JP2011248711A - Data management system with secret sharing - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a technology to safely store and transmit a document file handled between users of a group such as a company by a secret sharing with respect to a data management system with the secret sharing.SOLUTION: A data management system comprises an ASP server 10 providing a service for a group such as a company. The ASP server 10 comprises a labeling management part 11 managing a process to attach label information chosen by a user to a document file in a user terminal 20 of a group, a secret sharing management part 15 providing a service for fragmentation processing (secret sharing) of a file in the user terminal 20 and for restoration processing for use, and a check part 16 for checking an appropriateness of the restoration at the restoration processing. Also, the system has a means to associate disclosure range information of each group with the label information. The check part 16 determines whether an access source is in the disclosure range or not toward an access for a restoration request and does not perform restoration if the source is not included.

Description

  The present invention relates to a data management system technology for realizing safe storage and transmission of data (information assets) such as document files handled by companies and individuals, and more particularly to a data management system using secret sharing technology. In particular, it relates to technology for realizing important data protection, information leakage countermeasures, and the like for companies.

  There is a data management system using secret sharing technology as an effective technology for realizing information leakage countermeasures for companies and the like. A function for storing and transmitting data by dividing the target data (original data) into multiple pieces (divided data) for general data (document files) existing on the terminals of users (employees) of companies, etc. Have. Fragments are formed by rearranging data in bit units, and individual fragments are kept secret. In other words, the information is divided in the same way as with the paper shredder technology, but each fragment is also a state of information that is meaningless to the third party and cannot be read by the third party. It becomes. A plurality of pieces (sets) are stored in a plurality of locations together with information necessary for restoration (“restoration information”). In particular, security can be improved by distributing and storing and transmitting a plurality of fragments (sets) to a plurality of data center servers on the network. When restoring document files (original data) from fragments, multiple fragments (sets) can be collected and restored by restoration processing (data rearrangement, etc.) according to the restoration information, which can be viewed by the user become. In particular, even if important information such as personal information is included in the original data, since each fragment is in a confidential state and managed in a distributed manner, it is not possible to read important information from each fragment alone by a third party. It is not possible to restore the original data.

  By using the data management system (fragmentation / restoration function), a user of a company or the like can safely handle a document file in a confidential state without much awareness. For example, an employee can safely operate important data (such as non-public information handled in the company) with his / her terminal. For example, when a file is saved, it is safely stored in a fragmented state on an external network, and automatically restored when a file is viewed or edited. It is also possible to provide important data between companies (between users) from one side to the other in a safe state (storage / transmission on a network, mailing / handing by storing in a medium, etc.).

  Japanese Patent No. 4039810 (Patent Document 1) (method for ensuring the security of electronic information) is a prerequisite technology related to the data management system based on the secret sharing technique. Patent Document 1 describes GFI electronic tally (registered trademark) technology.

  Further, as a prerequisite technology, there is a labeling management system (labeling management function) for giving label information to a document file by a user (Non-Patent Document 1). The user himself / herself selects and assigns label information corresponding to the nature of the document, such as the importance of the document, to the data itself such as the document file created by the application of the terminal. Label information is added to the data by the program. The labels are, for example, “confidential”, “in-house limit”, “related party limit”. As a result, it is possible to increase the level of identification and organization of data (information assets) in group units such as companies, and to increase the level of security such as prevention of information leakage.

Patent No. 4039810

NRI Secure Technologies, Inc., “SecureCube / Labeling”, <URL: http://www.nri-secure.co.jp/service/cube/labeling.html>

  It is related to a conventional data management system based on secret sharing. By using the fragmentation / restoration function as described above in an information processing system (user terminal) of a company, the document file can be safely stored and transmitted. Although it can be generally realized, there are risks of information leakage due to user operation mistakes and unauthorized use by third parties. For example, if the document file (fragment) is provided / delivered by secret sharing, or if the provided file (fragment) itself is incorrect, restoration by a user of a company unrelated to the document file is not possible. Appropriate restoration (acquisition / use) may occur. In particular, in the case of a document file including important data, the influence on information leakage is very large.

  In view of the above, a main object of the present invention is related to a data management system using secret sharing, and can securely store and transmit document files handled between users of a group such as a company. ) To provide a technology that can prevent improper restoration (acquisition / use) of the file even when the provision / delivery destination is wrong. In other words, for example, it is to provide a technology capable of reducing the risk of information leakage of a company or the like and preventing information leakage or the like.

  To achieve the above object, a representative embodiment of the present invention relates to a data management system using secret sharing, and data (document file) handled by an information processing system (user terminal) of a group such as a company. Is provided with a fragmentation and restoration function / service (hereinafter referred to as “secret sharing service” or the like), and has the following configuration.

  For example, this secret sharing data management system has a service provider system including a server device that provides a service to an information processing system of a group including a plurality of user terminals. The server device provides a secret sharing service process including a function of fragmenting a target document file by a secret sharing technique and a function of restoring the document file from the fragment to a user terminal of the group. It has a secret sharing manager. The terminal of the user of the group has a secret sharing processing unit that accesses the secret sharing management unit of the server device and receives the secret sharing service process. The server device includes a check unit that checks whether or not restoration is possible and prevents inappropriate restoration at the time of restoration in the secret sharing service process. The server device has group information including ID, domain information, or IP address information for each group as management information that can be set by a user. The server device has public range information associating public range information in group units with document files on the user terminals of the group as management information that can be set by the user.

  The information processing system of the group having the fragment of the document file, when restoring the document file from the fragment, accesses the server device, and includes access source information and information of the fragment or document file. The request information is transmitted, and the check unit of the server device includes, based on the management information, the access source group ID or domain or IP address in the request information included in the disclosure range associated with the document file. The secret sharing management unit of the server device determines whether or not the document file is not restored in the case of the above in accordance with the result of the determination. The restoration process is executed, and the information processing system of the access source group acquires the restored document file.

  In addition, for example, the server device includes a labeling management unit that provides a service for managing information on labels used in the group to the terminals of the users of the group, and the terminals of the users of the group include the server A labeling processing unit that accesses a labeling management unit of the apparatus and performs processing for using the information of the label; The terminal of the user of the group has a function of setting an association between the label and the disclosure range for the disclosure range information of the server device. In the terminal of the user of the group, the labeling processing unit assigns information on a label selected by the user to the document file. The information on the label given to the document file is also given to the fragment by the fragmentation.

  When the group information processing system having a fragment of the document file restores the document file from the fragment, the information processing system accesses the server device to obtain the request information including the label information attached to the fragment. And the check unit of the server device, based on the management information, whether the ID or domain or IP address of the access source group in the request information is included in the disclosure range associated with the label of the document file Determine whether or not.

  According to a typical embodiment of the present invention, it is related to a data management system based on secret sharing, and a document file handled between users of a group such as a company can be safely stored and transmitted by secret sharing. Even when the provision / delivery destination of (fragment) is wrong, it is possible to prevent inappropriate restoration (acquisition / use) of the file. In other words, for example, it is possible to reduce the risk of information leakage of a company or the like and prevent information leakage or the like.

  In particular, it is possible to realize restoration check / control according to the nature of the document file itself and the relevance between the group / user (restoring person) of the provider company and the like, which could not be achieved with the prior art.

It is a figure which shows the whole structure regarding the system (data management system by secret sharing) of one embodiment of this invention. It is a figure which shows the structural example etc. of each part of this system. It is a figure which shows the structural example regarding the labeling management function (and open range provision function) of this system, the labeling process by the file provision side, etc. It is a figure which shows the structural example regarding the fragmentation process by the file provision side of this system. It is a figure which shows the structural example regarding the restoration process by the file reception side of this system. It is a figure which shows the detailed example of the fragmentation process in this system. It is a figure which shows the example of a screen at the time of labeling by this system. It is a figure which shows the example of a screen at the time of the setting in this system, and labeling.

