JP5984560B2 - Access control system - Google Patents

Description

  The present invention relates to an access control system that permits access to data of an e-mail sender only for a recipient designated as an e-mail destination.

  Conventionally, Patent Document 1 proposes a personal information management system that discloses personal information of an e-mail sender to an e-mail recipient. This personal information management system includes a transmitting terminal that transmits electronic mail, an incoming terminal that receives electronic mail, and a personal information management server that registers personal information of the sender. The sending terminal sets a password for the personal information of the caller and registers it in the personal information management server in advance. When the personal information is disclosed to the callee, the sending terminal writes the password in an e-mail and sends it to the receiving terminal. The receiving terminal presents the password entered in the received e-mail to the personal information management server and requests acquisition of the personal information of the sender. When the password set in the caller's personal information matches the password presented from the receiving terminal, the personal information management server transmits the caller's personal information to the receiving terminal.

JP-A-2005-51475

  The personal information management system described in Patent Document 1 can disclose the sender's personal information to the recipient. However, when the callee transfers the e-mail received from the calling terminal to a third party, the third party who has received the transferred e-mail can also refer to the caller's personal information. For this reason, the personal information management system described in Patent Document 1 discloses personal information to those who are not intended by the caller, in this case, the recipient of the transferred e-mail.

  Therefore, an object of the present invention is to provide an access control system that publishes sender data by limiting the range intended by the sender of the email, that is, the user who directly received the email.

In order to solve such a problem, the present invention is an access control system that permits access to data of a sender of an electronic mail limited to a recipient designated by the sender as a destination of the electronic mail. Access that has signed the e-mail destination e-mail address using the storage unit that stores the data corresponding to the e-mail address and the first electronic certificate issued to the sender who set the e-mail address of the sender A communication unit that receives a publishing request including the right file and the e-mail address of the publishing requester, a signature verifying unit that performs signature verification of the access right file and determines whether or not the verification is successful, And when the destination email address matches the email address of the requester, the email included in the first electronic certificate To allow access to the data corresponding to the address, if they do not match provides an access control system including a data server having access control means for disallowed.
With such a configuration, the present invention can permit access to data with high security only for a user who directly receives an e-mail.

  Preferably, the publishing request is signed using a second electronic certificate issued to the publishing requester who has set the e-mail address of the publishing requester. If both the verification of the signature by the second electronic certificate and the verification of the signature of the access right file are successful, it is determined that the verification is successful. With this configuration, the disclosure requester can be confirmed with higher security.

  More preferably, the access right file includes the data ID for specifying the data signed using the first electronic certificate, and the access control means permits access to the data specified by the data ID. Thus, even when there is a plurality of data that cannot be identified only by the sender's e-mail address, it can be identified and disclosed by the data ID.

  In addition, the access control system stores in advance a first electronic certificate issued to a sender who has set the sender's email address, and uses the first electronic certificate when creating an email. An access right file generating means for generating an access right file by signing the destination e-mail address of the e-mail, and an e-mail means for transmitting the e-mail to the destination e-mail address with the created access right file attached It is preferable to have a first communication device having With this configuration, the data server receives the publication request including the access right file created in the first communication device, and sends the data to the data limited to the user of the e-mail destination e-mail address described in the access right file. Allow access.

  In addition, the access control system stores in advance the second electronic certificate issued to the public requester who sets the public requester's e-mail address, and receives the e-mail attached with the access right file. Publication request generating means for generating a publication request for signing an access right file using the second electronic certificate when requesting publication of data, and data for acquiring the data by sending the publication request to the data server It is preferable to have a second communication device having acquisition means. With this configuration, the data server receives a publishing request including the access right file from the second communication device, and accesses the data only to users of the destination e-mail address of the e-mail described in the access right file. To give permission.

  The access control system according to the present invention has an effect that the data of the sender can be disclosed to the users who have directly received the e-mail.

It is a figure which shows the network system structure containing the access control system by one Embodiment of this invention. It is a functional block diagram of the communication apparatus which transmits / receives an electronic mail. It is a schematic diagram which shows the file format example of an electronic certificate. It is a schematic diagram which shows the file format example of an access right file. It is a schematic diagram which shows the data format example of the electronic mail with a S / MIME signature. It is a schematic diagram which shows the data format example of a public request. It is a flowchart of the email transmission process in a communication apparatus. It is a flowchart of the data browsing process in a communication apparatus. It is a functional block diagram of a data server. It is a schematic diagram which shows the example of a data table. It is a flowchart of the access control process by a data server. It is a sequence diagram explaining the whole operation | movement of an access control system.

Hereinafter, an access control system according to an embodiment of the present invention will be described with reference to the drawings.
FIG. 1 is a diagram showing a network system configuration including an access control system according to an embodiment of the present invention. As shown in FIG. 1, in the network system 1, three communication devices 2 and a data server 3 are connected via a network 4.
The communication device 2 is a terminal that can send and receive electronic mail via the network 4. It also has a function for accessing and referring to the data server 3 for data related to the sender of the received electronic mail.
In the present embodiment, each of the three communication devices 2 includes a communication device 2-S that receives the e-mail and a communication device 2-FR that receives the e-mail. Since the communication terminal 2-FR plays a role as a transfer mail receiving terminal that receives the transferred electronic mail, it is given a distinctive code.
The data server 3 stores data related to the sender in advance, controls access to the data using an access right file, and provides the data.
The network 4 is a network configured by the Internet / intranet or the like.

  The configuration of the communication device 2 will be described in detail with reference to FIG. Since the communication devices 2-S, 2-R, and 2-FR have basically the same configuration, the communication device 2 will be described as a representative with reference to the drawings. Each communication device 2 stores an electronic certificate 100, which will be described later, issued to each user. The communication device 2 includes a communication unit 21, a display unit 22, an operation unit 23, a storage unit 24, and a control unit 25.

  The communication unit 21 includes an interface circuit for connecting the communication device 2 to the network 4 and its driver software. And the communication part 21 transmits / receives the email 300 via a mail server (not shown) according to control of the control part 25. FIG. In addition, the communication unit 21 transmits a disclosure request 400 requesting the data 503 to the data server 3, and as a result, receives the data 503 or a rejection notification and passes it to the control unit 25.

