JP2019215903A - Management apparatus and processing apparatus - Google Patents

Abstract

To prevent that a document is processed by a processing apparatus that does not satisfy reference, in a system for processing the documents by the processing apparatus in individual local networks.SOLUTION: A processing apparatus periodically notifies a management server of own status. The management server compares a value of an item related to system security among statuses received from the processing apparatus with references (S102). If there is an item that does not satisfy the reference and the item is an urgent item, the management server installs setting information for the item (for example, the latest version of encryption software or security certificate) to the processing apparatus via a network (S112) so as to make the processing apparatus in an appropriate state for the item. Also, if the item other than the urgent item does not satisfy the reference, a warning is sent to the processing apparatus so as to request a maintenance operator to correct the setting of the item (S114).SELECTED DRAWING: Figure 17

Description

  The present invention relates to a management device and a processing device.

  Electronic documents have a higher risk of unauthorized copying and disclosure than paper documents. Therefore, a system for protecting an electronic document from leakage or the like has been proposed.

  For example, Patent Literature 1 discloses a system in which output data can be viewed only by those who are permitted to view the data. In this system, when an information processing apparatus is instructed to output a document to an information display device, the information processing apparatus generates document image data representing an image of the document. The information processing device acquires the user name of the information display device from the information display device, and displays the acquired user name. When the user name of a user who is permitted to view the document is selected, the selected user name is added to the document image data, and the document image data is output to the information display device. The information display device displays a list of file names of document image data to which the user name of the logged-in user has been added. When the user selects a file name of a file to be viewed from the file name list, the information display device displays a document image according to the document image data of the selected file name.

  Patent Literature 2 discloses an information processing apparatus and an image processing method for automatically previewing received image data.

  Patent Literature 3 discloses an image forming apparatus that aims to output electronic data to both electronic paper and paper by a simple operation.

  The system disclosed in Patent Document 4 first receives a request for a document together with unique user identification information from a plurality of users each having a computer having a display device or a printer. Next, the requests from the plurality of users are authenticated by the copyright server. Next, the copyright server instructs the document server to affect the correct authentication of each request. In response, the document server creates a uniquely encoded, compressed and encrypted document for each authenticated request and authenticates the document to each authenticated requesting user over the network. To the corresponding display or print agent for each requested user. The document is uniquely encoded for each of a plurality of users. Finally, each agent decrypts and decompresses the document, making the document available only in response to the correct private key provided to the agent by the authenticated requesting user.

Patent No. 4930121 JP-A-2003-283741 JP 2010-139848 A JP-A-7-239828

  To process the input document, a corresponding processing load is applied. When deploying document processing services on a large scale via the Internet, etc., adopting a configuration in which document processing is performed centrally on a central server, processing can be performed due to concentration of processing load on the central server or network congestion. Response becomes worse.

  On the other hand, if a processing device for processing a document is provided in each local network such as an office of each customer, such a problem of processing response can be avoided. However, in this case, the quality of the processing provided by the processing device provided in each local network becomes a problem. For example, it is not preferable in terms of service quality that a document processed by a processing device for which a necessary update has not been performed is distributed.

  SUMMARY OF THE INVENTION It is an object of the present invention to prevent a document from being processed by a processing device that does not satisfy a criterion in a system that provides a service for processing a document by a processing device in each local network.

  The invention according to claim 1 is a processing device provided in each local network, wherein the document management system is configured with a plurality of processing devices that execute processing on an input document using an encryption key, A management device provided on an external network connected to each of the local networks, and from the processing device, a status of a hardware circuit built in the processing device, wherein the information about the encryption key is The management device includes a receiving unit that receives a status, which is independent information, and a control unit that controls whether to permit the processing device to execute the process based on the status.

  The management device according to claim 1, wherein the management device according to claim 1, further comprising a transmission unit configured to transmit setting information about a specific item of the status of the processing device to the processing device to add or update the setting information. It is.

  The invention according to claim 3, wherein the setting information transmitted by the transmission unit to the processing device is a security certificate used by the processing device for communication with another device. Management device.

  The invention according to claim 4 is the management device according to claim 2, wherein the setting information transmitted by the transmission unit to the processing device is the encryption key used by the processing device.

  The invention according to claim 5 is the management apparatus according to claim 2, wherein the setting information transmitted by the transmission unit to the processing device is an updated program for the processing.

  The invention according to claim 6 is a processing device provided in each local network, comprising a document management system together with a plurality of processing devices that execute processing on an input document, and connected to each of the local networks. And a status of a hardware circuit built in the processing device, wherein at least one of a name and a version of the hardware circuit is provided from the processing device. The management device includes a receiving unit that receives a status, which is information including the information, and an output unit that outputs information indicating whether to permit the execution of the process to the processing device based on the status.

  The invention according to claim 7 is a processing device provided in a local network, the processing device constituting a document management system together with a management device provided in an external network connected to the local network, Means for performing processing on the document using the encryption key, and a status of a hardware circuit incorporated in the processing device, the status being information independent of information on the encryption key. Means for transmitting to the apparatus, and control means for controlling the processing means to perform the processing on the input document when there is permission from the management apparatus according to the status transmitted to the management apparatus. And a processing device including:

  The invention according to claim 8 is a processing device provided on a local network, which constitutes a document management system together with a management device provided on an external network connected to the local network. Processing means for performing processing on the received document using an encryption key, and information on a status of a hardware circuit built in the processing device, the information including at least one of a name and a version of the hardware circuit. Means for transmitting a certain status to the management device; and performing the process on the input document with respect to the processing means when there is permission from the management device according to the status transmitted to the management device. And a control means for performing such control.

  According to the first and fifth aspects of the present invention, in a system for providing a service for processing a document by a processing device provided in each local network, it is assumed that a document is processed by a processing device that does not satisfy a standard. Can be prevented.

  According to the invention according to claim 2-4, for a specific item that is important to the quality of the document, the corresponding setting information is transmitted from the management device to the processing device, so that the update is performed immediately. Can be.

FIG. 1 is a diagram illustrating an example of a configuration of a document management system. FIG. 2 is a diagram for describing an outline of distribution and browsing of a document using a document management system. FIG. 4 is a diagram illustrating an example of data content of metadata. FIG. 4 is a diagram illustrating data contents managed by a user ID server. FIG. 3 is a diagram illustrating data contents managed by a DID server. FIG. 4 is a diagram illustrating data contents managed by a processing device management server. FIG. 3 is a diagram illustrating a configuration of a processing device and data contents of the processing device. FIG. 3 is a diagram illustrating a flow of document distribution and browsing in the document management system. It is a figure showing the example of the input screen of attribute data. It is a figure showing an example of an option setting screen. It is a figure showing an example of a list screen. It is a figure showing the example of the system composition provided with the organization management system. FIG. 9 is a diagram illustrating an example of a processing flow when a user obtains and browses metadata of a document using a processing device to which the user is not registered. FIG. 11 is a diagram illustrating an example of a processing flow when a user registers a document in a document management system using a processing device that is not registered by the user. It is a figure showing an example of data contents of DID. FIG. 13 is a diagram illustrating a flow of a status check process of a processing device executed by the processing device management server. FIG. 14 is a diagram illustrating another example of the flow of the status check processing of the processing device executed by the processing device management server. FIG. 9 is a diagram illustrating an example of a processing flow of a processing device when a vulnerability is found in encryption software.

  FIG. 1 shows a schematic configuration of one embodiment of a document management system.

  In the case of a paper document, the person holding the document can freely copy or hand it to another person. Also, those who have obtained the document can read the document. Thus, paper documents have an extremely high risk of information leakage.

  On the other hand, the document management system according to the present embodiment aims to provide an environment in which electronic documents can be used securely and reduce the risk of information leakage of the documents. Here, the document is content data that can be distributed as one unit (for example, one file), and the type of data is not particularly limited. For example, the concept of a document includes text data, document data created by word processing software, spreadsheet data created by spreadsheet software, CAD (Computer Aided Design) data, image data, video data, audio data, multimedia This includes data, page data displayed on a web browser, and other data created, edited, and viewed on a PC and subjected to printout.

  The document management system includes a plurality of local systems 100 and a management system 200 that manages the local systems (particularly, a processing system described later). The management system 200 can communicate with each local system 100 via the wide area network 10 such as the Internet.

  The local system 100 includes one or more creating terminals 102, one or more viewing terminals 104, and a processing device 110 connected to a local network 108. The local network 108 is a private network (for example, configured as a LAN) provided in an organization such as a company, and is protected from the wide area network 10 by a firewall or the like. Basically, one processing device 110 is installed in the local system 100. When the private network in the organization is large, each network segment constituting the private network may be a local system 100, and one processing device 110 may be installed in each local system 100. . For example, a network segment in a room for each department of a certain company becomes the local system 100 of that department, and one processing device 110 is installed in that segment. In this example, a local system 100 having a processing device 110 as a core is formed for each company or each department of each company, and the processing devices 110 are managed by a central management system 200.

  The creation terminal 102 is a terminal used for creating a document, for example, a desktop or notebook personal computer, a workstation, a tablet terminal, a smartphone, a multifunction device, a scanner, a facsimile device, a digital camera, and the like. is there. An application for creating and editing documents is installed in the creating terminal 102. Also, software for requesting the document management system to distribute the created document is installed in the creation terminal 102. As a form of this software, it is conceivable that the software is implemented as a device driver that exchanges information with the processing device 110 described later, or is implemented by a Web application.

  The processing device 110 converts the document created by the creating terminal 102 into a protected document (hereinafter, also referred to as an “eDoc file”) that is used in a secure environment provided by the document management system of the present embodiment. Perform protection processing. The protection process can be said to be a process of encoding an original document into an eDoc, and in this sense, the processing device 110 is a kind of encoder. In this protection processing, the document is converted into, for example, data in a special format designed for the system of the present embodiment, and is encrypted in a form that can be decrypted only by the user specified as the distribution destination of the document. . Either format conversion or encryption may be performed first.

  Further, the processing device 110 creates metadata of the protected document, and registers the created metadata in the management system 200 which is a higher-level system. The metadata includes bibliographic information of the protected document, information on a distribution destination, information on a key used by each distribution destination to decrypt the protected document, and the like. The metadata includes a plurality of items, and data is assigned, edited, and updated by a corresponding device or user according to a function provided by this service.

  As an example, some of these items are specified by the user who has issued a document registration instruction to the document management system, and another part is created by the processing device 110. Further, the values of some items of the metadata may be set by the management system 200 or the browsing terminal 104. Further, the processing device 110 transmits the generated protected document (eDoc file) to the viewing terminal 104 of the distribution destination specified by the user.

  The protected document, that is, the eDoc file is obtained by converting the original document into a dedicated format and encrypting it, and is also referred to as the main body of eDoc. To be able to view an eDoc file, corresponding metadata is required. Together, the eDoc file and the metadata make up a complete protected document that can be viewed. The set of the eDoc file and the metadata corresponding to the eDoc file is hereinafter referred to as “eDoc”.

  The processing device 110 may have a function of a wireless LAN access point. In this case, the viewing terminal 104 can communicate with the processing device 110 via the wireless LAN.

  The viewing terminal 104 is a terminal used for viewing a protected document (eDoc file). Here, “browsing” means that the protected document is used in a form corresponding to the information content represented by the document. For example, when the protected document has a document such as a word processing data or a drawing as information content, the browsing is to read or view the document displayed by the browsing terminal 104. When the information content represented by the protected document is audio, browsing means that the user listens to the audio reproduced by the browsing terminal 104. The browsing terminal 104 is configured by installing a viewer application for browsing a protected document on a general-purpose computer such as a desktop or notebook personal computer, a workstation, a tablet terminal, and a smartphone. Alternatively, a terminal dedicated to browsing, such as an electronic book terminal, having the same function as the viewer application may be used as the browsing terminal 104. The viewer application has a function of decrypting an encrypted protected document using information of metadata, and a function of decoding data represented in a dedicated format of the protected document into readable data. Note that a computer without a viewer application corresponding to the document management system of the present embodiment cannot decode data in a dedicated format into readable data.

