JP4481529B2 - Data storage service device, control method thereof, and program - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a service technology for storing user data by a server on a network such as the Internet.
[0002]
[Prior art]
Conventionally, information such as electrophotography and video streams has been stored locally on a user side device (such as a large-capacity hard disk such as a personal computer, a DVD, or a CD-R) unless it is intended to be widely disclosed.
[0003]
[Problems to be solved by the invention]
However, as in the past, when stored locally, when the location where the user's equipment is installed is affected by a disaster such as a fire, earthquake, or typhoon, electronic information such as important electronic photographs and video streams is not stored. There is a risk of being lost.
[0004]
Therefore, as a countermeasure, the present applicant has proposed a service system that stores user data in a server on a network. In this service system, when a disaster such as a fire, an earthquake, or a typhoon occurs, user data in the area where the disaster has occurred is preferentially stored on a server with a high degree of safety (against disaster).
[0005]
However, in the above service system, when preferentially storing user data in a region where a disaster has occurred on a server with a high degree of safety (to disaster), the storage processing is performed in the order of the storage request. For this reason, when a user with a high service subscription condition, such as a user with a high service contract amount or a user with a long service contract, makes a storage request with a delay in time, a server with a high degree of safety is already present at the time of the request. There is a possibility that a user who is full and has a high service subscription condition may not be able to store it only on a server with a low degree of security or cannot receive the service at all.
[0006]
In order to solve this problem, it is conceivable to increase the number of servers. However, when the number of servers is increased, the operating cost of the service provider increases and the profit efficiency decreases.
[0007]
The present invention has been made in view of the problems of the prior art as described above, and an object thereof is to provide a fair data storage service without reducing profit efficiency.
[0008]
[Means for Solving the Problems]
In order to solve the above problems, the present invention includes a plurality of servers for storing data and To the client terminal, In a data storage service device connected via a network, When a data storage request is received from the client terminal, the client terminal that made the storage request To the level of user service subscription The lowest risk of damage based on disaster information from among multiple servers that are associated and exist in areas other than the user's residential area A selection means for selecting a server, and a server selected by the selection means, Said Storage control means for storing data requested to be stored.
[0009]
The present invention also includes a plurality of servers for storing data and To the client terminal, In a method for controlling a data storage service device connected via a network, When the data storage service device accepts a data storage request from the client terminal, the client terminal that made the storage request To the level of user service subscription A selection step of selecting a server having the lowest risk of suffering based on disaster information from a plurality of servers that are associated and exist in an area other than the area where the user resides, and the data storage service device includes: The selection step so For the selected server Said A storage control process for storing data requested to be stored.
[0010]
Also, the present invention relates to Rupu The program has multiple servers for storing data and To client terminal Connected via network When the computer receives a data storage request from the client terminal, the client terminal of the client terminal that made the storage request To the level of user service subscription The lowest risk of damage based on disaster information from among multiple servers that are associated and exist in areas other than the user's residential area Select server Selection means to perform the selection means Selected This Against the server Said Store the requested data Function as storage control means, It is configured to let you.
[0011]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[0012]
FIG. 1 is a system configuration diagram showing a schematic configuration of a user data storage management system to which the present invention is applied. In this system, a service for storing user data in a server on a network is performed.
[0013]
In FIG. 1, 11 is an application server group that provides a user data storage management service, 12 is a client terminal group for enjoying the service, and 13 is a weather database that provides forecast information such as earthquakes and typhoons. The server group 11, the client terminal group 12, and the weather database 13 are connected via a network 10 such as the Internet.
[0014]
The application server group 11 includes an application management server 111 that controls user data storage management processing, and data servers 112 and 113 that store user data. In FIG. 1, only two data servers are illustrated, but there are actually a large number of data servers.
[0015]
The client terminal group 12 includes a remote printer 121, a wired terminal 122, a wireless terminal 123, a user identification module 124, and a digital camera 125. The remote printer 121 is used to print out user data stored in the data servers 112 and 113. The wired terminal 122 and the wireless terminal 123 are used as communication terminals when image data captured by the digital camera 125 is stored in the data servers 112 and 113.
