JP2006253860A - Encrypted information share system, encrypted information share method, and information relay server used for same - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an encrypted information share system, an encrypted information share method, and an information relay server used for the same capable of ensuring communication security and relieving the load imposed on a sender terminal and recipient terminals. <P>SOLUTION: The encrypted information share system includes: the information sender terminal 21, a plurality of the information recipient terminals 52a to 52n, and the information relay server 30, which are interconnected via a network 40. The information relay server 30 includes: a data processing apparatus 31 including mail transmission reception sections 311, 314, a decoding section 312, a content registration section 313, and a request processing section 315; and a storage device 32 including a key information storage section 321, a content storage section 322, and a user information storage section 323. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an information encryption technique, and more particularly to an encrypted information sharing system, an encrypted information sharing method, and an information relay server used therefor, which share encrypted information via a network.

  Due to advances in network technology and communication technology, a large amount of data (or information) is transmitted through the network. With such network communication technology, it is possible for a caller and a receiver to make a call and open a received mail at their convenience regardless of the circumstances of the other party. However, since many users can access the communication network, the security (prevention of leakage and eavesdropping) of information placed on the network is important. In particular, sufficient security measures are necessary when transmitting confidential information over a network.

  On the other hand, even in the case of transmission of confidential information through a network, it is easy to access such information between specific users (for example, specific members in the same company) without requiring complicated operations. You may want to share.

  Prior art relating to or relating to such information encryption or the use of encrypted information is disclosed in several technical documents. The information sender saves a part or all of the encrypted information on the electronic bulletin board, and then the information receiver takes out the encrypted information once and asks the information sender for a key for decryption. An information sharing system is disclosed in which a key is sent from the received information sender to the information receiver using e-mail or the like, and the information is decrypted on the information receiver terminal using the key to obtain information ( For example, see Patent Document 1).

  Also, an encryption communication method and an encryption communication system are disclosed in which a communication person can share an encryption key with any one or a plurality of communication partners when performing broadcast communication by an electronic mail system or the like (for example, , See Patent Document 2). Furthermore, a data encryption system, an information processing apparatus, an IC card, and data that reduce the burden on the user by using an IC card that generates a group key based on a master key and a mail destination list when transmitting mail (See, for example, Patent Document 3).

JP-A-1-98032 (page 2-3, FIG. 1) Japanese Patent Laid-Open No. 6-152592 (page 7, FIG. 1) Japanese Patent Laid-Open No. 11-8615 (page 6-7, FIG. 1)

  The prior art described above has several problems. First, regarding the technique of Patent Document 1, the burden on the information sender is large. This is because it is necessary to send a decryption key each time a request is received from an information recipient, and at that time it is necessary to confirm the identity and secure a secure means for transmitting the key. . In addition, information sharing is delayed. The reason for this is that the information receiver individually checks the contents of the electronic bulletin board, determines that the information is his / her necessary information based on the title, etc., and then takes out the encrypted information and This is because it is necessary to perform the billing and decryption processing.

  Moreover, about the technique of the patent document 2 and the patent document 3 mentioned above, the load at the time of system introduction of both an information sender and an information receiver is large. The reason is that it is necessary to distribute the IC card in advance to both the information sender and the information receiver. On the other hand, when the IC card is not used, it is necessary to securely distribute the master key to both the information sender and the information receiver.

  Further, as another example of a system for sharing information using a network, when using an encrypted mail using public encryption such as S / MIME, all information recipients individually need to use a private key and a public key in advance. Generate and manage Then, the public key is sent to the information sender, and the information sender needs to set it in mail software or the like. When there are many information receivers, the work load increases. In order to reduce the burden of work, it is possible to use a mailing list, generate a set of public and private keys as a mailing list, and share the secret key with all information recipients. Therefore, security considerations such as a method for safely sending a secret key and a method for collecting a secret key from a user who is no longer an information receiver are required.

