JP7545936B2 - Data decoding and displaying system and data decoding and displaying method - Google Patents

Description

The present invention relates to a data decoding and display system and a data decoding and display method.

Remote work has become more prevalent in recent years, and work that was previously done in the office is now increasingly being done from home. In some industries, personal and confidential information may be handled from home, raising the issue that working from home increases the risk of information leaks.

In response to this, from the perspective of confidential information and privacy protection, there are technologies that encrypt information so that only appropriate users can decrypt it, and technologies that classify the content that can be viewed by users. For example, the technology described in Patent Document 1 decrypts encrypted content by holding a decryption icon over it, and displays the decrypted content through the decryption icon. Furthermore, the technology in Patent Document 1 performs password authentication when using the decryption icon to verify that the user is an appropriate user. As a result, the technology in Patent Document 1 makes it possible for users to decrypt encrypted content and view the decrypted content on the spot.

The technology described in Patent Document 2 encrypts an image displaying numbers and letters, splits the encrypted image into two, and displays one on a display and the other on a head-mounted display, etc., and decrypts the image by viewing the two overlapping each other. By applying the technology in Patent Document 2 to the display of one-time passwords or PIN codes, it is possible to prevent malicious individuals from viewing documents protected by these passwords.

JP 2002-158653 A Special table 2017-538152 publication

The technology of Patent Document 1 can limit the users who are allowed to decrypt encrypted data by password authentication. However, with the technology of Patent Document 1, when the decrypted data is displayed on the screen of a display device and a user who is allowed to decrypt is looking at the screen, there is a possibility that a person other than the user who is allowed to decrypt may look at the screen and see the decrypted data. With the technology of Patent Document 2, it is necessary to accurately overlay the encrypted images displayed on the two displays, which is inconvenient when viewing the decrypted image.

The present invention has been made to solve the above problems. That is, one of the objects of the present invention is to provide a data decryption and display system and a data decryption and display method that allows data obtained by decrypting encrypted data displayed on a screen to be easily viewed on another screen, while reducing the possibility that the decrypted data will be viewed by others if they look at the screen.

The data decryption and display system of the present invention includes a first information processing device including a first storage unit in which an encryption key is stored and configured to be able to encrypt data using the encryption key, a first display device including a first image display unit, a second display device including a second image display unit, and an input device that accepts a specific operation by a user, and a second information processing device to which the first information processing device is connected. The first information processing device is configured to acquire data requested by the second information processing device from the outside, generate encrypted data by encrypting the acquired data using the encryption key, and transmit the generated encrypted data to the second information processing device. The second information processing device is configured to receive the encrypted data from the first information processing device, display the received encrypted data on the first image display unit, and when the encrypted data is displayed on the first image display unit, if the specific operation is performed on the input device, acquire decrypted data obtained by decrypting the encrypted data, and display the acquired decrypted data on the second image display unit of the second display device.

The data decryption and display method of the present invention uses a first information processing device including a first storage unit in which an encryption key is stored and configured to be able to encrypt data using the encryption key, a first display device including a first image display unit, a second display device including a second image display unit, and an input device that accepts a specific operation by a user, and a second information processing device to which the first information processing device is connected, and the first information processing device acquires data requested by the second information processing device from the outside, generates encrypted data by encrypting the acquired data using the encryption key, and transmits the generated encrypted data to the second information processing device, receives the encrypted data from the first information processing device by the second information processing device, displays the received encrypted data on the first image display unit, and when the encrypted data is displayed on the first image display unit, if the specific operation is performed on the input device, acquires decrypted data obtained by decrypting the encrypted data, and displays the acquired decrypted data on the second image display unit of the second display device.

The present invention allows the decrypted data displayed on a screen to be easily viewed on another screen, and also reduces the possibility that the decrypted data will be viewed by others if they look at the screen.

