Data management program, information processing device, and information processing system

Abstract

To reduce the amount of data of a file that allows history management.SOLUTION: A computer receives first data indicating a first state of object data and second data indicating a second state of the object data after modification from the first state. The computer generates difference information indicating a difference between the first data and the second data. The computer generates a file including the second data and the difference information.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present invention relates to a data management program, an information processing device, and an information processing system. [Background technology]

[0002] For example, a workflow management system that manages the routing of document data among multiple users may manage a history showing modifications of the document data by those users.

[0003] In addition, an authentication information generating device has been proposed that generates a new digital signature using a new encryption key from a hash value of signed previous-generation data, which includes an old digital signature generated with the old encryption key, and a hash value of new-generation data that was generated after the previous-generation data.

[0004] Also, an electronic signature device has been proposed that inserts work data generated during a workflow into a document file as metadata, generates an electronic signature from the document file including the work data, and further inserts the generated electronic signature into the document file as metadata. When a user creates new document data corresponding to returned old document data, the proposed electronic signature device inserts the returned old document data and the old electronic signature added at the time of return into a document file including the new document data as metadata. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2002-6739 A [Patent Document 2] JP 2012-165293 A Summary of the Invention [Problem to be solved by the invention]

[0006] It is conceivable that the information processing system may store and manage history information in a file that contains the target data. Compared to a case where history information is stored outside the file, this improves the portability of the target data and makes history management more efficient.

[0007] However, depending on the format of the history information, the amount of data in the file may increase. For example, if the target data in the old state is inserted into the file in addition to the target data in the new state, the amount of data in the file may increase significantly. Therefore, in one aspect, the present invention aims to reduce the amount of data in a file that can be history managed. [Means for solving the problem]

[0008] In one embodiment, a data management program is provided that causes a computer to execute the following processes: receive first data indicating a first state of target data and second data indicating a second state of the target data after being modified from the first state; generate difference information indicating a difference between the first data and the second data; and generate a file including the second data and the difference information.

[0009] In one aspect, an information processing device is provided having a storage unit and a processing unit.In another aspect, an information processing system is provided having a first information processing device and a second information processing device. Effect of the Invention

[0010] In one aspect, the amount of data in a file that can be history managed is reduced. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a diagram illustrating an information processing system according to a first embodiment. [Diagram 2] FIG. 11 illustrates an example of an information processing system according to a second embodiment. [Diagram 3] FIG. 2 is a block diagram showing an example of hardware of a server device. [Figure 4] FIG. 13 is a diagram showing an example of a record of a file editing history using a container. [Diagram 5] FIG. 11 is a diagram illustrating an example of a procedure for generating an inspection file and a signature file. [Figure 6] FIG. 2 is a diagram illustrating an example of a container structure. [Figure 7] FIG. 13 illustrates an example of a file difference. [Figure 8] FIG. 13 is a diagram showing an example of an inspection file and a signature file. [Figure 9] FIG. 13 is a diagram illustrating an example of a result of file existence verification. [Figure 10] FIG. 13 is a diagram illustrating an example of a procedure for verifying file restoration. [Figure 11] FIG. 2 is a block diagram illustrating an example of functions of the information processing system. [Figure 12] 13 is a flowchart showing an example of a procedure for generating a container. [Figure 13] 13 is a flowchart illustrating an example of a procedure for container verification. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] The present embodiment will be described below with reference to the drawings. [First embodiment] A first embodiment will be described.

[0013] FIG. 1 is a diagram illustrating an information processing system according to a first embodiment. The information processing system of the first embodiment generates a file capable of managing the history of target data. For example, the information processing system generates a file capable of checking the revision history of document data circulated between users. The target data itself and information regarding the history are stored in the same file. The information processing system includes information processing devices 10, 20. The information processing devices 10, 20 may be client devices or server devices. The information processing devices 10, 20 may be called computers or data management devices.

[0014] The information processing device 10 receives the target data before and after the correction and generates a file. The information processing device 20 transmits the target data before and after the correction to the information processing device 10. However, the target data before and after the correction may be input by the user to the information processing device 10. Furthermore, when the information processing device 10 holds the target data before the correction, the information processing device 20 may transmit only the target data after the correction, and the user may input only the target data after the correction.

[0015] The information processing device 10 has a storage unit 11 and a processing unit 12. The information processing device 20 may have the same hardware as the information processing device 10. The storage unit 11 may be a volatile semiconductor memory such as a random access memory (RAM). The storage unit 11 may also be a non-volatile storage such as a hard disk drive (HDD) or a flash memory.

[0016] The processing unit 12 is, for example, a processor such as a central processing unit (CPU), a graphics processing unit (GPU), or a digital signal processor (DSP). However, the processing unit 12 may include an electronic circuit such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA). The processor executes a program stored in a memory such as a RAM (which may be the storage unit 11). A collection of processors may be called a multiprocessor or simply a "processor."

[0017] The storage unit 11 stores data 13 and 14. The data 13 is target data in a first state. The data 14 is target data in a second state. The second state is a state after correction from the first state. The target data may be forwarded data that is forwarded between users according to a workflow, and may be corrected by the user during forwarding. The target data may be document data, and character strings may be added or deleted.

[0018] The data 14 may be received from the information processing device 20 or may be input by a user. Furthermore, in addition to the data 14, the data 13 may be received from the information processing device 20 or may be input by a user. The information processing device 10 may accept the data 13 in a state where it is included in a file previously generated by the information processing device 10.