  Hereinafter, embodiments of the present invention (data management system based on secret sharing) will be described in detail with reference to the drawings (FIGS. 1 to 8). Note that G: group, U: user, K: administrator, C: terminal, F: file (document), T: template, L: label, d: fragment, H: disclosure range, etc. And

[Overview]
The system according to the present embodiment sets (1) labeling management function, (2) secret sharing service (fragmentation / restoration function), (3) restoration check function, and (4) disclosure range H as constituent elements. / It has a function to give. Further, the ASP server 10 side performs a main process of fragmentation / restoration (the terminal 20 side is a simple process).

  In this system, (1) a labeling management function for managing labeling that gives label information to data (document file) by a user of a group of companies, etc., and (2) data of a user of the group of companies (document file) A service combining a fragmentation (secret sharing) and restoration function (secret sharing service) targeted for a group is provided to an information processing system (terminals of a plurality of users) of a group such as each company.

  In this system, (2) a secret sharing service is provided, and (3) a check function when a user of the group restores (acquires and uses) a file from a fragment is provided to prevent inappropriate restoration. In particular, (4) using the function for setting / assigning the disclosure range H, depending on the nature of the importance of the document file itself represented by the assigned label information and the relevance to the group to which the document file is provided Realize checking and control during restoration. It is possible to restore from the appropriate disclosure range H for each document file.

  (4) The function to set / give the disclosure range H is a means / function that allows the disclosure range H information to be associated with a document file or its label information in units of groups such as companies. , (A) method: setting function to the ASP server 10, (b) method: granting function in individual user terminal 20 (FIG. 2, public range granting unit 40), etc., both of which can be used. . The disclosure range H indicates a group (including a plurality of users) related to a related party related to the document file, that is, a range (target) of browsing, sharing, and disclosure. With the function (4), the document file itself can be provided (associated) with the disclosure range H information. When the restoration check in (3) is performed, the appropriateness of restoration is determined by referring to and comparing the destination of the file (access source of the restoration request) and the disclosure range H associated with the label of the file. To do. Control execution and permission of restoration based on the check result.

[system]
FIG. 1 shows an example of the overall configuration of this system. An information processing system in units of groups (including a plurality of users' terminals 20) such as a plurality of companies to be serviced on a network (such as the Internet) 90, and a service section (service business) that provides services to them System) 100 and a plurality of data centers 30 are connected.

  The service unit 100 is configured by a server system or the like, and has an ASP server 10 and management information 50 by a database or the like. The ASP server 10 (ASP: application service provider) includes a labeling management unit 11, a secret sharing management unit 15, a check unit 16 (restoration check unit), management information 50, and the like. The ASP server 10 is composed of a server device (group) having each processing function (11 and the like), and performs service processing for access (request) from the terminal 20 and the like while processing the management information 50. The service unit 100 including the ASP server 10 is provided with functions such as server multiplexing and load distribution as necessary so that a large number of accesses can be processed.

  In this system, the ASP server 10 has (1) a labeling management function and (2) a secret sharing service as services / functions provided to each group (user terminal 20). In particular, (2) a function related to the secret sharing service has (3) a restoration check function.

  (1) As a first service, an integrated management service (labeling management function) for labeling (labeling) the document files of users in each group is provided. Realize labeling management based on uniform rules for each group. Since it is managed by the service unit 100, it is not necessary to install a dedicated server or the like in the information processing system of each group. This function is realized by performing communication processing cooperatively between the labeling processing unit 21 (FIG. 2) on the terminal 10 side and the labeling management unit 11 of the ASP server 10.

  (2) As a second service, a secret sharing service that realizes safe storage and transmission of document files by secret sharing at the terminal 20 of each group of users is provided. This function is realized by performing communication processing cooperatively between the secret sharing processing unit 25 (FIG. 2) of the terminal 20 and the secret sharing management unit 15 of the ASP server 10.

  (3) Restoration check function (2) When a group user restores a secret file (fragment) using the secret sharing service, the appropriateness of restoration is checked to prevent improper restoration. It is a function to do. This function is realized by the processing of the check unit 16 that cooperates with the secret sharing management unit 15 of the ASP server 10. In the check process, the determination is made by comparing the information of the disclosure range H (group unit) associated with the label of the file and the access source information of the restoration request. For example, restoration (acquisition / use) by a group (user) not corresponding to the disclosure range H is not permitted.

  In the information processing system on the client side, each group unit G (GA, GB, GC,...) Such as companies A, B, C,... Comprising. In this example, the case of a company unit is shown, but other group units such as a public organization are also possible. For example, the company A (group GA) includes terminals C (CA1 to CAn) of a plurality (n) of users U (UA1 to UAn). For example, each company's information processing system has an in-house LAN to which each terminal 20 or the like is connected. Further, for example, the company A and the company B have a coworking (collaboration) relationship regarding a predetermined business / project, and a specific group unit can be set between these companies (groups).

  User U (UA1 etc.) includes employees, system administrators, group representatives, and the like. Each user U uses a terminal 20 (CA1 or the like) which is an information processing apparatus such as a PC or a mobile device. For example, in the case of a PC, each terminal 20 is connected to the network 90 via an in-house LAN or the like. For example, in the case of a mobile device, it is connected to a network 90 including a wireless communication network. Each terminal 20 can access and communicate with the ASP server 10 via the network 90.

  The data center 30 includes a server system and the like, and includes a secret sharing server 31 (KS). The secret sharing server 31 (KS) has the same function as that of the secret sharing management unit 15 of the ASP server 10 and is based on cooperative processing with the secret sharing management unit 15 of the ASP server 10. Has a function of storing data (fragment d).

[Processing part]
FIG. 2 shows a configuration example of each processing unit of the present system (FIG. 1). For simplicity, each user's terminal 20 has a similar processing unit (21, etc.).

  The terminal 20 includes a labeling processing unit 21, a secret sharing processing unit 25, a Web browser 28, a document creation application 26, a mail client 27, a disclosure range giving unit 40, and the like. The user terminal 20 holds one fragment d (denoted du) obtained by fragmentation (c1) of the document file F.

  The web browser 28 provides a graphical user interface related to a labeling management function, a secret sharing service, and the like. The document creation application 26 is an application that allows a user to create and edit a document file F and the like. For example, the document creation application 26 is software such as a word processor, a spreadsheet, and a presentation. When the document file F with the label L is opened by the document creation application 26 or the like, a label is output in the document page. The mail client 27 is used when, for example, a user creates a mail with a fragment d file attached and sends the mail to a user in a provision destination group.

  The secret sharing management unit 15 of the ASP server 10 manages and processes the service information 85, performs secret sharing service processing (including a fragmentation processing function and a restoration processing function), and the terminal 20 of the group user (secret sharing processing unit 25). ). The secret sharing management unit 15 includes a basic user authentication processing function (described later) in the secret sharing service. The secret sharing manager 15 records log information of secret sharing service processing including user authentication processing in a database or the like.

  The secret sharing processing unit 25 of the terminal 20 accesses the secret sharing management unit 15 of the ASP server 10 and performs processing such as request (b1) -response (b2) of the secret sharing service. The secret sharing processing unit 25 is realized by a client program or the like, and cooperates with the labeling processing unit 21, the Web browser 28, and the like. The terminal 20 uses the secret sharing processing unit 25 to perform an operation / process (c1) for fragmenting the target file F (original data D), and conversely, from the fragmented data (fragment d) to the file F ( The operation / processing (c2) for restoring D) is possible.

  The restoration check unit 16 constitutes a part of functions of the secret sharing service by the secret sharing management unit 15 and can be used based on a service use contract and settings. The check unit 16 performs a check process at the time of the restoration process in the secret sharing management unit 15 based on the management / processing of the disclosure range information 80 (association between the label L information and the disclosure range H information).

  FIG. 3 mainly shows a configuration example related to the labeling management function. The labeling management unit 11 of the ASP server 10 includes a setting unit 11-1, an updating unit 11-2, and the like, and the labeling processing unit 21 of the terminal 20 includes a setting unit 21-1, an updating unit 21-2, and the like. . The labeling processing unit 21 operates in cooperation with each unit (28, 26, 40, etc.).

