JP7549283B2 - Management method, information processing device, and management program - Google Patents

Description

The present invention relates to a management method, an information processing device, and a management program.

A database system may use a database management program to manage the database and perform data processing. A database management program is sometimes called a DBMS (Database Management System) program. A database system may set user permissions for the database and permit access to the database within the scope of those permissions. A database system may also register stored procedures that define data processing procedures, and execute the stored procedures on request.

A system has been proposed that manages encryption keys for encrypting and decrypting databases. The proposed system stores key information that associates a user ID, a key ciphertext obtained by encrypting an encryption key using a password, and a revision number indicating the generation of the password. When a user changes their password, the proposed system decrypts the key ciphertext with the old password to restore the encryption key, re-encrypts the encryption key with the new password to generate new key information, and stores the new key information alongside the old key information.

JP 2016-192715 A

A database system may strengthen the protection of the data contained in the database by using a specific database management program. The specific database management program may be a restricted version of a database management program that places more restrictions on user operations than a normal database management program.

However, database systems may be subject to attacks in which a third party replaces the database management program. If the database management program is replaced from one with a high data protection level to one with a lower one, a third party may illegally read data from the database. Therefore, in one aspect, the present invention aims to prevent a third party from replacing the database management program.

In one aspect, a management method is provided in which a computer executes the following processes: Obtain revision information that identifies a database management program that manages the database, and user information that indicates a user of the database. Generate key information using the obtained revision information and user information. Encrypt the database using the generated key information. After the database is encrypted, discard the generated key information.

In one aspect, an information processing device is provided having a storage unit and a processing unit. In another aspect, a management program is provided to be executed by a computer.

In one aspect, replacement of the database management program by a third party is inhibited.
The above and other objects, features and advantages of the present invention will become apparent from the following description taken in conjunction with the accompanying drawings illustrating preferred embodiments of the present invention.

FIG. 1 is a diagram illustrating an information processing apparatus according to a first embodiment. FIG. 1 illustrates an example of an information processing system according to a second embodiment. FIG. 2 is a block diagram showing an example of hardware of a data processing server. FIG. 2 is a block diagram showing an example of the structure of a data capsule. FIG. 2 is a block diagram showing an example of software for the data processing server. FIG. 13 is a diagram showing an example of a capsule management table. FIG. 13 illustrates an example of encryption key generation. 13 is a flowchart illustrating an example of a procedure for generating a data capsule. 13 is a flowchart showing an example of a procedure for using a data capsule.

The present embodiment will be described below with reference to the drawings.
[First embodiment]
A first embodiment will be described.

FIG. 1 is a diagram illustrating an information processing apparatus according to a first embodiment.
The information processing device 10 according to the first embodiment holds data using a database management program. The information processing device 10 may be a client device or a server device. The information processing device 10 may be called a computer, a database device, or a management device.

The information processing device 10 has a storage unit 11 and a processing unit 12. The storage unit 11 may be a volatile semiconductor memory such as a random access memory (RAM), or a non-volatile storage such as a hard disk drive (HDD) or a flash memory. The processing unit 12 is, for example, a processor such as a central processing unit (CPU), a graphics processing unit (GPU), or a digital signal processor (DSP). However, the processing unit 12 may include an electronic circuit such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA). The processor executes a program stored in a memory such as a RAM (which may be the storage unit 11). A collection of processors may be called a multiprocessor or simply a "processor".

The storage unit 11 stores a database 13 and a database management program 14. The database 13 may be a relational database or a non-relational database such as a tree-type database or a network-type database. The database 13 includes a data set such as table data. The database 13 may include management information used to control data access. The management information may include a user definition indicating users who can access the database 13, and may include an authority definition indicating the types of data operations permitted to the users. The management information may also include a data structure definition, and may include a stored procedure definition that specifies a series of data processing procedures.

As described below, database 13 is encrypted. Encryption of database 13 may include encryption of data sets, or may include encryption of management information. Encryption may be performed at a fine granularity, such as on a record-by-record basis in a table or on an item-by-item basis in management information, or at a coarse granularity, such as on an entire table or an entire file of management information.