[0019] When the processing unit 12 receives the data 13 and 14, it generates difference information 15 indicating the difference between the data 13 and the data 14. The processing unit 12 may regard the data 13 and 14 as binary data, and the difference information 15 may indicate the difference in the binary data. Alternatively, the processing unit 12 may regard the data 13 and 14 as character string data, and the difference information 15 may indicate the difference in the character strings. The difference information 15 may indicate the addition or deletion of an element to convert one of the data 13 and 14 into the other.

[0020] Preferably, the difference information 15 indicates a conversion method for converting the data 14 into the data 13 based on the data 14. As an example, the data 13 includes Item1 and Item2, and the data 14 includes Item1 and Item3. The difference information 15 indicates a conversion method in which Item3 is deleted and Item2 is added. The processing unit 12 can restore the data 13 by applying the difference information 15 to the data 14.

[0021] The processing unit 12 generates a file 16 including the data 14 and the difference information 15. The file 16 may not include the data 13. The file 16 may be an archive file including multiple internal files and metadata indicating the file structure, or may be a compressed file compressed by a lossless compression algorithm. The processing unit 12 outputs the file 16. The processing unit 12 may store the file 16 in a non-volatile storage, or may transmit the file 16 to the information processing device 20 or another information processing device.

[0022] As described above, information processing device 10 of the first embodiment receives data 13 indicating a first state of target data and data 14 indicating a second state of the target data after it has been corrected from the first state. Information processing device 10 generates difference information 15 indicating the difference between data 13 and data 14. Then, information processing device 10 generates file 16 including data 14 and difference information 15.

[0023] This allows the information processing system to manage the history of the target data without referring to information outside the file 16. This improves the portability of the target data and makes history management more efficient. Furthermore, the file 16 includes data 14 indicating the state after modification. This allows the information processing system to efficiently check the latest state of the target data.

[0024] Moreover, the information processing system can restore data 13 indicating a state before modification by applying difference information 15 to data 14 indicating a state after modification. Therefore, file 16 does not need to include target data in an old state, and the amount of data in file 16 is reduced.

[0025] In particular, when attempting to restore the target data in a post-modification state by applying differential information to the target data in a pre-modification state, the file 16 will contain the target data in its initial state in addition to the target data in its latest state. In contrast, in the first embodiment, the file 16 does not need to contain the target data in its initial state, and the amount of data in the file 16 is reduced.

[0026] The difference information 15 may indicate a conversion method for converting the data 14 into the data 13. This allows the information processing system to efficiently restore the data 13 from the data 14. Furthermore, the information processing device 10 may generate a digest from the data 14, and generate signature information from the digest and difference information 15 using an encryption key. The file 16 may further include the digest and the signature information. Furthermore, the information processing device 10 may verify the digest and difference information 15 using the signature information, verify the data 14 using the digest, and restore the data 13 from the data 14 using the difference information 15. This ensures the authenticity of the data 14 and the difference information 15 using one piece of signature information. This reduces the amount of data in the file 16 and reduces the cost of signature management.

[0027] Moreover, the information processing device 10 may further generate other difference information for the other target data, and may generate signature information from combined information obtained by combining the difference information 15 and the other difference information using an encryption key. The file 16 may further include the other target data after correction, the other difference information, and the signature information. Moreover, the information processing device 10 may verify the difference information 15 and the other difference information using the signature information, restore the data 13 using the difference information 15, and restore the other target data before correction using the other difference information. In this way, the authenticity of the difference information of the different target data is guaranteed by one signature information. Therefore, the amount of data in the file 16 is reduced, and the cost of signature management is reduced.

[0028] [Second embodiment] Next, a second embodiment will be described. FIG. 2 illustrates an example of an information processing system according to the second embodiment.

[0029] The information processing system of the second embodiment includes client devices 31, 32, and 33 and a server device 100 connected to a network 30. The network 30 may include a wide area data communication network such as the Internet, or may include a LAN (Local Area Network). The server device 100 corresponds to the information processing device 10 of the first embodiment. The client device 31 corresponds to the information processing device 20 of the first embodiment.

[0030] The client devices 31, 32, and 33 are client computers used by different users. A user acquires a file, checks its contents, and transfers the file to the next user according to a workflow. When a user checks the contents of the file, the user may edit the file. In this manner, one or more files are forwarded between a plurality of users, and the file may be edited by one or more users during forwarding. The forwarded file may include a document file or an image file.

[0031] One or more files are inserted into an archive file called a container and forwarded. The container includes, as metadata, information about the change history of the file and signature information for guaranteeing the authenticity of the file. For example, client device 31 creates a new file and transmits a container including the created file to client device 32. Client device 32 edits the file included in the container and transfers the edited container to client device 33. Client device 33 further edits the file included in the container and returns the edited container to client device 31.

[0032] File protection using a container is performed by the server device 100. For example, when forwarding a container, the client devices 31, 32, and 33 transmit the changed file, the previous container, and the user identifier to the server device 100, and receive a new container that reflects the changed file from the server device 100.

[0033] The container may be transferred between the client devices 31, 32, and 33 via a workflow management server (not shown). In this case, the server device 100 may transparently protect files using the container between the workflow management server and the client devices 31, 32, and 33. The server device 100 may receive the previous container from the workflow management server instead of the client devices 31, 32, and 33.

