Data management program, data management apparatus, and data management system

Abstract

To ensure the security of data.SOLUTION: A data management server 201 suspends, in uploading a file 1000, transmitting / receiving the file 1000 on receipt of data of a predetermined size, out of data of the file 1000 to be sequentially transmitted from a client device 202. The data management server 201 generates shared data 1011, 1012, 1013 from received communication data 1010 through secret sharing scheme. The data management server 201 transfers the generated shared data 1011, 1012, 1013 to different storage spaces (clouds A, B, C), respectively. The data management server 201 restarts transmitting / receiving the file 1000 when the shared data 1011, 1012, 1013 are completely transferred. The data management server 201 performs the same processing on the next data in the file 1000, after receiving data of a predetermined size.SELECTED DRAWING: Figure 10A

Description

[Technical field]

[0001] The present invention relates to a data management program, a data management device, and a data management system. [Background technology]

[0002] In recent years, data has come to be stored in external storage environments such as cloud environments. For example, in cloud services, which are external storage environments, the service provider often promises to guarantee the security of data through a contract.

[0003] Prior art techniques include a technique in which, when data is being created at a terminal, data being edited and stored in a volatile memory is supplied to a storage controller at any time, and the storage controller secretly distributes the data being edited supplied from the terminal and stores it in multiple storage devices.

[0004] There is also a technology that uses secret sharing to generate b (a≦b) pieces of partial data from important data, from which at least a pieces of data must be collected to restore the important data, and stores the b pieces of partial data and the b copies in 2b servers. With this technology, c (a≦c≦b) different pieces of partial data or copies for restoring the important data are collected from c servers, and the important data is restored from the c pieces of partial data or copies using secret sharing.

[0005] In addition, when original data is distributed and stored in two or more distributed storage devices connected via a network, there is a technique in which the data is read out for each specified bit, the read data is divided into two or more divided data pieces using a specified logic, and each divided data piece is transferred to two or more storage devices. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] JP 2016-103048 A [Patent Document 2] JP 2013-20314 A [Patent Document 3] JP 2009-140518 A Summary of the Invention [Problem to be solved by the invention]

[0007] However, with conventional technology, there is a possibility that a cloud service administrator or other party may leak data through malicious acts, making it difficult to guarantee data security.

[0008] In one aspect, the present invention aims to ensure data security. [Means for solving the problem]

[0009] In one embodiment, a data management program is provided which, when uploading target data, each time a predetermined size of data is received from the target data transmitted sequentially from an upload requester, generates a plurality of encrypted distributed data from the received data of the predetermined size, at least before all of the target data is received, and transfers each of the generated distributed data to a different storage destination. Effect of the Invention

[0010] Advantageous Effects of Invention According to one aspect of the present invention, there is an effect that data security can be guaranteed. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is an explanatory diagram illustrating an example of a data management device 101 according to an embodiment. [Diagram 2] FIG. 2 is an explanatory diagram showing an example of the system configuration of the data management system 200. As shown in FIG. [Diagram 3] FIG. 3 is a block diagram showing an example of the hardware configuration of the data management server 201. As shown in FIG. [Figure 4] FIG. 4 is an explanatory diagram showing an example of the contents stored in the user information table 400. As shown in FIG. [Diagram 5] FIG. 5 is an explanatory diagram showing an example of the contents of the file information table 500. As shown in FIG. [Figure 6] FIG. 6 is an explanatory diagram showing an example of the contents of the file division information table 600. As shown in FIG. [Figure 7] FIG. 7 is an explanatory diagram showing an example of the contents of the file secret sharing information table 700. As shown in FIG. [Figure 8] FIG. 8 is an explanatory diagram showing an example of the contents of the file secret sharing storage location information table 800. As shown in FIG. [Figure 9] FIG. 9 is a block diagram showing an example of the functional configuration of the data management server 201. As shown in FIG. [Figure 10A] FIG. 10A is an explanatory diagram (part 1) showing an example of the operation of data management system 200 during upload. [Figure 10B] FIG. 10B is an explanatory diagram (part 2) showing an example of the operation of the data management system 200 during upload. [Figure 11A] FIG. 11A is an explanatory diagram (part 1) showing an example of an operation of the data management system 200 during downloading. [Figure 11B] FIG. 11B is an explanatory diagram (part 2) showing an example of the operation of the data management system 200 during downloading. [Figure 12] FIG. 12 is a flowchart (part 1) showing an example of a data management process procedure at the time of uploading in the data management server 201. [Figure 13] FIG. 13 is a flowchart (part 2) illustrating an example of the data management process procedure at the time of uploading in the data management server 201. [Figure 14] FIG. 14 is a flowchart showing an example of a data management process procedure at the time of downloading by the data management server 201. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of a data management program, a data management device, and a data management system according to the present invention will be described in detail with reference to the accompanying drawings.

[0013] (Embodiment) Example of operation Fig. 1 is an explanatory diagram showing an example of a data management device 101 according to an embodiment. In Fig. 1, the data management device 101 is a computer that manages data. The data is data to be uploaded (target data). The data is, for example, a file including confidential information.

[0014] Conventionally, data was stored in, for example, an end point device such as a PC (Personal Computer), in hardware connected to the end point, or in a shared environment (such as a network server) within an organization. Recently, data has come to be stored in storage environments outside an organization, such as a cloud environment.

[0015] In cloud services, which are storage environments outside of an organization, the service provider often promises to guarantee data security through contracts, but there is still a risk that cloud service administrators or others may leak data through malicious acts.

[0016] Here, as a conventional technique for ensuring the security of data on the cloud, there is a technique in which data stored on the cloud service side is divided into multiple secret shared data, and each of the multiple secret shared data is stored in a different storage location. With this conventional technique, even if an administrator on the cloud side where the actual data (secret shared data) is stored maliciously accesses the data, the data alone is meaningless.

[0017] For example, assume that a user uploads and saves an information file on a contract cloud from a terminal such as a PC or a smartphone. The contract cloud is a cloud for which the user has signed a service contract, and is the upload destination cloud to which the user sends the information file.

[0018] In this case, in the conventional technology, the uploaded information file is divided into multiple secret sharing data by the secret sharing method in the contract cloud, and the multiple secret sharing data are stored in different external clouds. Each secret sharing data is meaningless by itself. Therefore, even if an administrator of the external cloud where the actual data (secret sharing data) is stored maliciously accesses the secret sharing data, the security of the data is guaranteed.

[0019] However, in the conventional technology, the uploaded information file exists on the contract cloud even if only temporarily in order to perform secret sharing, which means that there is a possibility that the administrator of the contract cloud may maliciously leak the information file when it is uploaded to the contract cloud.

[0020] In this embodiment, therefore, a data management device 101 that ensures data security (safety) by preventing complete data from existing even temporarily when uploading target data will be described. Here, a processing example of the data management device 101 will be described.

[0021] When uploading target data, the data management device 101 receives the target data sequentially transmitted from the upload request source. In the example of Fig. 1, the target data is "information file 110" and the upload request source is "terminal 102".