FIG. 1 is a schematic diagram showing an example of the configuration of a data decoding and display system (first data display system) according to a first embodiment of the present invention. FIG. 2 is a block diagram showing an example of the hardware configuration of a user terminal. FIG. 3 is a block diagram showing an example of the hardware configuration of an encryption proxy server terminal. FIG. 4 is a block diagram showing an example of the hardware configuration of a database server terminal. FIG. 5 is a sequence diagram showing the procedure of the setup process executed by the first data display system. FIG. 6 is a sequence diagram showing the procedure of data encryption and decryption processing executed by the first data display system. FIG. 7 is a diagram showing an example of a format of data held by the database server terminal. FIG. 8 is a diagram showing an example of a data format of the response data. FIG. 9 is a diagram showing an example of a data format of the encrypted response data. FIG. 10 is a flowchart showing a process flow executed by the user terminal. FIG. 11 shows a first image display portion when encrypted data is displayed on a first display device, and a second image display portion when decrypted data is displayed on a second display device. FIG. 12 is a schematic diagram showing an example of the configuration of a data decoding and display system (second data display system) according to the second embodiment of the present invention. FIG. 13 is a sequence diagram showing the procedure of the setup process executed by the second data display system. FIG. 14 is a sequence diagram showing the procedure of encryption and decryption processing executed by the second data display system. FIG. 15 is a flowchart showing a process flow executed by the user terminal. FIG. 16 shows a first image display portion when encrypted data is displayed on a first display device, and a second image display portion when decrypted data is displayed on a second display device. FIG. 17 shows a first image display portion when encrypted data is displayed on a first display device, and a second image display portion when decrypted data is displayed on a second display device.

Each embodiment of the present invention will be described below with reference to the drawings. Note that each embodiment is merely an example for realizing the present invention and does not limit the technical scope of the present invention.

<<First embodiment>>
A data decoding and display system according to a first embodiment of the present invention (hereinafter referred to as a "first data display system") will be described.
<Configuration>
Fig. 1 is a schematic diagram showing an example of the configuration of a first data display system. As shown in Fig. 1, the first data display system includes a user terminal 100, an encryption proxy server terminal 200, and a database server terminal 300. These terminals are connected to each other via a network 400 so as to be able to communicate with each other.

The user terminal 100 includes a first display device 100-5 including a first image display unit 100-5A capable of displaying images. A second display device 100-6 including a second image display unit 100-6A capable of displaying images is connected to the user terminal 100. In this first data display system, the user terminal 100 executes a process for displaying encrypted data and a process for displaying decrypted data (hereinafter sometimes referred to as "data display process"), which will be described in detail later.

Figure 2 is a block diagram showing an example of the hardware configuration of the user terminal 100. The user terminal 100 is composed of, for example, a computer to which a CPU 100-1, an auxiliary storage device 100-2, a memory 100-3, a first display device 100-5, an input/output interface 100-7, and a communication device 100-8 are connected via an internal signal line 100-4. Note that the computer omitting the first display device 100-5 may also be referred to as an "information processing device" for convenience. The second display device 100-6 is connected to the user terminal 100 via the input/output interface 100-7. Note that the second display device 100-6 may be connected via the communication device 100-8. Furthermore, the second display device 100-6 may be included in the user terminal 100, or may be connected to the internal signal line 100-4. The first display device 100-5 may not be included in the user terminal 100, and may be connected to the user terminal 100 via an input/output interface 100-7 or a communication device 100-8. In this example, the user terminal 100 is a notebook PC (Personal Computer), the first display device 100-5 is a display of the notebook PC, and the second display device 100-6 is a head-mounted display.

CPU 100-1 includes a processor and executes programs stored in memory 100-3. Memory 100-3 includes ROM, which is a non-volatile storage element, and RAM, which is a volatile storage element. ROM stores immutable programs (e.g., BIOS) and the like. RAM is a high-speed, volatile storage element such as DRAM (Dynamic Random Access Memory), and temporarily stores programs executed by CPU 100-1 and data used when executing the programs.

The auxiliary storage device 100-2 is a large-capacity non-volatile storage device such as a magnetic storage device (HDD) or flash memory (SSD) that can read and write data, and stores the programs executed by the CPU 100-1 and the data used when the programs are executed. That is, the programs are read from the auxiliary storage device 100-2, loaded into the memory 100-3, and executed by the CPU 100-1.

The input/output interface 100-7 includes an interface to which an input device 100-9 such as a keyboard or mouse is connected and which receives input from a user. Furthermore, the input/output interface 100-7 includes an interface to which a display device, printer, etc. is connected and which outputs the results of program execution in a format that can be viewed by the user.

The communication device 100-8 is a network interface device that controls communication with other devices according to a specific protocol. Furthermore, the communication device 100-8 includes a serial interface such as USB. The program executed by the CPU 100-1 is provided to the user terminal 100 via removable media (CD-ROM, flash memory, etc.) or a network, and is stored in the non-volatile auxiliary storage device 100-2, which is a non-transitory storage medium. For this reason, it is preferable that the user terminal 100 has an interface that reads data from removable media.

