JP5221233B2 - ENCRYPTION SYSTEM, MOBILE TERMINAL, AND ENCRYPTION METHOD - Google Patents

Description

The present invention is an encryption system that holds the encrypted data within a mobile terminal, a contact and encryption methods end mobile terminal.

  Mobile terminals such as PHS (Personal Handyphone System) and mobile phones that are currently in widespread use are becoming more advanced and smaller in size, and most mobile terminals send and receive image data such as still images and moving images. Function is provided. Therefore, anyone can store images and sounds and transmit and receive the images and sounds via wireless without using a special separate device.

  In addition, semiconductor storage media such as USB (Universal Serial Bus) memory and memory cards, HDD (Hard Disk Drive), etc. are becoming smaller and larger in capacity, and large-capacity high-quality images and moving images are also relatively small. Can now be saved.

  By the way, manufacturing factories and research facilities need to store quality control of production lines, research results of advanced technology, etc., and the above portable terminal with high portability should be used as a simple storage device. There is also. Also, such facilities often handle confidential information, and in order to prevent leakage of confidential information, it is important to manage these portable terminals that store confidential information and storage media from which data can be extracted from the portable terminals. ing.

  Therefore, as a data management technique for preventing unauthorized use, a technique has been disclosed that can set the expiration date of digital content and the like so that the target data cannot be accessed after a specified period of time (Patent Literature). 1).

In addition, as a digital data control technology, when information such as digital content at the copy source is updated, a system that updates the information itself by automatically transmitting / receiving differential data or the like via a communication network is lightly loaded. The technology realized by this is also disclosed (Patent Document 2).
Japanese Patent Laid-Open No. 2001-265562 JP 2000-347969 A

  However, it is not feasible to restrict access to data once generated and stored in the mobile terminal. Even if the portable terminal is restricted from being taken out, it can be easily taken out by copying the data to a storage medium before the access is restricted. Furthermore, since the portable terminal is capable of wireless communication, if data is transmitted immediately after imaging, it becomes impossible to specify the leakage destination of confidential information.

  Here, if confidentiality is thoroughly maintained and the functions of the mobile terminal are restricted, the convenience is deteriorated in a regular operation that is not an unauthorized purpose.

  Furthermore, when the access restriction described in Patent Document 1 is performed, it is possible to restrict access to data within a predetermined period, but confidential information such as factories and research facilities must be stored permanently. There are many things, and even if there is a legitimate user who wants to refer to the data after a predetermined period of time, it cannot be accessed. Further, unauthorized access is not restricted within a predetermined period, and the data can be taken out to the outside. Therefore, the confidentiality of data cannot be kept effective.

  Once such intangible electronic data is in an accessible state, it is extremely difficult to completely manage the subsequent state including the above-described prior art. Therefore, it is desirable to add some restrictions before it becomes accessible.

In view of the above problems, while ensuring the convenience of authorized users, the cryptographic system to perform the integrity of the classified information more easily and reliably, the portable terminal end contact and encryption method The purpose is to provide.

  In order to solve the above problems, a typical configuration of the present invention includes an encryption including a mobile terminal, an encryption key generation server that can communicate with the mobile terminal, and a decryption key generation server that can communicate with the mobile terminal. The mobile terminal includes a data acquisition unit that acquires data including at least one of text, sound, or an image, and position specifying information for specifying the position of the mobile terminal when the data is acquired Obtained using the encryption key received from the encryption key generation server, the storage location acquisition unit for acquiring the terminal, the terminal identification information transmission unit for transmitting the terminal identification information for identifying the mobile terminal to the encryption key generation server When detecting an encryption unit for encrypting data, a terminal storage unit for storing the encrypted data in association with the position specifying information, and access to the data in the terminal storage unit, An access position acquisition unit that acquires position specifying information for specifying a device, a position specifying information transmission unit that transmits position specifying information and terminal specifying information at the time of data acquisition and access to a decryption key generation server, and a decryption key A decryption unit for decrypting data acquired using the decryption key received from the generation server; and an access execution unit for executing access to the decrypted data. An encryption key generation unit that generates an encryption key from the information, and an encryption key transmission unit that transmits the generated encryption key to the mobile terminal. When the distance between the information and the location specifying information at the time of access is within a predetermined range, a decryption key generation unit that generates a decryption key and a decryption key that transmits the generated decryption key to the mobile terminal Characterized in that it comprises a key transmission unit.

  In the present invention, the portable terminal stores the data only after the encryption key generation server generates the encryption key and encrypts the data acquired using the encryption key. Therefore, the user can recognize only the encrypted data and cannot refer to the data unless there is a decryption key.