The database management program 14 manages the database 13. The database management program 14 is sometimes called a DBMS program. For example, the database management program 14 receives a request message from a user that includes a query such as an SQL statement or a stored procedure specification. The database management program 14 refers to the user definition and authority definition to confirm that the contents of the request message are within the scope of the user's authority. The database management program 14 then executes the query or the specified stored procedure against the database 13.

The database management program 14 may be a restricted version of a database management program that places more restrictions on user operations than a normal database management program. For example, the database management program 14 may prohibit changes to management information such as user definitions, authority definitions, data structure definitions, and stored procedure definitions. Furthermore, the database management program 14 may prohibit some data operations, such as data updates and data deletions, out of data searches, data insertions, data updates, and data deletions.

The processing unit 12 encrypts the database 13. The processing unit 12 may package the encrypted database 13 and the database management program 14, and output the package data. For example, the processing unit 12 may provide the package data to a user, or may transmit it to another information processing device. When encrypting the database 13, the processing unit 12 acquires revision information 15 and user information 16.

Revision information 15 is an identifier that identifies the database management program 14. Revision information 15 may be the version number of the database management program 14, or a serial number of a copy of the database management program 14. Revision information 15 may be embedded in the database management program 14. User information 16 is an identifier that indicates the user of the database 13. This user is, for example, a data provider who stores data to be protected in the database 13. User information 16 may be written in a file associated with the database 13, or may be included in the database 13.

The processing unit 12 generates key information 17 according to a specific key generation algorithm using the acquired revision information 15 and user information 16. For example, the processing unit 12 combines the revision information 15 and the user information 16, and inputs the combined character string into a function such as a hash function to generate key information 17. The key information 17 may include a common key used in a common key cryptosystem, or may include a public key and a private key used in a public key cryptosystem.

The processing unit 12 encrypts the database 13 using the generated key information 17. After the database 13 is encrypted, the processing unit 12 discards the generated key information 17. Because the key information 17 is not saved, when decrypting the database 13, the key information 17 is regenerated from the revision information 15 and the user information 16. The database management program 14 may access the database 13 using the regenerated key information 17. The database management program 14 may include a module that regenerates the key information 17.

As described above, the information processing device 10 of the first embodiment generates key information 17 from revision information 15 and user information 16, encrypts database 13 using key information 17, and discards key information 17 after encryption. This links the database management program 14 with the user of database 13, making it difficult to decrypt database 13 unless the correct set of revision information 15 and user information 16 is known. This makes it difficult to access database 13 from another database management program with different revision information. This prevents a third party from replacing database management program 14 with another database management program to access database 13.

As mentioned above, the database management program 14 may be a specific database management program with enhanced data protection. For example, the database management program 14 prohibits changes to management information. In this case, by preventing replacement of the database management program 14, the risk of a third party illegally reading data from the database 13 and leaking the data is reduced, improving data security.

In addition, the information processing device 10 may reacquire the revision information 15 and the user information 16, regenerate the key information 17, and decrypt the database 13 using the regenerated key information 17. This allows the information processing device 10 to access the database 13 safely.

The information processing device 10 may also output package data including the database management program 14 with the revision information 15 embedded therein, the encrypted database 13, and a file containing the user information 16. This allows the information processing device 10 to provide data to other users while strengthening data protection. In this case, the database management program 14 may include a module that regenerates the key information 17 and decrypts the database 13. This allows other users to perform operations on the database 13 within the permitted range under the control of the database management program 14.

[Second embodiment]
Next, a second embodiment will be described.
FIG. 2 illustrates an example of an information processing system according to the second embodiment.

The information processing system of the second embodiment has a data processing server 31 and user servers 32, 33 connected to a network 30. The network 30 may include a LAN (Local Area Network) or the Internet. The data processing server 31 corresponds to the information processing device 10 of the first embodiment.

The data processing server 31 is a server computer that generates data capsules (described later) in response to requests from the user servers 32 and 33. The data processing server 31 may be located in a data center or may be a cloud server.

The data processing server 31 receives a data capsule creation request from a certain user server. The data capsule creation request specifies the data to be stored in the data capsule and management information such as users who can access the data and restrictions on the access method. In accordance with the data capsule creation request, the data processing server 31 generates a data capsule for distributing data in a protected state and returns it to the user server. The data capsule contains encrypted data and a DBMS program that provides limited data access.