[0034] The server device 100 is a server computer that provides a service of adding reliability to files by using containers. The server device 100 generates containers that contain files, and verifies the authenticity of the files contained in the containers.

[0035] The server device 100 acquires the changed file, the previous container, and the user identifier. The server device 100 then generates a difference between the changed file and the old file, and generates a container including the changed file and the difference. The server device 100 also generates a signature for guaranteeing the authenticity of the changed file and the difference, using a signature key corresponding to the user identifier, and inserts the signature into the container.

[0036] The server device 100 also acquires the container to be verified. The server device 100 then verifies the file and the differences included in the container using the signature included in the container. The server device 100 also applies the differences to the file to restore the file before the change, and verifies the file before the change. In this way, the server device 100 provides reliability to the change history indicating which user changed the file and how. Note that file verification may be performed by the client devices 31, 32, and 33.

[0037] FIG. 3 is a block diagram illustrating an example of hardware of the server device. The server device 100 has a CPU 101, a RAM 102, a HDD 103, a GPU 104, an input interface 105, a medium reader 106, and a communication interface 107, all connected to a bus. The CPU 101 corresponds to the processing unit 12 in the first embodiment. The RAM 102 or the HDD 103 corresponds to the storage unit 11 in the first embodiment. The client devices 31, 32, and 33 may each have the same hardware as the server device 100.

[0038] The CPU 101 is a processor that executes instructions of a program. The CPU 101 loads the program and data stored in the HDD 103 into the RAM 102, and executes the program. The server device 100 may have multiple processors.

[0039] The RAM 102 is a volatile semiconductor memory that temporarily stores programs executed by the CPU 101 and data used in calculations by the CPU 101. The server device 100 may have a type of volatile memory other than a RAM.

[0040] The HDD 103 is a non-volatile storage that stores software programs such as an operating system (OS), middleware, and application software, as well as data. The server device 100 may also have other types of non-volatile storage, such as a flash memory or a solid state drive (SSD).

[0041] The GPU 104 performs image processing in cooperation with the CPU 101, and outputs an image to a display device 111 connected to the server device 100. The display device 111 is, for example, a CRT (Cathode Ray Tube) display, a liquid crystal display, an organic EL (Electro Luminescence) display, or a projector. Other types of output devices, such as a printer, may be connected to the server device 100.

[0042] Furthermore, the GPU 104 may be used as a general purpose computing on graphics processing unit (GPGPU). The GPU 104 may execute a program in response to an instruction from the CPU 101. The server device 100 may include a volatile semiconductor memory other than the RAM 102 as a GPU memory.

[0043] The input interface 105 receives an input signal from an input device 112 connected to the server apparatus 100. The input device 112 is, for example, a mouse, a touch panel, or a keyboard. A plurality of input devices may be connected to the server apparatus 100.

[0044] The medium reader 106 is a reading device that reads the program and data recorded on the recording medium 113. The recording medium 113 is, for example, a magnetic disk, an optical disk, or a semiconductor memory. The magnetic disk includes a flexible disk (FD) and a HDD. The optical disk includes a compact disc (CD) and a digital versatile disc (DVD). The medium reader 106 copies the program and data read from the recording medium 113 to another recording medium such as the RAM 102 or the HDD 103. The read program may be executed by the CPU 101.

[0045] The recording medium 113 may be a portable recording medium. The recording medium 113 may be used for distributing programs and data. The recording medium 113 and the HDD 103 may be called computer-readable recording media.

[0046] The communication interface 107 communicates with the client devices 31, 32, and 33 via the network 30. The communication interface 107 may be a wired communication interface connected to a wired communication device such as a switch or a router, or a wireless communication interface connected to a wireless communication device such as a base station or an access point.

[0047] Next, history management using a container will be described. FIG. 4 is a diagram showing an example of a record of a file editing history using a container. The client device 31 generates a new file 141. Then, the server device 100 stores the file 141 in the container 140. The server device 100 also generates a signature 146 from the file 141 using a signature key corresponding to the user of the client device 31, and stores the signature 146 in the container 140.

[0048] Next, the client device 32 edits the file 141, changing the file 141 to the file 142. The server device 100 then replaces the file 141 in the container 140 with the file 142. The server device 100 also generates a difference 144 between the file 141 and the file 142, and stores the difference 144 in the container 140. The difference 144 indicates an operation for returning the file 142 to the file 141, with the file 142 as the reference. Thus, the difference 144 indicates an operation opposite to the user's editing operation.

[0049] Furthermore, server device 100 generates signature 147 from file 142 and difference 144 using a signature key corresponding to the user of client device 32, and stores signature 147 in container 140. As a result, file 142, difference 144, and signatures 146 and 147 are stored in container 140.

[0050] Next, the client device 33 edits the file 142, changing the file 142 to the file 143. The server device 100 then replaces the file 142 in the container 140 with the file 143. The server device 100 also generates a difference 145 between the file 142 and the file 143, and stores the difference 145 in the container 140. The difference 145 indicates an operation for returning the file 143 to the file 142, with the file 143 as the reference. Thus, the difference 145 indicates an operation opposite to the user's editing operation.

[0051] Furthermore, server device 100 generates signature 148 from file 143 and difference 145 using a signature key corresponding to the user of client device 33, and stores signature 148 in container 140. As a result, file 143, differences 144 and 145, and signatures 146, 147, and 148 are stored in container 140.