The user terminal 100 is a computer system configured on one physical computer, or on multiple logically or physically configured computers, and may operate in separate threads on the same computer, or may operate on a virtual computer constructed on multiple physical computer resources (the same applies to the encryption proxy server terminal 200 and database server terminal 300 described below).

The hardware configuration of each of the encryption proxy server terminal 200 and the database server terminal 300 is similar to that of the user terminal 100, except that, for example, the first display device 100-5 and the second display device 100-6 are omitted. That is, as shown in FIG. 3, the encryption proxy server terminal 200 is configured by a computer to which a CPU 200-1, an auxiliary storage device 200-2, a memory 200-3, an input/output interface 200-7, and a communication device 200-8 are connected via an internal signal line 200-4. As shown in FIG. 4, the database server terminal 300 is configured by a computer to which a CPU 300-1, an auxiliary storage device 300-2, a memory 300-3, an input/output interface 300-7, and a communication device 300-8 are connected via an internal signal line 300-4.

＜Overview＞
In the first data display system, for example, when a user handles confidential information in teleworking or the like, the user terminal 100 used by the user acquires encrypted data of the confidential information (data). Furthermore, in the first data display system, the user terminal 100 decrypts the encrypted data acquired, thereby acquiring decrypted data (plain text data) obtained by the user terminal 100 decrypting the encrypted data.

Furthermore, in the first data display system, the user terminal 100 displays encrypted data on a first display device 100-5 (display) that can be viewed by people other than the user (e.g., the user's family members), and displays decrypted plaintext data on a second display device 100-6 (a separate display for one person, such as a head-mounted display). This makes it possible for the first data display system to reduce the possibility that people other than the user himself/herself will be able to peek (sneak a peek) at the screen displaying confidential information.

<Specific operation>
The specific operation of the first data display system will be described in the following order.
(1-1) Setup process procedure (1-2) Data encryption and decryption process procedure (1-3) Display process of encrypted data and decrypted data (data display process)

(1-1) Procedure of the Setup Process Fig. 5 is a sequence diagram showing the procedure of the setup process executed by the first data display system. The first data display system executes the setup process by sequentially executing the processes of S310 to S313 described below.

S310: The user terminal 100 executes an encryption key and decryption key generation process to generate an encryption key D100 and a decryption key D110. In this example, public key cryptography is used in which different keys are used as the encryption key D100 and the decryption key 110. Common key cryptography in which the same key is used as the encryption key D100 and the decryption key D110 may also be used.
S 311 : The user terminal 100 transmits the encryption key D 100 to the encryption proxy server terminal 200 .
S312: The encryption proxy server terminal 200 stores the encryption key D100 received from the user terminal 100 in the auxiliary storage device 200-2.
S313: The first data display system ends the setup process.

(1-2) Data Encryption and Decryption Processing Procedure Fig. 6 is a sequence diagram showing the procedure of data encryption and decryption processing executed by the first data display system. The first data display system executes data encryption and decryption processing by sequentially executing the processes of S410 to S418 described below.

S410: The user terminal 100 executes a query data generation process to generate query data D200 for requesting data from the database server terminal 300.

S411: The user terminal 100 transmits query data D200 to the encryption proxy server terminal 200.

S412: When the encryption proxy server terminal 200 receives the query data D200 from the user terminal 100, it transmits the received query data D200 to the database server terminal 300.

S413: When the database server terminal 300 receives the query data D200 from the encryption proxy server terminal 200, it executes a response data generation process to generate response data D300. An example of the data held by the database server terminal 300 and an example of the response data D300 will be described later.

S414: The database server terminal 300 transmits the response data D300 to the encryption proxy server terminal 200.

S415: When the encryption proxy server terminal 200 receives the response data D300 from the database server terminal 300, it encrypts the response data D300 by executing a response data encryption process using the encryption key D100 stored in the auxiliary storage device 200-2 by the setup process. As a result, the encryption proxy server terminal 200 generates encrypted response data D400. An example of the encrypted response data D400 will be described later.

S416: The encryption proxy server terminal 200 transmits the encrypted response data D400 to the user terminal 100.

S417: When the user terminal 100 receives the encrypted response data D400 from the encryption proxy server terminal 200, it executes a display process (data display process) for the encrypted data and decrypted data. The details of this data display process will be described later.

S418: The first data display system ends the data encryption and decryption process.

