JPH11215122A5 - Data encryption method, data decryption method, data encryption device, data decryption device, and data encryption system - Google Patents

Description

Also, there is provided a data decryption method for performing data processing including decryption processing in accordance with an instruction embedded in encrypted data that specifies a data processing method including a decryption processing method, the data processing including decryption processing being performed on the encrypted data, the instruction including the embedded instruction, the data decryption method being performed on the encrypted data ...
The encryption device includes means for decrypting a range specified by a decryption range designation command for designating a range to be decrypted, for encrypted data into which a decryption range designation command is embedded.

Also, there is a data decryption device that performs data processing, including decryption processing, on encrypted data into which instructions specifying a data processing method including a decryption processing method are embedded, in accordance with the embedded instructions, and is equipped with a data communication means, a data processing means, a data input means, a data output means, and a data decryption means, and when information specifying data to be encrypted that is to be obtained from outside is input to the data input means, the data communication means transmits data request information requesting the transmission of the data to be encrypted, receives encrypted data corresponding to the data request information and into which a decryption range designation instruction specifying the range to be decrypted is embedded, the data decryption means decrypts the range of the encrypted data specified by the decryption range designation instruction, and the data processing means outputs the decrypted encrypted data to the data output means to which a data output device such as a display or printer is connected.

a data encryption system comprising a data encryption device on a sending side having a data communication means, a data acquisition means, a data storage means, a data encryption means, and a user key storage means; a data decryption device on a receiving side having a data communication means, a data processing means, a data input means, a data output means, a data decryption means, and a user key storage means; a network; a data creation device to be encrypted having a data creation means to be encrypted and a data delivery means to be encrypted; and a user key generation device having a user key generation means and a user key delivery means, wherein in the user key generation device, the user key generation means generates an encryption key unique to each user and a decryption key corresponding to this encryption key, the user key delivery means stores the encryption key in the user key storage means of the data encryption device on the sending side and stores the decryption key in the user key storage means of the data decryption device on the receiving side; in the data creation device to be encrypted, the data creation means creates data to be encrypted incorporating an encryption range designation command that designates the range to be encrypted, and the data delivery means stores the data to be encrypted in the data storage means of the data encryption device on the sending side;
In the data decryption device on the receiving side, when information specifying data to be encrypted that is to be acquired from the outside is input to the data input means, the data communication means transmits data request information requesting transmission of the data to be encrypted to the data encryption device on the sending side using the network, and in the data encryption device on the sending side, when the data communication means receives data request information requesting transmission of the data to be encrypted stored in the data storage means, the data acquisition means acquires the data to be encrypted requested by the data request information from the data storage means, and the data encryption means extracts the encrypted data from the data to be encrypted. The range specified by the encryption range specification command is encrypted, and encrypted data is created by incorporating a decryption range specification command that specifies the range to be decrypted into the at least partially encrypted data to be encrypted, and a data communication means transmits the encrypted data to the data decryption device on the receiving side using the network, and the encrypted data is received by the data decryption device on the receiving side, and the data decryption means decrypts the range of the encrypted data specified by the decryption range specification command, and the data processing means outputs the decrypted encrypted data to the data output means to which a data output device such as a display or printer is connected.

Also, a data encryption system is provided which is composed of a data encryption device on a sending side having a data communication means, a data acquisition means, and a data storage means, a data decryption device on a receiving side having a data communication means, a data processing means, a data input means, a data output means, a data decryption means, and a user key storage means, a network, an encrypted data creation device having an encryption target data creation means, a data encryption means, a user key storage means, and an encrypted data delivery means, and a user key generation device having a user key generation means and a user key delivery means, wherein in the user key generation device, the user key generation means An encryption key specific to a user and a decryption key corresponding to this encryption key are generated, the user key distribution means stores the encryption key in the user key storage means of the encrypted data creation device, and stores the decryption key in the user key storage means of the data decryption device on the receiving side, and in the encrypted data creation device, the encrypted data creation means creates encryption target data incorporating an encryption range designation command that designates the range to be encrypted, and the data encryption means encrypts the range of the encryption target data designated by the encryption range designation command, and the encryption target data at least partially encrypted as a result and the data communication means transmits the encrypted data to the data decryption device on the receiving side using the network. In the data decryption device on the receiving side, when information specifying data to be encrypted that is to be acquired from outside is input to the data input means, the data communication means transmits data request information requesting transmission of the encrypted data to the data encryption device on the sending side using the network. In the data encryption device on the sending side, when the data communication means receives data request information requesting transmission of the encrypted data stored in the data storage means, the data acquisition means acquires the encrypted data requested in the data request information from the data storage means. The data communication means transmits the encrypted data to the data decryption device on the receiving side using the network. In the data decryption device on the receiving side, the encrypted data is received, and the data decryption means decrypts the range of the encrypted data specified by the decryption range designation command. The data processing means outputs the decrypted encrypted data to the data output means to which a data output device such as a display or a printer is connected.