  The labeling management function (11, 21) includes a labeling function for assigning a label L to the file F by the user at the group user terminal 20 and a group manager K or the like from the terminal 20 to the ASP server 10 (management information 50). And a setting function for making settings related to the group G (group information 60), the template T (template information 70), and the like.

  For example, each group includes an administrator K (KA or the like) that is a specific user who is permitted to perform the setting operation among the plurality of users U and the terminal 20. For example, the group information 60 manages user information such as user ID, type / authority (general / administrator, etc.), and password. When using the setting function (when accessing the ASP server 10 from the terminal 20), a setting operation is permitted only to a specific user such as the administrator K by performing a user authentication process using the user information. Can be controlled.

  As an implementation example, the labeling processing unit 21 is incorporated as a plug-in in the document creation application 26 or the like. In the terminal 20, labeling processing is performed based on the cooperation of the processing between the labeling processing unit 21 and the document creation application 26. The information on the label L given to the document file F is described in attribute information (property information) managed by the document creation application 26, for example.

  The setting units 11-1 and 21-1 realize a setting function that can set a template T (including definition information of the label L) applied in the group G. With the setting function, group information 60, template information 70, disclosure range information 80, and the like can be set. The administrator K or the like accesses the ASP server 10 (setting unit 11-1) from the terminal 20 (setting unit 21-1) based on an operation on the screen of the web browser 28 of the terminal 20, and the group G and the template T The user can perform setting operations such as creation / change / deletion (a1 in FIG. 3).

  The update units 11-2 and 21-2 have an update function capable of automatically acquiring and updating a template T and the like applied for labeling the document file F on the terminal 20 of the user U of the group G. Realize. At the time of labeling or the like, the terminal 20 (update unit 21-2) can automatically acquire the latest template information 70 and the like from the ASP server 10 (update unit 11-2) and apply the update (FIG. 3). A2).

  In the present embodiment, the setting function related to the labeling management function can also be set for each service (including the secret sharing service and the check function). For example, it is possible to set the disclosure range information 80 related to the restoration check function ((a) method). Of course, each service / function setting function may be provided separately.

[Management Information]
As a configuration example of the management information 50 (FIGS. 1 to 3 and the like), group information 60, template information 70, disclosure range information 80, service information 85, and the like are included. The labeling management unit 11 manages and processes management information 51 (60, 70, etc.). The secret sharing manager 15 manages and processes the management information 55 (service information 85 and the like). The check unit 16 manages and processes the management information 56 (60, 80, etc.). The group information 60 is basic management information common to the management information (51, 55, 56), but may be managed separately.

  The group information 60 is management information (group configuration information) related to a group G unit of each of a plurality of companies or the like to be provided with services. For example, group ID (company ID etc.), group name (company name etc.), communication information such as domain information and IP address information, user information such as user ID and terminal ID, etc. are managed. Further, for example, for work between coworking companies, an arbitrary group G unit including a plurality of companies (group G) or respective users U thereof can be set. Also, the association between the group G and the template T (information of one or more templates T used in the group G) is managed (may be managed by the template information 70).

  In the example of the group information 60 in FIG. 3, the ID (GA, GB) of each group G corresponding to each company A, B, etc., the corresponding IP address (IA1, IB1, etc.), etc. are set. The group ID can be a company ID, a department ID, or the like as appropriate. The value of ID (identification information) can be appropriately set on the client (terminal 20) side and the ASP server 10 side and is managed in association with each other. The company ID is simply represented by A, B, etc. for the sake of explanation. Further, a domain on the network 90 (such as “xxx.co.jp”) and information such as an IP address are managed in association with a group ID and the like. Accordingly, the group G (ID, etc.) can be determined based on the group information 60 when checking. Moreover, not only a company (all users) unit but the arbitrary group which consists of a specific user group in a company can also be set. Further, for example, a group of users across a plurality of companies (groups) can be set. For example, the group GX includes a company A (GA) and a company B (GB). The group GX is set for a specific project (X) among, for example, a user of the company A (UA1 etc.) and a user of the company B (UB1 etc.). The members of the group are all users in each company or specific users (UA1, UB1, etc.) depending on the setting. Further, as an example of the association between the group G and the template T, templates TA and TX that are applied (can be used) in the company A (GA) are set.

  The template information 70 includes definition information of various labels L for each template T. For example, a group manager (K) or the like creates label L definition information and the like based on uniform rules in group G units for the ASP server 10 in advance on the setting screen of the terminal 20 (setting function). You can edit it. In the template information 70, an ID and name of the template T, an ID and name of the label L, classification information for each label L, rule explanation information, and the like can be set (described later, such as FIG. 8). In the present embodiment, the template information 70 is set and managed including the disclosure range information 80.

  In the example of FIG. 3, the template TA is a template for the company A, and can be used only by users in the company A. Further, for example, the template TX is a template for a group GX between companies, and can be used by users in each company (A, B) in the group GX. A plurality of templates can be set in one group. In that case, the user of the group can use (apply) what is selected from a plurality of templates. For example, a user of company A can select and use from the set templates TA and TX.

  The disclosure range information 80 manages information that associates the disclosure range H with the label L in units of groups. For example, a group manager (K) or the like associates the label L (label ID) and the disclosure range H (group ID, etc.) with the company ID on the setting screen of the terminal 20 (setting function) in advance. It can be set by selecting / specifying (etc. (a) method). It is also possible to set the disclosure range H in units of groups each consisting of a group of specific users who have already been set in the group information 60.

  In the example of FIG. 3, the template TA for the group GA includes definition information such as a label LA, for example. For example, the template TX for the group GX includes definition information such as a label LX. The label LA (for example, “in-house limit”) is within the company A (GA) as the associated disclosure range HA. The label LX (for example, “related party limit”) is in the group GX {GA, GB} as the associated disclosure range HX. The user can select and use the application template (for example, TA, TX) and its label (for example, LA, LX) according to work or the like.

  The service information 85 is management information related to secret sharing service processing by the secret sharing management unit 15, and information on the group G that uses (requests) the service, the user U / terminal 20 (group ID, user ID, IP address, etc.), Information on the target file F (file ID, etc.), information on the corresponding set (fragment d, restoration information R, etc.) (fragment d data file ID, etc.), information on the corresponding label L (label ID, etc.), storage location Information (such as the address of the secret sharing server 31) is managed in association with each other.

[Service Usage (Settings)]
Examples of work related to service usage and settings of this system are as follows. In advance, an administrator (for example, KA in FIG. 3) of a company (for example, company A) concludes a service usage contract for each service with the service unit 100, and the administrator of the service unit 100 or a setting target group (GA The basic group information 60 (company, user, domain / IP address, etc.) related to the setting target group (GA) is set in the management information 50 of the ASP server 10 by the administrator (KA) or the like. Further, based on the setting of the group (GA), the template information 70 (for example, TA, TX) based on the rules applied in the group is set by the manager (KA) of the group (a1). Also, the disclosure range information 80 may be set ((a) method). Settings can be appropriately changed from the terminal 20 by a setting function. Further, for example, the setting of the template TX (label LX) used between the companies A and B (group GX) is set by a user of one of the groups (for example, GA), and is set to a user of another group (for example, GB). I will contact you. Each user can add / update the latest template information by using the update function of the terminal 20.

  In the terminal 20 of each user in the set group (GA), a program or the like for realizing each processing unit (21 etc.) is installed and set. The labeling processing unit 21 of each user's terminal 20 acquires and stores the set template information 70 and the like from the ASP server 10 (a2). The secret sharing processing unit 25 of the terminal 20 of the user of the group (GA) uses the secret sharing service to the secret sharing management unit 15 (group information 60) of the ASP server 10 by the administrator (KA) or an individual user. Register account information (user information), etc.

  Regarding the use of the restoration check function, the setting function is used to set necessary information for the ASP server 10 (group information 60, disclosure range information 80, etc.) by a group (GA) administrator (KA) or the like. To do. For example, a group to be checked for restoration (for example, GX), an association between a label L (for example, LX) and a disclosure range H (for example, GX), and the like are set.