[0022] In this case, when uploading the information file 110, the data of the information file 110 is transmitted sequentially from the beginning during communication from the terminal 102 to the data management device 101. Then, the data management device 101 sequentially receives the data of the information file 110 transmitted sequentially from the terminal 102.

[0023] Every time the data management device 101 receives a predetermined size of data from the information file 110, the data management device 101 generates a plurality of encrypted distributed data from the received predetermined size of data at least before receiving the entire information file 110. Then, the data management device 101 transfers the generated plurality of distributed data to different storage destinations.

[0024] Here, the predetermined size can be set arbitrarily. For example, the predetermined size may be set according to the data size of the information file 110, or may be a fixed value. Each of the multiple pieces of shared data generated from the data of the predetermined size is data that does not have meaning by itself. The multiple pieces of shared data are generated, for example, by a secret sharing technique.

[0025] Here, it is assumed that the information file 110 includes first data 111 and second data 112. The first data 111 and the second data 112 are each data of a predetermined size. The first data 111 is transmitted to the data management device 101 before the second data 112.

[0026] In this case, when the data management device 101 receives the first data 111 of the information file 110, it generates encrypted distributed data 111-1 to 111-3 from the received first data 111 before receiving the second data 112. Then, the data management device 101 transfers the generated distributed data 111-1 to 111-3 to different storage destinations 103-1 to 103-3, respectively.

[0027] The storage destinations 103-1 to 103-3 are provided, for example, in different data storage devices (for example, data storage servers S1 to Sn shown in FIG. 2 described later) outside the data management device 101. Specifically, for example, the storage destinations 103-1 to 103-3 are provided by different cloud services. Note that transferring the distributed data to the storage destination corresponds to transmitting the distributed data to the storage destination and storing (saving) the distributed data in the storage destination.

[0028] For example, when the data management device 101 receives the first data 111, the data management device 101 may control the terminal 102 to stop the transmission process of the information file 110. Then, the data management device 101 may control the terminal 102 to resume the transmission process of the information file 110 after transferring the generated distributed data 111-1 to 111-3 to the different storage destinations 103-1 to 103-3, respectively.

[0029] Each of the shared data 111-1 to 111-3 is data (e.g., secret shared data) that does not have meaning by itself. The first data 111 can be restored, for example, by collecting all of the shared data 111-1 to 111-3 or a predetermined number (e.g., 2) of the shared data 111-1 to 111-3.

[0030] When the distributed data 111-1 to 111-3 are generated from the first data 111, the original data (first data 111) does not remain on the data management device 101. When the distributed data 111-1 to 111-3 are transferred, the distributed data 111-1 to 111-3 do not remain on the data management device 101.

[0031] Furthermore, after transferring the distributed data 111-1 to 111-3, when the data management device 101 receives the second data 112 of the information file 110, the data management device 101 generates encrypted distributed data 112-1 to 112-3 from the received second data 112. Then, the data management device 101 transfers the generated distributed data 112-1 to 112-3 to different storage destinations 103-1 to 103-3, respectively.

[0032] Each of the distributed data 112-1 to 112-3 is data that does not have meaning by itself. The second data 112 can be restored, for example, by collecting all of the distributed data 112-1 to 112-3 or a predetermined number (for example, 2) of the distributed data 112-1 to 112-3.

[0033] When the distributed data 112-1 to 112-3 are generated from the second data 112, the source data (second data 112) does not remain on the data management device 101. When the distributed data 112-1 to 112-3 are transferred, the distributed data 112-1 to 112-3 do not remain on the data management device 101.

[0034] In this way, according to the data management device 101, when uploading the information file 110, the security of the information file 110 can be ensured by ensuring that the complete file does not exist even temporarily on the upload destination device.

[0035] Furthermore, the data (distributed data 111-1, etc.) stored in each of the storage destinations 103-1 to 103-3 has no meaning by itself. Therefore, even if an administrator of each of the storage destinations 103-1 to 103-3 maliciously accesses the data, the data in the information file 110 can be prevented from leaking out.

[0036] In the above description, a case has been described in which, after the distributed data 111-1 to 111-3 generated from the first data 111 are transferred, the transmission process for the information file 110 by the terminal 102 is resumed and the second data 112 is received, but this is not limited to the case.

[0037] For example, at the point in time when the distributed data 111-1 to 111-3 are generated from the first data 111, the original data (first data 111) no longer exists in the data management device 101. For this reason, after generating the distributed data 111-1 to 111-3 from the first data 111, the data management device 101 may, for example, resume the transmission process of the information file 110 by the terminal 102 and receive the second data 112.

[0038] However, before the distributed data 111-1 to 111-3 are transferred, all of the distributed data 111-1 to 111-3 are available on the data management device 101, and there is a possibility that the first data 111 may be illegally decrypted from the distributed data 111-1 to 111-3. Therefore, it is preferable that the data management device 101 starts receiving the second data 112 after the distributed data 111-1 to 111-3 generated from the first data 111 have been transferred.

[0039] (System configuration example of data management system 200) Next, a system configuration example of a data management system 200 including the data management device 101 shown in Fig. 1 will be described. Here, a case where the data management device 101 shown in Fig. 1 is applied to a data management server 201 in the data management system 200 will be described as an example.

[0040] Fig. 2 is an explanatory diagram showing an example of a system configuration of a data management system 200. In Fig. 2, the data management system 200 includes a data management server 201, a client device 202, and data storage servers S1 to Sn (n: a natural number equal to or greater than 2). In the data management system 200, the data management server 201, the client device 202, and the data storage servers S1 to Sn are connected via a wired or wireless network 210. The network 210 is, for example, the Internet, a LAN (Local Area Network), or a WAN (Wide Area Network).

[0041] Here, the data management server 201 is a computer that has a data management table 220 and manages data. The data management server 201 is a computer for providing a service (online storage service) for uploading (storing) data on a cloud and downloading data from the cloud, for example.

[0042] Various types of information relating to data management are stored in the data management table 220. The contents stored in the data management table 220 will be described later with reference to FIGS.

[0043] The client device 202 is a computer used by a user of the data management system 200. The user is, for example, a person who uploads and downloads data. The client device 202 is, for example, a PC, a tablet PC, a smartphone, etc. The terminal 102 shown in FIG. 1 corresponds to, for example, the client device 202.

[0044] The data storage servers S1 to Sn are computers (data storage devices) that store data. Each of the data storage servers S1 to Sn provides, for example, a different cloud service. The cloud service provided by each of the data storage servers S1 to Sn is, for example, an external cloud service different from the cloud service provided by the data management server 201.

[0045] In the following description, any one of the data storage servers S1 to Sn may be referred to as a "data storage server Si" (i=1, 2, ..., n). The storage destinations 103-1 to 103-3 shown in Fig. 1 correspond to, for example, the data storage servers S1 to Sn.

[0046] Although only one client device 202 is shown in the example of FIG. 2, the data management system 200 may include multiple client devices 202 .

[0047] (Example of hardware configuration of data management server 201) Next, an example of the hardware configuration of the data management server 201 will be described.