The data transmitting device 1 includes a data communication means 11 for receiving data request information and, optionally, recipient identification information from the data receiving device 2 and transmitting encrypted data corresponding to the data request information to the data receiving device 2, a data acquisition means 12 for retrieving encryption target data corresponding to the data request information from the data storage means 13, passing the encryption target data to the data encryption means 14, acquiring the resulting encrypted data, and passing the encrypted data to the data communication means 11 , a data storage means 13 for storing the encryption target data, and a data encryption means 14 for encrypting the encryption target data for a recipient specified by the recipient identification information or a recipient designation command (described later) to generate encrypted data. The data encryption means 14 includes a public key storage means (not shown) for storing the user public keys of each user generated by the user key generation device 5. The detailed configuration of the data encryption means 14 will be described later.

Specifically, the data transmission device 1 can be a computer ( such as a personal computer or a workstation) equipped with an existing WWW (World Wide Web) server (such as a Netscape Communication server from Netscape Communications Inc.) that includes the above-mentioned data communication means 11, data acquisition means 12, and data storage means 13. In this case, the data communication means 11 included in the WWW server performs data communication based on the HTTP protocol, which is the standard communication protocol between WWW servers and WWW browsers.

Specifically, the data encryption means 14 in the data transmission device 1 can be implemented using a CGI (Common Gateway Interface) program (a program for adding various data processing functions to a WWW server). Figure 2(1) shows a configuration diagram of the data transmission device 1 implemented using a WWW server and a CGI program. As shown in Figure 2(1), when a CGI program is used, the data transmission device 1 is configured with a WWW server 100 incorporating a CGI program 101 that provides the data encryption means 14 , and the CGI program 101 and the WWW server 100 operate as a single program. In other words, when a CGI program is used, a CGI program must be added to each WWW server.

An encryption processing proxy program (hereinafter referred to as an encryption proxy) can be used as another method for implementing the data encryption means 14 in the data transmission device 1. Figure 2 (2) shows the configuration of the data transmission device 1 when implemented using an encryption proxy.

FIG. 3 shows the overall configuration of a system in which the data transmission device 1 is configured as a WWW server and an encryption proxy.

As shown in Figures 2(2) and 3, when using an encryption proxy configuration, the data transmission device 1 is composed of a WWW server 100 and an encryption proxy 101 equipped with a data encryption means 14 and a data communication means 11 .

Here, the data communication means 11 in the encryption proxy 101 performs data communication based on the HTTP protocol, which is the standard protocol for data communication between a WWW server and a WWW browser.

This configuration allows the WWW server 100 and the encryption proxy 101 to operate as independent programs, which in turn allows existing WWW servers to be used as they are, and also makes it possible to add data encryption means to multiple WWW servers using a single encryption proxy.

The data receiving device 2 also includes a data communication means 21 for transmitting data request information and, as an option, recipient identification information to the data transmitting device 1 and receiving encrypted data corresponding to the data request information, a data processing means 22 for passing the received encrypted data to a data decryption means 25 and performing various data processing (e.g., processing such as displaying, saving, or printing the data) on the resulting decrypted encrypted data, a data decryption means 25 for decrypting the encrypted data and generating decrypted encrypted data, a data input means 23 for receiving various data processing specifications from the user (e.g., specification of data to be acquired, or specification of processing such as saving or printing the data), and a data output means 24 for outputting data to an external device such as a display or printer for displaying or printing the data.

