JP4778798B2 - Data management device - Google Patents

Description

  The present invention relates to a technique for safely storing electronic data.

  2. Description of the Related Art Conventionally, electronic data management systems that store electronic data in a server connected via a network and retrieve the data from the server as needed are known. In such a system, in order to increase the security of electronic data, the server holds the electronic data encrypted.

  Accordingly, an object of the present invention is to improve security against leakage of electronic data.

  According to an embodiment of the present invention, a data management device for encrypting and storing a data block includes a first storage unit that stores a first key, the data block, a unique key corresponding to the data block, and a second key A first receiving means for receiving the input, a means for generating an encryption key based on the unique key, and a data block corresponding to the unique key received by the first receiving means with the generated encryption key. A first encryption unit for encrypting and erasing the data block; a second encryption unit for encrypting the encryption key with the second key; and a second encryption unit for erasing the encryption key; The third encryption means for encrypting with the first key stored in the first storage means and erasing the second key, and the encryption with the first encryption means Provided that the data blocks, the encryption key encrypted by the second encryption means, second storage means for storing a second key encrypted with the third encryption means. The encrypted data block is stored in the second storage means in association with the encrypted encryption key.

  In a preferred embodiment, the second storage means may further store the unique key. In this case, the unique key is stored in association with the encrypted data block or the encrypted encryption key.

  In a preferred embodiment, the first receiving unit receives a plurality of data blocks and a plurality of unique keys respectively associated with the data blocks, and the encryption key generating unit receives the plurality of unique keys. And generating a plurality of encryption keys, wherein the first encryption means encrypts each data block with a corresponding encryption key, and the second encryption means encrypts each encryption key and The encryption keys may be erased, and the second storage means may store a plurality of encrypted data blocks in association with the corresponding encrypted encryption keys. .

  In a preferred embodiment, the plurality of data blocks are grouped in advance into a plurality of groups, and the first storage means stores a plurality of first keys different for each group, Group identification that identifies one group from among the plurality of groups based on the unique key or the second key received by the receiving means, and obtains the first key corresponding to the specified group from the first storage means Means may further be provided. In this case, the third encryption means encrypts using the first key acquired by the group determination means.

  In a preferred embodiment, the plurality of data blocks may be grouped in advance into a plurality of groups, and the first storage unit may store a plurality of first keys different for each group. In this case, the first key stored in the first storage means includes a first decryption means for decrypting the encrypted second key stored in the second storage means, and one unique key. An acquisition request received by the second receiving means by a second receiving means for receiving an acquisition request for requesting acquisition of a data block corresponding to the unique key and a second key decrypted by the first decrypting means. A second decryption unit for decrypting the encrypted encryption key corresponding to the unique key included in the first key, and a second decryption unit for decrypting the encrypted data block with the encryption key decrypted by the second decryption unit. A first decoding unit that identifies one group from the plurality of groups based on a unique key included in the acquisition request received by the third decryption unit and the second reception unit, and that corresponds to the identified group; Further comprising a group determination unit configured to acquire over from the first storage means. The first decryption unit may decrypt the first key acquired by the group determination unit.

  A first decryption means for decrypting an encrypted second key stored in the second storage means with a first key stored in the first storage means; Included in the acquisition request received by the second receiving means by the second receiving means for receiving an acquisition request for requesting acquisition of the data block corresponding to the key and the second key decrypted by the first decrypting means. Second decryption means for decrypting the encrypted encryption key corresponding to the unique key, and third decryption means for decrypting the encrypted data block with the encryption key decrypted by the second decryption means And a means for outputting the data block decoded by the third decoding means as a response to the acquisition request.

  In a preferred embodiment, the first decryption means for decrypting the encrypted second key stored in the second storage means with the first key stored in the first storage means, and one unique The second accepting unit accepts the second accepting unit for accepting an acquisition request for obtaining the data block corresponding to the unique key, and the second key decrypted by the first decrypting unit. A second decryption unit for decrypting the encrypted encryption key corresponding to the unique key included in the obtained acquisition request, and the encrypted data block with the encryption key decrypted by the second decryption unit. Third decoding means for decoding and means for outputting the data block decoded by the third decoding means as a response to the acquisition request may be further provided. The plurality of data blocks are grouped into a plurality of groups in advance, and the first storage unit stores a plurality of first keys different for each group, and the second receiving unit stores Group discriminating means for identifying one group from the plurality of groups based on a unique key included in the received acquisition request and acquiring a first key corresponding to the identified group from the first storage means; You may make it prepare. In this case, the first decryption means decrypts using the first key acquired by the group discrimination means.