[0016]
A user identification module 124 can be attached to the remote printer 121 and the digital camera 125. As this user identification module 124, in this embodiment, an IC card is used, and specifically, a smart card with a terminal compliant with ISO7816 is used. In this user identification module 124, address information (address of the data servers 112 and 113) indicating the storage destination of the user data stored by the application management server 111 is encrypted and stored in the data servers 112 and 113. Information on the encryption key used at the time is transmitted from the application management server 111 and stored.
[0017]
FIG. 2 is a functional block diagram of the digital camera 125.
[0018]
In FIG. 2, 1501 is an imaging unit, 1502 is an image processing unit that converts an image captured by the imaging unit 1501 into electronic data, and 1503 is an encryption process that encrypts and decrypts the electronic image data with a desired encryption algorithm and key. Reference numeral 1504 denotes an output control unit that converts electronic image data into visible image data.
[0019]
Reference numeral 1505 denotes a control CPU that controls the digital camera 125; 1506, a removable memory unit that stores and stores image data converted into electronic data; and 1507, communication that manages local link communication with the network terminals (122, 123). 1508, a memory for storing a device control program, 1509, an IC card interface for managing communication with an IC card used as the user identification module 124, and 1510 for displaying visible image data converted by the output control unit 1504. It is a display.
[0020]
FIG. 3 is a functional block diagram of the remote printer 121.
[0021]
In FIG. 3, reference numeral 1601 denotes a local input interface that receives input data from a local device such as a scanner or a personal computer, 1602 denotes an image processing unit that converts input electronic image data into a format suitable for processing, and 1603 denotes electronic image data. 1604 is an output control unit that converts the electronic image data into visible image data and controls the printer engine 1610.
[0022]
Reference numeral 1605 denotes a control CPU that controls the remote printer, 1606 denotes a removable memory unit that stores and saves electronic image data, 1607 denotes a communication interface that controls communication with the network 10, 1608 denotes a memory that stores a device control program, and 1609 Is an IC card interface that controls communication with an IC card used as the user identification module 124, and 1610 is a printer engine that performs printing in accordance with the control of the output control unit 1604.
[0023]
FIG. 4 is a logical hierarchical model of an IC card as the user identification module 124.
[0024]
In FIG. 4, reference numeral 1701 denotes an MF (Master File) which is the highest layer of the IC card logical file structure, and 1702 denotes an uppermost EF (Elementary File) as an element file for storing information on the highest DF (Dedicated File). is there.
[0025]
Reference numerals 1703 and 1704 denote the highest DFs that exist immediately below the MF 1701. In this embodiment, these highest DFs (DFs for service providers) 1703 and 1704 identify these DFs 1703 and 1704. Are assigned to each service provider.
[0026]
Below the DFs 1703 and 1704 are DFs 1705 and 1706 related to the user data storage service, and below these DFs 1705 and 1706 are various information (user authentication related information, data server information, addresses) used in this application. There are various files 1707 to 1712 in which information, encryption key information, etc.) are stored. Note that an application ID is assigned to each of the service menus provided by each service provider in the files below the DFs 1705 and 1706.
[0027]
Next, processing of the application management server 111 when a user data storage request is received from a service receiving member (also simply referred to as a user) will be described with reference to FIGS. Here, it is assumed that the service receiving member stores the image data in the digital camera 125 in the data server 112 or 113 via the communication terminal 122 or 123.
[0028]
First, the application management server 111 sets a communication line between the communication terminal 122 or 123 and the application management server 111 in accordance with a member request (step S701 in FIG. 5 and 401 in FIG. 6).
[0029]
Next, a user authentication process is performed between the user identification module 124 mounted on the client terminal side (digital camera 125) and the application management server 111 to determine whether the client terminal operator is a regular member. (402 in FIG. 6, step S702 in FIG. 5).
[0030]
If the user authentication is successful, the user level recognized on the user identification module 124 (user application service subscription conditions) and the user level recognized on the application management server 111 are confirmed (step in FIG. 5). S703, 403, 404 in FIG.
[0031]
If both the user authentication and the user level confirmation are successful, the transfer of the user data related to the storage request is accepted (step S704 in FIG. 5 and 405 in FIG. 6). On the other hand, if any of the above fails, the cause of the failure is notified to the user identification module 124 and the line with the client terminal is disconnected (step S710 in FIG. 5), and one processing unit is terminated. To do.