[Case]
FIG. 2 also shows an example regarding restoration check. Regarding the document file F (corresponding fragment du), the provider is the user UA1 (IP address: IA1) of the company A (group GA) and the provider is the user UB1 (IP address: IB1) of the company B (group GB) And The document file F is, for example, a document file F1 (FIG. 3) for a specific project (X) between the coworking companies A and B. The creator is a user UA1 and the assigned label is LX (FIG. 3). 201 is a case where the fragment du of the file F1 is correctly provided from the provider (A) to the provider (B). 202 sends the correct file F1 fragment du from the provider (A) to the user UC1 (IP address: IC1) of the company C (group GC) which is the wrong provider (non-related party of F1), etc. (The same applies to the case of unauthorized use of the fragment du by the user UC1).

  Reference numeral 203 denotes a case of access request (GB) of the disclosure range preceding the restoration processing related to the fragment du (201) of the file F1 from the terminal 20 of the correct provision destination (B) to the ASP server 10. Is included in the group GX in the disclosure range H (HX) corresponding to the file F1 (LX), and the check result is OK. Reference numeral 204 denotes a case of access to a check request for a disclosure range preceding the restoration processing related to the fragment du (202) of the file F1 from the terminal 20 of the wrong provision destination (C) to the ASP server 10, and the access source ( GC) is not included in the group GX of the disclosure range H (HX) corresponding to the file F1 (LX), and thus the check result is NG.

  Also, for example, the fragment du of the wrong file F, for example, the document file F2 for the company C (granting label LY, disclosure range HY {GA, GC}) is sent from the provider (A) to the correct provider (B). If they are equal, the access source (GB) is not included in the public range HY {GA, GC} corresponding to the file F2 (LY), so the check result is NG.

[Method of disclosure range (H)]
A supplementary explanation will be given of the methods (a) and (b) relating to the association (setting / granting) of the open range H. In order to realize the check function, it has a mechanism to prevent the user operability from becoming complicated.

  In the method (a), the administrator K or the like accesses the ASP server 10 using the setting function of the terminal 20 in advance, and the disclosure range information 80 includes a label L (label ID, etc.) and a disclosure range H (group G unit). ) Can be set. In the case of the method (a), after the setting, the disclosure range H is automatically associated (determined) according to the label L given by labeling in the individual user terminal 20. In the checking process in the ASP server 10, since the disclosure range H associated with the attribute information or the like (label ID or the like) of the file to be restored is known based on the disclosure range information 80, it can be determined. By using the method (a), each user in the group can save time and effort for setting operations related to the use of the service (check function), and user operability and convenience can be maintained.

  In the method (b), the disclosure range H information is sent to the individual document file F or its label L by the user using the disclosure range giving unit 40 at the time of labeling on the terminal 20 of each individual user in the group. Can be specified and given in units of group G or the like. For example, when labeling a document file F for a specific company, based on the attribute of the label L of the template T, it is possible to designate a company or the like (a group of users of a specific related party) that will be in the detailed disclosure range H. it can. In the (b) method, detailed control is possible for each individual file provision.

  The function (b) may be performed separately from the setting (a) or may be combined (in this embodiment, combined). In the case of using only (b), even if the company (group) of the disclosure range H is not specifically set in the definition of the existing label (template information 70), It is possible to designate a detailed disclosure range H (such as a file provider). In the case of combined use, based on the definition of the existing label (template information 70) and the disclosure range information 80 according to (a), the detailed disclosure range (file providing destination) for the given label at the time of individual labeling, etc. Companies). In the case of combined use, the disclosure range H information that can be individually given by the user terminal 20 is controlled to be within a range that does not deviate from the definition in the basic setting information. For example, the other company cannot be assigned as the disclosure range H for the “internal limit” label.

[Example]
A series of processing sequence examples in this system will be described with reference to FIGS. 3 to 5 (S represents a processing step or the like). 3 shows the labeling process etc. on the file providing side, FIG. 4 shows the fragmentation process etc. on the same file providing side, and FIG. 5 shows the restoration process / checking process etc. on the file receiving / restoring side. Show. Note that this is a case in which the fragmentation / restoration main processing (S4, S10) is performed on the ASP server 10 side (the terminal 20 side is a simplified process such as an instruction operation as a trigger).

S0 (setting):
As described above, necessary information is set for the management information 50 based on processing between the terminal 20 and the ASP server 10. For example, in each group (GA, GB) of companies A and B related to the collaboration in FIG. 1, the user UA1 of the company A (GA) is set as the provider of the file F1 (the side that performs creation and fragmentation) and the company B ( The case where the user UB1 of GB) is the provision destination of the file F1 (the side that performs reception and restoration) will be described. The file F1 is a document for a specific project (X) between the companies A and B (corresponding group GX). Assume that the users of the concerned person (person in charge) of the project (X) are UA1, UB1, for example. The label LX of the file F1 is, for example, a label LX (“relevant party limit”) for allowing the document to be browsed or the like based on the template TX and limited to parties concerned between companies (internal and external) (described later). 704 in FIG. In the case of the method (a), the group GX {GA, GB} is set as the disclosure range HX corresponding to the label LX (all users of the group GX or specific users UA1, UB1).

S1 (labeling):
In FIG. 3, the terminal 20 of the user A UA1 of the company A (document creation application 26, labeling processing unit 21, etc.) automatically (forcedly) when the user UA1 creates and saves the document file F (F1). The labeling operation procedure by the user UA1 is interposed. Based on the processing (request-response, etc.) between the labeling processing unit 21 of the terminal 20 and the labeling management unit 11 of the ASP server 10, a labeling screen (described later, such as FIG. 7) is automatically displayed, and the application template T Based on information such as (for example, TX), a process of giving information on a label L (for example, LX) selected by the user UA1 to the document file F (F1) is performed. For example, information such as the label ID (LX) of the assigned label LX is described in the attribute information of the file F1. For example, the value of the label ID is described using the property name and its value.

S2 (Grant scope of disclosure):
In addition, at the time of the labeling of S1, the processing relationship ((b) method) of the disclosure range assigning unit 40 is also used to relate the document to the document file F1 (label LX) by the user UA1. The disclosure range H information corresponding to the person information can be designated and given by the company ID or the like. For example, the user UA1 selects and designates the company ID of the company B (GB) to which the document is provided or a specific group GX including the supplier and the user on the labeling screen (described later, such as FIG. 8). Then, the disclosure range HX is given. The disclosure range assigning unit 40 describes the disclosure range H (HX) information to be assigned in association with the assignment label L information (label ID, etc.) in the attribute information of the file F1, for example. For example, the value of the disclosure range H (company ID, etc.) is described using the property name and its value. When the disclosure range information 80 is already set in the ASP server 10 ((a) method), this process (S2) can be omitted.

S3 (fragmentation):
4, a target file F (a document file F1 with a label LX) selected by a user UA1 based on processing between the terminal 20 (secret sharing processing unit 25) and the ASP server 10 (secret sharing management unit 15). ) Is fragmented (b1, b2). For example, on the screen of the terminal 20 (file system, Web browser 28, etc.), the user UA1 selects the target file F1 to instruct fragmentation. For example, in the case of a folder-linked type (described later), the fragmentation can be triggered when the target file F is dropped in a specific folder. Alternatively, as another opportunity, for example, in the case of a label-linked type (described later), a specific type of label L can be given to the target file F.

  Fragmentation is automatically executed according to the above trigger. A fragmentation request is transmitted from the terminal 20 (secret sharing processing unit 25) to the ASP server 10 (secret sharing management unit 15) (b1). The information (b1) of the request includes, for example, data and information (file ID and the like) of the target file F1, information (label ID and the like) of the assigned label LX, and the like. If there is the provision information (H) in S2, it is transmitted together. The ASP server 10 (secret sharing manager 15) records management information 50 (service information 85), log information of the access, and the like for the request information (b1). For example, information indicating a request for fragmentation of the target file F1 (given label LX) from the group GA (user UA1) is recorded. If there is provision information (H) in S2, that information is also recorded.