  Hereinafter, a data management system according to an embodiment of the present invention will be described with reference to the drawings.

  FIG. 1 shows an overall configuration of a data management system according to the present embodiment.

  The system includes a center server 1 that manages data, a first key storage server 3 that stores a first key for encryption, and a user terminal 5.

  The center server 1, the first key storage server 3, and the user terminal 5 are all configured by, for example, a general-purpose computer system, and individual components or functions in the servers 1, 3 and the user terminal 5 described below. Is realized, for example, by executing a computer program.

  The center server 1 manages various blocked electronic data such as a user's confidential data file. For example, the center server 1 receives a registration request for each user's data file from a plurality of user terminals 5 and stores the encrypted data file. Then, when an acquisition request for a data file encrypted and held is received from any user terminal 5, the data file is decrypted and provided. The data file acquisition request can be made from the same user terminal 5 as the user terminal 5 that made the data file registration request, or can be made from a different user terminal 5.

  The data files that are encrypted and saved include, for example, a document file created with a word processor, a file for presentation, a file such as a drawing drawn with a draw tool, or an image file such as a photo, and a PDF file thereof. It may be.

  FIG. 2 shows a functional configuration of the center server 1.

  The center server 1 includes three cryptographic processing units (first cryptographic processing unit 11, second cryptographic processing unit 12, and third cryptographic processing unit 13) and three decryption processing units (first decryption processing unit 21, second decryption processing unit 13). A processing unit 22, a third decryption processing unit 23), a data storage unit 15 that stores encrypted data, a group determination unit 17, and a network interface 19.

  The network interface 19 performs data input / output with the user terminal 5.

  For example, the network interface 19 receives a data file registration request from the user terminal 5. In addition to the data file 100, the registration request includes a unique key 200 associated with the data file 100 and a second key 300 of the group to which the data file belongs.

  Further, the network interface 19 receives a data file acquisition request from the user terminal 5. This acquisition request includes the unique key 200 corresponding to the data file 100 that the user wants to retrieve. The network interface 19 transmits the decrypted data file 100 to the user terminal 5 as a response to the data file acquisition request.

  Here, the grouping of the data file 100 will be described. In the present embodiment, the data file 100 can be managed by being grouped into a plurality of groups. Each group is assigned a first key 400 and a second key 300 for each group.

  Therefore, the group determination unit 17 specifies the group to which the unique key 200 or the second key 300 belongs. Then, the group determination unit 17 acquires the first key of the identified group from the storage unit 31 of the first key storage server 3.

  The first encryption processing unit 11 encrypts the data file 100 with a predetermined encryption key 205 corresponding to the data file 100. The encryption key 205 is generated by the first encryption processing unit 11 converting the unique key 200 based on a predetermined rule. The encryption key 205 may be generated, for example, by adding a random number with a predetermined number of digits to the unique key 200 or using a predetermined conversion table. In addition, you may utilize the unique key 200 itself instead of the encryption key 205 for encryption of a 1st encryption process part.

  The data file 150 encrypted by the first encryption processing unit 11 is stored in the data storage unit 15. On the other hand, the data file 100 before encryption is erased and is not held in the center server 1.

  The second encryption processing unit 12 encrypts the encryption key 205 with the second key 300 of the group to which the unique key 200 corresponding to the encryption key 205 belongs, and stores the encrypted encryption key 250 in the data storage unit 15. . When this encryption is completed, the encryption key 205 before encryption is erased and is not held in the center server 1.

  Here, in the data storage unit 15, the encrypted encryption key 250 is stored in association with the unique key 200 before encryption. Further, the encrypted encryption key 250 is stored in association with the encrypted data file 150 obtained by encrypting the data file 100 corresponding to the unique key 200 before encryption.

  The third encryption processing unit 13 encrypts the second key 300 with the first key 400 and stores it in the data storage unit 15. When this encryption is completed, the second key 300 before encryption is erased and is not held in the center server 1.

  The first key 400 used for encryption by the third encryption processing unit 13 is acquired by the group determination unit 17 from the first key storage server 3, and corresponds to the group to which the second key 300 to be encrypted belongs. To do.

  By the processing of the first to third encryption processing units 11 to 13, the data storage unit 15 stores the encrypted data file 150 and the encrypted encryption key 250 (for encrypting the encrypted data file 150). The encrypted encryption key 205 used) and the encrypted second key 350 (encrypted second key 300 used for encrypting the encrypted encryption key 250) are stored. The

  On the other hand, the encryption key and the data file 100 and the second key 300 before being encrypted included in the data file registration request are not held in the center server 1. Further, the first key 400 is managed separately from the data storage unit 15. As a result, even if the stored contents of the data storage unit 15 are leaked, it is difficult to decrypt the data file 100.