The data decryption means 25 includes private key storage means (not shown) for storing the user private key (user private key of the user who uses this data receiving device) generated by the key generation device 5. The detailed configuration of the data decryption means 25 will be described later.

Specifically, the data receiving device 2 can be a computer (such as a personal computer or workstation) equipped with the above-mentioned data communication means 21 and an existing WWW browser (for example, Netscape Navigator by Netscape Communications or Internet Explorer by Microsoft) that is equipped with data processing means 22. In this case, the data communication means 21 equipped in the WWW browser performs data communication based on the HTTP protocol, which is the standard communication protocol between WWW servers and WWW browsers. Furthermore, the data input means 23 can be a keyboard, mouse, etc. equipped in the computer. Furthermore, a display, printer, etc. is connected to the data output means 24 .

Specifically, a plug-in for a WWW browser (a program for adding various data processing functions to a WWW browser) can be used to implement the data decryption means 25 in the data receiving device 2. Figure 2 (3) shows a configuration diagram of the data decryption means 25 when implemented as a plug-in. As shown in Figure 2 (3), when a plug-in is used, the data receiving device 2 is configured with a WWW browser 200 incorporating a decryption plug-in 201 that provides the data decryption means 25 , and the WWW browser and decryption plug-in operate as an integrated program.

As another method of realizing the data decryption means 25 in the data receiving device 2 , a decryption processing proxy program (hereinafter referred to as a decryption proxy) can be used. Figure 2 (4) shows the configuration of the data receiving device 2 when realized with a decryption proxy. Figure 3 shows the overall configuration of a system when the data receiving device 2 is configured with a WWW browser and a decryption proxy.

As shown in Figures 2(4) and 3, when a configuration using a decryption proxy is adopted, the data receiving device 2 is composed of a WWW browser 200 and a decryption proxy 201 that has a data communication means 21 in addition to a data decryption means 25 .

Here, the data communication means 21 in the decryption proxy 201 performs data communication based on the HTTP protocol, which is a standard protocol for data communication between a WWW server and a WWW browser.

This configuration allows the WWW browser 200 and the decryption proxy 201 to operate as independent programs, which in turn allows existing WWW browsers to be used as they are, and also makes it possible to add the data decryption means 25 to multiple WWW browsers using a single decryption proxy.

The data structure of the data to be encrypted will be explained later.
The user key generation device 5 includes a user key generation means 51 that generates a user private key and a user public key unique to each user, and a user key distribution means 52 that distributes the generated user private key to the private key storage means of the data receiving device 2 and distributes the generated user public key to the public key storage means of the data transmitting device 1. Specific examples of the user key generation device 5 that can be used include a personal computer or a workstation that has a user key generation program installed. The user key distribution means for distributing the user private key can include, for example, a means for recording the user private key on a physically secure medium such as an IC card and distributing it offline, a means for encrypting the user private key using a common key cryptosystem with the user's password or the like and then recording it on a recording medium such as a flexible disk and distributing it, and a means for distributing the user private key encrypted with the password or the like over a network. The user key distribution means 52 for distributing the user public key may, for example, be a means for recording the user public key on a physically secure medium such as an IC card and distributing it, a means for receiving a certificate for the user public key from a public institution called a certification authority, and then recording the user public key and certificate on a recording medium such as a flexible disk and distributing them offline, or a means for electronically distributing the user public key and certificate online using a network.

Although the data sending device 1, data receiving device 2, encryption target data creation device 4, and user key generation device 5 are described here as being implemented as separate devices, these devices can also be implemented as the same computer. For example, a configuration is possible in which a computer used by a user has the functions of the encryption target data creation device 4 , data receiving device 2 , and user key generation device 5 .

The recipient designation command is a command that is specified as needed and is a command that designates in advance the recipient who will receive the data to be encrypted. When a recipient designation command is specified, the data encryption means 14 of the data transmission device 1 encrypts the data to be encrypted so that only the recipient designated by this recipient designation command can correctly decrypt the data. The detailed configuration of the data encryption will be described later.