  In addition, the decryption key is issued only when the decryption key generation server determines that the position at the time of data acquisition and access is close, that is, when the data is being accessed near the position where the data was acquired. Therefore, an unauthorized third party who does not know the location where the data was obtained or is not located at that location cannot decrypt the encrypted data, and while maintaining the convenience of legitimate users, It becomes possible to carry out the maintenance of information more easily and reliably.

  Further, the position specifying information may be an absolute position using a GPS (Global Positioning System).

  In the present invention, position specifying information is required to decode data. With such a configuration using GPS, it is possible to easily construct an encryption system at a low cost by using a GPS function provided in advance in the mobile terminal without a new additional circuit.

  Another typical configuration of the present invention is an encryption system including a mobile terminal, an encryption key generation server that can communicate with the mobile terminal, and a decryption key generation server that can communicate with the mobile terminal. The terminal acquires a data acquisition unit that acquires data including at least one of text, sound, or an image, and a storage position acquisition that acquires position specifying information for specifying the position of the mobile terminal when the data is acquired A terminal specifying information transmitting unit for transmitting to the encryption key generating server, terminal specifying information for specifying the mobile terminal and position specifying information at the time of data acquisition, and an encryption key received from the encryption key generating server An encryption unit for encrypting the data acquired by the terminal, a terminal storage unit for storing the encrypted data in association with the absolute position at the time of data reception received from the encryption key generation server, and a terminal An access position acquisition unit that acquires position specifying information for specifying the position of the mobile terminal upon detecting access to data in the storage unit, an absolute position at the time of data acquisition, position specifying information at the time of access, and terminal specifying information To the decryption key generation server, a location specifying information transmission unit, a decryption unit for decrypting data acquired using the decryption key received from the decryption key generation server, and an access for executing access to the decrypted data The encryption key generation server generates an encryption key from the received terminal identification information, and an encryption position deriving section for deriving an absolute position at the time of data acquisition from the position identification information at the time of data acquisition An encryption key generation unit, and an encryption key transmission unit that transmits the generated encryption key and the absolute position to the mobile terminal. A decoding position deriving unit for deriving an absolute position at the time of access from the position specifying information, and a distance between the absolute position at the time of received data acquisition and the absolute position at the time of access derived by the decoding position deriving unit is within a predetermined range, You may provide the decoding key production | generation part which produces | generates a decoding key, and the decoding key transmission part which transmits the produced | generated decoding key to a portable terminal.

  In the present invention, the encryption key generation server performs derivation of the absolute position when the portable terminal stores data. In addition, the decryption key generation server derives the absolute position of the mobile terminal when attempting to access the data. With this configuration, for example, the absolute position when data is stored in the mobile terminal can be stored in the mobile terminal after being encrypted (or encoded) by the encryption key generation server and stored in the terminal storage unit of the mobile terminal It is possible to prevent unauthorized alteration of the absolute position at the time of data acquisition. Further, it is possible to avoid the risk that the absolute position at the time of data acquisition is illegally acquired and the data is directly visited and accessed.

  A typical configuration of the mobile terminal of the present invention is a data acquisition unit that acquires data including at least one of text, sound, or an image, and a position for specifying the position of the mobile terminal when the data is acquired A storage location acquisition unit that acquires location specification information, a terminal specification information transmission unit that transmits terminal specification information that specifies the mobile terminal to an encryption key generation server, and an encryption key generation server that generates based on the terminal specification information An encryption unit that encrypts data acquired using the encrypted encryption key, a terminal storage unit that stores the encrypted data in association with the position specifying information, and detecting access to data in the terminal storage unit An access position acquisition unit that acquires position specifying information for specifying the position of the mobile terminal, and a decoding key for the position specifying information and the terminal specifying information at the time of data acquisition and access Decodes the data acquired by using the decryption key generated based on the position specifying information and the terminal specifying information at the time of data acquisition and access at the time of data acquisition and access by the position specifying information transmitting unit to be transmitted to the generating server You may provide a decoding part and the access execution part which performs the access to the decoded data.

  Another typical configuration according to the present invention is an encryption method including a mobile terminal, an encryption key generation server that can communicate with the mobile terminal, and a decryption key generation server that can communicate with the mobile terminal, The mobile terminal acquires data including at least one of text, sound, or image, acquires position specifying information for specifying the position of the mobile terminal when the data is acquired, and specifies the mobile terminal Terminal identification information to be transmitted to the encryption key generation server, the encryption key generation server generates an encryption key from the received terminal identification information, transmits the generated encryption key to the mobile terminal, , Encrypts the data acquired using the encryption key received from the encryption key generation server, stores the encrypted data in association with the position specifying information, and detects access to the data in the terminal storage unit Then, the position specifying information for specifying the position of the mobile terminal is acquired, and the position specifying information and the terminal specifying information at the time of data acquisition and access are transmitted to the decryption key generation server. When the distance between the received position information at the time of data acquisition and the position specifying information at the time of access is within a predetermined range, a decryption key is generated, and the generated decryption key is transmitted to the mobile terminal. The data acquired using the decryption key received from the generation server is decrypted, and access to the decrypted data is executed.