[0052] In verifying container 140, server device 100 verifies file 143 and difference 145 using a verification key and signature 148 corresponding to the user of client device 33. Server device 100 also verifies difference 144 using a verification key and signature 147 corresponding to the user of client device 32.

[0053] The server apparatus 100 applies difference 145 to file 143 to restore file 142. In restoring file 142, the server apparatus 100 executes the operation indicated by difference 145 on file 143. Furthermore, the server apparatus 100 applies difference 144 to file 142 to restore file 141. In restoring file 141, the server apparatus 100 executes the operation indicated by difference 144 on file 142.

[0054] The server device 100 verifies the file 141 by using the verification key and the signature 146 corresponding to the user of the client device 31. This ensures the authenticity of the initial file 141 and the latest file 143, and also ensures the authenticity of the file editing by the client devices 32 and 33.

[0055] Here, when multiple files are forwarded together, the container includes the multiple files. In this case, if an individual signature is generated for each file, the amount of data in the container may increase, and the cost of signature management may increase. Therefore, the server device 100 generates one signature for multiple files, as described below.

[0056] FIG. 5 is a diagram showing an example of a procedure for generating a check file and a signature file. The server device 100 obtains the changed files, the previous container, and the user identifier. The server device 100 extracts the pre-change files from the previous container. The server device 100 performs file name matching between the changed files and the pre-change files to obtain a union of the files. The server device 100 generates an inspection record 157 for each file included in the union in the manner described below.

[0057] File 151 is the file after the change. Old file 152 is the file before the change, which has the same file name as file 151. However, if file 151 is a file that was recently added, old file 152 does not exist. Also, if old file 152 was recently deleted, file 151 does not exist.

[0058] The server device 100 identifies the file name 153 from the file 151 or the old file 152. The server device 100 also generates a digest 154 from the file 151. The digest 154 is, for example, a hash value calculated from the file 151 using a hash function. If the file 151 does not exist, the digest 154 is empty.

[0059] In addition, the server device 100 generates a difference 155 between the file 151 and the old file 152. The difference 155 indicates an operation for restoring the old file 152 from the file 151. If the file 151 does not exist, the difference 155 is the content of the old file 152 itself. If the old file 152 does not exist, the difference 155 is empty.

[0060] The server device 100 determines the change type 156 based on the difference 155. The change type 156 is added, edited, deleted, or no change. If the old file 152 does not exist, the change type 156 is "added". If the file 151 and the old file 152 exist and the difference 155 is not empty, the change type 156 is "edited". If the file 151 does not exist, the change type 156 is "deleted". If the file 151 and the old file 152 exist and the difference 155 is empty, the change type 156 is "no change".

[0061] The server device 100 combines the file name 153, the digest 154, the difference 155, and the change type 156 to generate an inspection record 157. The server device 100 inserts into an inspection file 163 a plurality of inspection records corresponding to a plurality of files.

[0062] The server device 100 generates a signature file 164 from the check file 163. Specifically, the server device 100 reads out a signature key 161 and a verification key certificate 162 corresponding to the received user identifier. The signature key 161 is, for example, a private key used in public key cryptography. The verification key certificate 162 includes a verification key corresponding to the signature key 161. The verification key is, for example, a public key used in public key cryptography.

[0063] The server device 100 generates a digest for the entire check file 163, and performs cryptographic processing to convert the digest into a signature using the signature key 161. This signature does not correspond to an individual file, but corresponds to the entire set of multiple files. The server device 100 inserts the signature and verification key certificate 162 into the signature file 164. The server device 100 stores the check file 163 and the signature file 164 in a container.

[0064] Note that the server device 100 may generate other characteristic values ​​related to the file 151, instead of generating the digest 154 from the file 151. Also, the server device 100 may generate other characteristic values ​​related to the inspection file 163, instead of generating a digest from the inspection file 163. Also, the server device 100 may determine the change type 156 by comparing the digest 154 of the file 151 with the digest of the old file 152, instead of determining the change type 156 from the difference 155.

[0065] Furthermore, the server device 100 may integrate the check file 163 and the signature file 164 into a single file. Furthermore, in the second embodiment, the check file 163 and the signature file 164 are written in a lightweight text format called JSON, but may be written in other data formats. Furthermore, when the data amount of the difference 155 is larger than that of the old file 152, the server device 100 may store the old file 152 itself instead of the difference 155. Furthermore, when the deleted old file 152 does not need to be restored, the server device 100 may empty the difference 155. Whether or not restoration is unnecessary may be specified by the user.

[0066] FIG. 6 illustrates an example of a container structure. The container 170 is an archive file including files 171 and 172 and a directory 173. The files 171 and 172 are files included in the latest file group. The file 171 is a document file, and the file 172 is an image file. The directory 173 stores metadata.

[0067] Directory 173 includes inspection files 174, 175, 176 and signature files 177, 178, 179. Inspection file 174 and signature file 177 are first generation inspection files and signature files corresponding to the files in the initial state. Inspection file 175 and signature file 178 are second generation inspection files and signature files corresponding to the files in the intermediate state. Inspection file 176 and signature file 179 are third generation inspection files and signature files corresponding to the files in the latest state. In this way, inspection files and signature files are accumulated in directory 173.

[0068] FIG. 7 illustrates an example of a file difference. As described above, the server device 100 compares the file 151 with the old file 152 to generate the difference 155. The difference 155 indicates the add operation, change operation, and delete operation for restoring the old file 152 from the file 151. The difference 155 converts the file 151 into the old file 152 at the binary data level. However, for simplicity of explanation, an example of converting the file 151 into the old file 152 at the character string level will be explained here.