[0032]
The application management server 111 that has received the transfer of the user data related to the storage request temporarily stores the received user data in the reception buffer 20 (see FIG. 7), and whether or not there is a transfer error for the received user data by a checksum or the like. Is determined (step S705 in FIG. 5). As a result, if there is a transfer error, the client terminal side is requested to retransmit the user data related to the storage request (step S707 in FIG. 5), and the process returns to step S704 to wait for the retransmission of the data.
[0033]
On the other hand, when there is no transfer error, after notifying that the data has been transferred normally, the line with the communication terminal 122 or 123 is disconnected (step S706 in FIG. 5, 407 in FIG. 6). The storage destination data server is selected (step S708 in FIG. 5). Then, user data is stored in the selected data server 112 or 113 (step S709 in FIG. 5), and the data storage condition is notified to the user identification module 124 (step S711 in FIG. 5, 408 in FIG. 6). ) End one processing unit.
[0034]
In the notification process of the data storage condition in step S711 (408 in FIG. 6) in FIG. 5, the result of the user data storage (successful) in the selected data server 112 or 113 (first or second data server described later) Failure) and various information related to data storage conditions such as identification information (IP address, etc.) of the first and second data servers, encryption algorithm used when storing user data, and encryption key information, The user identification module 124 is notified and stored via the communication terminals 122 and 123 using non-real-time communication means (attachment to an e-mail, etc.).
[0035]
In this embodiment, since it is assumed that a communication line of a connection time charging method is used as a communication line used for communication between the application management server 111 and the communication terminal 122 or 123, data storage is performed. In order to notify the information relating to the condition to the user identification module 124 using a non-real-time communication means, the data storage condition is notified after the communication line is once disconnected.
[0036]
However, the communication line disconnection process between the application management server 111 and the communication terminal 122 or 123 may be performed after the data storage condition notification process. In this case, the change of the data storage condition on the user identification module 124 can be quickly confirmed on the application management server 111 side. In particular, when the communication line is a charging method based on the amount of communication data, the method described later is more convenient than the method described above.
[0037]
Next, the storage destination data server selection process in step S708 of FIG. 5 will be described in detail based on the flowchart of FIG.
[0038]
In this selection process, the application management server 111 first refers to the user profile of the user (member) who has accessed this time and recognizes the residence information of the user (step S801 in FIG. 8). The user level (contract fee plan, contract continuation years, etc.) of the user is recognized (step S802 in FIG. 8).
[0039]
Next, referring to the disaster risk table for each user level (updated every time the user level information and the disaster risk information are changed in the process of FIG. 11) (step S803 in FIG. 8), The data server with the lowest damage risk on the damage risk table is selected as the first data storage server, and on the disaster risk table at the user level, other than the user's place of residence (with sufficient physical distance from the place of residence). Data server with the lowest risk of damage among those existing in the location (provided), but when the result is the same as the selection result of the first data storage server, the data with the second lowest risk of damage Server) is selected as the second data storage server (step S804 in FIG. 8).
[0040]
Then, an encryption method and an encryption key used for storing data in each selected data server are selected (step S805 in FIG. 8).
[0041]
Next, the data storage processing in the data server in step S709 in FIG. 5 will be described in detail based on FIGS. 7, 9, and 10. FIG.
[0042]
In this storage process, the application management server 111 first designates the selected first data storage server (501 in FIG. 10), authenticates the first data storage server (502 in FIG. 10), and impersonates. It is confirmed that the server is not an unauthorized server (step S1001 in FIG. 9).
[0043]
When it is confirmed that the first data storage server is a legitimate data server, the encryption key A and encryption algorithm for the first data server selected when the user data related to the storage request is selected at the previous server selection. After encryption using (22 in FIG. 7), the encrypted data is transferred to the first data storage server (503 in FIG. 10, step S1002 in FIG. 9). Then, it is determined whether or not a data transfer confirmation response has been obtained from the first data storage server (step S1003 in FIG. 9 and 504 in FIG. 10). As a result, if the data transfer confirmation response is not obtained, it is determined that the data transfer has failed, and the process returns to step S1002 to retransmit the data.
