JP4084971B2 - Data protection apparatus, data protection method and program used in electronic data exchange system - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a data protection apparatus, a data protection method, and a program used therefor in an electronic data interchange (Electronic Data Interchange, hereinafter referred to as “EDI”) system using a server system placed on the Internet.
[0002]
[Prior art]
In recent years, with the widespread use of the Internet, the movement to digitize the exchange of data such as slips and drawings between companies is rapidly expanding. In particular, exchanges with affiliated companies using the EDI system are effective in reducing labor and time compared to conventional paper-based transactions using postal mails and the like, and are being widely spread.
[0003]
Here, in the EDI system by the Internet, since the Internet is an extremely open environment, the vulnerability of data protection becomes a problem. In order to realize an EDI system using the Internet, it is necessary to place data for EDI outside the firewall, and thus it is necessary to protect the data outside the firewall.
[0004]
For such data protection problems, methods based on information encryption and security protocols have been proposed and put into practical use. In addition, a method of managing security according to the authority and affiliation of a user or the confidentiality of a content file has been proposed, and data protection can be performed with fine detail.
[0005]
[Problems to be solved by the invention]
However, in the above conventional technology, the management is performed with the access right set in advance, and there is a problem that the security cannot be detected when improper access occurs due to impersonation or the response is delayed even if it is detected. .
[0006]
The present invention has been made in order to solve the above-described problems. In the EDI system using the Internet, it is possible to eliminate unauthorized access and manage security with high security capable of promptly responding to unauthorized access. It is an object to provide a data protection device, a data protection method, and a program used therefor.
[0007]
[Means for Solving the Problems]
  A data protection device according to the present invention is a data protection device in an electronic data exchange system by a server system placed on the Internet,
  The server system includes a content server that stores files that users access via the Internet,
  the aboveUserRespectivelyThe security level previously assigned according to the electronic data management abilityManagement database in which is registeredWhenthe aboveTo fileRespectivelySecurity level granted according to the contentContent management database in which is registeredManagement information holding means for holding
  the aboveEach userAbout how to access when the above content server is accessedAccess result information holding means for holding access result information,
  When the user requested access to the content server, it was registered in the user management database of the userSecurity level and above fileRegistered in the content management databaseCompare security levels,Registered in the user management database of the userSecurity levelThe concernedUserFrom the access record information held in the access record information holding means and the access method when the user makes an access request to the file,Calculate the security level and calculateNewThe security level and the file that requested accessRegistered in the content management databaseThe above access request was made by comparing the security level.ConcernedUserNoA determination means for determining whether access is permitted;
  When the determination means determines that access is permitted, the access request is made to the requested file via the Internet.ConcernedMeans for sending to the client on the user side,
Is provided.
[0008]
The image processing apparatus includes encryption processing means for encrypting and decrypting each file and encrypted content storage means for storing the encrypted file.
[0009]
Further, a UDF (Universal Disc Format) file system is used as the installation location of the encrypted content storage means and the management information holding means.
[0010]
  Also, the access request is made by the determination means.ConcernedWhen it is determined that the user's access is not permitted, the access request is madeConcernedUserIn the above user management databaseRegisteredIs itAn authentication means for performing re-authentication to confirm whether or not, in the authentication means,The user is registered in the user management database.When it is determined that access can be permitted, the transmission means makes the access request to the requested file via the Internet.ConcernedIt is sent to the client on the user side.
[0011]
  Also, the access request is made by the determination means.ConcernedIf it is determined that user access is not permitted, the administrator who manages the server systemIt was determined that the user's access is not allowedA notification means for notifying the result of the determination is provided.
[0012]
  Also, the management information holding meansAnd the access record information holding means dataProvided in the storage device, and in the storage deviceOSAre provided in an area that is not normally accessed.
[0013]
  Also onWritingA sector address acquiring means for acquiring a sector address of an area which is not normally accessed; and a writing means for writing information to be held in the management information holding means to a sector having a sector address acquired by the sector address acquiring means; And reading means for reading the information written by the writing means.
[0014]
  Also, the determination meansPrograms that function as, Via a communication line different from the InternetLocated in the program storage unit connected to the content server,When executing judgment meansLoaded from the program storage unit to the content server via the communication lineIs.
[0015]
  A data protection method according to the present invention is a data protection method in an electronic data exchange system in an electronic data exchange system by a server system placed on the Internet,
  The server system includes a content server that stores files that users access via the Internet,
  A security level is given in advance to each of the users according to the management ability of the electronic data,
  Each of the above files is given a security level according to its contents.
  The content server has an access record information holding means for holding access record information related to an access method when each user accesses the content server,
  The content server
  A first step of receiving a request for access to a file from a user via the Internet;
  Requested accessGiven aboveThe user's security level and the requested fileGiven aboveA second step of comparing the security level;
  Of the user who requested accessGiven aboveSecurity level of the requested fileGiven aboveIf it is lower than the security level, access is not permitted and the user who requested access is not allowed.Given aboveSecurity level of the requested fileGiven aboveIf it is greater than the security level,The user's previously givenSecurity level andThe access record information held in the access record information holding unit of the user and,From the access method when the user makes an access request to the file, the user's newThe third step of calculating the security level;
  The calculatedNewThe security level of the requested fileGiven aboveA fourth step of comparing the security level;
  Result of comparison in the fourth stepDetermining whether the calculated new security level is higher than the previously assigned security level of the file requested to be accessed, and determining whether the calculated new security level of the file requested to be accessed is Judge that access is permitted if the security level is higher than the pre-assigned security level5th step to
  In the fifth step, when it is determined that access is permitted, the access request is made to the requested file via the Internet.ConcernedA sixth step of sending to the user side client;
TheExecuteIs.