S4 (fragmentation process):
The secret sharing manager 15 of the ASP server 10 performs fragmentation processing (S4) on the request information (b1) and returns a response to the access source (b2). This fragmentation process (S4) includes a process of forming a set of a plurality of pieces of fragment d (including restoration information R) data from the target file F (original data D) (described later, FIG. 6). It should be noted that each fragment d is given the inherited label L (LX) of the original file F (F1) as it is. As the response information (b2), for example, one fragment d (for example, d0) of the formed plurality of fragments d (set) is transmitted as the fragment du held by the terminal 20 of the requesting user UA1. . The terminal 20 of the user UA1 holds the fragment du by the response (b1).

S5 (distributed storage):
The secret sharing management unit 15 of the ASP server 10 performs the fragmentation processing (S4) by performing processing with the secret sharing server 31 (KS) of the data center 30 at a plurality of storage destinations (storage locations). The distributed storage process of the fragment d is performed. For example, a plurality of fragments d (d1 to d3) other than one fragment du (for example, d0) possessed by the user UA1 among a set of a plurality of fragments d (for example, d0 to d3) of the target file F are respectively networked. The data is transmitted to and stored in another secret sharing server 31 (KS1 to KS3) distributed on 90.

  Note that the secret sharing manager 15 of the ASP server 10 may store a part of the pieces of fragment d data as in the secret sharing server 31.

  The secret sharing manager 15 records the service information 85 and the log information along with the above processing (S4, S5). For example, a group ID, a user / terminal ID, a file ID, an ID of a plurality of fragment d data files, a label ID (+ publication range H information), storage location information (such as address information of the secret sharing server 31), and the like are stored. .

S6 (fragment provided):
In FIG. 5, the fragment du of the file F1 is transferred from the user UA1 (terminal 20) of the group GA on the providing (fragmenting) side of the file F1 to the user UB1 (terminal 20) of the group GB on the receiving (restoring) side of the file F1. (D0) is provided. Various means of provision are possible, for example, transmission by e-mail (attaching fragment du data) on the network 90 using the mail client 27, and storing the fragment du data in a medium such as a disk or USB memory. And provide it by means such as mailing or handing it. Alternatively, it may be provided via the ASP server 10. For example, the fragment d is deposited from the provider (A) to the ASP server 10 (secret sharing service), the information is notified to the provider (B), and the ASP server 10 (secret sharing service) is accessed from the provider (B). The form of receiving (restoring) the fragment d may be used.

S7 (restore request):
In the terminal 20 of the user UB1 of the group GB, a restoration operation is performed on the fragment du (d0) of the file F1. For example, the fragment du data file to be restored is specified / selected on the screen of the terminal 20 (file system, Web browser 28, etc.). For example, the restoration is automatically executed by clicking the fragment du, for example.

  At the above opportunity, the secret sharing processing unit 25 of the terminal 20 of the user UB1 accesses the secret sharing management unit 15 of the ASP server 10 to request restoration (S7). The information of this request includes (1) IP address information (for example, IB1) as access source information, (2) information such as data and ID of the fragment du of the target file F (F1), and the attached label L (LX). Includes information such as ID.

S8 (check process):
The secret sharing management unit 15 of the ASP server 10 interposes a check process (S8) with the check unit 16 based on the reference to the service information 85 for the restoration request (S7). For example, processing such as a check request from the secret sharing manager 15 to the check unit 16 (S8-1), a result response from the check unit 16 to the secret sharing manager 15 (S8-2), and the like. The check request (S8-1) is based on the information of S7, and includes, for example, (1) information on the access source (restoration request) (IP address or corresponding group ID), (2) label of the target file F L information (label ID), etc. The information of (2) includes the information when the disclosure range H information is given by the method (b). The result response (S8-2) includes, for example, OK / NG information.

  As a check process, the check unit 16 associates (1) the access source information (IP address, etc.) and (2) the label L with reference to the management information 56 (group information 60, disclosure range information 80, etc.). The disclosure range H information (group ID or the like) to be compared is determined, and OK / NG related to the execution of restoration is determined based on whether or not the access source is included in the disclosure range H. As a determination example, the group GX {GA, in the public range HX in which the group ID (GB) corresponding to the IP address (IB1) of the access source is associated with the label ID (LX) of the assigned label LX of the target file F1. Since it is included in GB}, the result is OK.

S9 (fragment collection):
The secret sharing manager 15 executes the following restoration process (S10) when the check result (S8-2) is OK, and does not execute it when the check result is NG. If the result is OK, the secret sharing management unit 15 uses the secret sharing server 31 (for example, FIG. 4), which is the storage location of the plurality of fragments d of the target file F, based on the service information 85 for the restoration process (S10). KS1 to KS3) and collect a plurality of fragments d (including restoration information R) necessary for restoration. For example, the set of fragments d in FIG. 4 (d1 to d3 and du (d0)) is acquired.

S10 (restoration process):
Then, the ASP server 10 (secret sharing management unit 15) uses the set of collected pieces d (with label L) (including restoration information R) to connect the terminal 20 (secret sharing processing unit 25) of the user UB1. The restored file F (original data D) is obtained by performing the restoration process (S10) based on the processing between the two.

S11 (restoration response):
If the check result (S8-2) is OK, the secret sharing manager 15 of the ASP server 10 transmits the restored data of the file F1 to the terminal 20 of the user UB1 that is the access source. Thereby, the user UB1 can acquire / view the file F1 (with the label LX).

  When the check result (S8-2) is NG, the secret sharing management unit 15 does not execute the restoration process (S10) regarding the target file F1, and sends the NG message to the terminal 20 of the user UB1 that is the access source, for example. Reply with information. This prevents file acquisition and use due to inappropriate restoration.

  Still further, information such as the result of the check / restoration (information indicating that it was OK or information indicating that it was NG) is notified to the terminal 20 of the user UA1 of the providing group GA by e-mail or the like. May be.

  In the above sequence example, the fragmentation subject (A) and the restoration subject (B) are different, but the check function works by the same process even in the case of the same subject.

[Secret sharing service (fragmentation processing)]
FIG. 6 shows a detailed example of the fragmentation process (S4) in this system (secret sharing service). This processing example is in accordance with a publicly known technique (the above-mentioned patent document 1 etc.) except for handling the label L information.

  A file F with label L (original data D), for example, a file F1 with label LX is targeted. Reference numeral 601 denotes a storage area (header or the like) of attribute information of the file F, in which label L information or the like is described.

  (1) Element division: First, the data D excluding the label L is divided into random data in bit units. The divided data here is element E. Let m be the number of elements E (number of divisions). A plurality of elements E {E1 to Em} are obtained. For example, the case of m = 6 is shown. The division number m is variable according to the target level.

  The data of each element E is accompanied by information such as the position and length in the original file F. The accompanying method is described in a batch or the like in each element E, each block B, or in the restoration information R.

  (2) Order rearrangement: The plurality of elements E are rearranged at random (array, shuffle).

  (3) Block formation: A plurality of blocks B are formed (extracted) from a plurality of elements E by combination / selection or the like. The number of blocks B (number of formations) is n. A plurality of blocks B {B1 to Bn} are obtained. For example, the case of n = 3 is shown. Each block B does not have the same bit arrangement as the original data D. From one block B, the original data D cannot be partially restored. Block B is associated with fragment d.

  The data of each block B is accompanied with information on how to form the block B. The accompanying method is a block description or the like for each block B or in the restoration information R. For example, the header 610 of the block B1 (fragment d0) includes information on the elements E (for example, E4 and E1) constituting the block B1 (and further detailed information on the division of each element E). In addition, information regarding the ID of the file F, the ID of the block B, the ID of the element E, the restoration information R, and the like may be appropriately stored in the header of the element E or the block B.

  Further, the fragmentation method as described in the above (1) to (3) is described / generated as the restoration information R. That is, the restoration information R includes information related to the element division, order rearrangement, block formation, and the like. The restoration information R may be described in the attribute information header or the like for each element E or each block B, for example. The attribute information of a plurality of elements E may be collectively described as attribute information of the corresponding block B, or the attribute information of the plurality of blocks B may be collectively described as attribute information (restoration information R) of the corresponding set (file F). May be described.