The components or the descriptions thereof, which correspond to the technical idea in the encryption system described above is applicable to you and encryption methods end the mobile terminal.

  As described above, according to the present invention, it is possible to more easily and reliably maintain confidential information while ensuring user convenience.

  Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. The dimensions, materials, and other specific numerical values shown in the embodiment are merely examples for facilitating understanding of the invention, and do not limit the present invention unless otherwise specified. In the present specification and drawings, elements having substantially the same function and configuration are denoted by the same reference numerals, and redundant description is omitted, and elements not directly related to the present invention are not illustrated. To do.

  A mobile terminal represented by a PHS terminal, a mobile phone, or the like constructs a wireless communication system that performs wireless communication with a base station installed at a predetermined location. In such a wireless communication system, a mobile terminal is provided with an image capturing function for images such as still images and moving images and a function for transmitting and receiving captured data to various servers through a base station.

  Although the portable terminal may be used for acquiring data such as confidential information because of its excellent portability, it is not easy to prevent leakage of the acquired data. In view of this, the present embodiment provides an encryption system that can more easily and reliably maintain confidential information while ensuring the convenience of a legitimate user. Here, in order to facilitate understanding, the entire encryption system will be described, and then specific configurations, an encryption method, and a decryption method of the mobile terminal, the encryption key generation server, and the decryption key generation server will be described.

  In addition, although a PHS terminal is mentioned here as a portable terminal, the present invention is not limited to such a case, and a cellular phone, a notebook personal computer, a PDA (Personal Digital Assistant), a digital camera, a music player, a car navigation system, a portable TV, a game Various electronic devices capable of wireless communication, such as devices, DVD players, and remote controllers, can also be used as portable terminals.

(Encryption system 100)
FIG. 1 is an explanatory diagram showing a schematic connection relationship of the encryption system 100. The encryption system 100 includes a PHS terminal 110, a base station 120, a communication network 130 including an ISDN (Integrated Services Digital Network) line, the Internet, a dedicated line, etc., a relay server 140, and an encryption key generation server. 150 and a decryption key generation server 160.

  In the encryption system 100 of the present embodiment, for example, when a user acquires data using his / her own PHS terminal 110, the acquired data is not held as it is, but can be recognized as data for the first time through encryption. Therefore, the user cannot refer to the data unless there is a decryption key. The decryption key is provided only when a predetermined condition regarding the position to be decrypted is satisfied. Therefore, an unauthorized third party who does not know the condition or cannot satisfy the condition cannot decrypt the encrypted data.

  In the encryption system 100, the encryption key generation server 150 generates an encryption key, and the decryption key generation server 160 generates a decryption key. The PHS terminal 110 accesses the encryption key generation server 150 and the decryption key generation server 160 through the base station 120 and the communication network 130, and maintains the data acquired by itself.

(PHS terminal 110)
A specific configuration of the PHS terminal 110 in the encryption system 100 will be described below.

  2 is a block diagram showing a hardware configuration of the PHS terminal 110, and FIG. 3 is a perspective view showing an appearance of the PHS terminal 110. As shown in FIG. The PHS terminal 110 includes a terminal control unit 200, a terminal storage unit 202, a display unit 204, an operation unit 206, a voice input unit 208, a voice output unit 210, an imaging unit 212, and a terminal wireless communication unit 214.

  The terminal control unit 200 manages and controls the entire PHS terminal 110 by a semiconductor integrated circuit including a central processing unit (CPU). The terminal control unit 200 also performs a call function, a mail transmission / reception function, an imaging function, a music playback function, a Web browsing function, and a TV viewing function using the program stored in the terminal storage unit 202.

  Furthermore, the terminal control unit 200 also functions as a data acquisition unit 250, an encryption unit 252, a decryption unit 254, and an access execution unit 256.

  The data acquisition unit 250 acquires data such as text and memos input from the operation unit 206, audio signals input from the audio input unit 208, or image signals input from the imaging unit 212. The data acquisition unit of the data acquisition unit 250 is not limited to the operation unit 206, the audio input unit 208, and the imaging unit 212 described above, and is generated using an external device such as a digital camera, a digital video camera, or a voice recorder. Data can also be acquired via a USB connection or the like.

  The encryption unit 252 encrypts the data acquired by the data acquisition unit 250 using the encryption key acquired from the encryption key generation server 150. The user cannot access the acquired data until the encryption is completed. In the present embodiment, the encryption method is not limited, and various encryption methods can be applied.