[0016]
Further, each file is encrypted and transmitted to the client on the user side who requested the access.
[0017]
The encrypted file, the security level of the user, and the security level of the file are stored using a UDF (Universal Disk Format) file system.
[0018]
  Further, when it is determined in the fifth step that access of the user who has requested the access is not permitted, the user who has requested the accessIn the content management databaseRegisteredIs itAn authentication means for performing re-authentication to confirm whether or not, in the authentication means,The user is registered in the user management databaseWhen it is determined that access can be permitted, the access request is made to the requested file via the Internet.ConcernedIt is sent to the client on the user side.
[0019]
  In addition, the access request is made in the fifth step.ConcernedIf it is determined that user access is not permitted, the administrator who manages the server systemDetermined that the user who requested the above access is not allowed to accessThe result of determination is notified.
[0020]
  In addition, the above userGiven aboveSecurity level and above fileGiven aboveThe security level is stored in the storage device.OSAre provided in an area that is not normally accessed.
[0021]
  Also onWritingA sector address of an area that is not normally accessed is acquired, information on the security level of the user and the security level of the file is written in a sector having the acquired sector address, and the written information is read.
[0022]
  In addition, the first to the above5th stepRunProgram used forThrough a separate communication line from the InternetIt is placed in a program storage unit connected to the content server, and is loaded from the program storage unit to the content server via the communication line when the content server executes the first to fifth steps.Is.
[0023]
  A program according to the present invention is a program used for data protection in an electronic data exchange system in an electronic data exchange system by a server system placed on the Internet.,
  The server system includes a content server that stores files that users access via the Internet,
The content server
  the aboveUserRespectivelyThe security level previously assigned according to the electronic data management abilityManagement database in which is registeredWhenthe aboveTo fileRespectivelySecurity level granted according to the contentContent management database in which is registeredManagement information holding means for holding
  the aboveEach userAccess result information on how to access when accessing the above content serverAccess result information holding means for holding
  When the user requested access to the content server, it was registered in the user management database of the userSecurity level and above fileRegistered in the above content management databaseCompare security levels,Registered in the user management database of the userSecurity level,ConcernedUserFrom the access record information held in the access record information holding means and the access method when the user requests access to the file,Calculate the security level and calculateNewThe security level and the file that requested accessRegistered in the content management databaseThe above access request was made by comparing the security level.ConcernedUserNoA determination means for determining whether access is permitted;
  Transmitting means for transmitting the requested file to the client on the user side who has made the access request via the Internet when the determining means determines that access is permitted;
It is to function as.
[0024]
  Also,the aboveComputerBut the content serverIt functions as an encryption processing means for encrypting and decrypting each file, and an encrypted content storage means for storing the encrypted file.
[0025]
Further, a UDF (Universal Disc Format) file system is used as the installation location of the encrypted content storage means and the management information holding means.
[0026]
  Also,the aboveComputerBut the content serverWhen the determination means determines that the access of the user who requested the access is not permitted, the access request is made.ConcernedUserIn the above user management databaseRegisteredIs itFunction as an authentication means for performing re-authentication to confirm whether or notRegistered in the user management databaseIf it is determined that access can be granted, the sending means is requestedFileMade the access request via the internetConcernedSend to user side clientTo function likeIs.
[0027]
  Also,the aboveComputerBut,The access request was made by the determination means.ConcernedIf it is determined that user access is not permitted, the administrator who manages the server systemIt was determined that the user's access is not allowedIt functions as a notification means for notifying the result of determination.
[0028]
  Also, the management information holding meansAnd the data of the access record information holding means are provided in the storage device, and are provided in an area that is not normally accessed from the OS in the storage device.Is.
[0029]
DETAILED DESCRIPTION OF THE INVENTION
Embodiments of a data protection apparatus, a data protection method, and a recording medium used therefor in an EDI system according to the present invention will be described below with reference to the drawings.
[0030]
Embodiment 1 FIG.
FIG. 1 is a block diagram illustrating an environment in which a data protection device (hereinafter simply referred to as a data protection device) in the EDI system according to the first embodiment is realized and a configuration of the data protection device.
[0031]
In FIG. 1, 1 is the Internet, 2 is an in-house LAN, 3 is a content server that holds data exchanged with a business partner, 4 is a PC (personal computer) (hereinafter referred to as a client) installed at the business partner, and 5 is, for example. The internal LAN 2 is a firewall, and information security is ensured by the firewall 5. Although there is one client 4 shown in the figure, a plurality of clients 4 can be installed.
[0032]
301 is a plaintext content storage unit, 302 is a management information storage unit (management information storage unit), and 303 is an access record information storage unit (access record information storage unit), which are provided in the content server 3. Reference numeral 401 denotes a content storage unit included in the client 4.
[0033]
A plaintext content file is stored in the plaintext content storage unit 301, and only local access is permitted to access the plaintext content file. The management information storage unit 302 stores a user management database for managing the security level of each user and a content management database for managing the security level of each content file. Hereinafter, the content management database and the user management database stored in the management information storage unit 302 are collectively referred to as management information.
[0034]
FIG. 2 is a diagram illustrating an example of the contents of the user management database. As shown in the figure, the user management database includes user name, group name, security level, name, and affiliation information.
[0035]
The security level included in the user management database indicates the security level set for each user. For example, the security level is represented by an integer from 1 to 10, and the larger the numerical value, the higher the security level.
