WO2006001153A1

WO2006001153A1 - File managing program

Info

Publication number: WO2006001153A1
Application number: PCT/JP2005/009908
Authority: WO
Inventors: Tao Wang; Tao Guo; Junichiro Kawaguchi; Jun Li; Chen Yu
Original assignee: Easy Systems Japan Ltd.
Priority date: 2004-06-29
Filing date: 2005-05-30
Publication date: 2006-01-05
Also published as: JP2008026925A

Abstract

A file managing program for consolidating files without marring the convenience of the users. The file managing program has a file specifying block (21) which receives specification of an original file to be managed, a policy formulating block (22) for formulating a policy of when the original file is used, and a package block (23) for packaging a policy file created according to a common key created for each original file and the policy and the original file encrypted with the common key and thus creating a package file. The package file is so created that only the user satisfying the use condition of the policy can develop the common key in the policy file and the right to use the original file on a temporary memory of a terminal (4) of the user, can develop the original file encrypted with the common key only on the temporary memory, and can use the original file within the scope of the use right.

Description

Specification

File management program

Technical field

[0001] The present invention relates to a file management program, and more particularly to a file management program for setting a use condition to package a file and using a packaged file within the range of the use condition.

Background art

Conventionally, as a distribution system that sets usage conditions and distributes data or software to users, there has been a distribution system as shown in Patent Document 1.

[0003] In the distribution system disclosed in Patent Document 1, the distribution server encrypts data with usage agreement, software, and usage conditions by an encryption processing unit using an encryption key corresponding to the client terminal of the distribution destination, Send it after packaging in the package part. The client terminal uses the encryption key in the encryption processing unit to decrypt the usage conditions, and when the usage conditions are available, the client terminal decrypts and installs the data and software.

[0004] According to such a distribution system, it is possible to add and encrypt usage conditions without re-consolidating data and software, and to distribute in a format that can be executed in a client terminal. Data and software with contracts can be easily created and distributed to users, and data and software with contracts can be easily used by users.

[0005] However, such a distribution system has the following technical problems.

[0006] Patent Document 1: Japanese Patent Application Laid-Open No. 2002-189526

Disclosure of the invention

Problems to be solved by the invention

[0007] In the distribution system disclosed in Patent Document 1, since the usage conditions are encrypted with a key for each client terminal that uses data and software, a knock file is naturally created for each terminal client. Generated.

[0008] Therefore, for example, a plurality of users inside and outside the company want to use data and software. In this case, it is necessary to generate as many package files as the number of users, and data cannot be shared among multiple users, making it difficult to centrally manage data.

[0009] The present invention has been made in view of such conventional problems, and the object of the present invention is to provide a file that can be centrally managed without impairing the convenience of the user. To provide a management program.

Means for solving the problem

[0010] The invention of claim 1

A file management program having a file package program that is stored and executed in a user terminal and performs central management of an original file created by an arbitrary user. A file designating unit that accepts file specifications, a policy planning unit that formulates a policy for using the original file, a common key generated for each original file, and a policy generated based on the policy A package unit that generates a package file by packaging the file and the original file encrypted with the common key, and only a user who satisfies the policy usage conditions can store the file in the policy file. The usage rights for the common key and the original file can be expanded on the temporary memory of the user terminal, and A file management program for generating the package file so that the original file decrypted with the common key can be expanded only on the temporary memory and the original file can be used within the range of the use authority.

[0011] The invention of claim 2

The file management program further includes a search unit for searching for information related to a package history of the package file and information related to a user access history to the package file.

[0012] According to the inventions of claims 1 and 2, after encrypting all types of files with the common key generated for each file, the files are packaged together with the policy file, and the user satisfies the use conditions. Users will be provided with a mechanism for granting the authority to use the original file only, and a mechanism for checking the user's access history.

[0013] Moreover, the number of users who package the original file depends on the number of users who are given usage rights. Regardless, it is possible to share the original file among multiple users simply by creating a single package file and storing it in a storage medium that can be accessed by the user terminal that has been given the right to use it. Become.

[0014] That is, it becomes possible to perform unified management of files while maintaining a high security level and without impairing convenience when generating a user's package file.

[0015] The invention of claim 3

A package file is generated in the package part, and a notification of sending the package file or sending the package file by e-mail attachment is sent to the user terminal of the user who is authorized to use the original file. This is a file management program with a part.

[0016] According to the invention of claim 3, the user's user terminal, which has been given the authority to use the original file, cannot inadvertently know the existence of the package file in which the original file is packaged. As a result, a user who has been granted the right to use the original file can immediately use the original file.

[0017] The invention of claim 4

It has a file use program that is stored and executed in the user terminal and that is used by the user by restoring the original file packaged by the file package program for centralized management of the original file created by any user The file management program comprises a file specification unit that accepts specification of a package file in which a source file to be used is packaged among package files, and a policy file in the package file. If the usage of the original file is within the range of the usage conditions, it is a common key generated for each original file and used for the encryption key. The decryption key of the original file and the right to use the original file are -The contents of the package file are encrypted by the decryption key decryption unit that develops the decryption key and the usage authority on the temporary memory of the user terminal, and the acquired common key. A decryption unit that decrypts the original file and expands it on a temporary memory of the user terminal; A file management program having a file usage control unit for controlling usage of the original file based on the acquired usage right.

[0018] According to the invention of claim 4, the use authority of the original file and the decryption key of the original file are included in the knock file so that they can be decrypted only when the use conditions are satisfied. Therefore, only when the user satisfies the usage conditions of the policy included in the knock file, the user is authorized to use the original file, and the user cannot use the original file. Will be provided. In other words, the file management program 1 makes it possible to use the original file by a user who has been given usage rights while maintaining a high security level.

[0019] If the usage authority is limited to authority other than editing and saving, users other than the user who created the original file cannot change the original file. The same original file is shared among users. This has the same effect even if it is stored in the user terminal of a user who is authorized to use the package file by means of email attachment.

[0020] That is, a user can share the same original file with other users as a result without accessing a user terminal other than the user terminal. In this way, the same original file can be shared with other users because the original file is encrypted with the common key generated for each original file, and the number of users depends on the number of users. This is also due to the fact that one package file is generated.

[0021] The invention of claim 5 provides:

The file usage control unit controls the corresponding software of the original file, and performs the API hooking that performs the function call instruction based on the acquired usage authority to the OS or middleware of the user terminal. This is a file management program.

[0022] According to the invention of claim 5, it is possible to use existing original file compatible software without creating dedicated software for browsing, printing, editing, saving, etc. corresponding to any original file. It is possible to control usage rights.

[0023] The invention of claim 6 Further, when the encrypted original file in the package file is decrypted and the original file is edited based on the user's usage rights, the edited original file is again stored in the policy file. It is a file management program having a repackaging section that packages together and updates the original package file.

[0024] According to the invention of claim 6, by updating the knock file, the central management of the original file is continuously performed, and the original file shared by a plurality of users is maintained. The unity of the file is also preserved.

[0025] The invention of claim 7

When the original file is repackaged, the file management program includes a notification unit that notifies the user terminal or server of the user who created the original file that the repackage has been performed.

[0026] According to the invention of claim 7, the user or server that created the original file can immediately confirm that the original file has been updated.

[0027] The invention of claim 8

Each time the user terminal tries to use the original file in the package file at the user terminal, the usage situation database that can update the usage situation of the original file by the user terminal is read and updated by a user terminal other than the user terminal. The file management program includes a database generation unit that generates the user terminal in a state incapable of being performed.

[0028] According to the invention of claim 8, the usage status database is generated in the user terminal, thereby preventing and detecting the unauthorized use of the original file in the user terminal other than the user terminal. I can do it.

[0029] The invention of claim 9

Part or all of the policy file is stored in a server, and the file usage program is a file management program that requests the server to check usage conditions in the policy file.

[0030] According to the invention of claim 9, by placing a part or all of the policy file on the server, it is possible to further prevent illegal acts such as falsification of the policy file. [0031] The invention of claim 10

The policy file is encrypted with a key replaced by a replacement table generated for each server. The replacement table stores the file management program in the user terminal and the user terminal. Is a file management program stored in

[0032] According to the invention of claim 10, unauthorized use of the package file alone can be prevented.

[0033] The invention of claim 11

In the policy file, the usage conditions are described in association with a plurality of policy objects. When the usage conditions corresponding to an arbitrary policy object are satisfied, another policy object is opened. Keys can be obtained, and finally all policy object keys are opened, and only when all usage conditions are satisfied, the decryption key and usage rights can be extracted. This file management program has a data structure.

[0034] According to the invention of claim 11, it becomes more difficult to extract the decryption key and the usage authority easily and use it illegally.

[0035] The invention of claim 12

It has an authentication interface that authenticates whether or not it is a registered user of the file management program, or whether or not it is a use-permitted user of the original file included in the use conditions, and the authentication interface is determined by a request from the user The second password of the user output from the authentication device or the authentication device determined in advance on the authentication interface side, and the type of the authentication device, together with the login ID and password of the file management program, the user terminal capability It is a file management program that sends data to a server and requests verification with data already stored in the server.

[0036] The invention of claim 13

The authentication interface includes template data stored in the sano or the user terminal if the authentication device includes encryption logic. In other words, the template data corresponding to the login ID is obtained, the second password is obtained by verifying and decrypting the signature with the user's PKI certificate, and the data already stored in the server. This is a file management program that requests verification.

[0037] According to the inventions of claims 12 and 13, the server or the user terminal can perform the user authentication regardless of the authentication device power of any kind and the user authentication result. The number and combination of user authentication can be changed arbitrarily.

