File provision system, file provision method and program

Abstract

To further simply improve security against information leakage when providing a file.SOLUTION: A file provision system 100 includes: acquisition means 302 for acquiring a file stored in a provision source folder set in a provision source terminal 300A; setting means 301 for associating provision destination user information with the provision source folder; file encryption means 303 for encrypting a file with a password and generating an encrypted file; password encryption means 305 for encrypting the password based on provision source user information and the provision destination user information of a provision destination user set in the provision source folder and generating an encrypted password; provision means 130 for providing the encrypted file to a provision destination terminal 300B; password decryption means 307 for decrypting the encrypted password; and file decryption means 308 for decrypting the encrypted file with the password.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to a source user who provides a file, and a file providing system, a file providing method, and a program for providing the file to a destination user. [Background technology]

[0002] For example, a file sharing assistance system has been proposed in which an encryption program generates a password based on a pre-generated common key and encrypts one or more files or folders using the generated password, a decryption program decrypts the encrypted files using the password, and a file management program compares and monitors a shared folder with a storage server and a pre-designated local storage folder, encrypts one or more files or folders stored in the local storage folder and then copies them into the shared folder, and when an encrypted file stored in the shared folder is recognized, it copies it into the local storage folder, decrypts it, and stores it in the local storage folder (see, for example, Patent Document 1).

[0003] According to the file sharing assistance system of Patent Document 1, confidential data can be shared efficiently among a limited number of members in a safe manner. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2019-211867 A Summary of the Invention [Problem to be solved by the invention]

[0005] In business, files are provided to multiple parties, and the files provided vary depending on the parties. For example, if there are multiple business partners, the invoice files provided to each of the multiple business partners will be different for each business partner.

[0006] Therefore, when there are multiple file recipients and the files provided to each recipient are different, in order to manage the files in the shared folder shown in the file sharing assistance system of Patent Document 1, it is necessary to set permissions for the shared folder and files and manage the shared URL (Uniform Resource Locator) for each recipient, which requires a great deal of effort on the part of the file provider, and also poses the problem of reduced security against information leaks due to human error in setting and management.

[0007] The present invention has been made to solve such problems, and aims to provide a file providing system, a file providing method, and a program that can more easily improve security against information leakage when providing files. [Means for solving the problem]

[0008] The first aspect of the present invention is A file providing system for providing a file from a source terminal operated by a source user providing the file to a destination terminal operated by a destination user, the file comprising: a user information storage means for storing source user information, which is information relating to the source user, and destination user information, which is information relating to the destination user; a file acquisition means for acquiring the file stored in a source folder set in the source terminal; a destination setting means for associating the destination user information with the source folder; a file encryption means for encrypting the file with a password to generate an encrypted file; a password encryption means for encrypting the password based on the source user information and the destination user information of the destination user set in the source folder to generate an encrypted password; a file providing means for providing the encrypted file and the encrypted password to the destination terminal of the destination user set in the source folder; a password decryption means for decrypting the encrypted password; a file decryption means for decrypting the encrypted file using the password; A file providing system comprising:

[0009] According to this configuration, A file providing system that provides a file from a source terminal operated by a file providing user to a destination terminal operated by a destination user includes a user information storage means, a file acquisition means, a destination setting means, a file encryption means, a password encryption means, a file providing means, a password decryption means, and a file decryption means. The user information storage means stores source user information, which is information relating to a source user, and destination user information, which is information relating to a destination user. The file acquisition means acquires a file stored in a source folder set in the source terminal. The destination setting means associates the destination user information with the source folder. The file encryption means encrypts the file stored in the source folder with a password to generate an encrypted file. The password encryption means encrypts the password based on the source user information and the destination user information of the destination user set in the source folder, to generate an encrypted password. The file providing means provides the encrypted file and the encrypted password to a destination terminal of a destination user set in the source folder. The password decryption means decrypts the encrypted password. The file decryption means decrypts the encrypted file with the password.