  The display unit 22 includes a display device such as a liquid crystal display or an organic EL display, and displays a creation screen for the email 300, a content display screen for the email 300, a display screen for data 503, and the like.

The operation unit 23 is an operation interface for a user of the communication device 2 to operate the communication device 2. The operation unit 23 includes input devices such as a keyboard and a numeric keypad, receives various operations from the user, and outputs signals corresponding to these operations to the control unit 25.
In addition, you may comprise the display part 22 and the operation part 23 integrally with a touchscreen display. In that case, the function of the operation unit 23 can be realized by displaying a keyboard screen for the user to input various operations on the touch panel display. The operation unit 23 outputs signals corresponding to the operations to the control unit 25 when the user operates the keyboard screen.

  The storage unit 24 includes at least one of a semiconductor memory, a magnetic recording medium and its access device, and an optical recording medium and its access device. The storage unit 24 stores a computer program, various parameters, data, and the like for controlling the communication device 2. In addition, the storage unit 24 stores the electronic certificate 100 issued from a certificate authority (not shown) with the user of the communication device 2 as the owner.

  Here, the file format of the electronic certificate 100 will be described with reference to FIG. The electronic certificate 100 has a file format conforming to, for example, PKCS (Public-Key Cryptography Standards) # 12, and includes a private key 110 of the owner of the electronic certificate 100 and a public key certificate 120. The owner's private key 110 is protected by a password so that a person other than the owner cannot use it. The public key certificate 120 proves the public key 121 and its owner. For example, the ITU-T PKI standard X. 509. The public key certificate 120 includes a public key 121 that is paired with the private key 110 of the owner, an owner name 122, an owner e-mail address 123 that is identification information for identifying the owner, and a public key certificate 120. It includes the name 124 of the issued certificate authority, certificate validity period 125, serial number 126, and the like. The public key certificate 120 is issued in advance by a certificate authority that is a third-party certificate authority.

  Returning to FIG. 2, the control unit 25 includes one or a plurality of processors and their peripheral circuits. The control unit 25 performs transmission processing for the email 300 and reception processing for the email 300. The control unit 25 includes an electronic mail unit 251 and a transmission plug-in and a reception plug-in that support the function of the electronic mail unit 251 as functional modules implemented by software operating on the processor. The transmission plug-in includes an access right file generation unit 252 and an S / MIME signature unit 253. The reception plug-in includes an S / MIME verification unit 254, a public request generation unit 255, and a data acquisition unit 256. Note that these units included in the control unit 25 may be configured by independent integrated circuits, firmware, a microprocessor, and the like.

  The e-mail means 251 creates an e-mail 300 including a body 303 of the e-mail 300 input by the sender from the operation unit 23, a destination e-mail address 302 of the e-mail 300, various attached files, and the like via the communication unit 21. The mail software is a so-called mail software that has a transmission function for transmitting the electronic mail 300 and a reception function for receiving and displaying the electronic mail 300 via the communication unit 21 in cooperation with various plug-in software. The email 300 will be described later with reference to FIG.

  The access right file generation unit 252 is activated by the transmission operation of the electronic mail 300 by the sender, and generates the access right file 200. Specifically, the data disclosure URL 303 a included in the body 303 of the email 300 created by the email means 251 and the destination email address 302 included in the header of the email 300 are extracted. The data disclosure URL 303a is a URL obtained by concatenating the address of the data server 3 that stores the data 503 and the data ID 502 that identifies the data 503. Using the extracted data public URL 303a and the destination mail address 302 as signatures, the sender uses the electronic certificate 100 of the sender in the storage unit 24 to sign, and the signature data of the access right file 200 is combined with the public key certificate 120 in the signature value. 203 is generated. Then, the access right file generation unit 252 generates the access right file 200 including the data disclosure URL 303a, the destination mail address 302, and the access right file signature data 203. Then, the access right file generation unit 252 attaches the access right file 200 related to the electronic mail 300. In this embodiment, the data disclosure URL 303a is described in the access right file 200, but may be omitted if there is a method for notifying the recipient of the electronic mail 300 of the data disclosure URL 303a.

  Here, the file format of the access right file 200 will be described with reference to FIG. The access right file 200 includes a data disclosure URL 201, a destination mail address 202, and access right file signature data 203. The data disclosure URL 201 is a data disclosure URL 303a extracted from the body of the e-mail. The destination mail address 202 is the destination mail address 302 extracted from the header of the electronic mail 300. The access right file signature data 203 includes a signature value 203a based on the sender's electronic certificate 100, a signature attribute 203b, and a sender's public key certificate 203c. The signature value 203 a by the electronic certificate 100 is a value obtained by encrypting the hash value of the data disclosure URL 201 and the destination mail address 202 to be signed with the private key 110 described in the sender's electronic certificate 100. The signature attribute 203b includes a signing time. The sender's public key certificate 203c is the public key certificate 120 described with reference to FIG.

  Returning to FIG. 2, the S / MIME signing means 253 is activated by a transmission operation of the e-mail 300 by the sender, and transmits via the communication unit 21 in accordance with the S / MIME (Secure Multipurpose Internet Mail Extensions) standard. The e-mail 300 in the immediately previous state is signed using the sender's electronic certificate 100.

Here, with reference to FIG. 5, the data format of the e-mail 300 signed in accordance with the S / MIME standard will be described. The e-mail 300 has a data format composed of a source e-mail address 301, a destination e-mail address 302, a body 303, an attached file access right file 200, and S / MIME signature data 304.
The sender email address 301 is set by extracting the owner email address 123 in the electronic certificate 100. The sender email address 301 may be set manually by the sender, but in this case, a match with the owner email address 123 is confirmed. It becomes a condition.
The destination mail address 302 is set when the sender inputs or selects an e-mail address of an arbitrary mail destination.
In the signature according to the S / MIME standard, the body 303 of the e-mail 300 and the access right file 200 that is an attached file are to be signed. The S / MIME signature value is a value obtained by encrypting the hash value to be signed by S / MIME with the private key 110 described in the electronic certificate 100 of the sender. The S / MIME signature value and the sender's public key certificate 120 are added to the footer portion of the e-mail 300 as S / MIME signature data 304, and the S / MIME signature data 304 is an attached file of the e-mail 300. Treated as a kind.
The body text 303 of the e-mail 300 includes a data disclosure URL 303 a that is a URL of a web page that discloses sender data 503 registered in advance in the data server 3. The data disclosure URL 303a is composed of, for example, an address of the data server 3 and a data ID 502 for identifying the data 503. In the present embodiment, the data disclosure URL 303 a is stored in advance in the storage unit 24, and is selected and input from the storage unit 24 when the sender inputs the text 303. Note that the sender may manually input the text 303 from the operation unit 23. In the present embodiment, the data disclosure URL 303a is described in the text 303, but the present invention is not limited to this, and any method may be adopted as long as it can be transmitted to the recipient of the e-mail.