  The browsing terminal 104 may have a function of receiving processing (editing) from the user on the displayed document in addition to the function of decrypting and decoding the protected document and displaying the document. Although the processed document has a different content from the original protected document, the edited document can be sent from the viewing terminal 104 to the processing device 110 and registered in the document management system (that is, encoded into a protected document). You may do so. Thus, one terminal may have the functions of both the creation terminal 102 and the browsing terminal 104. In addition, the authority (access authority information in metadata described later) permitted to the viewer is set in the eDoc, and the contents of the authority include restrictions on writing to the eDoc, restrictions on the redistribution destination, and the like. It may be. In the case of an eDoc defined in the access authority information, such a restriction is accepted by the viewing terminal 104 only for a processing (editing) operation from the viewer within the range of the writing restriction, and for a new eDoc after the processing. The specification of the redistribution destination is accepted only within the limit of the redistribution destination.

  In the embodiment, as an example, the authentication device 130 carried by the user is used as a tool for authenticating the user who uses the document management system of the embodiment. The authentication device 130 is a device, such as an IC card, that incorporates identification information unique to a user who carries the device and executes data processing for user authentication in response to a request from an external device. The authentication device 130 may be a mobile terminal such as a smart phone having a function equivalent to such an IC card for personal authentication. The viewing terminal 104 and the creation terminal 102 have a function of communicating with the authentication device 130 using a wireless communication protocol such as NFC (Near Field Communication). The browsing terminal 104 and the creation terminal 102 exchange information for user authentication with the authentication device 130 according to a predetermined protocol, and authenticate the user who carries the authentication device 130. Alternatively, the actual user authentication is executed by the server side of the document management system of the present embodiment, such as the processing device 110 or the management system 200, and the browsing terminal 104 and the creation terminal 102 transfer data between the server side and the authentication device 130. May be used as a system for mediation. Also, the browsing terminal 104 and the creation terminal 102 may have the function of the authentication device 130 built-in.

  The management system 200 manages the processing devices 110 in each local system 100. The management system 200 manages the metadata of the protected document generated by each of the processing devices 110, and provides the metadata to the browsing terminal 104 in response to a request. The management system 200 includes one computer or a plurality of computers that can communicate with each other, and has functions of a user ID server 210, a DID server 220, a metadata server 230, and a processing device management server 240.

  The user ID server 210 is a server that manages information of each user who uses the document management system. A user who uses the document management system has two layers. One is a contractor who has concluded a contract for using the document management system with the operator of this system, and the other is to register and browse documents using the system under the contract. General user. For example, it is assumed that a company is a contractor, and a processing device 110 is installed in the local network 108 of the company, and employees of the company often use the document management system via the processing device 110 as general users. Is done. The user ID server 210 holds and manages information on each of the contractor and the general user.

  The DID server 220 manages DID (document ID) which is identification information (ID) of the protected document. The processing device 110 that has created the protected document actually assigns the DID to the protected document, but the DID server 220 assigns the DID issuing authority and the issuance limit (number of issuances) to the processing device 110. , And receives and records the report of the DID actually issued by the processing device 110 in the issuance authority and the issuance frame. As a result, the DID server 220 suppresses the occurrence of an illegal DID and makes it possible to detect a document having an illegal DID.

  The metadata server 230 holds and manages the metadata of the protected document (eDoc file) generated by the processing device 110. When a user requests metadata of a protected document from the user via the browsing terminal 104, the metadata server 230 provides the metadata to the browsing terminal 104 if the user is a valid person. It should be noted that a user (browser) who requests metadata is “a legitimate person” for the metadata server 230 when a combination of the user and the browsing terminal 104 used when the user issues the request is described. , The delivery destination user and delivery destination indicated in the delivery destination information (which will be described in detail later) in the metadata held by the metadata server 230 in association with the DID of the eDoc file (this is included in the request). This is the case where the combination corresponds to the combination of the viewing terminals 104.

  The processing device management server 240 is a server that manages the status (state) of each processing device 110.

  With reference to FIG. 2, the mechanism of the present embodiment will be schematically described.

  (0) The management system 200 (DID server 220) previously assigns an issuance right of DID (document ID) and an issuance frame (number of documents) accompanying the right to issue to the processing device 110 in the local system 100. . The right to issue the DID is not limited and is limited to the issuance limit of the management system 200. That is, the processing device 110 can assign a DID based on the issuance right granted at the same time as long as the documents are up to the number indicated by the issuance space assigned from the management system 200. When the issue slots are used up, the processing device 110 receives a new issue right and a new issue slot from the management system 200.

  (1) When the user wants to register a document in the document management system of the present embodiment (that is, to distribute the document), the user instructs the creation terminal 102 to register the document (for example, instructs “registration” on a menu of the application). The creating terminal 102 receiving this instruction requests user authentication. This authentication may be performed by inputting a user ID and a password, or may be performed by the user bringing the authentication device 130 close to the vicinity of the card reader unit of the creation terminal 102. The user authentication may be performed by the creation terminal 102 or the processing device 110 to which the document is registered. Then, the user selects a document to be registered in the document management system from the documents held in the creation terminal 102 and instructs the registration.

  When receiving a document registration instruction from a user, the creation terminal 102 (more specifically, a registration processing program installed in the creation terminal 102) specifies items (for example, document Of the distribution destination). Here, the designation of the combination of the user and the viewing terminal 104 may be accepted as the distribution destination. In this case, when the combination of the user and the browsing terminal 104 used by the user for browsing the document matches the combination specified as the distribution destination, the user can browse the document.

  The creation terminal 102 converts the attribute data such as the distribution destination input by the user and other attribute items (for example, registrant information, creation date and time) generated by the creation terminal 102 itself into data of the document. With the processing device 110. Note that the creation terminal 102 may have a driver that converts documents in various formats created by various applications into a unified format that can be handled by the viewing terminal 104. For example, in the case of data indicating a static document image such as word processing data, spreadsheet, or CAD data, the driver converts the data into a document described in a page description language, similar to a printer driver. Further, for example, when the original data is audio data, the driver converts the audio data into data (document) in a specific audio data format supported by the document management system (particularly, the browsing terminal 104) of the present embodiment. .

  (2) The processing device 110 generates a protected document (eDoc file) by performing protection processing on the document to be registered received from the creation terminal 102. In this generation, an eDoc file is generated by encoding a received document into a dedicated format of the document management system of the present embodiment and encrypting the encoded data using the generated encryption key. The order of encoding and encryption may be reversed. Further, the processing device 110 assigns a unique DID to the eDoc. This DID includes information (issuance authority key described later) that proves that the DID is based on the issuance authority received from the management system 200, and information (issuance described later) that proves that the DID is assigned by the processing apparatus 110 itself. Certification key). A detailed example of the data structure of the DID will be described later. The generated DID is embedded in the eDoc file (for example, as one item of the property of the file).

  Further, the processing device 110 generates metadata corresponding to the generated eDoc file. The metadata includes attribute data received together with the document from the creation terminal 102 and values of attribute items (for example, DID, ID of the processing device itself, encoding date and time, and encryption key information) generated by the processing device 110 itself. included. The encryption key information included in the metadata is information indicating a key for decrypting the eDoc file. When a common key method is used for encryption, the encryption key information is information indicating the common key. However, if the common key itself is included in the metadata in plain text, there is a concern that it will be misused by eavesdropping or eavesdropping. Therefore, the common key encrypted with the public key of the distribution destination user is embedded in the metadata as encryption key information. .

  Further, the processing device 110 saves the generated eDoc file and metadata in a built-in database.

  (3) The processing device 110 transmits the generated metadata to the management system 200 and registers it. The management system 200 (metadata server 230) stores the received metadata.

  (4) The processing device 110 distributes the generated eDoc file to the viewing terminal 104 specified as the distribution destination. This distribution may be a push type or a pull type, or both of them (for example, push distribution at the time of eDoc creation, and the browsing terminal 104 that is not operating and does not receive at that time receives the distribution in a pull type). This distribution is performed via the local network 108 in the local system 100.

  (5) The eDoc file received by the viewing terminal 104 cannot be viewed as it is because it is protected by encryption or the like. When the user wants to browse the eDoc file with the browsing terminal 104, the user is authenticated by bringing his / her authentication device 130 close to the card reader unit of the browsing terminal 104, and then browses the eDoc on the screen of the browsing terminal 104. Instruct. The browsing terminal 104 that has received this instruction accesses the management system 200 and requests the metadata of the eDoc. The request includes the DID of the eDoc.

  (6) The management system 200 (metadata server 230) transmits the latest metadata of the eDoc requested from the viewing terminal 104 to the viewing terminal 104.

  (7) When the browsing terminal 104 receives the requested metadata from the management system 200, the distribution destination information included in the metadata includes the browsing terminal 104 and the user (authentication device) currently using the browsing terminal 104 in the distribution destination information. It is determined whether or not the combination with (authenticated in 130) is included. If not included, the user does not have the right to view the eDoc on the viewing terminal 104, so the viewing terminal 104 does not open the eDoc file and displays an error message indicating that there is no viewing right. If so, the user has permission to view the eDoc file at the viewing terminal 104. In this case, the browsing terminal 104 decrypts the eDoc file using the encryption key information included in the metadata and displays the decrypted eDoc file on the screen (that is, outputs the eDoc file in a form corresponding to the information content of the eDoc file).

  An expiration date can be set for the metadata. The expiration date is obtained, for example, by adding a prescribed expiration period or a expiration period designated by a distributor or the like to the date and time when the metadata is transmitted. After the expiration date of the metadata has passed, the viewing terminal 104 cannot open (decrypt and display) the corresponding eDoc file unless the metadata is acquired again from the management system 200. If the browsing terminal 104 can communicate with the processing device 110 or the management system 200, the browsing terminal 104 acquires the latest metadata of the eDoc file designated as the browsing target at the time of the designation from the processing device 110 or the management system 200, It is determined whether browsing is possible based on the latest metadata.

  After the metadata is registered in the management system 200 for the first time, the distribution destination information and the access right information included in the meta data are distributed by a distributor or a person authorized to change the distribution destination (for example, a user who has a data editing right). May change. Even if the user is designated as the distribution destination when the eDoc is created and registered, if the user is removed from the distribution destination due to a subsequent change, the browsing terminal 104 uses the latest metadata acquired from the management system 200. Is detected by the distribution destination information included in the eDoc file, and the eDoc file is not displayed.

  Next, an example of the data content of the eDoc metadata 300 will be described with reference to FIG.

  Of the items included in the metadata 300, “DID” is a document ID assigned by the processing device 110 that has generated the eDoc. “Document name” is the name or title of the eDoc.

  The “distributor ID” is a person who has distributed the eDoc, that is, a person who performs a document registration operation from the creation terminal 102 to the processing device 110 and distributes the document via the processing device 110 (hereinafter, referred to as a distributor). User ID.

  The “encoding date and time” is the date and time when the document from the creating terminal 102 was encoded (protected) and its eDoc was created. “Processing device ID” is identification information of the processing device that has executed the protection process. The “encryption information” is information on encryption at the time of generation of the eDoc, and includes the name of the encryption software used for encryption, the version of the encryption software, and the key for releasing (decrypting) the encryption. Is included. The key information is, for example, information obtained by encrypting a key for decryption with the public key of each distribution destination user. “Keyword information” is a list of keywords extracted from the eDoc (or original data). This keyword information is used, for example, when searching for eDocs.

  “Distribution destination information” is information indicating the user and the viewing terminal designated by the distributor as the distribution destination of the eDoc. In the example of FIG. 3, the distribution destination information includes, for each distribution destination user, the user ID of the user and the ID (identification information) of the browsing terminal 104 that the user should use for browsing. When the user specifies a plurality of browsing terminals 104 that can be used for browsing the eDoc, a set of the user ID of the user and the IDs of the plurality of browsing terminals 104 is incorporated in the distribution destination information.