Figure 7 shows an example of the format of data stored in the database server terminal 300. As shown in Figure 7, the database server terminal 300 stores (stores, saves) data records in the auxiliary storage device 300-2 in key-value format. In Figure 7, the value corresponding to key100 is Yamada Taro, the value corresponding to key101 is Yamada Hanako, and the value corresponding to key102 is Tanaka Ichiro.

Figure 8 shows an example of the data format of response data D300. As described above, in S413, the database server terminal 300 performs a response data generation process for the query data D200 generated by the user terminal 100 for the key-value format data record it holds. As a result, the database server terminal 300 generates response data D300, and in S414 transmits the generated response data D300 to the encryption proxy server terminal 200.

For example, if the query data D200 requests key=101, the database server terminal 300 returns the set of value=Yamada Hanako (key=101, value=Yamada Hanako) corresponding to key101 shown in FIG. 8 as response data D300.

Figure 9 shows an example of the data format of encrypted response data D400. The encryption proxy server terminal 200 performs encryption processing on Yamada Hanako, which is the value portion of the received response data D300, using encryption key D100, to generate encrypted response data D400. In Figure 9, the ciphertext binary for Yamada Hanako is "0x630fa2209c61a6e4", which is stored in the value portion.

(1-3) Display process of encrypted data and decrypted data (data display process)
<S417>
The above-mentioned data display process (S417) will be described in detail with reference to Fig. 10. Fig. 10 is a flowchart showing the process flow executed by the user terminal 100. The user terminal 100 executes the process flow shown in Fig. 10. Therefore, the user terminal 100 starts the process from step 1000 and proceeds to step 1001, where the encrypted response data D400 received from the encryption proxy server terminal 200 is displayed on the first image display unit 100-5A of the first display device 100-5.

Then, the user terminal 100 proceeds to step 1002 and determines whether or not a user operation has been performed to request decryption of the encrypted response data D400 being displayed on the first image display unit 100-5A of the first display device 100-5. The user operation is an operation performed on the input device 100-9 connected to the input/output interface 100-7, and includes, for example, at least one of the following: pressing a specific button on a keyboard, pressing a specific button on a mouse, moving the mouse cursor to a specific area on the screen of the first display device 100-5 (first image display unit 100-5A), and moving the mouse cursor to a specific area on the screen of the second display device 100-6 (second image display unit 100-6A). Hereinafter, this user operation may also be referred to as a "specific operation." For example, the specific operation may be an operation required to input a preset password. Such an operation may include, for example, pressing a specific button on a keyboard corresponding to a preset password. If a specific operation is performed on the encrypted response data D400 being displayed on the first image display unit 100-5A of the first display device 100-5, the user terminal 100 determines "Yes" in step 1002 and executes the processing of steps 1003 and 1004 described below in order, and then proceeds to step 1095 to temporarily end this processing flow.

Step 1003: The user terminal 100 decrypts the encrypted response data D400 (strictly speaking, the encrypted portion) using the decryption key D110 to create decrypted response data D300 (strictly speaking, response data D300 obtained by decrypting a portion of the encrypted response data D400).

Step 1004: The user terminal 100 displays the decrypted response data D300 on the second image display unit 100-6A of the second display device 100-6.

If no specific operation has been performed at the time when the process of step 1002 is executed, the user terminal 100 determines "No" in step 1002 and proceeds to step 1005. When the user terminal 100 proceeds to step 1005, it determines whether a predetermined time has elapsed since the display start point when the encrypted response data D400 was started to be displayed on the first display device 100-5.

If the specified time has not elapsed since the start of display, the user terminal 100 determines "No" in step 1005, proceeds to step 1002, and executes the processing of step 1002 described above.

If a predetermined time has elapsed since the start of display, the user terminal 100 judges "Yes" in step 1005 and proceeds to step 1095, temporarily terminating this processing flow.

By executing the process of step 1002 and the process of step 1005, the user terminal 100 waits for a specific operation on the encrypted response data D400 being displayed on the first image display unit 100-5A of the first display device 100-5, and if there is no specific operation for a certain period of time, the user terminal 100 temporarily terminates this processing flow. In this case, the user terminal 100 may then execute this processing flow again based on the user's operation on the input device. Note that the user terminal 100 may wait for a specific operation on the encrypted response data D400 being displayed on the first image display unit 100-5A of the first display device 100-5, and may prohibit decryption of the encrypted response data D400 if there is no specific operation for a certain period of time. In this case, for a limited period of time from the time when the encrypted response data D400 is displayed on the first image display unit 100-5A of the first display device 100-5, the response data D300 obtained by decrypting the encrypted response data D400 displayed on the first image display unit 100-5A of the first display device 100-5 is permitted to be displayed on the second display device 100-6.