The invention's effect

[0038] According to the file management program of the present invention, all types of files are encrypted with the common key generated for each file, and then knocked together with the policy file to satisfy the usage conditions. A mechanism that gives only the user the authority to use the original file and a mechanism for checking the user's access history will be provided to the user.

[0039] Moreover, the user who packages the original file generates a single package file regardless of the number of users who are given usage rights, and the user terminal of the user who has given usage rights can access the memory. The original file can be shared among multiple users simply by storing it on the medium.

[0040] In addition, since the use authority of the original file and the decryption key of the original file are included in the package file so that they can be decrypted only when the use conditions are satisfied, the user includes them in the package file. Only when the usage conditions of the specified policy are satisfied, the usage rights of the original file are granted, and the usage rights are granted, so that the user cannot use the original file.

[0041] In other words, the file management program can perform centralized management and use of a file that maintains a high security level and does not impair the convenience of the user when generating a package file. become able to do.

[0042] If the usage authority is limited to authority other than editing and saving, users other than the user who created the original file cannot change the original file. The same original file is shared among users. This can be done by the user of the user who has been given the right to use the package file by e-mail attachment. Even when stored in the terminal, the same effect is obtained.

That is, a user can share the same original file with other users as a result without accessing a user terminal other than the user terminal. In this way, the same original file can be shared with other users because the original file is encrypted with the common key generated for each original file, and the number of users depends on the number of users. This is also due to the fact that one package file is generated.

BEST MODE FOR CARRYING OUT THE INVENTION

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. The file management program 1 according to the present invention is capable of viewing, printing, editing, and saving a file, such as a document, an image (a moving image or a still image) is included in a document file (hereinafter simply referred to as a file). It is used to prevent unauthorized use by leaking information to persons who do not have the right to use the file, etc., and to improve file safety by setting file usage conditions (policy). It is a program.

[0045] The following description is based on the assumption that the file management program 1 of the present invention is used inside and outside a general company, but this is only an example and is used by a home or an individual. Even so.

[0046] The file management program 1 is a program stored and executed in the user terminal 4. An arbitrary user creates a package file from a file created by an arbitrary user in the user terminal 4, File package program 2 for centralized management of files, and a file usage program for users other than the file creation user to restore the original file from the package file holder and use the file on the user terminal 4 It is roughly divided into three. Here, “use of file” refers to actions such as viewing, printing, editing, and saving a file.

As shown in FIG. 1, these user terminals 4 are connected to each other via a network 6 such as a LAN 6a inside the company, and outside the company via a network 6 such as the Internet 6b. Connected. In addition, the internal user terminal 4a is used when accessing outside the company, requesting various authentications, registering various types of information, downloading the file management program 1 of the present invention, and using the file management program 1. Support via network 6 Connected to server 5. The external user terminal 4b is also connected to the server 5 via the network 6 at the same time as described above.

[0048] The user terminal 4 stores the configuration required for storing and executing these programs (external storage devices such as CPU, temporary memory 43, hard disk 44, communication device, input / output device, etc.). What is necessary is just a normal computer.

Note that the user and the user terminal 4 perform user registration with the server 5 in order to use the file management program 1 of the present invention, and register information about the user and the user terminal 4 in the server 5. Shall. In the present embodiment, the user and the user terminal 4 are associated one-to-one, and one user ID is assigned to a set of one user and one user terminal 4.

[0050] Therefore, for example, when a user owns two user terminals 4 regardless of whether they are inside or outside the company, and the file management program 1 is used for each user terminal 4, the 2 user IDs shall be assigned. One user ID may be given to one user regardless of the user terminal 4, or one user ID may be given to one user terminal 4 regardless of the user.

[0051] The server 5 has a configuration similar to that of the user terminal 4, and may be a normal server computer provided with server software. In this embodiment, the server 5 includes a user database 55 storing information such as user information and hardware information of the user terminal 4, an authentication database 57 storing authentication information necessary for user authentication, It is equipped with various databases such as the history database 56 that stores history information such as user history and package file creation history.

[0052] It should be noted that only the administrator of the server 5 or a user who has been given a predetermined authentication permission has the authority to view, print, edit, and save information stored in the database in the server 5. Others (including Service-to-Self) cannot illegally abuse their authority (for example, built-in firewall, database encryption, connection to authentication system, proxy server Installation, etc.) Force It is assumed that server 5 is applied.

Next, the configuration of the file package program 2 will be described with reference to FIG. First, the file package program 2 is stored in the user terminal 4 and used in the user terminal 4, regardless of the storage method of the power program. For example, the server 5 power is downloaded to the user terminal 4 together with the installer. Alternatively, a storage medium such as a CD-ROM may be copied to the user terminal 4.

[0054] The finale package program 2 mainly includes functional block capabilities of a file designation unit 21, a policy formulation unit 22, a knock unit 23, and a search request unit 24.

The file designation unit 21 is a means for receiving designation of a file that is to be managed among files stored in a storage medium that can be accessed by the user terminal 4. For example, the file specification unit 21 displays on the screen of the user terminal 4 identification information (title, creation date, creation user, file type (extension) that the user terminal 4 can manage at that time. Etc.), the file data size, etc.) is displayed, and the input device such as a keyboard or a mouse selects one of the information to accept the file specification.

The policy formulation unit 22 is a means for formulating a policy for using the finale received by the file designating unit 21 (hereinafter referred to as the original file). In this embodiment, the prepared policy is transmitted to the server 5 together with the identification information of the original file. These are not necessarily transmitted to the server 5.

[0057] The policy is, for example, authentication of whether or not a user is permitted to use the original file, Z authentication, password and other authentication, number of times the file can be used, expiration date of the original file, number of files that can be accessed simultaneously, access These are usage conditions such as possible time, and usage rights granted when these usage conditions are satisfied (for example, usage modes such as viewing, printing, editing, and saving of the original file).

Here, as shown in FIG. 2, the server 5 includes a key generation unit 51 and a policy file generation unit 52 as functional blocks.

[0059] The key generation unit 51 is means for generating an encryption key (decryption key) for encrypting (decrypting) the original file. In the present invention, file encryption and decryption are performed by a common key encryption method. In other words, the encryption key and decryption key are common, and only one type is generated for each original file. Therefore, in the following description, the encryption key is also referred to as a decryption key. In the present embodiment, the decryption key generated by the key generation unit 51 is a random number generated every time a policy is formulated by the policy formulation unit 22 (and for each original file). If the key is generated differently for each policy, it is not necessarily a random number.

[0061] Here, the common key encryption method is used for file encryption and decryption, because the processing time required for file encryption and decryption at user terminal 4 is as follows. This is because the burden on the user terminal 4 is short compared to the encryption and decryption processing time when the public key cryptosystem is used.

However, using the common key encryption method, for example, when the encryption key generated by the server 5 is used for file encryption, or the encrypted file is used as an encryption key only for a specific user. When decrypting with the same decryption key, in general, the key delivery method often becomes a problem. As long as the encryption key and decryption key are the same, once the key is known to a third party, anyone can decrypt the encrypted file, meaning the file has been encrypted. Because there will be no more.

[0063] Therefore, in the present invention, even a file encrypted with a common key cannot be decrypted by just knowing the key! We adopted a mechanism that can acquire the decryption key for the encrypted file and the authority to use the file only when the policy usage conditions established by the policy development unit 22 are satisfied.

Here, the policy file generation unit 52 is a means for generating a policy file based on the policy formulated by the policy formulation unit 22 and the decryption key generated by the key generation unit 51. The policy file is, for example, XML format data that describes the decryption key and the policy. Specifically, the usage conditions in the policy are described in association with a plurality of policy objects. When the usage conditions corresponding to a policy object are satisfied, a key for opening another policy object can be obtained, and finally all policy objects are opened, that is, all policies are opened. This is a chained data structure in which the decryption key and usage authority can be extracted only when the usage conditions are satisfied.

[0065] With such a data structure, it becomes more difficult to extract the decryption key and the usage authority easily and use it illegally. In addition, if the decryption key and usage authority are Even if it is possible to know other than the acquisition path of one file, the decryption key decryption unit 34 described later decrypts the encrypted original file unless the decryption key decrypted from the policy file and the usage authority are used. I can't use the original file! / Speak.

It should be noted that the generated policy file is stored in the user database 55 for storing user information with the identification ID of the policy file assigned to each user, and is also transmitted to the user terminal 4. At this time, the decryption key generated by the key generation unit 51 may also be stored in the user database 55 and transmitted to the user terminal 4.

[0067] In addition, an identification ID is assigned to each policy object, and a key for opening the policy object is generated by the key generation unit 51, and this information is also stored in the user database 55. The

[0068] In addition, when the user terminal 4 does not connect to the server 5, the policy file generation unit 52 may be included as a functional block of the file package program 2 stored in the user terminal 4. In this case, the user terminal 4 does not transmit the policy to the server 5, generates the policy file itself, and stores the policy file identification ID in the user terminal 4.

[0069] Returning to the description of the configuration of the file package program 2, the knocking unit 23 encrypts the original file with the decryption key generated by the key generation unit 51, and the encrypted original file, The policy file and basic file information generated by the policy file generator 52 are packaged together and added with a header to generate a new file (called a package file). is there. Figure 3 shows a conceptual diagram when the package unit 23 generates a package file.

[0070] As shown in FIG. 3, by packaging the encrypted original file and the policy file, the encrypted original file cannot be taken out or used alone. It can be used only by linking with the policy file.