[0069] For example, DELTA++ is used to generate the difference 155. DELTA++ is described in, for example, the following non-patent document: Nikolai Samteladze and Ken Christensen, "DELTA++: Reducing the Size of Android Application Updates", IEEE (Institute of Electrical and Electronics Engineers) Internet Computing, Volume 18, Issue 2, pp. 50-57, March-April 2014.

[0070] Difference 155 includes a ctrl block, a diff block, and an extra block. The ctrl block includes one or more triplet records. The triplet indicates the number of changed bytes, the number of added bytes, and the number of deleted bytes. The diff block lists a number to be added to the byte string contained in file 151. A number to be added of 0 indicates that a character from file 151 is to be copied. The numbers in the diff block are used with the triplet indicating the number of changed bytes. The extra block lists a string to be added to file 151. The string in the extra block is used with the triplet indicating the number of added bytes.

[0071] When restoring the old file 152 from the file 151, the server device 100 repeats changing character strings by adding numerical values, adding character strings, and deleting character strings, according to the triplet included in the ctrl block.

[0072] As an example, old file 152 contains "abcdefh1234567ABCDEFG" and file 151 contains "abcdefg234567". When editing old file 152, the user changes "h" to "g", deletes "1", and deletes "ABCDEFG". Here, it is assumed that one character is represented by one byte.

[0073] The ctrl block of difference 155 contains the triple [7,1,0],[6,7,0]. The diff block of difference 155 contains the byte sequence "0000001000000". The extra block of difference 155 contains the string "1ABCDEFG".

[0074] When restoring old file 152 from file 151, server device 100 extracts a byte string of 7 bytes, which is the number of changed bytes in the first triplet, from the diff block and adds it to the first 7 bytes of file 151. This changes "abcdefg" to "abcdefh". Next, server device 100 extracts a character of 1 byte, which is the number of added bytes in the first triplet, from the extra block and inserts it at the current position of file 151. This inserts "1" after "abcdefh".

[0075] Next, the server device 100 skips characters from the current position of the file 151 by 0 bytes, which is the number of bytes to delete in the first triplet. Skipping characters is equivalent to deleting characters. In this case, no characters are skipped.

[0076] Next, server device 100 extracts 6 bytes, which is the changed byte count of the second triplet, from the diff block and adds this to the 6-byte byte string from the current position of file 151. As a result, "234567" is maintained as is. Next, server device 100 extracts 7 bytes, which is the added byte count of the second triplet, from the extra block and inserts this at the current position of file 151. As a result, "ABCDEFG" is inserted after "234567".

[0077] Next, the server device 100 skips characters from the current position of the file 151 by 0 bytes, which is the number of bytes to delete in the second triplet. In this case, no characters are skipped. This converts the file 151 to the old file 152.

[0078] FIG. 8 is a diagram showing an example of the check file and the signature file. Check file 174 includes check records corresponding to file 171 and file 172. Each check record includes a file name, a difference, a change type, and a digest. If the change type is an addition or no change, the difference is null. If the change type is a deletion, the difference is the old file itself. If the change type is a deletion, the digest is null.

[0079] The server device 100 generates a signature file 177 from the check file 174. The signature file 177 includes the file name of the check file 174, the signature of the check file 174, and a verification key certificate. The signature of the check file 174 is generated by encrypting a digest of the entire check file 174 with the signature key of the user who changed the files. The verification key certificate includes the verification key of the user who changed the files.

[0080] Next, the verification of the container will be described. When verifying a container, the server device 100 extracts the signature and verification key from the signature file, and uses the verification key to encrypt the signature to restore the digest. The server device 100 generates a digest of the inspection file and compares it with the digest restored from the signature. In this way, the server device 100 verifies the inspection file. If the digests match, the verification is successful, and if the digests do not match, the verification is unsuccessful. The server device 100 verifies the inspection files of one or more generations using the above method.

[0081] Next, the server device 100 extracts a digest from the latest generation inspection file. The server device 100 generates digests of the files included in the container and compares them with the digests extracted from the inspection file. In this way, the server device 100 verifies the latest files. If the digests match, the verification is successful, and if the digests do not match, the verification is unsuccessful. The server device 100 verifies each of the one or more files included in the container by the above method.

[0082] Next, the server device 100 performs file existence verification for each file name. In the file existence verification, the server device 100 extracts change types from one or more generations of the inspection file and judges the consistency between the set of change types and the presence or absence of files in the container. In this way, the server device 100 verifies the contents of the inspection file. If the set of change types and the presence or absence of files are consistent, the verification is successful, and if they are inconsistent, the verification is unsuccessful.

[0083] Next, the server device 100 performs file restoration verification for each file name. In the file restoration verification, the server device 100 extracts the difference and the change type from the latest generation inspection file. If the change type is editing, the server device 100 applies the difference to the latest state file to restore the file to the previous state. The server device 100 repeats extracting the difference and the change type from the previous generation inspection file and restoring the file to the previous state up to the generation where the change type is addition. This restores the file to its initial state.