[0048] Fig. 3 is a block diagram showing an example of the hardware configuration of the data management server 201. In Fig. 3, the data management server 201 has a CPU (Central Processing Unit) 301, a memory 302, a disk drive 303, a disk 304, a communication I / F (Interface) 305, a portable recording medium I / F 306, and a portable recording medium 307. Furthermore, each component is connected to each other via a bus 300.

[0049] Here, the CPU 301 is responsible for the overall control of the data management server 201. The CPU 301 may have multiple cores. The memory 302 has, for example, a read only memory (ROM), a random access memory (RAM), and a flash ROM. Specifically, for example, the flash ROM stores an OS program, the ROM stores an application program, and the RAM is used as a work area for the CPU 301. The programs stored in the memory 302 are loaded into the CPU 301 to cause the CPU 301 to execute the coded processes.

[0050] The disk drive 303 controls reading / writing of data from / to the disk 304 under the control of the CPU 301. The disk 304 stores data written under the control of the disk drive 303. The disk 304 is, for example, a magnetic disk, an optical disk, or the like.

[0051] The communication I / F 305 is connected to the network 210 through a communication line, and is connected to an external computer (for example, the client device 202 and data storage servers S1 to Sn shown in FIG. 2) via the network 210. The communication I / F 305 manages the interface between the network 210 and the inside of the device, and controls input and output of data from the external computer. The communication I / F 305 is, for example, a modem or a LAN adapter.

[0052] The portable recording medium I / F 306 controls reading / writing of data from / to the portable recording medium 307 under the control of the CPU 301. The portable recording medium 307 stores data written under the control of the portable recording medium I / F 306. The portable recording medium 307 is, for example, a CD (Compact Disc)-ROM, a DVD (Digital Versatile Disk), or a USB (Universal Serial Bus) memory.

[0053] In addition to the above-mentioned components, the data management server 201 may have, for example, an input device, a display, etc. Furthermore, the data management server 201 may not have, for example, the portable recording medium I / F 306 and the portable recording medium 307 among the above-mentioned components. Furthermore, the client device 202 and the data storage servers S1 to Sn shown in FIG. 2 can also be realized by the same hardware configuration as the data management server 201. However, the client device 202 has, for example, an input device, a display, etc. in addition to the above-mentioned components.

[0054] (Storage contents of data management table 220) Next, the contents stored in the data management table 220 of the data management server 201 will be described with reference to Fig. 4 to Fig. 8. The data management table 220 includes various tables as shown in Fig. 4 to Fig. 8. The data management table 220 is realized by a storage device such as the memory 302 and the disk 304 shown in Fig. 3.

[0055] Fig. 4 is an explanatory diagram showing an example of the contents stored in the user information table 400. In Fig. 4, the user information table 400 has fields for a user management number, a user name, and a password hash, and stores user information (for example, user information 400-1) as a record by setting information in each field.

[0056] Here, the user management number is an identifier that uniquely identifies a user of the data management system 200. The user name is the name of the user. The password hash is a hash value obtained by applying the user's password to a hash function.

[0057] Fig. 5 is an explanatory diagram showing an example of the contents stored in file information table 500. In Fig. 5, file information table 500 has fields for file information No., name, creation date and time, update date and time, size, creator, and updater, and stores file information (for example, file information 500-1) as a record by setting information in each field.

[0058] Here, the file information No. is an identifier that uniquely identifies the file. The name is the name of the file (file name). The creation date and time is the date and time when the file was created. The update date and time is the date and time when the file was updated. The size is the data size of the file. The creator is the person who created the file. The updater is the person who updated the file.

[0059] Fig. 6 is an explanatory diagram showing an example of the contents stored in the file division information table 600. In Fig. 6, the file division information table 600 has fields for file information No., division number, and division management No., and stores file division information (for example, file division information 600-1) as a record by setting information in each field.

[0060] Here, the file information No. is an identifier that uniquely identifies a file. The division number is the number of divisions into which a file is divided (e.g., the number of pieces of data of a predetermined size). The division management No. is an identifier for managing communication data into which a file is divided (e.g., the number of pieces of data of a predetermined size).

[0061] Fig. 7 is an explanatory diagram showing an example of the contents stored in the file secret sharing information table 700. In Fig. 7, the file secret sharing information table 700 has fields for file information No., division management No., division management branch number, secret sharing number, and secret sharing branch number, and stores file secret sharing information (for example, file secret sharing information 700-1) as a record by setting information in each field.

[0062] Here, the file information No is an identifier that uniquely identifies a file. The division management No is an identifier for managing communication data obtained by dividing a file. The division management branch number, when combined with the division management No, uniquely identifies communication data obtained by dividing a file. The secret sharing number is an identifier for managing shared data generated from communication data. The secret sharing branch number, when combined with the secret sharing number, uniquely identifies shared data generated from communication data.

[0063] Fig. 8 is an explanatory diagram showing an example of the contents of the file secret sharing storage location information table 800. In Fig. 8, the file secret sharing storage location information table 800 has fields of file information No., secret sharing number, secret sharing branch number, storage destination, storage destination access information 1, and storage destination access information 2. By setting information in each field, the file secret sharing storage location information (for example, file secret sharing storage location information 800-1) is stored as a record.

[0064] Here, the file information No is an identifier that uniquely identifies a file. The secret sharing number is an identifier for managing the shared data generated from the communication data. The secret sharing branch number, when combined with the secret sharing number, uniquely identifies the shared data generated from the communication data.

[0065] The destination is the destination where the distributed data is to be saved (stored). The destination is provided in, for example, any of the data storage servers Si among the data storage servers S1 to Sn shown in Fig. 2. The destination access information 1 is a user name for accessing the destination. The destination access information 2 is a password for accessing the destination.

[0066] Although not shown in the drawings, the data management table 220 may include information on storage locations and access rights (read / write rights) assigned to users, for example.

[0067] (Example of functional configuration of data management server 201) Next, an example of the functional configuration of the data management server 201 will be described.

[0068] Fig. 9 is a block diagram showing an example of a functional configuration of the data management server 201. In Fig. 9, the data management server 201 includes a reception unit 901, a communication control unit 902, a generation / transfer unit 903, and a restoration / transfer unit 904. The reception unit 901 to the restoration / transfer unit 904 are functions that constitute the control unit 900, and specifically, the functions are realized by causing the CPU 301 to execute a program stored in a storage device such as the memory 302, the disk 304, or the portable recording medium 307 shown in Fig. 3, or by the communication I / F 305. The processing results of each functional unit are stored in a storage device such as the memory 302 or the disk 304.

[0069] The reception unit 901 receives a request to upload target data. Here, the upload request is, for example, a request to upload the target data to a cloud environment. The target data is, for example, a file including personal information, customer information, technical information, and the like.

[0070] Specifically, for example, the receiving unit 901 receives a request to upload target data from the client device 202 shown in Fig. 2. However, if the user who has made the upload request has not yet logged in, the receiving unit 901 may execute a login process for user authentication. The login process is performed using, for example, a user name and a password.

[0071] To explain in more detail, for example, first, the reception unit 901 receives authentication information from the client device 202. The authentication information includes, for example, a user name, a password, and the like inputted on a login screen (not shown). Next, the reception unit 901 authenticates the user based on the received authentication information.