  The present invention has been made in view of the above-described problems of the prior art, and an encrypted information sharing system that solves or improves such problems to ensure security and share information using a network. The main object is to provide an encrypted information sharing method and an information relay server used therefor.

  In order to solve the above-mentioned problems, the encrypted information sharing system, the encrypted information sharing method, and the information relay server used therefor employ the following characteristic configuration.

(1) Encrypted information sharing system for sharing encrypted mail transmitted from one terminal (information sender terminal) mutually connected via a network with other terminals (information receiver terminals) In
An encrypted information sharing system comprising an information relay server that performs decryption of encrypted mail from the information sender terminal and notification of mail arrival to the information receiver terminal.
(2) The encrypted information sharing system according to (1), wherein the encrypted mail from the information sender terminal is an encrypted mail using public key encryption such as S / MIME (Secure Multi-purpose Internet Mail Extensions).
(3) The encrypted information according to (1) or (2), wherein an information sender mail server and an information receiver mail server are interposed between the information sender terminal and the information receiver terminal and the information relay server, respectively. Shared system.
(4) The encrypted information sharing system according to (3), wherein communication between the information sender terminal and the mail server corresponding to the information receiver terminal is performed by SMTP (Simple Mail Transfer Protocol).
(5) The information relay server includes an information processing device and a storage device,
The information processing apparatus includes: a mail transmitting / receiving unit that transmits / receives mail to / from the information sender mail server and the information receiver mail server; a decrypting unit that decrypts the received mail; a content registration unit that registers content and user information And request processing means corresponding to the access request from the information receiver terminal,
The encrypted information according to any one of (1) to (4), wherein the storage device includes a key information storage unit that stores key information, a content storage unit that stores the content, and a user information storage unit that stores user information. Shared system.
(6) including a plurality of terminals interconnected via a network, an information sender terminal that transmits information among the terminals, and an information relay server that mediates communication between a plurality of information receiver terminals that receive information, In the encrypted information sharing method for sharing the encrypted mail from the information sender terminal with the information receiver terminal,
The information sender terminal receives a mail encrypted with a public key and decrypts it with the information relay server using a secret key; and sends a mail addressed to the information receiver terminal including a URL to send the mail An encrypted information sharing method comprising: storing content corresponding to the URL; and returning the content by HTTPS after user authentication in response to an HTTPS content request from the information receiver terminal .
(7) The encrypted information sharing method according to (6), comprising the steps of: attaching an electronic signature to the encrypted mail at the information recipient terminal; and processing an email in which the electronic signature matches registered information.
(8) In an information relay server connected to the network in order to transmit an encrypted mail from an information sender terminal among a plurality of terminals connected to the network and share it with a plurality of information receiver terminals,
Mail transmission / reception means for transmitting / receiving mails of the information sender terminal and the information receiver terminal, decryption means for decrypting the received mail, content registration means for registering the contents of the mail, and access requests from the information receiver terminal Data processing apparatus including request processing means to deal with, key information storage section for storing key information to be sent to decryption means, content storage section for storing content, user information to be sent to content registration means and request processing means An information relay server comprising a storage device including a user information storage unit for storing the information.

  According to the encrypted information sharing system, the encrypted information sharing method and the information relay server used therefor according to the present invention, the following remarkable effects in practical use can be obtained. First, security can be ensured by encryption. The reason is that mail encryption using a public key method such as S / MIME is performed between the information sender terminal and the information relay server, and communication between the information relay server and the information receiver terminal is performed using HTTPS. This is because it is encrypted. Further, although the URL itself for accessing information flows through the network in a uniform manner, user authentication is required for access, and therefore it is impossible for a third party to access the information.

  Second, the burden on both the information sender and the information receiver is reduced. The reason is that the information sender terminal has mail software capable of sending encrypted mail by public key cryptography such as S / MIME, and the information receiver terminal has mail software and a web browser that supports HTTPS. This is because, when using a PC (personal computer) that is currently widely distributed, these softwares have already been installed and it is not necessary to perform new installation work. In addition, key exchange and management are also automatically executed by these software without any user operation, which reduces the operational burden.