[0036]
FIG. 3 is a diagram illustrating an example of the contents of the content management database. As shown in the figure, the content management database includes file name, access group, security level, and directory information.
[0037]
The access group of the content management database is information indicating that only users belonging to the group included in the user management database can access the file.
[0038]
The security level included in the content management database is represented by an integer from 1 to 10, for example, and the user security level is, for example, from the field, business content, etc. A high number is set for a high level, a low level is set for a low level of ability, such as a document creator, and the security level of a content file is the type of content file, for example, for reference Is low, and is set high for those that can be changed or edited. Then, when the security level set for the user is higher than the security level set for each content file, the user can access the content file.
[0039]
As described above, registration and editing of management information in the user management database and content management database described above are performed by the administrator of the content server 3 using management software using a dedicated secure API (application programming interface). Specifically, management information input from input means such as a keyboard is stored in the user management database and the content management database via a dedicated secure API provided in the content server 3. However, the registration to the content management database is performed by management software using a secure API by the administrator at the time of content file registration.
[0040]
Processing contents when the content file is actually taken out and transmitted to the client 4 side using the management information will be described below.
[0041]
First, the user logs into the client 4. Thereafter, an access request is made to the content file via the Internet 1, and the content server 3 that has received the request activates a dedicated secure API. More specifically, when the client 4 designates the port number of the FTP daemon of the content server 3, the content server 3 that recognizes the designation calls the secure API.
[0042]
  FIG. 4 is a flowchart showing the processing contents of the secure API. The access record information storage unit 303 stores access record information for calculating a security level based on the access record of each user. Hereinafter, information stored in the access record information storage unit 303 is referred to as access record information. Access record information includes user name, access cycle, access frequency and conventional access day of the week, user access pattern represented by usage time zoneThat is, access on how to accessIt is assumed that the information is included. The calculation of the security level based on the access performance of the user is based on the user security level and the userStored in the access record information storage unit 303 ofRequested access pattern and file accessof timeCalculated from the user's access pattern, for example, a request to access a fileof timeUser access pattern is normalAccess patterns stored in the access record information storage unit 303The security level is calculated to be low with respect to suspicious access, such as when it is different from the above or when it is frequently accessed in a short cycle.
[0043]
The secure API on the content server 3 side acquires information such as the user name transmitted from the client 4 and the file name of the requested content file (S401), obtains management information from the user management database and the content management database, and It functions as a determination unit that compares and determines the group name and the access group of the content file (S402).
[0044]
If the group name does not match, the content file cannot be accessed.
[0045]
As a result of the determination, if the group names match, the secure API on the content server 3 side compares and determines the security level (S404).
[0046]
As a result of the determination, if the security level of the user is lower than the security level of the content file, access to the content file is not permitted (S405: No).
[0047]
If the determination result shows that the security level of the user is equal to or higher than the security level of the content file (S405: Yes), the secure API on the content server 3 side calculates the security level calculated based on the security level of the user and the access record information. The level and the security level of the content file are compared and determined (S406).
[0048]
When the determination result shows that the security level calculated based on the user security level and the access record information is below the security level of the content file (S407: No), access to the content file is not permitted.
[0049]
If the security level calculated based on the determination result, the user security level and the access record information is equal to or higher than the security level of the content file (S407: Yes), the content file can be accessed. Performs transmission processing of the content file stored in the plaintext content storage unit 301 of the content server 3 via the Internet 1 (S408).
[0050]
On the client 4 side, when the content file is received, the received content file is stored in the content storage unit 401. The stored content file can be used in various applications.
[0051]
As described above, according to the present embodiment, in the EDI system using the Internet, unauthorized access is prevented by realizing data protection with a detailed security level based on the user's access record. Eliminate and perform highly secure security management.
[0052]
In the present embodiment, a program that causes a computer to function as a management information storage unit (management information storage unit) 302, an access record information storage unit (access record information storage unit) 303, and a determination unit / transmission unit (secure API). Are recorded on a recording medium, and the computer reads the recording medium to execute the processes of S401 to S408.
[0053]
Embodiment 2. FIG.
FIG. 5 is a block diagram showing an environment in which the data protection device of the second embodiment is realized and the configuration of the data protection device. The same reference numerals as those in FIG. 1 denote the same or corresponding parts.
[0054]
In this embodiment, an encrypted content storage unit (encrypted content storage unit) 304 and an encryption processing unit (encryption processing unit) 305 are added to the content server 3, and an encryption processing unit 402 is added to the client 4. The encryption processing units 305 and 402 perform content file encryption and decryption processing.
[0055]
As will be described later, the data protection apparatus implements various processes using a dedicated secure API, but the content file encryption process is also performed using a dedicated secure API. As the encryption method, various encryption methods can be used depending on the confidentiality of information. A known technique can be used as the encryption method itself.
[0056]
The plaintext content storage unit 301 stores a plaintext content file. In order to avoid holding the plaintext content file outside the firewall 5, in practice, for example, a portable readable computer such as a flexible disk or a CD-ROM without the content server 3 being connected to the Internet 1. The plaintext content file recorded on the recording medium is encrypted by the encryption processing unit 305, and the plaintext content file itself is connected to the Internet 1 without being present in the content server 3.
[0057]
The encrypted content storage unit 304 stores the plaintext content file encrypted by the encryption processing unit 305. Specifically, as the encrypted content storage unit 304, various storage means such as a hard disk device and a flexible disk device can be used.
[0058]
The management information storage unit 302 stores a user management database for managing the security level of each user and a content management database for managing the security level of each content file.