The user servers 32, 33 are server computers of users who use the services of the data processing server 31. The users may be called participants and may be individuals or companies. The user servers 32, 33 may be located in a data center or may be cloud servers. In addition, client computers may be used instead of the user servers 32, 33.

Each of user servers 32 and 33 sends a data capsule creation request to data processing server 31 and receives the created data capsule from data processing server 31. Each of user servers 32 and 33 sends data capsules to other user servers according to business requirements. For example, user server 32 may send a data capsule to user server 33, and user server 33 may send a data capsule to user server 32.

Each of user servers 32 and 33 performs data processing on the initial data stored in the data capsule by starting the DBMS program contained in the data capsule received from the other user server. However, the DBMS program may restrict data access so that the initial data itself cannot be read from the data capsule. In addition, the DBMS program may output the data processing results obtained by processing the initial data using a certain processing procedure instead of the initial data itself.

In addition, each of user servers 32 and 33 may store additional data in the received data capsule and send it back to the other user server. This allows data processing between data held by multiple users while reducing the risk of data leakage.

FIG. 3 is a block diagram showing an example of hardware of the data processing server.
The data processing server 31 has a CPU 101, a RAM 102, a HDD 103, a GPU 104, an input interface 105, a media reader 106, and a communication interface 107, all connected via a bus. The user servers 32 and 33 may have the same hardware as the data processing server 31. The CPU 101 corresponds to the processing unit 12 in the first embodiment. The RAM 102 or the HDD 103 corresponds to the storage unit 11 in the first embodiment.

The CPU 101 is a processor that executes program instructions. The CPU 101 loads at least a portion of the programs and data stored in the HDD 103 into the RAM 102 and executes the programs. The data processing server 31 may have multiple processors. A collection of processors may be called a multiprocessor or simply a "processor."

RAM 102 is a volatile semiconductor memory that temporarily stores programs executed by CPU 101 and data used in calculations by CPU 101. Data processing server 31 may have a type of volatile memory other than RAM.

The HDD 103 is a non-volatile storage that stores software programs such as an OS (Operating System), middleware, and application software, as well as data. The data processing server 31 may also have other types of non-volatile storage, such as a flash memory or an SSD (Solid State Drive).

The GPU 104 is a processor that performs image processing in cooperation with the CPU 101 and outputs images to a display device 111 connected to the data processing server 31. The display device 111 is, for example, a CRT (Cathode Ray Tube) display, a liquid crystal display, an organic EL (Electro Luminescence) display, or a projector. Note that other types of output devices, such as a printer, may also be connected to the data processing server 31.

The input interface 105 receives an input signal from an input device 112 connected to the data processing server 31. The input device 112 is, for example, a mouse, a touch panel, or a keyboard. Multiple input devices may be connected to the data processing server 31.

The media reader 106 is a reading device that reads programs and data recorded on the recording medium 113. The recording medium 113 is, for example, a magnetic disk, an optical disk, or a semiconductor memory. Magnetic disks include flexible disks (FDs) and HDDs. Optical disks include compact discs (CDs) and digital versatile discs (DVDs). The media reader 106 copies the programs and data read from the recording medium 113 to other recording media such as the RAM 102 and the HDD 103. The read programs may be executed by the CPU 101.

The recording medium 113 may be a portable recording medium. The recording medium 113 may be used for distributing programs and data. The recording medium 113 and the HDD 103 may also be referred to as computer-readable recording media.

The communication interface 107 communicates with the user servers 32 and 33 via the network 30. The communication interface 107 may be a wired communication interface connected to a wired communication device such as a switch or a router, or a wireless communication interface connected to a wireless communication device such as a base station or an access point.

Next, the data capsule generated by the data processing server 31 will be described.
FIG. 4 is a block diagram showing an example of the structure of a data capsule.
The data capsule 120 includes a customer number file 121, a configuration file 122, a management information file 123, and a data file 124. The data capsule 120 also includes a DBMS program 131, an erasure program 132, and a container program 133. The management information file 123 and the data file 124 correspond to the database 13 in the first embodiment. The DBMS program 131 corresponds to the database management program 14 in the first embodiment.

The customer number file 121 is a file in which the customer number is recorded. The customer number corresponds to the user information 16 in the first embodiment. This customer number is the identification number of the user who requested the data processing server 31 to create the data capsule 120, i.e., the user who stored the initial data in the database. However, the customer number may also be the identification number of the user to whom the data capsule 120 is to be transferred. The customer number file 121 is not encrypted.