Figure 11 shows the first image display unit 100-5A (screen) when the encrypted response data D400 is displayed on the first display device 100-5 (in this example, the display of a notebook PC which is the user terminal 100), and shows the second image display unit 100-6A (screen) when the decrypted response data D300 is displayed on the second display device 100-6 (in this example, a head-mounted display).

As shown in FIG. 11, the first image display unit 100-5A of the first display device 100-5 displays "101" corresponding to the "key" of the encrypted response data D400 and the encrypted value "0x630fa2209c61a6e4" corresponding to the "value" in the encrypted response data D400 for each of the "key" and "value" fields indicating the data items of the encrypted response data D400.

In this example, when the mouse cursor CA1 moves over the ciphertext "0x630fa2209c61a6e4" in the first image display unit 100-5A of the first display device 100-5, it is determined that a user operation (specific operation) has occurred.

When it is determined that a user operation (specific operation) has occurred, the second image display unit 100-6A of the second display device 100-6 displays the decrypted response data D300, which includes the plaintext obtained by decrypting the ciphertext "0x630fa2209c61a6e4". That is, the second image display unit 100-6A of the second display device 100-6 displays "101" corresponding to the "key" of the response data D300 and the plaintext "Yamada Hanako", which is the value corresponding to the "value", in the "key" and "value" fields indicating the data items of the decrypted response data D300.

In this way, the response data D300, which includes the plaintext obtained by decrypting the ciphertext included in the encrypted response data D400, is displayed on the second image display unit 100-6A of the second display device 100-6, so that only the user himself can view the plaintext. Therefore, for example, in the case where confidential information is encrypted data, when a target user who is permitted to view the confidential information decrypts and views the encrypted confidential information, the first data display system can reduce the possibility that the confidential information will be viewed by people other than the target user.

＜Effects＞
As described above, the first data display system can reduce the possibility that the decrypted data, which is decrypted from encrypted data that should not be leaked to others, is peeked by others other than the target user when the target user who is allowed to decrypt the encrypted data views the decrypted data on a screen. Furthermore, the first data display system can easily display the decrypted data, which is decrypted from the encrypted data displayed on the screen, on another screen that can be viewed only by the target user. Furthermore, the first data display system can build a system that can prevent the leakage of confidential information that a user who has the authority to view confidential information needs to view on the screen, for example, when the user performs teleworking, with a simple and easy configuration.

In addition, in the technology of Patent Document 2 (JP Patent Publication No. 2017-538152), the data to be encrypted must be converted into a two-part image. Furthermore, in the technology of Patent Document 2, in order to view the decrypted image, it is necessary to accurately overlap the encrypted images displayed on the two displays, which is inconvenient and may cause the encrypted image to become misaligned, making it difficult to see and making it difficult to read. Furthermore, in the technology of Patent Document 2, if the decrypted data contains a lot of characters such as text, it becomes difficult to read. In contrast, the first data display system does not require the data to be encrypted to be converted into a two-part image, nor does it require the encrypted images displayed on the two displays to be accurately overlapped, so there is no difficulty in reading the decrypted data.

<<Second embodiment>>
A data decoding and display system according to a second embodiment of the present invention (hereinafter referred to as a "second data display system") will be described.

＜Overview＞
The second data display system differs from the first data display system only in the following respects.
The second data display system further includes a decoding server terminal 1000 (see FIG. 12 described later).
The decryption server terminal 1000 executes the decryption process.

The following will focus on these differences.

<Configuration>
Fig. 12 is a schematic diagram showing an example of the configuration of the second data display system. As shown in Fig. 12, the second data display system includes a user terminal 100, an encryption proxy server terminal 200, a database server terminal 300, and a decryption server terminal 1000. These terminals are connected to each other via a network 400 so as to be able to communicate with each other. In this second data display system, the decryption server terminal 1000 executes a decryption process for encrypted data. Note that the hardware configuration of the decryption server terminal 1000 is similar to that of the encryption proxy server terminal 200 shown in Fig. 3, for example, and therefore description thereof will be omitted.