  The decryption unit 254 decrypts the encrypted data requested to be accessed using the decryption key acquired from the decryption key generation server 160.

  The access execution unit 256 executes access to the data decoded by the decoding unit 254. For example, when accessing image data, the decoded image data is displayed on the display unit 204, and the user can edit or delete the image data.

  The terminal storage unit 202 includes a ROM, a RAM, an EEPROM, a nonvolatile RAM, a flash memory, an HDD, and the like. The program and audio data processed by the terminal control unit 200, and further the data encrypted by the encryption unit 252 In addition, the acquisition position table 258 is also stored.

  FIG. 4 is an explanatory diagram for explaining the acquisition position table 258.

  In the acquisition position table 258, the data A and B encrypted by the encryption unit 252 are stored in association with the absolute positions (latitude X1, longitude Y1) and (X2, Y2) at the time of data acquisition.

  Also, the absolute position at the time of data acquisition can be stored in an encrypted state as with the data. By doing so, an unauthorized third party refers to the acquisition position table 258 stored in the terminal storage unit 202 when the PHS terminal 110 is acquired, acquires data at the absolute position, It is possible to avoid tampering the position and acquiring data at an illegal position.

  The terminal storage unit 202 also functions as a temporary storage unit 260. The temporary storage unit 260 temporarily stores the data acquired by the data acquisition unit 250 in an inaccessible state, and after the data has been normally encrypted, the encrypted data is formally stored in the terminal storage unit 202. Remember. Then, the temporary storage unit 260 deletes the data before encryption from its own storage area. In addition, when an operation that does not perform encryption correctly is detected, such as when the power is turned off during encryption, the acquired data is automatically deleted. With this configuration, it is possible to avoid a situation in which a user who tries to acquire data illegally takes out data before encryption.

  The display unit 204 includes a liquid crystal display, an organic EL (Electro Luminescence) display, etc., and is stored in the terminal storage unit 202 or provided from a server (not shown) via the communication network 130, An application GUI (Graphical User Interface) can be displayed.

  The operation unit 206 includes a keyboard, a cross key, a joystick, and the like, and accepts a user operation input. In addition, when the PHS terminal 110 functions as a storage device for data such as text, voice, or images, the storage operation can be performed directly through the operation unit 206.

  The voice input unit 208 includes voice recognition means such as a microphone, and converts a user voice input during a call or the like into an electrical signal that can be processed in the PHS terminal 110.

  The audio output unit 210 is configured with a speaker, and converts the audio signal of the call partner received by the PHS terminal 110 into audio and outputs it. In addition, a ring tone, an operation sound of the operation unit 206, an alarm sound, and the like can be output.

  The imaging unit 212 includes a video device such as a charge coupled device (CCD) or a complementary metal oxide semiconductor (CMOS), and can capture images such as still images and moving images.

  The terminal wireless communication unit 214 performs wireless communication with the base station 120. Examples of such wireless communication include a time division multiple access (TDMA) in which a plurality of time slots obtained by time-dividing frames in the base station 120 are assigned to the channels of the respective PHS terminals 110 to perform communication. It has been adopted.

  The terminal wireless communication unit 214 also functions as a storage location acquisition unit 262, a terminal specification information transmission unit 264, an access location acquisition unit 266, and a location specification information transmission unit 268.

  The storage position acquisition unit 262 acquires position specifying information for specifying the position of the PHS terminal 110 when the data acquisition unit 250 acquires data. Specifically, CSID (base station identification number: Cell Station IDentifier) of a nearby base station, RSSI (Received Signal Strength Indicator) for each base station, and the like are acquired by open search.

  The terminal identification information transmission unit 264 transmits the terminal identification information for identifying the PHS terminal 110 and the position identification information at the time of data acquisition acquired by the storage position acquisition unit 262 to the encryption key generation server 150.

  The access position acquisition unit 266 acquires position specifying information for specifying the position of the PHS terminal 110 when the user tries to access the data of the PHS terminal 110. Similar to the storage location acquisition unit 262, the CSID of the nearby base station, the RSSI for each base station, and the like are acquired by open search. Since the access position acquisition unit 266 has the same function as the storage position acquisition unit 262, it can be configured integrally.

  The location specification information transmission unit 268 includes the absolute location at the time of data acquisition associated with the encrypted data, the location specification information at the time of access acquired by the access location acquisition unit 266, the terminal specification information of the PHS terminal 110, Is transmitted to the decryption key generation server 160.

(Encryption key generation server 150)
Next, the configuration of the encryption key generation server 150 will be described.

