JP5339970B2 - Information processing system, information processing method, and information processing program - Google Patents

Description

  The present invention relates to a technique for enhancing the security of data held by a terminal connected to a network.

  Conventionally, security management of data handled in an apparatus accessing the Internet has been an important theme, and various technical proposals have been made in this regard (Patent Document 1 and the like).

  On the other hand, in a PC terminal used by a user, encryption with a certain key may be used for security enhancement such as information leakage. Broadly speaking, the following two types of encryption measures are taken. . The first is to set an encryption key for each individual data file, and the second is to uniformly encrypt and manage all data by the encryption system.

Special table 2004-503969 gazette

  However, in the above technology, when individually setting encryption, the set password is often forgotten, and when the entire system is uniformly encrypted with an arbitrary key, once the encryption key leaks, There is a problem that it is necessary to take measures such as re-encrypting the data.

  In addition, data is usually used using a PC terminal connected to the network, but unencrypted confidential information is attached to an e-mail and sent, or confidential information is not sent to authorized network locations. There is also a problem that information leakage occurs when it is taken out.

  Furthermore, it may be possible to encrypt confidential information using identification information unique to the PC terminal, such as an IP address, but it is impossible to prevent leakage of confidential information due to unintended third party impersonation. There are also problems.

  Accordingly, in the present invention, in view of the above problems, an information processing system, an information processing method, and an information processing program that enable use of secret data only within a predetermined network and prevent leakage of secret data outside the network. The purpose is to provide.

  In the disclosed information processing system, as a mechanism for solving the information leakage problem as described above, a file is encrypted and decrypted with an encryption key managed based on a unique key on the network. Adopt a mechanism to prevent information leakage to the outside. By adopting this mechanism, encryption is performed with an encryption key corresponding to the network unique key, so that it is possible to prevent unauthorized use of secret data taken out of the network. In addition, since encryption and decryption are performed automatically when the user terminal is connected to the network, there is no need for the user to be aware of the encryption key, preventing the problem of forgetting the encryption key and the problem of leakage of the encryption key. can do.

  In the disclosed information processing system, the secret data can be used only within a predetermined network, and leakage of the secret data to the outside of the network can be prevented.

It is a figure which shows an example of the hardware constitutions of the terminal which concerns on this Embodiment. It is a figure which shows an example of the hardware constitutions of the authentication server which concerns on this Embodiment. It is a figure which shows an example of the hardware constitutions of the key information storage server which concerns on this Embodiment. It is a figure explaining the principle of operation of the information processing system concerning this embodiment. It is a figure which shows an example of key information DB which concerns on this Embodiment. It is a flowchart of the example of a process by the information processing system which concerns on this Embodiment.

The best mode for carrying out the present invention will be described with reference to the drawings.
(Hardware configuration example of information processing system according to the present embodiment)
A hardware configuration example of the terminal 200, the authentication server 400, and the key information storage server 600 included in the information processing system 100 according to the present embodiment will be described with reference to FIG.

  The terminal 200 includes a CPU (Central Processing Unit) 310, a ROM (Read-Only Memory) 320, a RAM (Random Access Memory) 330, an HDD (Hard Disc Drive) 340, a communication I / F (InterFace) 350, and a display device 360. Have.

  The CPU 310 is a device that executes a program stored in the ROM 320. The CPU 310 performs arithmetic processing on data expanded (loaded) in the RAM 330 in accordance with a program instruction, and controls the entire terminal 200. The ROM 320 stores programs and data executed by the CPU 310. When the program stored in the ROM 320 is executed by the CPU 310, the RAM 330 is loaded (loaded) with the program and data to be executed, and temporarily holds the operation data during the operation. The HDD 340 is a device that stores an OS (Operating System) that is basic software, an application program according to the present embodiment, and the like together with related data.

  The communication I / F 350 is an interface for transmitting / receiving information (data) to / from peripheral devices (such as the authentication server 400) having other communication control functions connected via a communication network. The terminal 200 is connected to a LAN (Local Area Network) via a communication I / F 350 and stores an authentication server 400 or key information connected to the LAN according to a communication protocol such as TCP / IP (Transmission Control Protocol / Internet Protocol). Data is transmitted to and received from the server 600.

  The display device 360 includes a key switch using a hard key, an LCD (Liquid Crystal Display), and the like, and functions as a user interface when the user uses the functions of the terminal 200 or when performing various settings.

  The authentication server 400 includes a CPU 510, a ROM 520, a RAM 530, an HDD 540, a communication I / F 550, and a display device 560. The function of each device is the same as that of the terminal 200.

  The key information storage server 600 includes a CPU 710, a ROM 720, a RAM 730, an HDD 740, a communication I / F 750, and a display device 760. The function of each device is the same as that of the terminal 200.

  The processing by each unit included in the terminal 200, the authentication server 400, and the key information storage server 600 corresponds to the processing by each unit stored in the ROM 320, 520, 720 or the HDD 340, 540, 740 by the CPU 310, 510, 710. It is good also as a form implement | achieved by running a program, and good also as a form which implement | achieves the process of the said means by hardware.