Specifically, the encryption range specification command specifies the start and end of the encryption range with the following character strings: <!--BEGIN SECRET-> and <!--END SECRET->, and specifies that the data enclosed by these strings should be encrypted. In HTML, the character string "<!***-->" is treated as a simple comment, unlike a normal command (hereafter, this command will be referred to as a comment command). Therefore, in existing WWW browsers and WWW servers, the encryption range specification command is ignored as a comment and does not affect the WWW browser or WWW server. Similarly, as shown in Figure 6 , other encryption processing commands also use HTML comment commands, with specific character strings assigned to each specific encryption processing command. Using comment commands in this way makes it possible to encrypt only the required range of data as needed, or to incorporate commands into the data to be encrypted so that only designated recipients can decrypt it, without affecting existing WWW servers or browsers.

First, Fig. 4 (1) shows the detailed configuration of the data encryption means 14. As shown in Fig. 4 (1) , the data encryption means 14 is composed of data key generation means 141 for generating a data key, which is a random number used when encrypting data to be encrypted, common key encryption means 142 for encrypting a range of the data to be encrypted specified by an encryption range designation command using the data key generated by the data key generation means 141, using a common key cryptosystem, user public key storage means 143 for storing the user public keys of each user, public key encryption means 144 for extracting the user public key of a recipient specified by a recipient designation command or recipient identification information received from the data receiving device from the user public keys stored in the user public key storage means 143, and encrypting the data key using the public key cryptosystem, and encrypted data generation means 145 for adding a decryption range designation command specifying a range to be decrypted or a key information designation command specifying the encrypted data key to the encrypted data to be encrypted.

Fig. 4(2) shows the detailed configuration of the data decryption means 25. As shown in Fig. 4(2), the data decryption means 25 comprises encrypted data analysis means 251 for extracting the encrypted data key specified by the key information specification command from the encrypted data, passing this encrypted data key to public key decryption means 253, and passing the range of the encrypted data specified by the decryption range specification command to common key decryption means 254, private key storage means 252 for storing a user private key, public key decryption means 253 for decrypting the encrypted data key using the user private key managed in the private key storage means 252 by the same public key cryptosystem as used in the data encryption means 14 , and common key decryption means 254 for decrypting the range of the encrypted data specified by the decryption range specification command by using the decrypted data key by the same common key cryptosystem as used in the data encryption means 14.

The user key generation process (S100) is performed by the user himself or herself or the administrator of this system using the user key generation device 5. Specifically, a user private key for each user and a user public key corresponding to the user private key are generated, and the generated user private key is delivered to the data receiving device 2 used by the user, and the user public key is delivered to the data transmitting device 1 .

The data creation process (S200) is performed by the data provider using the encryption target data creation device 4. Specifically, the data provider creates encryption target data and delivers the created encryption target data to the data transmission device 1 .

The data acquisition process (S300) is performed by each user using the data receiving device 2. Specifically, each user uses their own data receiving device 2 to transmit data request information requesting the transmission of provided data (encryption target data) that they wish to acquire to the data transmitting device 1 , receives encrypted encryption target data (encrypted data) corresponding to the data request information from the data transmitting device 1 , and performs processes such as decrypting and acquiring the received encrypted data.

As shown in FIG. 8, in the user key generation process, in the user key generation device 5 , the user key generation means 51 generates a user private key and a user public key corresponding to that user private key for each user (step S110), the user key distribution means 52 distributes the generated user private key to the user private key storage means 252 of the data receiving device 2 so as not to be discovered by a third party (step S120), the user private key is stored by the user private key storage means 252 of the data receiving device 2 (step S130), and the user key distribution means 52 distributes the generated user public key to the user public key storage means 143 of the data transmitting device 1 so as not to be tampered with by a third party (step S140), and the user public key is stored by the user public key storage means 143 of the data transmitting device 1 (step S150).