  FIG. 5 is a block diagram illustrating a hardware configuration of the encryption key generation server 150. The encryption key generation server 150 includes an encryption storage unit 300, an encryption control unit 302, and an encrypted wired communication unit 304.

  The encryption storage unit 300 includes a ROM, RAM, EEPROM, nonvolatile RAM, flash memory, HDD, and the like, and stores a program processed by the encryption key generation server 150 and a base station position table 350.

  FIG. 6 is an explanatory diagram of the base station position table 350. In the base station position table 350, the CSIDs C and D unique to the base station 120 are associated with the absolute positions (latitude X3, longitude Y3) and (X4, Y4) of the base station 120. By referring to this table, the encryption key generation server 150 can identify the absolute position of the CSID base station 120 acquired by the PHS terminal 110 through an open search.

  It is desirable that the base station position table 350 always has the latest information corresponding to the establishment and removal of the base station 120, but it is not always necessary for the reason to be described later.

  The encryption control unit 302 manages and controls the entire encryption key generation server 150 by a semiconductor integrated circuit including a central processing unit (CPU). Further, the encryption control unit 302 also functions as an encryption position derivation unit 352 and an encryption key generation unit 354.

  The encrypted position deriving unit 352 derives the absolute position from which the PHS terminal 110 has acquired data from the position specifying information (CSID and RSSI) transmitted from the PHS terminal 110. The encrypted position deriving unit 352 refers to the base station position table 350 described above, and specifies the absolute position of the CSID base station 120 transmitted from the PHS terminal 110. Further, since the strength of RSSI is approximately proportional to the distance from the base station 120, the PHS terminal 110 is located on a concentric circle centered on the absolute position of the base station 120, and the position of the PHS terminal 110 at the time of data acquisition is determined. Can be estimated.

  Further, since the PHS terminal 110 acquires and transmits a plurality of CSIDs and RSSIs by open search, the encrypted position deriving unit 352 can derive a plurality of concentric circles centering on the base station 120, and the intersections between the concentric circles are most concentrated. The accuracy of deriving the absolute position can be increased by setting the determined position as the absolute position when the PHS terminal 110 acquires the data.

  As described above, since a plurality of CSIDs are used for deriving the absolute position, the base station position table 350 is not updated to the latest data, and the CSID of the base station 120 that is not stored in the base station position table 350 is stored. Even if it is transmitted, the encrypted position deriving unit 352 can make the encryption system 100 function normally by deriving the absolute position from the other CSID and RSSI without referring to the CSID.

  Similarly, even if the base station 120 of the CSID described in the base station location table 350 is removed, the CSID is not transmitted from the PHS terminal 110, and the location information of the base station 120 is referred to. Therefore, the encryption system 100 is not affected.

  With this configuration, by using a method of deriving the absolute position of the PHS terminal 110 at the time of data acquisition using a plurality of CSIDs and RSSIs, a base station position table of the encryption key generation server 150 and a decryption key generation server 160 described later 350 need not always be the latest information and can be easily managed.

  Furthermore, the encryption key generation server 150 may use the combination of the CSID and RSSI data transmitted from the PHS terminal 110 as it is for position verification without deriving the absolute position at the time of data acquisition. The encryption key generation server 150 does not need to be equipped with a program or circuit for deriving the absolute position, and can realize a simpler and faster system.

  The encrypted wired communication unit 304 is connected to the communication network 130 and receives position specifying information and terminal specifying information from the PHS terminal 110. The encrypted wired communication unit 304 also functions as an encryption key transmission unit 356, and transmits the encryption key generated by the encryption key generation unit to the PHS terminal 110.

(Decryption key generation server 160)
Next, the configuration of the decryption key generation server 160 will be described.

  FIG. 7 is a block diagram showing a hardware configuration of the decryption key generation server 160. The decryption key generation server 160 includes a decryption storage unit 400, a decryption control unit 402, and a decryption wired communication unit 404.

  The decryption storage unit 400 includes a ROM, a RAM, an EEPROM, a nonvolatile RAM, a flash memory, an HDD, and the like, and stores a program processed by the decryption key generation server 160 and a base station position table 350. The base station position table 350 is synchronized with the base station position table 350 of the encryption key generation server 150 at a predetermined frequency.

  The decryption control unit 402 manages and controls the entire decryption key generation server 160 using a semiconductor integrated circuit including a central processing unit (CPU). Further, the decryption control unit 402 also functions as a decryption position derivation unit 452 and a decryption key generation unit 454.

  The decryption position deriving unit 452 refers to the base station position table 350 described above in the same manner as the above-described encrypted position deriving unit 352, and obtains position specifying information such as CSID and RSSI transmitted from the PHS terminal 110. The absolute position where the PHS terminal 110 is going to access data is derived.