  Returning to FIG. 2, the S / MIME verification unit 254, which is a part of the reception plug-in, is activated when an operation for displaying the e-mail 300 is performed from the operation unit 23, and the e-mail 300 signed in accordance with the S / MIME standard. The S / MIME signature data 304 is used for verification. As a result, it is confirmed whether the body 303 of the e-mail 300 and the attached access right file 200 have been altered during transmission or whether the sender of the e-mail 300 has been impersonated.

  The publication request generation unit 255 is activated by an operation for requesting publication of the data 503 of the electronic mail 300 received by the recipient from the operation unit 23, and creates a publication request 400 for requesting publication of the data 503. That is, the access right file 200 attached to the received e-mail 300 is signed using the recipient's electronic certificate 100 to generate the signature data 401, and includes the access right file 200 and the generated signature data 401. A publication request 400 is generated.

  Here, the data format of the publication request 400 will be described with reference to FIG. The publication request 400 includes an access right file 200 and signature data 401 signed with the access right file 200 using the electronic certificate 100. The signature data 401 of the public request 400 includes a signature value 401a based on the electronic certificate 100, a signature attribute 401b, and a public key certificate 401c. The signature value 401 a is a value obtained by encrypting the hash value of the entire access right file 200 to be signed with the private key 110 described in the electronic certificate 100. The signature attribute 401b includes a signing time. The public key certificate 401c is the public key certificate 120 described with reference to FIG.

  Returning to FIG. 2, the data acquisition unit 256 is activated together with the public request generation unit 255 when the user performs a data acquisition operation for requesting data disclosure from the operation unit 23, and the public request generation unit 255 generates the public request. 400 is transmitted to the data server 3 via the communication unit 21 and the network 4 to acquire and display data. Specifically, when the user performs an operation of selecting the data disclosure URL 303 a described in the text 303 of the e-mail 300 from the operation unit 23, the data that is the storage destination of the data 503 via the communication unit 21 and the network 4. The server 3 is accessed and a publication request 400 is transmitted. Then, the data server 3 performs an access control process, which will be described later, using the disclosure request 400, and if permitted, receives the data 503 and displays it on the display unit 22. In addition, when the result of the access control in the data server 3 is refusal, the fact is received and displayed.

  In this embodiment, when accessing the data server 3, the data disclosure URL 303 a described in the text 303 of the e-mail 300 is selected, but the present invention is not limited to this. The access button may be prepared in advance and selected. Further, when the data disclosure URL is obtained by another method that does not include the data disclosure URL 303a in the text, the data disclosure URL may be manually input from another input screen.

  Next, the processing flow of the communication device 2 will be described with reference to FIGS. 7 and 8. The transmission process, reception process, and data reference process of the e-mail 300 will be described in this order.

FIG. 7 shows a flow of processing for transmitting the e-mail 300. This process starts when the e-mail means 251 is activated and an operation for starting e-mail creation is input through the operation unit 23.
First, in step S301, the e-mail means 251 sets the destination e-mail address 302, which is the e-mail address of the transmission destination specified by the sender from the operation unit 23, and the body 303 in the data format of the e-mail 300. The data disclosure URL 303 a included in the text 303 is input by the user selecting the data disclosure URL 303 a stored in the storage unit 24 using the operation unit 23.
Next, the electronic mail unit 251 determines whether or not the sender's electronic certificate 100 is stored in the storage unit 24 (step S302). When the sender's electronic certificate 100 is stored in the storage unit 24 (step S302—Yes), the sender's electronic certificate 100 is described in the public key certificate 120 of the sender's electronic certificate 100 as the sender email address 301 of the email 300. The e-mail address 123 thus set is set as the sender e-mail address 301 in the data format of the e-mail 300 (step S303).

Next, the e-mail unit 251 calls the access right file generation unit 252 to generate the access right file 200. Specifically, the data disclosure URL 303 a is extracted from the body 303 set in the data format of the e-mail 300 being created, and is set as the data disclosure URL 201 in the file format of the access right file 200. Also, the destination mail address 302 set in the data format of the e-mail 300 being created is extracted and set as the destination mail address 202 in the file format of the access right file 200 (step S304). Then, the signature data 203 of the access right file 200 is generated by signing the data disclosure URL 201 and the destination mail address 202 using the electronic certificate 100 of the storage unit 24 as a signature target, and set to the file format of the access right file 200. . Here, the signature data 203 of the access right file 200 includes a signature value 203a based on an electronic certificate and a signature attribute 203b. Further, the public key certificate 120 included in the electronic certificate 100 is set in the public key certificate 203c in the file format of the access right file 200, and the access right file 200 is generated (step S305). Then, the access right file generation unit 252 attaches the generated access right file 200 as an attached file in the data format of the electronic mail 300 being created (step S306).
Next, the e-mail means 251 calls the S / MIME signature means 253, and the S / MIME signature means 253 targets the e-mail 300 being created with the access right file 200 attached in accordance with the S / MIME standard. The S / MIME signature data 304 is created by signing using the electronic certificate 100 of the storage unit 24, and set in the footer part of the e-mail 300 being created (step S307).
Then, the e-mail means 251 transmits the e-mail 300 with the access right file 200 attached and the S / MIME signature data 304 to the destination e-mail address 302 via the communication unit 21 (step S308). Then, a series of e-mail transmission processing steps is completed. Although not described in the flow for simplification, if the data disclosure URL 303a cannot be extracted in step S304, that fact is displayed on the display unit 22, and the series of processing steps is terminated. In step S305 and step S307, when signing using the electronic certificate 100 of the storage unit 24, the sender makes a mistake in the password on the protection password input screen of the private key 110, or a timeout occurs while waiting for input. If the signature process fails due to the above, a message to that effect is displayed on the display unit 22 and the series of process steps is terminated.