The configuration file 122 is a file in which a file path indicating the location of the management information file 123 in the data capsule 120 is written. The configuration file 122 is encrypted.
The management information file 123 is a file in which management information used for controlling access to the database is written. The management information file 123 includes the file paths of the data files 124. The management information file 123 also includes a user definition 125, an authority definition 126, a data structure definition 127, and a procedure definition 128.

User definition 125 indicates the users who can access the database. The users may be identified by their user name, customer number, server name of the user's server, or communication address of the user's server. Authority definition 126 indicates the types of data operations permitted for each user. For example, it specifies whether data search, data insertion, data update, and data deletion are each permitted for each relational table.

The data structure definition 127 indicates the table structure of a relational database. Note that although the data capsule 120 uses a relational database, a non-relational database such as a tree database or a network database may also be used.

Procedure definition 128 indicates a stored procedure. A stored procedure is a program that describes a series of data processing operations that are difficult to describe in a single SQL statement. A stored procedure is written using a procedure description language that extends SQL. When a stored procedure call command is received in place of an SQL statement, the stored procedure is executed. By using a stored procedure appropriately, the data contained in the database itself is prevented from being output outside the data capsule 120.

The management information file 123 is encrypted. The unit of encryption may be coarse-grained, such as the entire management information file 123, or fine-grained, such as user definition 125 or authority definition 126, with each item of the management information file 123 as a unit.

Data file 124 is a file that contains records of tables in a relational database. Data file 124 is encrypted. The unit of encryption may be coarse-grained, such as the entire data file 124, or fine-grained, such as table-by-table or record-by-record.

DBMS program 131 is a limited version of a DBMS program with limited functionality compared to a normal DBMS program. DBMS program 131 may not have the functionality to change management information file 123. Furthermore, DBMS program 131 may not have the functionality to execute some of the data operations, such as data update and data deletion, among data search, data insertion, data update, and data deletion.

A revision number 134 is embedded in the DBMS program 131. The revision number 134 is an identification number that identifies the DBMS program 131. Each time the data processing server 31 issues a data capsule for a new case, it assigns a new revision number and embeds it in the restricted version of the DBMS program.

The DBMS program 131 includes a key generation module 135 and a data access module 136. The key generation module 135 generates an encryption key for decrypting the configuration file 122 and the management information file 123, and for decrypting and re-encrypting the data file 124. The encryption key in the second embodiment is a common key in a common key cryptosystem. However, the encryption key may also be a public key and a private key in a public key cryptosystem.

The key generation module 135 generates an encryption key according to a specific key generation algorithm from the revision number 134 embedded in the DBMS program 131 and the customer number written in the customer number file 121. This encryption key is the same as the encryption key used by the data processing server 31 when generating the data capsule 120. The encryption key used when generating the data capsule 120 is not stored, but is regenerated when the data capsule 120 is used. However, instead of generating an encryption key by itself, the key generation module 135 may send the revision number 134 and the customer number to the data processing server 31 to request regeneration of the encryption key, and receive the encryption key regenerated by the data processing server 31.

The data access module 136 provides users with limited access to the data file 124. The data access module 136 receives a request message from the user and verifies that the contents of the request message are within the scope of the user's authority based on the user definition 125 and the authority definition 126. The data access module 136 then executes the SQL statement contained in the request message or the stored procedure specified by the request message against the relational tables included in the data file 124.

For the above data processing, the data access module 136 performs decryption and re-encryption using the encryption key regenerated by the key generation module 135. The data access module 136 may decrypt the entire configuration file 122, management information file 123, and data file 124 when the DBMS program 131 is started. The data access module 136 may also decrypt the portions of the management information file 123 and data file 124 that are to be used when accessing a relational table. The data access module 136 may also re-encrypt the data file 124 when updating a relational table.

When generating the data capsule 120, the data processing server 31 generates and encrypts the configuration file 122, management information file 123, and data file 124 using a standard version of the DBMS program with no functional restrictions. The data processing server 31 inputs management information and data into the standard version of the DBMS in accordance with the data capsule creation request. After the configuration file 122, management information file 123, and data file 124 have been generated, the data processing server 31 replaces the standard version of the DBMS program with the DBMS program 131.