  The decryption key generation unit 454 compares the absolute position at the time of accessing the data derived by the decryption position deriving unit 452 with the absolute position at the time of data acquisition transmitted by the PHS terminal 110, and the two points are within a predetermined distance. If, for example, it can be determined that they are in the same company, a decryption key is generated based on the terminal identification information transmitted by the PHS terminal 110. At this time, when the two points are separated from each other by a predetermined distance, it is regarded as unauthorized access, and the decryption key generation unit 454 does not generate a decryption key. Thus, the user cannot access the data unless he / she goes to the position where the data is acquired.

  The decoding wired communication unit 404 is connected to the communication network 130 and receives the absolute position at the time of data acquisition, the position specifying information at the time of data access, and the terminal specifying information from the PHS terminal 110. The decryption wired communication unit 404 also functions as a decryption key transmission unit 456, and transmits the decryption key generated by the decryption key generation unit to the PHS terminal 110.

(Encryption and decryption methods)
FIG. 8 is a sequence diagram showing the flow of the encryption and decryption method according to the present embodiment.

  When the data acquisition unit 250 of the PHS terminal 110 acquires data (S500), the storage location acquisition unit 262 performs an open search and acquires location specifying information (CSID and RSSI) (S502). Then, the acquired position specifying information and terminal specifying information are transmitted to the encryption key generation server 150 (S504).

  The encrypted position deriving unit 352 of the encryption key generation server 150 derives the absolute position from which the data was acquired from the received position specifying information (S506), and generates an encryption key from the terminal specifying information (S508). The generated encryption key and the absolute position at the time of data acquisition are transmitted to the PHS terminal 110 (S510).

  The encryption unit 252 of the PHS terminal 110 encrypts the acquired data using the received encryption key (S512). Then, the encrypted data is stored in the terminal storage unit 202 in association with the absolute position at the time of data acquisition (S514).

  In this way, the PHS terminal 110 causes the encryption key generation server 150 to generate an encryption key based on the terminal identification information that identifies the PHS terminal 110, and after encrypting the target information using the encryption key. Remember. Therefore, the user can recognize only the encrypted data and cannot refer to the data unless there is a decryption key.

  Next, the decoding method will be described. When the PHS terminal 110 detects access to the encrypted data (S600), the PHS terminal 110 obtains position specifying information (CSID and RSSI) by performing an open search (S602), and is further accessed with reference to the acquisition position table 258. The absolute position at the time of data acquisition corresponding to the received data is acquired (S604), and transmitted to the decryption key generation server 160 together with the terminal specifying information and the position specifying information (S606).

  The decryption key generation server 160 derives the absolute position at the time of accessing the data from the received position specifying information (S608), and the two points are located within a predetermined distance compared to the absolute position at the time of receiving the received data. It is determined whether or not (S610). If it is within the predetermined distance, a decryption key is generated from the terminal identification information (S612) and transmitted to the PHS terminal 110 (S614).

  The decryption unit 254 of the PHS terminal 110 decrypts the encrypted data to be accessed using the received decryption key (S616), and the access execution unit 256 accesses the data (S618).

  By using this decryption method, when the decryption key generation server 160 determines that the positions at the time of data acquisition and access are close, that is, the data is accessed near the position where the data was acquired. Since it is issued only when it is determined that the data is acquired, an unauthorized third party who does not know the location where the data was acquired or is not at the location cannot decrypt the encrypted data, It is possible to more easily and reliably perform the maintenance of confidential information while ensuring convenience.

  Unlike the derivation method using GPS described later, the absolute position derivation method using CSID and RSSI described above can be used indoors because it can receive radio waves even if it is blocked by a building. Therefore, this embodiment can be effectively used in facilities that handle confidential information such as factories and laboratories.

(Other embodiments)
In the embodiment described above, CSID and RSSI are used as the position specifying information in order to specify the position at the time of data acquisition and the position at the time of accessing the encrypted data. However, the absolute position at the time of data acquisition or the absolute position at the time of accessing encrypted data may be specified using GPS.

  FIG. 9 is a block diagram illustrating a hardware configuration of the PHS terminal 710 according to another embodiment. Unlike FIG. 2, the PHS terminal 710 includes a GPS antenna unit 712. The GPS antenna unit 712 receives a GPS signal emitted from the GPS satellite 750.

  The storage position acquisition unit 262 acquires a GPS signal from the GPS antenna unit 712 and derives an absolute position instead of acquiring the above-described CSID and RSSI as position specifying information when acquiring data.

  Further, the encrypted position derivation unit 352 in the encryption key generation server 150 and the decryption position derivation unit 452 in the decryption key generation server 160 are unnecessary in this embodiment.

  Hereinafter, the encryption and decryption methods in this embodiment will be described. Differences from the above-described embodiment will be mainly described.