  On the other hand, if the sender's electronic certificate 100 is not stored in the storage unit 24 in step S302 (step S302-No), the email means 251 sends the sender as the sender email address 301 of the created email 300. Sets an e-mail address in use, that is, a standard transmission source e-mail address preset in the e-mail means 251 (step S309), transmits an e-mail 300 (step S308), and transmits a series of e-mails. The process step ends. That is, when the sender's electronic certificate 100 is not stored, the access right file is not attached to the e-mail, and the signature by S / MIME is not performed.

By the way, the case where the sender does not create a new e-mail 300 but transfers the received e-mail 300 will be described. In such a case, the flow of FIG. 7 is applied in a state where the body 303 of the received e-mail 300 is cited as the body of the forwarded mail and the access right file 200 attached to the received e-mail 300 is an attached file. The At this time, the access right file 200 is newly created by the sender, but the access right file 200 of the received e-mail 300 is aliased, and the second access right file 200 is attached. / MIME is signed and a forwarded mail is created.
As a method of creating a transfer mail by a method different from the present embodiment, there is a case where the received electronic mail 300 itself is transferred in the form of an attached file. Even in this case, if the data disclosure URL 303a is described in the body 303 of the forwarded mail by the sender, the flow of FIG. 7 is applied. That is, the newly created access right file 200 and the received e-mail 300 are attached with the S / MIME signature.

  Next, a process for displaying the received electronic mail 300 will be described. First, the e-mail unit 251 starts processing when the received e-mail 300 is selected by the operation of the recipient via the operation unit 23 and an instruction to display the contents of the e-mail 300 is acquired. The presence / absence of the S / MIME signature data 304 of the received e-mail 300 is determined. If the S / MIME signature data 304 is present, the S / MIME verification unit 254 verifies the S / MIME signature data 304 of the e-mail 300 and displays the result on the display unit 22. Since the details of the verification method are general methods, description thereof is omitted here. If there is no S / MIME signature data 304, the e-mail means 251 displays the content of the e-mail 300 on the display unit 22 as it is.

Next, a flow of processing for acquiring the sender data 503 of the electronic mail 300 indicated by the received electronic mail 300 will be described with reference to FIG. Assume that the electronic mail means 251 is activated and one electronic mail 300 is selected. When the e-mail 300 is selected by the recipient, the e-mail unit 251 activates the S / MIME verification unit 254, and the S / MIME verification unit 254 performs the S / MIME signature data of the e-mail 300. 304 is verified. If the verification result of the S / MIME signature data 304 is a verification failure, a message to that effect may be displayed and the series of processing in FIG. 8 may not be performed.
In step S401, the electronic mail unit 251, the public request generation unit 255, and the data acquisition unit 256 cooperate with each other by selecting the data public URL 303a described in the text 303 of the electronic mail 300 according to the operation of the recipient. Processing for requesting the disclosure of data 503 is started.
In step S <b> 402, the electronic mail unit 251 determines whether or not the recipient's electronic certificate 100 is stored in the storage unit 24. When the electronic certificate 100 of the recipient is stored in the storage unit 24 (step S402—Yes), the public request generation unit 255 adds the electronic certificate of the storage unit 24 to the access right file 200 attached to the e-mail 300. The signature data 401 of the publication request signed using the certificate 100 is generated (step S403). Next, the publication request generation unit 255 creates a publication request 400 including the access right file 200 and the signature data 401 of the created publication request, and the data acquisition unit 256 receives the publication request 400 via the communication unit 21. It is transmitted to the data server 3 indicated by the data disclosure URL 303a operated by the user (step S404). Then, it waits for a response to the disclosure request 400 from the data server 3 (step S405). Specifically, the data acquisition unit 256 starts a timer (not shown) after transmission, polls a response to the publication request 400 from the data server 3, and receives a response from the data server 3 to the publication request 400. (Step S405-Yes), the data acquisition unit 256 determines whether or not the data 503 has been received (Step S407). When the data 503 is received (step S407-Yes), the data acquisition unit 256 displays the received data 503 on the display unit 22 (step S408), and ends a series of processing steps. On the other hand, if the data 503 is not received, that is, if a rejection notification is received (step S407-No), the data acquisition unit 256 displays on the display unit 22 that the data 503 could not be acquired (step S409), The process step ends.

When the response to the disclosure request 400 from the data server 3 is not received in step S405 (step S405-No), the data acquisition unit 256 confirms whether a predetermined time has not elapsed by the timer (step S406). ), If the predetermined time has not yet elapsed (step S406—No), the process returns to step S405. If the predetermined time has already elapsed (step S406—Yes), the display unit 22 displays that the publication request 400 has timed out (step S410), and the series of processing steps ends.
If the recipient's electronic certificate 100 is not stored in the storage unit 24 in step S402 (No in step S402), the publication request generation unit 255 displays on the display unit 22 that the publication request 400 cannot be created. (Step S411), a series of processing steps is completed.
In step S403, when signing using the electronic certificate 100 in the storage unit 24, the recipient may make a mistake by entering a wrong password on the input screen for the protection password of the private key 110, or may time out. If the process fails, a message to that effect is displayed on the display unit 22 and the series of process steps is terminated. Needless to say, if the access right file 200 is not attached to the e-mail 300, there is no signature target in the first place, and the signature processing fails in step S403.

Next, the configuration of the data server 3 will be described with reference to FIG.
The data server 3 is a server that stores user data. Further, when the data server 3 receives the disclosure request 400 for requesting the disclosure of the data 503 from the communication device 2, the data server 3 determines whether or not the user of the communication device 2 is a user permitted to view the data 503. The data 503 is transmitted to the communication device 2 only when the user is determined and authorized. The data server 3 includes a communication unit 31, a storage unit 32, and a control unit 33.

  The communication unit 31 includes an interface circuit for connecting the data server 3 to the network 4 and its driver software. The communication unit 31 receives the publishing request 400 from the communication device 2 via the network 4 and passes it to the control unit 33, and sends data 503 or a rejection notification as a response to the publishing request 400 via the network 4 according to the control of the control unit 33. To the communication device 2.