[0010] Thus, in the file providing system, a source folder is associated with destination user information, a file stored in the source folder is encrypted with a password to generate an encrypted file, and the password is further encrypted based on the source user information and the destination user information of the destination user set in the source folder to generate an encrypted password.The encrypted file is then provided to a destination terminal operated by the destination user, the encrypted password is decrypted, and the encrypted file is decrypted with the decrypted password.

[0011] Therefore, by setting a destination user (destination user information) in the source folder in advance, the source user can save a file in the source folder and provide the file in an encrypted state to the destination user (destination terminal) where it can be decrypted. Therefore, when providing a file, it is possible to more easily improve security against information leakage.

[0012] A preferred embodiment of the first aspect of the present invention is as follows: the source folder is set for the destination user designated by the source user, The user information storage means stores the destination user information for each of the source folders.

[0013] As a result, when a source user provides different files to multiple destination users, the source user can provide the destination users with encrypted files and decrypt them simply by saving the files to be provided to the destination users in a source folder for each destination user. In addition, the password used to encrypt the file is encrypted based on the source user information and the destination user information for each destination user to generate an encrypted password, so that a different encrypted password can be generated for each destination user. Therefore, even when different files are provided to a plurality of destination users, it is possible to more simply and easily improve security against information leakage.

[0014] Also, for example, there may be a case where there are multiple groups including multiple destination users, and a different file is to be provided to each of the multiple groups. In such a case, the source user can provide and decrypt the encrypted file to all the destination users by simply specifying the multiple destination users included in a certain group for one source folder and saving the file to be provided to all the multiple destination users included in the group in the source folder. Therefore, even when different files are provided to each of a plurality of groups, it is possible to more simply and easily improve security against information leakage.

[0015] Another preferred embodiment of the first aspect of the present invention is as follows: a password storage means for storing the encrypted password; and an erasing unit that erases the encrypted password stored in the password storage unit based on an operation by the providing user, The password decryption means obtains the encrypted password from the password storage means, If the encrypted password has been deleted from the password storage means, The password decryption means cannot obtain the encrypted password, The file decryption means is characterized in that it cannot decrypt the encrypted file.

[0016] As a result, for example, if the source user accidentally saves the wrong file in the source folder, the source user can erase the encrypted password stored in the password storage means, thereby preventing the encrypted file of that file from being decrypted. Therefore, even if a wrong file is saved in the source folder, information leakage of the file can be prevented.

[0017] A second aspect of the present invention is A method executed by a file providing system for providing a file from a source terminal operated by a source user providing the file to a destination terminal operated by a destination user, the method comprising: storing source user information, which is information related to the source user, and destination user information, which is information related to the destination user; acquiring the file stored in a source folder set in the source terminal; A step of associating the destination user information with the source folder; encrypting the file with a password to generate an encrypted file; encrypting the password based on the source user information and the destination user information of the destination user set in the source folder to generate an encrypted password; providing the encrypted file and the encrypted password to the destination terminal of the destination user set in the source folder; decrypting the encrypted password; decrypting the encrypted file with the password; A file providing method comprising:

[0018] A third aspect of the present invention is A file providing system for providing a file from a source terminal operated by a source user who provides the file to a destination terminal operated by a destination user, a user information storage means for storing source user information, which is information relating to the source user, and destination user information, which is information relating to the destination user; a file acquisition means for acquiring the file stored in a source folder set in the source terminal; a destination setting means for associating the destination user information with the source folder; a file encryption means for encrypting the file with a password to generate an encrypted file; a password encryption means for encrypting the password based on the source user information and the destination user information of the destination user set in the source folder to generate an encrypted password; a file providing means for providing the encrypted file and the encrypted password to the destination terminal of the destination user set in the source folder; a password decryption means for decrypting the encrypted password; a file decryption means for decrypting the encrypted file using the password; A program characterized by causing the program to function as a