[0044]
On the other hand, if a data transfer confirmation response is obtained, the process proceeds to step S1004. If the data server cannot be confirmed as a valid data server in step S1001, an illegal data server detection process is performed (step S1007), and the process proceeds to step S1004. The unauthorized data server detection process will be described later in detail based on the flowchart of FIG.
[0045]
In step S1004, the selected second data storage server is designated (505 in FIG. 10), the second data storage server is authenticated (506 in FIG. 10), and it is confirmed that the server is not an improper server such as impersonation. .
[0046]
If it is confirmed that the second data storage server is a legitimate data server, the encryption key B and encryption algorithm for the second data server selected when the user data related to the storage request is selected at the previous server selection After encryption using (23 in FIG. 7), the encrypted data is transferred to the second data storage server (507 in FIG. 10, step S1005 in FIG. 9). Then, it is determined whether or not a data transfer confirmation response is obtained from the second data storage server (step S1006 in FIG. 9, 508 in FIG. 10). As a result, if the data transfer confirmation response is not obtained, it is determined that the data transfer has failed, and the process returns to step S1005 to retransmit the data.
[0047]
On the other hand, when a data transfer confirmation response is obtained, one processing unit is terminated. If it cannot be confirmed as a valid data server in step S1004, an illegal data server detection process is performed (step S1008), and one processing unit is terminated. The unauthorized data server detection process will be described later in detail based on the flowchart of FIG.
[0048]
Through the above processing, application enjoying members can be affected by disasters such as earthquakes, typhoons, etc., even if they do not perform special operations to specify the data storage location. Because it is possible to store desired user data in a data server in a low place, it is possible to protect important user data from physical damage caused by damage to the member's home or disaster that occurred in the member's residence area. Become.
[0049]
In addition, for the user data storage application provider, a fair data storage service corresponding to the user level can be provided to the user by adding the member level (subscription fee plan, number of continuous contracts, etc.) as a parameter when selecting the data server. It is possible to provide a data storage service that is highly profitable and can prevent the data server from becoming full without increasing the number of data servers. It becomes possible.
[0050]
Next, the disaster risk table update process for each user level will be described based on the flowchart of FIG. The disaster risk table update process is automatically executed periodically by the application management server 111.
[0051]
In this update process, the application management server 111 first determines whether or not the user level information has changed for each user by referring to the user profile (step S901), and refers to the weather database 13 for the disease risk information. It is determined whether or not there is a change (step S902). As a result, if neither the user level information nor the disaster risk information has changed, one processing unit is terminated as it is.
[0052]
If at least one of the user level information and the morbidity risk information has changed, the affliction risk table information for each user level is updated based on the changed information (step S903). Then, it is determined whether or not the storage data server needs to be changed in accordance with the table update (step S904). If there is no need to change the storage data server, one processing unit is terminated.
[0053]
On the other hand, if it is necessary to change the storage data server, the storage data server is selected again based on the flowchart of FIG. 8 described above (step S905). Then, based on the flowchart of FIG. 9 described above, the user data is re-stored in the re-selected storage data server (step S906).
[0054]
Next, the data storage conditions that have changed as a result of the re-storage are stored by notifying the user identification module 124 via the communication terminals 122 and 123 using non-real-time communication means (such as attachment to an e-mail). (Step S907) and one processing unit is completed.
[0055]
As described above, the user data once stored in the data server is automatically re-selected / restored in accordance with the change even if the user level or the risk of damage changes. It will be possible to provide quality service.
[0056]
Next, communication processing when user data (such as electrophotographic information) stored in the data servers 112 and 113 is read and output by the remote printer 121 will be described based on the flowchart of FIG. 12 and the sequence diagram of FIG. To do.
[0057]
The remote printer 121 receives various information related to the data server storing user data (address for access, use encryption key, use encryption algorithm, etc.) from the user identification module 124 attached to the remote printer 121. ) Is read (601 in FIG. 13). The user selects user data to be output in advance by operating the remote printer 121 (not described in FIGS. 12 and 13).