  The storage unit 32 includes a semiconductor memory, a magnetic recording medium and its access device, an optical recording medium and its access device. The storage unit 32 stores a computer program for controlling the data server 3, various parameters, data, and the like. In addition, the storage unit 32 stores a data table 500 in which user data 503 is stored in association with the user's email address 501 and data ID 502.

  FIG. 10 shows the data table 500. In the data table 500, the e-mail address 501, the data ID 502, the data 503, and the access count 504 are stored in association with each other. In the present embodiment, an e-mail address 123 used by the user described in the user's public key certificate 100 is stored as the e-mail address 501. Further, the file name of the data 503 is stored as the data ID 502, and arbitrary data such as the user's name, music data, and diary is stored in advance as the data 503. The access count 504 stores the number of times the data server 3 has read the data 503 and transmitted it to the communication device 2. Note that the data ID 502 may be omitted if the user's e-mail address 501 and the data ID 502 always correspond one-to-one.

  The control unit 33 has one or a plurality of processors and their peripheral circuits. Then, the control unit 33 performs an access control process for the data 503 disclosure request 400. The control unit 33 includes an access control unit 331 and a signature verification unit 332 as functional modules implemented by software that operates on the processor. Note that these units included in the control unit 33 may be configured by independent integrated circuits, firmware, a microprocessor, and the like.

  When the access control unit 331 receives the publication request 400 via the communication unit 31, in cooperation with the signature verification unit 332, the access control unit 331 determines whether the user of the communication device 2 is a user permitted to view the data 503. If it is determined that the user is permitted to browse, the data 503 is transmitted to the communication device 2, and if the user of the communication device 2 is not permitted to view the data 503, a rejection notice is transmitted from the communication unit 31. It is means for transmitting to the communication device 2 via the network 4.

  The signature verification unit 332 performs signature verification of the publication request 400 and signature verification of the access right file 200 included in the publication request 400 based on the signature verification request from the access control unit 331.

  Next, access control processing by the access control means 331 in the data server 3 will be described in detail with reference to the flowchart of FIG. The process of FIG. 11 starts when the data server 3 receives a request for access to the data disclosure URL 303a from the communication device 2.

  The access control unit 331 determines whether or not the disclosure request 400 is included in the access request (step S501). Here, when the disclosure request 400 is not included in the access request (step S501-No), the access control unit 331 determines that the access is inappropriate and there is no access authority (step S502).

On the other hand, when the publication request 400 is received (step S501-Yes), the access control unit 331 causes the signature verification unit 332 to verify the signature data 401 of the publication request (step S503). In other words, this verification confirms the user who has requested the disclosure of the data 503 and ensures that the access right file 200 included in the disclosure request 400 has not been tampered with. Specifically, the signature verification unit 332 reads the signature value 401a based on the electronic certificate and the public key 121 of the public key certificate 401c (120) from the signature data 401 of the public request shown in FIG. The signature value 401a based on the electronic certificate is decrypted to obtain a hash value. Further, the signature verification unit 332 calculates the hash value of the access right file 200 that is the signature target of the signature data 401 of the publication request. The signature verification unit 332 compares the hash value obtained from the signature value with the hash value calculated from the signature target, and determines that the access right file 200 is not falsified if they match. Further, the signature verification unit 332 determines whether the public key certificate 401c of the signature data 401 of the public request is valid, the validity period 125 of the certificate described in the public key certificate 401c, and the name 124 of the certificate authority. It is determined by checking whether the public key certificate 401c has been revoked before the validity period based on the electronic certificate revocation information acquired from the certificate authority described in FIG. By using the public key certificate 401c, the user who has requested the disclosure can be confirmed using the e-mail address 123 of the owner.
Here, the electronic certificate revocation information indicates whether each electronic certificate issued by the certification authority that issued the electronic certificate has been revoked within the validity period, that is, whether or not the electronic certificate is valid. It is something to manage. The electronic certificate revocation information includes the serial number 126 of the public key certificate revoked within the validity period of the certificate and the date and time of revocation. This electronic certificate revocation information is periodically updated by a certificate authority and supplied in response to a request from a communication device or the like that performs signature verification.
The signature verification unit 332 determines that the verification is successful if the access right file 200 is not falsified and the public key certificate 203c is valid, and otherwise determines that the verification fails, and outputs the determination result to the access control unit 331. To do. Note that although the security is slightly lowered, it may be determined that the verification is successful if it is verified that the access right file 200 has not been falsified.

  In step S504, the access control unit 331 determines whether the verification of the signature data 401 of the publication request has been successful. Here, when the verification of the signature data 401 of the publication request has failed (No in step S504), the access control unit 331 determines that there is no access authority due to the signature verification failure of the publication request (step S502).

On the other hand, when the verification of the signature data 401 of the publication request is successful (step S504—Yes), the access control unit 331 causes the signature verification unit 332 to verify the access right file signature data 203 (step S505). That is, such verification can confirm the transmission source mail address 301 of the electronic mail 300 and guarantee that the destination mail address 302 of the electronic mail 300 has not been falsified. Then, it can be ensured that the source mail address 301 and the destination mail address 302 of the e-mail 300 are firmly connected. Specifically, the signature verification unit 332 reads the signature value 203a by the electronic certificate and the public key 121 of the public key certificate 203c (120) from the access right file signature data 203 of the access right file 200 of FIG. The signature value 203a based on the electronic certificate is decrypted using the public key 121 to obtain a hash value. Further, the signature verification unit 322 calculates the data disclosure URL 201 of the access right file signature data 203 and the hash value of the destination mail address 202.
Then, a hash value obtained by decrypting the signature value 203 a of the access right file signature data 203 using the electronic certificate, a hash value calculated from the data disclosure URL 201 and the destination e-mail address 202 that are the signature target of the access right file signature data 203. And compare. If they match, it is guaranteed that the access right file 200 generated by the sender of the e-mail 300, that is, the destination mail address 202 and the data disclosure URL 201 included in the access right file 200 are not falsified. Furthermore, the signature verification unit 332 determines whether the public key certificate 203c of the access right file signature data 203 is valid, the validity period 125 of the certificate described in the public key certificate 203c, and the name 124 of the certificate authority. Whether or not the public key certificate 203c has been revoked before the validity period is determined based on the electronic certificate revocation information acquired from the certificate authority described in (1).
If the public key certificate 203c is valid, the e-mail address 123 of the owner of the public key certificate 120 can be used to confirm that the sender of the e-mail 300 has signed.
The signature verification unit 332 determines that the verification of the access right file signature data 203 is successful if there is no falsification in the data disclosure URL 201 and the destination mail address 202 to be signed and the public key certificate 203c is valid, and otherwise. It is determined that the verification has failed, and the determination result is output to the access control means 331.