[0072] For example, the reception unit 901 refers to the user information table 400 shown in Fig. 4 to identify a password hash that is included in the authentication information and corresponds to a user name. Then, the reception unit 901 compares the identified password hash with the hash value of the password included in the authentication information.

[0073] If the password hash matches, the reception unit 901 authenticates the user (authentication OK). On the other hand, if the password hash does not match, the reception unit 901 does not authenticate the user (authentication NG). Also, if the reception unit 901 cannot identify the password hash that corresponds to the user name included in the authentication information, the reception unit 901 does not authenticate the user (authentication NG).

[0074] Then, when the receiving unit 901 authenticates the user (authentication OK), it receives a request to upload the target data from the client device 202. The upload request includes information on the target file, such as the name (file name), creation date and time, update date and time, size, creator, updater, etc.

[0075] When an upload request for target data is accepted, new file information is registered in, for example, the file information table 500 shown in Fig. 5. The new file information includes, for example, the name (file name), creation date and time, update date and time, size, creator, updater, etc., included in the upload request. The file information No. is assigned by, for example, the data management server 201.

[0076] The communication control unit 902 receives the target data sequentially transmitted from the upload request source when uploading the target data. Specifically, for example, the communication control unit 902 receives the target data sequentially transmitted from the upload request source client device 202 when uploading the target data in response to the accepted upload request.

[0077] In the following description, a "target file #" may be used as an example of target data. The target file # is a collection of data. When uploading of the target file # is started, data of the target file # is sequentially transmitted from the client device 202 to the data management server 201 via the network 210.

[0078] Furthermore, the communications control unit 902 performs control so as to stop the transmission process of the target file # by the upload request source every time a predetermined size of data of the target file # is received. Here, the predetermined size can be set arbitrarily. The predetermined size is set, for example, according to the data size of the target file #.

[0079] For example, the predetermined size may be set to a value that divides the target file # into m parts, where m is a natural number equal to or greater than 2 and may be set to any value. For example, if "m=3", the predetermined size may be set to a number of bytes that divides the target file # into three parts. The data size of the target file # is identified, for example, from the size in the file information table 500 shown in FIG. 5.

[0080] For example, if the data size of the target file # is "12 [kB]" and "m = 3", the specified size may be set to "4 [kB] (= 12 [kB] / 3)". Also, if the data size of the target file # is "11 [kB]" and "m = 3", the specified size may be set to "4 [kB]". In this case, the first processing size when receiving the target file # will be "4 [kB]". The second specified size will be "4 [kB]". The third specified size will be the remaining "3 [kB]".

[0081] The specified size may also be a predetermined fixed value (a fixed number of bytes). For example, assume that the data size of the target file # is "12 [kB]" and the specified size is "5 [kB]." In this case, the first processing size when receiving the target file # will be "5 [kB]." The second specified size will be "5 [kB]." The third specified size will be the remaining "2 [kB]."

[0082] The number of divisions of the target file # into which the file is divided by a predetermined size is managed, for example, in association with the file information No. of the target file # by a file division information table 600 as shown in Fig. 6. The division management No. is assigned, for example, by the data management server 201.

[0083] Specifically, for example, when the communications control unit 902 receives a predetermined size (e.g., 4 kB) of data of the target file #, it controls the network 210 to put the transmission and reception of the target file # between the client device 202 and the data management server 201 on hold. Putting it on hold is a process of suspending the transmission and reception of data, which is performed when an overflow occurs on the receiving side. For example, when the transmission and reception of the target file # is put on hold, the transmission process of the target file # by the client device 202 (the upload requester) is temporarily stopped.

[0084] The generating / transferring unit 903 generates a plurality of encrypted distributed data from the received data of a predetermined size before at least all of the target file # is received, and transfers the generated plurality of distributed data to different storage destinations. The timing for generating and transferring the plurality of distributed data may be any timing, for example, before all of the target file # is received.

[0085] For example, before the next data of a predetermined size of the target file # is received, the generating / transferring unit 903 may generate a plurality of encrypted distributed data from the received data of a predetermined size and transfer the generated plurality of distributed data to different storage destinations. For example, the generating / transferring unit 903 generates and transfers a plurality of distributed data while the transmission process for the target file # is stopped by the communication control unit 902.

[0086] When a predetermined size of data is received, there may be no unreceived data in the target file # (all of the target file # has been received). In this case, the generation / transfer unit 903 generates multiple pieces of encrypted distributed data from the received data of the predetermined size, and transfers the generated multiple pieces of distributed data to different storage destinations.

[0087] Specifically, for example, the generation / transfer unit 903 generates k pieces of shared data (k: a natural number equal to or greater than 2) from the received data of a predetermined size by a secret sharing technique. Here, secret sharing is an encryption technique, and is a technique for dividing data into shared data (e.g., fragments of random numbers) that have no meaning by themselves and concealing the data. In the secret sharing technique, the original data can be restored by collecting all of the k pieces of shared data or a predetermined number of the k pieces of shared data.

[0088] More specifically, for example, the generating / transferring unit 903 encrypts received data of a predetermined size using an existing secret sharing library. Next, the generating / transferring unit 903 divides the encrypted data into k pieces (the divided data cannot be inferred because they are encrypted). The generating / transferring unit 903 then encrypts the k pieces of divided data to generate k pieces of shared data (ensuring that decryption is not possible unless the required number of pieces is available).

[0089] The information for identifying the generated shared data is managed, for example, in association with the division management number by a file secret sharing information table 700 as shown in Fig. 7. The secret sharing number is assigned by, for example, the data management server 201.

[0090] Then, the generation / transfer unit 903 transfers the generated k pieces of distributed data to different storage destinations. The different storage destinations are provided by different cloud services, for example. The different cloud services are realized by different data storage servers Si.

[0091] Here, it is sufficient that the shared data generated from the same data are stored in different locations, and the shared data generated from different data may be stored in the same location. Information specifying the storage location of the shared data is managed by the file secret sharing storage location information table 800 as shown in FIG. 8 in association with the secret sharing number, for example.

[0092] When uploading the target file #, if multiple pieces of distributed data are generated from a predetermined size of data, the original data (predetermined size of data) does not remain on the data management server 201. In addition, when distributed data generated from a predetermined size of data is transferred, the distributed data does not remain on the data management server 201.

[0093] Furthermore, the communication control unit 902 controls the upload request source to resume transmission processing of the target file # after the multiple generated distributed data are transferred to different storage destinations. Specifically, for example, when the transfer of the multiple distributed data is completed, the communication control unit 902 controls the network 210 to resume transmission and reception of the target file # between the client device 202 / data management server 201.

[0094] In the following description, the data of a predetermined size contained in the target file # and from which multiple pieces of distributed data were generated may be referred to as "communication data".

[0095] The reception unit 901 also receives a download request for the target file #. Here, the download request is, for example, a request to download the target file # from a cloud environment. Specifically, for example, the download request for the target file # is received from the client device 202 to receive the download request.