[0058]
The remote printer 121 sets up a communication line with the data server {here, data server 1 (112)} in which the selected user data is stored (step S1401 in FIG. 12, 602 in FIG. 13). Next, user authentication processing is performed between the line-connected data server 112 and the user identification module 124 (step S1402 in FIG. 12 and 603 in FIG. 13). If the user authentication fails, the line is disconnected as it is (step S1406 in FIG. 12), and the user data reading process is terminated.
[0059]
On the other hand, if the user authentication is successful, user data from the data server 112 is received (step S1403 in FIG. 12, 604 in FIG. 13), and the presence or absence of a transfer error is determined by checksum or the like (step S1404 in FIG. 12). 605 in FIG. If a transfer error has occurred, the user data is requested to be retransmitted (step S1407 in FIG. 12), and the process returns to step S1403.
[0060]
On the other hand, if no transfer error has occurred, the transfer data is decrypted using the use encryption key and the use encryption algorithm (step S1405 in FIG. 12). Then, the line is disconnected (step S1406 in FIG. 12, 606 and 607 in FIG. 13), and the user data reading process ends.
[0061]
Next, the process for confirming the validity of stored data will be described with reference to FIGS. Note that the processing for confirming the validity of the stored data is periodically executed by the application management server 111.
[0062]
First, the application management server 111 stores the user data (electrophotographic information) of the member who confirms the validity of the data this time from the application enjoying member information storage area (31 in FIG. 15) in the application management server 111. Information (stored data server address, used encryption key information, etc.) related to the data server (first and second stored data servers) is read out, and the first stored data server and the second stored based on the information Server authentication processing is performed for the data server (steps S1101 and S103 in FIG. 14).
[0063]
If server authentication fails for at least one of the first storage data server and the second storage data server, an unauthorized data server detection process is performed (step S1107 in FIG. 14), and one processing unit is terminated. The unauthorized data server detection process will be described later in detail based on FIG.
[0064]
On the other hand, if both the first storage data server and the second storage data server have succeeded in server authentication, the encryption in the first storage data server and the second storage data server that has succeeded in the server authentication. The user data related to is taken into the application management server 111 (steps S1102 and S1104 in FIG. 14).
[0065]
Then, the captured user data relating to encryption is decrypted using the corresponding encryption key and algorithm (step S1105 in FIG. 14, 32 and 33 in FIG. 15), and whether or not both user data match. Is discriminated (step S1106 in FIG. 14). As a result, if both user data match, one processing unit is terminated as it is. On the other hand, if they do not match, user data alteration detection processing is performed (step S1108 in FIG. 14), and one processing unit is completed.
[0066]
Next, the user data alteration detection process in step S1108 of FIG. 14 will be described in detail based on the flowchart of FIG.
[0067]
In this user data falsification detection process, the application management server 111 performs a disk (memory) scan (local check) of the user data storage area related to the user (the same user) with respect to both the data servers 112 and 113 to be compared. ) Is instructed (step S1201). Upon receiving this instruction, the data servers 112 and 113 perform error detection processing in the user data storage area, perform correction processing if the error location can be corrected, and notify the application management server 111 of the processing results. .
[0068]
Therefore, the application control server 111 determines whether or not the error correction is performed by the data servers 112 and 113 (step S1202). If the error correction has been performed, the stored data validity check process of FIG. 14 is performed again. (Step S1203).
[0069]
On the other hand, if no error correction has been made, it is determined that the user data has been tampered with by a third party, and the difference information between the two user data is stored in the referenceable information storage area 30 (32 in FIG. 15). ), The user is notified via the communication terminal (step S1204).
[0070]
Next, the unauthorized data server detection process in step S1107 of FIG. 14 will be described in detail based on the flowchart of FIG.
[0071]
When user data is being written to the data server at the time of detecting the unauthorized data server, the application control server 111 side starts communication line setting processing with the client user (member) (steps S1301 and S1302). ). Then, the application management server 111 performs user authentication with the user identification module 124 (step S1303), and when user authentication fails, the communication line with the client user (member) is disconnected (step S1309). 1 unit of processing is completed.
[0072]
On the other hand, if the user authentication is successful, the storage data server is selected again based on the flowchart of FIG. 8 (step S1304). However, in the selection process here, the selection process is performed with the selection priority of the data server detected as the unauthorized server as the storage data server lowered. Next, the application management server 111 disconnects the communication line with the client user (member) (step S1305), and performs data storage processing in the selected data server based on the flowchart of FIG. 9 (step S1306). 1 unit of processing is completed.