  The first decryption processing unit 21 decrypts the encrypted second key 350 stored in the data storage unit 15 with the first key 400 of the first key storage server 3. Here, the first key 400 used for decryption is the first key 400 acquired by the group determination unit 17 based on the unique key 220 included in the data file acquisition request, and the group to which the data file related to the data file acquisition request belongs. It corresponds to.

  The third decryption processing unit 23 uses the encryption key 205 decrypted by the second decryption processing unit 22 to decrypt the encrypted data file 150 stored in association with the data storage unit 15 before decryption. . The data file 110 obtained by decryption is transmitted to the user terminal 5 via the network interface 19.

  FIG. 3 is a flowchart showing a processing procedure of the center server 1 when a data file registration request is received from the user terminal 5.

  First, when the network interface 19 receives a registration request for a data file, the first encryption processing unit 11 uses the encryption key 205 obtained by converting the unique key 200 included in the registration request to store the data file 100 included in the registration request. Encryption is performed (S11). When the encryption of the data file 100 is completed, the first encryption processing unit 11 erases the data file 100 before encryption.

  Next, the second encryption processing unit 12 encrypts the encryption key 205 used for encrypting the data file 100 with the second key 300 included in the registration request (S12). When the encryption of the encryption key 205 is completed, the second encryption processing unit 12 erases the encryption key 205 before encryption.

  Then, the encrypted data file 150, the encrypted encryption key 205, and the unique key 200 are associated with each other and stored in the data storage unit 15 (S13).

  Based on the second key 300 or the unique key 200 included in the registration request, the group determination unit 17 identifies the group to which these groups belong, and the first key 400 of the identified group is obtained from the first key storage server 3. Obtain (S14).

  The third encryption processing unit 13 encrypts the second key 300 used for encrypting the unique key 200 with the first key 400 acquired in the above process (S15). When the encryption of the second key 300 is completed, the third encryption processing unit 13 erases the second key 300 before encryption.

  Then, the encrypted second key 350 is stored in the data storage unit 15 (S16).

  As a result, the registration of the data file is completed, and the data file is held in the encrypted state in the center server 1 with high security strength.

  FIG. 4 is a flowchart showing a processing procedure of the center server 1 when a data file acquisition request is received from the user terminal 5.

  First, when the network interface 19 receives a data file acquisition request, the group determination unit 17 specifies a group to which the unique key 220 belongs based on the unique key 220 included in the acquisition request. The first key 400 is acquired from the first key storage server 3 (S21).

  The first decryption processing unit 21 decrypts the encrypted second key 350 of the same group based on the first key 400 acquired here (S22).

  Based on the decrypted second key 310, the second decryption processing unit 22 decrypts the encrypted encryption key 250 stored in association with the unique key 220 included in the data file acquisition request. (S23).

  Then, the encrypted data file 150 associated with the data storage unit 15 before the decrypted encryption key 205 is decrypted is decrypted with the encryption key 205 decrypted in step S23 (S24).

  The decrypted data file 110 is transmitted to the user terminal 5 (S25).

  The above-described embodiments of the present invention are examples for explaining the present invention, and are not intended to limit the scope of the present invention only to those embodiments. Those skilled in the art can implement the present invention in various other modes without departing from the gist of the present invention.

  For example, the above-described first key storage server does not necessarily have to be a server. For example, the first key storage server is a portable storage medium that stores the first key, and is connected to the center server when performing encryption processing. It may be a thing. Furthermore, the first key is not necessarily stored in the storage medium, and may be input by an administrator or the like as necessary.

1 shows an overall configuration of a data management system according to an embodiment of the present invention. The function structure of the center server 1 is shown. It is a flowchart which shows the process sequence when the registration request of a data file is received. It is a flowchart which shows the process sequence when the acquisition request of a data file is received.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Center server 3 1st key storage server 5 User terminal 11, 12, 13 Encryption processing part 15 Data storage part 17 Group determination part 19 Network interface 21, 22, 23 Decryption processing part

Claims (8)