[0071] That is, only when all the usage conditions are satisfied, the usage authority can be acquired and the encrypted file can be decrypted. Even if it is sent to 4 or known, it will be encrypted if there is no package final and the conditions of use of all policies are not satisfied. Since the original file cannot be decrypted, the security of the encrypted file is ensured.

[0072] Moreover, since the decryption key is included in the policy file and packaged with the encrypted original file, the user is also aware of the key delivery, which is a problem of the common key cryptosystem. Without being done safely.

[0073] Conventionally, a public key cryptosystem has been adopted in order to give the right to use a file only to a specific user while maintaining a high security level. However, in the case of the public key encryption method, there is no need to generate a public key and a private key, to obtain a user's public key who is authorized to use the file, and to encrypt a file with the public key for each user. It was hanging. Since the file management program 1 of the present invention uses a common key encryption method, such a trouble does not occur, and the security can be determined by simply specifying a file, formulating a policy, and packaging a simple procedure. High level file management will be realized.

[0074] The file basic information includes the original file identification information in addition to information such as the title, creation date, creation user, original file type (extension, etc.), and original file data size. The use permission of Z is included. It may also include the title that is the identification information of the knock file, creation (package date and time), creation user (packaged person), package file type, package file data size, and the like.

[0075] Here, the encryption of the file basic information is arbitrary, and basically the contents of the file basic information can be known even by a user who does not have the authority to use the original file.

. This is the force that the law at the time of filing this application gives all users the right to know whether or not to use the original file.

The search request unit 24 requests the search unit 53 in the server 5 to search the history information of the file package stored in the history database 56 and the information related to the access history of the package file. It is. The history database 56 may store the same data as that stored in the user database 55, or the history information stored in the user database 55 may be searched! ,. [0077] If the file creation user himself / herself searches his / her own file package history and / or other user's access history to the shared storage medium in his / her user terminal 4, the search request unit 24 Alternatively, it may be a means of accessing the history information stored in a database (for example, a usage status database 33a described later) in the user terminal 4 of the file creation user.

The search request unit 24 specifies, for example, a search condition, and transmits the search condition to the server 5. The search unit 53 of the server 5 extracts the history information that matches the search condition from the history database 56 and transmits it to the user terminal 4. Here, based on the retrieved history, the user terminal 4 can further change the policy in the policy formulation unit 22 and change the file in the file specification unit 21. If any change is made, the knocking unit 23 repackages the file. This procedure is the same as the procedure for a new file package, as described above.

It should be noted that the history database 56 also stores a user access history to the package file. Therefore, the user who has packaged the file can confirm from the search request section 24 who has accessed which package file from when.

[0080] According to the configuration of the file package program 2 in the file management program 1 described above, all types of files are encrypted with the common key generated for each file, and then stored together with the policy file. Thus, a mechanism for granting the authority to use the original file only to users who satisfy the usage conditions and a mechanism for checking the user's access history will be provided to the user.

[0081] Moreover, the user who packages the original file can generate one package file and access it by the user terminal 4 of the user who has been given the use right regardless of the number of users to whom the use right is given. The original file can be shared among multiple users simply by storing it in the storage medium.

[0082] In other words, the file management program 1 can perform centralized management of files while maintaining a high security level and without impairing the convenience of the user when generating a package file. It becomes like this.

Next, the configuration of the file use program 3 will be described based on FIG. First, The file usage program 3 is stored in the user terminal 4 and is stored in the user terminal 4 in the same manner as the file package program 2. For example, the file usage program 3 can be stored in the user terminal 4 together with the installer. It may be downloaded to the user terminal 4 or a storage medium such as a CD-ROM may be copied to the user terminal 4. In addition, the file use program 3 may be programmed together with the file package program 2, and in this case, the file use program 3 is stored in the user terminal 4 as the file management program 1.

[0084] However, among the functions provided by the file management program 1, only the file use function on the file use program 3 side is used, and the file package function and history search function on the file package program 2 side are used. For users who do not use it, only the necessary programs are stored in the user terminal 4.

[0085] The file usage program 3 is mainly composed of a file designation unit 31, an authentication request unit 32, a database generation unit 33, a decryption key decryption unit 34, a decryption unit 35, a file usage control unit 36, and a re-noclusion unit 37. Consists of functional block force.

[0086] The file designating unit 31 is a means for accepting designation of a package file that is used by the original file among package files stored in a storage medium that can be accessed by the user terminal 4. It is. For example, the file designating unit 31 displays on the screen of the user terminal 4 the basic file information of the package file (package file or original file title, creation date, creation user, file type (extension, etc.), The use of the original file is allowed (Z non-permitted users, etc.), and the input device such as a keyboard or mouse can be used to select either of the information, and the specification of the knock file can be accepted.

[0087] In order to prevent the user terminal 4 of the user not authorized to use the original file from inadvertently knowing the existence of the package file in which the original file is packaged, The information cannot be displayed on the user terminal 4, for example, only if it is attached to the user's user terminal 4 that is attached to the knock file e-mail and is authorized to use the original file. Documents such as e-mail to notify that the original file in the knock file at the storage location is available You can access the user terminal 4 force knock file only if it is sent to the terminal 4.

That is, in this case, the file package program 2 generates a package file in the package unit 23 and notifies the user terminal 4 of the user who has been given the authority to use the original file to notify the generation of the package file or In addition, it has a notification unit (not shown) for sending a knock file by mail attachment. As a result, the usage rights of the original file can be granted only by preventing the user's user terminal 4 from inadvertently knowing the existence of the package file in which the original file is packaged. The authorized file can be used immediately by the authorized user.

In this embodiment, the authentication request unit 32 is means for requesting the server 5 to authenticate a user who intends to use the file use program 3. If one user ID is assigned to one user and one user terminal 4, the user terminal 4 is naturally not authenticated unless the user requests an authentication from the user terminal 4 to the server 5.

Note that the authentication request unit 32 does not necessarily require the server 5 to authenticate, and may be means for authenticating the user by the user terminal 4 itself. This will be described later in Examples.

[0091] Each time the user tries to use the original file in the package file at the user terminal 4, the database generation unit 33 may update the usage status (for example, the number of times used) of the original file by the user terminal 4. This is a means for generating the usable usage state database 33a in the user terminal 4 in such a state that it cannot be read and updated by the user terminal 4 other than the user terminal 4 of the user.

[0092] It should be noted that, among the usage conditions of the policy formulated by the policy formulation unit 22, usage conditions that do not require the usage status of the original file to be updated each time the original file is used (for example, the usage permission of the original file is Z If the policy is generated only by the authentication of whether it is an authorized user, password and other authentication, the expiration date of the original file, the number of simultaneous access to the same knock file, the access time, etc. The generation unit 33 is not necessarily required to generate the usage status database 33a.

[0093] Further, the database corresponding to the usage status database 33a is not necessarily the user terminal. It may be generated in the server 5 that does not need to be generated in 4. In this case, the database generation unit 33 is not required in the file package program 2.

[0094] The decryption key decryption unit 34 compares the policy usage conditions in all the policy objects constituting the policy file in the knock file, and decrypts the decryption key of the encrypted original file. And the user's usage authority, and the decryption key and usage authority are retrieved from the temporary memory 43 of the user terminal 4, and the verification / update means 34a for verifying the usage conditions and updating the usage status is provided. Have it.

The verification / update means 34a, for example, checks the usage conditions and the usage status stored in the usage status database 33a for a policy that requires the usage conditions and the usage status of the original file to be verified. If the usage status does not violate the usage conditions (for example, the usage status is 3 times against the usage condition of 10 usages), update the usage status in the usage status database 33a to create another policy object. Take out the key to open or the decryption key of the encrypted original file.

[0096] In this case, either the server 5 or the user terminal 4 needs a program (for example, counting means, timing means, etc.) for updating the contents of the usage status data base 33a. Also, the location where the usage database 33a is generated and how to update the usage status can be stored in the policy file! /.

[0097] In addition, the collation / update means 34a does not need to update the usage status of the original file! The server 5 may be requested to collate the usage conditions with the usage status (current status). It can also be performed in the user terminal 4.

In addition, even when part or all of the policy object is stored in the server 5, the collation / update means 34a accesses the server 5 to check the usage conditions and the usage status. The server 5 receives the verification result and the key of the policy object to be opened next from the server 5.

Note that the server 5 can encrypt the verification result and key to the user terminal 4 with the user's public key generated in advance and transmit it to the user terminal 4. As a result, since the encrypted verification result and key are not decrypted by the user's private key, the security at the time of transmitting the verification result and key is further enhanced. [0100] The decryption key unit 35 uses the decryption key decrypted by the decryption key decryption unit 34 and taken out to the temporary memory 43 of the user terminal 4, and then decrypts the original file encrypted in the package file. Means for decryption. Further, the decryption unit 35 may be a means for decrypting other encrypted data in conjunction with the decryption key decryption unit 34 that only decrypts the encrypted original file. Good.

The file usage control unit 36 is means for controlling the usage of the original file decrypted based on the usage authority decrypted by the decryption key decrypting unit 34. Further, the file usage control unit 36 may also serve as means for starting the corresponding software 42 for opening the original file based on the file identification information of the original file. The corresponding software 42 may be prepared in the file usage program 3. For example, viewer-specific software that can browse all types of original files may be made available on the user terminal 4.

Note that the file usage control unit 36 may be a means for performing API (Application Program Interface) hooking. Specifically, the file usage control unit is provided when all or part of the functional capabilities of the viewer, etc. in the original file compatible software 42, is realized by calling the functions provided by the OS or middleware. 36 controls the corresponding software 42 and issues a function call instruction based on the acquired use authority from the corresponding software 42 to the OS or middleware. This makes it possible to control usage rights while using existing compatible software 42 without creating dedicated software that can be used for browsing, printing, editing, saving, etc. corresponding to all original files. It becomes.