[0096] The download request includes information such as the name (file name) of the target file and the file information No. If the user who has made the download request has not yet logged in, the receiving unit 901 may execute a login process for user authentication.

[0097] When downloading the target file #, the communication control unit 902 acquires, for each piece of communication data included in the target file #, a plurality of pieces of distributed data corresponding to the communication data from different storage locations. Specifically, for example, the communication control unit 902 refers to the file information table 500 to identify the file information No. corresponding to the file name included in the received download request. However, the file information No. may be included in the download request.

[0098] Next, the communication control unit 902 refers to the file division information table 600 to identify the division number and division management No. corresponding to the identified file information No. Then, the communication control unit 902 acquires, for each of the communication data of the identified number of divisions, a plurality of distributed data corresponding to the communication data from different storage locations.

[0099] More specifically, for example, the communication control unit 902 refers to the file secret sharing information table 700 in ascending order of communication data with the smallest division management branch number of the identified division management No. and identifies the secret sharing number corresponding to the division management branch number of the division management No. Next, the communication control unit 902 refers to the file secret sharing storage location information table 800 shown in Fig. 8 in ascending order of shared data with the smallest secret sharing branch number of the identified secret sharing number and identifies the storage destination, storage destination access information 1, and storage destination access information 2 corresponding to the secret sharing branch number of the secret sharing number.

[0100] Then, the communication control unit 902 accesses the identified storage destination and performs authentication processing using the identified storage destination access information 1 and storage destination access information 2. The authentication processing is executed by the data storage server Si corresponding to the storage destination. Here, if the authentication is successful, the communication control unit 902 acquires the distributed data from the accessed storage destination. Note that if the authentication fails, the download of the target file # results in an error.

[0101] As a result, the communication control unit 902 obtains shared data (e.g., k pieces of shared data) corresponding to all secret sharing branch numbers of the secret sharing number. The communication control unit 902 also obtains multiple pieces of shared data (e.g., k pieces of shared data) for each communication data included in the target file # by incrementing the division management branch number of the division management No and performing the same process.

[0102] The restoration / transfer unit 904 restores, for each communication data included in the target file #, the communication data from the multiple acquired distributed data so that it does not coexist on its own server with other communication data included in the target file #, and transfers the restored communication data to the download request source.

[0103] For example, assume that communication data is transferred to the download request source in sequence starting from the first communication data in the target file #. In this case, the restoration / transfer unit 904 may restore communication data from the acquired multiple pieces of distributed data for each piece of communication data included in the target file # before restoring the next communication data included in the target file #, and transfer the restored communication data to the download request source. In this way, the restoration / transfer unit 904 can prevent multiple pieces of communication data included in the target file # from coexisting on its own server.

[0104] Specifically, for example, the restoration / transfer unit 904 restores the communication data from the acquired k pieces of shared data by a secret sharing technique. Then, the restoration / transfer unit 904 transfers the restored communication data to the client device 202 that has requested the download. The client device 202 that has requested the download sequentially receives the communication data, and when reception of all the communication data is completed, the download of the target file # is completed.

[0105] When the communication data is restored from the multiple distributed data acquired during download of the target file #, the data from which it is restored (the multiple distributed data) does not remain on the data management server 201. Moreover, when the communication data is transferred to the download request source, the communication data does not remain on the data management server 201.

[0106] (Example of operation of data management system 200) Next, a description will be given of an example of the operation of the data management system 200. First, a description will be given of an example of the operation of the data management system 200 during uploading, with reference to Figs. 10A and 10B.

[0107] 10A and 10B are explanatory diagrams showing an example of the operation at the time of uploading of the data management system 200. In Fig. 10A, it is assumed that the target file # is "file 1000" and the file 1000 is uploaded from the client device 202 to the contract cloud X.

[0108] The contract cloud X is a cloud service for which the user of the client device 202 has signed a usage contract, and is a cloud service for the user to upload and download the target file #. The contract cloud X corresponds to a storage environment outside the organization of the requesting user. Here, the contract cloud X is provided by the data management server 201.

[0109] When uploading the file 1000 from the client device 202 to the data management server 201 of the contract cloud X, data of the file 1000 is sequentially transmitted and received in communication between the client device 202 and the data management server 201.

[0110] When the data management server 201 receives a predetermined size of data of the file 1000 sequentially transmitted from the client device 202, the data management server 201 controls the client device 202 to stop transmitting the file 1000. Here, it is assumed that the predetermined size is set to "xx bytes" so that the file 1000 is divided into three.

[0111] In this case, when the data management server 201 receives xx bytes of communication data 1010 from the beginning of the file 1000, it controls the network 210 to put the transmission and reception of the file 1000 between the client device 202 and the data management server 201 on hold.

[0112] Next, the data management server 201 generates k pieces of shared data from the received communication data 1010 by a secret sharing technique. Here, k is set to 3. In this case, shared data 1011, 1012, and 1013 are generated from the communication data 1010.

[0113] The data management server 201 then transfers the three generated distributed data 1011, 1012, and 1013 to different storage destinations. Here, the storage destination of the distributed data 1011 is assumed to be "data storage server S1 of cloud A." The storage destination of the distributed data 1012 is assumed to be "data storage server S2 of cloud B." The storage destination of the distributed data 1013 is assumed to be "data storage server S2 of cloud C." Clouds A, B, and C are different cloud services outside of the contract cloud X.

[0114] When the transfer of the distributed data 1011, 1012, and 1013 is completed, the data management server 201 controls the network 210 to resume transmission and reception of the file 1000 between the client device 202 and the data management server 201. This causes the client device 202 to resume the transmission process of the file 1000.

[0115] Thereafter, when the data management server 201 receives xx bytes of communication data 1020 in the middle of the file 1000, it controls the network 210 to put the transmission and reception of the file 1000 between the client device 202 and the data management server 201 on hold.

[0116] Next, the data management server 201 uses a secret sharing technique to generate three pieces of shared data 1021, 1022, and 1023 from the received communication data 1020. Then, the data management server 201 transfers the generated three pieces of shared data 1021, 1022, and 1023 to different storage destinations.

[0117] Here, the storage destination of the distributed data 1021 is "data storage server S1 of cloud A." The storage destination of the distributed data 1022 is "data storage server S2 of cloud B." The storage destination of the distributed data 1023 is "data storage server S2 of cloud C."

[0118] When the transfer of the distributed data 1021, 1022, and 1023 is completed, the data management server 201 controls the network 210 to resume transmission and reception of the file 1000 between the client device 202 and the data management server 201. This causes the transmission process of the file 1000 by the client device 202 to be resumed.

[0119] In FIG. 10B, when the data management server 201 receives the remaining xx bytes of communication data 1030 of the file 1000, it controls the network 210 to put the transmission and reception of the file 1000 between the client device 202 and the data management server 201 on hold.

[0120] Next, the data management server 201 uses a secret sharing technique to generate three pieces of shared data 1031, 1032, and 1033 from the received communication data 1030. Then, the data management server 201 transfers the generated three pieces of shared data 1031, 1032, and 1033 to different storage destinations.