Then, the access control means 331 determines whether or not the access right file signature data 203 has been successfully verified (step S506). Here, when the verification of the access right file signature data 203 fails (step S506-No), the access control means 331 determines that there is no access authority due to the signature verification failure of the publication request (step S502).
On the other hand, if the verification of the signature of the access right file signature data 203 is successful (step S506-Yes), the process proceeds to step S507.

  In step S507, the access control unit 331 compares the destination email address 202 described in the access right file 200 with the owner's email address 123 in the public key certificate 401c included in the signature data 401 of the publication request. . Here, if the destination mail address 202 described in the access right file 200 does not match the owner's e-mail address 123 (No in step S508), the access control means 331 determines that there is no access right (step S508). S502). In this way, the presence / absence of access authority can be determined by the received publication request 400 without registering in advance information for permitting access by the data server 3.

  On the other hand, when the destination email address 202 described in the access right file 200 matches the owner's email address 123 in the public key certificate 401c included in the signature data 401 of the publication request (step S508—Yes). The access control means 331 determines that there is an access authority (step S509) and permits access to the data 503. Incidentally, the fact that the e-mail address 123 of the owner of the public key certificate 401c (120) in the public request 400 matches the destination e-mail address 202 described in the access right file 200 means that the sender of the e-mail 300 This means that the specified recipient is assured that the request is made public.

  Then, the access control unit 331 reads the corresponding data 503 from the data table 500 of the storage unit 32 (Step S510). Specifically, the access control means 331 determines that the owner's e-mail address 123 described in the public key certificate 203c in the access right file 200 matches the e-mail address 501 and the data in the access right file 200 A record in which the data ID included in the public URL 201 matches the data ID 502 is searched from the data table 500 and specified. Then, the access control unit 331 reads the data 503 in the specified record, transmits the data 503 to the communication device 2 via the communication unit 31, and increments the access count 504 of the record (step S511), and ends the series of steps. To do.

  If it is determined in step S502 that there is no access authority, the access control unit 331 transmits a rejection notice to the communication device 2 via the communication unit 31 (step S512), and the series of steps is terminated.

  Through a series of these processes, the data server 3 can transmit the data 503 to the communication device 2 used by the user specified by the destination mail address 202 specified in the access right file 200.

Hereinafter, an operation example of the entire network system 1 will be described as to how the communication device 2 and the data server 3 operate in cooperation. Here, the user A of the communication device 2-S (hereinafter simply referred to as “Class A”) transmits the electronic mail A to the user B of the communication device 2-R (hereinafter simply referred to as “B”). Further, it is assumed that the electronic mail A received by the second party is transmitted as the forward mail B to the user 丙 (hereinafter simply referred to as “丙”) of the communication device 2-FR. The e-mail address is “kou@***.co.jp”, “otsu@***.co.jp” is used as the e-mail address, and “hei@***.co.jp” is used as the eaves. ing. Further, it is assumed that Party A, Party B, and 丙 respectively store the issuance of the electronic certificate 100 in which the electronic mail address used in advance is the owner's electronic mail address 123 in the storage unit 24.
In addition, as shown in FIG. 10, in the data table 500, the data of A is set in the first and second lines as “kou@***.co.jp” in the column of the email address 501. Yes. Two types of “xxx.zip” and “yyy.zip” are set as the data ID 502 to distinguish the data 503. The data 503 is indicated as “data 1” and “data 2”. B's data is set in the third row as “otsu@***.co.jp” in the column of the email address 501. One type of “abc.zip” is set as the data ID 502. The data 503 of the second party is indicated as “Data 3”. In addition, Tsuji does not register data.

The overall operation of the network system 1 will be described with reference to FIG. First, the operation in which Party A transmits E-mail A to Party B and Party B refers to the data of Party A will be described (steps S101 to S117).
First, Party A sends E-mail A to Party B according to the steps described in FIG. That is, Party A uses “Otsu@***.co.jp” as its destination email address 302 and “https: //www.data.*” as the data disclosure URL 303a in the body 303 of the email A. Create email A with "**. co.jp/xxx.zip". “Kou@***.co.jp”, which is the email address 123 of the owner of the electronic certificate 100, is read and set as the sender email address 301. And access from the data disclosure URL 303a “https: //www.data.***.co.jp/xxx.zip” and the destination mail address 302 “otsu@***.co.jp” described in the text 303 The right file 200A is created, and the electronic mail A is transmitted from the communication device 2-S to the communication device 2-R (step S101). Incidentally, “https: //www.data.***.co.jp”, which is the former part of the data disclosure URL 303a, is the address of the data server 3, and “xxx.zip” which is the latter part is the data ID 502.

  Next, the second party who received the electronic mail A accesses the data server 3 according to the steps described with reference to FIG. 8 in order to acquire the data 503 of the former which is the sender of the electronic mail A (steps S102 and S111). . Specifically, the electronic mail A is received by the communication device 2-R (step S102), and the second party refers to the content of the electronic mail A displayed on the display unit 22 of the communication device 2-R. Then, B selects the data disclosure URL 303a “https: //www.data.***.co.jp/xxx.zip” described in the text 303, and enters the access right file 200A included in the email A. The publication request 400 is created by signing with the electronic certificate 100 having the own electronic mail address “otsu@***.co.jp” as the electronic mail address 123 of the owner. Next, the data server 3 is accessed, and the publication request 400 is transmitted to the data server 3 (step S111).