It should be noted that the decryption unit 35 and the file usage control unit 36 only use the decryption key and the usage authority extracted to the temporary memory 43 through the normal decryption process in the decryption key decryption unit 34. It is possible to decrypt and use the original file. For example, when a decryption key or usage right that is used alone is about to be decrypted or used, the decryption unit 35 and the file usage control unit 36 Can be stopped on the spot. Thereby, unauthorized use of the original file can be prevented.

[0104] If the encrypted original file in the package file is decrypted and the original file is edited based on the user's usage rights, the repackaging unit 37 will edit the original file after editing. A means of packaging the file again with the policy file.

[0105] After the edited original file is packaged and the package file is generated, the repackage unit 37 exchanges the original package file (or overwrites or updates the original package file). As a result, the original package file is deleted, and the package file is updated.

[0106] The basic difference between the original package file and the repackaged package file is only the difference in the data capacity of the original file, and related data such as file basic information is accompanied by the repackage. The power that may be updated The file name and the decryption key of the original file do not change. In addition, for example, if a mechanism for detecting unauthorized use is adopted based on the hash value of the original file, the hash value also needs to be updated.

[0107] By renewing the package file by the repackaging unit 37, the original management of the original file is continued, and the unity of the original file that is shared among multiple users is maintained. Is also retained.

[0108] It should be noted that the repackaging unit 37 should only function if the editing of the original file is permitted among the usage rights. In the first place, the editing of the original file is included in the usage rights. If not, the repackaging section 37 is not necessary. Furthermore, in this embodiment, the policy file cannot be edited by a user who is permitted to edit the original file. This is to prevent unauthorized use of the original file by editing the policy file.

[0109] In addition, when the original file is repackaged, the file utilization program 3 having the repackage unit 37 is repackaged in the user terminal 4 or the server 5 of the original file creation user. You may have a notification part (not shown) which notifies that. This allows the user and server that created the original file to immediately confirm that the original file has been updated.

[0110] According to the configuration of the file usage program 3 in the file management program 1 described above, the usage authority of the original file and the decryption key of the original file can be decrypted only when the usage conditions are satisfied. Because the package is included in the package file, the user Only when the usage conditions of the policy included in the file are satisfied, the usage rights of the original file are granted, and the usage rights are granted, so that the user cannot use the original file. Become. In other words, the file management program 1 makes it possible to use the original file by a user who has been given usage rights while maintaining a high V security level.

[0111] Also, if the usage authority is limited to authority other than editing and saving, users other than the user who created the original file cannot change the original file. The same original file is shared among users. This has the same effect even if it is stored in the user terminal of a user who is authorized to use the package file by means of email attachment.

That is, the user can share the same original file with other users as a result without accessing a user terminal other than the user terminal. In this way, the same original file can be shared with other users because the original file is encrypted with the common key generated for each original file, and the number of users depends on the number of users. This is also due to the fact that one package file is generated.

[0113] Here, the details of the usage status database 33a will be described. Reading and updating the information in the usage status database 33a is performed only in the process of decrypting the decryption key and the use authority by the decryption key decryption means, and by the user and the Service-to-Self in other processes. It will not be updated or tampered with.

[0114] Therefore, the usage status database 33a generated in the user terminal 4 is a one-way function such as a hash value of the identification information (MAC address, BIOS serial number, hard disk 44 serial number, etc.) of the user terminal 4. May be encrypted.

[0115] It should be noted that detection of unauthorized update, alteration, unauthorized use, etc. of the usage status in the usage status database 33a can be performed by using a known hash (one-way) function technique or the like. For example, the usage status is always encrypted with the hash value of the usage status at the time of the last update or reading, and encrypted with the correct hash value at the next update or reading. Check the consistency of force.

[0116] If an illegal read or update has been performed, then the normal read or update is performed. Even so, the usage status is not encrypted with the original hash value, or the correct decryption key cannot be obtained, so the encrypted original file cannot be decrypted! / ,.

[0117] In addition, for example, the usage status should be updated from 2 times to 3 times by setting a mechanism that can be increased or decreased only by a predetermined number, for example, by decreasing it by one. It is also possible to make it impossible to tamper with zero.

[0118] In this way, in the event that unauthorized reading or falsification is made, the decryption key decryption will be stopped or the registry etc. Then, it is backed up, corrected, read the usage status, and the altered usage status database 33a is restored to the original state.

[0119] In order to be able to generate the usage database 33a only on the user's user terminal 4, a program that can generate the usage database 33a only when a new user tries to open a package file for the first time. Before downloading, the server 5 recognizes the identification information (MAC address, BIOS serial number, hard disk 44 serial number, etc.) of the user terminal 4 in advance and downloads the usage status data based on the hash value of the identification information. The terminal 33a is encrypted, and a program that prevents the encrypted usage status database 33a from being decrypted is installed in a terminal having other identification information.

[0120] Next, in order to disable reading by a terminal other than the user terminal 4 that was originally generated from the usage status database 33a, when the decryption key decryption means collates the usage conditions and the usage status, It is confirmed whether or not the usage database 33a has been generated in the user terminal 4 having the identification information registered on the server 5 side. It is assumed that the original file is likely to be used on the terminal, and the usage database 33a is encrypted with the identification information of each user terminal 4 using a unique identification information, a hash value, etc. In addition, there is a method of making it impossible to decrypt the usage status database 33a based on the identification and other values of the identification information of other terminals.

[0121] Further, an example in which the usage status database 33a is used for purposes other than the usage status update will be described.

[0122] For example, in the usage conditions generated in advance, the identification information of the user terminal 4 is set as one condition. In addition, when collating the usage conditions with the usage status, the identification information of the user terminal 4 that is actually used as the usage status is checked, and the user terminal 4 of the user who is originally given the usage rights as the usage conditions is checked. If it does not match the identification information, the use of the original file may be stopped. Note that the usage conditions naturally vary from user to user, so if you want to share a policy file, the usage conditions and keys of the policy objects related to the usage conditions are stored in the server 5. It may be stored.

[0123] Further, by decrypting the usage status database 33a with the identification information of the user or the user terminal 4 or a unique key, the decryption key decryption can be performed even if the usage status database 33a is substantially empty. If the part 34 confirms the existence of the usage status database 33a, the user and the user terminal 4 are automatically authenticated, and the user and the user terminal 4 who do not have the authority to use the original file. More effective in preventing unauthorized use.

Here, an example of the data structure of the package file is shown in FIG. To explain based on Fig. 5, the knock file is used under the root directory, the key acquisition path directory indicating the acquisition path and acquisition order of the decryption key and the usage right, and the usage conditions indicating the usage conditions for each policy object. It consists of four directories: a condition directory, a file directory that stores encrypted original files, and basic file information.

[0125] It should be noted that the key acquisition path directory and the usage condition directory correspond to the policy file, and the policy file, the encrypted original file, and the basic file information are packaged by the knocking unit 23. The power of this package file

[0126] A plurality of policy objects are arranged in order under the key acquisition path directory, and the usage authority and the decryption key that can be finally acquired are also included. Each policy object includes a key for starting the collation / update means 34a and opening the next policy object.

Note that, in FIG. 5, the policy object and the usage conditions in the portion surrounded by the dotted frame are not actually included in the policy file, but are stored in the server 5. In this way, a part or all of the policy file can be obtained from the server 5. policy Placing some or all of the files in the server 5 can further prevent fraudulent actions such as policy file tampering.

[0128] In addition, the usage condition directory includes initial values of usage conditions according to the type of policy object generated, and the database generation unit 33 uses the original file for the first time by the user terminal 4. Sometimes, the initial value of this usage condition is copied or moved to the usage status database 33a. It should be noted that even if the usage database 33a is generated and the usage status is updated, it may be stored in the usage conditions directory.

Note that, as described above, the policy object that requires the initial value of the use condition is, for example, the use status of the original file is updated each time the file is used, and the next file is used. In use, this is a type of comparison with the updated usage status. A policy object that does not require an initial value is a type that compares a usage condition and a usage situation that does not require updating, such as the usage period of an original file.

[0130] Here, for example, the initial value of the usage condition relating to the number of times of use is, for example, 10 times if it is 10. The numerical value stored in the power usage database 33a is "0 times" or "10 Times ".

[0131] If “10 times” is stored, the usage status database 33a is updated to reduce the number of times by 1 each time the original file is used, and becomes “0 times”. Since the original file can no longer be used at that time, the collating work in the collating / updating means 34a becomes substantially unnecessary.

[0132] On the other hand, when “0 times” is stored, the collation / update means 34a performs an update operation in the usage status database 33a to increase the number of usages, and checks the usage conditions. Work (judgment of power or less 10 times) is necessary.

That is, as shown in FIG. 6, the verification / updating means 34a in the decryption key decryption unit 34 determines the location of the usage status database 33a corresponding to the key under the usage condition directory as shown in FIG. Search for power and update the usage database 33a to obtain the next key. In some cases, the corresponding usage conditions are searched from the usage conditions directory, and the usage conditions and usage status are collated. And in the policy file shown in Figure 5 It plays the role of linking the keys stored in each branched directory, usage conditions, and usage status storage locations.