[0019] According to the second and third aspects, the same advantageous effects as those of the file providing system according to the first aspect are achieved. Effect of the Invention

[0020] According to the present invention, when providing a file, it is possible to more simply improve security against information leakage. [Brief description of the drawings]

[0021] [Figure 1] 1 is a diagram illustrating an overview of a file providing system according to an embodiment of the present invention. [Diagram 2] 1 is a block diagram showing a hardware configuration of a computer that constitutes a file providing system according to an embodiment of the present invention. [Diagram 3] 1 is a block diagram showing a functional configuration of a file providing system according to an embodiment of the present invention. [Figure 4] 3 is a diagram illustrating a user information DB of the file providing system according to the embodiment of the present invention. FIG. [Diagram 5] 3 is a diagram illustrating a flow of encryption and decryption in the file providing system according to the embodiment of the present invention. FIG. [Figure 6] 4 is a flowchart showing a file providing process executed by the file providing system according to the embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0022] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, modes for carrying out the present invention (hereinafter, referred to as embodiments) will be described in detail with reference to the accompanying drawings.

[0023] <Embodiment> [File provision system overview] FIG. 1 is a diagram illustrating an overview of a file providing system according to an embodiment of the present invention. The file providing system (hereinafter, simply referred to as "the system" or "this system") provides files (files B, C, D) from a source terminal operated by a source user (user A) who provides the files (files B, C, D) to a destination terminal operated by a destination user (users B, C, D).

[0024] Specifically, the file providing system provides files stored in a source folder (folders B, C, D) set by a source terminal to a destination terminal operated by a destination user (users B, C, D) associated with the source folder. In this embodiment, the "source folder" may be a folder set in the source terminal or online storage provided by an external system. Also, a "file" is a file that can be created, edited, displayed, etc., using an application installed on a general personal computer.

[0025] In detail, the file providing system stores source user information, which is information about the source user, and destination user information, which is information about the destination user, based on the operation of the source terminal by the source user (user A), and associates the destination user information with each of a plurality of source folders (folders B, C, D) associated with the source user information. For example, in the example shown in FIG. 1, the file providing system associates the destination user information of user B with folder B, the destination user information of user C with folder C, and the destination user information of user D with folder D. Note that, in the example shown in FIG. 1, the file providing system associates one user with one folder, but this is not limiting, and multiple users may be associated with one folder.

[0026] Then, when a file is saved in a source folder by a source user (user A) operating a source terminal, the file providing system acquires the file for each source folder. For example, in the example shown in FIG. 1, the file providing system acquires file B as a file saved in folder B, file C as a file saved in folder C, and file D as a file saved in folder D.

[0027] Next, the file providing system encrypts the acquired files with a password for each source folder (folders B, C, D) and generates encrypted files (encrypted files B, C, D).

[0028] In addition, the file provision system encrypts the password for each source folder (folders B, C, D) based on the source user (user A) information and the destination user information of the destination users (users B, C, D) set in that source folder, and generates an encrypted password.

[0029] Next, the file providing system provides the encrypted files (encrypted files B, C, D) for each source folder (folders B, C, D) to the destination terminals of the respective destination users (users B, C, D). The file providing system also provides the encrypted passwords for each source folder (folders B, C, D) to the destination terminals of the respective destination users (users B, C, D).

[0030] Then, the file providing system decrypts each encrypted file (encrypted files B, C, D) at the destination terminal of each destination user (users B, C, D).

[0031] In this way, according to the file provision system, by setting a destination user (destination user information) in a source folder in advance, the source user can save a file in the source folder, and then provide the file in an encrypted state to the destination user (destination terminal) where it can be decrypted. Therefore, when providing a file, it is possible to more easily improve security against information leakage.

