member server 32 among the three numerical values included in the duplicated key location information. Member server 32 inserts the first numerical value “2” included in duplicated key location information 151 into data capsule 130 . Member server 33 inserts the first numerical value “2” included in duplicated key location information 152 into data capsule 130 . Member server 34 inserts the first numerical value “1” included in duplicated key location information 153 into data capsule 130 .

At this time, the key management server 31 may specify to the member servers 32, 33, and 34 what numerical value to extract from the duplicated key location information. Also, the duplicated key position information 151, 152, 153 may associate three individual keys with three numerical values. In that case, the key management server 31 requests the member servers 32, 33, and 34 for numerical values corresponding to the marked individual keys. The member servers 32, 33, 34 read the marked individual key from the data capsule 130 and extract the numerical value corresponding to the individual key. Each numerical value of the double key position information may be encrypted with an individual key. In that case, the member servers 32, 33, 34 search for a numerical value that can be decrypted with the read individual key.

The key management server 31 executes the stored procedure 176. The stored procedure 176 inputs the three numerical values collected from the member servers 32 , 33 , 34 into the hash function to calculate the double key position of the member server 32 . The key management server 31 acquires “4” as the duplicate key position of the member server 32 from the stored procedure 176 . At this time, the collected numerical values and logic for synthesizing them are protected from the key management server 31 .

The key management server 31 does not know in which member server the duplicate key of the member server 32 resides. Therefore, the key management server 31 requests the member servers 32, 33, and 34 for the encryption keys in parallel, specifying the duplicated key position "4".

The member server 32 extracts the key in the duplicated key position "4" from the duplicated key list 154 and reads out the marked individual key from the data capsule 130 . The member server 32 inquires of the key verification server 38 whether the extracted key is a duplicate key. Since the key in duplicate key position "4" is not a trap key, the response from key verification server 38 to member server 32 is not delayed. Member server 32 inserts an extraction failure into data capsule 130 .

Similarly, the member server 33 extracts the key in the duplicated key position "4" from the duplicated key list 155 and reads the marked individual key from the data capsule 130. Member server 33 inserts an extraction failure into data capsule 130 . Member server 34 extracts the key in duplicate key position “4” from duplicate key list 156 and reads the marked individual key from data capsule 130 . The member server 33 decrypts the extracted double key with the individual key and inserts the decrypted encryption key into the data capsule 130 .

The key management server 31 executes the stored procedure 177. Stored procedure 177 removes extraction failure information from data capsule 130 . As a result, the encryption key of the member server 32 remains in the data capsule 130 . At this time, the encryption key is protected from the key management server 31 . The key management server 31 transmits the data capsule 130 to the member server 32 . Member server 32 reads the encryption key from data capsule 130 .

Next, functions and processing procedures of the server device will be described.
FIG. 12 is a block diagram showing an example of the software structure of the server device.
The key management server 31 has a key information placement unit 121 and an encryption key restoration unit 122 . The key information allocation unit 121 and the encryption key recovery unit 122 are implemented using, for example, the CPU 101, the communication interface 107, and programs.

The key information placement unit 121 receives the encryption key to be registered from the member servers 32, 33, and 34. The key information placement unit 121 generates an individual key for each member server, encrypts the encryption key with the individual key, and generates a duplicated key. The key information placement unit 121 generates individual key position information, an individual key list, dual key position information and a dual key list based on the individual key, dual key and random number. The key information placement unit 121 transmits the individual key position information and the individual key list to the clerk servers 35, 36, and 37 for storage. Further, the key information placement unit 121 transmits the duplicated key position information and the duplicated key list to the member servers 32, 33, and 34 for storage.

The encryption key recovery unit 122 receives the data capsule 130 from one member server. The encryption key recovery unit 122 inserts the individual key position information from the clark servers 35, 36, and 37 into the data capsule 130, and calculates the individual key position. The encryption key recovery unit 122 causes the clark servers 35 , 36 , 37 to insert the individual key specified by the individual key position into the data capsule 130 . The encryption key recovery unit 122 inserts the duplicated key position information from the member servers 32, 33, and 34 into the data capsule 130, and calculates the duplicated key position. The encryption key recovery unit 122 causes the member servers 32, 33, and 34 to insert into the data capsule 130 the result of decrypting the duplicated key specified by the duplicated key position with the individual key. The encryption key recovery unit 122 then returns the data capsule 130 to the requesting member server.