[0121] Here, the storage destination of the distributed data 1031 is "data storage server S1 of cloud A." The storage destination of the distributed data 1032 is "data storage server S2 of cloud B." The storage destination of the distributed data 1033 is "data storage server S2 of cloud C."

[0122] This completes the upload of the file 1000. In this way, according to the data management server 201, when secret sharing is performed at the time of uploading the file 1000, the security of the file 1000 can be guaranteed by preventing the complete file from temporarily existing in the contract cloud X, which is the upload destination.

[0123] For example, since the complete file 1000 does not exist even temporarily in the contract cloud X, which is the upload destination, the risk of the administrator of the contract cloud X or the like leaking the file 1000 due to malicious acts can be reduced. Also, the data (distributed data 1011, etc.) stored in each of the clouds A, B, and C has no meaning by itself. Therefore, even if the administrator of each of the clouds A, B, and C maliciously accesses the data, it is possible to prevent the data of the file 1000 from being leaked.

[0124] Next, an example of the operation of the data management system 200 during downloading will be described with reference to FIGS. 11A and 11B.

[0125] 11A and 11B are explanatory diagrams showing an example of the operation during downloading of the data management system 200. In FIG. 11A, it is assumed that the target file # is “file 1000” and the file 1000 is downloaded from the contract cloud X to the client device 202.

[0126] First, the data management server 201 acquires distributed data 1011, 1012, and 1013 corresponding to communication data 1010 included in a file 1000 from different storage destinations. Here, the data management server 201 acquires distributed data 1011 from a data storage server S1 of cloud A. The data management server 201 acquires distributed data 1012 from a data storage server S2 of cloud B. The data management server 201 acquires distributed data 1013 from a data storage server S3 of cloud C.

[0127] Each of the communication data 1010, 1020, and 1030 included in the file 1000 is identified, for example, from the file information table 500 and the file division information table 600. Also, the shared data corresponding to each of the communication data 1010, 1020, and 1030 is identified, for example, from the file secret sharing information table 700. Also, the storage destination of the shared data is identified, for example, from the file secret sharing storage location information table 800.

[0128] Next, the data management server 201 restores the communication data 1010 from the acquired shared data 1011, 1012, and 1013 by using a secret sharing technique. Then, the data management server 201 transfers the restored communication data 1010 to the client device 202 that has made the download request.

[0129] As a result, the data management server 201 transfers the communication data 1010 to the client device 202 before restoring the other communication data 1020 and 1030 included in the file 1000 .

[0130] Next, the data management server 201 acquires distributed data 1021, 1022, and 1023 corresponding to the communication data 1020 included in the file 1000 from different storage destinations. Here, the data management server 201 acquires the distributed data 1021 from the data storage server S1 of cloud A. The data management server 201 acquires the distributed data 1022 from the data storage server S2 of cloud B. The data management server 201 acquires the distributed data 1023 from the data storage server S3 of cloud C.

[0131] Next, the data management server 201 restores the communication data 1020 from the acquired shared data 1021, 1022, and 1023 by using a secret sharing technique. Then, the data management server 201 transfers the restored communication data 1020 to the client device 202 that has made the download request.

[0132] As a result, the data management server 201 transfers the communication data 1020 to the client device 202 before restoring the other communication data 1030 included in the file 1000 .

[0133] 11B, the data management server 201 acquires distributed data 1031, 1032, and 1033 corresponding to communication data 1030 included in a file 1000 from different storage destinations. Here, the data management server 201 acquires distributed data 1031 from a data storage server S1 of cloud A. The data management server 201 acquires distributed data 1032 from a data storage server S2 of cloud B. The data management server 201 acquires distributed data 1033 from a data storage server S3 of cloud C.

[0134] Next, the data management server 201 restores the communication data 1030 from the acquired shared data 1031, 1032, and 1033 by using a secret sharing technique. Then, the data management server 201 transfers the restored communication data 1030 to the client device 202 that has made the download request.

[0135] When the data management server 201 completes the transfer of the communication data 1030, the download of the file 1000 in the client device 202 is completed. In this way, according to the data management server 201, when the file 1000 is downloaded, the complete file is prevented from temporarily existing in the contract cloud X, thereby ensuring the security of the file 1000.

[0136] For example, when restoring data at the time of downloading, the complete file 1000 does not exist even temporarily in the contract cloud X, so the risk of an administrator of the contract cloud X or the like leaking the file 1000 through malicious acts can be reduced.

[0137] (Various processing procedures of the data management server 201) Next, a description will be given of various processing procedures of the data management server 201. First, a data management processing procedure during uploading by the data management server 201 will be described with reference to Figs.

[0138] 12 and 13 are flowcharts showing an example of a data management processing procedure during uploading by the data management server 201. In the flowchart of Fig. 12, first, the data management server 201 determines whether or not it has received an upload request for the target file # from the client device 202 (step S1201).

[0139] Here, the data management server 201 waits to receive an upload request (step S1201: No). If the data management server 201 receives an upload request (step S1201: Yes), the data management server 201 registers file information in the file information table 500 (step S1202).

[0140] The file information includes, for example, the name (file name), creation date and time, update date and time, size, creator, and updater included in the upload request. In addition, the file information includes a file information number assigned by the data management server 201.

[0141] Next, the data management server 201 identifies the division size (predetermined size) and the number of divisions of the target file # from the size of the target file # (step S1203). Then, the data management server 201 registers the file division information in the file division information table 600 (step S1204).

[0142] The file division information includes the file information No. of the target file # and the specified number of divisions. Also, the division management No. given by the data management server 201 is set in the file division information.

[0143] Then, the data management server 201 transmits an instruction to start uploading to the client device 202 (step S1205). Upon receiving the instruction to start uploading from the data management server 201, the client device 202 starts a transmission process for the target file #. As a result, the data of the target file # is sequentially transmitted from the client device 202 to the data management server 201.

[0144] Next, the data management server 201 determines whether or not the reception of the data of the specified division size of the target file # is completed (step S1206). Here, the data management server 201 waits until the reception of the data of the division size is completed (step S1206: Yes). When the reception of the data of the division size is completed (step S1206: Yes), the data management server 201 determines whether or not there is any data of the target file # that has not been received (step S1207).

[0145] Incidentally, even if reception of all data of the target file # is completed in step S1206, the data management server 201 proceeds to step S1207.

[0146] If there is unreceived data (step S1207: Yes), the data management server 201 controls the network 210 to suspend the transmission and reception of the target file # between the client device 202 / data management server 201 (step S1208), and proceeds to step S1301 shown in FIG. 13.

[0147] If there is no unreceived data (step S1207: No), the data management server 201 proceeds to step S1301 shown in FIG.

[0148] 13, first, the data management server 201 generates k pieces of shared data from the data (communication data) received in step S1206 by the secret sharing technique (step S1301). Next, the data management server 201 registers file secret sharing information for each of the generated k pieces of shared data in the file secret sharing information table 700 (step S1302).

[0149] The file secret sharing information includes the file information No. of the target file #, the division management No., the division management branch number, the secret sharing number, and the secret sharing branch number. The division management branch number corresponds to the data received in step S1206. The secret sharing number is assigned by the data management server 201. The secret sharing branch number corresponds to each of the shared data generated in step S1301.