(Operation principle of information processing system according to this embodiment)
The operation principle of the information processing system 100 according to the present embodiment will be described with reference to FIG. As illustrated in FIG. 4, the information processing system 100 includes a terminal 200, an authentication server 400, and a key information storage server 600. Here, the terminal 200 is a terminal device that is used while connected to a network such as the Internet or a LAN, for example, a PC terminal that is directly operated by a user. The authentication server 400 is a device that determines (authenticates) whether or not the terminal 200 can be connected to the network when the user uses the terminal 200 connected to the network. Any method may be used for authentication by the authentication server 400. For example, the authentication server 400 may be configured in accordance with SIP (Session Initiation Protocol).

  The terminal 200 includes a key information acquisition request unit 210, a decryption unit 220, an encryption unit 230, and encryption target data 240. The encryption target data 240 is, for example, data stored in the HDD 340, and is encrypted to increase data security. Further, the encryption target data 240 may be stored in a file server outside the terminal 200 and may be a target of information processing on the terminal 200.

  The key information acquisition request unit 210 requests the authentication server 400 to acquire key information for decrypting the encryption target data 240 from the key information storage server 600. Here, the request by the key information acquisition request unit 210 includes communication path identification information for identifying a communication path used when data communication is performed between the terminal 200 and the authentication server 400. The key information acquisition request unit 210 may be configured as a network connection request made in accordance with SIP.

  Here, the communication path identification information may be a line number of a line connecting the terminal 200 and the authentication server 400, and is a telephone number of a telephone line used when a request by the key information acquisition request unit 210 is transmitted. There may be. Further, the communication path identification information may be information that combines these line number or telephone number and the identification information of the terminal 200. By doing so, the degree of security by encryption can be increased. On the other hand, the terminal 200 and the authentication server 400 may be connected via a wireless line or may be connected via a wired line.

  The decryption unit 220 decrypts the encrypted data 240 to be encrypted using the key information notified by the key information notification unit 610. The encryption unit 230 re-encrypts the decrypted data to be encrypted 240 using the key information notified by the key information notification unit 610. The decryption unit 220 and the encryption unit 230 may be configured to delete the key information notified by the key information notification unit 610 at the timing when the decryption or encryption of the encryption target data 240 is completed.

  The authentication server 400 includes an identification information acquisition unit 410 and a key information notification request unit 420. The identification information acquisition unit 410 extracts communication path identification information and terminal information from the request by the key information acquisition request unit 210. For example, when there is a SIP network connection request from the terminal 200, a line number or the like is extracted from the connection request.

  The key information notification request unit 420 notifies the key information storage server 600 of the communication path identification information acquired by the identification information acquisition unit 410 and also requests the key information corresponding to the communication path identification information.

  The key information storage server 600 includes a key information notification unit 610 and a key information DB 620. An example of the key information DB 620 will be described with reference to FIG. As shown in FIG. 5, in the key information DB 620, communication path identification information (for example, a line number) that is a network unique key and key information are held in association with each other. In FIG. 5, for example, the key information corresponding to the line number “1000015” is “aaabbbccc”, and the key information corresponding to the line number “2000023” is “ddeeffff”. Further, by associating a plurality of line numbers such as line numbers “1000015” and “1000011” with specific key information such as key information “aaabbbccc”, the bases desired to have the same security level are grouped and managed. be able to.

  The key information notification unit 610 searches the key information DB 620 for the communication path identification information notified by the key information notification request unit 420, and extracts the key information held in association with the communication path identification information. Thereafter, the key information notifying unit 610 notifies the terminal 200 of the extracted key information. Here, the key information notifying unit 610 may be configured to notify the terminal 200 of the key information via the authentication server 400, or may be configured to notify the terminal 200 of the key information directly without using the authentication server 400. Also good.

  Based on the operation principle as described above, the information processing system 100 encrypts data with an encryption key corresponding to a network unique key, so that data taken out of a predetermined network is illegally used. Can be prevented. Further, in the information processing system 100, since encryption and decryption are automatically performed by connection of a user terminal, there is no need for the user to be aware of the encryption key, the problem of forgetting the encryption key, encryption Problems associated with key leakage can be prevented.

(Processing example by information processing system according to the present embodiment)
A processing example by the information processing system 100 will be described with reference to FIG. In S10, the encryption tool included in the terminal 200 is activated. Here, as illustrated in FIG. 4, the terminal 200 holds encrypted data 240 that has been encrypted, for example, in the HDD 340.

  In S20, the key information acquisition request unit 210 requests the authentication server 400 to acquire key information for decrypting the encryption target data 240 from the key information storage server 600. Here, the key information acquisition request unit 210 may be performed as a network connection request performed in accordance with SIP, and the specification conforms to ITU-T NGN Release 1.

  In step S30, the identification information acquisition unit 410 acquires the line number “1000015” as the communication path identification information from the request by the key information acquisition request unit 210.