  When the data server 3 receives the disclosure request 400 from the communication device 2-R (step S112), the data server 3 determines whether or not access is possible according to the process of FIG. 11 (steps S113 to S115). That is, it is verified that the received publication request 400 has not been tampered with, and “otsu@***.co.jp”, which is the destination email address 202 of the access right file 200A, and the signature data 401 of the publication request. It is confirmed that the e-mail address 123 “otsu@***.co.jp” of the public key certificate 401c of FIG. As a result, it is possible to reliably confirm the match between the destination email address set when the Party A created the email A and the email address in the electronic certificate proving the party requesting the data disclosure (step S113). ). Since they match in this example, access is permitted.

Next, the data server 3 obtains “kou@***.co.jp” from “xxx.zip” which is the latter stage of the data disclosure URL 201 of the access right file 200A and the e-mail address 123 of the owner of the public key certificate 203c. Is extracted. Then, the record of the data table 500 in which the column of the e-mail address 501 is “kou@***.co.jp” and the column of the data ID 502 is “xxx.zip” is searched and specified. In the example of FIG. 10, the uppermost record corresponds to “data 1” of the data 503 in the record, and is read from the data table 500 (step S114).
Thereafter, “data 1” which is the acquired data 503 is transmitted to the communication device 2-R, and the access count 504 of the record is incremented (step S115).
The communication device 2-R that has received “data 1” that is data 503 displays “data 1” on the display unit 22. By this display, the second party can browse “Data 1” which is the data 503 of the former (Step S116, Step S117).

  In this way, the data server 3 can permit access to the public request from the user B who is specified by the destination email address designated by the user A, and can transmit data to the user B.

Next, the case where the e-mail A received from Party A is transferred to the bag will be described with reference to steps S201 to S216. It should be noted that the second party grants the right to access his / her data when the electronic mail A is transferred to the bag.
B creates and sends forward mail B from E-mail A according to the steps described in FIG. In other words, the second party quotes the e-mail address “hei@***.co.jp” as the destination e-mail address 302, quotes the text of the received e-mail A in the text 303, and is attached to the received e-mail A. Attached to the access right file 200A. Here, the second party may delete the access right file 200A without attaching it.
Then, “otsu@***.co.jp” that is the electronic mail address 123 of the owner of the electronic certificate 100 of the second party is read and set as the transmission source mail address 301 of the forward mail B. Then, transfer from the data disclosure URL 303a “https: //www.data.***.co.jp/abc.zip” and the destination mail address 302 “hei@***.co.jp” described in the text 303 The mail access right file 200B is created and attached, and the transfer mail B is transmitted from the communication device 2-R to the communication device 2-FR (step S201). Incidentally, “https: //www.data.***.co.jp”, which is the former part of the data disclosure URL 303a, is the address of the data server 3, and “abc.zip” which is the latter part is the data ID 502.

Next, a case where the bag that has received the forward mail B tries to acquire the data 503 of the former who is the sender of the original electronic mail 300 will be described. In addition, when acquiring the data of the sender of the forwarded mail B, the processing is the same as the processing in steps S111 to S117 described above, and since “Data 3” is displayed, description thereof is omitted.
First, after receiving the forwarded mail B by the communication device 2-FR (step S202), Sakai accesses the data server 3 according to the steps described in FIG. 8 in order to obtain the data 503 of the former (step S202). S211). Specifically, Tsuji selects the data disclosure URL 303a “https: //www.data.***.co.jp/xxx.zip” cited in the text 303, and The access right file 200A created by the client is signed with the electronic certificate 100 having the e-mail address “hei@***.co.jp” as the owner's e-mail address 123, and a publication request 400 is created. Next, the data server 3 is accessed, and the publication request 400 is transmitted to the data server 3 (step S211).

When the data server 3 receives the disclosure request 400 from the communication device 2-FR (step S212), the data server 3 determines whether or not access is possible according to the process of FIG. 11 (steps S213 and S214). That is, it can be verified that the received disclosure request 400 has not been tampered with. Furthermore, “otsu@***.co.jp”, which is the destination email address 202 of the access right file 200A, and the email address 123 “hei@***.co.” Of the public key certificate 401c of the signature data 401 of the publication request. co.jp "can be confirmed to be inconsistent. As a result, the recipient's email address that was set when E-mail A was created does not match the email address in the electronic certificate proving that the data is requested to be published. Access can be denied (step S213). Then, the data server 3 transmits a rejection notification as a determination result to the communication device 2-FR (step S214).
The communication device 2-FR that has received the “rejection notification” displays on the display unit 22 that data could not be acquired. As a result, Samurai cannot view the data 503 of the former. (Step S215, Step S216).

  In this way, the data server 3 can protect the data 503 without permitting access to a disclosure request from a destination mail address other than that specified by the user A.

  As described above, according to the access control system according to one embodiment of the present invention, the data is disclosed only to the user who directly receives the e-mail, and the user who receives the forwarded mail, that is, , The disclosure of data to a third party to whom the e-mail has been transferred can be restricted.

  The present invention is not limited to these embodiments. For example, in the present embodiment, when generating a public request, the communication device that transmits the public request uses the electronic certificate stored in the storage unit to generate the signature data of the public request by signing the access right file. However, if it is not necessary to strictly check the disclosure requester, the generation process of the signature data for the disclosure request can be omitted.

  In this case, the communication apparatus that transmits the publication request omits the determination process for determining whether there is an electronic certificate and the signature data generation process illustrated in step S403, which are illustrated in step S402 in FIG. In step S404, the publishing request is transmitted including the e-mail address normally used by the e-mail recipient instead of the signature data.

  On the other hand, the data server omits the verification processing of the signature data of the publication request shown in steps S503 and S504 in FIG. In step S507, the data server collates the destination email address described in the access right file with the email address normally used by the disclosure requester included in the disclosure request.

  In addition, the data server compares the signature time with the current time in the verification process of the access right file signature data, and determines whether or not the elapsed time from the sender's signature to the access right file is within a predetermined valid viewing period. May be added, and data browsing may be prohibited after a certain period of time has elapsed since the sender's signature. Accordingly, the disclosure of data can be restricted after a certain period of time has elapsed since the e-mail was sent from the sender.