  The PHS terminal 710 receives a GPS signal at the GPS antenna unit 712 at the time of data acquisition, and the storage position acquisition unit 262 derives an absolute position at the time of data acquisition based on the signal. The derived absolute position is not transmitted to the encryption key generation server 150 but is associated with the encrypted data.

  When the user accesses the encrypted data, the access position acquisition unit 266 similarly acquires a GPS signal from the GPS antenna unit 712 and derives the absolute position at the time of access. Decryption key generation server 160 compares the absolute position at the time of data reception and access received from PHS terminal 710, generates a decryption key only when it is within a predetermined distance, and transmits it to PHS terminal 710.

  With this configuration, it is possible to reduce the cost by using a GPS provided in advance in the PHS terminal 110, and furthermore, the encryption key generation server 150 and the decryption key generation server 160 for deriving the absolute position and the PHS terminal Since communication with 710 is not required, a high-speed encryption system can be constructed.

  Furthermore, in order to increase security, the absolute position at the time of data acquisition may be encrypted (encoded) when stored in the acquisition position table 258. By doing so, it is possible to avoid a situation where an unauthorized third party extracts the absolute position at the time of data acquisition from the terminal storage unit and directly visits the location to access the data.

  As mentioned above, although preferred embodiment of this invention was described referring an accompanying drawing, it cannot be overemphasized that this invention is not limited to this embodiment. It will be apparent to those skilled in the art that various changes and modifications can be made within the scope of the claims, and these are naturally within the technical scope of the present invention. Understood.

  For example, in the embodiment described above, the encryption key generation server 150 may not store the absolute position at the time of data acquisition, and the PHS terminal 110 may store the position specifying information in association with the data. In this case, at the time of accessing data, position specifying information that has not been converted to an absolute position is transmitted, and the decryption key generation server 160 derives both absolute positions at the time of data acquisition and access, and performs the above-described position determination. With this configuration, the encryption key generation server 150 does not have to provide an encryption position deriving unit.

  Also, the encryption key generation server 150 and the decryption key generation server 160 can be formed integrally, and the functions of both servers can be realized in the same server. With this configuration, a common circuit and data can be shared, so that cost can be reduced.

  Note that each step in the encryption method of the present specification does not necessarily have to be processed in time series in the order described as a sequence diagram, but is performed in parallel or individually (for example, parallel processing or object processing). May be included.

The present invention is an encryption system that holds the encrypted data in the portable terminal can be utilized to contact and encryption methods end mobile terminal.

It is explanatory drawing which showed the rough connection relation of the encryption system. It is the block diagram which showed the hardware constitutions of the PHS terminal. It is the perspective view which showed the external appearance of the PHS terminal. It is explanatory drawing of the acquisition position table which linked | related encrypted data and the absolute position at the time of the data acquisition. It is the block diagram which showed the hardware constitutions of the encryption key production | generation server. It is explanatory drawing of a base station position table. It is the block diagram which showed the hardware constitutions of the decoding key production | generation server. It is the sequence diagram which showed the flow of the encryption and decoding method concerning this embodiment. It is the block diagram which showed the hardware constitutions of the PHS terminal in other embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 ... Encryption system 110 ... PHS terminal 150 ... Encryption key generation server 160 ... Decryption key generation server 202 ... Terminal storage part 250 ... Data acquisition part 252 ... Encryption part 254 ... Decryption part 256 ... Access execution part 258 ... Acquisition position Table 262 ... Storage location acquisition unit 264 ... Terminal identification information transmission unit 266 ... Access location acquisition unit 268 ... Location identification information transmission unit 352 ... Encryption position derivation unit 354 ... Encryption key generation unit 356 ... Encryption key transmission unit 452 ... Decryption position derivation unit 454 ... Decryption key generation unit 456 ... Decryption key transmission unit

Claims (5)