  The block B is a fragment d (divided data). A set of multiple (n) fragments d corresponding to the original file F is obtained. Each fragment d attaches label L information to an attribute information storage area (header or the like). In this example, in all fragments d, the same attached label L information (label ID, etc.) corresponding to the original file F is inherited and attached to the headers (610 to 612).

  Further, although depending on the fragmentation method, each fragment d attaches the restoration information R to the attribute information storage area (header or the like). In this example, the same restoration information R is included in the headers (610 to 612) in all fragments d (d0 to d2). That is, the restoration process can be performed by referring to the restoration information R of any fragment d. The restoration information R may be configured as one independent fragment d in other schemes (602). In this case, if there is no fragment d of the restoration information R, the restoration process is impossible.

  Further, a part of the fragment d (for example, d0) in the set is managed as a fragment du to be held in the terminal 20 of the user (creator, owner, etc.) of the target file F. Alternatively, a specific data file in which management information such as the restoration information R is described is configured and held in the ASP server 10 and the user terminal 20.

  Further, the fragments d such as the respective blocks B and the restoration information R are appropriately packaged as a unit corresponding to storage and transmission. In the package, for example, management information such as a user (provider, provider, etc.), file F, address, etc. may be stored in a header or the like. The package may be subjected to encryption processing or the like. Each fragment d (package) is distributed and stored in a plurality of storage locations (such as the secret sharing server 31) on the network 90, for example.

  Note that since the block B (fragment d) is in a secret state, a basic level of safety is ensured. The location and means of storage and transmission can be selected according to the target level. For example, the level is raised by physically and geographically distributing the storage locations of the plurality of pieces d. Further, for example, the level is increased by using a combination of two or more types.

  At the time of the restoration process (S10) of the file F, a set of a plurality of fragments d (including restoration information R) is collected, and the reverse flow process at the time of fragmentation is performed according to the restoration information R. The file F can be restored. That is, each fragment d (block B) is separated into elements E, rearranged in the correct order (rearrangement), and integrated so that the bits of the original file F (original data D) are aligned.

  In this example, as a fragmentation method, data of a plurality of fragments d is formed to have redundancy as in RAID 5 and the like, and even if some fragments d are lost, they can be restored without any information leakage. And For example, there is no problem even if some of the fragments du held by the user terminal 20 are eliminated. As a method of configuring the divided data having redundancy, parity data is generated from the original data, and distributed with the original data to form divided data (fragment d). Taking advantage of the above redundancy, the fragment d can be stored even in a data center 30 (a provider of inexpensive HaaS, PaaS) with a low SLA as a storage location. That is, the service can be realized at a low cost. Further, by taking advantage of the above redundancy, it is possible to implement a file backup function by this secret sharing service (which can be immediately restored), and a simple BCP by the regional distribution of the data center 30. In the case of distributed storage, for example, even if some data centers 30 collapse due to a disaster, they can be restored.

  As another fragmentation processing method, data of a plurality of fragments d can be formed so as not to have redundancy, and restoration cannot be performed unless all the fragments d are prepared. The fragmentation-restoration method is not limited to the above example, and various methods can be used according to a known technique.

[Configuration example of secret sharing service]
The configuration example of the secret sharing service has the following types in detail. The target file F is a general document file.

  (1) Folder-linked type: The user drags and drops the target file F to a specific folder (“secure folder”) based on the settings on his / her terminal 20 (file system or the like) (move or save operation, etc.) ) Then, the fragmentation processing (S3, S4) is automatically performed on the file F (regardless of the presence or absence of the assigned label L) by this secret sharing service processing (including distributed storage (S5)). At the user's terminal 20, a fragment du data file is obtained. The fragment du functions as an operation icon for the file F. The target file F is inherited even after fragmentation and restoration when there is a given label L. Similarly, the fragment du is clicked (selected and executed) or opened in the specific folder, or moved to another normal folder. Then, the restoration process is automatically performed on the fragment du.

  (2) Label-linked type: A user selects and gives a label L to the file F at the time of creation / save of the file F at his / her terminal 20 (document creation application 26, labeling processing unit 21, etc.) ( Labeling process). Then, the fragmentation process is automatically performed on the file F with the label L by the secret sharing service process as described above.

  Further, as a combination of the above (1) and (2), a predetermined type of document file F (in a state where no label L is assigned) automatically dropped to a secure folder is automatically set based on the setting. It is also possible to perform control so that the label L is applied and the fragmentation process is executed.

  By using the service as described above, the user can safely handle important data and the like without having to be aware of it, and information leakage can be prevented. Only when the user is viewing / editing the file F on the terminal 20 is the normal state, and when storing or transmitting, the service automatically enters the non-critical information state.

[User Authentication]
As a configuration example of the secret sharing service, the secret sharing management unit 15 has a basic user authentication processing function. In response to access from the user terminal 20 (secret sharing processing unit 25), the secret sharing management unit 15 performs user authentication processing using, for example, a user ID + password based on user information (account information, etc.) included in the group information 60. (Login process) is performed. A secret sharing service (fragmentation and restoration function) is provided to users of the official group that passes this, and the use of the service by unrelated third parties is controlled without permission.

  When a request to restore the file F from the fragment d (S7, etc.) is made, the check process (S8, etc.) is performed after the user authentication is passed. At the time of the check, this is a restoration request within the public range H (group G) corresponding to the file F (label L) when the user of the official group in the secret sharing service has the fragment du of the target file F In this case, restoration execution is permitted (OK). Unlike the prior art, file restoration by a group (user) can be checked and controlled in a group unit (domain / IP address, group ID, etc.) such as a company in a secret sharing service. An official user who passes the user authentication can perform restoration by a simple operation such as opening (clicking) the fragment du data file without requiring a special operation.

  In addition, for example, a user of an official group who passes user authentication and uses the secret sharing service, and a user (for example, a specific project (X The user who is not the person in charge of ()) requests the restoration of the file (for example, when the disclosure range H is set in the group GX (all users)). In this case, in the check at the time of restoration, the access source is included in the disclosure range H (GX), and the result is OK. Since the log information at the time of restoration is recorded in the service unit 100, even if there is a problem in restoration by the user, confirmation and verification can be performed later.

  Further, for example, when a user of a group on the file providing side notices sending to an incorrect providing destination, the user immediately deletes the fragment du data file of the file from the folder of his / her terminal 20, and accordingly, Accordingly, the set of the corresponding fragment d is deleted by the ASP server 10 side. Therefore, inappropriate restoration can be prevented. If the user needs the file, the user stores the file separately before the deletion operation.

[Labeling screen]
FIG. 7 shows an example of a labeling screen that is automatically displayed at the time of labeling (S1) on the terminal 20 of the user of the group. In this example, when there are a plurality of templates (for example, TA, TX, etc.) that can be used at the terminal 20 of the user of the group (for example, GA) at the time of labeling, the user selects and applies them. It is. In the application template item (700), information (name or the like) of one or more available templates is displayed, and the user selects a template to be applied to the document file. If there is one available template, it is automatically determined.

  In the label item (710), based on the information of the applied template (eg, “company template” (TA)), information on one or more labels that can be used for selecting a given label is displayed. Make a selection operation. The user selects a label according to the importance of the document file to be assigned based on the reference to the display information (classification, rule, etc.). For example, by selecting from the “Label” item on the left and pressing the OK button, the label can be given.

  In this example, five types of labels L (701 to 705) are shown. It is related to the definition of various labels and has items such as “label”, “confidential information category”, “internal / external category”, and “rule”. The item “label” indicates a design (image) on the output (display, printing, etc.) of the label. The characters 701 are “confidential”, 702 is “internal limit”, 703 and 704 are “related party limit”, and 705 is none.

  In this example, the item “confidential information classification” includes “confidential”, “in-house limit”, “related party limit” (1), “related party limit” (2), “public information”, and the like. This item is classification information regarding the confidentiality of the target data. In this example, the item “internal / external classification” has two types, “internal document” and “external document”. This item indicates the division inside and outside the group unit. The meaning of “internal document” indicates that the labeled document file is for a specific internal company. The meaning of “document for outside” indicates that the labeled document file is for a specific outside in addition to a specific company.