  Hereinafter, the configuration and operation of a preferred embodiment of an encrypted information sharing system, encrypted information sharing method, and information relay server according to the present invention will be described in detail with reference to the accompanying drawings.

  FIG. 1 is a system configuration diagram showing an outline of an encrypted information sharing system according to the present invention. The encrypted information sharing system 10 includes an information sender terminal 21, an information sender mail server 22, an information relay server 30, a network 40, a plurality of information receiver mail servers 51a to 51n, and a plurality of corresponding information receiver terminals 52a. It is comprised by -52n. The information sender terminal 21, the information sender mail server 22, the information relay server 30, the plurality of information receiver mail servers 51a to 51n, and the plurality of information receiver terminals 52a to 52n are connected to each other via the network 40. ing.

  Next, FIG. 2 is a functional block diagram showing a detailed configuration of the encrypted information sharing system 10 shown in FIG. The information relay server 30 includes a data processing device 31 and a storage device 32.

  The data processing device 31 includes a mail reception unit (or mail reception unit) 311, a decryption unit (or decryption unit) 312, a content registration unit (or content registration unit) 313, a mail transmission unit (or mail transmission unit) 314, and A request processing unit (or request processing means) 315 is included. The storage device 32 includes a key information storage unit 321, a content storage unit 322, and a user information storage unit 323.

  In the information relay server 30, the mail reception unit 311 and the key information storage unit 321 of the storage device 32 are connected to the decryption unit 312. The decryption unit 312 is connected to the content registration unit 313. The content registration unit 313 is connected to the content recording unit 322 and the mail transmission unit 314. Further, the content storage unit 322 is connected to the request processing unit 315. The user information storage unit 323 is connected to the content registration unit 313 and the request processing unit 315.

  The information sender terminal 21 is connected to the mail receiver 311 of the data processing device 31 of the information relay server 30 via the information sender mail server 22. On the other hand, the information receiver terminals 52a to 52n are connected to the request processing unit 315 of the data processing unit 31 of the information relay server 30, and the data processing of the information relay server 30 via the respective information receiver mail servers 51a to 51n. The mail transmission unit 314 of the device 31 is connected.

  Here, the network 40 is a network constructed in the company by the Internet and a public network or the like for dial-up connection or a VPN (Virtual Private Network) such as a LAN (Local Area Network) or a WAN (Wide Area Network). Alternatively, both are connected via a firewall or the like. As will be described later, it is assumed that the network protocol used for connection between the elements is appropriately adjusted so that communication is possible. For example, the information sender terminal 21 is adjusted to be able to communicate with the information sender mail server 22 using SMTP (Simple Mail Transfer Protocol). In FIG. 2, the network 40 is omitted for convenience.

  The information sender terminal 21 is installed with mail software capable of sending encrypted mail by public key encryption such as S / MIME (Secure Multi-purpose Interface Mail Extensions), and SMTP is sent to the information sender mail server 22. It can be used to send e-mails. For simplicity of explanation, the information sender terminal 21 and the information sender mail server 22 are each single here, but may be plural and overlap with the information receiver terminals 52a to 52n. Or overlapping.

  The information sender mail server 22 transfers the mail received using SMTP to the information relay server 30. In general, a plurality of mail servers are interposed between the information sender mail server 22 and the information relay server 30 for mail transfer, but are omitted in FIGS. The same applies to the information relay server 30 and the information recipient mail servers 51a to 51n.

  In the information relay server 30, the mail receiver 311 receives the encrypted mail from the information sender terminal 21 transferred from the information sender mail server 22 by SMTP and passes it to the decryptor 312. Accordingly, the decryption unit 312 decrypts the received encrypted mail using the private key information extracted from the key information storage unit 321 and passes the decrypted encrypted mail to the content registration unit 313.