  As another example, when a method is adopted in which the distribution destination user can browse the eDoc using any of the browsing terminals 104 designated as the distribution destination, the distribution destination information includes the distribution destination user. And a list of IDs of the distribution destination viewing terminals 104 are included. For example, as a candidate of the distribution destination viewing terminal 104, a shared terminal of a department, a terminal provided in a room or a conference room of the department, or the like may be assumed. It is not decided who the users in the organization will use, such as shared terminals and equipment installed in rooms (also a type of shared terminal), but the distributor knows at least what kind of terminal it is, It is also known that it is unlikely that the document will be taken out of the organization without permission, so it is suitable as a distribution destination of a confidential document. In the case of using eDocs with a shared terminal whose characteristics are known in this way, a use form in which the distribution destination user may use any of the browsing terminals 104 designated as the distribution destination is considered. Can be

  The “access right information” is information indicating the use right for the eDoc that the distributor has given to the destination user.

  “Offline validity period” is information indicating the length of the validity period of the metadata. That is, even when the browsing terminal 104 cannot access the management system 200 (offline state), the metadata acquired and cached at the time of the previous browsing of the eDoc exists, and the metadata is acquired from the date and time of acquiring the metadata. If it is within the “offline validity period”, the browsing terminal 104 decrypts and displays the eDoc using the encryption key information in the metadata. On the other hand, if the offline valid period of the cached metadata for the eDoc for which browsing has been instructed has already passed, the browsing terminal 104 does not decrypt the eDoc and therefore does not display it. When the user instructs browsing of an eDoc while the management terminal 200 is accessible (that is, online), the browsing terminal 104 transmits the latest metadata of the eDoc to the management system 200 (particularly, the metadata server 230). ).

  The “original data information” is information indicating whether or not the original data before the eDoc is generated (encoded) is stored, and if stored, information indicating the storage location of the original data (for example, URL: Uniform Resource Locator). The original data here is, for example, a document (before the protection processing is performed) sent from the creating terminal 102 to the processing device 110, or application data on which the document is based (for example, the document is page description language data. In this case, the data is data of a word processing software before being converted into the data), or both.

  The “document acquisition date and time” is the date and time when the browsing terminal 104 acquires the file of the body data of the eDoc (that is, the eDoc file). The “metadata acquisition date and time” is the date and time when the browsing terminal 104 acquired the latest metadata currently cached for the eDoc from the management system 200. The document acquisition date and time and the metadata acquisition date and time are not included in the metadata held in the management system 200, but are added by the viewing terminal 104 to the metadata acquired from the management system 200 for management by the own device. .

  In the metadata items shown in FIG. 3, DID, encoding date and time, processing device ID, encryption information, and keyword information are information generated by the processing device 110. Further, the document name, distributor ID, distribution destination information, access authority information, offline validity period, and original data information are derived from documents and attribute data sent from the creation terminal 102 to the processing device 110.

  Next, data contents of information managed by each of the servers 210 to 240 of the management system 200 will be exemplified.

  First, an example of data content managed by the user ID server 210 will be described with reference to FIG. In the user ID server 210, contractor data 212 of each contractor and user data 214 of each general user are registered.

  The contractor data 212 includes a contractor ID, contract content information, and a user list. The contractor ID is identification information of a contractor (for example, an organization or a department within the organization) that has contracted with the operator of the document management system. The user list is a list of user IDs of general users (for example, members belonging to an organization that is a contractor) who use the document management system according to the contract of the contractor.

  The general user data 214 includes the general user's user ID, password, user ID key information, public key certificate, predetermined processing device ID, predetermined viewing terminal list, and affiliation information. The user ID key information is authentication information of the user used by the authentication device 130 of the user. The public key certificate is a digital certificate that certifies the user's public key. The default processing device ID is the ID of the processing device 110 in which the user is registered. Usually, a user is registered in a processing device 110 located in the office to which the user belongs, and the processing device 110 is a default processing device for the user. The default browsing terminal list is a list of IDs of one or more browsing terminals mainly used by the user. The browsing terminals included in this list are candidates for distribution destination terminals when eDocs are distributed to the user. The affiliation information is information for specifying an organization to which the user belongs, a department thereof, and the like, and is, for example, a contractor ID of the organization or the department.

  Next, an example of data contents managed by the DID server 220 will be described with reference to FIG.

  As shown in FIG. 5, the DID server 220 issues, for each issue authority key issued to the processing device, information on the issue frame, the assignee processing device, the key assignment date and time, the key end date and time, and the items of the issued DID list. Holding.

  The issuance authority key is key information (for example, a randomly generated character string) that is provided by the DID server 220 to the processing device 110 and certifies the DID issuance authority. The processing device 110 certifies that the DID has been issued under valid issuing authority by including the issuing authority key assigned from the DID server 220 in the DID issued by itself.

  The issuance frame is the upper limit of the number of DIDs issued to the processing device 110 together with the issuance authority key (the upper limit of the number of documents that can be assigned a DID). When the pair of the issuing authority key and the issuing slot is assigned from the DID server 220, the processing device 110 can assign a unique DID to each of the eDocs up to the upper limit indicated by the issuing slot.

  The grant destination processing device indicates the ID of the grant destination processing device 110 of the issuing authority key (and the issuing frame). The key assignment date and time is the date and time when the issuing authority key was assigned to the processing device 110. The key end date and time is the date and time when the granting processing device 110 has finished using the issuing authority key. In other words, it is the date and time when the processing device 110 has finished giving DIDs to the upper limit number of eDocs indicated by the issuance space assigned together with the issuance authority key. When the processing device 110 employs a mechanism for requesting the DID server 220 for the next issuance key and the next issuance key after the issuance slot has been used up, the key end of a certain issuance authority key (referred to as a first key) is terminated. Instead of explicitly recording the date and time, the key assignment date and time of the issue authority key assigned to the processing device 110 after the issue authority key may be used as the key end date and time of the first key. The issued DID list is a list of DIDs issued by the assigning processing device 110 using the issuance authority key and the issuance date. Each time the assigning processing apparatus 110 issues a DID using the issuing authority key, the DID server 220 notifies the DID server 220 of the issued DID, and the DID server 220 includes the notified DID and the issue date in the DID. Is added to the issued DID list corresponding to the issuing authority key to be issued.

  The metadata server 230 stores the metadata of each eDoc sent from each processing device 110. The data content of the metadata to be stored is the same as that illustrated in FIG. However, among the metadata items illustrated in FIG. 3, items (document acquisition date and time, metadata acquisition date and time, etc.) used only by the browsing terminal 104 are not managed by the metadata server 230.

  Next, data managed by the processing device management server 240 will be described with reference to FIG. The processing device management server 240 stores the status history 242 of the processing device 110 for each processing device 110 to be managed. The status history includes information on the status 244 of the processing device 110 at the time of creation and individual update (creation / update date and time) in association with the ID of the processing device 110.

  The status 244 at each time includes the installation location, contractor ID, administrator name, administrator contact information, registered user list, software information 246, hardware information 248, free disk space, and security certificate information. It is. The installation location is information indicating the installation location of the processing device 110, and includes, for example, information such as an address, a building name, and the number of floors. The contractor ID is the ID of the contractor using the processing device 110. The administrator name is the name of the administrator of the processing device 110. The administrator is a user who manages the processing device 110 in a department or the like where the processing device 110 is installed. The administrator contact information is information on the contact information of the administrator (for example, an e-mail address). The registered user list is a list of user IDs of the users registered in the processing device 110 (in other words, the users who set the processing device 110 as the “default processing device”).

  The software information 246 includes an encoding software name, an encoding software version, an encryption software name, an encryption software version, and names and versions of other software installed in the processing device 110. Here, the encoding software is software that converts (encodes) a document input from the creation terminal 102 into a format dedicated to the document management system. The encryption software is software for encrypting a document (for example, a document converted into a dedicated format).

  The hardware information 248 includes items such as encoding circuit information, an encoding circuit FW version, and a manufacturer name of the processing device 110. The encoding circuit information is information indicating a model of a hardware circuit used for the encoding process. The encoding circuit FW version is a firmware (FW) version of the encoding circuit.

  The disk free space is the free space of the secondary storage device such as a hard disk or a solid state disk of the processing device 110 at that time.

  The security certificate information includes information (for example, a subject (subject: subject) identifier, an issuer (issuer: issuer) identifier, and a date and time of issue) of each security certificate installed in the processing device 110 at that time. Etc.).

  Although not shown for the sake of simplicity, the status 244 includes the type of font (a list of font names) installed in the processing device 110, an address for network communication (for example, an IP address), and the like. Device ID of the secondary storage device (such as a hard disk drive), information indicating the contents of customization for connecting the processing device 110 to the core system of the installation organization, and an encryption key (communication path encryption) used by the processing device 110. And the date and time of installation of the signature).

  Next, a database group held by the processing device 110 will be described with reference to FIG. As illustrated, the processing device 110 includes a management information storage unit 112, a user DB 114, and a document DB 116.

  The management information storage unit 112 stores management information 112a. The management information 112a includes items such as upper device address information, a security certificate, an encryption key, an encoding software name, an encoding software version, an encryption software name, and an encryption software version. The higher-level device address information is information on each communication address (for example, an IP address, a URL, and the like) of the higher-level device that manages the processing device 110. The management system 200 and the respective servers 210 to 240 therein, or the in-house management system 150 described later and the respective servers 152 to 156 therein are examples of higher-level devices. The security certificate is a digital certificate used when the processing device 110 performs secure communication based on the public key infrastructure with another device on the network. The processing device 110 holds a security certificate of each higher-level device with which communication is frequently performed. Further, the security certificate of each user who uses the creation terminal 102 or the browsing terminal 104 may be held. The encryption key is used for purposes such as encryption and decryption when the processing device 110 communicates with another device on the network, a digital signature by the processing device 110 (or generation of certification information similar thereto), and the like. For example, a pair of a secret key and a public key given to the processing device 110 in a public key infrastructure. The encoding software and the encryption software are software (encoding to a special format) and encryption software installed in the processing device 110, respectively.

  The user DB 114 stores user information 114a of each user registered in the processing device 110 (in other words, a user who sets the processing device 110 as a “default processing device”). The user information 114a of each registered user includes items such as a user ID, a password, user ID key information, a public key certificate, and a predetermined viewing terminal list. These items have been described in the description of the data of the user ID server 210 (see FIG. 4).

  The document DB 116 stores an eDoc file generated by the processing device 110 and metadata corresponding to the eDoc file. Since the eDoc file and the metadata include DID information, they can be associated with each other. In the document DB 116, the original data before being encoded into the eDoc (the data received from the creating terminal 102) may be registered in association with the DID of the eDoc.

  The creation terminal 102 and the browsing terminal 104 provide, for each user who uses the terminal, authentication information (user ID, password, and the like) of the user, ID of a predetermined processing device, address information of a predetermined processing device, and a higher-level device (for example, It stores the address information of the management system 200 and the in-house management system 150 (described later), security certificates of processing devices and higher-level devices, encryption keys used for communication path encryption, and the like.

<System processing flow>
When the processing device 110 is installed on the local network 108, a maintenance worker who performs maintenance on the processing device 110 can provide the processing device 110 with information on the user who uses the processing device 110 and the information that the user can use The information of the creation terminal 102 and the browsing terminal 104 which have a possibility is registered. The registered user information is also transferred to the user ID server 210 (or a local user ID server 152 described later), which is a higher-level device, and registered. When the number of users who use the processing device 110 increases or decreases after the installation, the maintenance worker newly registers information of the increased user with respect to the processing device 110, or updates the information of the reduced user. Work to delete the registration of information. Such addition or deletion is also notified to a higher-level device such as the user ID server 210, and the information held by the higher-level device is updated accordingly. Further, the maintenance worker installs software (for example, in the form of a device driver of the processing device 110) for performing a process of requesting the processing device 110 to register and distribute a document to each of the creation terminals 102. In addition, the maintenance worker registers information (for example, a device name, a communication address, and wireless access settings) for communicating with the processing device 110 in each viewing terminal 104.