[0084] The server device 100 extracts a digest from the inspection file of a generation in which the change type is addition. The server device 100 generates a digest of the file in its initial state and compares it with the digest extracted from the inspection file. In this way, the server device 100 verifies the file in its initial state. If the digests match, the verification is successful, and if the digests do not match, the verification is unsuccessful. The server device 100 verifies the initial state of each of one or more files included in a container using the above method.

[0085] FIG. 9 is a diagram showing an example of a result of the file existence verification. Table 165 shows the results of the file existence verification. In the file existence verification, the server device 100 identifies a set of change types for each file name. The server device 100 counts the number of times the change type is an addition and the number of times the change type is a deletion, and calculates a numerical value by subtracting the number of deletions from the number of additions. If the calculated numerical value is positive, the server device 100 presumes that the file exists in the container. If the calculated numerical value is zero or less, the server device 100 presumes that the file does not exist in the container.

[0086] As an example, the change type of the first file is addition and editing. In this case, the server device 100 presumes that the first file exists in the container. In fact, it is assumed that the first file exists in the container. In this case, the server device 100 determines that the file existence verification of the first file is successful.

[0087] The change type of the second file is addition and deletion. In this case, the server device 100 presumes that the second file does not exist in the container. In fact, it is assumed that the second file does not exist in the container. In that case, the server device 100 determines that the file existence verification of the second file is successful.

[0088] The change type of the third file is edit and no change. In this case, the server device 100 presumes that the third file does not exist in the container. On the other hand, it is assumed that the third file exists in the container. In this case, the server device 100 determines that the file existence verification of the third file has failed.

[0089] The change type of the fourth file is addition and deletion. In this case, the server device 100 presumes that the fourth file does not exist in the container. On the other hand, it is assumed that the fourth file exists in the container. In this case, the server device 100 determines that the file existence verification of the fourth file has failed.

[0090] FIG. 10 is a diagram showing an example of a procedure for verifying file restoration. The server device 100 extracts, from the inspection file 176, a change type corresponding to the file name of the file 171 included in the container 170. Because the change type is editing, the server device 100 extracts a difference from the inspection file 176 and applies it to the file 171, thereby restoring the file 171a to its previous state. Next, the server device 100 extracts, from the inspection file 175, a change type corresponding to the file name of the file 171. Because the change type is editing, the server device 100 extracts a difference from the inspection file 175 and applies it to the file 171a, thereby restoring the file 171b to its previous state.

[0091] Next, the server device 100 extracts the change type corresponding to the file name of the file 171 from the check file 174. Because the change type is addition, the server device 100 extracts a digest from the check file 174. The server device 100 generates a digest of the file 171b and compares it with the extracted digest.

[0092] If the change type of a certain generation is no change and the digest included in the inspection file of that generation does not match the digest included in the inspection file of the previous generation, the server device 100 may determine that the verification has failed without restoring the file in its initial state. Also, the server device 100 may cache inspection files that are inspection files after the generation in which the change type is addition and that include the change type of addition or editing during the above-mentioned file existence verification, thereby suppressing reloading of the inspection files.

[0093] The server device 100 may also execute file restoration verification for multiple files included in a container in parallel using different processors. The server device 100 may also determine whether digests match for files in an intermediate state. For example, the server device 100 may extract a digest from the inspection file 174 and compare it with a digest generated from the file 171a. The server device 100 may also execute the file restoration verification for deleted files not included in a container by restoring the files to their original state immediately before deletion from the differences included in the inspection file.

[0094] Next, the functions and processing procedures of the information processing system will be described. FIG. 11 is a block diagram illustrating an example of functions of the information processing system. The server device 100 includes a key storage unit 121 , a communication unit 122 , a container extraction unit 123 , a difference generation unit 124 , a digest generation unit 125 , a combining unit 126 , a signature unit 127 , a container generation unit 128 , and a container verification unit 129 .

[0095] The key storage unit 121 is implemented, for example, by using the RAM 102 or the HDD 103. The communication unit 122 is implemented, for example, by using the CPU 101, the communication interface 107, and a program. The container extraction unit 123, the difference generation unit 124, the digest generation unit 125, the combining unit 126, the signature unit 127, the container generation unit 128, and the container verification unit 129 are implemented, for example, by using the CPU 101 and a program.

[0096] The key storage unit 121 stores, in association with each of a plurality of user identifiers, the signature key and the verification key certificate of the user indicated by the user identifier. The verification key included in the verification key certificate corresponds to the signature key. For example, the signature key is a private key of public key cryptography, and the verification key is a public key corresponding to the private key. The verification key certificate includes, for example, a signature generated for the verification key using the signature key of a certification authority. The verification key certificate guarantees the authenticity of the user's verification key.

[0097] The communication unit 122 communicates with the client devices 31, 32, and 33. The communication unit 122 may also communicate with other information processing devices, such as a workflow management server. When creating a container, the communication unit 122 receives the changed file, the previous container, and a user identifier. Then, the communication unit 122 transmits the new container. When verifying a container, the communication unit 122 receives the container and transmits the verification result.

[0098] The container extraction unit 123 extracts a container received by the communication unit 122. In extracting a container, the container extraction unit 123 extracts the file body, the inspection file of each generation, and the signature file of each generation from the container, which is an archive file. If the container is a compressed file, the container extraction unit 123 may decompress the container.

[0099] The difference generation unit 124 generates a difference between the changed file received by the communication unit 122 and the old file extracted by the container extraction unit 123. The difference generation unit 124 regards the changed file and the old file as binary data, and generates a difference at the binary data level. The difference indicates an operation for returning the changed file to the old file. The difference generation unit 124 also determines the type of change based on the generated difference. The type of change is any one of addition, editing, deletion, and no change.