[0150] Then, the data management server 201 transfers the generated k pieces of shared data to different clouds (storage destinations) (step S1303). Next, the data management server 201 registers file secret sharing storage location information for each of the transferred k pieces of shared data in the file secret sharing storage location information table 800 (step S1304).

[0151] The file secret sharing storage location information includes the file information No. of the target file #, the secret sharing number, the secret sharing branch number, the storage destination, the storage destination access information 1, and the storage destination access information 2. The storage destination, the storage destination access information 1, and the storage destination access information 2 correspond to the clouds to which the shared data were transferred in step S1303.

[0152] Next, the data management server 201 judges whether or not there is any unreceived data of the target file # (step S1305). If there is any unreceived data (step S1305: Yes), the data management server 201 controls the network 210 to resume transmission and reception of the target file # between the client device 202 and the data management server 201 (step S1306), and proceeds to step S1206 shown in FIG.

[0153] On the other hand, if there is no unreceived data (step S1305: No), the data management server 201 transmits an upload completion notification to the client device 202 (step S1307) and ends the series of processes according to this flowchart. The upload completion notification is a notification indicating that the upload of the target file # is completed.

[0154] This allows the data management server 201 to ensure the security of the target file # by preventing the complete file from existing even temporarily on its own server when the target file # is uploaded.

[0155] Next, the data management process procedure at the time of downloading by the data management server 201 will be described with reference to FIG.

[0156] Fig. 14 is a flowchart showing an example of a data management process procedure during downloading by the data management server 201. In the flowchart of Fig. 14, first, the data management server 201 determines whether or not a download request for the target file # has been received from the client device 202 (step S1401).

[0157] Here, the data management server 201 waits to receive a download request (step S1401: No). When the data management server 201 receives a download request (step S1401: Yes), the data management server 201 refers to the file division information table 600 and identifies the number of divisions and the division management number corresponding to the target file # (step S1402).

[0158] Then, the data management server 201 selects an unselected divided management branch number from among the divided management branch numbers of the identified divided management No. (step S1403). The divided management branch numbers exist for the number of divisions identified in step S1402. For example, if the number of divisions is "3", the divided management branch numbers are, for example, "1, 2, 3".

[0159] Next, the data management server 201 refers to the file secret sharing information table 700 and selects an unselected secret sharing branch number from among the secret sharing branch numbers of the secret sharing number corresponding to the selected division management branch number (step S1404). There are k secret sharing branch numbers, for example, which represent the number of shared data generated from the communication data. For example, when "k=5", the secret sharing branch numbers are, for example, "1, 2, 3, 4, 5".

[0160] Next, the data management server 201 refers to the file secret sharing storage location information table 800 to identify the storage destination, storage destination access information 1, and storage destination access information 2 corresponding to the selected secret sharing branch number (step S1405). Then, the data management server 201 uses the identified storage destination access information 1 and storage destination access information 2 to obtain the shared data from the identified storage destination cloud (step S1406).

[0161] Next, the data management server 201 refers to the file secret sharing information table 700 and judges whether or not there is an unselected secret sharing branch number among the secret sharing branch numbers of the secret sharing number corresponding to the selected division management branch number (step S1407). If there is an unselected secret sharing branch number (step S1407: Yes), the data management server 201 returns to step S1404.

[0162] On the other hand, if there is no unselected secret sharing branch number (step S1407: No), the data management server 201 restores the communication data of the target file # from the acquired shared data by the secret sharing method (step S1408). Then, the data management server 201 transfers the restored communication data to the client device 202 (step S1409).

[0163] Next, the data management server 201 judges whether or not there is an unselected divided management branch number among the divided management branch numbers of the identified divided management No. (Step S1410). If there is an unselected divided management branch number (Step S1410: Yes), the data management server 201 returns to Step S1403.

[0164] On the other hand, if there is no unselected divided management branch number (step S1410: No), the data management server 201 transmits a transfer completion notification to the client device 202 (step S1411) and ends the series of processes according to this flowchart. The transfer completion notification is a notification indicating that the data transfer for the target file # is completed.

[0165] This allows the data management server 201 to ensure the security of the target file # by ensuring that the complete file does not exist even temporarily on its own server when the target file # is downloaded.

[0166] As described above, according to the data management server 201 according to the embodiment, when uploading a target file #, each time a predetermined size of data (communication data) of the target file # sequentially transmitted from an upload request source (e.g., client device 202) is received, a plurality of encrypted distributed data are generated from the received predetermined size of data before at least the entire target file # is received, and the generated plurality of distributed data are transferred to different storage destinations. The different storage destinations are provided by, for example, different cloud services (e.g., clouds A, B, and C shown in FIG. 10A).

[0167] This allows the data management server 201 to ensure the security of the target file # by ensuring that the complete file does not exist even temporarily on the upload destination server when uploading the target file #.

[0168] Moreover, according to the data management server 201, each time a predetermined size of data of the target file # is received, a plurality of distributed data can be generated from the received data of the predetermined size before the next data of the predetermined size is received, and the generated plurality of distributed data can be transferred to different storage destinations. Specifically, for example, each time a predetermined size of data of the target file # is received, the data management server 201 controls the upload request source to stop the transmission process of the target file #. Then, after transferring the generated plurality of distributed data to different storage destinations, the data management server 201 controls the upload request source to resume the transmission process of the target file #.

[0169] This allows the data management server 201 to ensure the security of the target file # by ensuring that no data of the target file # that exceeds a specified size is present even temporarily on the server when the target file # is uploaded.

[0170] Furthermore, according to the data management server 201, when a predetermined size of data is received and there is no unreceived data of the target file #, a plurality of distributed data can be generated from the received predetermined size of data and the generated plurality of distributed data can be transferred to different storage destinations. Furthermore, according to the data management server 201, a notification of completion of uploading the target file # can be transmitted to the upload request source.

[0171] In this way, when the processing of all data to be uploaded is completed, the data management server 201 can notify the upload requester that the upload of the target file # has been completed.

[0172] Furthermore, according to the data management server 201, when downloading the target file #, for each data of a predetermined size included in the target file #, a plurality of distributed data corresponding to the data of the predetermined size can be acquired from different storage locations. Then, according to the data management server 201, the data of the predetermined size can be restored from the acquired plurality of distributed data so that the data does not coexist on the server with other data included in the target file #, and the restored data of the predetermined size can be transferred to the download request source.

[0173] This allows the data management server 201 to ensure the security of the target file # by ensuring that the complete file does not exist even temporarily on its own server when the target file # is downloaded.

[0174] Furthermore, according to the data management server 201, when all data included in the target file # has been transferred, a transfer completion notification of the target file # can be sent to the download request source.

[0175] In this way, when the transfer of all data to be downloaded is completed, the data management server 201 can notify the download request source that the data transfer of the target file # has been completed.

[0176] Furthermore, the data management server 201 can generate a plurality of encrypted shared data from data of a predetermined size received by the secret sharing technique.