Since the package file including the policy file has a tree structure as shown in FIG. 5, the usage authority and the decryption key are not acquired unless they are in a normal order. Also, if the data in one directory does not correspond to the data in the other directory, the decryption key cannot be decrypted, so only a part of the directory is copied or the storage location or path name of one of the directories changes. If this is the case, cooperation with the decryption key decryption means will not be performed, and unauthorized use will be difficult.

Example

[0135] Next, an example of a process in which a user A uses a file management program 1 to package a file, and then another user B uses the file included in the knock file. This will be described in detail with reference to the flowcharts of FIGS. 8 to 15 and the configuration diagrams of FIGS. 1, 2, 4, and 6. FIG.

[0136] Incidentally. In this embodiment, it is assumed that the file management program 1 cannot be used without a server information storage file to be described later. Therefore, it is possible to install the file management program 1 on condition that the server information storage file power file management program 1 is installed and the file stored in the user terminal 4 at the same time or the existence of the installer server information storage file exists. Desirable to be,

First, both users A and B who use the file management program 1 must complete user registration after agreeing to the terms of use of the file management program 1.

An example of this user registration flow will be described below with reference to the flowchart of FIG. Note that the following user registration flow is the same for both users A and B, regardless of whether the user or user terminal 4 is different.

[0139] Since the user terminal 4 accesses the user registration home page stored in the computer such as the server 5 via the network 6, the user registration home page u

RL is input and transmitted to server 5 (S110).

[0140] The server 5 transmits the user registration home page data in the URL received from the user terminal 4 to the user terminal 4 (S115). [0141] The server 5 displays on the user terminal 4 a user registration screen in the user registration home page. The user inputs registration information such as user identification information and user terminal 4 identification information on the user registration screen, and transmits the registration information to the server 5 (S120). Note that the identification information and the like of the user terminal 4 may be automatically extracted and transmitted to the server 5 without the user inputting it.

[0142] The server 5 checks the registration information also received by the user terminal 4 (S125), and if there is a deficiency such as omission of input (S130), an error message is transmitted to the user terminal 4 (S135). For example, the user's e-mail address included in the registration information has already been registered in the user database 55 of the server 5 (S140), and some of the registration information is different from the registered information. In this case, it is determined that the registration information has been updated, and the registration information in the user database 55 of the server 5 is updated (S 145).

[0143] If there is no fear of incomplete registration or double registration in the registration information, the server 5 generates a user public key / private key pair and stores it in the user database 55 of the server 5 (S150). The public / private key pair generated here is used later when the user terminal 4 and the server 5 transmit / receive any data or when the user terminal 4 itself authenticates the user. Force key generation is not mandatory.

[0144] Furthermore, the server 5 generates a unique ID (user UID) for each user and a unique ID (user terminal UID) for each user terminal 4, and stores the registration information together with these IDs. (S155), and transmits the registration information stored, the generated public key and private key, the user UID and the user terminal UID together with the registration completion message to the user terminal 4 (S160). If the public key and private key are not generated, it is not necessary to send the key.

[0145] If there is a problem with the security of the transmission of the public key and the private key, these keys are encrypted with the private key of the server 5, and the signature of the server 5 is attached. The user terminal 4 is encrypted with unique identification information such as the MAC address of the user terminal 4 so that the user terminal 4 registered as a user can only know the key.

[0146] The user terminal 4 stores the registration information in a predetermined location in the user terminal 4 specified by the server 5 (for example, a predetermined location in the registry) (S165). In addition, with this predetermined place The usage status database 33a generated in advance may be used.

Next, an example of the flow of packaging an arbitrary file for user A who has performed user registration will be described below with reference to the flow from FIG. 9 to FIG. As a premise, user A not only registers as server 5 as described above, but also installs file package program 2 as shown in FIG. 2 on user terminal A of user A. It shall be.

[0148] The user terminal A activates the installed file package program 2 by double-clicking an icon on the screen (S210).

[0149] As shown in FIG. 16, a login screen for the file package program 2 appears on the screen of the user terminal A, so that the user terminal A authenticates whether or not it is a registered user (or the server 5). Therefore, it accepts input devices such as a keyboard for input of login ID and password (S215). In this embodiment, the login ID is the user's email address registered at the time of user registration, and the password is specified by the user at the time of user registration, and the login ID corresponds to the authentication database 57 on the server 5. This is a character string that is stored.

[0150] Furthermore, in this embodiment, in order to improve the accuracy of authentication of registered users, authentication using the second password is performed in addition to authentication using the previously input password. Here, the second password is an authentication result obtained by the authentication device that can be arbitrarily specified by the user.

[0151] The authentication device may be of any kind as long as it is connected to user terminal A. Authentication devices can be roughly classified into password-based authentication, property authentication (IC card, IC card using PKI certificate, USB key, USB token, etc.), biometric authentication (fingerprint, voiceprint, voiceprint, handwriting, (Face, vein, etc.)

[0152] In this embodiment, the server 5 or the user terminal A can perform user authentication regardless of the type of authentication device user, and the number of user authentications The server 5 or user terminal A has an authentication interface so that the combination can be changed arbitrarily. The authentication interface is in user terminal A because the user does not access the server 5 and This is a case where authentication within the terminal A is requested.

[0153] The authentication interface uses the above authentication method as follows: (1) Those that contain cryptographic logic (some IC cards, USB keys, biometrics and other PKI), (2) Authentication result YESZNO binary (3) Those that output some character strings (some devices with device IDs such as USB key, MAC address, BIOS serial number, etc.) t As you can see, it is classified by the type of output data (second password) of the authentication device, and the login ID, password, second password, and authentication type of the second password are associated with each other, and the server 5 or user terminal Save to A.

[0154] In the case of an authentication method that includes the encryption logic of (1), in addition to the login ID, password, second password, and second password authentication type, the second password is assigned to the user based on the PKI certificate. Data (template data) encrypted with the public key (hereinafter referred to as PKI public key) and signed with the user's private key (hereinafter referred to as PKI private key) is stored in server 5 or user terminal A.

[0155] The authentication interface determines the authentication device determined by the request from the user, or the user's second password output from the authentication device determined in advance on the authentication interface side, and the type of the authentication device. The user terminal A force is received together with the password, and is compared with the data already stored.

[0156] If the authentication device power encryption logic is included, the authentication interface receives the template data corresponding to the mouth guin ID out of the template data already stored in the server 5 or the user terminal A, Using the user's PKI certificate, signature verification and decryption are performed to obtain the second password, which is verified against the data already stored.

[0157] In the authentication interface, password verification may be omitted even if only the login ID and the second password are verified.

[0158] If the authentication interface power Sano 5 or the user terminal 4 configured as described above is provided, the user can request user authentication by arbitrarily performing the number and combination of authentication types, In addition, since user authentication can be performed with a predetermined number of authentication types and combinations, an authentication device is added to the server 5 or the user terminal 4. It is possible to respond flexibly to the case. In addition, since the authentication is not performed using only one type of password, the accuracy of authentication is improved, and it is not necessary to maintain the confidentiality of the password completely, and the password itself can be stored in the user terminal 4.

Returning to the description of the flowchart in FIG. 9, the authentication interface obtains an arbitrary authentication device power second password as described above (S220).

Here, user A selects either user authentication (local login) at user terminal A or user authentication (server login) at server 5 (S225).

[0161] In order to perform local login, a pair of public key and private key of user A is generated in the user registration flow of Fig. 8, and the login ID, password, and second pass password are also generated. Stored in user terminal A, and the generated private key must be stored in user terminal A with the second password encrypted. .

[0162] When local login is selected, the authentication interface displays the user information (login ID, password, second password, authentication type, public key and secret) required for user authentication on user terminal A. It is checked whether the key pair and the private key encrypted with the second password are registered (S230). If any one of the user information is not registered, the process proceeds to the server login flow in FIG. If local login is not selected, proceed to B in Figure 9.

[0163] If the user information is registered, the authentication interface compares the acquired user information with the user information stored in the user terminal A, and further, the user information is encrypted with the second password. The decrypted secret key is decrypted with the second pass key acquired by the authentication interface, and the decrypted secret key is compared with the secret key already stored in the user terminal A (S235).

[0164] The secret key verification method in the present embodiment will be described in detail below. In this embodiment, at the time of user registration, it is determined whether or not local login is to be performed. If it is determined that local login is to be performed, the usage status database 33a is generated on the user terminal A, and the usage status database is User information including the public key and private key of user A is stored in 33a. [0165] Further, at the time of user registration, after the user A's private key is replaced with another key by the replacement table, the usage status database 33a is encrypted.

[0166] The replacement table is a kind of cryptanalysis table generated with random numbers and the like, and is a table showing the correspondence before and after replacement. In this embodiment, as will be described later, the policy file is also encrypted using this substitution table. This makes it difficult to decipher or illegally use the policy file, which cannot be directly seen by the user or the Service-to-Self.

[0167] The replacement table is stored in the server information storage file. The server information storage file is a file generated for each server 5, that is, a file for identifying the server 5. Accordingly, when the URL of the server 5 accessed by the user terminal A is changed, the server information storage file itself is also changed.

[0168] The server information storage file includes a replacement table, a range of user IDs that the server 5 corresponding to the server information storage file allows to use the file management program 1, the URL of the program on the server 5 side, A key for communication between the terminal A and the server 5 (for example, the public key of the server 5) is included. The user ID range here may be the start value and mask value (range) of the user ID! /.

[0169] The URL of the program on the server 5 side and the key for communication between the user terminal A and the server 5 initialize the program on the server 5 side when the user terminal A accesses the server 5, This is to reduce the burden on the server 5 and to decrypt the encrypted communication from the user terminal A.