[0059]
FIG. 6 is a diagram illustrating an example of the contents of the user management database. As shown in the figure, the user management database includes common key information in addition to the user name, group name, security level, name, and affiliation information described in the first embodiment.
[0060]
The common key refers to the re-encryption of the plaintext content file and the re-encrypted plaintext content file when the user sends the plaintext content file combined from the encrypted content storage unit 304 to the Internet 1. This is a key used for decryption on the received client 4 side. As will be described later, this common key is different from the key used when the plaintext content file stored in the plaintext content storage unit 301 is encrypted and stored in the encrypted content storage unit 304.
[0061]
FIG. 7 is a diagram showing an example of the contents of the content management database. As shown in the figure, the content management database includes content key information in addition to the file name, access group, security level, and directory information described in the first embodiment.
[0062]
The content key is a key used in the content server 3 for encryption when storing a plaintext content file in the encrypted content storage unit 304 and decryption when reading the content file from the encrypted content storage unit 304. As described above, the plaintext content file combined with the content key is encrypted again with the common key and sent over the Internet.
[0063]
As described above, registration and editing of management information in the user management database and the content management database described above are performed by the administrator of the content server 3 using management software using a dedicated secure API. Specifically, management information input from input means such as a keyboard is stored in the user management database and the content management database via a dedicated secure API provided in the content server 3. However, the registration to the content management database is automatically performed by the secure API when the plaintext content file is encrypted.
[0064]
The processing contents when the content file actually encrypted using the management information is taken out and transmitted to the client 4 side will be described below.
[0065]
First, the user logs into the client 4. Thereafter, an access request is made to the content file via the Internet 1, and the content server 3 that has received the request activates a dedicated secure API. More specifically, when the client 4 designates the port number of the FTP daemon of the content server 3, the content server 3 that recognizes the designation calls the secure API.
[0066]
FIG. 8 is a flowchart showing the processing contents of the secure API. The processing from S801 to S806 is the same as that from S401 to S406 in the first embodiment, and a description thereof will be omitted.
[0067]
Compare the security level based on the user's security level and access information with the security level of the content file, and the security level calculated based on the user's security level and access history information is lower than the security level of the content file. (S807: No), access to the content file is not permitted.
[0068]
If the security level calculated based on the user security level and the access record information is equal to or higher than the security level of the content file (S807: Yes, since the content file can be accessed, the content file key is used). Decryption processing of the encrypted content file is performed (S808).
[0069]
The plaintext content file obtained by the decryption process is compressed (S809), and then encrypted again using the common key (S810). Here, the reason why the encryption is performed after the compression is that the compression cannot be performed if the encryption is performed first.
[0070]
The content file encrypted again is transmitted to the client 4 via the Internet 1 (S811).
[0071]
Next, processing contents on the client 4 side that has received the encrypted content file will be described. FIG. 9 is a flowchart showing the processing content on the client 4 side that has received the encrypted content file.
[0072]
On the client 4 side, when the compressed and encrypted content file is received (S901), it is combined using the common key (S902). Here, the reason why the decryption is performed first is that it cannot be decompressed unless it is combined.
[0073]
The compressed plaintext content file is decompressed (S903), converted into a normal plaintext content file, and then encrypted again using a common key for storage in the content storage unit 402 of the client 4 (S904). .
[0074]
The encrypted plaintext content file is stored in the content storage unit 402 (S905), and the processing on the client 4 side ends.
[0075]
Next, processing when the encrypted content file stored in the content storage unit 402 is read and used will be described.
[0076]
In order to use the encrypted content file on the client 4 side, a PC card having a security function is used. By installing a PC card on the client 4 side and inputting a password, the encrypted content file is combined and can be used in various applications. Note that a known technique can be used for the decryption processing by the PC card.
[0077]
As described above, according to the present embodiment, stronger data protection can be realized by encrypting a content file in an EDI system using the Internet.
[0078]
In the present embodiment, a program that causes a computer to function as the encrypted content storage unit (encrypted content storage unit) 304 and the encryption processing unit (encryption processing unit) 305 is recorded on a recording medium. Is read, the processing of S801 to S811 is executed.
[0079]
Embodiment 3 FIG.
FIG. 10 is a flowchart showing the processing contents of the secure API in the third embodiment. In the present embodiment, an authentication means for re-authenticating the user is added to the processing of the first embodiment. The processing contents will be described below.
[0080]
The processing from S1001 to S1006 is the same as the processing from S401 to S406 in the first embodiment.
[0081]
The security level based on the user security level and access information is compared with the security level of the content file, and the security level calculated based on the user security level and access performance information exceeds the security level of the content file. If it is (S1007: Yes), the content file can be accessed, so the secure API performs the content file transmission process via the Internet 1 (S1010).
[0082]
When the security level calculated based on the user security level and the access record information is lower than the security level of the content file (S1007: No), the user is re-authenticated (S1008) and the authentication result is determined. (S1009). The re-authentication is to confirm whether or not the user has a registered access right.
[0083]
If the authentication result is good, it is determined that the user himself / herself has the access right, and the content file can be accessed, and the secure API performs a content file transmission process via the Internet 1 (S1010).
[0084]
As described above, when access is not permitted by the judging means based on the access record information, it is possible to automatically cope with the user at the time of access denial by adding an authentication means for re-authentication. It is possible to reduce the burden on the server side administrator for the user.
[0085]
In the present embodiment, a program that causes a computer to function as authentication means is recorded on a recording medium, and the processing of S1001 to S1010 is executed by the computer reading this recording medium.
[0086]
Embodiment 4 FIG.
FIG. 11 is a flowchart showing the processing contents of the secure API in the fourth embodiment. In the present embodiment, a means for notifying the server-side administrator is added to the processing of the first embodiment. The processing contents will be described below.