  The content registration unit 313 converts the content of the decrypted mail into a format such as HTML (Hyper Text Markup Language). Then, the content of the converted mail is stored in the content storage unit 322 and the mail address of each information recipient acquired from the user information storage unit 322 is used as a destination, and the content reference URL (Uniform Resource Locator) information is included. A notification e-mail notifying the arrival of the e-mail is created and passed to the e-mail transmission unit 314.

  The mail transmission unit 314 transfers mail by SMTP to the information recipient mail servers 51a to 51n. At this time, encryption processing is not performed. The information receiver terminals 52a to 52n are installed with a web browser that supports mail software and HTTPS (Hyper Text Transfer Protocol Security). Each of the information recipient mail servers 51 a to 51 n can acquire the mail received from the information relay server 30. Further, it is assumed that a content request can be made to the information relay server 30 using HTTPS using a reference URL information included in the mail, and the response can be displayed on a display unit (not shown). .

  The request processing unit 315 refers to user information acquired from the user information storage unit 322 in response to an access request in HTTPS received from the information receiver terminals 52a to 52n, and performs user authentication by a standard procedure such as password authentication. Check access authority. And the content of the mail preserve | saved from the content memory | storage part 322 is acquired, and a response is returned by HTTPS to the information receiver terminals 52a-52n.

  Next, the operation of the encrypted information sharing system 10 according to the present invention shown in FIGS. 1 and 2 will be described in detail with reference to FIG. FIG. 3 is a sequence diagram showing operations among the information receiver terminal 21, the information receiver mail server 22, the information relay server 30, the plurality of information receiver mail servers 51a to 51n, and the plurality of information receiver terminals 52a to 52n. is there.

  The case where information is transmitted from the information sender terminal 21 in the sequence diagram of FIG. 3 will be described. First, using the public key of the information relay server 30 obtained in advance, encryption is performed by a method (for example, S / MIME) decided in advance by mail software (step S1). This encrypted information is sent to the information sender mail server 22 by SMTP as a mail addressed to the information relay server 30 (step S2).

  The information sender mail server 22 transfers the received encrypted mail to the information relay server 30 by SMTP (step S3). Next, the information relay server 30 decrypts the encrypted mail received by the mail reception unit 311 by the decryption unit 312 (step S4). Then, registration in the content storage unit 322 is performed by the content registration unit 313 (step S5), and a notification mail including a reference URL to the content addressed to each information receiver terminal 52a to 52n is created. The mail is transferred to the information recipient mail servers 51a to 51n by SMTP (step S6). The information receiver terminals 52a to 52n receive notification mails from the information receiver mail servers 51a to 51n, respectively (steps S7 and S8). Then, by a user operation, a content request is made from the Web browser to the information relay server 30 by using the content reference URL included in the notification mail (step S9 and step S10).

  Finally, the information relay server 30 receives the content request from the information receiver terminals 52a to 52n by the request processing unit 315, performs user authentication and confirmation of access authority by a standard procedure such as password authentication, and the content storage unit The mail content stored in 322 is returned to the information recipient terminals 52a to 52n as a response by HTTPS (step S11 and step S12). The Web browsers of the information receiver terminals 52a to 52n display the mail contents obtained as a response by HTTPS from the information relay server 30 on the display unit described above.

  The information transmitted from the information sender terminal 21 is displayed on the browsers of the information receiver terminals 52a to 52n by the series of flows (or operations) described above. And the user of these information receiver terminals 52a-52n can share the received encryption information.

  Next, another embodiment or modified embodiment of the encrypted information sharing system and the encrypted information sharing method according to the present invention will be described. First, for an information recipient who can receive an encrypted mail by S / MIME or the like, the public key information is registered in the user information storage unit 323 in advance, and instead of sending a notification mail, an encrypted mail is sent. May be sent directly.

  In addition, the information sender is limited to the one that can digitally sign an e-mail by S / MIME, etc., and the content registration unit 313 checks the information in the user information storage unit 323 with the electronic signature, and from the authorized information sender Only this information may be processed.