<Specific operation>
The specific operation of the second data display system will be described below. The description will be given in the following order. Note that the same reference numerals are used for the processes that overlap with those of the first data display system, and the description thereof will be omitted as appropriate.
(2-1) Setup process procedure (2-2) Encryption and decryption process procedure (2-3) Display process of encrypted data and decrypted data (data display process)

(2-1) Procedure of the Setup Process Fig. 13 is a sequence diagram showing the procedure of the setup process executed by the second data display system. The second data display system executes the setup process by sequentially executing the processes of S310 to S312 described above and the processes of S320 to S322 described below.

S 320 : The user terminal 100 transmits the decryption key D 110 to the decryption server terminal 1000 .
S321: The decryption server terminal 1000 stores the decryption key D110 received from the user terminal 100 in the auxiliary storage device.
S322: The second data display system ends the setup process.

(2-2) Encryption and Decryption Processing Procedures Fig. 14 is a sequence diagram showing the encryption and decryption processing procedures executed by the second data display system. The second data display system executes encryption and decryption processing by sequentially executing the processes of S410 to S416 already described and the processes of S430 to S435 described below. The processes of S430, S431, and S434 executed by the user terminal 100 will be described in detail later.

S430: The user terminal 100 displays the encrypted response data D400 received from the encryption proxy server terminal 200 on the first image display unit 100-5A of the first display device 100-5.

S431: When a user operation (specific operation) is performed on the encrypted response data D400 being displayed on the first image display unit 100-5A of the first display device 100-5, the user terminal 100 transmits the encrypted response data D400 to the decryption server terminal 1000.

S432: When the decryption server terminal 100 receives the encrypted response data D400 from the user terminal 100, it decrypts the encrypted response data D400 using the decryption key D110 to create decrypted response data D300.

S433: The decryption server terminal 1000 transmits the decrypted response data D300 to the user terminal 100.

S434: The user terminal 100 displays the response data D300 received from the decryption server terminal 1000 on the second image display unit 100-6A of the second display device 100-6.

S435: The second data display system ends the data encryption and decryption process.

<S430, S431 and S434>
The above-mentioned steps S430, S431 and S434 will be described in detail with reference to Fig. 15. Fig. 15 is a flowchart showing the process flow executed by the user terminal 100.

The user terminal 100 executes the processing flow shown in FIG. 15. Therefore, the user terminal 100 starts processing from step 1500, and executes the appropriate processing from among the above-mentioned steps 1001, 1002, and 1005.

If a user operation (specific operation) has been performed on the encrypted response data D400 being displayed on the first image display unit 100-5A of the first display device 100-5 at the time of executing the processing of step 1002, the user terminal 100 determines "Yes" in step 1002 and executes the processing of steps 1501 to 1503 described below in order, and then proceeds to step 1595 and temporarily ends this processing flow.

Step 1501: The user terminal 100 transmits the encrypted response data D400 to the decryption server terminal 1000.

Step 1502: The user terminal 100 receives the decrypted response data D300 from the decryption server terminal 1000.

Step 1503: The user terminal 100 displays the decrypted response data D300 received from the decryption server terminal 1000 on the second image display unit 100-6A of the second display device 100-6.

＜Effects＞
As described above, the second data display system has the same effect as the first data display system. That is, when a target user who is permitted to decrypt encrypted data views on a screen the decrypted data that is decrypted from encrypted data that should not be leaked to others, the second data display system can reduce the possibility that the decrypted data is peeked by others other than the target user. Furthermore, the second data display system can easily display decrypted data obtained by decrypting the encrypted data displayed on the screen on another screen that can be viewed only by the target user. Furthermore, the second data display system can easily build a system that can prevent leakage of confidential information that a user who has the authority to view confidential information needs to view on the screen, for example, when the user performs teleworking. Furthermore, the second data display system transmits the encrypted response data D400 to the decryption server terminal 1000 and causes the decryption server terminal 1000 to decrypt the encrypted response data D400, so that the processing load of the user terminal 100 can be reduced compared to the first data display system.

<<Modifications>>
The present invention is not limited to the above-mentioned embodiments, and various modifications can be adopted within the scope of the gist of the present invention. For example, in the above-mentioned second embodiment, the encryption key and decryption key generation process may be executed by the decryption server terminal 1000. In this case, in the setup process, the decryption server terminal 1000 transmits the encryption key D100 to the encryption proxy server terminal 200.