The member server 32 has a key information storage unit 123 , an encryption key request unit 124 and a key information transmission unit 125 . The key information storage unit 123 is implemented using the RAM or HDD of the member server 32, for example. The encryption key requesting unit 124 and the key information transmitting unit 125 are implemented using, for example, the CPU, communication interface and program of the member server 32 . Member servers 33 and 34 may have modules similar to member server 32 .

The key information storage unit 123 stores key element information distributed from the key management server 31 . The key element information includes dual key location information and a dual key list.
Encryption key requesting unit 124 receives a request for an encryption key from application software. The application software is, for example, database software executed on the member server 32 . The encryption key requesting unit 124 then transmits the data capsule 130 to the key management server 31 . The data capsule 130 may be generated by the member server 32, or the member server 32 may request the generation of the data capsule generation server. The encryption key requesting unit 124 receives the data capsule 130 from the key management server 31 and reads out the encryption key of the member server 32 from the data capsule 130 .

In response to a request from the key management server 31, the key information transmission unit 125 extracts a designated numerical value from the duplicated key position information stored in the key information storage unit 123, and converts the data capsule possessed by the key management server 31. Insert at 130. Further, the key information transmitting unit 125 extracts the key at the specified duplicated key position from the duplicated key list stored in the key information storage unit 123 in response to a request from the key management server 31 . The key information transmission unit 125 inquires of the key verification server 38 about the type of the extracted key. If the key type is not a duplicated key, the key information transmitting unit 125 inserts an extraction failure report into the data capsule 130 of the key management server 31 . When the key type is a duplicated key, the key information transmitting unit 125 inserts the encryption key obtained by decrypting the duplicated key with the individual key into the data capsule 130 possessed by the key management server 31 .

The clerk server 35 has a key information storage unit 126 and a key information transmission unit 127 . The key information storage unit 126 is implemented using the RAM or HDD of the clerk server 35, for example. The key information transmission unit 127 is implemented using, for example, the CPU, communication interface, and program of the clerk server 35 . Clerk servers 36 and 37 may have modules similar to clerk server 35 .

The key information storage unit 126 stores key element information distributed from the key management server 31 . Key element information includes individual key location information and an individual key list.
The key information transmission unit 127 inserts the individual key position information stored in the key information storage unit 126 into the data capsule 130 of the key management server 31 in response to a request from the key management server 31 . Further, the key information transmission unit 127 extracts the key at the designated individual key position from the individual key list stored in the key information storage unit 126 in response to a request from the key management server 31 . The key information transmission unit 127 inquires of the key verification server 38 about the type of the extracted key. If the key type is not an individual key, the key information transmitting unit 127 inserts a report of extraction failure into the data capsule 130 possessed by the key management server 31 . When the key type is an individual key, the key information transmitting unit 127 inserts the individual key into the data capsule 130 of the key management server 31 .

The key verification server 38 has a verification information storage section 128 and a key verification section 129 . The verification information storage unit 128 is implemented using the RAM or HDD of the key verification server 38, for example. The key verification unit 129 is implemented using, for example, the CPU, communication interface, and program of the key verification server 38 . A plurality of key verification servers may exist.

The verification information storage unit 128 stores a determination algorithm for determining whether a key included in the individual key list is an individual key, a dummy key, or a trap key. The verification information storage unit 128 also stores a determination algorithm for determining whether a key included in the duplicated key list is a duplicated key, a dummy key, or a trap key.

The key verification unit 129 determines the type of the received key based on the determination algorithm stored in the verification information storage unit 128 in response to inquiries from the clark servers 35, 36, and 37. If the key type is an individual key, the key verification unit 129 replies to that effect, and if the key type is a dummy key or a trap key, it replies that it is not an individual key. However, if the key type is a trap key, the key verification unit 129 outputs an alert indicating the possibility of unauthorized access, and intentionally delays the reply for a certain period of time after outputting the alert.

Similarly, the key verification unit 129 determines the type of the received key based on the determination algorithm stored in the verification information storage unit 128 in response to inquiries from the member servers 32, 33, and 34. If the key type is a duplicated key, the key verification unit 129 replies to that effect, and if the key type is a dummy key or a trap key, it replies that it is not a duplicated key. However, if the key type is a trap key, the key verification unit 129 outputs an alert indicating the possibility of unauthorized access, and intentionally delays the reply for a certain period of time after outputting the alert.