[0170] In this embodiment, when the user A stores the file management program 1 in the user terminal A, the server information storage file is stored together, and the server information storage file is stored together. If the file management program 1 is not stored, the file management program 1 cannot be stored. This prevents unauthorized use of the knock file alone.

[0171] The authentication interface decrypts the encrypted secret key with the second password that has also acquired the authentication device power to obtain the secret key (S235), and further stores the secret key in the server information storage file. The encrypted usage database 33a is decrypted by replacing with the replacement table in the table. The user information stored in the decrypted usage database 33a and the authentication If there is no problem comparing the user information acquired by the interface, user A has succeeded in authentication (login) (S240, S245).

[0172] When user A successfully logs in, information such as the name and affiliation name is displayed on the screen of user terminal A among the user information stored in the usage status database 33a ( This is called user information recovery).

[0173] In addition, if there is a problem such as no substitution table, decryption, incorrect collation result, etc. in the login process so far, login failure (S250) and proceeding to the following procedures I can't.

Next, the flow in the case of server 5 login will be described with reference to the flowchart of FIG. The authentication interface checks whether the user terminal UID is registered in user terminal A (S310). In this embodiment, whether or not the user terminal UID is registered depends on whether or not the usage status database 33a is generated in the user terminal A and the user terminal UID is stored in the usage status database 33a. Can be confirmed. In addition, identification information such as the MAC address of user terminal A is also detected by the user terminal A itself, and it is also confirmed by a method such as whether the usage status database 33a encrypted with the identification information can be decrypted. I can do it.

[0175] If the user terminal UID is not registered, the authentication interface transmits the identification information of the user terminal A to the server 5 (S315). The server 5 generates and registers the user terminal UID based on the identification information of the user terminal A (S320).

[0176] If the user terminal UID is registered in user terminal A, the authentication interface sends the login ID, password, second password, and second password authentication type of user A to server 5 (S325). .

The server 5 collates the transmitted information with the information stored in the authentication database 57 in the authentication unit 54 shown in FIG. 2 (S330). The user information stored in is transmitted to the user terminal A (S335). At this time, the server 5 can transmit the mail address list of other registered users and the public key list together with the user information of the user terminal A.

[0178] If there is a problem during verification, an error message is transmitted to user terminal A (S340). [0179] Receiving the user information from the server 5 means that the user A has successfully logged in (S345). Based on this user information, the user terminal A displays information such as the user name and affiliation name on the screen (referred to as user recovery).

[0180] This force will be described with reference to the block diagram of FIG. 2 and the flowchart of FIG. User terminal A displays the file package screen of file package program 2 for the user who has logged in. Figures 17 and 18 show examples of file package screens.

[0181] User A can activate the function block in the file package program 2 by clicking any button on the file package screen.

In the present embodiment, first, the file designating unit 21 receives from the user A designation of a file to be managed (S410). In FIG. 17, this corresponds to the reference button for specifying the encryption target file, and in FIG.

[0183] Next, the policy formulation unit 22 receives from the user A policy formulation when another user uses the file specified by the file specification unit 21 (hereinafter referred to as the original file) (S420). In Fig. 17, it corresponds to the input on the security policy setting screen, and in Fig. 18 it corresponds to the reception of the input force policy development on the policy setting screen.

In this embodiment, the user Z group (for example, User B or development group A) to whom the use authority of the original file is given, the expiration date of the original file, the number of times of use of the original file, and the original file are displayed. Develop policies such as the password to use and the authority to use the original file (usage mode).

[0185] In FIG. 17, the policy consists of selecting an authorized user Z group, selecting an operation to be permitted (printing, editing, saving, viewing), and selecting viewing conditions (period, number of times, file password). In Fig. 18, operation (view, print, save, edit) settings, period and number of times (period, period, number of times) settings, user and group settings, server check (right on server 5 each time it is used) Power to check, check rights with Sano 5 at a certain frequency Or limit the number of clients (terminals) that can be used) and password settings.

In this embodiment, the user who is given the authority to use the original file is limited to the registered user, and the user terminal A preliminarily receives the registered user's mail address list received from the server 5 based on the registered user's mail address list. Select a user. For example, the users may be selected in a batch for each group. FIG. 22 shows an example of the screen for selecting the authorized user Z group in the screen of FIG. As shown in Fig. 22, from the address book displayed on the left side of the screen, the authorized user Z group is specified by clicking, etc., so that it is displayed in the allowed user Z group column on the right side.

[0187] The policy formulation unit 22 generates an XML sentence based on the policy formulated by the user A on the user terminal A (S425). Note that the XML sentence is generated here by clarifying the structure of the established policy, and it is easy to generate a policy file that includes the policy object, usage rights, decryption key, and usage conditions. The power to do that It is not always necessary to generate an XML sentence.

[0188] The generation of the XML sentence may be performed, for example, when the encryption button is clicked in FIG. 17, or in FIG. 18, when the button for saving the policy is clicked. Also good.

Here, user A selects whether to generate a policy file on user terminal A (local package) or to generate a policy file on server 5 (server package) (S430).

[0190] When a local package is selected by user A, as will be described later, a key is generated at user terminal A, and the generated key is the force used when user B uses the original file. Is not stored on server 5. Therefore, the authentication method of the authorized user of the original file can only support local login.

[0191] Therefore, the user terminal A obtains a public key generated in advance for each authorized user (here, user B) of the original file (S435). The public key acquisition method is arbitrary. For example, when user A logs in to the server, the server 5 may also receive the registered user's public key list upon successful login. In addition, user A performs user registration. When done, a similar public key list may be received. In addition, each time the server 5 is accessed, the public key of the authorized user can be obtained. In this embodiment, since the public key is disclosed to the user, the local login cannot be performed when the original file is used for the user! / User terminal A cannot perform the server package.

[0192] Here, it is assumed that the user terminal A that has selected the local package has the same functional block as the key generation unit 51 that the server 5 has in FIG. Therefore, the key generation unit 51 of the user terminal A uses a random number decryption key for encrypting the original file as well as a key for opening a policy object of a policy finale generated later for the number of policy objects. Generate (S440).

[0193] Furthermore, the key generation unit 51 or the encryption unit (not shown) of the user terminal A first acquires the key for opening the policy object among the keys generated by the key generation unit 51. Encrypt with the public key of each authorized user (S445). This is because only the authorized user can use the original file by making it possible to decrypt the key only with the private key of the authorized user.

User terminal A is assumed to have the same functional blocks as policy file generation unit 52 of server 5 in FIG. Therefore, the policy file generation unit 52 of the user terminal A combines the usage conditions, usage rights, decryption key, and key for opening the policy object into a directory structure as shown in FIG. A policy file is generated (S450). In this embodiment, the policy file is generated in the XML format as well as the established policy. Here, the policy file may be replaced by a predetermined replacement table.

[0195] On the other hand, in S430, when user A selects a package method other than a local package, that is, a server package, the policy in XML format generated from user terminal A to server 5 first. Is transmitted (S455).

[0196] The server 5 receives the policy and analyzes the structure of the policy included in the XML sentence (S460). Here, a plurality of policy objects may be generated based on the policy.

Based on the received policy, the key generation unit 51 of the server 5 generates a random number decryption key for encrypting the original file and keys corresponding to the number of policy objects (S465).

[0198] Based on the key generated by the key generation unit 51, the policy file generation unit 52 of the server 5 The package history of the original file is stored in the history database 56 (S470), and a policy file is generated based on the key generated by the key generation unit 51 and the policy formulated by the policy formulation unit 22 (S475). The policy file should be replaced by the specified replacement table.

[0199] The server 5 transmits the generated policy file to the user terminal A (S480).

[0200] The package part 23 of the user terminal A decrypts the original file based on the policy file generated by the user terminal A in the case of a local package or the policy file generated by the server 5 in the case of a server package. Then, the encrypted original file and the policy file are packaged to generate a package file (S485). A series of flow from S425 force to S485 may be performed in accordance with the click of the B sound key in FIG. 17 or the policy setting button in FIG.

[0201] Note that user A may add a signature to the generated package file so that a user other than user A can detect that the original file has been tampered with. The signature is attached to the knock file by encrypting the hash value of the original file to be detected for alteration with the private key of User A.

[0202] The package file is stored in a predetermined storage location designated by user A. The package file stored in the specified storage location is generated so that the authorized user can immediately open it. At the same time, as shown in Fig. 19, it is attached to the email addressed to the authorized user and sent. May be. Further, as shown in the lower part of FIG. 19, information on the policy set for the permitted user may be displayed in the mail body.

[0203] Further, the search request unit 24 of the user terminal A can search the history of the package file created by the user A based on the history database 56. 20 and 21 show an example of a package history search screen displayed on the user terminal A. FIG. By using such a package history search screen, user A can grasp for which user and under what usage conditions the original file was packaged. It is also possible to review the policy and repackage the original file as the policy is revised.

[0204] Next, an example in which user B uses the original file in the package file packaged at user terminal A of user A is shown in the configuration diagram of FIG. 4 and the flowcharts of FIGS. This will be described with reference to the Yart diagram. It is assumed that file usage program 3 is installed on user terminal B of user B! /.

[0205] User B designates a package file stored in a storage medium that can be accessed by user terminal B by double-clicking on user terminal B (for example, user A first packages). S510).

[0206] It should be noted that user B can receive a notification from user A that the original file that can be used by user B has been packaged, or, as shown in FIG. At the same time, the user terminal A can automatically send an email with the package file attached to user terminal B! / ヽ. Alternatively, the file usage program 3 may be started first so that the file specification unit 31 accepts the specification of the package file used by the user B.

