JP2005071245A - Data information management system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent a manipulation, leak or the like of confidential data by managing in a server apparatus whether or not to permit processing executed on the confidential data held in a client apparatus. <P>SOLUTION: The client apparatus 30, when requesting the server apparatus 10 to permit the execution of processing on confidential data, calculates a hash value from the confidential data and sends it to the server apparatus 10, and when finishing the processing on the confidential data, adds a random number to the confidential data, calculates a new hash value and sends it to the server apparatus 10. The server apparatus 10, when requested by the client apparatus 30 to permit the execution of the processing on the confidential data, determines whether or not to permit the processing execution according to the hash value sent from the client apparatus 30 and user file information in user file information storing means 23, and stores the new hash value sent by the client apparatus 30 that finishes the processing on the confidential data in the user file information storing means 23 as new user file information. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a data information management system for preventing falsification or leakage of data (confidential data) acquired and held by a client device from a server device in a so-called client-server type computer system.

  Conventionally, various proposals have been made as security measures in a client-server type computer system.

  For example, when performing user authentication for authenticating that the user is a legitimate user, the user ID or password given to the user permitted to use is input from the client device, and the server device receives the input user ID, password, or client device. Authentication is performed based on information such as the connection location. If the server device authenticates the validity of the user trying to connect from the client device, the login of the client device to the server device is completed, and various services can be used between the server device and the client device. Such user authentication methods are widely used, and can refuse login for users who are not permitted to use, select whether to use various services and information, and set usage patterns, The safety and reliability of the computer system can be maintained, and users can be grasped and managed.

  As a security measure for data flowing on the network, public key cryptosystems that encrypt / decrypt information using two values called a public key (encryption key) and a decryption key (secret key) are widely used. It's being used. In the public key cryptosystem, a data sender encrypts data using a public key calculated and generated from a decryption key of the receiver, and transmits the encrypted data to the receiver. Then, the receiver decrypts the received encrypted data using the decryption key known only to him / her. This encryption method uses a one-way function in public key generation, making it difficult to obtain a decryption key from an eavesdropped public key even if the public key is wiretapped by a third party. It is safe because it can be done.

  However, in the security measures as described above, although a defense measure against a third party is taken, it is unprotected against a user who is authenticated as a regular user. In other words, regular users are allowed to freely handle data and information acquired from the server device, so they can freely copy and falsify the obtained data and information, and leak it to the outside. It was.

Therefore, in a system having a portable computer, if it is an authorized user of a portable computer, information can be freely obtained and used within a predetermined range, and even a legitimate user can easily obtain information from the portable computer. Has been proposed (see Patent Document 1).
JP 2001-31466 A

  According to the system described in Patent Document 1, only a legitimate user can download data and information to his / her portable computer within the authority range by user authentication (use authentication, computer authentication, access authentication) and access authority management. It becomes like this. Downloaded data and information are encrypted and stored in the portable computer together with the encrypted user information so that only users who have the same user information as the encrypted user information can decrypt it. Therefore, it prevents the third party from looking into the downloaded data and information. Furthermore, the port for accessing the outside of the portable computer is closed to prevent data and information from leaking.

  However, even with the system described in Patent Document 1, once authenticated as a legitimate user, it is possible to copy or tamper with downloaded data and information, and it is also difficult to take it outside. Although it is, it is never impossible.

  In this way, security measures for legitimate users are often left to the discretion of legitimate users, and it is not possible to completely prevent the data and information obtained from being copied or altered or leaked to the outside. Is the current situation.

  The present invention has been made in view of the above problems, and the server determines whether or not a process to be executed by a client device on confidential data acquired and held by the client device from the server device. It is an object of the present invention to provide a data information management system capable of preventing falsification or leakage of confidential data by managing the apparatus.

  In order to solve the above-described problem, the data information management system according to the present invention provides data information managed by the server device to determine whether the client device can execute processing on confidential data acquired and held from the server device. (A) program storage means for storing various programs for executing processing on confidential data by the client device; and (b) whether or not the access request from the client device is an access request by a legitimate user. User information storage means for storing user information for the server device to authenticate the server device, and (c) the server device determines whether or not the requested processing can be executed in response to the processing execution permission request for the confidential data from the client device. User file information storage means for storing user file information for use Characterized in that it has a.