  Next, a flow of processing when a document is registered and distributed via the document management system of the present embodiment will be described with reference to FIG.

  (1) -1: When the user (distributor) instructs the creation terminal 102 to register a document, the creation terminal 102 inputs login authentication information (for example, a user ID and password or the authentication device 130). Display the screen you want. When the distributor inputs authentication information in response to the request, the creation terminal 102 transmits the authentication information to the processing device 110 via the local network 108.

  (1) -2: The processing device 110 that has received the login authentication information performs user authentication using the information. Here, it is assumed that the user authentication has succeeded (the user has been confirmed as a correct user). In the illustrated example, login authentication is performed using a login ID and a password. However, if the creation terminal 102 supports communication with the authentication device 130, login authentication may be performed using the authentication device 130.

  (2) -1: When the login authentication is successful, the user selects a document to be registered in the document management system (and to be distributed to another user) from the documents held in the creation terminal 102, and sends the document to the processing device 110. Instruct the registration of. Then, software (e.g., a device driver) serving as an interface with the processing device 110 starts, receives input of attribute data on the document from the user, and transmits the received attribute data and the data of the document to the processing device 110.

  FIG. 9 shows an example of the input screen 400 for the attribute data. The input screen 400 includes a distribution destination user selection menu 402, a distribution destination user list column 404, a distribution destination terminal selection menu 406, a distribution destination terminal list column 408, an access authority setting column 410, an offline valid period menu 412, and an option setting call. Button 414 is included.

  The distribution destination user selection menu 402 is a pull-down menu that lists options of distribution destination users of the document. The optional users are the users registered in the processing device 110, and a list of the IDs and user names of the optional users may be obtained from the processing device 110. Alternatively, the creation terminal 102 obtains a list of users from a local user ID server 152 (see FIG. 12) described later that manages information of users of the document management system belonging to the organization, and the distributor transmits the list to other users in the organization. The user registered in the processing device 110 may be selected as a distribution destination. In this case, in the distribution destination user selection menu 402, each user is displayed in a display form in which the processing device 110 in which each user is registered can be distinguished. For example, the user may be displayed in a different color or font for each processing device 110 with which the user is registered. Alternatively, the menu may have a hierarchical structure, in which a processing device 110 is first selected, a list of users registered in the processing device 110 is called, and a distribution destination user is selected from the list. A delivery destination user list field 404 displays a list of delivery destination users selected by the user. When the distributor selects a distribution destination user from the distribution destination user selection menu 402 and presses an “Add” button on the right side, the user ID or user name of the distribution destination user is added to the distribution destination user list field 404. When the distributor selects a distribution destination user in the distribution destination user list field 404 and presses a “Delete” button on the right side, the distribution destination user is deleted from the distribution destination user list field 404 (that is, the distribution destination user is no longer a distribution destination). ).

  The distribution destination terminal selection menu 406 is a pull-down menu that lists options of the viewing terminal (viewer) 104 as a distribution destination of the document. The viewing terminals 104 as options are registered in the processing device 110, and a list of IDs and terminal names of the viewing terminals 104 as options may be obtained from the processing device 110. Alternatively, the processing device 110 itself, the local user ID server 152 (see FIG. 12, see below for details), and the like have a list of the browsing terminals 104 in the organization registered in the document management system. The list may be presented to the distributor so that the browsing terminal 104 of the user registered in another processing device 110 in the organization can be selected as the distribution destination. As in the case of the distribution destination user list column 404, a list of distribution destination viewing terminals 104 selected by the distributor in the distribution destination terminal selection menu 406 is displayed in the distribution destination user list column 404.

  In addition, you may enable it to specify the browsing terminal 104 of the distribution destination corresponding to the user for every distribution destination user. For this purpose, for example, each time a distribution destination user is selected in the distribution destination user list field 404, the creation terminal 102 sends the user's default from the processing device 110 (or the local user ID server 152 or the user ID server 210). A list of viewing terminals may be obtained, and the list may be set in the distribution destination terminal selection menu 406. If the distributor does not explicitly select the distribution destination viewing terminal 104 for the distribution destination user, a specific one (for example, the top of the list) in the list of the user's default browsing terminal is automatically distributed. The selected terminal 104 is selected.

  The access right setting column 410 is a column for setting the access right (use right) of the distribution destination user to the document. In the illustrated example, check boxes for four authority items of browsing, processing (editing), printing, and copying are shown, and the distributor checks the check boxes of items permitted to the distribution destination user for the document. .

  The offline valid period menu 412 is a pull-down menu showing options for the length of the offline valid period set for the document. The distributor selects a period to be set for the document to be registered and distributed to the system this time from among several stages of the offline valid period shown in the offline valid period menu 412.

  When the option setting call button 414 is pressed, the creation terminal 102 displays an option setting screen 420 illustrated in FIG. The option setting screen 420 includes a processing device designation column 422 and an original data setting column 424. The processing device designation column 422 includes a pull-down menu showing options of the processing device 110 to which the document is to be transmitted. This menu includes a list of processing devices 110 that can be selected from the creation terminal 102. The processing devices 110 included in this list are first the processing devices 110 in the local system 100 to which the creation terminal 102 belongs (there is basically one, but there may be more than one). Further, the processing device 110 of another local system 100 in the same organization may be included in the list. In the original data setting column 424, a pull-down menu for accepting a selection as to whether the original data on which the eDoc is based is stored in the processing device 110 is displayed.

  The attribute data sent from the creation terminal 102 to the processing device 110 in step (2) -1 includes distribution destination information (user list and browsing terminal list), access authority information, Information such as an offline valid period and original data information is included.

  Returning to the description of FIG.

  (2) -2: The processing device 110 receives a document (called a target document) and attribute data from the creation terminal 102.

  (3) -1: If the processing device 110 has not received the DID issuing authority and the issuing frame (or has used up the received issuing frame), the processing device 110 issues a new issuing authority to the DID server 220 of the management system 200. And request an issue slot. If there is any remaining in the received issuance slot, the process proceeds to step (4) described later without making this request.

  (3) -2: In response to a request from the processing device 110, the DID server 220 transmits a new issuing authority and a new issuing frame to the processing device 110.

  (4) The processing device 110 issues a DID using the issuance authority assigned from the DID server 220, and assigns the DID to an eDoc (generated in the next step) generated from the target document.

  (5) -1: The processing device 110 generates an encryption key for encrypting the target document using, for example, a random number or the like. Further, the processing device 110 converts the target document into an eDoc file. In other words, the eDoc file is generated by encoding the target document into a special format of the document management system and encrypting the encoding result with the encryption key generated earlier. The generated eDoc file includes the information of the DID generated earlier.

  (5) -2: The processing device 110 generates metadata of the generated eDoc. That is, metadata is generated by adding the previously generated DID, encoding date and time, ID of the processing device 110, encryption information, and the like to the attribute data received from the creation terminal 102 (see FIG. 3). Here, the encryption information includes, for each distribution destination user, key information obtained by encrypting the encryption key used for encryption with the public key of the distribution destination user.

  (5) -3: When receiving an instruction to store the original data from the creation terminal 102, the processing device 110 saves the document received from the creation terminal 102 (or the application data from which the document is based). I do.

  (6) -1: The processing device 110 uploads the DID generated earlier to the DID server 220. The DID server 220 stores the DID uploaded from the processing device 110.

  (6) -2: The processing device 110 uploads the metadata generated earlier to the metadata server 230. The metadata server 230 stores the metadata uploaded from the processing device 110.

  (7) The processing device 110 transmits a distribution preparation completion notification for the eDoc to each viewing terminal 104 to which the generated eDoc is distributed. This notification includes information on the DID and the document name of the eDoc generated earlier. Also, this notification may include a thumbnail image of a representative page of the eDoc (a previously specified page such as the first page).

  Now, the user (referred to as a viewer) using the browsing terminal 104 receives user authentication by bringing his / her authentication device 130 close to the card reader unit of the browsing terminal 104. The browsing terminal 104 displays a list screen displaying a list of eDocs distributed to itself. FIG. 11 shows an example of this list screen 500. The list screen 500 in this example includes a notification mark 502, a document name 504 of the eDoc, and a browsability mark 506 for each eDoc. The notification mark 502 is a mark for notifying the viewer of the state of the eDoc. The state of the eDoc represented by the notification mark 502 includes “new arrival” (a state in which the document has not been opened after the document has been distributed from the processing device 110, which is indicated by a “☆” mark in the figure), and “normal” (no mark in the figure). ), “Expired” (access validity period has expired, indicated by “!” In the figure), and the like. Regarding the “expired” state, even if an eDoc file is stored in the browsing terminal 104, it cannot be browsed until the latest metadata about the eDoc is acquired from the processing device 110 or the management system 200. With respect to the eDoc in the “normal” state, since the metadata whose access validity period has not expired is stored (cached) in the browsing terminal 104, the browsing terminal 104 may temporarily store the metadata in the processing device 110 or the management system 200. Even if you are offline, you can browse. The browsing permission / prohibition mark 506 indicates that the combination of the browsing terminal 104 and the user using the same (authentication by the authentication device 130) indicates the distribution destination of the eDoc indicated in the metadata of the eDoc cached in the browsing terminal 104. It indicates whether the combination of the user and the viewing terminal 104 matches. If they match, the eDoc can be browsed (marked with “○” in the figure), and if they do not match, it cannot be browsed (marked with “x” in the figure). For eDocs that have received the distribution preparation completion notification but have not yet received the eDoc file and metadata, the browsing terminal 104 does not have information on the criteria for determining whether or not the eDocs match the combination of distribution destinations. The permission / inhibition mark 506 is a “-” mark indicating that the status is undecided. In the illustrated example, the three eDocs from the top are new arrivals, and the eDoc body (file and metadata) has not yet been acquired, so that the browsing permission / inhibition mark 506 is a mark indicating undecided.

  The viewer selects an eDoc he / she wants to view on the list screen (FIG. 11) by, for example, a touch operation or the like, and gives a viewing instruction. Here, it is assumed that the newly arrived eDoc (the notification mark 502 is a “☆” mark) is selected as the browsing target.

  (8) Return to the description of FIG. Since the viewing terminal 104 does not hold the selected viewing target eDoc file and metadata, it is necessary to obtain the eDoc file from the processing device 110. Therefore, the browsing terminal 104 sends the user ID key, which is the authentication information acquired from the authentication device 130 of the browsing user, to the processing device 110 on the local network 108 to which the browsing terminal 104 is connected. The information is transmitted to the processing device 110 on the network 108. The processing device 110 verifies whether the user ID key proves a user registered in the processing device 110 (user authentication). Here, it is assumed that the user authentication has succeeded. If the user ID key received from the viewing terminal 104 does not correspond to any of the users registered in the processing device 110, the processing device 110 assigns the user ID key to a higher-level device related to user authentication (user ID server 210). Alternatively, it may be sent to the local user ID server 152) to request user authentication.

  (9) -1: Further, in response to the successful user authentication in the processing device 110, the viewing terminal 104 sends a distribution request including the DID of the eDoc to be viewed selected by the viewer to the processing device 110.

  (9) -2: The processing device 110 returns an eDoc file and metadata corresponding to the DID included in the distribution request from the viewing terminal 104 to the viewing terminal 104.

  (10) The viewing terminal 104 receives and stores (caches) the eDoc file and the metadata transmitted from the processing device 110.