[0087]
The processing from S1101 to S1106 is the same as the processing from S401 to S406 in the first embodiment.
[0088]
The security level based on the user security level and access information is compared with the security level of the content file, and the security level calculated based on the user security level and access performance information exceeds the security level of the content file. If it is (S1109: Yes), the content file can be accessed, so the secure API performs the content file transmission process via the Internet 1 (S1110).
[0089]
When the security level calculated based on the user security level and the access record information is lower than the security level of the content file (S1107: No), the administrator is notified (S1108), Access is not allowed.
[0090]
As described above, by adding a notification means to notify the administrator when access is not permitted by the determination means based on the access record information, it is possible to flexibly deal with the user at the time of access refusal by the administrator's judgment Therefore, it is possible to deal with finer details.
[0091]
In the present embodiment, a program for causing a computer to function as means for notifying a server-side administrator is recorded on a recording medium, and the processing of S1001 to S1010 is executed by the computer reading this recording medium.
[0092]
Embodiment 5. FIG.
In FIG. 5, a UDF file system standardized by ISO 13346 can be used as the encrypted content storage unit 304, the management information storage unit 302, and the access record information storage unit 303.
[0093]
By using a UDF file system having a high-level security function and a backup function, it is possible to ensure stronger security as a whole EDI system.
[0094]
Embodiment 6 FIG.
In the first to fifth embodiments, the secure API refers to access record information and management information. Normally, these are held by data holding means such as a DB, but by writing them in an area not normally used by the OS etc. in the storage device, further security of access record information and management information is to be achieved. Can do.
[0095]
FIG. 12 is a diagram for explaining an area in which the secure API writes access record information and management information. In the drawing, access record information and management information are written in areas indicated as “Hidden Sector” and “unused area” (hereinafter, both are referred to as unused areas).
[0096]
FIG. 13 is a flowchart showing the processing contents when the secure API writes the access record information and the management information in the unused area in the present embodiment.
[0097]
The secure API first acquires the sector address of the unused area (S1301). Specifically, in the storage device such as a hard disk used as the access record information storage unit 303 and the management information storage unit 302 shown in FIG. 1, the data area managed by the partition table, that is, the area normally used The sector addresses of the unused areas (c) and (d) can be acquired from the information of the first sector (a) and the end sector (b).
[0098]
Next, the secure API calls a device driver included in the BIOS (BasicInput / Output System) using a system call, and accesses the access record together with parameters such as the number of bytes of the access record information or management information, the sector address of the write position, and the like. Information or management information is passed (S1302). As a result, data is written to the unused area by the device driver (S1303). Note that the access record information or the management information written in the unused area can be read by using the secure API as in the writing.
[0099]
As described above, by holding the access record information and management information in an area that is not normally accessed from the OS, unauthorized access to the access record information and management information other than the secure API can be prevented. This is preferable.
[0100]
Embodiment 7 FIG.
FIG. 14 is a block diagram showing an environment in which the protection device in the EDI system of Embodiment 7 is implemented and the configuration of the data protection device. The same reference numerals as those in FIG. 1 denote the same or corresponding parts.
[0101]
In the first embodiment, the secure API used for the data protection device is stored in the HDD on the content server 3 as a program realized in an environment having access record information and management information.
[0102]
In the present embodiment, the program realized in the environment having the access record information and the management information is another recording device provided at the end of the communication line 6 different from the Internet 1, for example, a hard disk of a computer. Or in a program storage unit 306 realized by a recording medium such as a RAM.
[0103]
In this case, when the content server 3 executes a program using the secure API, the secure API is loaded via the communication line 6 and executed on the main memory. When an unauthorized access to the content server 3 is received and the program becomes executable by an intruder, the secure API is not used by shutting down the communication line 6 or stopping the program storage unit 306 or ejecting the recording medium. Enable unauthorized access to access performance information and management information.
[0104]
As described above, the access record information and the management information are obtained by placing a program for realizing the secure API in a location other than the HDD of the content server 3 and loading it through the communication line 36 different from the Internet 1 when executing the program. Can prevent unauthorized access to. When used together with the means for notifying the server-side administrator of the fourth embodiment, the server-side administrator can respond quickly and the effect is particularly great.
[0105]
【The invention's effect】
  According to the data protection device of the present invention, a data protection device in an electronic data exchange system by a server system placed on the Internet,
  The server system includes a content server that stores files that users access via the Internet,
  the aboveUserRespectivelyThe security level previously assigned according to the electronic data management abilityManagement database in which is registeredWhenthe aboveTo fileRespectivelySecurity level granted according to the contentContent management database in which is registeredManagement information holding means for holding
  the aboveEach userAbout how to access when the above content server is accessedAccess result information holding means for holding access result information,
  When the user requested access to the content server, it was registered in the user management database of the userSecurity level and above fileRegistered in the content management databaseCompare security levels,Registered in the user management database of the userSecurity levelThe concernedUserFrom the access record information held in the access record information holding means and the access method when the user makes an access request to the file,Calculate the security level and calculateNewThe security level and the file that requested accessRegistered in the content management databaseThe above access request was made by comparing the security level.ConcernedUserNoA determination means for determining whether access is permitted;
  When the determination means determines that access is permitted, the access request is made to the requested file via the Internet.ConcernedMeans for sending to the client on the user side,
Therefore, unauthorized access can be eliminated and highly secure security management can be performed.
[0106]
Further, since the encryption processing means for encrypting and decrypting each file and the encrypted content storage means for storing the encrypted file are provided, stronger security can be ensured.