[0207] In this embodiment, the user terminal B starts the installed file usage program 3 in conjunction with the designation of the knock file. First, the file usage program 3 The file format of the specified package file is checked (S515).

[0208] Furthermore, the file usage program 3 extracts information (ID space information) on the range of user IDs that can use the package file from the package file (S520), and the file usage program 3 It is confirmed whether the server information storage file and replacement table corresponding to the extracted ID space information are stored in the user terminal B (S525). Here, if the replacement table does not exist, the package file is a file that cannot be used by the user B by the file use program 3, so an error notification is sent to the user terminal B (S530).

[0209] If the replacement table exists, the file using program 3 extracts the file basic information from the knock file (S535).

[0210] Based on the extracted file basic information, the file usage program 3 displays on the screen of the user terminal B a user list such as a user Z who is not permitted to use the original file (S540). .

[0211] User B is the authorized user of the original file based on the screen display of user terminal B. After confirming that it is included in the file, log in to the file usage program 3 (S545). An example of the log-in flow to the file usage program 3 is the same as that described for the log-in to the file package program 2 in the flowcharts of FIGS. .

[0212] At the time of login of the file usage program 3, not only authentication as to whether the user B is a registered user of the file management program 1, but also authentication of whether the user B has the authority to use the original file is performed. Also good. In that case, and when logging in to the server, the user B's authentication information is sent from the user terminal B to the server 5 together with the authentication information of the user B along with the identification information of the server 5 54 authenticates User B based on whether the received information is stored in the authentication database 57!

[0213] Also, whether or not user B is a user who has the authority to use the original file is one of the usage conditions of the policy, and even if the decryption key decryption unit 34 authenticates when the usage conditions are verified. Good. As an authentication method, it is also possible to confirm whether or not the usage status database 33a encrypted with the identification information of the authorized user or the identification information described therein is generated in the user terminal B.

[0214] The flow after successful login will be described with reference to the flowcharts of FIGS. 13 to 15 and the configuration diagrams of FIGS. In the present embodiment, when the specific package file is used for the first time, the database generation unit 33 generates the usage status database 33a in the user terminal B. It is assumed that the policy file contains three policy objects. These three policy objects are chained together in the policy file, and the policy object that contains the usage conditions to be checked at the end is encrypted. It is assumed that the decryption key of the original file and the authority to use the original file are connected.

[0215] When the user B successfully logs in, the decryption key decryption unit 34 included in the file usage program 3 is activated and starts decrypting the policy file (S610). If the policy file included in the package file is encrypted (S615), the decryption key decryption unit 34 (or decryption unit 35) decrypts the encrypted policy file. In order to enter, the replacement table stored in user terminal B is retrieved (S620).

[0216] Here, in the policy file, as shown in Fig. 7, an arbitrary key A is placed in the replacement table. It is assumed that the encrypted key B is encrypted.

[0217] The decryption key decryption unit 34 (or decryption unit 35) extracts the key A stored in the file basic information of the server information storage file or package file (S630), and uses the replacement table to Replace A with key B (S635). Here, if the key A is not replaced with the key B, the replacement table has been tampered with, and the tampering is detected and the subsequent steps are not allowed to proceed (S640). . The replaced key B is expanded on the temporary memory 43 (S645).

[0218] Decryption key decryption unit 34 (or decryption unit 35) decrypts the encrypted policy file by using key B (S710). If the encrypted policy file is not decrypted, it means that key B has been tampered with by someone, and that tampering is detected and the following steps cannot be taken! /, And so on (S715).

[0219] Since the policy file has been decrypted, the collation 'update means 34a of the decryption key decryption unit 34 shown in Fig. 6 is used corresponding to policy object 1 out of the three policy objects constituting the policy file. Condition 1 can be extracted (S720). Note that the activation of the first verification 'update means 34a may be performed by, for example, the key 0 (shown in FIG. 6) sent from the server 5 when the user B has successfully logged in. Or by entering certain symbols.

[0220] As described above, the usage conditions and keys may be stored entirely or partially in a storage medium such as the server 5 or CD-ROM where data cannot be rewritten. It may be issued to User B as a separate file from the policy file.

[0221] In particular, if the policy includes usage conditions that require a legitimate evaluation such as date and time, number of times, etc., all or part of the keys and usage conditions may be stored in the server 5. If the policy file is different from the policy file, it is more effective for preventing unauthorized use of the original file. However, if a key or usage conditions are stored on the server 5 side, the user terminal 4 must access the server 5 each time the original file is used, which increases the burden of network connection. Care must be taken in the design of server 5.

[0222] The collation / update means 34a checks whether or not the usage status 1 corresponding to the extracted usage condition 1 exists in the usage status database 33a in the user terminal B (S725). Book The usage condition 1 of the embodiment is a power that requires comparison and collation with the data stored in the usage status database 33a in the user terminal B. There are naturally usage conditions that can be verified by the user terminal B and usage conditions that can be verified by the server 5. In this case, the generation of the usage status database 33a is not essential.

[0223] If usage status database 33a itself or usage status 1 does not exist in user terminal B, it indicates that the original file is likely to be used illegally on user terminal 4 other than user terminal B. Therefore, it is not allowed to proceed to the subsequent steps (S730).

[0224] It is also possible to detect falsification of these by taking the hash value of the policy file, the usage conditions, and the usage status in the verification 'update means 34a.

[0225] When the usage status 1 exists in the user terminal 7 (S725), the checking / updating means 34a is the force that the usage status 1 satisfies the usage condition 1, that is, the range of the usage condition 1. It is confirmed whether it is equivalent to the use in (S735).

[0226] For example, use condition 1 is "use limit number of times is 10", and use condition 1 stored in user terminal B is "current use number of times 3". Satisfied. On the other hand, if the usage status 1 is currently 10 times of usage, it is assumed that the usage condition 1 has not been satisfied, and the subsequent steps are not allowed to proceed (S740). Thus, an example of an error screen displayed on user terminal B when it cannot proceed to the subsequent steps is shown in FIG.

[0227] When the verification of usage condition 1 and usage status 1 is completed, usage status 1 is updated, and key 1 necessary for proceeding to the next verification / update means 34b is extracted (S745).

[0228] For example, when the corresponding usage condition is related to "number of times", the usage status is automatically updated to a state where 1 is added to the remaining usage count, etc. Updated.

[0229] Even if the usage conditions are indefinite, unlimited number of times, and permanent usage rights, it is necessary to allow the user to illegally use the original file with usage rights. To prevent this, a usage database 33a consisting of empty or meaningless data is generated on the user terminal, and the usage status data must be Go through the process of confirming the existence of the service 33a.

[0230] The key 1 extracted from the policy object 1 opens the next policy object 2, and the use condition 2 corresponding to the policy object 2 is extracted (S810).

[0231] The verification / updating means 34b of the decryption key decryption unit 34 checks with the server 5 whether or not the user B satisfies the usage condition 2 (S815). For example, if the usage condition 2 is the expiration date of the original file, the decryption key decryption unit 34 transmits the usage condition 2 to the server 5 and receives information on the current date and time from the server 5, or the server In 5, check the current date and usage conditions 2 and have the result sent.

[0232] Also, if the use condition 2 is, for example, the number of simultaneous accesses to the knock file, the decryption key decryption unit 34 sends the use condition 2 to the server 5, and the package file is transmitted from the server 5. Send information about the number of simultaneous accesses based on information such as login access history.

[0233] If user B does not satisfy use condition 2, the use process of the original file is stopped on the spot (S820). If user B satisfies use condition 2, key 2 included in policy object 2 is extracted, and policy object 3 is opened with key 2. Then, use condition 3 corresponding to policy object 3 is retrieved (S825).

[0234] Then, for usage condition 3, the same procedure as in S815 to S825 is taken, and finally the decryption key decrypting unit 34 obtains the decryption key and the usage authority of user B (S830). Note that these decryption key and usage authority are not stored in a storage medium such as the hard disk 44 developed in the temporary memory 43 of the user terminal B so as not to be used illegally.

[0235] The decryption unit 35 extracts the encrypted original file from the knock file and decrypts the encrypted original file using the previous decryption key (S835). .

[0236] The decrypted original file is expanded on the temporary memory 43 instead of the hard disk 44 of the user terminal B, and the original file can be used on the temporary memory 43, as with the previous decryption key and usage authority. . The reason why the original file is not stored in the hard disk 44 of the user terminal B is to prevent the use of the original file ignoring the use conditions if it is stored in the hard disk 44. is there.

[0237] The file usage control unit 36 downloads the corresponding software 42 according to the type of the original file that has been decrypted. It is started on the user terminal B (S840), and the original file can be used on the corresponding software 42. At that time, the operation of the corresponding software 42 is controlled based on the acquired use authority (S845). For example, if the usage right acquired by User B is only to view the original file, the save button and the print button that appear on the screen of the corresponding software 42 are not displayed. In addition, the file usage control unit 36 detects the operation and stops the use of the original file when the user B tries to perform usage (for example, printing or saving) outside the usage authority acquired. Or a warning display may be displayed on the screen of the user terminal B.

[0238] The corresponding software 42 may be prepared in the user terminal B according to the type of the original file, or may be multi-compatible software that does not depend on the type of the original file. Also, the corresponding software 42 is included in the file usage program 3! /, Or even! /.

[0239] When user B finishes using the original file, if the corresponding software 42 is closed on user terminal B, the decryption key, usage authority, original file, and other data stored in temporary memory 43 will be displayed. The data is deleted and only the original package file remains on the storage medium accessible to user terminal B. When User B uses the original file thereafter, the original file can be used within the range of usage conditions and usage rights through the same decryption key decryption process as before.