An encryption system including a mobile terminal, an encryption key generation server that can communicate with the mobile terminal, and a decryption key generation server that can communicate with the mobile terminal,
The portable terminal is
A data acquisition unit for acquiring data including at least one of text, sound, or images;
A storage position acquisition unit for acquiring position specifying information for specifying the position of the mobile terminal when the data is acquired;
A terminal specifying information transmitting unit for transmitting terminal specifying information for specifying the portable terminal to the encryption key generation server;
An encryption unit for encrypting the acquired data using an encryption key received from the encryption key generation server;
A terminal storage unit that stores encrypted data in association with the position specifying information;
Upon detecting access to the data in the terminal storage unit, an access position acquisition unit that acquires position specifying information for specifying the position of the mobile terminal;
A position specifying information transmitting unit for transmitting the position specifying information at the time of data acquisition and access and the terminal specifying information to the decryption key generation server;
A decryption unit that decrypts the acquired data using the decryption key received from the decryption key generation server;
An access execution unit for executing access to the decrypted data;
With
The encryption key generation server
An encryption key generation unit for generating an encryption key from the received terminal identification information;
An encryption key transmitter for transmitting the generated encryption key to the mobile terminal;
With
The decryption key generation server
If the distance between the received position information at the time of data acquisition and the position specifying information at the time of access is within a predetermined range, a decryption key generation unit that generates a decryption key;
A decryption key transmitter for transmitting the generated decryption key to the mobile terminal;
An encryption system comprising:   The encryption system according to claim 1, wherein the position specifying information is an absolute position using GPS. An encryption system including a mobile terminal, an encryption key generation server that can communicate with the mobile terminal, and a decryption key generation server that can communicate with the mobile terminal,
The portable terminal is
A data acquisition unit for acquiring data including at least one of text, sound, or images;
A storage position acquisition unit for acquiring position specifying information for specifying the position of the mobile terminal when the data is acquired;
A terminal specifying information transmitting unit for transmitting the terminal specifying information for specifying the portable terminal and the position specifying information at the time of data acquisition to the encryption key generation server;
An encryption unit for encrypting the acquired data using an encryption key received from the encryption key generation server;
A terminal storage unit that stores the encrypted data in association with the absolute position at the time of data acquisition received from the encryption key generation server;
Upon detecting access to the data in the terminal storage unit, an access position acquisition unit that acquires position specifying information for specifying the position of the mobile terminal;
A position specifying information transmitting unit that transmits the absolute position at the time of data acquisition, the position specifying information at the time of access, and the terminal specifying information to the decryption key generation server;
A decryption unit that decrypts the acquired data using the decryption key received from the decryption key generation server;
An access execution unit for executing access to the decrypted data;
With
The encryption key generation server
An encrypted position deriving unit for deriving an absolute position at the time of data acquisition from the position specifying information at the time of data acquisition;
An encryption key generation unit for generating an encryption key from the received terminal identification information;
An encryption key transmitter for transmitting the generated encryption key and the absolute position to the mobile terminal;
With
The decryption key generation server
A decoding position deriving unit for deriving an absolute position at the time of access from the position specifying information at the time of access;
When the distance between the received absolute position at the time of data acquisition and the absolute position at the time of access derived by the decryption position deriving unit is within a predetermined range, a decryption key generating unit for generating a decryption key;
A decryption key transmitter for transmitting the generated decryption key to the mobile terminal;
An encryption system comprising: A data acquisition unit for acquiring data including at least one of text, sound, or images;
A storage position acquisition unit for acquiring position specifying information for specifying the position of the mobile terminal when the data is acquired;
A terminal specifying information transmitting unit for transmitting terminal specifying information for specifying the portable terminal to the encryption key generation server;
An encryption unit that encrypts the acquired data using an encryption key generated based on the terminal identification information in an encryption key generation server;
A terminal storage unit that stores encrypted data in association with the position specifying information;
Upon detecting access to the data in the terminal storage unit, an access position acquisition unit that acquires position specifying information for specifying the position of the mobile terminal;
A position specifying information transmitting unit for transmitting the position specifying information at the time of data acquisition and access and the terminal specifying information to the decryption key generation server;
A decryption unit for decrypting the acquired data using a decryption key generated based on the position specifying information and the terminal specifying information at the time of data acquisition and access at the decryption key generation server;
An access execution unit for executing access to the decrypted data;
A portable terminal comprising: An encryption method including a mobile terminal, an encryption key generation server that can communicate with the mobile terminal, and a decryption key generation server that can communicate with the mobile terminal,
The portable terminal is
Retrieve data containing at least one of text, audio, or images,
Obtaining position specifying information for specifying the position of the mobile terminal when the data is acquired;
Transmitting terminal specifying information for specifying the mobile terminal to the encryption key generation server;
The encryption key generation server
Generate an encryption key from the received terminal identification information,
Sending the generated encryption key to the mobile terminal;
The portable terminal is
Encrypting the acquired data using an encryption key received from the encryption key generation server;
Storing the encrypted data in association with the location information,
Upon detecting access to the data in the terminal storage unit, obtain position specifying information for specifying the position of the mobile terminal,
Transmitting the position specifying information and the terminal specifying information at the time of data acquisition and access to the decryption key generation server;
The decryption key generation server
When the distance between the received position information at the time of data acquisition and the position specifying information at the time of access falls within a predetermined range, a decryption key is generated,
Sending the generated decryption key to the mobile terminal;
The portable terminal is
Decrypting the acquired data using the decryption key received from the decryption key generation server;
An encryption method characterized by causing access to the decrypted data.

Images