[0073]
If it is determined in step S1301 that an unauthorized data server has been detected, the data server has not been written, and if the detected data server is detected as an unauthorized server, the number of detections is greater than the specified number. It is determined whether or not it can be set to an arbitrary value once or more (step S1307). As a result, if the number of times of detection as an unauthorized server is not the specified number or more, one processing unit is terminated, and if the number is the specified number or more, the member is notified via the client terminal (step S1308). finish. In this embodiment, this notification assumes non-real-time communication such as e-mail.
[0074]
In this way, the application management server 111 autonomously and periodically checks the validity of the user data on the data server, so that the application receiving member saves user data such as electrophotographic information stored on the data server. It is possible to greatly reduce the effort for confirming the legitimacy (no tampering, etc.).
[0075]
FIG. 18 is a schematic diagram for explaining billing (payment of application service enjoyment price) to a member in the user data storage management system.
[0076]
In FIG. 18, reference numeral 111 denotes the application management server shown in FIG. 1 and the like, and 112.113 denotes the data server shown in FIG. Reference numeral 1803 denotes an information server of a transaction financial institution of a provider (hereinafter referred to as service provider) that provides the application service, and 1804 denotes a transaction financial institution of a member (subscriber of the application service: hereinafter referred to as user). The information server 10 is the network shown in FIG. 1, and 181 is a dedicated financial institution network (closed network).
[0077]
Next, billing processing for members of the application management server 111 will be described based on the flowchart of FIG. 19 with reference to FIG. 18 as appropriate.
[0078]
When the account settlement date (1810 in FIG. 18) comes to the member, the application management server 111 checks the validity of the user data related to storage for each account settlement target user based on the flowchart in FIG. 14 ( 1811 in FIG. 18 and step S1901 in FIG. 19). As a result, if the validity of the user data is confirmed, for each accounting settlement target user, the compensation for the data storage in the current term is calculated based on various conditions such as the user level and the presence / absence of data alteration (step S1902). .
[0079]
On the other hand, when the validity of the user data cannot be confirmed, the reselection processing of the storage target data server is performed based on the flowchart of FIG. 8 (step S1903), and the data server related to the reselection based on the flowchart of FIG. After the user data storage process is performed (step S1904), for each accounting settlement target user, the compensation for data storage in the current term is calculated based on various conditions such as the user level and the presence / absence of data falsification (step S1902). ).
[0080]
Next, for each user, the compensation for the current data storage and the latest data storage server information (IP address, encryption algorithm, encryption key, failure history, appeal deadline / method, etc.) are sent via the network 10. Then, notification is made using non-real-time communication means (e-mail attached file or the like) (1813 in FIG. 18, step S1905 in FIG. 9). The notification (mail) can be received and confirmed by the communication terminals 122 and 123 connected to the network 10. In addition, the user identification module 124 can be attached to the communication terminals 122 and 123 so that the received mail can be stored in the user identification module 124.
[0081]
In the unlikely event that the user is dissatisfied with the contents (billing amount, trouble history, etc.), the user can appeal the service provider by the due date according to the appealing method related to the notification. Therefore, the application management server 111 determines whether or not there has been a complaint from the user before the complaint deadline has passed (step S1906).
[0082]
As a result, if there is no complaint, the service provider's transaction financial institution information server 1803 is notified from the account of the user's financial institution that the specified amount should be withdrawn on the settlement date (FIG. 18). 1812, step S1907 in FIG. 19), one processing unit is completed. On the other hand, if there is a complaint, reconfirmation processing of the user profile or the like of the user is performed (step S1908), the process returns to step S1906, and the presence or absence of a complaint from the user is confirmed again.
[0083]
On the payment settlement date, the payment amount and the payee account are specified from the transaction financial institution information server 1803 of the service provider to the transaction financial institution information server 1804 of the user (1821 in FIG. 18). The transaction financial institution information server 1804 of the user who has accepted this designation pays the designated payment amount to the designated payment account (1822 in FIG. 18), and sends non-real-time communication means (attachment of e-mail) to the user. The payment history is stored in the user identification module 124 by notifying the payment of the service consideration using the file or the like and the payment history (1823 in FIG. 18).