As shown in Figure 9, in the data creation process, in the encryption target data creation device 4 , the encryption target data creation means 41 creates encryption target data incorporating encryption range designation instructions, recipient designation instructions, etc. (step 210), and the data delivery means 42 delivers the created encryption target data to the data storage means 13 of the data transmission device 1 (step 220), and the encryption target data is stored in the data transmission device 1 (step 230 ).

(4) Detailed Operation of Data Acquisition Processing (S300) First, detailed operation will be described when the data transmission device 1 is configured with a WWW server and a CGI program, and the data reception device 2 is configured with a WWW browser and a decryption plug-in. Fig. 13 is a flowchart showing detailed operation of the data acquisition processing in this case.

As shown in FIG. 10, in the data acquisition process, first, in the WWW browser of the data receiving device 2 , the data input means 23 receives the designation of the data to be acquired from the user (step S310), then the data communication means 21 transmits data request information requesting transmission of the designated data and, as an option, recipient identification information specifying a recipient to the data transmitting device 1 (step S320), then in the WWW server of the data transmitting device 1 , the data communication means 11 receives the data request information and recipient identification information (step S330), and the data acquisition means 12 acquires the data to be encrypted corresponding to the received data request information (step S331). 40), the data encryption means 14 encrypts the acquired data to be encrypted so that it can be decrypted only by the recipient specified by the recipient designation command or the recipient identification information, to create encrypted data (step S350), the data communication means 11 transmits the encrypted data to the data receiving device 2 (step S360), in the data receiving device 2 the data communication means 21 receives the encrypted data (step S370), the data decryption means 25 decrypts the encrypted data (step S380), and the data processing means 22 passes the decrypted encrypted data to the data output means 24 for display or the like (step S390).

FIG. 11(1) is a flowchart showing the detailed operation of the data encryption means 14 in encrypting the data to be encrypted (step S350).

As shown in FIG. 11 (1), in the data encryption means 14 , the data key generation means 141 generates a data key (step S351), the common key encryption means 142 uses the generated data key to encrypt the range of the data to be encrypted specified by the encryption range designation command (step S352), the public key encryption means 144 obtains the user public key of the recipient specified by the recipient designation command or recipient identification information from the user public keys of each user stored in the user public key storage means 143 , and performs public key encryption using the obtained user public key (step S353), and the encrypted data creation means 145 creates encrypted data incorporating the encryption key information designation command that designates the encrypted data key and the decryption range designation command (step S354).

FIG. 11B is a flowchart showing the detailed operation of the data decryption means 25 for decrypting the encrypted data (step S380).

As shown in Figure 11 (2), in the data decryption means 25 , the encrypted data analysis means 251 obtains the encrypted data key specified in the key information specification command from the encrypted data (step S381), the public key decryption means 253 decrypts the encrypted data key using the user private key stored in the user private key storage means 252 (step S382), and the common key decryption means 254 decrypts the encrypted data using the decrypted data key (step S383), and obtains the decrypted encrypted data (step S384).

When the recipient of the data to be encrypted is specified by incorporating a recipient specification command into the data to be encrypted, there is no need to transmit recipient identification information from the data receiving device 2 to the data transmitting device 1 .

Next, a detailed operation will be described when the data transmitting device 1 is configured with a WWW server and an encryption proxy, and the data receiving device 2 is configured with a WWW browser and a decryption proxy. Fig. 12 is a flowchart showing the detailed operation of the data acquisition process in this case.

As shown in FIG. 12, in the data acquisition process, first, in the WWW browser of the data receiving device 2 , the data input means 23 receives designation of data to be acquired from the user (step S410), then the data communication means 21 transmits data request information requesting transmission of the designated data and, as an option, recipient identification information specifying a recipient to the data transmitting device 1 (step S420), then in the WWW server of the data transmitting device 1 , the data communication means 11 receives the data request information and recipient identification information (step S430), then the data acquisition means 12 acquires data to be encrypted corresponding to the received data request information (step S440), then the data communication means 11 transmits the data to be encrypted to the encryption proxy (step S450), and the encryption proxy receives the data to be encrypted by the data communication means 11 (step S460), The data encryption means 14 encrypts the acquired data to be encrypted so that it can only be decrypted by the recipient specified by the recipient designation command or the recipient identification information, creating encrypted data (step S470). The data communication means 11 transmits the encrypted data to the decryption proxy (step S480). In the decryption proxy of the data receiving device 2 , the data communication means 21 receives the encrypted data (step S490) and the data decryption means 25 decrypts the encrypted data (step S500). The data communication means 21 transmits the decrypted encrypted data to the WWW browser (step S510 ). The WWW browser receives the decrypted encrypted data through its data communication means 21 (step S520). The data processing means 22 passes the decrypted encrypted data to the data output means 24 for display or the like (step S530).