In each of the above embodiments, as shown in FIG. 16, a first image including each item of confidential information and confidential information (ciphertext) P1 as encrypted data may be displayed on the first image display unit 100-5A of the first display device 100-5 of the notebook PC as the user terminal 100. In this case, as shown in FIG. 16, the user terminal 100 may further conceal the confidential information (ciphertext) P1 by, for example, garbling the characters before displaying it. In this case, when a specific operation is performed on the input device 100-9, a second image including each item of confidential information and confidential information (plaintext) P2 obtained by decrypting the confidential information as encrypted data is displayed on the second image display unit 100-6A of the head-mounted display as the second display device 100-6.

In each of the above embodiments, as shown in FIG. 17, a first image including each item of confidential information, confidential information (ciphertext) P11 as encrypted data, and a number N11 (number) associated with specific information (ciphertext) of the confidential information (ciphertext) P11 may be displayed on the first image display unit 100-5A of the first display device 100-5 of the notebook PC as the user terminal 100. In this case, as shown in FIG. 17, the user terminal 100 may display the confidential information (ciphertext) P11 in a concealed manner, for example by garbling the characters. In this case, when a specific operation is performed on the input device 100-9, only the specific information associated with the number N11 may be decrypted, and only the number N11 and the decrypted specific information (plaintext) P12 may be displayed on the second image display unit 100-6A of the head-mounted display as the second display device 100-6. This allows the user to quickly recognize the decrypted information. Note that the number N11 (number) may be information other than numbers, such as letters, symbols, or pictures.

In each of the above embodiments, the second display device 100-6 can be any display device that can shield an image so that the image displayed on the second image display unit 100-6A is not visible to anyone other than the user when the user is viewing the image displayed on the second image display unit 100-6A. Examples of such a second display device 100-6 include, in addition to head-mounted display devices such as the head-mounted display described above, eyeglass-type display devices such as smart glasses, "displays, smartphones, or tablet terminals equipped with a function for shielding an image so that the image displayed on the image display unit cannot be viewed from outside a predetermined viewing angle range," displays dedicated to one user (displays in which the image displayed on the screen cannot be viewed by anyone other than the user when the user is viewing the image displayed on the screen), and display devices that are converted into eyeglass-type terminals by attaching an eyeglass-type adapter to a smartphone or the like.

100...user terminal, 100-5...first display device, 100-5A...first image display unit, 100-6...second display device, 100-6A...second image display unit, 100-9...input device, 200...encryption proxy server terminal, 300...database server terminal, 400...network, 1000...decryption server terminal

Claims (10)