  In the item of “Rule”, for each label, an explanation of a rule that is unified within the group, a description such as the nature of the importance of the document file to be assigned, a description range, etc. are described. For example, the “internal limit” label (702) indicates that, as a rule, the labeled document is browsed only for employees within the company. In other words, it indicates that the document is not viewed by anyone other than those in the range. For example, a label (703) of “related party limit” (1) indicates that the labeled document is browsed only for persons in charge (participants) belonging to a specific group within the company. For example, the label (704) of “relevant person limit” (2) indicates that the labeled document is to be browsed and limited to persons in charge (participants) belonging to a specific group within and outside the company.

[Template setting screen]
FIG. 8 shows an example of a template setting screen as an example of a screen displayed when the setting function is used on the terminal 20 of a user such as an administrator (K). At the time of setting, the terminal 20 (setting function) such as an administrator (K) accesses the ASP server 10, performs login processing related to the user of the group, and succeeds in user authentication. Is displayed on the terminal 20.

  In this example, it has a template information item (800), a category selection item (810), a label information display / setting item (820), a disclosure range detail setting item (830), and the like. In the template information item (800), the ID and name of the template to be set are displayed. In the category item (810), the category relating to the label (based on the category of the definition information of the label) can be selected by the user. For example, the categories “internal”, “internal & specific external”, and “public” are displayed.

  In the label information item (820), information on all labels of the target template, or information on the type of label corresponding to the category selected by the user in the category item (810) is displayed. For example, when “internal” is selected in 810, only the label information of “internal / external classification” is displayed. For example, when “internal & specific outside” is selected, only the label information of “external document” is displayed for “internal / external classification”. In this item, for example, as in FIG. 7 (710), for each label, a label, a classification (confidential information classification, internal / external classification), a rule, a disclosure range, a display order, and other items are displayed. Definition information can be set. In particular, in the item “public range”, the above-described public range H information can be confirmed and set. For example, when “setting” is selected in this item, the disclosure range H associated with the label L can be specified and set by the user in a specific group unit (such as a company unit). For example, by setting the template TX for a specific project (X), the group GX {GA, GB} can be set by designating the partner company B (GB) as the disclosure range HX.

  Furthermore, in the setting item (830) of the disclosure range details, details of the disclosure range H associated with the label L (in this example, a company unit) can be arbitrarily specified and set by the user. In the template, classifications, rules, and the like are roughly defined for each label, but in the item of the disclosure range H, a user can specify a specific group (company) as the disclosure range H (specific outside). For example, the company name and company ID are input and specified by the user. It is also possible to search by company name or company ID. In addition, a list of the main company information (company a, b, c,...) That can be selected and specified in the company list information item, and the company selected by the user in the item of disclosure range (specific outside). Information (eg, “company a, b”) is displayed. The user can add (specify) with the add button and delete (cancel designation) with the delete button. As another format, a check box may be displayed so that a user checks a designated company.

  The main company information displayed in the list or the like is, for example, information on companies registered in the ASP server 10. For this registration, for example, the service provider registers a listed company in advance. Also, companies that are not displayed in the list can be registered from the client side (user). In that case, for example, the company registration button is pressed, and the information of the company to be registered on the display screen is registered by the registration process in cooperation with the ASP server 10 (group information 60). Alternatively, registration may be performed by requesting the service unit 100 for registration.

  With the “OK” button, the template information edited on this screen can be stored in the terminal 10 and uploaded to the ASP server 10 (management information 50) for registration (setting update). The template registered in the ASP server 10 is reflected as a template for each user in the group.

  Also, the labeling screen is not limited to the example of FIG. 7, and the same information (810, 820, 830) as in the example of FIG. 8 may be displayed so that the user can select it. For example, in the method (b) relating to the provision of the disclosure range H, information regarding the setting of the disclosure range H as shown in FIG. 8 (820, 830) may be displayed as the processing function of the disclosure range provision unit 40.

[Effects]
As described above, according to the system of the present embodiment, the document file F and the like handled between users in each group can be safely stored and transmitted by secret sharing (secret sharing service), and the file F (fragment d) Even if the service provider is wrong, the check function at the time of restoration makes the file F inappropriate due to a user's operation error (such as a mistake in the service provider or file provided) or unauthorized use by a third party. Recovery (acquisition, browsing, etc.) can be prevented. In other words, for example, it is possible to reduce the risk of information leakage of a company or the like and prevent information leakage or the like. In particular, it is possible to control restoration according to the properties (label L, disclosure range H) of the document file F itself.

  In particular, it is possible to realize safety of a predetermined level or more without impairing user operability and convenience when using a file. Further, the effect of the check function can be obtained regardless of the means for providing the file (fragment).

  In this check function, the range check is performed in units such as an IP address and a group ID, not in an individual user unit. Therefore, a user authentication process for checking or the like is unnecessary, and a check effect can be obtained without impairing user convenience. As mentioned above, there is a separate basic user authentication processing function in the secret sharing service, but this is confirmation of the person who has the account of the service, while this check function is a user who is permitted to use the file. It is confirmation (check) of being (group), and both are different. With this check function, an effect that this confirmation (check) can be realized without requiring an additional operation is obtained.

[Other embodiments]
Although the ASP server 10 is configured to integrate and provide each function / service, the ASP server 10 may be configured separately on another server. For example, a server for a labeling management function, a server for a secret sharing service, and the like may be divided and linked between servers when necessary.

  The secret sharing management unit 15 of the ASP server 10 is not limited to the form in which the fragmentation processing (S4) and the restoration processing (S10) regarding the target file F are performed, but the data (fragment required) in the user terminal 20 (secret sharing processing unit 25) In the same manner, the fragmentation process (S4) and the restoration process (S10) regarding the target file F are performed by acquiring the set of d), and the ASP server 10 performs the range check by the restoration check unit (16). It is good.

  Further, at the time of restoration, the management information 50 (table or a part of information) necessary for the check process may be acquired from the ASP server 10 side and the check process may be performed on the terminal 20 side.

  Moreover, it is good also as a system form which is not provided with a labeling management function. That is, the label L information is not given to the document file F, and the service provided by the ASP server 10 is centered on the secret sharing service. Instead, a function is provided that allows the user to give the disclosure range H information to the document file F itself. For example, it implement | achieves using the open range provision part 40 of the above-mentioned terminal 20. FIG. For example, in the attribute information of the document file F, the disclosure range H information based on the company ID specified by the user is described. Then, the disclosure range H information is included in the information of the request to the ASP server 10, and the check process is performed.

  As mentioned above, the invention made by the present inventor has been specifically described based on the embodiment. However, the present invention is not limited to the embodiment, and various modifications can be made without departing from the scope of the invention. Needless to say.

  The present invention can be used for an information processing system of a company, a data management service on a network, and the like.

  DESCRIPTION OF SYMBOLS 10 ... ASP server, 11 ... Labeling management part, 11-1 ... Setting part, 11-2 ... Update part, 15 ... Secret sharing management part, 16 ... Check part (check part at the time of restoration), 20 ... Terminal, 21 ... Labeling Processing unit 21-1 ... Setting unit, 21-2 ... Update unit, 25 ... Secret sharing processing unit, 26 ... Document creation application, 27 ... Mail client, 28 ... Web browser, 30 ... Data center, 31 ... Secret sharing server , 40 ... Public range granting unit, 50, 55, 56 ... Management information, 60 ... Group information, 70 ... Template information, 80 ... Public range information, 85 ... Service information, 90 ... Network, 100 ... Service unit (service provider) system).