  (11) The browsing terminal 104 determines that the combination that matches the combination of itself and the browsing user who is currently using it is the distribution destination user and distribution destination indicated in the distribution destination information (see FIG. 3) in the metadata. It is determined whether it is in the terminal combination. If it is determined that there is no eDoc file, the browsing terminal 104 cannot browse the eDoc file. In this case, the browsing terminal 104 displays an error message indicating that browsing cannot be performed. In this case, the viewing terminal 104 may delete the stored eDoc file (and the corresponding metadata). On the other hand, if the browsing terminal 104 determines that the combination of the browsing terminal 104 and the viewer currently using the browsing terminal 104 is included in the distributor information in the metadata, the browsing terminal 104 requests the browsing user to view the eDoc. Allow In this case, the browsing terminal 104 extracts the key corresponding to the viewer from among the encrypted keys corresponding to the respective distribution destination users included in the encryption information in the metadata, and transfers the key to the secret of the viewer. The decryption key required for decrypting the eDoc file is restored by decrypting with the key (for example, this is held by the authentication device 130).

  (12) The browsing terminal 104 reproduces a browsable document by decrypting the eDoc file using the restored decryption key, and outputs the document (for example, screen display). The browsing terminal 104 controls whether to accept an operation instruction for the document from the browsing user according to the access authority information included in the metadata. The viewing terminal 104 does not basically store the decrypted document in a file. That is, after the browsing is completed, the eDoc file and the metadata are stored in the nonvolatile storage device of the browsing terminal 104, but the decrypted document is not stored.

  Next, another example of the document management system according to the present embodiment will be described with reference to FIG. In the example illustrated in FIG. 12, a plurality of local systems 100 exist in an intra-organizational network that is a private network of an organization such as a company. In addition, an in-house management system 150 is provided in the in-house network. The organization management system 150 manages processing in the organization and information necessary for the processing in the document management system. That is, the management system 200 is operated by a service provider of the document management system, and manages information and processes for a plurality of organizations that use the document management system. The part related to the organization is managed under the management of the management system 200.

  The organization management system 150 includes a local user ID server 152, a local DID server 154, and a local metadata server 156.

  The local user ID server 152 manages information on users who are registered in the document management system among members of the organization. The individual user information held by the local user ID server 152 is the same as the general user information held by the user ID server 210 shown in FIG. When a user who acquires and uses the processing device 110 (that is, a user who sets the processing device 110 as a “default processing device”) is registered in the processing device 110, the processing device 110 acquires information on the registered user. To the local user ID server 152 in the organization. The local user ID server 152 stores the received user information and sends it to the user ID server 210 of the central management system 200 via the wide area network 10. The user ID server 210 stores the received user information. When the information of the user registered in the processing device 110 is changed, an administrator or the like changes the information of the user to the processing device 110. The processing device 110 transmits to the local user ID server 152 information on the content of the change of the user information (including, for example, the user ID, the item name of the changed information item, and the value after the change of the item), The local user ID server 152 changes the information of the user stored therein according to the content of the received change. Further, the local user ID server 152 sends the received change information to the central user ID server 210, and the user ID server 210 changes the information of the user held by the user according to the sent information. .

  The local DID server 154 receives and stores the DID issued by the processing device 110 in each local system 100 belonging to the organization's internal network. The information held by the local DID server 154 is the same as the information held by the DID server 220 shown in FIG. Further, the local DID server 154 sends the DID information received from the processing device 110 to the central DID server 220, and the DID server 220 stores the information. In addition, the local DID server 154 is given a DID issuing authority and an issuing frame from the central DID server 220, and within a range of the issuing frame, sends a DID to each of the managed processing devices 110 based on the issuing authority. Granting the issuance authority and issuance limit.

  The local metadata server 156 receives and stores eDoc metadata generated by the processing device 110 in each local system 100 belonging to the organization's internal network. The information held by the local metadata server 156 is the same as the information held by the metadata server 230. Further, the local metadata server 156 sends the metadata received from the processing device 110 to the central metadata server 230, and the metadata server 230 stores the metadata.

  In the system shown in FIG. 12, the processing device 110 requests registration (and distribution) of a document from a user who is not registered in the processing device but is registered in another processing device 110 in the same organization, or an eDoc file or meta file. When a request such as a data acquisition request is received, the request is responded to via the in-house management system 150.

  As one example, a viewer registered in the processing device # 1 in the first local system 100 in the first department in the organization network may download the eDoc registered and distributed to the processing device # 1. Consider a case in which the eDoc is saved in the user's own browsing terminal 104 and then moved to the second department under the control of the processing device # 2 to browse the eDoc. At this point, it is assumed that the metadata of the eDoc stored in the browsing terminal 104 is out of date (that is, the access validity period has passed). In this case, when the viewer performs an operation of opening the eDoc at the browsing terminal 104, the processing illustrated in FIG. 13 is performed.

  First, the browsing terminal 104 searches for the processing device 110 from the local network 108 of the second local system 100 to which the browsing terminal 104 is currently connected. Thereby, the processing device # 2 is found. Since this processing device # 2 is a device different from the processing device # 1 that has delivered the eDoc, it does not have its eDoc file or metadata.

  (1) The viewing terminal 104 reads a user ID key (authentication information) from the authentication device 130 of the viewer.

  (2) The browsing terminal 104 sends the user ID acquired from the authentication device 130 to the processing device # 2 for user authentication to acquire the latest metadata of the eDoc designated as the browsing target. Send the key.

  (3) The browsing terminal 104 requests the metadata of the eDoc from the processing device # 2. The request includes the DID of the eDoc.

  (4) -1: The processing device # 2 checks whether the user ID key received from the browsing terminal 104 belongs to a user registered therein (user authentication). In this example, the viewer is registered in the processing device # 1 and not registered in the processing device # 2. Therefore, the processing device # 2 receives the address of the local user ID server 152 set in advance. Sends an authentication request including the user ID key. Further, the processing device # 2 sends the DID included in the metadata request from the browsing terminal 104 to the preset local DID server 154, and requests authentication.

  (4) -2: The local user ID server 152 verifies whether or not the user ID key received from the processing device # 2 belongs to a user registered therein (user authentication). Since the viewer who owns the user ID key is registered in the processing device # 1, the user is also registered in the local user ID server 152, which is the higher-level device. Therefore, this user authentication succeeds. The local user ID server 152 returns a response indicating that the authentication has succeeded to the processing device # 2.

  The local DID server 154 checks whether the DID to be verified sent from the browsing terminal 104 is a valid DID, that is, whether the local DID server is a stored DID. In this example, the DID of the eDoc is issued by the processing device # 1, and is also stored in the local DID server 154 which is a higher-order device relating to the DID of the processing device # 1. Therefore, the DID is authenticated as valid. The local DID server 154 returns a response to the effect that the DID is authenticated to the processing device # 2.

  (5) -1: Since the user authentication and the DID authentication are successful, the processing device # 2 continues the process for responding to the metadata request from the viewing terminal 104. That is, the processing device # 2 sends a metadata request including the DID to a preset address of the local metadata server 156.

  (5) -2: Upon receiving the metadata request from the processing device # 2, the local metadata server 156 returns the metadata corresponding to the DID included in the request to the processing device # 2. When the eDoc metadata is changed by the processing device 110 from the distributor, the change is immediately reflected on the local metadata server 156. Therefore, the metadata returned to the processing device # 2 at this time is Is the latest version of the eDoc metadata.

  (6) The processing device # 2 transmits the metadata received from the local metadata server 156 to the viewing terminal 104.

  (7) The viewing terminal 104 receives the metadata from the processing device # 2 and stores (caches) the metadata.

  (8) The browsing terminal 104 checks the authority of the combination of the browsing terminal 104 and the browsing user by referring to the distribution destination information of the received latest metadata. That is, if a combination that matches the combination of the browsing terminal 104 itself and the viewer is included in the combination of the distribution destination user and the distribution destination terminal indicated in the distribution destination information (see FIG. 3), it is determined that the user has browsing authority. Otherwise, it is determined that there is no viewing authority. If it is determined that there is no viewing authority, the viewing terminal 104 displays an error. If the browsing terminal 104 determines that the user has browsing authority, the browsing terminal 104 extracts a key corresponding to the viewer from among the encrypted keys corresponding to each distribution destination user included in the encryption information in the metadata, and extracts the key. Is decrypted with the private key of the viewer (for example, this is held by the authentication device 130), thereby restoring the decryption key necessary for decrypting the eDoc file.

  (9) The browsing terminal 104 decrypts the eDoc file using the restored decryption key to reproduce a browsable document and outputs the document (for example, screen display). Then, whether to accept an operation instruction for the document from the viewer is controlled according to the access right information included in the metadata.

  Next, referring to FIG. 14, a user registered in processing device # 1 in first local system 100 sends a document to the document management system in a second department under the control of processing device # 2. Consider the flow of processing for registration. It is assumed that the user (the document distributor) is not registered in the processing device # 2.

  (1) When the user instructs the creation terminal 102 to register a document, the creation terminal 102 displays a screen for requesting input of login authentication information. When the distributor inputs authentication information (for example, a user ID and a password) in response to the request, the creation terminal 102 transmits the authentication information to the processing device 110 via the local network 108.

  (2) The processing device # 2 determines whether the authentication information received from the creation terminal 102 belongs to the user registered in itself. In this case, the distributor is not registered in the processing device # 2. In this case, the processing device # 2 sends the authentication information to the higher-level local user ID server 152 and requests authentication.

  (3) The local user ID server 152 determines whether the received authentication information belongs to a user registered in the server itself (user authentication). In this example, since the distributor is a user registered in the processing device # 1, the distributor is also registered in the local user ID server 152, and the user authentication is successful. The local user ID server 152 returns information indicating that the user authentication has succeeded to the processing device # 2.

  (4) When the processing device # 2 receives a response indicating the successful authentication from the local user ID server 152, the processing device # 2 responds to the creating terminal 102 that the user authentication is successful.

  (5) When the user authentication is successful, the creation terminal 102 sends the document selected by the user to be registered and the attribute data input by the user to the processing device # 2.

  (6) The processing device # 2 receives the document and the attribute data from the creation terminal 102.

  (7) -1: The processing device # 2 requests the local DID server 154 for a new issuance authority and an issuance slot when the DID issuance authority and the issuance slot are used up. If there is any remaining in the received issuance slot, the process proceeds to step (8) described later without making this request.

  (7) -2: In response to a request from the processing device # 2, the local DID server 154 assigns a new issuing authority and a new issuing frame to the processing device # 2. When the issue space assigned by the central DID server 220 has been used up, the local DID server 154 requests the DID server 220 for new issue authority and issue space, and issues the issue authority and issue The DID issuance right and the issuance limit are given to the processing device # 2 using the frame.

  (8) The processing device # 2 issues a DID using the assigned issuing authority, and assigns the DID to an eDoc (generated in the next step) generated from the target document.

  (9) -1: The processing device # 2 generates an encryption key for encrypting the target document, encodes the target document into a dedicated format of the present system, and encrypts the encoding result with the encryption key generated earlier. To generate an eDoc file.

  (9) -2: The processing device # 2 generates eDoc metadata by adding items such as the DID generated earlier and the date and time of encoding to the attribute data received from the creation terminal 102.

  (10) The processing device # 2 uploads the generated DID to the local DID server 154 and uploads the generated metadata to the local metadata server 156. The local DID server 154 adds the DID uploaded from the processing device # 2 to the issued DID list (see FIG. 5) corresponding to the issuing authority key included therein, and uploads the DID to the central DID server 220. . The DID server 220 adds the DID uploaded from the local DID server 154 to the issued DID list (see FIG. 5) corresponding to the issuing authority key. The local metadata server 156 stores the metadata uploaded from the processing device # 2 and uploads the metadata to the central metadata server 230. The metadata server 230 stores metadata uploaded from the local metadata server 156.

  The processing device # 2 distributes the generated eDoc to a distribution destination specified by the distributor. This process is the same as steps (7) to (12) in FIG.