Regarding the duplicated key, the key verification unit 129 may determine the key type with respect to the bit string before decryption, or may determine the key type with respect to the bit string after decryption. Also, when the key type is a duplicated key, the key verification unit 129 may decrypt the duplicated key into an encryption key.

FIG. 13 is a flow chart showing an example of a procedure for restoring an encryption key.
(S11) The key management server 31 receives a request for an encryption key from the target member server. At this time, the key management server 31 receives the data capsule 130 from the target member server.

(S12) The key management server 31 requests individual key location information from the clerks servers 35, 36, and 37. At this time, the key management server 31 activates the DBMS program 133 of the data capsule 130 and discloses its application interface to the clerk servers 35 , 36 and 37 . This allows the clerks servers 35 , 36 , 37 to send SQL statements and procedure calls to the DBMS program 133 .

(S13) Each of the clerk servers 35, 36 and 37 transmits an SQL statement and inserts its own individual key location information into the data capsule 130. FIG.
(S14) The key management server 31 executes a stored procedure to calculate individual key positions of the member servers 32, 33, and 34 in the data capsule 130. FIG. The key management server 31 receives the individual key positions of the member servers 32 , 33 , 34 from the data capsule 130 .

(S15) The key management server 31 notifies the clerk servers 35, 36, and 37 of the individual key positions of the member servers 32, 33, and 34, respectively.
(S16) Each of the clerk servers 35, 36, and 37 extracts the key at the specified individual key position from the individual key list it owns.

(S17) Each of the clerk servers 35, 36, and 37 requests the key verification server 38 to verify the extracted key. Each of the clerk servers 35, 36, 37 receives a response from the key verification server 38 as to whether or not the extracted key is an individual key.

(S18) Each of the clerk servers 35, 36, and 37 transmits the SQL statement and inserts the extraction result of the individual key into the data capsule 130. FIG.
(S19) The key management server 31 executes the stored procedure to mark the individual key of the target member server included in the data capsule 130. FIG.

FIG. 14 is a flowchart (continued) showing a procedure example of encryption key restoration.
(S21) The key management server 31 requests the member servers 32, 33, and 34 for the numerical values of the target member servers included in the duplicated key location information. At this time, the key management server 31 may request a numerical value of a specific order among the multiple numerical values included in the duplicated key location information, or may request a numerical value associated with the member identifier of the target member server. may Further, the key management server 31 may request a numeric value associated with the marked individual key, or may request a numeric value that can be decrypted with the marked individual key.

(S22) Each of the member servers 32, 33, and 34 transmits an SQL statement and inserts into the data capsule 130 the numeric value of the target member server included in the dual key location information.
(S23) The key management server 31 executes a stored procedure to calculate the dual key position of the target member server in the data capsule 130. FIG. The key management server 31 receives the dual key location of the target member server from the data capsule 130 .

(S24) The key management server 31 notifies the member servers 32, 33, and 34 of the location of the duplicated key of the target member server.
(S25) Each of the member servers 32, 33, and 34 extracts the key at the specified duplicate key position from the duplicate key list it owns.

(S26) Each of the member servers 32, 33, 34 calls the stored procedure of the data capsule 130 to read the marked individual key.
(S27) Each of the member servers 32, 33, and 34 requests the key verification server 38 to verify the extracted key. Each of the member servers 32, 33, and 34 receives a response from the key verification server 38 as to whether or not the extracted key is a duplicated key.

(S28) Each of the member servers 32, 33, and 34 decrypts the duplicated key using the marked individual key when the duplicated key is extracted. Each of the member servers 32 , 33 , 34 transmits an SQL statement and inserts the decryption result of the encryption key into the data capsule 130 .

(S29) The key management server 31 returns the data capsule 130 as a response to the request for the encryption key from the target member server.
As described above, the information processing system of the second embodiment encrypts the encryption key for decrypting the encrypted data, and separates and stores the duplicated key and the individual key for decrypting the duplicated key. . This reduces the risk of leakage of the encryption key. Also, the information processing system randomly distributes the individual key to a plurality of clerk servers, and randomly distributes the duplicate key to a plurality of member servers. This makes it difficult to search for a server device that has the individual key or duplicate key of the target member server, and reduces the possibility that an attacker can acquire a desired encryption key.