Here, the configurations of the data receiving device 2 and the user key generating device 5 can be the same as those in the first embodiment, and therefore a description thereof will be omitted here.

The data transmitting device 1 is composed of a data communication means 11 for receiving data request information and, optionally, recipient identification information from the data receiving device 2 and transmitting encrypted data corresponding to the data request information to the data receiving device 2, a data acquisition means 12 for retrieving the encrypted data corresponding to the data request information from the data storage means 13 and passing this encrypted data to the data communication means 11, and a data storage means 13 for storing the encrypted data.

Specifically, the data transmission device 1 can be a computer ( such as a personal computer or a workstation) equipped with an existing WWW (World Wide Web) server (such as a Netscape Communication server from Netscape Communications Inc.) that includes the above-mentioned data communication means 11, data acquisition means 12, and data storage means 13. In this case, the data communication means 11 included in the WWW server performs data communication based on the HTTP protocol, which is the standard communication protocol between WWW servers and WWW browsers.

Specifically, the encrypted data creation device 6 can be a computer (personal computer or workstation) equipped with a conventional text editor, commercially available software for creating existing WWW data (such as a homepage), and a program that implements a data encryption means.

As a specific method for realizing the data delivery means 63 , for example, it is possible to use a means for recording the data to be encrypted on a recording medium such as a flexible disk and delivering it offline.

As in the first embodiment, the user key generation process (S100) is performed by the user himself/herself or the administrator of this system using the user key generation device 5. Specifically, a user private key for each user and a user public key corresponding to the user private key are generated, and the generated user private key is delivered to the data receiving device 2 used by the user, and the user public key is delivered to the data transmitting device 1 .

Unlike the first embodiment, the data creation process (S200) is performed by the data provider using the encrypted data creation device 6 .

Specifically, the encryption target data is created, the created encryption target data is encrypted, and the data is delivered to the data transmission device 1 .

Unlike the first embodiment, the data acquisition process (S300) is performed by each user using the data receiving device 2. Specifically, each user uses his/her own data receiving device 2 to transmit data request information requesting transmission of the provided data (encrypted data) that the user wishes to acquire to the data transmitting device 1 , receives encrypted data corresponding to the data request information from the data transmitting device 1 , and performs processes such as decrypting and acquiring the received encrypted data.

As shown in Figure 14, in the data creation process, in the encrypted data creation device 6 , the encryption target data creation means 61 creates encryption target data incorporating encryption range designation instructions, recipient designation instructions, etc. (step 210), encrypts the encryption target data so that it can be decrypted only by the recipient designated in the recipient designation instruction, and creates encrypted data (step 220), and the data delivery means 63 delivers the created encryption target data to the data storage means 13 of the data transmission device 1 (step 230), and the encrypted data is stored in the data transmission device 1 (step 240).

The detailed operation of the data encryption means 62 to encrypt the data to be encrypted (step S220) is the same as in the first embodiment, and therefore a detailed description thereof will be omitted.

(4) Detailed Operation of Data Acquisition Process (S300) First, detailed operation will be described when the data receiving device 2 is configured with a WWW browser and a decryption plug-in. Fig. 15 is a flowchart showing detailed operation of the data acquisition process in this case.