  The client device receives (d1) storage means for storing confidential data acquired from the server device, and (d2) is input from the input means when authenticating whether the access request is issued by a legitimate user to the server device. Authentication means for transmitting user information to the server device; (d3) encryption means for encrypting various data to be transmitted to the server device by acquiring a first public key from the server device; and (d4) from the server device. A pseudo-random number generating means for generating a random value for generating a second decryption key for decrypting the transmitted encrypted data; and (d5) generating a second decryption key from the generated random value; Public key generating means for generating a second public key from the generated second decryption key, and transmitting the generated second public key to the server device; (d6) A decryption means for decrypting the encrypted data encrypted with the first public key using the second decryption key; and (d7) a server device that grants execution permission to the confidential data stored in the storage means. When a request is made, a hash value is calculated from the confidential data, the calculated hash value is transmitted to the server device, and when the processing for the confidential data is finished, a random number is added to the confidential data to create a new hash A hash value calculating means for calculating a value and transmitting the calculated new hash value to the server apparatus; and (d8) dedicated data browsing means for browsing confidential data permitted to be processed by the server apparatus. It is characterized by providing.

  Further, the server device (e1) determines whether the access request from the client device is an access request by a legitimate user based on the user information transmitted from the client device and the user information stored in the user information storage means. (E2) Domain authentication means for identifying the domain to which the client device is connected and authenticating whether the connected domain is a permitted domain, (e3) Client An encryption unit that obtains a second public key from the client device and encrypts various data to be transmitted to the device; and (e4) a first decryption key that decrypts the encrypted data transmitted from the client device. (E5) generating a first decryption key from the generated random number value; Public key generating means for generating a first public key from the generated first decryption key and transmitting the generated first public key to the client device; and (e6) encrypted data transmitted from the client device. Decryption means for decrypting using the first decryption key; and (e7) when the client device requests permission to execute the processing on the confidential data, the client device transmits whether the requested processing can be executed. A new hash value transmitted from the client device is determined by the new user when the client device finishes processing the confidential data, based on the hash value and the user file information stored in the user file information storage means. User file information management means for storing in the user file information storage means as file information To.

  That is, according to the data information management system according to the present invention, whether or not to permit execution of processing for confidential data requested by a legitimate user connected from a predetermined domain is registered for each piece of confidential data. The server device determines based on the above. This user file information is updated to a new value generated from the confidential data every time the confidential data is processed in the client device and stored on the server device side. In this case, the updated new user file information is required. In other words, by making it impossible to determine the value of user file information stored on the server device side from data that has been copied or altered, even for legitimate users, Outflow to the outside can be prevented.

According to the present invention, a data information management system capable of preventing falsification or outflow of confidential data by the server device managing whether or not the client device can execute processing on confidential data acquired from the server device. Can be provided.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. Throughout the drawings, the same or equivalent parts and components are denoted by the same or equivalent reference numerals, and the description thereof is omitted or simplified.

[Data information management system configuration]
FIG. 1 shows a configuration example of a data information management system according to an embodiment of the present invention. As shown in the figure, the data information management system includes a server device 10, a program storage unit 21, a user information storage unit 22, a user file information storage unit 23, and one or a plurality of client devices 30. It is connected. The network 40 may be a wired network, a wireless network, or a combination thereof. Further, the network 40 may be any connection form such as the Internet, an intranet, a WAN (Wide Area Network), and a LAN (Local Area Network), or may be a combination form of these.

  The program storage unit 21 includes various programs to be described later for executing processing on confidential data acquired and held by the client device 30 from the server device 10, for example, a hash value calculation unit 33, an encryption unit 34, Various programs such as a public key generation unit 35, a pseudo random number generation unit 36, a decryption unit 37, a data browsing unit 38, and the like are stored, and various programs are provided to the client device 30 in response to a download request from the client device 30.

  As illustrated in FIG. 2, the user information storage unit 22 is user information for the server device 10 to authenticate whether the access request from the client device 30 to the server device 10 is an access request by a legitimate user, for example, User ID and password are stored. The user information storage unit 22 provides the stored user information to the server device 10 in response to a request from the server device 10.

  The user file information storage unit 23 determines whether the server apparatus 10 permits the execution of the requested process in response to an execution permission request for the process (reference, update, etc.) on the confidential data from the client apparatus 30. For storing user file information. As shown in FIG. 3, the user file information includes a file name and file information of confidential data (file size, file creation date and time, file update date and time), a hash value obtained from confidential data to be described later, and the confidential data. This includes information such as the user ID and usage classification (classification of reference only or update) of the user who can process the above-mentioned information, and each of the above information is stored for each confidential data.

  The server device 10 has a function of managing whether or not the client device 30 can execute processing on confidential data acquired from the server device 10, and includes an authentication unit 12, an encryption unit 14, a public key generation unit 15, and a pseudo random number. A generation unit 16, a decryption unit 17, a domain authentication unit 18, a user file information management unit 19 and the like are provided.

  The authentication unit 12 determines that the access request from the client device 30 is a legitimate user based on the user information such as the user ID and password transmitted from the client device 30 and the user information stored in the user information storage unit 22. Authenticates whether it is an access request. When the authentication unit 12 authenticates that the access request from the client device 30 is an access request by a legitimate user, the authentication unit 12 permits the login by the client device 30.

  The domain authentication means 18 identifies the domain to which the client device 30 is connected, and authenticates whether or not the connected domain is a permitted domain. When the client device 30 is connected from an unauthorized domain, the domain authentication unit 18 rejects login by the client device 30.

  The encryption unit 14 encrypts various data transmitted from the server device 10 to the client device 30 by using the public key 2 acquired from the client device 30, and prevents the transmitted data from leaking to a third party. The public key 2 acquired from the client device 30 is generated by the client device 30 from the decryption key 2 held by the client device 30 and sent to the server device 10.

  The pseudo-random number generator 16 generates a random value for generating the decryption key 1 used when decrypting the encrypted data transmitted from the client device 30.

  The public key generation unit 15 generates the decryption key 1 from the random value generated by the pseudo random number generation unit 16. The decryption key 1 is used when the decryption unit 17 decrypts the encrypted data transmitted from the client device 30. Further, the public key generation unit 15 generates the public key 1 from the generated decryption key 1 and transmits it to the client device 30.

  The decryption means 17 decrypts the encrypted data transmitted from the client device 30 using the decryption key 1.

  The user file information management means 19 is transmitted from the client device 30 whether or not to permit the execution of the process when the client device 30 is requested to execute the process (reference or update) on the confidential data. The determination is made based on the hash value and the user file information stored in the user file information storage means 23. Further, the user file information management unit 19 stores the new hash value transmitted from the client device 30 when the client device 30 finishes the process on the confidential data in the user file information storage unit 23 as new user file information. .

  On the other hand, the client device 30 downloads a necessary program from the program storage unit 21 via the network 40, performs an authentication procedure for the server device 10, and then requests the confidential data acquired from the server device 10 by the user. A terminal that executes various processes, and includes a storage unit 31, an authentication unit 32, a hash value calculation unit 33, an encryption unit 34, a public key generation unit 35, a pseudo-random number generation unit 36, a decryption unit 37, and a data browsing unit 38. Input means 39 and the like.

  The storage unit 31 is a writable storage unit that stores various programs downloaded from the program storage unit 21, confidential data acquired from the server device 10, and the like.

  The authentication unit 32 transmits user information such as a user ID and a password input from the input unit 39 to the server device 10 during an authentication procedure for the server device 10.

  The encryption unit 34 encrypts various data to be transmitted to the server device 10 using the public key 1 acquired from the server device 10.

  The pseudo-random number generation means 36 generates a random number value for generating the decryption key 2 for decrypting the encrypted data transmitted from the server device 10.

  The public key generation unit 35 generates the decryption key 2 from the random value generated by the pseudo random number generation unit 36. Further, the public key generation means 35 generates the public key 2 from the generated decryption key 2 and transmits it to the server device 10.

  The decryption unit 37 decrypts the encrypted data transmitted from the server device 10 and encrypted with the first public key, using the decryption key 2 generated by the public key generation unit 35.

  The hash value calculation unit 33 calculates a hash value from the confidential data when requesting the server device 10 for permission to execute processing (reference, update, etc.) on the confidential data stored in the storage unit 31. Then, the calculated hash value is transmitted to the server device 10. Further, the hash value calculation unit 33 calculates a new hash value by adding a random number to the confidential data when the process for the confidential data is finished, and transmits the calculated new hash value to the server device 10. .

  The data browsing unit 38 is a dedicated data browsing unit for browsing or rewriting confidential data permitted to be processed by the server device 10.

  The input unit 39 is an input for allowing a user using the client device 30 such as a keyboard or a pointing device to input a user ID or password, or to browse or rewrite confidential data using the data browsing unit 38. Means.

  In the client device 30, the hash value calculation means 33, the encryption means 34, the public key generation means 35, the pseudo random number generation means 36, the decryption means 37, and the data browsing means 38 cooperate with each other to store data and information. It is desirable to make the state of communication invisible to the user.

[Processing of data information management system]
FIG. 4 is a flowchart showing an example of processing operation of the data information management system in the present embodiment.

  When the client device 30 intends to execute processing such as browsing or updating on confidential data acquired from the server device 10 and stored in the storage unit 31, the client device 30 transmits the processing through the network 40 in step S101. An inquiry (access request) to start using confidential data is made to the server device 10.

  On the other hand, in order to authenticate whether or not the connection from the client device 30 is a connection by a legitimate user and from a permitted domain, the server device 10 in step S102 30 is requested to send user information.

  In step S <b> 103, the authentication unit 32 of the client device 30 transmits user information such as a user ID and password input from the input unit 39 to the server device 10 via the network 40.

  In step S <b> 104, the authentication unit 12 of the server device 10 receives the information from the client device 30 based on the user information transmitted from the client device 30, such as the user ID and password, and the user information stored in the user information storage unit 22. It is inquired whether or not the access request is an access request by a legitimate user. If it is determined that the access request is not an access request by a legitimate user, login by the client device 30 is rejected and the process is terminated.

  Further, the domain authentication means 18 of the server device 10 identifies the domain to which the client device 30 is connected, determines whether or not the connected domain is a permitted domain, and is not permitted. If the connection is established, the login by the client device 30 is rejected and the process is terminated.

  When the user authentication and domain authentication in step S104 are completed normally, the client device 30 becomes accessible to the server device 10, and requests for permission to execute processing on confidential data, downloading of various programs, and the like are possible.

  In step S <b> 105, the client device 30 stores various programs such as the hash value calculation unit 33, the encryption unit 34, the public key generation unit 35, the pseudo random number generation unit 36, the decryption unit 37, and the data browsing unit 38 in the client device 30. To check if it exists. If any one of the programs does not exist in the client device 30, the necessary program is downloaded from the program storage unit 21 via the network 40 in step S 106.

  Here, the client device 30 inquires of the server device 10 whether or not the confidential data held in the storage unit 31 is data for which processing such as browsing or updating is permitted.

  On the other hand, in step S107, the user file information management means 19 of the server device 10 refers to the user file information storage means 23 and based on information such as the user ID and usage classification of the user who can process the confidential data. Thus, it is determined whether or not the confidential data is data permitted by the user for processing such as browsing and updating. As a result of the determination, if the confidential data is data that is not permitted by the user, the inquiry from the client device 30 is rejected, and the process is terminated.

  As a result of the determination in step S107, if the confidential data is data permitted by the user, in step S108, the server device 10 uses the decryption key 1 used when decrypting the encrypted data transmitted from the client device 30. Furthermore, the public key 1 is generated from the generated decryption key 1, and the generated public key 1 is sent to the client device 30. Specifically, the pseudo random number generation means 16 generates a random value for generating the decryption key 1, and the public key generation means 15 generates the decryption key 1 from the random value generated by the pseudo random number generation means 16. Further, the public key 1 is generated from the decryption key 1, and the generated public key 1 is transmitted to the client device 30 via the network 40.

  Next, in step S <b> 109, the client device 30 uses the hash value calculation unit 33 to calculate a hash value from the confidential data to be processed. Then, the encryption unit 34 encrypts the calculated hash value and the file information of the confidential data (file size, file creation date / time, file update date / time, etc.) using the public key 1 and sends it to the server device 10 on the network. Send via 40.

  Further, in step S109, the client device 30 generates the decryption key 2 used when decrypting the encrypted data transmitted from the server device 10, and further generates the public key 2 from the generated decryption key 2. The generated public key 2 is sent to the client device 30. Specifically, the pseudo random number generation means 36 generates a random number value for generating the decryption key 2, and the public key generation means 35 obtains the decryption key 2 from the random number value generated by the pseudo random number generation means 36. Further, the public key 2 is generated from the decryption key 2, and the generated public key 2 is transmitted to the client device 30 via the network 40.

  On the other hand, the server device 10 that has received the encrypted hash value and file information uses the decryption key 17 to decrypt the received hash value and file information in the decrypting means 17 in step S112. Then, the user file information management means 19 determines whether or not to permit the execution of the process on the confidential data, the decrypted hash value and file information and the user file information stored in the user file information storage means 23 ( This is determined based on the hash value and file information of the confidential data. As a result of the determination, if the execution of the process on the confidential data by the client device 30 is not permitted, the process ends.

  As a result of the determination in step S112, if the client device 30 is permitted to execute the process on the confidential data, in step S113, the server device 10 uses the encryption unit 14 to decrypt the confidential data. Is encrypted using the public key 2 obtained from the client device 30 and sent to the client device 30 via the network 40. From this point onward, data transmitted via the network 40 is transmitted after being encrypted with the public key obtained from the receiving side by the transmitting side, and the receiving side that has received the data transmits the decryption key generated in advance. It shall be decrypted with

  The client device 30 that has received the encrypted confidential data key 1 decrypts the confidential data key 1 using the decryption key 2 in the decryption means 17 in step S114.

  In step S <b> 115, the client device 30 decrypts the confidential data using the confidential data key 1, and the data browsing means 38 executes processing on the decrypted confidential data.

  Then, in step S116, the client device 30 inquires whether or not the change processing for the confidential data is permitted to the server device 10 when performing the data change processing for the confidential data, and in step S117. move on. On the other hand, when the data change process is not performed on the confidential data (when only the reference is performed), the process proceeds to step S122.

  In step S117, the server apparatus 10 determines whether or not the user file information management unit 19 permits the change process for the confidential data based on the processing classification of the user file information stored in the user file information storage unit 23. judge. As a result of the determination, if the change process for the confidential data is not permitted, the process proceeds to step S122. Conversely, if the change process for the confidential data is permitted, the process proceeds to step S118.

  In step S118, the client device 30 requests the server device 10 for a dedicated key (confidential data key 2) for encrypting the changed confidential data.

  In step S 119, the server apparatus 10 encrypts the confidential data key 2 using the public key 2 and sends it to the client apparatus 30 via the network 40.

  The client device 30 decrypts the received encrypted confidential data key 2 using the decryption key 2 in step S120, and uses the decrypted confidential data key 2 to decrypt the changed confidential data in step S121. Encrypt.

  Further, in step S122, the client device 30 generates an unknown random value of an arbitrary length by the pseudo-random number generator 36, and the hash value calculator 33 uses the generated random data to hash the confidential data. Calculate the value again.

  In step S123, the client device 30 encrypts the calculated hash value and the file information (file size, file creation date / time, file update date / time) of the confidential data using the public key 1, and the network 40 Is sent to the server device 10 via.

  In step S <b> 124, the server device 10 that has received the encrypted hash value and file information decrypts the decryption unit 17 using the decryption key 1. Then, the user file information management means 19 registers the decrypted hash value and file information as new user file information of the confidential data, overwriting the previous user file information in the user file information storage means 23. .

  As described above, according to the data information management system according to the present embodiment, whether or not to permit execution of processing for confidential data requested by a legitimate user connected from a predetermined domain is determined for each confidential data. The server device 10 determines based on the registered user file information. This user file information is updated to a new unknown value generated from confidential data to which an unknown random number is added each time confidential data is processed in the client device 30, and the user file information storage on the server device 10 side is updated. Since it is stored in the means 23, the updated new user file information is required when the client device 30 next processes the confidential data.

  For example, if the hash value calculated from the confidential data “D1” is “A0” as illustrated in FIG. 5A, the confidential data “D1” is disturbed as illustrated in FIG. 5B. The hash value calculated by adding the numerical value “R1” is “A1” which is different from “A0”. Further, each time the confidential data “D1” is processed, as illustrated in FIG. 5C, when a new unknown random value “R2” is added to calculate a hash value, the calculated hash value is “ A value different from “A0” and “A1” becomes “A2”, and as shown in FIG. 5D, a new unknown random number value “R3” is added to the changed confidential data “D2” and the hash is added. When the value is calculated, the calculated hash value becomes a completely new unknown value “A3”.