a first information processing device including a first storage unit in which an encryption key is stored and configured to be able to encrypt data using the encryption key;
a first display device including a first image display unit ;
a second display device including a second image display unit ;
an input device that accepts a specific operation by a user ;
a second information processing device to which the first display device, the second display device, and the input device are connected;
A data decoding and display system comprising:
The first information processing device,
The second information processing device is configured to obtain data requested by the second information processing device from an external source, encrypt the obtained data using the encryption key to generate encrypted data, and transmit the generated encrypted data to the second information processing device;
The second information processing device is
receiving the encrypted data from the first information processing device, and displaying the received encrypted data on the first image display unit;
and when the specific operation is performed on the input device while the encrypted data is being displayed on the first image display section, the display device is configured to obtain decrypted data by decrypting the encrypted data, and display the obtained decrypted data on the second image display section of the second display device.
Data decoding and display system. 2. The data decoding and display system of claim 1,
The second display device is
The second image display unit is configured to be able to block an image displayed on the second image display unit so that the image is not visible to people other than the one user when the image is viewed by the one user.
Data decoding and display system. 2. The data decoding and display system of claim 1,
the second information processing device includes a second storage unit in which a decryption key capable of decrypting the encrypted data is stored;
The second information processing device is
generating the encryption key and the decryption key;
The generated encryption key is transmitted to the first information processing device and stored in the first storage unit;
storing the generated decryption key in the second storage unit;
decrypting the encrypted data using the decryption key stored in the second storage unit;
It was configured as follows:
Data decoding and display system. a first information processing device including a first storage unit in which an encryption key is stored and configured to be able to encrypt data using the encryption key;
a first display device including a first image display unit;
a second display device including a second image display unit;
an input device that accepts a specific operation by a user;
a second information processing device to which the first display device, the second display device, and the input device are connected;
A data decoding and display system comprising:
The first information processing device,
The second information processing device is configured to obtain data requested by the second information processing device from an external source, encrypt the obtained data using the encryption key to generate encrypted data, and transmit the generated encrypted data to the second information processing device;
The second information processing device is
receiving the encrypted data from the first information processing device, and displaying the received encrypted data on the first image display unit;
when the specific operation is performed on the input device while the encrypted data is being displayed on the first image display section, decrypted data obtained by decrypting the encrypted data is obtained, and the obtained decrypted data is displayed on the second image display section of the second display device;
The method further includes a third information processing device including a third storage unit in which a decryption key capable of decrypting the encrypted data is stored,
The second information processing device is
generating the encryption key and the decryption key;
The generated encryption key is transmitted to the first information processing device and stored in the first storage unit;
transmitting the generated decryption key to the third information processing device and storing it in the third storage unit;
It is configured as follows:
Furthermore, the second information processing device
transmitting the encrypted data to the third information processing device, and receiving the decrypted data obtained by causing the third information processing device to decrypt the encrypted data with the decryption key from the third information processing device, thereby acquiring the decrypted data.
It was configured as follows:
Data decoding and display system. a first information processing device including a first storage unit in which an encryption key is stored and configured to be able to encrypt data using the encryption key;
a first display device including a first image display unit;
a second display device including a second image display unit;
an input device that accepts a specific operation by a user;
a second information processing device to which the first display device, the second display device, and the input device are connected;
A data decoding and display system comprising:
The first information processing device,
The second information processing device is configured to obtain data requested by the second information processing device from an external source, encrypt the obtained data using the encryption key to generate encrypted data, and transmit the generated encrypted data to the second information processing device;
The second information processing device is
receiving the encrypted data from the first information processing device, and displaying the received encrypted data on the first image display unit;
when the specific operation is performed on the input device while the encrypted data is being displayed on the first image display section, decrypted data obtained by decrypting the encrypted data is obtained, and the obtained decrypted data is displayed on the second image display section of the second display device;
The method further includes a third information processing device including a third storage unit in which a decryption key capable of decrypting the encrypted data is stored,
The third information processing device is
generating the encryption key and the decryption key;
The generated encryption key is transmitted to the first information processing device and stored in the first storage unit;
storing the generated decryption key in the third storage unit;
It is configured as follows:
The second information processing device is
transmitting the encrypted data to the third information processing device, and receiving the decrypted data obtained by causing the third information processing device to decrypt the encrypted data with the decryption key from the third information processing device, thereby acquiring the decrypted data.
It was configured as follows:
Data decoding and display system. 2. The data decoding and display system of claim 1,
The second display device is
A head-mounted display, a glasses-type display, or a display dedicated to a single user,
Data decoding and display system. 2. The data decoding and display system of claim 1,
The input device is at least one of a keyboard and a mouse;
the specific operation includes at least one of an operation of pressing a specific button on the keyboard, an operation of pressing a specific button on the mouse, an operation of moving a mouse cursor to a specific area of the first image display section of the first display device, and an operation of moving a mouse cursor to a specific area of the second image display section of the second display device;
Data decoding and display system. 2. The data decoding and display system of claim 1,
The second information processing device is
When the encrypted data is displayed on the first image display section of the first display device, a first image including the encrypted data, first data associated with the encrypted data, and second data other than the encrypted data and the first data is displayed on the first image display section;
When the decoded data is displayed on the second image display section of the second display device, a second image including only the decoded data and the first data is displayed on the second image display section.
It was configured as follows:
Data decoding and display system. 2. The data decoding and display system of claim 1,
The second information processing device is
prohibiting decryption of the encrypted data when the encrypted data is being displayed on the first image display unit and the specific operation is not performed on the input device until a predetermined time has elapsed from a time when the encrypted data starts to be displayed.
It was configured as follows:
Data decoding and display system. a first information processing device including a first storage unit in which an encryption key is stored and configured to be able to encrypt data using the encryption key;
a first display device including a first image display unit, a second display device including a second image display unit, an input device that accepts a specific operation by a user, and a second information processing device to which the first display device, the second display device, and the input device are connected;
A data decoding and display method using the
The first information processing device
acquiring data requested by the second information processing device from an external device, encrypting the acquired data with the encryption key to generate encrypted data, and transmitting the generated encrypted data to the second information processing device;
The second information processing device
receiving the encrypted data from the first information processing device, and displaying the received encrypted data on the first image display unit;
when the specific operation is performed on the input device while the encrypted data is being displayed on the first image display section, the encrypted data is decrypted to obtain decrypted data, and the obtained decrypted data is displayed on the second image display section of the second display device.
Data decryption display method.

Images