[0177] In this way, the data management server 201 can use a secret sharing technique to distribute the data of the target file # into multiple pieces of data that have no meaning by themselves.

[0178] For these reasons, according to the data management server 201, when secret sharing is performed at the time of uploading the target file #, the security of the target file # can be ensured by ensuring that the complete file does not exist even temporarily in the cloud to which the file is uploaded (for example, the contract cloud X shown in FIG. 10A).

[0179] This allows the data management server 201 to reduce the risk of personal information, technical information, and the like leaking due to malicious acts by the administrator of the cloud (e.g., contract cloud X) during upload. Also, the data (distributed data) stored in each storage destination (e.g., clouds A, B, and C shown in FIG. 10A) has no meaning by itself. Therefore, the data management server 201 can prevent data such as personal information and technical information from leaking even if the administrator of each storage destination maliciously accesses the data.

[0180] Furthermore, when the target file # is downloaded, the complete file does not exist even temporarily in the cloud when restoring the data. Therefore, the data management server 201 can reduce the risk of personal information, technical information, etc. being leaked due to malicious acts by the administrator of the cloud (e.g., contract cloud X) during downloading.

[0181] The data management method described in this embodiment can be realized by executing a prepared program on a computer such as a personal computer or a workstation. The data management program is recorded on a computer-readable recording medium such as a hard disk, a flexible disk, a CD-ROM, a DVD, or a USB memory, and is executed by being read from the recording medium by the computer. The data management program may also be distributed via a network such as the Internet.

[0182] In addition, the data management device 101 (data management server 201) described in this embodiment can also be realized using application-specific ICs such as standard cells and structured ASICs (Application Specific Integrated Circuits) and PLDs (Programmable Logic Devices) such as FPGAs.

[0183] The following supplementary notes are further disclosed regarding the above-described embodiment.

[0184] (Note 1) When uploading target data, each time a predetermined amount of data is received from the upload request source, the generating a plurality of encrypted shared data from the received data of the predetermined size before receiving at least all of the target data, and transferring the generated plurality of shared data to different storage destinations; A data management program that causes a computer to execute a process.

[0185] (Appendix 2) The data management program according to appendix 1, characterized in that each time data of the specified size is received among the target data, the program generates the plurality of distributed data from the received data of the specified size before receiving the next data of the specified size, and transfers each of the generated plurality of distributed data to a different storage destination.

[0186] (Note 3) Each time the predetermined size of data is received from among the target data, the upload request source is controlled to stop a transmission process of the target data; and after transferring the plurality of generated distributed data to different storage destinations, controlling the upload request source to resume the transmission process. 3. The data management program according to claim 2, characterized in that the program causes the computer to execute a process.

[0187] (Note 4) When downloading the target data, for each piece of data of the predetermined size included in the target data, the plurality of pieces of distributed data corresponding to the data of the predetermined size are acquired from the different storage locations; restoring data of the predetermined size from the acquired plurality of distributed data so that the data does not coexist on the local computer with other data included in the target data, and transferring the restored data of the predetermined size to a download request source; 4. The data management program according to claim 1, wherein the program causes the computer to execute a process.

[0188] (Supplementary Note 5) The data management program according to any one of Supplementary Notes 1 to 4, wherein the plurality of shared data are generated from the data of the predetermined size by a secret sharing technique.

[0189] (Supplementary Note 6) The data management program according to any one of Supplementary Notes 1 to 5, wherein the different storage destinations are provided by different cloud services.

[0190] (Note 7) When the data of the predetermined size is received, if there is no unreceived data among the target data, the plurality of distributed data are generated from the received data of the predetermined size, and the plurality of distributed data generated are transferred to different storage destinations; Sending a notification of completion of uploading the target data to the upload request source; 7. The data management program according to any one of claims 1 to 6, which causes the computer to execute a process.

[0191] (Appendix 8) When all data included in the target data has been transferred, a transfer completion notice of the target data is sent to the download requester. 5. The data management program according to claim 4, which causes the computer to execute a process.

[0192] (Note 9) When uploading target data, each time a predetermined size of data is received from the target data sequentially transmitted from an upload request source, a plurality of encrypted distributed data are generated from the received data of the predetermined size before at least all of the target data is received, and the generated plurality of distributed data are transferred to different storage destinations. A data management device comprising a control unit.

[0193] (Appendix 10) A plurality of data storage devices; a data management device which, when uploading target data, generates a plurality of encrypted distributed data from the received data of a predetermined size among the target data sequentially transmitted from an upload request source, before receiving at least all of the target data, and transfers the generated plurality of distributed data to different data storage devices included in the plurality of data storage devices; A data management system comprising: [Explanation of symbols]

[0194] 101 Data management device 102 Terminals 110 Information File 111 First Data 112 Second Data 200 Data Management System 201 Data Management Server 202 Client device 210 Network 220 Data Management Table 300 Bus 301 CPU 302 Memory 303 Disk Drive 304 Disk 305 Communication I / F 306 Portable Recording Media I / F 307 Portable recording media 400 User Information Table 500 File Information Table 600 File division information table 700 File Secret Sharing Information Table 800 File Secret Sharing Storage Location Information Table 900 Control section 901 Reception 902 Communication control section 903 Generation / Transfer Department 904 Recovery / Transfer Department 1000 files 1010,1020,1030 Communication data 111-1~111-3,112-1~112-3,1011,1012,1013,1021,1022,1023,1031,1032,1033 Distributed data S1~Sn,Si Data storage server

Claims

1. When uploading target data, each time a predetermined size of data is received from the target data sequentially transmitted from the upload request source, generating a plurality of encrypted shared data from the received data of the predetermined size before receiving at least all of the target data, and transferring the generated plurality of shared data to different storage destinations; A data management program that causes a computer to execute a process.

2. The data management program according to claim 1, characterized in that each time data of the specified size is received among the target data, a plurality of distributed data are generated from the received data of the specified size before receiving the next data of the specified size, and the generated plurality of distributed data are transferred to different storage destinations.

3. When downloading the target data, for each piece of data of the predetermined size included in the target data, the plurality of pieces of distributed data corresponding to the data of the predetermined size are acquired from the different storage locations; restoring data of the predetermined size from the acquired plurality of distributed data so that the data does not coexist on the local computer with other data included in the target data, and transferring the restored data of the predetermined size to a download request source; 2. The data management program according to claim 1, which causes the computer to execute a process.

4. 4. The data management program according to claim 1, wherein the plurality of shared data are generated from the data of the predetermined size by a secret sharing technique.

5. When uploading target data, every time a predetermined size of data is received from the target data sequentially transmitted from an upload request source, a plurality of pieces of encrypted distributed data are generated from the received data of the predetermined size before at least all of the target data is received, and the generated plurality of pieces of distributed data are transferred to different storage destinations. A data management device comprising a control unit.

6. A plurality of data storage devices; a data management device which, when uploading target data, generates a plurality of encrypted distributed data from the received data of a predetermined size among the target data sequentially transmitted from an upload request source, before receiving at least all of the target data, and transfers the generated plurality of distributed data to different data storage devices included in the plurality of data storage devices; A data management system comprising:

Images