The erasure program 132 is a program that deletes the management information file 123 and the data file 124 in response to an instruction from the container program 133 to prevent data leakage. The erasure program 132 first deletes the management information file 123, and then deletes the data file 124. The management information file 123 and the data file 124 are deleted by overwriting specific bits in the storage area in which the management information file 123 and the data file 124 are stored to make them unrecoverable.

Container program 133 is a representative program for encapsulating data capsule 120 into a single file. When attempting to start data capsule 120, container program 133 is executed first. When container program 133 is started, it performs user authentication using a customer number and password. Container program 133 may hold account information indicating the correspondence between customer numbers and correct passwords. If user authentication is successful, container program 133 starts DBMS program 131.

The container program 133 also initiates a status check to continuously verify that the data capsule 120 is not being used unauthorizedly. If the container program 133 detects an event that may indicate unauthorized use of the data capsule 120, it decides to disable the data capsule 120 and launches the erasure program 132.

To check the status, the container program 133 periodically communicates with the data processing server 31 after startup. However, the communication partner of the container program 133 may be a specific server other than the data processing server 31. If an inability to communicate is detected, the container program 133 decides to disable the data capsule 120. The container program 133 also confirms that the current time has not passed the expiration date. The container program 133 may retain information about the expiration date of the data capsule 120. If the current time has passed the expiration date, the container program 133 decides to disable the data capsule 120.

The container program 133 also detects unauthorized intrusion by monitoring the results of user authentication for the data capsule 120. If the results of multiple user authentications match a specific pattern, the container program 133 determines that there is a possibility of unauthorized intrusion and decides to disable the data capsule 120. An example of an unauthorized intrusion pattern is when the number of user authentication failures exceeds a threshold within a time T1, followed by successful user authentication within the following time T2. The status check detects the possibility that the data capsule 120 has been transferred to an unauthorized person, or that an unauthorized person has illegally intruded into the data capsule 120.

Next, the functions of the data processing server 31 will be described.
FIG. 5 is a block diagram illustrating an example of software for the data processing server.
The data processing server 31 has a management table storage unit 141 and a program storage unit 142. These storage units are implemented, for example, using the RAM 102 or the HDD 103. The data processing server 31 also has a request receiving unit 143, a case management unit 144, a key generating unit 145, a data storage unit 146, a build unit 147, and a monitoring unit 148. These processing units are implemented, for example, using the CPU 101 and a program.

The management table storage unit 141 stores a capsule management table. The capsule management table associates, for each case for which a data capsule is to be created, the revision number of a restricted version of the DBMS with the customer number of the user who registers the initial data in the database.

The program storage unit 142 stores the normal version of the DBMS program. The program storage unit 142 also stores the source code of the restricted version of the DBMS program, as well as an erasure program and a container program to be incorporated into the data capsule.

The request receiving unit 143 communicates with the user servers 32 and 33. The request receiving unit 143 provides a web interface to the user servers 32 and 33 and receives a data capsule creation request from either the user servers 32 and 33.

The request receiving unit 143 notifies the case management unit 144 of the customer number included in the data capsule creation request, and obtains the revision number and encryption key from the case management unit 144. The request receiving unit 143 notifies the data storage unit 146 of the encryption key, and the user definition, authority definition, data structure definition, procedure definition, and data included in the data capsule creation request. The request receiving unit 143 notifies the build unit 147 of the revision number and customer number, obtains the generated data capsule from the build unit 147, and returns it to the user server.

The case management unit 144 refers to the capsule management table stored in the management table memory unit 141 and assigns a new revision number to be used in the new case. The case management unit 144 associates the revision number with the customer number and registers them in the capsule management table. The case management unit 144 notifies the key generation unit 145 of the revision number and customer number, obtains the encryption key from the key generation unit 145, and notifies the request receiving unit 143 of the encryption key and revision number.

The key generation unit 145 generates an encryption key from the customer number and the revision number according to a specific key generation algorithm. For example, the key generation unit 145 generates a character string by combining the customer number and the revision number, inputs the generated character string to a function such as a hash function, and uses the bit string output by the function as the encryption key.