[0032] [Hardware configuration of file serving system] First, the hardware configuration of a computer constituting a file providing system according to an embodiment of the present invention will be described with reference to FIG. 2. FIG. 2 is a block diagram showing the hardware configuration of a computer constituting a file providing system according to an embodiment of the present invention. A file management device 101 and a terminal 300 constituting the system according to this embodiment, which will be described later with reference to FIG. 3, are each realized by a general computer. The computer is basically configured to have a CPU (Central Processing Unit) 1, a ROM (Read Only Memory) 2, a RAM (Random Access Memory) 3, a storage device 4, an input / output interface (hereinafter abbreviated as "IF") 5, a mouse 6, a keyboard 7, a display device 8, a printer 9, and a communication device 10. The CPU 1, the ROM 2, the RAM 3, the storage device 4, and the IF 5 are connected to each other via an internal bus. The mouse 6, the keyboard 7, the display device 8, the printer 9, and the communication device 10 are connected to the internal bus via the IF 5.

[0033] The CPU 1 controls the execution of the entire computer, and for example, executes the file providing process described below based on a program. The ROM 2 stores a control program for controlling the execution of the entire computer. The RAM 3 provides a working area and a storage area for various data required for the execution control of the CPU 1. The storage device 4 is a large-capacity storage device such as a hard disk drive or a solid-state drive, and stores, for example, programs and data for executing the file providing process according to installation or download. The IF 5 exchanges various signals between the CPU 1 and the mouse 6, keyboard 7, display device 8, printer 9, and communication device 10. The RAM 3 and storage device 4 are examples of storage means.

[0034] The mouse 6 is a so-called pointing device, and is used to perform selection operations on the screen of the display device 8. The keyboard 7 is used to directly input characters, numbers, and the like on the screen of the display device 8. The display device 8 is, for example, a liquid crystal display, and displays character information, etc. on an input operation display screen, an output result display screen, and the like. The printing device 9 is, for example, an inkjet printer or a laser printer, and prints and outputs, for example, a figure displayed on the output result display screen on paper in response to a printing operation. The communication device 10 is connected to, for example, a terminal or device on the Internet via a network line not shown, and downloads and uploads various data, programs, and the like between the terminal, etc. in response to a web request.

[0035] In addition, the computer of this embodiment has programs, data, etc. for executing the file provision process installed in advance in the storage device 4, but since it is basically connected to the Internet, it may also be possible to operate it by downloading programs, data, etc. for executing the file provision process from other external servers each time.

[0036] In this embodiment, "accept" means storing in a storage means by file operations such as uploading via the Internet or saving via an internal LAN. In this embodiment, "provide" means transmitting or uploading via the Internet or an internal LAN. In this embodiment, "obtain" means receiving or downloading via the Internet or an internal LAN.

[0037] [System Functionality Configuration] Next, the functional configuration of the system will be described with reference to Fig. 3. Fig. 3 is a block diagram showing the functional configuration of the file providing system according to an embodiment of the present invention.

[0038] The present system includes a file management device 101 as an example of a computer shown in FIG. 2, and a plurality of terminals 300 (300A, 300B, etc.) that are connected to the file management device 101 via a network (e.g., the Internet, an in-house LAN, etc.) and function as a source terminal or a destination terminal. A file storage means 200 in which a source folder is set may be connected to the file management device 101 and the terminal 300 via the network. A plurality of storage means 250 constituting, for example, a blockchain may be connected to the file management device 101 via the network. The file storage means 200 may be an online storage provided by an external system, or may be a storage area in a storage device 4 provided in the file management device 101 or the terminal 300. The plurality of storage means 250 may be a device outside the present system, or may be a plurality of storage areas in a storage device 4 provided in the file management device 101.

[0039] (File Management Device) The file management device 101 includes a receiving unit 110 , an erasing unit 120 , a providing unit 130 , and a storage unit 150 .