Claims (12)

A service provider system including a server device that provides a service for an information processing system of a group including a plurality of user terminals;
The server device provides a secret sharing service process including a function of fragmenting a target document file by a secret sharing technique and a function of restoring the document file from the fragment to a user terminal of the group. Has a secret sharing manager,
The terminal of the user of the group has a secret sharing processing unit that accesses the secret sharing management unit of the server device and receives the secret sharing service process,
The server device includes a check unit that performs processing for preventing improper restoration by checking whether restoration is possible during the restoration in the secret sharing service processing,
The server device has group information including ID, domain information, or IP address information for each group as management information that can be set by a user.
The server device has, as management information that can be set by a user, public range information for associating information on a public range in a group unit with a document file on a user terminal of the group,
The information processing system of the group having the fragment of the document file, when restoring the document file from the fragment, accesses the server device, and includes access source information and information of the fragment or document file. Send request information,
The check unit of the server device determines, based on the management information, whether the ID, domain, or IP address of the access source group in the request information is included in a disclosure range associated with the document file. ,
According to the result of the determination, the secret sharing management unit of the server device does not execute the restoration process of the document file in the case of the above, and executes the restoration process in the case of being included, and performs the restoration process. A data management system based on secret sharing, wherein the information processing system of the access source group acquires the document file that has been processed. A service provider system including a server device that provides a service for an information processing system of a group including a plurality of user terminals;
The server device provides a secret sharing service process including a function of fragmenting a target document file by a secret sharing technique and a function of restoring the document file from the fragment to a user terminal of the group. Has a secret sharing manager,
The terminal of the user of the group has a secret sharing processing unit that accesses the secret sharing management unit of the server device and receives the secret sharing service process,
The server device includes a check unit that performs processing for preventing improper restoration by checking whether restoration is possible during the restoration in the secret sharing service processing,
The server device has group information including ID, domain information, or IP address information for each group as management information that can be set by a user.
The terminal of the user of the group has a disclosure range giving unit that performs processing for associating the disclosure range information with the document unit in units of groups,
When the group information processing system having a fragment of the document file restores the document file from the fragment, the server apparatus accesses the server device to access the source information, the fragment or document file information, and the document. Send the request information, including the disclosure scope information associated with the file,
The check unit of the server device determines, based on the management information, whether the ID, domain, or IP address of the access source group in the request information is included in a disclosure range associated with the document file. ,
According to the result of the determination, the secret sharing management unit of the server device does not execute the restoration process of the document file in the case of the above, and executes the restoration process in the case of being included, and performs the restoration process. A data management system based on secret sharing, wherein the information processing system of the access source group acquires the document file that has been processed. The data management system by secret sharing according to claim 1,
The server device has a labeling management unit that provides a service for managing information on labels used in the group for each user terminal of the group,
The user terminal of the group has a labeling processing unit that performs processing for accessing the labeling management unit of the server device and using the information of the label,
The terminal of the user of the group has a function of setting an association between the label and the disclosure range with respect to the disclosure range information of the server device,
In the user terminal of the group, the labeling processing unit gives the document file information on a label selected by the user,
Label information given to the document file is also given to the fragment by the fragmentation,
When the group information processing system having a fragment of the document file restores the document file from the fragment, the information processing system accesses the server device to obtain the request information including the label information attached to the fragment. Send
The check unit of the server device determines whether the ID, domain, or IP address of the access source group in the request information is included in the disclosure range associated with the label of the document file based on the management information. A data management system using secret sharing, characterized by determining. The data management system by secret sharing according to claim 2,
The server device has a labeling management unit that provides a service for managing information on labels used in the group for each user terminal of the group,
The user terminal of the group has a labeling processing unit that performs processing for accessing the labeling management unit of the server device and using the information of the label,
In the user terminal of the group, the labeling processing unit gives the document file information on a label selected by the user,
In the terminal of the user of the group, the disclosure range granting unit performs a process of assigning the disclosure range information in a group unit designated by the user to the label information given to the document file,
The label and disclosure range information given to the document file is also given to the fragment by the fragmentation,
When the information processing system of the group having the fragment of the document file restores the document file from the fragment, the information processing system accesses the server device and includes the label attached to the fragment and information on the disclosure range. Send information about
The check unit of the server device determines whether the ID, domain, or IP address of the access source group in the request information is included in the disclosure range associated with the label of the document file based on the management information. A data management system using secret sharing, characterized by determining. In the data management system by secret sharing as described in any one of Claims 1-4,
The secret sharing processing unit of the user terminal of the group, when fragmenting the document file, sends a fragmentation request to the secret sharing management unit of the server device,
In response to the fragmentation request, the secret sharing management unit of the server device forms a plurality of fragment sets including restoration information from the document file by processing the fragmentation function. Are distributed and stored in a plurality of secret sharing servers on the network, and some fragments are held in the terminals of the users of the group,
The secret sharing processing unit of the user terminal of the group, when restoring the document file from the partial fragment, transmits a restoration request to the secret sharing management unit of the server device,
In response to the restoration request, the secret sharing management unit of the server device collects the plurality of fragments from the plurality of secret sharing servers by processing the restoration function according to the processing result of the check unit. A data management system based on secret sharing, wherein the document file is restored from the set, and the restored document file is transmitted to a user terminal of the group. In the data management system by secret sharing as described in any one of Claims 1-4,
The secret sharing processing unit of the terminal of the user of the group forms a set of a plurality of fragments including the restoration information from the document file by the processing of the fragmentation function, and among the plurality of fragments on the network Distributing and storing in a plurality of secret sharing servers, holding some fragments on the terminal of the user of the group,
The secret sharing processing unit of the terminal of the user of the group accesses the server device when restoring the document file from the partial fragment, and includes the label and the disclosure range information given to the fragment. Sending the request information;
The check unit of the server device determines the disclosure range for the request information, transmits the processing result to the user terminal of the group,
The terminal of the user of the group collects the plurality of fragments from the plurality of secret sharing servers and restores the document file from the set by processing of the restoration function according to the processing result. A data management system based on secret sharing. In the data management system by secret sharing as described in any one of Claims 1-5,
The terminal of the first user of the first group acquires and holds the first fragment for the first document file by the fragmentation function by the secret sharing service process,
Providing the first fragment by any means, with the terminal of the first user of the first group as the provider and the terminal of the second user of the second group as the provider,
The terminal of the second user of the second group retrieves the first document file from the first fragment according to the processing result of the check unit by the restoration function by the secret sharing service processing. A data management system using secret sharing, characterized by acquiring. The data management system by secret sharing according to claim 5,
Based on the secret sharing service process between the secret sharing processing unit of the user terminal of the group and the secret sharing management unit of the server apparatus, the document file is moved or stored in a specific folder on the user terminal. When an operation is performed, the fragmentation is automatically performed on the document file to hold the fragment, and the fragment is selectively executed or opened in the specific folder, or moved to another folder. A data management system based on secret sharing, which, when operated, automatically executes the restoration to obtain a document file. In the data management system by secret sharing according to claim 6,
Based on the secret sharing service processing by the secret sharing processing unit of the user terminal of the group, when the document file is moved or saved to a specific folder on the user terminal, the document file is automatically targeted The fragmentation is executed to hold the fragment, and when the fragment is selected, executed, opened, or moved to another folder in the specific folder, the restoration is automatically executed. A data management system using secret sharing, characterized in that a document file is acquired. The data management system by secret sharing according to claim 3 or 4,
Based on the label assignment processing between the labeling processing unit of the user terminal of the group and the labeling management unit of the server device, a specific label is attached to the document file at the user terminal, or A data management system based on secret sharing, wherein when a storage operation of a document file to which the label is attached is performed, the fragmentation is automatically performed on the document file to hold the fragment. The data management system by secret sharing according to claim 3 or 4,
A function of performing processing for setting template information including definition information of the label to be usable in the group with respect to management information of the server device from a terminal of a user of the group;
A terminal of a user of the group has a function of acquiring information of the template from the server device;
The labeling processing unit of the user terminal of the group, based on the information of the template to be applied, gives the document file information of the type of the label selected by the user from the display information on the screen A data management system using secret sharing, characterized by The data management system by secret sharing according to claim 3 or 4,
A function of performing processing for setting the group information with respect to the management information of the server device from the terminal of the user of the group;
As the group information, as the group unit, a unit of an information processing system of a company including a plurality of user terminals, a unit of a group of arbitrary users of the companies, and between companies over a group of companies A data management system based on secret sharing, characterized in that both a unit of a group and a unit consisting of a group of a plurality of arbitrary users over a group of a plurality of companies can be set.

Images