[0084]
With the above processing, it is possible to realize a billing process in which an agreement between the service provider and the user is obtained on the user data storage management system. In addition, since the application management server 111 and the user identification module 124 manage information for each user such as billing information, various information such as stored data servers, payment information from transaction financial institutions, the above various information It is possible to confirm from the user side, and it is possible to reliably detect falsification of stored data or the like.
[0085]
Note that the present invention is not limited to the above-described embodiment, and for example, text information other than electrophotographic information, video streaming information (electronic moving image information), audio information, and the like can be stored and managed. Further, as the user identification module, it is possible to use a non-contact type IC card without using an IC card (an IC card with a terminal defined by ISO 7816). Furthermore, it is possible to save the trouble of mounting the user identification module on the terminal by incorporating the user identification module itself into a mobile phone / personal digital assistant, etc., or by mounting a function equivalent to the user identification module. .
[0086]
In addition, the damage risk judgment process is not only performed using the earthquake prediction information and typhoon information of the weather data server 13, but also is managed by a property insurance company (fire insurance, earthquake insurance, etc.). It is also possible to use the rate information for each region. In addition, it is not a billing / settlement method by account transfer processing using a dedicated network system (closed network) between banks, but a billing / credit card system that uses cryptographic communication on a general-purpose network (open network) as a communication medium. It is also possible to use a payment method.
[0087]
Further, if an electronic cash (electronic money whose value can be transferred without the approval of the financial institution central server) application is installed on the user identification module 124, the user who has received the notification of the payment amount can receive the application central server. By sending electronic cash to 111 using encryption communication on a general-purpose network (open network) as a communication medium, direct payment can be made without going through the financial institution server.
[0088]
【The invention's effect】
As described above, according to the present invention, the data related to the storage request is stored in the server selected in accordance with at least the level of the service subscription condition of the user, so that the profit efficiency is not lowered. It becomes possible to provide a fair data storage service.
[Brief description of the drawings]
FIG. 1 is a system configuration diagram showing a schematic configuration of a user data storage management system to which the present invention is applied.
FIG. 2 is a functional block diagram of a digital camera as a client terminal.
FIG. 3 is a functional block diagram of a remote printer as a client terminal.
FIG. 4 is a conceptual diagram showing a storage hierarchy model of logical information of a user identification module.
FIG. 5 is a flowchart showing processing of an application management server when a connection request (user data storage request) is received from a client terminal.
FIG. 6 is a sequence diagram showing communication processing when a connection request (user data storage request) is made from a client terminal.
FIG. 7 is a conceptual diagram for explaining processing of an application management server when a connection request (user data storage request) is received from a client terminal.
FIG. 8 is a flowchart showing a process of selecting a data server for storing user data by an application management server.
FIG. 9 is a flowchart showing user data storage processing by an application management server to a data server related to selection.
FIG. 10 is a sequence diagram showing a communication process at the time of storing user data in a data server related to selection.
FIG. 11 is a flowchart showing a disaster risk table update process for each user level by the application management server.
FIG. 12 is a flowchart showing user data download processing from a data server by a remote printer.
FIG. 13 is a sequence diagram illustrating communication processing when user data download processing from a data server is performed.
FIG. 14 is a flowchart showing a process of confirming the validity of user data in the data server by the application management server.
FIG. 15 is a conceptual diagram for explaining a process of confirming the validity of user data in a data server by an application management server.
FIG. 16 is a flowchart showing falsification detection processing of user data by the application management server.
FIG. 17 is a flowchart showing illegal data server detection processing by an application management server.
FIG. 18 is a schematic diagram for explaining charging processing using a closed network (dedicated network) together;
FIG. 19 is a flowchart showing the charging process by the application management server.