  (11) The processing device # 2 transmits the generated eDoc file and metadata to the creation terminal 102. The processing device # 2 may save the eDoc file and the metadata, or may delete the eDoc file and the metadata without saving. When the eDoc file and the metadata are deleted without saving, the eDoc file and the metadata are stored only in the processing device # 1 which is the default processing device among the processing devices 110 in the organization by a step (13) described later. Become. Whether or not the processing device 110, which is not the default processing device of the distributor, saves the eDoc file and the metadata registered and distributed by the distributor may be set to the processing device 110.

  (12) The creating terminal 102 stores the eDoc file and the metadata received from the processing device 110 for later transfer to the processing device # 1, which is the default processing device of the distributor.

  (13) When the distributor returns to the first department to which the distributor belongs with the creation terminal 102, the creation terminal 102 processes on the first local network 108, which is the default processing device of the distributor. Search for device # 1. When finding the processing device # 1, the creating terminal 102 registers the eDoc file and the metadata saved in step (12) in the processing device # 1. Thus, when the distributor wants to change the content of the metadata (for example, the distribution destination), the distributor may access the predetermined processing device # 1 and perform the change operation.

  In the document management system of the present embodiment described above, the main body information (that is, the eDoc file) of the document instructed to be distributed from the creation terminal 102 to the processing device 110 is only possessed by the processing device 110 and the viewing terminal 104 of the distribution destination. , And does not appear on other networks or devices. For this reason, the leakage risk of the eDoc file is minimized. In particular, if the distribution destination of the eDoc file is limited to the browsing terminal 104 on the local network 108 that generated the eDoc, the eDoc will not go out of the local network 108 at all.

  On the other hand, the metadata of the eDoc is registered in the central management system 200 or the in-house management system 150 for each organization, so that even if the browsing terminal 104 moves to various places, the wide area network 10 or the organization's private network is not changed. Has become available through. When the browsing terminal 104 receives an eDoc browsing instruction from the user, the browsing terminal 104 acquires the latest metadata of the eDoc from the in-house management system 150 or the central management system 200, and distributes destination information included in the latest metadata. , It is determined whether the user can be permitted to browse the eDoc. Even if the user is designated as the distribution destination at the time of registration and distribution of the eDoc, if the user is out of the distribution destination due to the subsequent distribution destination change, browsing is not permitted.

  In the examples of FIGS. 13 and 14, it is assumed that the processing device # 1 and the processing device # 2 are both installed in the same organization, and that the distribution destination user also belongs to that organization. User authentication was performed by the local user ID server 152 of the organization. On the other hand, if the viewer is a user belonging to an organization different from that of the processing device # 2, neither the processing device # 2 nor the local user ID server 152 at a higher level can authenticate the distributor. In this case, a higher-order user ID server 210 may perform user authentication of the distributor.

  In the examples of FIGS. 13 and 14, another processing device # 2 mediates the exchange between the browsing terminal 104 of the user registered in the processing device # 1 and the local user ID server 152 or the local metadata server 156. . However, this is only an example. Alternatively, for example, if the user is not registered in the processing device # 2 based on the authentication information of the user sent from the viewing terminal 104, the processing device # 2 may respond to the browsing terminal 104 that the authentication is not possible. Should be performed. In this case, the browsing terminal 104 requests authentication from the local user ID server 152 by using the address information of the higher-level device registered in the own terminal, and if the authentication is successful, accesses the local metadata server 156 to access the necessary information. Get metadata.

  The example of FIG. 13 is an example of a case where a user browses a document by moving to a local system 100 under the control of a processing device 110 different from his / her default processing device in his / her organization. there were. However, the user may be able to view documents delivered from his or her default processing device outside his / her organization. In this case, the browsing terminal 104 of the user is authenticated by the user ID server 210 in the central management system 200, and acquires the metadata of the document to be browsed from the metadata server 230.

<Example of DID>
Next, a configuration of the DID 600 used for the eDoc identification information in the document management system will be described with reference to FIG.

  As illustrated, the DID 600 includes an issuance authority key 602, processing device specific information 604, an issuance date 606, an issuance certification key 608, and an issuance number 610. It should be noted that the illustrated DID 600 and the number of digits of its components 602 to 610 are merely exemplary.

  The issuance authority key 602 is key information for identifying the issuance authority assigned to the processing device 110 by the DID server 220. When the DID server 220 receives a request for an issuance authority and an issuance frame from the processing device 110, the DID server 220 generates an issuance authority key 602 and uses the issuance authority key 602 together with the numerical value of the issuance frame (for example, 100 documents). Send to In the case of a system configuration in which the local DID server 154 intervenes between the DID server 220 and the processing device 110, the DID server 220 transmits, for example, a set of an issuance authority key and an issuance frame to the local DID server 154. Multiple sets are given at once. This assignment may be regarded as requesting the local DID server 154 to perform the process of assigning the plurality of sets of the issuing authority key and the issuing frame to the processing device 110 by the DID server 220. When the local DID server 154 receives a request for issuing authority from the processing device 110 under management, the local DID server 154 may assign a plurality of sets of the assigned issuing authority keys and the unassigned ones of the issuing slots to the processing device 110. .

  The processing device unique information 604 is information unique to the processing device 110 that has issued the DID. That is, by examining the processing device unique information 604 in the DID 600, the processing device 110 that has issued the DID 600 can be uniquely specified. The processing device unique information 604 is held by the processing device 110.

  The issue date 606 is a character string indicating the date when the DID was issued. The issue date of the DID is also the date when the eDoc to which the DID is assigned is generated (encoded).

  The issue certification key 608 is key information for certifying that the processing device 110 (identified by the processing device unique information 604) has issued its DID using the issue authority indicated by the issue authority key 602. The issuance certification key 608 is, for example, a value obtained by encrypting the issuance authority key 602 with the secret key of the processing device 110. In this case, if the value obtained by decrypting the issue certification key 608 with the public key of the processing device 110 matches the issue authority key 602, the DID 600 uses the issue authority key 602 to execute Is issued. Further, a value obtained by encrypting the value of the portion of the DID 600 excluding the issuing authority key 602 (or a hash value of a predetermined number of digits generated from the value) with the secret key of the processing device 110 may be used as the issuing certification key 608. . In this case, if the value obtained by decrypting the issuance certification key 608 with the public key of the processing device 110 does not contradict the value of the part except the issuance certification key 608 of the DID 600 (for example, the decryption result matches the hash value of the value). The DID 600 is issued by the processing device 110 based on the issuance authority key 602, and it is proved that the portion other than the issuance certification key 608 of the DID 600 has not been tampered with.

  The issue number 610 is a serial number indicating which DID the DID 600 is issued by the processing device 110 using the issue authority key 602. The maximum possible value of the issue number 610 of the DID 600 generated using a certain issue authority key 602 is the value of the issue frame (number of documents) assigned by the DID server 220 (or the local DID server 154) together with the issue authority key 602. It is.

<Change of distribution destination after registration>
Now, after registering the eDoc in the document management system, the distributor (or another person who has been given the authority to change the distribution destination) deletes or adds the distribution destination, and changes the access right to the eDoc given to those distribution destinations. You may want to fix it. In such a case, the distributor accesses, for example, a predetermined processing device 110 using the creation terminal 102 or the browsing terminal 104 (hereinafter collectively referred to as a user terminal), specifies the DID of the target eDoc, and specifies the distribution destination ( Or, the user instructs the execution of the editing process of the access right).

  Upon receiving this instruction, the processing device 110 determines that the user who issued the instruction by user authentication is the correct distributor or the like of the target eDoc (general term of the distributor and other persons who have been given the authority to change the distribution destination). If confirmed, an edit screen for the distribution destination and access authority is provided to the user terminal. The edit screen may be the same as the input screen 400 shown in FIG. On the editing screen, the distributor or the like adds or deletes the distribution destination user and the viewing terminal, and changes the access authority. When the distributor or the like performs a necessary change on the edit screen and then performs an operation of confirming the change, the processing device 110 reflects the change in the stored metadata of the eDoc, and The contents of the change are notified to the upper-level local metadata server 156 and the metadata server 230. The local metadata server 156 and the metadata server 230 reflect the notified change content in the stored metadata of the eDoc. For example, even if the user is designated as the distribution destination at the time of distribution, if the user is deleted from the distribution destination due to a subsequent change, browsing of the eDoc becomes impossible. Further, when the distribution destination information in the metadata of the eDoc is changed, the processing device 110 includes the distribution destination information before the change but the distribution destination information after the change. An instruction to delete the eDoc file (and the corresponding metadata) may be sent to the browsing terminal 104 that is not the distribution destination.

  In the above example, the processing device 110 has received the instruction to change the destination of the eDoc or the access authority, but instead or in addition to this, the host device, that is, the management system 200 (metadata server 230) or the management within the organization System 150 (local metadata server 156) may receive the change instruction. In this case, the higher-level device transmits new metadata changed according to the change instruction to the processing device 110 (and the local metadata server 156 of the organization to which the processing device 110 belongs) that generated the eDoc. Then, the existing metadata in the processing device 110 is replaced.

<Status management of processing unit>
Next, control based on status management of the processing device 110 will be described.

  The processing device 110 periodically notifies its own status to the management system 200. In the management system 200, the processing device management server 240 adds the received status to the status history 242 of the processing device 110 in association with the date and time of the reception. In addition, the processing device management server 240 checks the received status, and controls whether the service of the user of the processing device 110 can be provided according to the result of the check.

  The status that the processing device 110 periodically transmits to the processing device management server 240 includes the same items as the status 244 of the processing device illustrated in FIG. 6 (however, the status 244 is not changed by the processing device 110). The installation location, the encoding circuit information, the manufacturer of the processing device, etc. do not need to be transmitted periodically.

  The processing device management server 240 executes, for example, the process illustrated in FIG. 16 based on the status sent from the processing device 110.

  First, when the processing device management server 240 receives the status from the processing device 110 (S100), the processing device management server 240 checks the value of the inspection target item in the status against the reference of each item (S102). The inspection target items include the name and version of the encryption software, the name and version of the encoding software, the security certificate installed in the processing device 110, and the encryption key (for example, a secret key and a public key) installed in the processing device 110. Pair (used for communication channel encryption, signature purpose, etc.) (for example, identification information of the key, installation date and time, etc.), name of encoding circuit and firmware (FW) version, installed font type, disk ( Free space of the next storage). Examples of criteria for individual items are that encryption software, encoding software, and firmware are the latest versions (or that they are versions after a certain version), and that the free space of the disk is greater than or equal to a predetermined threshold. That there is no blacklist among the installed security certificates, that a predetermined period has not elapsed since the date on which the encryption key of the processing device 110 was installed, (Defined) fonts are installed.

  For example, it is desirable that the encryption key used by the processing device 110 for communication path encryption, signature, and the like be periodically changed to a new key in order to maintain its security. Determines that the standard is not satisfied, disables the service provision (or issues a warning to the effect that the service cannot be provided), and prompts the exchange of a new key.

  Next, the processing device management server 240 determines whether or not any of the inspection target items of the status received from the processing device 110 does not satisfy the criterion of the item (S104). The processing for the processing device 110 ends. If there is an item that does not satisfy the criterion in S104, the processing device management server 240 notifies the processing device 110 that the service is unavailable (S106). Upon receiving this notification, the processing device 110 stops the document registration (distribution) service for the document management system of the present embodiment. That is, a document registration (distribution) request from the creation terminal 102 is not accepted, and a message indicating that the service is suspended is returned.

  According to such control, the possibility that the processing device 110 generates an eDoc of a quality that does not satisfy the standard is reduced. For example, according to this control, the service of the processing device 110 is stopped before an eDoc with insufficient encryption strength is generated by old encryption software. In addition, the service is stopped before an error occurs in the eDoc generation process due to a small disk free space or outdated firmware, and a document leakage occurs due to the error. In addition, the service is stopped before the image quality of the eDoc is reduced by the processing device 110 having no predetermined font replacing the font in the document with another font and encoding. Since the firmware of the encoding circuit is old, the image size of the document supported by the latest firmware is not supported, and the situation that the image size of the eDoc is limited is less likely to occur.