[0240] It should be noted that the storage location of the set of packaging files may be moved or copied. Further, as one aspect of the usage authority, when the original file can be saved or edited, the original file itself can be saved on the node disk 44. -If the original file is stored in the hard disk 44, the original file can be used by starting the corresponding software 42 without starting the file use program 3 thereafter.

[0241] Next, a procedure for updating a package file when editing of the original file is permitted as an aspect of the usage authority will be described below. It should be noted that the file usage program 3 〖is assumed to include the repackage unit 37 at the beginning, and the usage authority acquired by the decryption key decryption unit 34 includes editing. It is desirable that the package part 37 be controlled so that V does not operate.

[0242] First, when the original file is edited on the user terminal B of the user B who has obtained the use right and the original file is edited, the repackaging unit 37 reads the original file from the corresponding software 42. Get notified that Ayr has been edited.

[0243] Therefore, the repackaging unit 37, after finishing editing (for example, displaying a “re-nockage button” on the screen of the user terminal B and detecting that it has been clicked, etc.), reads the edited original file. Then, encrypt the original file before editing with the same decryption key, package it with the policy file and basic file information, and generate a knock file. The generated package file is overwritten on the original package file. In other words, the original package file is deleted, and a new package file is stored in the storage location of the original package file.

[0244] Note that the policy file is basically the same as the original policy file, but the file basic information may be used for repackaging when the contents are partially updated.

[0245] When the original file is repackaged, the creation user of the original file may be notified to that effect. In addition, since the access history and repackaging history of user B to server 5 are sequentially stored in the history database 56 of server 5, user A who created the original file can search from the search request unit 24 to the search unit 53 of server 5. In addition, a search for user B's original file usage history may be requested. This allows User A to track and manage the original file after it is created.

[0246] Each means and database in the present invention is only logically distinguished in function, and may be physically or virtually identical. It goes without saying that a data file may be used instead of a database, and the description of a database includes a data file.

[0247] In carrying out the present invention, a storage medium recording a software program that implements the functions of the present embodiment is supplied to the system, and the computer of the system reads and executes the program stored in the storage medium. This is also realized.

In this case, the program itself read from the storage medium realizes the functions of the above-described embodiments, and the storage medium storing the program constitutes the present invention.

[0249] The program of the present invention is supplied mainly by a method of downloading to a computer via the network 6 such as the LAN 6a or the Internet 6b. Others, magnetic disk, light Portable storage media such as disks, magneto-optical disks, magnetic tapes, and non-volatile memory cards can also be supplied to computers.

[0250] Further, by executing the program read by the computer, not only the functions of the above-described embodiments are realized, but also the operating system that operates on the computer based on the instructions of the program is actually The present invention also includes a case where part or all of the processing is performed and the functions of the above-described embodiments are realized by the processing. Brief Description of Drawings

FIG. 1 is a diagram showing an embodiment of a connection configuration between a user terminal installed with a file management program and a server.

FIG. 2 is a diagram illustrating an example of the configuration of a file package program and a server.

FIG. 3 is a conceptual diagram showing an outline process for generating a package file.

FIG. 4 is a diagram showing an example of the configuration of a file usage program and the configuration of a user terminal.

FIG. 5 is a diagram showing an example of the data structure of a package file.

FIG. 6 is a configuration diagram showing another embodiment of the configuration of the user terminal.

FIG. 7 is a conceptual diagram showing an outline process for encrypting a policy file.

FIG. 8 is a flowchart showing an example of a process flow of the present invention.

FIG. 9 is a flowchart showing another example of the process flow of the present invention.

FIG. 10 is a flowchart showing another example of the process flow of the present invention.

FIG. 11 is a flowchart showing another example of the process flow of the present invention.

FIG. 12 is a flowchart showing another example of the process flow of the present invention.

FIG. 13 is a flowchart showing another example of the process flow of the present invention.

FIG. 14 is a flowchart showing another example of the process flow of the present invention.

FIG. 15 is a flowchart showing another example of the process flow of the present invention.

FIG. 16 is a diagram showing an example of a login screen.

FIG. 17 is a diagram showing an example of a file package screen.

FIG. 18 is a diagram showing another example of a file package screen.

FIG. 19 is a diagram showing an example of a mail transmission screen. FIG. 20 is a diagram showing an example of a package history search screen.

FIG. 21 is a diagram showing another example of a package history search screen.

FIG. 22 is a diagram showing an example of an allowed user group selection screen. FIG. 23 is a diagram showing an example of an error screen.

Explanation of symbols

1: File management program

2: File package program

21: File specification part

22: Policy development department

23: Package part

24: Search request part

3: File usage program

31: File specification part

32: Authentication request part

33: Database generator

33a: Usage database

34: Decryption key decryption unit

34a, 34b, 34c: Collation 'update means

35: Decryption unit

36: File usage control section

37: Repackaging part

: User terminal

2: Compatible software

3: —Time memory

4: Node disk

5: Server

51: Key generator

2: Policy file generator 3: Search part

: Authentication section

5: User database: History database 7: Authentication database: Network

Claims

The scope of the claims

[1] A file management program that includes a file package program that is stored and executed in a user terminal and performs centralized management of an original file created by an arbitrary user, and the file package program includes:

A file specification section that accepts the specification of the original file that you want to manage,

A policy formulation unit that formulates a policy for using the original file;

A package unit for packaging a common key generated for each original file, a policy file generated based on the policy, and an original file encrypted with the common key to generate a package file; Have

Only users who satisfy the policy usage conditions can use the common key in the policy file and the authority to use the original file on the temporary memory of the user's terminal, and decrypted with the common key. The original file can be expanded only on the temporary memory, and the package file is generated so that the original file can be used within the range of the usage authority.

A file management program characterized by that.

[2] The file package program further includes:

A search unit for searching for information relating to a package history of the package file and information relating to a user's access history to the package file;

The file management program according to claim 1, wherein:

[3] The file package program is:

A package file is generated in the package section, and notification of generation of the package file or notification of transmission of the package file by mail attachment to a user terminal of a user who is authorized to use the original file Part

The file management program according to claim 1, wherein the file management program is provided.

[4] It has a file use program that is stored and executed in the user terminal and is used by the user by restoring the original file packaged by the file package program for centralized management of the original file created by any user A file management program, The file utilization program is:

Among the package files, a file specification part that accepts specification of the package file in which the original file you want to use is packaged,

If the usage conditions of the policies that make up the policy file in the package file are matched, and the usage of the original file is within the usage conditions, the common key generated for each original file In addition, the decryption key of the original file used for encryption and the authority to use the original file are acquired in the middle of the policy file, and the decryption key and the authority to use are obtained from the user terminal. A decryption key that is expanded in the temporary memory of

A decryption unit that decrypts the encrypted original file in the package file with the acquired common key, and expands it on a temporary memory of the user terminal;

Based on the acquired usage right! /, A file usage control unit that controls the use of the original file.

A file management program comprising:

[5] The file usage control unit

The corresponding software of the original file is controlled and based on the acquired use authority from the corresponding software to the OS or middleware of the user terminal! It is a means of API hooking that performs function call instructions.

The file management program according to claim 4, wherein:

[6] The file use program further includes:

When the encrypted original file in the package file is decrypted and the original file is edited based on the user's usage rights, the edited original file is packaged together with the policy file again. Repackage the package to update the original package file.

6. The file management program according to claim 4 or 5, characterized by comprising:

[7] The file utilization program is:

When the original file is repackaged, a notification unit for notifying the user terminal or server of the original file creation user that the repackage has been performed. 7. The file management program according to claim 6, further comprising:

[8] The file utilization program is:

Each time the user terminal tries to use the original file in the package file at the user terminal, the usage situation database that can update the usage situation of the original file by the user terminal is read and updated by a user terminal other than the user terminal. In a state where it is not possible, a database generation unit that generates the user terminal

The file management program according to claim 7, wherein the file management program according to claim 7 is provided.

[9] Part or all of the policy file is stored on the server,

The file utilization program is:

The file management program according to any one of claims 4 to 8, wherein the server is requested to check usage conditions in the policy file.

[10] The policy file is encrypted with the key replaced by the replacement table generated for each server.

The replacement table is stored in the user terminal as well as the file management program is stored in the user terminal.

The file management program according to any one of claims 1 to 9, wherein

[11] The policy file is

If the usage conditions are described in association with multiple policy objects, and the usage conditions corresponding to any policy object are satisfied, the key to open another policy object is obtained. It has a chained data structure that can be used to retrieve the decryption key and usage rights only when all policy object keys are finally opened and all usage conditions are satisfied. And

11. The file management program according to claim 1, wherein the file management program is any one of claims 1 to 10.

[12] The file management program includes: It has an authentication interface that authenticates whether or not it is a registered user of the file management program, or authenticates whether or not it is a user authorized to use the original file included in the usage conditions

The authentication interface is

The authentication device determined by the request for the user power or the authentication device power determined in advance on the authentication interface side The second password of the user output and the type of the authentication device are set in the file management program. The login ID and password are sent to the user terminal server and requested to collate with the data already stored in the server.

12. The file management program according to claim 1, wherein the file management program is any one of claims 1 to 11.

The authentication interface is

If the authentication device includes cryptographic key logic, the template data corresponding to the login ID is acquired from the template data stored in the server or the user terminal, and the PKI of the user is acquired. Obtain the second password through signature verification and decryption using a certificate, and request verification with the data already stored in the server

The file management program according to claim 12, wherein