[0040] The receiving means 110 receives user information, which is information about the operating user (for example, a user ID for identifying the user such as a user name, a sending / receiving address such as an email address, etc.), source folder information indicating a source folder designated by each user (link information indicating the location of the source folder, identification information of the source folder, etc.), and destination user information (information indicating the destination of the file, etc.) which is the destination of the file associated with each source folder, and stores them in a user information DB (database) of the storage means 150. The receiving means 110 also receives public key information indicating the public key of each user, and stores it in the storage means 150. Such storage means 150 functions as an example of a user information storage means.

[0041] The receiving means 110 may receive user information, source folder information, destination user information and public key information from each terminal 300, or may receive them from another device (e.g., a server that stores user information and public key information), or may receive user information and public key information based on operation of an input means (e.g., mouse 6, keyboard 7, etc.) by a person operating the file management device 101.

[0042] FIG. 4 is a diagram for explaining a user information DB of the file providing system according to the embodiment of the present invention. In the example shown in FIG. 4, in the user information DB, a user ID (e.g., "AAA") accepted by the accepting means 110 as user information (providing source user information) of a providing source user who provides a file is associated with providing source folder information (e.g., "AAA1", "AAA2", "AAA3") accepted from the user. Also, in the user information DB, each providing source folder information (e.g., "AAA1") is associated with destination user information (e.g., "bbb@example2.com"). In the example shown in FIG. 4, in the user information DB, one providing source folder information is associated with one providing destination user information, but this is not limiting, and one providing source folder information may be associated with a plurality of providing destination user information.

[0043] 4, in the user information DB, the source user information (user ID: for example, "AAA") is associated with the public key of the user (for example, "public key A"), and the destination user information (information indicating the destination of the file: for example, "bbb@example2.com") is associated with the public key of the user (for example, "public key B"). Note that the public keys may be stored in the storage means 150 in a separate database, not in the user information DB, with each public key associated with the user information of each user.

[0044] Returning to Fig. 3, the receiving means 110 also receives from each terminal 300 an encrypted file and source folder information of a source folder in which the encrypted file is stored, and stores the encrypted file in the storage means 150. The receiving means 110 also receives an encrypted password, which will be described later, from each terminal 300, and stores the encrypted password in a password storage area of ​​the storage means 150 or storage means 250, which are examples of password storage means. The receiving means 110 also receives, from each terminal 300, deletion instruction information that instructs the deletion of the encrypted password stored in the password storage area.

[0045] When the receiving means 110 receives deletion instruction information from the source user's terminal 300 instructing the deletion of a certain encrypted password, the erasing means 120 erases the encrypted password stored in the password memory area of ​​the memory means 150 or the storage means 250.

[0046] The providing means 130 functions as an example of a file providing means, and when the receiving means 110 receives an encrypted file, source folder information of the encrypted file, and an encrypted password of the encrypted file from the source user's terminal 300, the providing means 130 provides the encrypted file and the encrypted password to the destination user (the destination user's terminal 300) directly or via the storage means 250 constituting the block chain, based on the destination user information associated with the source folder information in the user information DB (see FIG. 4). Note that, when the encrypted password has been erased by the erasing means 120, the providing means 130 does not provide the encrypted password to the destination user (the destination user's terminal 300).

[0047] Moreover, the providing means 130 transmits the public key of the destination user to the terminal 300 of the source user, and transmits the public key of the source user to the terminal 300 of the destination user.

[0048] (Terminal) The terminal 300 includes a setting unit 301 , an acquisition unit 302 , a file encryption unit 303 , a key generation unit 304 , a password encryption unit 305 , a transmission unit 306 , a password decryption unit 307 , and a file decryption unit 308 .

[0049] The setting means 301 mainly functions as an example of a destination setting means when the terminal 300 functions as a source terminal, and in response to a user's operation, accepts and transmits to the file management device 101 user information of the user (for example, a user ID identifying the user, such as a user name, sending and receiving addresses, such as an email address, etc.), source folder information indicating the source folder specified by the user (link information indicating the location of the source folder, identification information of the source folder, etc.), and one or more destination user information (information indicating the destination of the files, etc.) to which the files associated with each source folder are to be provided.