[0100] The digest generation unit 125 generates a digest of the changed file received by the communication unit 122. The digest is, for example, a hash value of the changed file. The combining unit 126 combines the file name, the difference, the change type, and the digest for each file to generate an inspection record. The combining unit 126 inserts the inspection records of one or more files into an inspection file to generate the inspection file.

[0101] The signature unit 127 searches the key storage unit 121 for a signature key and a verification key certificate corresponding to the user identifier received by the communication unit 122. The signature unit 127 generates a digest from the entire inspection file generated by the combination unit 126, and generates a signature using the signature key. The signature unit 127 inserts the signature and the verification key certificate into the signature file to generate the signature file.

[0102] The container generation unit 128 generates a new container. The container generation unit 128 inserts the changed file, the inspection file and the signature file extracted by the container expansion unit 123, the inspection file generated by the combining unit 126, and the signature file generated by the signature unit 127 into the new container. The container is formed into one file as an archive file. The container may be compressed.

[0103] The container verification unit 129 verifies the authenticity of the latest file and its change history by using the latest file, the inspection file of each generation, and the signature file of each generation extracted by the container expansion unit 123. At that time, the container verification unit 129 extracts a verification key from the verification key certificate included in the signature file, and uses it to verify the signature included in the signature file.

[0104] The client device 31 has a container storage unit 131, a file editing unit 132, and a communication unit 133. The container storage unit 131 is implemented using, for example, a RAM or a HDD. The file editing unit 132 is implemented using, for example, a CPU and a program. The communication unit 133 is implemented using a CPU, a communication interface, and a program. The client devices 32 and 33 may have the same functions as the client device 31.

[0105] The container storage unit 131 stores the container sent to the client device 31. However, the container may be sent to the client device 31 in an expanded state. Also, only the latest file may be sent to the client device 31.

[0106] The file editing unit 132 edits files in response to user operations. The file editing unit 132 may add a new file or delete an existing file that has been forwarded to the client device 31.

[0107] The communication unit 133 communicates with the server device 100. The communication unit 133 transmits the changed file, the previous container, and the user identifier of the user who uses the client device 31 to the server device 100. The communication unit 133 receives a new container that reflects the file change from the server device 100. In addition, the communication unit 133 transmits the container to the server device 100 and receives the verification result of the container from the server device 100.

[0108] However, when editing a file or verifying a container, instead of the client device 31 sending a container to the server device 100, the server device 100 may obtain a container from another information processing device such as a workflow management server. Also, when editing a file, instead of the server device 100 sending a new container to the client device 31, the new container may be stored in another information processing device such as a workflow management server.

[0109] FIG. 12 is a flowchart illustrating an example of a procedure for generating a container. (S10) The communication unit 122 receives the changed file, the previous container, and the user identifier. The container extraction unit 123 extracts the previous container and extracts the old file, the inspection files of each generation, and the signature files of each generation.

[0110] (S11) The difference generation unit 124 selects one file name. The parent set of file names is the union of the file names of the changed file and the file names of the old file. The difference generation unit 124 generates a difference between the changed file having the selected file name and the old file. However, it may happen that either the changed file or the old file does not exist. The difference generation unit 124 determines the change type from the generated difference.

[0111] (S12) If a changed file having the selected file name exists, the digest generating unit 125 generates a digest of the changed file. (S13) The difference generation unit 124 judges whether all the file names have been selected in step S11. If all the file names have been selected, the process proceeds to step S14. If there are any file names that have not been selected, the process returns to step S11.

[0112] (S14) The combining unit 126 selects one file name. The combining unit 126 registers the file name and the change type in the inspection record corresponding to the selected file name. The combining unit 126 also initializes the difference and digest items of the inspection record to blank. The combining unit 126 determines whether the change type is editing or deletion. If the change type is editing or deletion, the process proceeds to step S15. If the change type is addition or no change, the process proceeds to step S16.

[0113] (S15) The combining unit 126 registers the generated difference in the inspection record. (S16) The combining unit 126 judges whether the change type is addition, editing, or no change. If the change type is addition, editing, or no change, the process proceeds to step S17. If the change type is deletion, the process proceeds to step S18.

[0114] (S17) The combining unit 126 registers the generated digest in the inspection record. (S18) The combining unit 126 adds the examination record to the examination file. (S19) The combining unit 126 determines whether all file names have been selected in step S14. If all file names have been selected, the process proceeds to step S20. If there are file names that have not been selected, the process returns to step S14.

[0115] (S20) Signature unit 127 reads out the signature key and verification key certificate corresponding to the received user identifier. Signature unit 127 generates a digest of the check file, and generates a signature file from the digest using the signature key.

[0116] (S21) The container generation unit 128 generates a new container. The new container includes the changed file, the inspection file and signature file extracted from the previous container, the generated inspection file, and the generated signature file.

[0117] FIG. 13 is a flowchart showing an example of a procedure for container verification. (S30) The container verification unit 129 selects one signature file included in the container. The container verification unit 129 extracts a verification key from a verification key certificate included in the signature file, and restores a digest from the signature included in the signature file using the verification key.

[0118] (S31) The container verification unit 129 generates a digest of the inspection file corresponding to the selected signature file, and compares it with the digest restored in step S30. If the digests do not match, it is determined that the verification has failed.