As shown in FIG. 15, in the data acquisition process, first, in the WWW browser of the data receiving device 2 , the data input means 23 receives from the user the designation of data to be acquired (step S310), and then the data communication means 21 transmits data request information requesting transmission of the designated data (step S320). In the WWW server of the data transmitting device 1 , the data communication means 11 receives the data request information and recipient identification information (step S330), and then the data acquisition means 12 acquires encrypted data corresponding to the received data request information (step S340). The data communication means 11 then transmits the encrypted data to the data receiving device 2 (step S350). In the data receiving device 2 , the data communication means 21 receives the encrypted data (step S360), the data decryption means 25 decrypts the encrypted data (step S370), and the data processing means 22 passes the decrypted encrypted data to the data output means 24 for display or the like (step S380).

The detailed operation of the data decryption means 25 for decrypting the encrypted data (step S370) is the same as in the first embodiment, and therefore a detailed description thereof will be omitted.

Next, a detailed operation will be described for the case where the data receiving device 2 is configured with a WWW browser and a decryption proxy. Fig. 16 is a flowchart showing the detailed operation of the data acquisition process in this case.

As shown in FIG. 16, in the data acquisition process, first, in the WWW browser of the data receiving device 2 , the data input means 23 receives the designation of the data to be acquired from the user (step S410), the data communication means 21 transmits data request information requesting transmission of the designated data to the data sending device 1 (step S420), the data communication means 11 in the WWW server of the data sending device 1 receives the data request information and the recipient identification information (step S430), the data acquisition means 12 acquires the encrypted data corresponding to the received data request information (step S440), and the data communication means 11 The encrypted data is sent to the decryption proxy by the data communication means 21 (step S460), and the encrypted data is decrypted by the data decryption means 25 (step S470) in the decryption proxy of the data receiving device 2. The decrypted encrypted data is sent to the data communication means 21 by the data communication means 21 (step S480), and the decrypted encrypted data is received by the data communication means 21 of the WWW browser (step S490), and the decrypted encrypted data is passed to the data output means 24 by the data processing means 22 for display or the like (step S500).

Claims (9)