A data management device for encrypting and storing data blocks ,
First receiving means for receiving input of the data block, a unique key corresponding to the data block, and a second key from a terminal device ;
Obtaining means for obtaining a first key from an external device different from the terminal device;
Means for generating an encryption key based on the unique key;
A first encryption unit for encrypting a data block corresponding to the unique key received by the first reception unit with the generated encryption key and erasing the data block;
A second encryption means for encrypting the encryption key with the second key and erasing the encryption key;
A third encryption means for encrypting the second key with the first key obtained by the obtaining means and erasing the second key;
The data block encrypted by the first encryption means, the encryption key encrypted by the second encryption means, and the second key encrypted by the third encryption means are stored. Second storage means,
The data management apparatus, wherein the encrypted data block is stored in the second storage unit in association with the encrypted encryption key. The second storage means further stores the unique key,
2. The data management apparatus according to claim 1, wherein the unique key is stored in association with the encrypted data block or the encrypted encryption key. The first receiving means receives a plurality of data blocks and a plurality of unique keys respectively associated with the data blocks,
The encryption key generation means generates a plurality of encryption keys based on the plurality of unique keys,
The first encryption means encrypts each data block with a corresponding encryption key,
The second encryption means encrypts each encryption key and erases each unencrypted encryption key;
The data according to claim 1 or 2, wherein the second storage means stores a plurality of encrypted data blocks in association with corresponding encrypted encryption keys. Management device. The plurality of data blocks are previously grouped into a plurality of groups, and a different first key is set for each group ,
Further comprising a group discriminator Ru JP Teisu one group from the plurality of groups based on the unique key or the second key the first reception unit receives,
The acquisition means acquires a first key corresponding to the group specified by the group determination means,
4. The data management according to claim 3, wherein the third encryption unit encrypts using the first key acquired by the acquisition unit and corresponding to the group specified by the group determination unit. apparatus. First decryption means for decrypting the encrypted second key stored in the second storage means with the first key obtained by the obtaining means ;
A second accepting unit that accepts an acquisition request that includes one unique key and requests acquisition of a data block corresponding to the unique key;
Second decryption means for decrypting an encrypted encryption key corresponding to the unique key included in the acquisition request received by the second reception means with the second key decrypted by the first decryption means; ,
Third decryption means for decrypting the encrypted data block with the encryption key decrypted by the second decryption means;
The data management apparatus according to claim 1, further comprising means for outputting the data block decoded by the third decoding means as a response to the acquisition request. The plurality of data blocks are previously grouped into a plurality of groups, and a different first key is set for each group ,
First decryption means for decrypting the encrypted second key stored in the second storage means with the first key obtained by the obtaining means ;
A second accepting unit that accepts an acquisition request that includes one unique key and requests acquisition of a data block corresponding to the unique key;
Second decryption means for decrypting an encrypted encryption key corresponding to the unique key included in the acquisition request received by the second reception means with the second key decrypted by the first decryption means; ,
Third decryption means for decrypting the encrypted data block with the encryption key decrypted by the second decryption means;
Additionally and a group discriminator Ru JP Teisu one group from the plurality of groups based on the unique key the second receiving unit is included in the acquisition request received,
The acquisition means acquires a first key corresponding to the group specified by the group determination means,
Said first decoding means, the acquisition means has acquired, the data management system of claim 3, wherein the decoding by using the first key that corresponds to the group identified by the group discriminator. A data management method by a computer that encrypts and stores data blocks ,
Computer
Receiving a data block, a unique key corresponding to the data block, and a second input from the terminal device ;
Obtaining a first key from an external device different from the terminal device;
Generating an encryption key based on the unique key;
Encrypting the data block with the encryption key and erasing the unencrypted data block according to the encryption; and
Encrypting the encryption key with the second key and erasing the encryption key;
Encrypting the second key with the acquired first key and erasing the second key before encryption;
Storing the encrypted data block, the encrypted encryption key, and the encrypted second key in a second storage means,
In the step of storing in the second storage means,
The data management method, wherein the encrypted data block is stored in the second storage means in association with an encrypted encryption key. A computer program for encrypting and storing a plurality of data blocks,
When executed on a computer ,
Receiving a data block, a unique key corresponding to the data block, and a second input from the terminal device ;
Obtaining a first key from an external device different from the terminal device;
Generating an encryption key based on the unique key;
Encrypting the data block with the encryption key and erasing the unencrypted data block according to the encryption; and
Encrypting the encryption key with the second key and erasing the encryption key;
Encrypting the second key with the acquired first key and erasing the second key before encryption;
The step of storing the encrypted data block, the encrypted encryption key, and the encrypted second key in a second storage means is performed by the computer,
In the step of storing in the second storage means,
The computer program, wherein the encrypted data block is stored in the second storage means in association with an encrypted encryption key.

Images