[0119] (S32) The container verification unit 129 determines whether or not all generations of signature files have been selected in step S30. If all generations of signature files have been selected, the process proceeds to step S33. If there are any unselected signature files, the process returns to step S30.

[0120] (S33) The container verification unit 129 extracts a digest from the latest generation inspection file. Note that steps S33 and S34 are executed for each file name. (S34) The container verification unit 129 generates a digest of the latest file included in the container and compares it with the digest extracted in step S33. If the digests do not match, it is determined that the verification has failed.

[0121] (S35) The container verification unit 129 extracts the change type from all generations of inspection files for each file name, and estimates whether the current file exists based on the set of change types. If the number of additions minus the number of deletions is positive, it is estimated that the file exists. If the number is zero or less, it is estimated that the file does not exist.

[0122] (S36) The container verification unit 129 compares the actual presence or absence of a file in the container with the estimation result of step S35. If the estimation and the actual state do not match, it is determined that the verification has failed. (S37) The container verification unit 129 preferentially selects one inspection file from the newest generation. The container verification unit 129 extracts the change type from the selected inspection file. The container verification unit 129 determines whether the change type is addition. If the change type is addition, the process proceeds to step S40, and otherwise the process proceeds to step S38. Note that steps S37, S38, and S39 are executed for each file name.

[0123] (S38) The container verification unit 129 determines whether the change type is editing. If the change type is editing, the process proceeds to step S39; otherwise, the process returns to step S37. (S39) The container verification unit 129 extracts the difference from the selected inspection file. The container verification unit 129 applies the difference to the file to restore the file to its previous state. Then, the process returns to step S37.

[0124] (S40) The container verifying unit 129 extracts a digest from the inspection file currently selected in step S37. (S41) The container verification unit 129 generates a digest of the restored file in its initial state and compares it with the digest extracted in step S40. If the digests do not match, it is determined that the verification has failed. Note that, in the flow of FIG. 13, if it is determined that the verification has failed in any step, the subsequent processes may be skipped.

[0125] As described above, the server device 100 of the second embodiment generates a container that includes the difference and the signature in addition to the managed file. This enables history management without referring to external information, improves file portability, and makes history management more efficient. In addition, the reliability of the latest file and the change history leading up to the latest file is improved.

[0126] In addition, the container includes files in their latest state. This allows files in their latest state to be displayed quickly. In addition, the container includes a difference for restoring a file to the previous state for each generation. This allows files in each state prior to the latest state to be restored even if the container does not include files in their initial state, and reduces the amount of data in the container.

[0127] The container also includes an inspection file and a signature file for each generation. The inspection file includes multiple inspection records corresponding to multiple files. The inspection record includes a digest and differences of the files. The signature file includes a signature generated from the entire inspection file. This eliminates the need for the container to include an individual signature for each file, reducing the amount of data in the container. Also, the number of signatures is reduced, lowering the cost of signature management. Also, a single signature guarantees the authenticity of the contents and differences of multiple files.

[0128] The server device 100 also tracks the types of changes contained in the inspection files of multiple generations to detect any inconsistencies with the presence or absence of actual files in the container. This detects any unauthorized use of the inspection files, improving the reliability of the container. The server device 100 also restores the file in its initial state using the differences, and verifies the authenticity of the file in its initial state using the signature. The server device 100 may further verify the authenticity of the file in the intermediate state. This ensures the authenticity of the changes to the file during transfer. [Explanation of symbols]

[0129] 10,20 Information processing device 11 Storage section 12 Processing section 13,14 Data 15 Difference information 16 Files

Claims

1. receiving first data indicating a first state of the target data and second data indicating a second state of the target data after being modified from the first state; generating difference information indicating a difference between the first data and the second data; generating a file including the second data and the difference information; A data management program that causes a computer to carry out processing.

2. the difference information indicates a conversion method for converting the second data into the first data; The data management program according to claim 1.

3. generating a digest from the second data, and generating signature information from the digest and the difference information by using an encryption key; the file further includes the digest and the signature information. The data management program according to claim 1.

4. and further causing the computer to execute a process of verifying the digest and the difference information using the signature information, verifying the second data using the digest, and restoring the first data from the second data using the difference information.

4. The data management program according to claim 3.

5. receiving the first data and the second data includes a process of further receiving third data indicating a third state of the other target data and fourth data indicating a fourth state of the other target data after being corrected from the third state; generating the difference information includes a process of further generating other difference information indicating a difference between the third data and the fourth data; generating signature information from combined information obtained by combining the difference information and the other difference information by using an encryption key; the file further includes the fourth data, the other difference information, and the signature information. The data management program according to claim 1.

6. and further causing the computer to execute a process of verifying the difference information and the other difference information using the signature information, restoring the first data from the second data using the difference information, and restoring the third data from the fourth data using the other difference information.

6. The data management program according to claim 5.

7. a storage unit that stores first data indicating a first state of target data and second data indicating a second state of the target data after being corrected from the first state; a processing unit that generates difference information indicating a difference between the first data and the second data, and generates a file including the second data and the difference information; An information processing device having the above configuration.

8. A first information processing device that transmits first data indicating a first state of target data and second data indicating a second state of the target data after being corrected from the first state; a second information processing device that receives the first data and the second data, generates difference information indicating a difference between the first data and the second data, and generates a file including the second data and the difference information; An information processing system having the above configuration.

Images