A data decryption method for performing data processing including decryption processing in accordance with an instruction embedded in encrypted data that specifies a data processing method including a decryption processing method, the method comprising:
A data decryption method for encrypted data into which a decryption range designation instruction for designating a range to be decrypted is embedded, the method comprising: decrypting a range designated by the decryption range designation instruction. When the encrypted data includes, in addition to the decryption range designation command, a recipient designation command that designates a recipient of the encrypted data,
5. The data decryption method according to claim 4, wherein a range specified by the decryption range designation command is decrypted using a decryption key held by a recipient specified by the recipient designation command. When the encrypted data includes, in addition to the decryption range designation command, a key information designation command that designates the encrypted first decryption key,
When decrypting the encrypted data, the encrypted first decryption key designated by the key information designation command is decrypted with a second decryption key held by a recipient;
5. The data decryption method according to claim 4, wherein the encrypted data is decrypted using the decrypted first decryption key, and the range specified by the decryption range specification command is decrypted using the decryption key. A data decryption method described in any one of claims 4 to 6, characterized in that when the instructions incorporated into the data to be encrypted are, in particular, instructions based on HTML (Hypertext Markup Language), a comment specification command defined in HTML is used as a method of describing the group of instructions for encryption processing, i.e., the encryption range specification command, the decryption range specification command, the recipient specification command, and the key information specification command, and when a predetermined specific comment is specified as the comment, a corresponding command is deemed to have been specified from the group of instructions for the encryption processing. A data decryption device that performs data processing including decryption on encrypted data in accordance with an instruction that specifies a data processing method including a decryption method, the data decryption device comprising: a data communication means, a data processing means, a data input means, a data output means, and a data decryption means;
A data decryption device characterized in that, when information specifying data to be encrypted that is to be obtained from outside is input to the data input means, the data communication means transmits data request information requesting the transmission of the data to be encrypted, receives encrypted data corresponding to the data request information and incorporating a decryption range designation command that specifies the range to be decrypted, the data decryption means decrypts the range of the encrypted data specified by the decryption range designation command, and the data processing means outputs the decrypted encrypted data to the data output means to which a data output device such as a display or printer is connected. The data decoding device according to claim 11, characterized in that the data receiving device is a computer having a decoding program implemented therein, and the data receiving device is particularly a WWW browser having the data communication means, the data processing means, the data input means, and the data output means, and the data decoding means. The decoding program includes, in addition to the data decoding means, a WWW server or a WWW browser;
13. The data decryption device according to claim 12, wherein the data decryption device is a program having a data communication means for transmitting and receiving the data to be encrypted or the encrypted data. a data encryption device on a sending side, which includes a data communication means, a data acquisition means, a data storage means, a data encryption means, and a user key storage means;
a receiving-side data decryption device including a data communication means, a data processing means, a data input means, a data output means, a data decryption means, and a user key storage means; and a network.
an encryption target data creation device including an encryption target data creation means and an encryption target data delivery means;
A data encryption system comprising a user key generation device having a user key generation means and a user key distribution means,
In the user key generation device, the user key generation means generates an encryption key specific to each user and a decryption key corresponding to the encryption key, and the user key distribution means stores the encryption key in the user key storage means of the data encryption device on the sending side and stores the decryption key in the user key storage means of the data decryption device on the receiving side;
In the encryption target data creation device, the encryption target data creation means creates encryption target data incorporating an encryption range designation command that designates the range to be encrypted, and the encryption target data delivery means stores the encryption target data in the data storage means of the data encryption device on the sending side,
In the data decryption device on the receiving side, when information specifying encryption target data to be acquired from the outside is input to the data input means, the data communication means transmits data request information requesting transmission of the encryption target data to the data encryption device on the sending side using the network,
In the data encryption device on the sending side, when the data communication means receives data request information requesting transmission of encryption target data stored in the data storage means, the data acquisition means acquires the encryption target data requested in the data request information from the data storage means, the data encryption means encrypts a range of the encryption target data specified by the encryption range designation command, and creates encrypted data incorporating a decryption range designation command that designates a range to be decrypted into the encryption target data, at least a portion of which is encrypted as a result, and the data communication means transmits the encrypted data to the data decryption device on the receiving side using the network,
A data encryption system characterized in that in the data decryption device on the receiving side, the encrypted data is received, the data decryption means decrypts a range of the encrypted data specified by a decryption range designation command, and the data processing means outputs the decrypted encrypted data to the data output means to which a data output device such as a display or a printer is connected. a data encryption device on the sending side that includes a data communication means, a data acquisition means, and a data storage means;
a receiving-side data decryption device comprising a data communication means, a data processing means, a data input means, a data output means, a data decryption means, and a user key storage means;
Network and
an encrypted data generating device including encryption target data generating means, data encryption means, user key storage means, and encrypted data delivery means;
A data encryption system comprising a user key generation device having a user key generation means and a user key distribution means,
In the user key generation device, the user key generation means generates an encryption key specific to each user and a decryption key corresponding to this encryption key, and the user key distribution means stores the encryption key in the user key storage means of the encrypted data creation device and stores the decryption key in the user key storage means of the data decryption device on the receiving side;
In the encrypted data creation device, the encrypted data creation means creates encryption target data incorporating an encryption range designation instruction that designates the range to be encrypted, the data encryption means encrypts the range of the encryption target data designated by the encryption range designation instruction, and creates encrypted data incorporating a decryption range designation instruction that designates the range to be decrypted into the encryption target data, at least a portion of which is encrypted as a result, and the encrypted data delivery means stores the encrypted data in the data storage means of the data encryption device on the sending side,
In the data decryption device on the receiving side, when information specifying encryption target data to be acquired from the outside is input to the data input means, the data communication means transmits data request information requesting transmission of the encrypted data to the data encryption device on the sending side using the network,
In the data encryption device on the sending side, when the data communication means receives data request information requesting transmission of encrypted data stored in the data storage means, the data acquisition means acquires the encrypted data requested by the data request information from the data storage means, and the data communication means transmits the encrypted data to the data decryption device on the receiving side using the network;
A data encryption system characterized in that in the data decryption device on the receiving side, the encrypted data is received, the data decryption means decrypts a range of the encrypted data specified by a decryption range designation command, and the data processing means outputs the decrypted encrypted data to the data output means to which a data output device such as a display or a printer is connected.