The data storage unit 146 uses the standard version of the DBMS program stored in the program storage unit 142 to register user definitions, authority definitions, and procedure definitions in the management information. The data storage unit 146 also uses the standard version of the DBMS program to register data structure definitions in the management information and register data in the relationship table. At this time, the data storage unit 146 encrypts the management information and the relationship table using an encryption key obtained from the request receiving unit 143. As a result, a configuration file, a management information file, and a data file are generated.

The build unit 147 embeds the revision number obtained from the request receiving unit 143 in the source code of the restricted version of the DBMS program stored in the program storage unit 142, and builds the restricted version of the DBMS program. The build includes compiling the source code and linking the libraries. The build unit 147 also generates a customer number file that lists the customer number obtained from the request receiving unit 143.

The build unit 147 reads the erasure program and the container program from the program storage unit 142. The build unit 147 encapsulates the customer number file, configuration file, management information file, data file, restricted version of the DBMS program, the erasure program, and the container program to generate a data capsule. The data capsule corresponds to an image file that combines a group of files on a storage device into a single file while retaining the directory hierarchy. The build unit 147 provides the data capsule to the request receiving unit 143.

The monitoring unit 148 communicates with the data capsules provided to the user servers 32 and 33 and tracks those data capsules. While the restricted version of the DBMS program is being executed, the monitoring unit 148 periodically receives messages from the container program and returns response messages. Note that the monitoring unit 148 may be implemented in a server different from the data processing server 31.

FIG. 6 is a diagram showing an example of a capsule management table.
Capsule management table 151 is stored in management table storage unit 141. Capsule management table 151 associates case number, revision number, customer name, customer number, case name, creation date, and expiration date. The case number is an identification number that identifies the case for which a new data capsule is provided. The revision number is an identification number that identifies a restricted version of the DBMS program, and is assigned for each case. The customer name is the name of the user who registers initial data in the database. The customer number is an identification number that is assigned to the user in advance.

The case name is a name indicating the purpose of the data capsule. The creation date is the date on which the data processing server 31 generated the data capsule. The expiration date is the date by which the generated data capsule can be used. Data capsules that have passed their expiration date are invalidated and the database is erased. The expiration date is specified by the user in the data capsule creation request.

FIG. 7 is a diagram illustrating an example of generation of an encryption key.
Key generation unit 145 accepts revision number 152 and customer number 153. Key generation unit 145 inputs revision number 152 and customer number 153 to key generation algorithm 154 to generate encryption key 155. For example, key generation unit 145 combines revision number 152 and customer number 153 and inputs them to key generation algorithm 154.

The restricted version DBMS program inputs the revision number 152 embedded in the restricted version DBMS program and the customer number 153 written in the customer number file to the key generation algorithm 154 to regenerate the encryption key 155. However, the restricted version DBMS program may output the revision number 152 and the customer number 153 to request an external module of the restricted version DBMS program to regenerate the encryption key 155.

Next, a processing procedure of the data processing server 31 that generates a data capsule and a processing procedure of the user server 32 that uses the data capsule will be described.
FIG. 8 is a flowchart showing an example of a procedure for generating a data capsule.

(S10) The request receiving unit 143 receives a data capsule creation request.
(S11) The case management unit 144 assigns a new revision number by referring to the capsule management table 151. The case management unit 144 records the revision number in the capsule management table 151 together with the customer number included in the data capsule creation request.

(S12) The key generation unit 145 generates an encryption key from the revision number and the customer number.
(S13) The data storage unit 146 uses the normal version of the DBMS program to register the user definition, authority definition, and procedure definition included in the data capsule creation request in the database. The data storage unit 146 encrypts this definition information using an encryption key.

(S14) The data storage unit 146 uses the standard version of the DBMS program to register the data structure definition and the data body in the database. The data storage unit 146 encrypts the definition information and data using an encryption key.

(S15) The data storage unit 146 discards the encryption key used above.
(S16) The build unit 147 embeds the revision number in the source code of the restricted version of the DBMS program, and builds the restricted version of the DBMS program having the revision number.

(S17) The build unit 147 further adds a customer number file, an erasure program, and a container program to the configuration file, management information file, and data file generated by the normal version of the DBMS program, and to the restricted version of the DBMS program. The build unit 147 encapsulates these files and programs to generate a data capsule.