  It should be noted that the inspection target items of the status may be classified into items that affect the security of the eDoc and items that do not, and the processing device 110 may stop the service only when the former item does not satisfy the criteria. . If the latter item does not meet the criteria, a warning is sent to the processing device 110 or its administrator to urge the user to resolve the problem with that item. In response to this warning, the administrator of the processing device 110 repairs the processing device 110 for items that can be dealt with by himself, and dispatches a maintenance worker for items that require the intervention of a specialized maintenance worker. Ask the operator. Further, when it is determined that a specific item among the inspection target items does not satisfy the criteria, the processing device management server 240 may automatically arrange for dispatching a maintenance worker to the processing device 110. Good.

  A modification of the process in FIG. 16 will be described with reference to FIG.

  In the procedure of FIG. 17, an emergency item and other items are classified into levels for the inspection target items of the status of the processing device 110. The urgent item is an item that greatly affects the security quality of the eDoc generated by the processing device 110 and the security of the document management system. If the eDoc generated by the processing device 110 whose item does not satisfy the criterion is not secured sufficiently, or if the processing device 110 whose item does not satisfy the criterion continues to operate, that processing device 110 It could be a security hole (vulnerability). Examples of such urgent items include a case where a vulnerability is found in the version of the encryption software, the security certificate installed in the processing device 110, and the encryption key installed in the processing device 110. .

  One method of avoiding the problem caused by the emergency item not meeting the standard is to shut down the processing device 110 in which the emergency item does not meet the standard and dispatch a maintenance worker to correct and repair the emergency item. It is. However, there is an inconvenience that the user cannot use the processing device 110 until the correction is completed.

  Therefore, in the procedure of FIG. 17, when finding an item that does not satisfy the criterion in S104, the processing device management server 240 determines whether the item is an urgent item (S110). If the item is an urgent item, the setting information for correcting the defect of the urgent item is remotely installed from the processing device management server 240 to the processing device 110 via the wide area network 10 (S112). Examples of the setting information for correcting the defect of the urgent item include the latest version of the encryption software, the latest version of the security certificate in which the vulnerabilities are removed from the security certificate in which the vulnerability is found, and the vulnerabilities of the processing device 110. There is a new key pair that replaces a secret / public key pair for which a property has been found.

  For example, in the case of a new key pair, the processing device management server 240 prepares a phrase for generating the new key pair, generates a key pair using the phrase, and processes the generated key pair in a secure manner. It is transmitted to the device 110 and remotely installed.

  As a result, the setting information for the emergency items that do not satisfy the criterion in the processing device 110 is updated to those that satisfy the criterion. Further, in response to this update, the value of the urgent item in the status of the processing device 110 is updated.

  If the determination result in S110 is No (not an emergency item), the processing device management server 240 sends a warning indicating an item that does not satisfy the criteria to the processing device 110 or the administrator, and Arrangement of dispatch of a maintenance worker is performed to correct the item (S114). For items that are not urgent items, serious problems in security are unlikely to occur even if the processing device 110 continues to operate as it is. Therefore, the processing device 110 is not stopped and is dealt with by dispatching a maintenance worker. For items other than the urgent items, the processing device management server 240 does not need to perform remote installation, so that an increase in load on the processing device management server 240 can be avoided.

  In the example of FIG. 17, the setting information on the urgent item is installed in the processing device 110 from the processing device management server 240 from the top down, and the setting information is installed in the processing device 110 in response thereto. Of the emergency item is updated. On the other hand, for the status items other than the urgent items, the values are set or changed in the individual processing devices 110 by, for example, a maintenance worker, and the setting information (for example, the latest Version). The setting or change of the status item value performed by the processing device 110 in this way is notified to the upper-level processing device management server 240, and the processing device management server 240 responds to the notification to change the status of its own processing device 110. Change the value of the status corresponding item.

<DID verification>
The management system 200 transmits a DID issued by the processing device 110, a request for metadata from the browsing terminal 104 (this request includes the DID), or a request for verification of the DID by a user or the like. , Verify that the DID is correct.

  In this case, the DID server 220 verifies the following points for the target DID 600 (see FIG. 15).

  (A) There is no contradiction between the issuing authority key 602 in the DID 600 and the processing device specific information 604.

  The DID server 220 records the issuance authority key 602 in its own recorded information (see FIG. 5) as an issuance authority key to which the processing device 110 indicated by the processing device unique information 604 is assigned. Find out if it is. If it is not recorded, the issuance authority key 602 has not been issued to the processing device 110 indicated by the processing device unique information 604, so that both of them are inconsistent. In this case, the DID 600 is an invalid DID.

  (B) The issuing authority key 602 in the DID 600 and the issuing date 606 do not conflict.

  The DID server 220 records the key grant date and time and the key end date and time in association with the issuing authority key (see FIG. 5). If the issue date 606 in the DID 600 is out of the period from the key grant date and time to the key end date and time recorded in association with the issue authority key 602 in the DID 600, the issue authority key 602 and the issue date 606 is inconsistent. In this case, DID 600 is an invalid DID.

  (C) There is no inconsistency between the issuing authority key 602, the processing device unique information 604, and the issuing certification key 608 in the DID 600.

  The DID server 220 decrypts the issuance certification key 608 with the public key of the processing device 110 indicated by the processing device unique information 604, and the issuance certification key indicated by the decryption result matches the issuance certification key 608 in the DID 600. Is determined. If they do not match, a contradiction exists between the three and the DID 600 is found to be incorrect.

  (D) The issue number 610 in the DID 600 does not contradict the issue frame corresponding to the issue authority key 602.

  The DID server 220 records the issue slots assigned to the processing device 110 together with the issue authority key 602 (see FIG. 5). If the issue number 610 in the DID 600 is a number larger than the issue frame recorded corresponding to the issue authority key 602, the DID is invalid.

  (E) The issue number 610 in the DID 600 does not contradict the issue number of the issued DID including the same issue authority key as the issue authority key 602 of the DID 600. This criterion is used for verifying whether or not the DID is inconsistent with an already issued DID when the processing device 110 is notified of a newly issued DID.

  The DID server 220 records, in association with the issuing authority key, information on the DID issued using the issuing authority key and the date and time of the issuance (the issued DID list in FIG. 5). The DID server 220 checks whether any of the issued DIDs having the same issue authority key as the issue authority key 602 of the DID 600 to be verified has the same issue number as the issue number 610 in the DID 600. If there is such a thing, the DID 600 is determined to be invalid.

  (F) The combination of the issue date 606 and the issue number 610 in the DID 600 does not contradict the combination of the issue date and issue number of the issued DID including the same issue authority key as the issue authority key 602 of the DID 600. thing.

  The DID server 220 determines that the combination of the issue date 606 and the issue number 610 of the DID 600 to be verified includes the issue date and issue number of each issued DID including the same issue authority key as the issue authority key 602 of the DID 600. Is determined to be inconsistent with the combination of the above, that is, whether or not there is a case where the context is reversed. For example, if an issued DID with a smaller issue number is found even though the issue date is later than the DID 600, the DID 600 and the issued DID are inconsistent, that is, the context is reversed. When such a contradiction is found, it is determined that only the DID 600 to be verified or both this and the issued DID are invalid.

  When the DID server 220 determines that a certain DID is invalid by the verification based on the above-described criteria, the DID server 220 notifies the administrator of the processing device 110 related to the invalid DID of a warning by e-mail or the like. . The warning notification includes a message notifying that the DID issued by the processing device 110 and the impersonated DID have been found. The administrator takes measures to strengthen security based on the notification. The administrator of the processing device 110 and the contact information may be obtained from the information (see FIG. 6) of the processing device management server 240. The processing device 110 related to the illegal DID that is the destination of the warning notification is the processing device 110 indicated by the processing device specific information 604 included in the DID. Further, the processing device 110 to which the same issuing authority key as the issuing authority key included in the unauthorized DID has been given in the past may be set as the destination of the warning notification.

<Process when vulnerability is found in eDoc encryption>
Now, a description will be given of a process when a vulnerability is found in the encryption software used for encryption when generating the eDoc file. When the operator of the document management system learns that a vulnerability has been found in a specific version of the encryption software used by any of the processing devices 110, the management system 200 vulnerable to each of the processing devices 110. Send notifications. The vulnerability notification includes information on the software name and version of the encryption software in which the vulnerability was found. When the in-house management system 150 exists, the vulnerability notification is passed from the management system 200 to the in-house management system 150, and the in-house management system 150 transmits the vulnerability notification to each of the processing devices 110 under the in-house management system. . In response to this notification, the processing device 110 executes a process illustrated in FIG.

  When the processing device 110 receives the vulnerability notification from the higher-level device (the management system 200 or the in-house management system 150) (S200), the processing device 110 encrypts itself using the version of the encryption software in which the vulnerability indicated by the notification is found. The converted file is specified (S202). In the document DB 116 of the processing device 110, each eDoc file generated by the processing device 110 and its metadata are stored. From the metadata of each eDoc file, the name of the encryption software used to generate each eDoc is stored. The version is known (see the example of the metadata structure shown in FIG. 3). In S202, the processing device 110 specifies an eDoc in which the combination of the encryption software name and the version included in the metadata matches the combination indicated in the vulnerability notification.

  Next, the processing device 110 re-encrypts each of the identified eDoc files with the version of the current encryption software installed in its own device (S204). In this example, it is assumed that the encryption software of the processing device 110 has been appropriately upgraded, and no vulnerability has been found for the version of the current encryption software of the processing device 110. Generally, it is considered that a vulnerability is often found in the version of the encryption software used by the processing device 110 in the past. If the version of the encryption software that is the target of the vulnerability notification is the current version of the encryption software of the processing device 110, the processing device 110 downloads the latest version of the encryption software from a higher-level device or the like, and Re-encrypt using the latest version. If a vulnerability is found in the latest version of the encryption software currently in use, the upper-level device determines whether there is a newer version of the encryption software that has resolved the vulnerability and whether the distribution source of the software is available. It can be assumed that it has. In the re-encryption, for example, the target eDoc file is decrypted by using the information on the decryption key recorded in the metadata corresponding to the eDoc file, and the decryption result is decrypted by using the newly generated encryption key. Encrypt using a non-vulnerable version of encryption software. It is assumed that the metadata stored in the processing device 110 includes information on the decryption key, for example, in a state encrypted with the public key of the processing device 110 (similarly, the metadata sent to the higher-level device is May include those whose decryption keys are encrypted with the public key of the higher-level device).

  The processing device 110 updates the metadata of the eDoc file according to the re-encryption (S206). That is, the encoding date and time and the encryption information (encryption software name, version information and key information) in the metadata (see FIG. 3) are re-encrypted, the date and time of the re-encryption, the name and version of the encryption software used for the re-encryption. It is rewritten with information on a decryption key for decrypting the encryption. Then, the processing device 110 saves the updated metadata (for example, saves it as the latest metadata for the eDoc file) and uploads the updated metadata to the higher-level device. The host device saves the uploaded updated metadata.

  Thereafter, the processing device 110 executes a process for distributing the eDoc file obtained by the re-encryption to each of the viewing terminals 104 of the distribution destination indicated in the distribution destination information of the metadata (S208). That is, for example, a distribution preparation completion notification is sent to each distribution destination viewing terminal 104 (see step (7) in FIG. 8). This notification may include, in addition to the DID and the document name, information indicating that the eDoc to be delivered is an updated version of the already delivered eDoc. When the browsing terminal 104 receives the distribution preparation completion notification, the browsing user designates, on the list screen 500 (see FIG. 11) of the browsing terminal 104, the eDoc for which the distribution preparation completion notification has been received by re-encryption as a browsing target. The browsing terminal 104 overwrites the eDoc file obtained from the processing device 110 in response to the instruction and the eDoc file in the own device before re-encryption. The browsing terminal 104 stores the updated metadata received together with the eDoc file as the latest metadata of the eDoc. As a result, the eDoc file encrypted with the vulnerable encryption software and the metadata corresponding thereto disappear from the browsing terminal 104, and the eDoc file and the metadata re-encrypted with the encryption software for which no vulnerability has been found. Is replaced by

  The processing device 110 may explicitly transmit a deletion notification including the DID of the eDoc to each of the browsing terminals 104 of the distribution destination before or before sending the browsing completion notification of the re-encrypted eDoc. . In this case, in response to the instruction, each viewing terminal 104 deletes the existing eDoc file having the DID (before re-encryption). At this time, the existing metadata may be deleted together.