  The data server counts the number of data accesses and manages the cumulative number of accesses. The number of accesses is managed for each e-mail address of the public key certificate included in the signature data of the publication request. Data may not be transmitted when the number of accesses to the e-mail address of the public key certificate exceeds a predetermined number of valid times in a certain period. Thereby, when the data is accessed a certain number of times by a specific user, the disclosure of the data can be restricted.

  Further, the data server may not transmit data in response to a public request by a specific user set in advance. In that case, the sender of the e-mail that publishes the data registers in advance in the data server a list of e-mail addresses of users who are prohibited from transmitting data from the communication device. Then, the data server does not transmit data when the electronic mail address of the public key certificate included in the signature data of the public request matches the electronic mail address described in the list. This allows senders of e-mails who publish data to restrict the publishing when the situation changes after sending the access rights file and it becomes necessary to prohibit the data from being released to specific users. Can do.

In addition, the data server confirms whether or not the body text of the email transmitted by the sender's communication device and the access right file correspond to each other, and if the data server supports the data server, the data server sends the data You may make it transmit. In this case, an e-mail with an S / MIME signature is transmitted from the communication device of the e-mail sender that publishes the data, and the hash value used for the S / MIME signature is transmitted to the data server in advance. On the other hand, the communication device of the disclosure requester includes the hash value obtained when verifying the S / MIME signature in the disclosure request and transmits it to the data server. The data server sends data only if the hash value received from the communication device of the sender of the e-mail that publishes the data matches the hash value received from the communication device of the disclosure requester. Does not send data.
Alternatively, the communication device of the e-mail sender who publishes data calculates a hash value of the body of the e-mail and includes the calculated hash value in the access right file. On the other hand, the communication device of the disclosure requester calculates a hash value of the body text of the acquired electronic mail, and includes the calculated hash value in the disclosure request and transmits it to the data server. The data server transmits data only when the hash value included in the access right file matches the hash value received from the communication device of the disclosure requester, and does not transmit data when they do not match.
As a result, it is possible to prevent the data from being disclosed to users who have not received the electronic mail transmitted by the sender who discloses the data, so that the security can be further improved.

  Further, the destination mail address included in the access right file may be encrypted by an encryption method such as RSA. Thereby, there is no possibility that the destination mail address is leaked to a third party, and the security can be further improved.

In addition, although the example in which the data disclosure URL is a URL obtained by concatenating the address of the data server and the data ID has been described, this may be omitted or modified.
For example, it may be a data disclosure URL in which the data ID is omitted. When there is only one data assigned to the user's email address in a data server, the data server must identify the corresponding data from the email address described in the public key certificate included in the access right file. The data ID can be omitted.
Alternatively, the data public URL may be omitted from the data server address. When there is only one data server, the transmission destination of the publication request can be fixed, and the address of the data server can be omitted.
If there is only one data server and one data is assigned to the user's e-mail address, the user data can be specified as only one, and the electronic data disclosure URL may be omitted.

  In addition, when the access right file is generated in the communication device of the sender, the data disclosure URL described in the access right file is an example of the data disclosure URL extracted from the body of the e-mail, and the embodiment will be described. did. However, the present invention is not limited to this, and when creating the access right file, the sender may be asked to input the data disclosure URL manually, or the data disclosure URL may be stored in advance and stored. May be selected and set in the access right file.

  In addition, the case where one communication device has both a function of transmitting an e-mail and a function of acquiring data from a data server for receiving the e-mail and browsing the data has been described. It may have only functions. In that case, the control unit of the communication apparatus can be realized if the electronic mail means is provided with either a transmission plug-in or a reception plug-in.

  The access control system may use a mobile phone as a communication device. In this case, each communication device communicates with another communication device via the base station device and the mobile phone network in accordance with a mobile phone communication standard such as W-CDMA, CDMA2000, or LTE (Long Term Evolution). The data server is connected to the mobile phone network, accepts registration of data from the communication device of the sender via the mobile phone network, accepts a public request from the communication device of the public requester, verifies the public request, If the verification is successful, the data is transmitted to the communication device of the disclosure requester.

  As described above, those skilled in the art can make various modifications in accordance with the embodiment to be implemented within the scope of the present invention.

DESCRIPTION OF SYMBOLS 1 Network system 2 (2-S, 2-R, 2-FR) Communication apparatus 3 Data server 4 Network 21, 31 Communication part 22 Display part 23 Operation part 24, 32 Storage part 25, 33 Control part 251 E-mail means 252 Access right file generation means 253 S / MIME signature means 254 S / MIME verification means 255 Public request generation means 256 Data acquisition means 331 Access control means 332 Signature verification means

Claims (4)

An access control system that includes a first communication device and a data server, and permits access to data of an e-mail sender only to recipients of an e-mail address specified by the sender. There,
The first communication device is
A device storage unit that pre-stores the first electronic certificate issued to the sender, including the sender's email address;
An access right file generating means for extracting a destination mail address from the header of the e-mail created by the sender, signing the destination mail address using the first electronic certificate, and generating an access right file;
E-mail means for sending the e-mail to the destination e-mail address with the created access right file attached,
The data server is
A storage unit storing data corresponding to an email address;
A communication unit that receives a public request including the e-mail address of the access right file and the public requester,
Signature verification means for performing signature verification of the access right file and determining whether the verification is successful;
Access to the data corresponding to the e-mail address included in the first electronic certificate when the signature verification means determines that the verification is successful and the destination e-mail address matches the e-mail address of the public requester allow, if they do not match the access control system characterized by having an access control means for disallowed. The public request includes an e-mail address of the public requester has been signed with the second electronic certificate issued to the public requester,
The access control system according to claim 1, wherein the signature verification unit determines that the verification is successful if both the verification of the signature by the second electronic certificate of the publication request and the verification of the signature of the access right file are successful. The access right file includes a data ID that identifies the data signed using the first electronic certificate,
The access control system according to claim 1, wherein the access control unit permits access to the data specified by the data ID. Further comprising an electronic mail address of the public requester stores in advance the second electronic certificate issued to the public requester,
When requesting the release of the data receives the e-mail in which the access right file is attached, the public request generator wherein generating a public request that signed the access right file using the second digital certificate Means,
Access control system according to claim 2 or claim 3 including a second communication device having a data acquisition means for acquiring data and transmits the disclosure request to the data server.

Images