(S18) The request receiver 143 transmits the generated data capsule.
FIG. 9 is a flowchart showing an example of a procedure for using a data capsule.
(S20) The user server 32 starts the container program 133 and inputs the customer number and password into the container program 133 to perform user authentication.

(S21) The user server 32 determines whether the container program 133 has detected an event that would invalidate the data capsule 120. Invalidation events include failure of periodic communication with the data processing server 31, the occurrence of a user authentication result that suggests unauthorized intrusion, and expiration of the expiration date. If an invalidation event is detected, processing proceeds to step S28, otherwise processing proceeds to step S22.

(S 22 ) The user server 32 starts the DBMS program 131 .
(S 23 ) The user server 32 extracts the revision number embedded in the DBMS program 131 , and extracts the customer number from the customer number file 121 .

(S24) The user server 32 generates an encryption key from the extracted revision number and customer number using the DBMS program 131.
(S 25 ) The user server 32 decrypts the management information file 123 using the DBMS program 131 , and confirms the authority of the user of the user server 32 .

(S26) The user server 32 decrypts the data file 124 using the DBMS program 131, and executes the query or stored procedure specified by the user.
(S27) The user server 32 discards the encryption key generated by the DBMS program 131. Then, use of the data capsule ends.

(S 28 ) The user server 32 starts the erasure program 132 and erases the management information file 123 and the data file 124 from the data capsule 120 .
As described above, the data processing server 31 of the second embodiment generates and provides a data capsule in response to a request from a user. The data capsule includes a restricted version of a DBMS program and an encrypted database. This limits the users who can read data from the database, and the stored procedure processes the data without outputting the data itself outside the data capsule. This allows multiple users to transfer data used in business while reducing the risk of data leakage.

In addition, the encryption key for decrypting the database is not stored, but is generated each time the database is used from the revision number embedded in the restricted version of the DBMS program and the database's customer number. This links the restricted version of the DBMS program to the database, making it difficult to decrypt the database without using the correct DBMS program. This makes it more difficult for a third party to weaken the protection of the database by replacing the DBMS program, reducing the risk of data leakage.

The data capsule also includes a container program that detects events that require the data capsule to be invalidated, and an erasure program that invalidates the data capsule by erasing the database. The container program detects events such as failure to communicate with a server that tracks the data capsule, expiration of the validity period, and unauthorized breach of user authentication. This reduces the risk of data leakage if the data capsule is illegally transferred to a third party.

The foregoing merely illustrates the principles of the present invention. Further, since numerous modifications and changes are possible to those skilled in the art, the present invention is not limited to the exact construction and application shown and described above, and all corresponding modifications and equivalents are deemed to be within the scope of the present invention according to the appended claims and their equivalents.

REFERENCE SIGNS LIST 10 Information processing device 11 Storage unit 12 Processing unit 13 Database 14 Database management program 15 Revision information 16 User information 17 Key information

Claims (7)

acquiring revision information for identifying a database management program for managing a database and user information indicating a user of the database;
generating key information using the acquired revision information and user information;
encrypting the database using the generated key information;
After the database is encrypted, discarding the generated key information.
A method of managing how a process is carried out by a computer. reacquiring the revision information and the user information;
regenerating the key information using the reacquired revision information and the user information;
decrypting the database using the regenerated key information;
The management method according to claim 1 , further comprising the step of: generating package data including the database management program in which the revision information is embedded, the encrypted database, and a file in which the user information is described, and outputting the package data;
The management method according to claim 1 , further comprising the step of: the database management program includes a module that regenerates the key information from the revision information embedded in the database management program and the user information described in the file, and decrypts the database using the regenerated key information;
The management method according to claim 3. the database management program included in the package data restricts changes to management information that defines an access method for the database;
The management method according to claim 3. a storage unit that stores a database and a database management program that manages the database;
a processing unit that acquires revision information for identifying the database management program and user information indicating a user of the database, generates key information using the acquired revision information and user information, encrypts the database using the generated key information, and discards the generated key information after the database has been encrypted;
An information processing device having the above configuration. acquiring revision information for identifying a database management program for managing a database and user information indicating a user of the database;
generating key information using the acquired revision information and user information;
encrypting the database using the generated key information;
After the database is encrypted, discarding the generated key information.
A management program that causes a computer to carry out processing.

Images