<Another example of destination terminal designation>
In the example described above, the distribution destination user and the browsing terminal 104 that can be selected by the distributor on the UI screen (the input screen 400 in FIG. 9) of the creation terminal 102 are registered in the processing device 110 in the same local system 100. User or the browsing terminal 104 registered in the in-house management system 150 of the same organization or the registered user and the browsing terminal 104 (in this case, the user and the browsing terminal 104 registered in another processing device 110 are also designated as distribution destinations). Possible).

  However, in a meeting in which a user inside the organization exchanges people (guests) outside the organization, there may be a case where the guest wants to temporarily view a document such as a created meeting memo. In such a case, registering the guest or the portable terminal of the guest in the processing device 110 or a host device thereof, or canceling the registration after the browsing is completed, is a complicated operation.

  Therefore, in the present embodiment, the eDoc can be distributed to the browsing terminal 104 that can be determined to be a guest terminal under certain restrictions.

  For example, the terminal of the user near the creation terminal 102 is regarded as a guest terminal, and the guest terminal is added to the options of the distribution destination terminal selection menu 406. Alternatively, the terminal of the user near the processing device 110 is regarded as a guest terminal, and the guest terminal is added to the options of the distribution destination terminal selection menu 406. It is considered that the creation terminal 102 and the processing device 110 are often installed in a room of a building of an organization (for example, a room in a department or a meeting room). It is assumed that the person has entered the room with appropriate permission for the purpose.

  For example, the processing device 110 or the creation terminal 102 searches for a partner terminal that can communicate using short-range wireless communication such as Bluetooth Low Energy (registered trademark), and finds a partner terminal that has been found, or among those partner terminals, a terminal from its own device. A terminal whose distance (some short-range wireless communication can determine the communication distance between the own device and the other device) is equal to or less than a predetermined threshold value is determined as a guest terminal near the own device. In the distribution destination terminal selection menu 406, the terminal name of the guest terminal detected by the processing device 110 or the creation terminal 102 is displayed as an option in a display mode different from that of the pre-registered browsing terminal 104 in the organization. Is done. The distributor can select a guest terminal as a distribution destination.

  Here, the processing device 110 or the creation terminal 102 may select, as the guest terminal, only a terminal that satisfies a predetermined condition among the terminals in the vicinity of the own device, as a guest terminal, instead of all the terminals in the vicinity of the own device. For example, the condition may be that the version of the viewer application or other specific software installed on the terminal is higher than a certain version, or that the terminal is not included in a predetermined rejected terminal list. Conceivable.

  It is generally considered that the user carrying the guest terminal is not registered in the processing device 110, the local user ID server 152, or the like. Therefore, when an eDoc file or metadata is requested from a guest terminal specified as a document distribution destination, the processing device 110 may distribute the data without user authentication. In addition, the eDoc metadata to be delivered to the guest terminal incorporates a deletion instruction to delete the eDoc file and the metadata from the guest terminal when the deletion condition is satisfied. The deletion condition is, for example, when the screen display of the eDoc ends, or when a predetermined permission period has elapsed from the time of distribution. When the deletion condition is satisfied, the guest terminal deletes the eDoc file and the metadata from the terminal itself. Thereby, the risk of eDoc leakage by the guest terminal is reduced.

<Response to a request from a terminal other than the distribution destination terminal>
The example described so far is a push type distribution mode in which the processing device 110 distributes an eDoc (or a distribution preparation completion notification corresponding thereto) to the viewing terminal 104 designated as a distribution destination by the distributor. Was.

  However, as another example, a list of eDocs held by the processing device 110 is provided to the browsing terminal 104 in response to a request from the browsing terminal 104, and a browsing target selected by the user from the list is distributed to the browsing terminal 104. A pull-type distribution form is also conceivable. In the case of the pull-type distribution mode, it is conceivable that the distribution destination user accesses the processing device 110 from the browsing terminal 104 that is not specified as the distribution destination and requests the eDoc. The following method is available as a measure to be taken by the processing device 110 when such a request is made.

  (Method 1) When the processing device 110 receives an eDoc distribution request from the browsing terminal 104, the processing terminal 110 sets the browsing terminal to which the browsing terminal 104 is set as the distribution destination based on the distribution destination information of the latest metadata of the eDoc. Is determined. When it is determined that the eDoc does not correspond, neither the file (body) nor the metadata of the eDoc is transmitted to the browsing terminal 104. If it is determined that the metadata is applicable, it is further determined whether or not the user who made the distribution request (or a combination of the user and the browsing terminal 104) is included in the distribution destination information of the metadata. If it is included, distribution may be performed, and if not included, distribution may not be performed.

  As described above, in the method 1, the eDoc (body file and metadata) is not distributed to the viewing terminal 104 that does not correspond to the distribution destination specified by the distributor.

  (Method 2) In this method, even when the viewing terminal 104 that has transmitted the eDoc distribution request does not correspond to the distribution destination browsing terminal 104 specified in the distribution destination information of the metadata of the eDoc, When the user who issued the request (that is, the user who is using the browsing terminal 104) is included in the distribution destination information as the distribution destination, the eDoc main body file and the metadata are transmitted. However, in this case, the processing device 110 incorporates flag information indicating that storage is impossible in the eDoc file and the metadata to be transmitted. The browsing terminal 104 displays the eDoc file and the metadata including the flag information indicating that storage is not possible, but does not accept a save instruction from the user, and discards the data without saving the user when browsing is completed.

  Note that, instead of a method in which the eDoc file and the metadata transmitted to the viewing terminal 104 not specified as the distribution destination are not stored in the viewing terminal 104, the storage may be permitted once. However, in this case, when the browsing terminal 104 tries to open the eDoc file again thereafter, the browsing terminal 104 requests the latest metadata of the eDoc from the processing device 110 or the like (this is a request for requesting browsing permission). However, in response to the request, the processing device 110 determines whether or not the combination of the browsing terminal 104 and the requested user is included in the distribution destination information of the metadata. An instruction to delete the eDoc is sent. The browsing terminal 104 deletes the stored eDoc file and the corresponding metadata in response to the instruction. Note that the processing device 110 may simply respond with the latest metadata, instead of explicitly sending an eDoc deletion instruction to the viewing terminal 104 that has requested the latest metadata. In this case, the browsing terminal 104 determines whether the latest metadata received includes the combination of its own device and the current user, and if not, does not open the eDoc file and further saves it. The eDoc file may be deleted.

  In the example of FIG. 18 described above, the eDoc file after re-encryption inherits the DID of the eDoc file before re-encryption, but the eDoc file after re-encryption has a different eDoc file from the eDoc file before re-encryption. DID may be provided. In this case, the processing device 110 sends an explicit deletion instruction including the DID of the eDoc file before re-encryption to each of the browsing terminals 104 at the distribution destination, so that the vulnerable terminal before re-encryption is transmitted. Make sure that the eDoc file does not remain in the viewing terminal 104. In addition, information on association indicating that the eDoc file after re-encryption and the eDoc file before re-encryption correspond to the same document is written in metadata corresponding to the eDoc file after re-encryption, or It is recorded in the processing device 110 (or in the higher-order DID server 220 or the local DID server 154). When recording in the metadata corresponding to the eDoc after re-encryption, for example, the metadata may include the DID of the eDoc before re-encryption as an item of “DID before update”, for example.

  The embodiment of the invention has been described. The creation terminal 102, the browsing terminal 104, the processing device 110, the local user ID server 152, the local DID server 154, the local metadata server 156, the user ID server 210, the DID server 220, the metadata server 230, and the processing device management exemplified above. Each device such as the server 240 is realized by causing a computer to execute a program representing the function of each device described above. Here, the computer includes, for example, a microprocessor such as a CPU, a memory (primary storage) such as a random access memory (RAM) and a read-only memory (ROM), a flash memory or an SSD (solid state drive), and an HDD as hardware. A controller for controlling a fixed storage device such as a hard disk drive or the like, various I / O (input / output) interfaces, a network interface for controlling connection with a network such as a local area network, and the like are connected via, for example, a bus. Circuit configuration. A program describing the processing contents of each of these functions is stored in a fixed storage device such as a flash memory via a network or the like, and is installed in a computer. The program stored in the fixed storage device is read into the RAM and executed by the microprocessor such as the CPU, thereby realizing the functional module group exemplified above.

  Reference Signs List 10 wide area network, 100 local system, 102 creation terminal, 104 viewing terminal, 108 local network, 110 processing device, 112 management information storage unit, 112a management information, 114a user information, 130 authentication device, 150 organization management system, 152 local User ID server, 154 Local DID server, 156 Local metadata server, 200 management system, 210 User ID server, 212 Contractor data, 214 General user data, 220 DID server, 230 Metadata server, 240 Processing device management server, 242 Status history, 244 status, 246 software information, 248 hardware information, 300 metadata, 400 input screen, 402 distribution destination user selection menu 404, distribution destination user list field, 406 distribution destination terminal selection menu, 408 distribution destination terminal list field, 410 access authority setting field, 412 offline validity period menu, 414 option setting call button, 420 option setting screen, 422 processing device designation field 424 Original data setting column, 500 list screen, 502 notification mark, 504 document name, 506 browsability mark, 602 issue authority key, 604 processing unit specific information, 606 issue date, 608 issue certification key, 610 issue number.

Claims (8)

A processing device provided in each of the local networks, a plurality of processing devices that execute processing on an input document using an encryption key, and a document management system is configured together with the processing device, and connected to each of the local networks. A management device provided on an external network,
Receiving means for receiving, from the processing device, a status of a hardware circuit incorporated in the processing device, the status being information independent of information on the encryption key;
Control means for controlling whether to permit the processing device to execute the processing based on the status,
Management device including. Transmission means for transmitting setting information for a specific item of the status of the processing device to the processing device to add or update,
The management device according to claim 1, further comprising:   3. The management device according to claim 2, wherein the setting information transmitted by the transmission unit to the processing device is a security certificate used by the processing device for communication with another device.   The management device according to claim 2, wherein the setting information transmitted by the transmission unit to the processing device is the encryption key used by the processing device.   3. The management apparatus according to claim 2, wherein the setting information transmitted by the transmission unit to the processing apparatus is an updated program for the processing. A processing device provided in each local network, a plurality of processing devices that execute processing on an input document, and a document management system are configured, and provided on an external network connected to the local network. Management device,
Receiving means for receiving, from the processing device, a status of a hardware circuit built in the processing device, the status being information including at least one of a name and a version of the hardware circuit;
Output means for outputting information indicating whether or not to permit the processing device to execute the processing based on the status;
Management device including. A processing device provided in a local network, the processing device constituting a document management system together with a management device provided in an external network connected to the local network,
Processing means for performing processing on the input document using an encryption key;
Means for transmitting a status, which is a status of a hardware circuit built in the processing device, which is information independent of information on the encryption key, to the management device,
A control unit that controls the processing unit to perform the processing on the input document when there is a permission from the management device according to the status transmitted to the management device;
A processing device including: A processing device provided in a local network, the processing device constituting a document management system together with a management device provided in an external network connected to the local network,
Processing means for performing processing on the input document using an encryption key;
Means for transmitting, to the management device, a status of a hardware circuit built in the processing device, the status being information including at least one of a name and a version of the hardware circuit;
A control unit that controls the processing unit to perform the processing on the input document when there is a permission from the management device according to the status transmitted to the management device;
A processing device including: