JP2006039794A - File management system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To ensure the security of file information that is obtained as it is sent from a server to a client utilizing electronic division techniques. <P>SOLUTION: The proxy of a remote site uses an electronic division means to divide the original file into a plurality of files of varying sizes to create a first large file and a second small file. The first and second files are associated with each other and registered in the storage means of the server. When there is a request from a client to obtain files, the first file registered in the storage means is read and sent to the client. The client retains the first file in a storage means. Thereafter, when there is a request from the client to browse files, the second file retained in the storage means of the server is read and sent to the client. At the client a process of integrating together the first file previously obtained and retained and the second file obtained thereafter is implemented to restore the original file. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a file management system, and more particularly to security management when a client accesses a server via a network to acquire file information and the like.

Connect a mobile terminal device such as a mobile or notebook PC to a server at a remote site via a network such as the Internet from wherever you go to download file information or connect to a provider's site Business transactions are becoming commonplace.
In such a background, for example, when confidentiality is required for a file managed by the server, generally the file security is ensured by setting the access right for each file or encrypting the file. is doing.

  However, the protection of the file by the access right may be leaked by password hacking or the like. Even if the file is encrypted to protect the security, the encryption is decrypted if the mobile terminal device storing the file information downloaded from the server is lost or if it is stolen. There is a possibility that the file information is restored is a matter of time.

  Incidentally, it is known to use electronic tally as a technique for ensuring the security of electronic information. Electronic tally is an encryption technique in which a file is encrypted and divided into a plurality of parts, and it is impossible to restore the original file unless all the divided parts are obtained at the time of decryption. For example, in Japanese Patent Application Laid-Open No. 2003-132234 (Patent Document 1), as an example of using electronic tally, a remaining reserved portion X of electronic information is divided into a plurality of tally information Yi by an electronic tally generating means provided in a server machine. In other words, a technique is disclosed in which each is sent to a user machine through a separate communication path and restored by an electronic tally restoration means provided in the user machine.

JP 2003-132234 A

  However, the content disclosed in Patent Document 1 is a basic principle relating to the application of electronic tally to the transaction of electronic information between a server machine and a user machine using the Internet, and includes, for example, a client and a remote site. It is not specifically disclosed how tally information is generated and managed by the servers.

An object of the present invention is to ensure the security of file information acquired from a server to a client by using an electronic tally technique.
Another object of the present invention is to ensure security while improving transfer time efficiency when downloading file information from a server to a client.

The present invention relates to a file processing method in a file management system for acquiring a file from a server in accordance with a request from a client. The server side divides an original file into a plurality of files and at least a first file and a second file. And registering the first and second files in the storage means, sending the first file registered in the storage means to the client according to a request from the client, and the client The step of holding the first file in the storage unit, the step of transmitting the second file registered in the storage unit of the server to the client according to the request from the client, and the client holding the first file in the storage unit first The original first file and the second file obtained thereafter are integrated and processed as the original file. And restoring the Le a processing method of a file with a.
In the present invention, when considering the efficiency of the transfer time of the second file, when the original file is divided, the original file is divided into a plurality of files having different sizes, and the first file having a larger size and the first file having a smaller size. The second file is generated and the first file and the second file are associated with each other and registered in the storage unit.
In a preferred example, the file registered in the storage means on the server side is created by the client, and the file transmitted from the client is received by the server in accordance with the registration request from the client. The file is divided into multiple parts.
In the preferred example, the first file is stored in the file system of the file server and the second file is maintained in the remote proxy.
The present invention is also understood as a program for executing the above processing method on a server and / or a client.

  The present invention is also grasped as a file management system. Preferably, in the file management system in which the request from the client is transmitted to the remote site via the network, the server at the remote site performs processing according to the request, and the related file is transmitted to the client, the remote site has A remote proxy having electronic tally generating means for generating at least first electronic tally information and second electronic tally information by dividing the file into a plurality of files, and divided first electronic tally information and second electronic tally information; A server having storage means for storing the information in association with each other, and the client stores at least first electronic tally information acquired from the remote site, and second electronic tally acquired from the remote site. The original electronic tally information stored in the information and the storage means is integrated to restore the original file A local proxy having an encoding means, and the remote proxy obtains the first electronic tally information from the storage means and sends it to the client in response to the first request for file acquisition sent from the client In addition, in response to a second request from the client, the file management system obtains related second electronic tally information from the storage means and transmits it to the client.

  According to the present invention, since the file information is electronically tallyed and held by the client and the server, respectively, and the secret sharing is achieved, the security of the file information handled can be improved. For example, even if the portable terminal device holding the file information downloaded from the server is lost, only a part of the electronic tally file information exists in the portable terminal device. Restoration is impossible and file information leakage can be prevented.

  Also, since the larger one of the electronic tally files is held on the client side and the other smaller file is held on the server side, when restoring the file on the client, the server Since it is only necessary to download a small file, the time required for downloading can be relatively short, and the transfer time can be improved.

Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.
FIG. 1 shows the configuration of a network system to which one embodiment is applied.
The remote site 1 and the local site 2 are connected via a network 3 such as the Internet or a WAN (Wide Area Network), and communication based on, for example, HTTP is possible between the two.

  The remote site 1 includes a file management server 10 that holds and manages information about files, and a file server 13 that performs access control of a file system formed in a large-capacity storage device that stores files.

  The file management server 10 has a remote proxy 11 which is software for connecting to the network 3 and communicating information, and the remote proxy has a secret sharing processing function. This secret sharing processing function is an electronic tally function that performs processing for dividing and integrating file information by secret sharing, and is referred to as a secret sharing remote proxy (R-PROXY) 11 here. Although details will be described later, the remote proxy 11 is realized by executing a program having this function by a processor.

  On the other hand, the client in the local site 2 is, for example, a PC (personal computer) or a PC 20 such as a mobile. Although the figure shows an example in which one PC is connected to the network 3, in general, a plurality of PCs are connected. The PC 20 includes a browser 21 and a local proxy (L-PROXY) 22. The browser 21 is application software for browsing the file information acquired from the file management server 10. The browser 21 receives HTML format files, image files, and the like through the network 3, analyzes and plays back the layout, and displays them on the PC 20. Display on the instrument.

  The local proxy 22 is software for connecting the browser 21 and the network 3 and communicating information, and has a secret sharing processing function in this embodiment. This secret sharing processing function performs a process of decrypting electronically tallyed file information. This is realized by executing a program having this function by a processor.

Next, functions of the file management server 10 and the PC 20 on the client 2 side will be described with reference to FIG.
The file management server 10 has a secret sharing remote proxy 11. The secret sharing remote proxy 11 includes a basic processing unit 111, an HTTP request analysis unit 112, an HTTP request relay unit 113, an HTTP response relay unit 114, and a secret sharing processing unit 115.

The basic processing unit 111 performs basic processing such as initial setting processing and child thread creation. The HTTP request analysis unit 112 analyzes the HTTP request transmitted from the client 2. As a result of the analysis, the file server 13 is searched according to the content of the request, and the requested file information is selected.
The request relay unit 113 relays the HTTP request from the client 2 and transfers it to another application or the file server 13.
The HTTP response relay unit 114 relays the file acquired from the file server 13 for transmission to the client 2.

  The secret sharing processing unit 115 includes means for dividing a file using electronic tally into a plurality of files and means for integrating the files divided into a plurality of files.

What is characteristic in this embodiment is that the sizes of the files to be divided are made different to generate a file A1 having a large file size and a file A2 having a small file size. The size ratio of the files A1 and A2 is, for example, 99: 1. Then, the large file A1 is held in the PC 20 such as a mobile, while the small file A2 is held on the file management server 10 side. For example, the file A2 is held in the remote proxy 11. In response to the file browsing request sent from the client 2, the remote proxy 11 obtains the other file A2 of the files to be restored and sends it to the client.
Since the size of the other file A2 transmitted from the file management server 10 to the client 2 is reduced, the number of packets to be transferred is small, the download time is short, and the transfer time is saved.

On the other hand, the secret sharing local proxy 22 of the PC 20 includes a basic processing unit 221, an HTTP request unit 222, an HTTP response unit 223, a secret sharing processing unit 224, and a viewer unit 225.
Here, the basic processing unit 221 performs processing of acquiring device information such as a MAC address and a serial number as unique information and storing it in the memory. The HTTP request unit 222 relays the HTTP request generated by the PC 20 and transmits it to the remote site 1. The HTTP response unit 223 receives an HTTP response transmitted from the remote site 1.

The secret sharing processing unit 224 has means for integrating a plurality of pieces of electronic tally information. In this example, the integration unit performs a process of restoring the original file A by performing an integration process on one of the divided files A2 received from the file management server 10 and the other divided file A1.
In this embodiment, in order to restore the file information divided by the electronic tally, for example, a password such as unique information of the PC is used.

Next, a file information processing sequence in the file management system will be described with reference to FIG. FIG. 3 is a diagram showing a processing sequence for registering a file created by the user of the PC 20 in the file management server 10.
File creation and registration operations do not require the use of a mobile terminal device. A user creates a file by using an information processing apparatus such as a PC 20 installed in the company as a daily work. The created file is transferred from the client 1 to the file management server 10 via the in-house LAN and registered in the file server 13. Details will be described below.

As a premise, the created file D is pre-stored in the storage device of the PC 20 with the file name added. When a registration request instruction is issued from the browser 21, the request is relayed by the local proxy 22 and transmitted to the remote site 1 (S31).
In the remote site 1, the remote proxy 11 of the file management server 10 receives this request and transmits a registration form such as a password to the client 2 (S32).

  The registration form received by the client 2 is displayed by the browser 21. As shown in FIG. 6 as an example of the display screen, the registration screen includes input items of a registrant ID and a registered file name. The registered file name is selected by clicking the browse button. When the “OK” key on the display screen is operated, the browser 21 performs processing for uploading the user ID and file name input according to the registration form and the file D. The HTTP relay unit 222 relays this information and transmits it to the remote site 1 (S33). In general, information such as an input ID, file name, and file D is encrypted and transmitted.

The remote proxy 11 of the file management server 10 analyzes the received HTTP request (S35). If the result of analysis is a file registration request, processing for registering the received file is performed (S36).
In the registration process, the received file is first divided into two files D1 and D2 having different sizes by the electronic tally function. The size ratio of the files D1 and D2 to be divided is 99: 1. The generation of electronic tally for dividing a file into a plurality of files can be realized by using a generally known technique. In addition, division processing can be easily performed by changing the size of information to be electronically tallyed.

A file ID is assigned to the two divided files D1 and D2, and a pair of ID1 and ID2 and file information relating them are registered in a table, and this table is held in the remote proxy 11.
Of the two divided files, one file D1 having a larger size is transferred to the file server 13 and stored in the file system (S37). The other small file D2 is held in the storage means of the remote proxy 11. This storage means may be a memory or a storage function configured in software.

  When the series of registration processes is completed, an HTTP response indicating registration completion notification is transmitted from the remote proxy 11 (S38). The local proxy 22 of the client 1 receives this HTTP response and relays it to the browser 21, and the series of registration processing ends (S39).

  It is assumed that the above registration process is performed via a LAN in a secure environment from an in-house PC, and that the PC that created the file itself is not taken out as a mobile terminal PC. It is.

Next, with reference to FIG. 4, the operation of acquiring a file registered in the file server 13 will be described.
Here, the file acquisition refers to a process of downloading a large divided file to the client.
First, a request for obtaining a list for obtaining a file is issued from the client 2. The local proxy 22 receives the list acquisition request from the client 2, and the HTTP request unit 222 transmits an HTTP request including the list acquisition request to the remote site 1 (S41).

  In the remote proxy 11, the HTTP request analysis unit 112 analyzes the received HTTP request (S42). As a result of the analysis, if the file list acquisition request is included, the HTTP response relay unit 114 transmits the list of files held in the remote proxy 11 to the client 2 (S43).

  In the client 2, the received file list is processed by the browser and displayed on the display device. FIG. 7 shows an example of a file list display screen. The file list displayed on the display screen is associated with a file name and a registrant ID. The user designates a file to be acquired from this list and operates the “save” key.

  For example, as shown in FIG. 7, when the file name “BBB.doc” is designated, a general dialog for designating the storage destination of the file is displayed. The acquisition request for the file B is sent to the local proxy 22, and the HTTP request unit 222 transmits an HTTP request including the request to the remote site 1 (S44).

The HTTP request analysis unit 112 of the remote proxy 11 analyzes the received HTTP request (S45). As a result of this analysis, if the HTTP request includes a file acquisition request, it is further checked whether or not the requested file exists by referring to the registration table. As a result of this check, if the corresponding file exists, one of the divided file names (for example, the name of B1) is specified.
As a result of the above check, if one of the files B1 targeted for the file acquisition request can be identified, the HTTP request relay unit 113 relays the HTTP request and stores the file B1 obtained from the registration table. The name is added and transmitted to the file server 13 (S46).

  The file server 13 searches the file system using the name of the file B1 as a key, acquires the file B1 from the file system, and sends it to the remote proxy 11. The HTTP response relay unit 114 transmits the received one file B1 to the client 2 as an HTTP response (S47).

In the local proxy 22 of the client 2, the HTTP response unit 223 receives the HTTP response (S48). At the same time, one file B1 is also received, and the file B1 is stored in the storage device of the PC 20. This completes a series of download processes for obtaining the file B1 (S49).
As a result, a name related to the newly acquired file B is registered in the file list held in the local proxy 22. Note that the example of FIG. 4 shows an example in which the file A has already been acquired.

Next, with reference to FIG. 5, the processing operation when the other file is downloaded from the file server and the original file is restored will be described.
In the following description, file browsing means downloading the other divided small file to the client and integrating it with one large file that has already been acquired and stored in the storage device. Say the process to restore the original file.

  First, a request for browsing a file is issued from the client 2. A file to be browsed is designated by reading a file list held in the memory of the client 2 and displaying it on the screen, and selecting from the displayed contents. The browsing request is limited to files registered in this file list.

  As shown in FIG. 8 as an example of the display screen, here, two files with the file names “AAA.doc” and “BBB.doc” can be viewed and are to be downloaded. In this example, the files already held in the storage device of the PC 20 are one of the files A1 and B1 (files with larger electronic tally capacity) related to the files A and B, and the other files A2 and B2 are stored. Once downloaded, the original file can be restored and viewed. Here, it is assumed that a browsing request for file B is specified by the user.

  The local proxy 22 receives the browsing request for the file B from the client 2, and the HTTP request unit 222 transmits an HTTP request including the browsing request to the remote site 1 (S51).

  In the remote proxy 11, the HTTP request analysis unit 112 analyzes the received HTTP request (S52). If the result of this analysis is a request to browse file B, the name of the other file B2 of the requested file B is specified with reference to the registration table. Then, the file B2 held in the storage means of the remote proxy 11 is retrieved using this name as a key, and the file B2 is transmitted to the client 2 as an HTTP response (S54).

  In the local proxy 22 of the client 2, the HTTP response unit 223 receives the HTTP response and simultaneously receives the file B2 (S55). Next, the restoration process of the file B is performed by the secret sharing processing unit 224 of the local proxy 22 (S56).

In this process, the file B1 previously acquired and stored in the storage device of the PC 20 is read, and the file B1 and the newly acquired file B2 are integrated by the integrating means to restore the original file B. To do.
The original file B restored by the above processing is displayed on the display screen of the terminal device under the control of the viewer (S57).

Although one embodiment has been described above, the present invention is not limited to the above-described embodiment, and various modifications can be made.
For example, in the above-described embodiment, the other file B <b> 2 having the smaller file size is described as being held in the remote proxy 11. However, according to a modification, both of the two divided files B1 and B2 may be registered and held in the file system of the file server 13. In this case, the file browsing request transmitted from the client 2 is relayed by the HTTP request relay unit 113 and transferred to the file server 13, and the file server 13 searches the file system using the name of the file B2 as a key. The file B2 is acquired from the file system and sent to the remote proxy 11. The HTTP response relay unit 114 takes a processing step such as transmitting the received one file B2 to the client 2 as an HTTP response.

  In the above embodiment, the process of fetching a large file among the divided files into the PC 20 is referred to as file acquisition, and the process of obtaining a small file in order to restore the original file is referred to as file browsing. In short, it is significant which one of the files is a request for obtaining, and the definition or name of these terms is not limited to the above.

  In the above-described embodiment, the configuration on the remote site 10 side is described on the assumption that the file management server 11 is provided. However, the name of the file management server 11 is an example, and the function of the remote proxy 11 is the file server. 11 is an example, and is not limited to the above embodiment.

The figure which shows the structure of the network system in one Example of this invention. The figure which shows the processing function in the client and file management server of the file management system by one Example. The figure which shows the registration processing sequence of the file information in the file management system by one Example. The figure which shows the acquisition process sequence of the file information in the file management system by one Example. The figure which shows the browsing processing sequence of the file information in the file management system by one Example. The figure which shows the example of the screen display of the client by one Example. The figure which shows the example of the screen display of the client by one Example. The figure which shows the example of the screen display of the client by one Example.

Explanation of symbols

1: remote site 2: local site 10: file management server 11: secret sharing remote proxy 115: secret sharing processing unit 13: file server 20: PC 21: browser 22: secret sharing local proxy 224: secret sharing processing unit

Claims (9)

A file processing method in a file management system for acquiring a file from a server according to a request from a client,
On the server side, dividing the original file into a plurality of files to generate at least a first file and a second file, and registering the first and second files in a storage means;
Transmitting a first file registered in the storage means to the client according to a request from the client;
In the client, holding the acquired first file in a storage means;
Transmitting a second file registered in the storage means of the server to the client in accordance with a request from the client;
In the client, the step of integrating the first file previously acquired and held in the storage means and the second file acquired thereafter to restore the original file;
A file processing method characterized by comprising: The file registered in the storage means on the server side is created by a client, and further includes a step of receiving the file transmitted from the client at the server in accordance with a registration request from the client. The file processing method according to claim 1. A file processing method in a file management system for acquiring a file from a server according to a request from a client,
On the server side, the original file is divided into a plurality of files having different sizes, a first file having a larger size and a second file having a smaller size are generated, and the first and second files are associated with each other. Registering in the storage means;
Transmitting a first file registered in the storage means to the client according to a request from the client;
Holding the acquired first file in the storage means in the client;
Transmitting a second file registered in the storage means of the server to the client in accordance with a request from the client;
In the client, integrating the first file previously held in the storage means and the second file obtained thereafter to restore the original file;
A file processing method characterized by comprising: 4. The file processing method according to claim 1, wherein the first file is stored in a file system of a file server, and the second file is held in a remote proxy. 5. The file processing method according to claim 1, wherein the integration process of the first file and the second file is performed only when the input password is valid. A program for executing the method according to any one of claims 1 to 5 on a server and / or a client. In a file management system that transmits a request from a client to a remote site via a network, performs processing according to the request at a server at the remote site, and transmits a related file to the client.
The remote site includes a remote proxy having electronic tally generation means for dividing a file into a plurality of pieces and generating at least first electronic tally information and second electronic tally information, and the divided first electronic tally A server having storage means for associating and storing information and second electronic tally information,
The client stores at least the first electronic tally information obtained from the remote site, the second electronic tally information obtained from the remote site, and the second electronic tally information stored in the storage means. A local proxy having decryption means for integrating the electronic tally information of 1 to restore the original file;
In response to a first request for file acquisition transmitted from the client, the remote proxy obtains the first electronic tally information from the storage means and transmits the information to the client, and further receives a first request from the client. In response to the request of 2, the second electronic tally information related to the storage means is obtained and transmitted to the client. 8. The file management system according to claim 7, wherein a file size of the first electronic tally information is larger than a file size of the second electronic tally information. 9. The file management system according to claim 7, wherein the first file is stored in a file system of a file server, and the second file is held in a remote proxy.

Images