[0107]
Further, since the UDF (Universal Disc Format) file system is used as the installation location of the encrypted content storage means and the management information holding means, it is possible to ensure stronger security.
[0108]
  Also, the access request is made by the determination means.ConcernedWhen it is determined that the user's access is not permitted, the access request is madeConcernedUserIn the above user management databaseRegisteredIs itAn authentication means for performing re-authentication to confirm whether or not, in the authentication means,The user is registered in the user management database.When it is determined that access can be permitted, the transmission means makes the access request to the requested file via the Internet.ConcernedSince it is transmitted to the client on the user side, when it is determined that the user access is not permitted, it is possible to reduce the burden on the server side administrator for the user.
[0109]
  Also, the access request is made by the determination means.ConcernedIf it is determined that user access is not permitted, the administrator who manages the server systemIt was determined that the user's access is not allowedSince the notification means for notifying the result of the determination is provided, a finer response to the user or the like can be made when access is denied.
[0110]
  Also, the management information holding meansAnd the access record information holding means dataProvided in the storage device, and in the storage deviceOSTherefore, the information held in the access record information holding unit and the management information holding unit can be further secured.
[0111]
  Also onWritingA sector address acquiring means for acquiring a sector address of an area that is not normally accessed; and a writing means for writing information to be held in the management information holding means to a sector having the sector address acquired by the sector address acquiring means; And reading means for reading the information written by the writing means, it is easy to write to and read from an area that is not normally accessed from the file system.
[0112]
  Also, the determination meansPrograms that function as, Via a communication line different from the InternetLocated in the program storage unit connected to the content server,When executing judgment meansLoaded from the program storage unit to the content server via the communication lineTherefore, unauthorized access to the access record information holding unit and the management information holding unit can be prevented.
[0113]
  A data protection method according to the present invention is a data protection method in an electronic data exchange system in an electronic data exchange system by a server system placed on the Internet,
  The server system includes a content server that stores a file that a user accesses via the Internet,
  A security level is given in advance to each of the users according to the management ability of the electronic data,
  Each of the above files is given a security level according to its contents.
  The content server has access record information holding means for holding access record information related to an access method when each user accesses the content server,
  The content server
  A first step of receiving a request for access to a file from a user via the Internet;
  Requested accessGiven aboveThe user's security level and the requested fileGiven aboveA second step of comparing the security level;
  Of the user who requested accessGiven aboveSecurity level of the requested fileGiven aboveIf it is lower than the security level, access is not permitted and the user who requested access is not allowed.Given aboveSecurity level of the requested fileGiven aboveIf it is greater than the security level,The user's previously givenSecurity level andThe access record information held in the access record information holding unit of the user and,From the access method when the user makes an access request to the file, the user's newThe third step of calculating the security level;
  The calculatedNewThe security level of the requested fileGiven aboveA fourth step of comparing the security level;
  Result of comparison in the fourth stepDetermining whether the calculated new security level is higher than the previously assigned security level of the file requested to be accessed, and determining whether the calculated new security level of the file requested to be accessed is Judge that access is permitted if the security level is higher than the pre-assigned security level5th step to
  In the fifth step, when it is determined that access is permitted, the access request is made to the requested file via the Internet.ConcernedA sixth step of sending to the user side client;
TheExecuteTherefore, unauthorized access can be eliminated and highly secure security management can be performed.
[0114]
Further, since each file is encrypted and transmitted to the client on the user side who has requested the access, stronger security can be ensured.
[0115]
Further, since the encrypted file, the security level of the user, and the security level of the file are stored using the UDF file system, stronger security can be ensured.
[0116]
  Further, when it is determined in the fifth step that access of the user who has requested the access is not permitted, the user who has requested the accessIn the content management databaseRegisteredIs itAn authentication means for performing re-authentication to confirm whether or not, in the authentication means,The user is registered in the user management databaseWhen it is determined that access can be permitted, the access request is made to the requested file via the Internet.ConcernedSince it is transmitted to the client on the user side, when it is determined that the user access is not permitted, it is possible to reduce the burden on the server side administrator for the user.
[0117]
  In addition, the access request is made in the fifth step.ConcernedIf it is determined that user access is not permitted, the administrator who manages the server systemDetermined that the user who requested the above access is not allowed to accessSince the result of the determination is notified, a finer response to the user or the like is possible when access is denied.
[0118]
  In addition, the above userGiven aboveSecurity level and above fileGiven aboveThe security level is stored in the storage device.OSTherefore, it is possible to further improve the security of access record information and information related to the security level of users and files.
[0119]
  Also onWritingSince the sector address of the area that is not normally accessed is acquired, information on the security level of the user and the security level of the file is written in the sector having the acquired sector address, and the written information is read. It is possible to easily write to and read from an area that is not normally accessed from the file system.
[0120]
  In addition, the first to the above5th stepRunProgram used forThrough a separate communication line from the InternetIt is placed in a program storage unit connected to the content server, and is loaded from the program storage unit to the content server via the communication line when the content server executes the first to fifth steps.Therefore, unauthorized access to access record information and information related to user and file security levels can be prevented.