  In general, it is very difficult to estimate the original data from the hash value, and the probability that the hash values of two different data match is extremely low.

  Therefore, for example, even if a hash value is obtained based on confidential data that has been copied or altered, it is extremely difficult to reach user file information that matches the value of the user file information stored on the server device 10 side. It is. Therefore, it is possible to prevent not only a third party but also a legitimate user from copying or falsifying confidential data, and leaking to the outside.

  As mentioned above, although embodiment of this invention was described in detail, this invention can be implemented in other various forms, without deviating from the mind or main characteristics. Accordingly, the above-described embodiment is merely an example in all respects and should not be interpreted in a limited manner. The scope of the present invention is indicated by the claims, and is not restricted by the text of the specification. Further, all modifications and changes belonging to the equivalent scope of the claims are within the scope of the present invention.

It is a schematic block diagram which shows the structural example of the data information management system in one Embodiment of this invention. It is a figure which shows the data structural example of the user information storage means in the data information management system shown in FIG. It is a figure which shows the data structural example of the user file information storage means in the data information management system shown in FIG. 2 is a flowchart illustrating an example of a processing procedure of a client device and a server device in the data information management system illustrated in FIG. It is the figure which modeled the example of hash value calculation by the hash value calculation means of the client apparatus shown in FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 ... Server apparatus 12 ... Authentication means 14 ... Encryption means 15 ... Public key generation means 16 ... Pseudorandom number generation means 17 ... Decryption means 18 ... Domain authentication means 19 ... User file information management means 21 ... Program storage means 22 ... User Information storage means 23 ... User file information storage means 30 ... Client device 31 ... Storage means 32 ... Authentication means 33 ... Hash value calculation means 34 ... Encryption means 35 ... Public key generation means 36 ... Pseudorandom number generation means 37 ... Decryption means 38 ... Data browsing means 39 ... Input means 40 ... Network

Claims (1)

A data information management system in which the server device manages whether or not a process to be executed on confidential data acquired and held by the client device from the server device,
Program storage means for storing various programs for executing processing on the confidential data by the client device;
User information storage means for storing user information for the server device to authenticate whether the access request from the client device is an access request by a legitimate user;
User file information storage means for storing user file information for the server device to determine whether or not the requested processing can be executed in response to a processing execution permission request for the confidential data from the client device;
The client device is
Storage means for storing the confidential data acquired from the server device;
An authentication unit that transmits user information input from the input unit to the server device when the server device authenticates whether the access request is made by a legitimate user;
Encrypting means for acquiring and encrypting various data to be transmitted to the server device by obtaining a first public key from the server device;
Pseudo-random number generating means for generating a random value for generating a second decryption key for decrypting encrypted data transmitted from the server device;
Public key generation for generating a second decryption key from the generated random number value, generating a second public key from the generated second decryption key, and transmitting the generated second public key to the server device Means,
Decryption means for decrypting encrypted data transmitted from the server device and encrypted with the first public key, using the second decryption key;
When requesting the server apparatus to execute processing for the confidential data stored in the storage means, the hash value is calculated from the confidential data, and the calculated hash value is transmitted to the server apparatus. A hash value calculation means for calculating a new hash value by adding a random number to the confidential data and transmitting the calculated new hash value to the server device,
A dedicated data browsing means for browsing the confidential data permitted to be processed by the server device;
The server device is
Authentication for authenticating whether the access request from the client device is an access request by a legitimate user based on the user information transmitted from the client device and the user information stored in the user information storage means Means,
Domain authentication means for identifying a domain to which the client device is connected and authenticating whether the connected domain is a permitted domain;
Encryption means for acquiring and encrypting the second public key from the client device for various data to be transmitted to the client device;
A cryptographic pseudo-random number generating means for generating a random value for generating the first decryption key for decrypting encrypted data transmitted from the client device;
Generate a first decryption key from the generated random value, generate the first public key from the generated first decryption key, and transmit the generated first public key to the client device Means,
Decryption means for decrypting encrypted data transmitted from the client device using the first decryption key;
When the client device requests permission to execute processing on the confidential data, whether or not to execute the requested processing is stored in the hash value transmitted from the client device and the user file information storage means The user file information storage means that uses the new hash value transmitted from the client device as new user file information when the client device finishes the process on the confidential data. A data file management system comprising: user file information management means for storing the file information.

Images