  The configuration and operation of the preferred embodiment of the encrypted information sharing system and the encrypted information sharing method according to the present invention have been described in detail above. However, it should be noted that such examples are merely illustrative of the invention and do not limit the invention in any way. Those skilled in the art will readily understand that various modifications and changes can be made according to a specific application without departing from the spirit and spirit of the present invention. The present invention is also suitable for use in sharing information such as technical information by a large number of specific members within a company or between companies.

1 is a system configuration diagram showing an overview of a preferred embodiment of an encrypted information sharing system according to the present invention. FIG. 2 is a functional block diagram mainly showing a detailed configuration of an information relay server in FIG. 1. It is a sequence diagram for demonstrating operation | movement of the encryption information sharing system shown to FIG. 1 and FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Encrypted information sharing system 21 Information sender terminal 22 Information sender mail server 30 Information relay server 31 Data processing device 311 Mail receiving unit 312 Decoding unit 313 Content registration unit 314 Mail sending unit 315 Request processing unit 32 Storage device 321 Key Information storage unit 322 Content storage unit 323 User information storage unit 40 Network 51a to 51n Information recipient mail server 52a to 52n Information recipient terminal

Claims (8)

In an encrypted information sharing system in which an encrypted mail transmitted from one terminal (information sender terminal) mutually connected via a network is shared by a plurality of other terminals (information receiver terminals),
An encrypted information sharing system comprising: an information relay server that performs decryption of encrypted mail from the information sender terminal and notification of mail arrival to the information receiver terminal.   2. The encrypted information sharing according to claim 1, wherein the encrypted mail from the information sender terminal is an encrypted mail using public key encryption such as S / MIME (Secure Multi-purpose Internet Mail Extensions). system.   The encryption according to claim 1 or 2, wherein an information sender mail server and an information receiver mail server are interposed between the information sender terminal and the information receiver terminal and the information relay server, respectively. Information sharing system.   4. The encrypted information sharing system according to claim 3, wherein communication between the information sender terminal and the mail server corresponding to the information receiver terminal is performed by SMTP (Simple Mail Transfer Protocol). The information relay server includes an information processing device and a storage device,
The information processing apparatus includes: a mail transmitting / receiving unit that transmits / receives mail to / from the information sender mail server and the information receiver mail server; a decrypting unit that decrypts the received mail; a content registration unit that registers content and user information And request processing means corresponding to the access request from the information receiver terminal,
5. The storage device according to claim 1, wherein the storage device includes a key information storage unit that stores key information, a content storage unit that stores the content, and a user information storage unit that stores user information. Encryption information sharing system. An information relay server that mediates communication between a plurality of terminals interconnected via a network, an information sender terminal that transmits information among the terminals, and a plurality of information receiver terminals that receive information; In the encrypted information sharing method for sharing the encrypted mail from the user terminal with the information receiver terminal,
The information sender terminal receives a mail encrypted with a public key and decrypts it with the information relay server using a secret key; and sends a mail addressed to the information receiver terminal including a URL to send the mail An encrypted information sharing method comprising: storing content corresponding to the URL; and returning the content by HTTPS after user authentication in response to an HTTPS content request from the information receiver terminal .   The encrypted information sharing according to claim 6, comprising the steps of: attaching an electronic signature to the encrypted mail at the information recipient terminal; and processing an email in which the electronic signature matches registered information. Method. In the information relay server connected to the network in order to transmit the encrypted mail from the information sender terminal of the plurality of terminals connected to the network and share it with the plurality of information receiver terminals,
Mail transmission / reception means for sending / receiving mails of the information sender terminal and the information receiver terminal, decryption means for decrypting the received mail, content registration means for registering the contents of the mail, and access requests from the information receiver terminal Data processing apparatus including request processing means to cope with, key information storage section for storing key information to be sent to decryption means, content storage section for storing content, user information to be sent to content registration means, and request processing means And a storage device including a user information storage unit for storing the information relay server.

Images