In addition, the information processing system stores the individual key and duplicate key mixed with the trap key. This makes it difficult for an attacker who does not know the correct location to evade the trap, making the attack easier to detect. When the trap key is selected, the information processing system outputs an alert indicating the possibility of unauthorized access and delays the response of the server device. This makes it difficult for an attacker to access a large number of server devices in a short period of time, ensuring sufficient time to detect an attack and take countermeasures. In addition, the fact that the trap key was selected is used to determine whether to invalidate the data encapsulation, improving security. In addition, the information processing system distributes fragmentary position information for calculating the correct positions of the individual key and the duplicated key to a plurality of server devices. As a result, the number of server devices that an attacker must intrude to avoid the trap increases, and the time required for the attack increases.

In addition, the information processing system places a dummy key in place of the trap key at a position that is incorrect for one server device but correct for another server device. Thereby, the information processing system can access a plurality of server devices in parallel in valid decryption processing, and can efficiently execute valid decryption processing.

Also, the process of collecting various key element information and restoring the encryption key by the key management server 31 is performed confidentially in the data capsule 130 . The data capsule 130 prohibits the key management server 31 from reading the collected key element information or the encryption key, and conceals the logic for synthesizing the collected key element information from the key management server 31 . As a result, even if an attacker intrudes into the key management server 31 or an administrator of the key management server 31 maliciously attempts to leak information, the encryption key, key element information, or logic is less risk of leakage from Therefore, the security of the encryption key is improved.

Also, when the data capsule 130 detects the possibility of unauthorized use, it automatically deletes the management information and data in the database. This reduces the risk of information leakage even if the key management server 31 leaks the data capsule 130 .

The above merely shows the principle of the present invention. Furthermore, many variations and modifications will occur to those skilled in the art, and the present invention is not limited to the precise construction and applications shown and described above, and all corresponding variations and equivalents are and the equivalents thereof.

10 information processing device 11 storage unit 12 processing unit 13 database 14 database management program 15 procedure 16 key information 21, 22, 23 nodes 24, 25, 26 information

Claims (7)

1. receive a request for key information used to decrypt encrypted data;
   Restoring the key information using a database protected by a database management program that permits the storage of input data and the execution of a procedure that converts the stored input data, and restricts the reading of the stored input data. Acquiring the information in a state saved in the database from a plurality of nodes each having at least one of element information to be used and logic information indicating a conversion method of the element information;
   restoring the key information in the database by executing the procedure on the information stored in the database;
   outputting the database containing the key information in response to the request;
   A control method in which processing is executed by a computer.
2. receiving the request includes a process of acquiring package data including the database management program and the database;
   The output of the database includes a process of outputting the package data,
   The control method according to claim 1.
3. The database management program restricts modification of management information indicating definitions of access privileges of the database and definitions of the procedures.
   The control method according to claim 1.
4. The database management program permits the plurality of nodes to store the input data, permits the computer to execute the procedure, and permits an output destination of the database to extract the restored key information.
   The control method according to claim 1.
5. Restoring the key information generates location information indicating the location of the key information from the saved information, and based on the location information, restores the key information stored in the database from one of the plurality of nodes. including a process of acquiring the key information in a state of
   The control method according to claim 1.
6. a storage unit for storing a database protected by a database management program that permits storage of input data and execution of a procedure that transforms the stored input data, and restricts reading of the stored input data;
   From a plurality of nodes each of which receives a request for key information used to decrypt encrypted data and has at least one of element information used to restore the key information and logic information indicating a conversion method of the element information retrieving the information as it is stored in the database, and executing the procedure on the information stored in the database to restore the key information in the database and respond to the request. and a processing unit that outputs the database containing the key information;
   Information processing device having
7. receive a request for key information used to decrypt encrypted data;
   Restoring the key information using a database protected by a database management program that permits the storage of input data, the execution of a procedure that converts the stored input data, and restricts the reading of the stored input data. Acquiring the information in a state saved in the database from a plurality of nodes each having at least one of element information to be used and logic information indicating a conversion method of the element information;
   restoring the key information in the database by executing the procedure on the information stored in the database;
   outputting the database containing the key information in response to the request;
   A control program that causes a computer to execute a process.

Images