  In S30, the key information notification request unit 420 notifies the key information storage server 600 of the line number “1000015” acquired by the identification information acquisition unit 410 and the terminal information, and the key information corresponding to the line number. Request to be notified.

  In S <b> 40, the key information notification unit 610 acquires the notification of the line number “1000015”, terminal information, and key information notified by the key information notification request unit 420. In step S50, the key information notifying unit 610 searches the key information DB 620 shown in FIG. 5 for the line number “1000015”, and extracts the key information “aaabbbccc” stored in association with the line number “1000015” from the key information DB 620. To do. If there is no line number “1000015” in the key information DB 620, the key information notification unit 610 notifies the terminal 200 of that fact in S50. In this case, since the encryption target data 240 cannot be decrypted, the user cannot operate the data.

  In step S60, the key information notifying unit 610 notifies the terminal 200 of the key information “aaabbbccc” extracted in step S50. In S <b> 70, the decryption unit 220 obtains the key information “aaabbbccc” notified by the key information notification unit 610. In S80, the decryption means 220 decrypts the encrypted data to be encrypted 240 using the acquired key information “aaabbbccc”. With this processing, the encryption target data 240 is ready for processing by the user. In S70, the encryption unit 230 obtains the key information “aaabbbccc” notified by the key information notification unit 610. In S80, the encryption unit 230 uses the obtained key information “aaabbbccc” to perform encryption. Data 240 may be encrypted. As a result of this processing, the encryption target data 240 is in a state where it cannot be processed by the user unless it is decrypted with the regular key information.

  In S90, the decryption means 220 or the encryption means 230 deletes the acquired key information “aaabbbccc”. This process prevents unintentional leakage of key information. And the encryption tool with which the terminal 200 is provided is complete | finished by S100.

  Based on the above processing, in the information processing system 100, the data is encrypted with the encryption key corresponding to the network unique key, so that it is possible to prevent unauthorized use of the data taken out of the predetermined network. it can. Further, in the information processing system 100, since encryption and decryption are automatically performed by connection of a user terminal, there is no need for the user to be aware of the encryption key, the problem of forgetting the encryption key, encryption Problems associated with key leakage can be prevented.

  Although the embodiment of the present invention has been described in detail above, the present invention is not limited to the specific embodiment, and various modifications are possible within the scope of the gist of the present invention described in the claims.・ Change is possible.

DESCRIPTION OF SYMBOLS 100 Information processing system 200 Terminal 210 Key information acquisition request means 220 Decryption means 230 Encryption means 240 Encryption object data 310, 510, 710 CPU
320, 520, 720 ROM
330, 530, 730 RAM
340, 540, 740 HDD
350, 550, 750 Communication I / F
360, 560, 760 Display device 400 Authentication server 410 Identification information acquisition means 420 Key information notification request means 600 Key information storage server 610 Key information notification means 620 Key information DB

Claims (7)

A terminal having encrypted data; an authentication server for determining whether or not the terminal can connect to the network; a line number for identifying a line path connecting the terminal and the authentication server; and decrypting the data An information processing system having a key information storage server that associates and holds key information,
The authentication server is
Identification information acquisition means for acquiring the line number from the key information acquisition request by the terminal via the line path;
Key information notification requesting means for requesting notification of key information including the line number acquired by the identification information acquiring means,
The key information storage server
Storage means for storing a plurality of different line numbers and one key information in association with each other,
When the notification of the key information is Ru required by the key information notification request means, the key information associated with the line number contained in the notification of said key information, a key information notifying unit that notifies the terminal,
The terminal
An information processing system comprising decryption means for decrypting the data using the key information notified by the key information notification means. The line number information according to claim 1, wherein the said line number, that the information of a combination of a telephone number of the telephone line used when transmitting a request to acquire the key information by the terminal Processing system.   The information processing system according to claim 1, wherein the key information acquisition request by the terminal is an authentication request for the network connection made to the authentication server.   The information processing system according to claim 3, wherein the network connection authentication request is made according to SIP (Session Initiation Protocol). The terminal further includes
5. The information processing system according to claim 1, further comprising an encryption unit configured to encrypt data to be encrypted using the key information notified by the key information notification unit. A terminal having encrypted data; an authentication server for determining whether or not the terminal can connect to the network; a line number for identifying a line path connecting the terminal and the authentication server; and decrypting the data An information processing method in an information processing system having a key information storage server that associates and holds key information,
The authentication server is
An identification information obtaining unit obtaining the line number from an acquisition request for the key information by the terminal via the communication path;
A key information notification requesting unit requesting notification of the key information including the line number acquired by the identification information acquiring unit,
The key information storage server
Associating and storing a plurality of different line numbers and one key information;
The key information notifying unit, the notification of the key information is Ru requested by the key information notification request means, the key information associated with the line number contained in the notification of said key information, a step of notifying the terminal Have
The terminal
An information processing method comprising: a step of decrypting the data by using the key information notified by the key information notifying unit.   An information processing program for causing a computer to execute the information processing method according to claim 6.

Images