[0121]
  A program according to the present invention is a program used for data protection in an electronic data exchange system in an electronic data exchange system by a server system placed on the Internet.,
  The server system includes a content server that stores files that users access via the Internet,
The content server
  the aboveUserRespectivelyThe security level previously assigned according to the electronic data management abilityManagement database in which is registeredWhenthe aboveTo fileRespectivelySecurity level granted according to the contentContent management database in which is registeredManagement information holding means for holding
  the aboveEach userAccess result information on how to access when accessing the above content serverAccess result information holding means for holding
  When the user requested access to the content server, it was registered in the user management database of the userSecurity level and above fileRegistered in the above content management databaseCompare security levels,Registered in the user management database of the userSecurity level,ConcernedUserFrom the access record information held in the access record information holding means and the access method when the user requests access to the file,Calculate the security level and calculateNewThe security level and the file that requested accessRegistered in the content management databaseThe above access request was made by comparing the security level.ConcernedUserNoA determination means for determining whether access is permitted;
  A transmission means for transmitting the requested file to the client on the user side who has made the access request via the Internet when the determination means determines that access is permitted;
Therefore, unauthorized access can be eliminated and highly secure security management can be performed.
[0122]
  Also,the aboveComputerBut the content serverSince it functions as an encryption processing means for encrypting and decrypting each file and an encrypted content storage means for storing the encrypted file, stronger security can be ensured.
[0123]
In addition, since the UDF file system is used as the installation location of the encrypted content storage means and the management information holding means, it is possible to ensure stronger security.
[0124]
  Also,the aboveComputerBut the content serverWhen the determination means determines that the access of the user who requested the access is not permitted, the access request is made.ConcernedUserIn the above user management databaseRegisteredIs itFunction as an authentication means for performing re-authentication to confirm whether or notRegistered in the user management databaseIf it is determined that access can be granted, the sending means is requestedFileMade the access request via the internetConcernedSend to user side clientTo function likeTherefore, when it is determined that the user's access is not permitted, it is possible to reduce the burden on the server side administrator for the user.
[0125]
  Also,the aboveComputerBut,The access request was made by the determination means.ConcernedIf it is determined that user access is not permitted, the administrator who manages the server systemIt was determined that the user's access is not allowedSince it functions as a notification means for notifying the result of determination, it is possible to deal with a user or the like more finely when access is denied.
[0126]
  Also, the management information holding meansAnd the data of the access record information holding means are provided in the storage device, and are provided in an area that is not normally accessed from the OS in the storage device.Therefore, it is possible to further improve the security of access record information and information related to the security level of users and files.
[Brief description of the drawings]
FIG. 1 is a block diagram illustrating an environment in which a data protection device in an EDI system according to a first embodiment is implemented and a configuration of the data protection device.
FIG. 2 is a diagram showing an example of contents of a user management database.
FIG. 3 is a diagram showing an example of contents of a content management database.
4 is a flowchart showing processing contents of a secure API in Embodiment 1. FIG.
FIG. 5 is a block diagram illustrating an environment in which the data protection device of the second embodiment is realized and a configuration of the data protection device.
FIG. 6 is a diagram showing an example of the contents of a user management database.
FIG. 7 is a diagram showing an example of contents of a content management database.
FIG. 8 is a flowchart showing processing contents of a secure API according to the second embodiment;
FIG. 9 is a flowchart showing details of processing on the client side that has received an encrypted content file;
10 is a flowchart showing processing contents of a secure API in Embodiment 3. FIG.
FIG. 11 is a flowchart showing processing contents of a secure API in the fourth embodiment.
FIG. 12 is a diagram for describing an area in which a secure API writes access record information and management information.
FIG. 13 is a flowchart showing processing contents when the secure API writes access record information and management information in an unused area in the fourth embodiment.
FIG. 14 is a block diagram illustrating an environment in which a protection device in an EDI system according to a seventh embodiment is realized and a configuration of the data protection device.
[Explanation of symbols]
1 Internet, 2 internal LAN, 3 content server,
4 clients, 5 firewalls, 301 plaintext content storage,
302 management information storage unit, 303 access record information storage unit,
304 encrypted content storage unit, 305, 306 program storage unit,
402 Cryptographic processing unit, 401, 402 Content storage unit.

Claims (22)

A data protection device in an electronic data exchange system by a server system placed on the Internet,
The server system includes a content server that stores files that users access via the Internet,
A content management database in which the electronic data the user management database and the files in each security level granted in accordance with the contents of previously assigned security level in accordance with the management capabilities is registered is registered for each said user Management information holding means for holding
Access record information holding means for each user holds access performance information on how to access when accessing the said content server,
When the user makes an access request to the content server, the security level registered in the user management database of the user is compared with the security level registered in the content management database of the file, and the user the user management database to a registered security level, the access record information holding means the access record information held in of the user, and the user from the way of the access when the user has an access request to the file calculating a new security level, and the new security level the calculated, by comparing the security level registered in the content management database files an access request, and the access request Determining means for determining whether the user of the access is permitted,
The by determining means, if it is determined that access is allowed, transmitting means for transmitting the requested file to the user side of the client that the access request via the Internet,
A data protection device comprising:   2. The data protection apparatus according to claim 1, further comprising encryption processing means for encrypting and decrypting each file and encrypted content storage means for storing the encrypted file.   3. The data protection apparatus according to claim 2, wherein a UDF (Universal Disc Format) file system is used as an installation location of the encrypted content storage means and the management information holding means. By the determination unit, when the access of the user who the access request is determined not to be permitted, the user who the access request to confirm whether or not registered in the user management database Authentication means for performing re-authentication, and when the authentication means determines that the user is registered in the user management database and access can be permitted, the transmission means sends the requested file to the user via the Internet data protection apparatus of claim 1, wherein the transmitting to the client of the user side who the access request. When it is determined by the determination means that the access of the user who has requested the access is not permitted, it is determined that the administrator who manages the server system is not permitted to access the user. 2. The data protection apparatus according to claim 1, further comprising notification means for notifying a result of the determination. 2. The data according to claim 1, wherein the data of the management information holding means and the access record information holding means is provided in a storage device and is provided in an area that is not normally accessed from an OS in the storage device. Protective device. And the sector address acquisition means for acquiring a sector address region not above SL through normal access, write and write information to be retained in the management information holding means with respect to a sector having a sector address obtained by the sector address acquiring means The data protection apparatus according to claim 6, further comprising: a reading unit; and a reading unit that reads information written by the writing unit. The program that functions as a determination means, and the Internet are placed in a program storage unit that is connected to the content server via another communication line, the program via the communication line when executing the determination means The data protection apparatus according to claim 1, wherein the data protection apparatus is loaded from the storage unit into the content server . A data protection method in an electronic data exchange system in an electronic data exchange system by a server system placed on the Internet,
The server system includes a content server that stores files that users access via the Internet,
A security level is given in advance to each of the users according to the management ability of the electronic data,
Each of the above files is given a security level according to its contents.
The content server has access record information holding means for holding access record information related to an access method when each user accesses the content server,
The content server
A first step of receiving a request for access to a file from a user via the Internet;
A second step of comparing the security level of the previously granted user who requested access with the previously given security level of the requested file;
If the pre-assigned security level of the user who requested the access is smaller than the pre-assigned security level of the requested file, access is not permitted and the pre-assigned of the user who requested the access If the assigned security level is higher than the previously assigned security level of the requested file, it is held in the previously given security level of the user and the access record information holding means of the user. A third step of calculating a new security level of the user from the access record information and a method of access when the user makes an access request to the file ;
A fourth step of comparing the calculated new security level with the previously assigned security level of the requested file;
As a result of the comparison in the fourth step, it is determined whether or not the calculated new security level is higher than the previously assigned security level of the requested file, and the calculated new security level is determined. There fifth step of determining an access is larger than the previously assigned security level of a file access request is permitted,
In the fifth step, a sixth step of transmitting if it is determined that access is allowed, the requested file, to the user side of the client that the access request via the Internet,
Data protection method, characterized by the execution.   10. The data protection method according to claim 9, wherein each file is encrypted and transmitted to the client on the user side who has requested access.   11. The data protection method according to claim 10, wherein the encrypted file, the security level of the user, and the security level of the file are stored using a UDF (Universal Disk Format) file system. By the fifth step, if the access of the user who the access request is determined not to be permitted, the user who the access request to confirm whether or not registered in the content management database Authentication means for performing re-authentication, and when the user is registered in the user management database and access is determined to be permitted in the authentication means, the requested file is transferred to the Internet The data protection method according to claim 9, wherein the access request is transmitted to the client on the user side who has made the access request via the client. If it is determined in the fifth step that access of the user who made the access request is not permitted, the administrator who manages the server system is permitted to access the user who made the access request. The data protection method according to claim 9, wherein a result of the determination that it has not been determined is notified. The previously assigned security level of the previously assigned security level and the file of the user data according to claim 9, wherein in that it is provided in a region from the OS in the storage device is not normal access Protection method. Gets the sector address regions not above SL through normal access, the sectors having sector addresses the acquired write the security level of the information security level and the file of the user, to read the written information 15. A data protection method according to claim 14, wherein: The program used to execute the first to fifth steps is placed in a program storage unit connected to the content server via a communication line different from the Internet, and the content server is connected to the first to fifth steps. 10. The data protection method according to claim 9, wherein when executing the fifth step, the content server is loaded from the program storage unit via the communication line . A program used for data protection in an electronic data exchange system in an electronic data exchange system by a server system placed on the Internet ,
The server system includes a content server that stores files that users access via the Internet,
The content server
Content management database in which the electronic data the user management database and the security level that is assigned depending on each the content of the file previously assigned security level in accordance with the management capabilities is registered is registered for each said user Management information holding means for holding
Access record information holding means for each user holds access performance information on how to access when accessing the said content server,
When the user makes an access request to the content server, the security level registered in the user management database of the user is compared with the security level registered in the content management database of the file , and the user the user management database to a registered security level, the access record information holding means the access record information held in of the user, and the manner of access when the user access request to said file of the user calculating a new security level, and a new level of security the calculated, by comparing the security level registered in the content management database files an access request, and the access request those Determining means for determining whether the user's access is permitted,
Transmitting means for transmitting the requested file to the client on the user side who has made the access request via the Internet when the determining means determines that access is permitted;
A program characterized by functioning as The computer is, the content server, the encryption processing unit, according to claim 17, wherein the program for causing to function as an encrypted content storing unit for storing the encrypted file to encrypt and decrypt the respective files.   19. The program according to claim 18, wherein a UDF (Universal Disc Format) file system is used as an installation location of the encrypted content storage means and the management information holding means. The computer, the content server by the determining means, when the access of the user who the access request is determined not to be permitted, the user who the access request is registered in the user management database Functioning as an authenticating unit that performs re-authentication to confirm whether or not it is registered, and when the authenticating unit is registered in the user management database and it is determined that access can be permitted, the transmitting unit the requested file, according to claim 17, wherein the program for causing the functions to be sent to the client of the user side who the access request via the Internet. The computer, by the determination unit, when the access of the user who the access request is determined not to be allowed, has been granted access the corresponding user to the administrator that manages the server system 18. The program according to claim 17, wherein the program functions as notifying means for notifying a result of the determination that there is not . 18. The program according to claim 17 , wherein the data of the management information holding means and the access record information holding means is provided in a storage device and is provided in an area that is not normally accessed from an OS in the storage device. .

Images