[Explanation of symbols]
10: Network
11: Application server group
12: Client terminal group
13: Weather database server
111: Application management server
112: First data server
113: Second data server
121: Remote printer
122: Wired communication terminal
123: Wireless communication terminal
124: User identification module
125: Digital camera

Claims (17)

In a data storage service device connected via a network to a plurality of servers and client terminals for storing data,
When receiving a data storage request from the client terminal, a plurality of servers that are associated with the level of service subscription conditions of the user of the client terminal that made the storage request and exist in an area other than the user's residence area A selection means for selecting a server with the lowest risk of suffering from disaster information based on disaster information ;
And storage control means for the selected server, and stores the storage requested data by said selecting means,
A data storage service device comprising: The selection means performs the save request with a first server having the lowest risk of suffering from among a plurality of servers associated with the level of service subscription conditions of the user of the client terminal that has made the save request. A second associated with the service subscription condition level of the user of the client terminal and having the lowest risk of suffering other than the first server among the plurality of servers existing in an area other than the area where the user resides The data storage service device according to claim 1 , wherein a server is selected.   The storage control unit encrypts the data requested to be stored by an encryption method corresponding to the server selected by the selection unit, and stores the encrypted data in the selected server. Data storage service equipment.   4. The data storage service device according to claim 1, wherein the level of the service subscription condition is determined based on at least one of a consideration for the service and a service enjoyment period. When the service subscription condition level of the user of the client terminal that has made the save request is changed, the selection unit is associated with the level of the service subscription condition after the change of the user of the client terminal that has made the save request. In addition, the server having the lowest risk of suffering is selected based on the disaster information from a plurality of servers existing in areas other than the user's residence area, and the storage control means selects the server by the selection means. against it healed a server, data storage service device according to any one of claims 1-4, characterized in that re-storing the storing requested data. When the disaster information is updated, the selection means is associated with a level of service subscription conditions of the user of the client terminal that has made the storage request and is present in a region other than the user's residence region. Based on the updated disaster information, the server having the lowest disaster risk is selected again from the server, and the storage control unit is requested to store the server selected by the selection unit. data storage service apparatus according to any one of claims 1 to 5, wherein the re-storing the data. The data storage service device according to any one of claims 1 to 6, further comprising an investigation unit that periodically examines the validity of data stored in the server by the storage control unit. 8. The data storage service device according to claim 7 , wherein the checking means checks the validity by comparing the same data related to the storage requests stored in a plurality of servers by the storage control means. . The survey unit, the data storage service apparatus according to claim 7 or 8 further characterized in that due to the memory medium to determine whether data became invalid. The data storage service device according to any one of claims 7 to 9 , wherein the investigating unit determines whether or not the data has become invalid due to falsification of the data. An authentication unit for authenticating whether or not the user who has made the storage request is a member of the service, wherein only a storage request from a user authenticated by the authentication unit is accepted. The data storage service device according to any one of 1 to 10 . Further, it includes an authentication unit that authenticates the validity of the server selected by the selection unit, and the storage control unit stores the data requested to be stored only for the server authenticated by the authentication unit. The data storage service device according to any one of claims 1 to 11 . The data storage according to any one of claims 1 to 12 , further comprising notification means for notifying at least storage condition data relating to data storage processing by the storage control means to a client terminal that has made the storage request. Service device. 14. The data storage service device according to claim 13 , wherein the notifying unit notifies the storage condition data of an encryption algorithm and encryption key data in addition to the storage location data of the data relating to the storage request. . The client terminal data storage service apparatus according to claim 13 or 14, wherein further comprising a storage means for storing storage condition data notified by at least said notification means. In a control method of a data storage service device connected via a network to a plurality of servers and client terminals for storing data,
When the data storage service device receives a data storage request from the client terminal, the data storage service device is associated with the level of service subscription conditions of the user of the client terminal that made the storage request, and is in an area other than the user's residence area. A selection step of selecting a server with the lowest risk of suffering based on disaster information from a plurality of existing servers ;
The data storage service apparatus, a storage control step for the selected server by the selection step, storing the stored request data,
A method for controlling a data storage service device, comprising: A computer connected via a network to a plurality of servers and client terminals for storing data,
When receiving a data storage request from the client terminal, a plurality of servers that are associated with the level of service subscription conditions of the user of the client terminal that made the storage request and exist in an area other than the user's residence area Selection means for selecting the server with the lowest risk of disaster based on disaster information ,
Storage control means for the selected server by the selection means, for storing said stored requested data,
Program to function as .

Images