[0050] Furthermore, when the terminal 300 functions as a destination terminal, the setting means 301 may set a destination folder for each source user of the encrypted file in response to a user operation. In such a destination folder for each source user, the files obtained by decrypting the acquired encrypted file are sorted for each source user and stored.

[0051] The acquisition means 302 mainly functions as an example of a file acquisition means when the terminal 300 functions as a source terminal, monitors the source folder specified by the source folder information received by the setting means 301, and when a file is saved in the source folder by user operation, acquires the file and stores it in a storage device.

[0052] Furthermore, the acquiring means 302 mainly acquires an encrypted file provided from the file management device 101 when the terminal 300 functions as a destination terminal, and stores the file in a storage device. Furthermore, the acquiring means 302 acquires an encrypted password of the encrypted file from the file management device 101 via the storage means 250 (blockchain), and stores the password in a storage device. For example, the acquiring means 302 may acquire an encrypted file or an encrypted password directly from the file management device 101, or, when an address for downloading the encrypted file is notified from the file management device 101, the acquiring means 302 may access the address, download the encrypted file or the encrypted password, and store the file in a storage device. Note that, when the terminal 300 functions as a destination terminal, if deletion instruction information instructing deletion of the encrypted password designated by the source user from the destination terminal is transmitted to the file management device 101 (if the encrypted password has been deleted from the storage means 150 of the file management device 101), the acquiring means 302 cannot acquire the encrypted password.

[0053] When the terminal 300 mainly functions as a source terminal, the file encryption means 303 reads the file acquired by the acquisition means 302 (the file saved in the source folder) from the storage means, encrypts it with a randomly generated password, generates an encrypted file, and stores it in the storage means. Note that the number of files encrypted by the file encryption means 303 may be one or more.

[0054] The key generation means 304 generates a common key from one user's public key and the other user's private key using the salt sent from the file management device 101, using a common key encryption algorithm such as AES (Advanced Encryption Standard) CBC mode (Cipher Block Chaining Mode), and encrypts the file with an initial vector, which is a randomly generated bit string, and the common key, thereby generating an encrypted file.

[0055] Specifically, when the terminal 300 functions as a source terminal, the key generation means 304 generates a public key and a private key for encryption. Then, the key generation means 304 associates the generated public key with the user information of the source user and transmits it to the file management device 101. Also, when the terminal 300 functions as a destination terminal, the key generation means 304 generates a public key and a private key for decryption. Then, the key generation means 304 associates the generated public key with the user information of the destination user and transmits it to the file management device 101.

[0056] When the terminal 300 functions as a source terminal, the password encryption means 305 receives the public key of the destination user from the file management device 101, generates a common key from the destination user's public key and the private key for encryption generated by the key generation means 304, and encrypts the password generated by the file encryption means 303 and used to encrypt the file with the common key, thereby generating an encrypted password.

[0057] The transmission means 306 provides the encrypted file generated by the file encryption means 303 and the encrypted password generated by the password encryption means 305 to the file management device 101 .

[0058] Furthermore, the transmission means 306 transmits, based on the operation of the source user, to the file management apparatus 101, deletion instruction information for instructing the file management apparatus 101 to delete the encrypted password designated by the source user.

[0059] When the terminal 300 functions as a destination terminal, the password decryption means 307 receives the public key of the providing user from the file management device 101, generates a common key from the public key of the providing user and the private key for decryption generated by the key generation means 304, and decrypts the encrypted password acquired by the acquisition means 302 with the common key. Note that when the terminal 300 functions as a destination terminal, if deletion instruction information instructing the destination terminal to delete the encrypted password designated by the providing user has been transmitted to the file management device 101 (if the encrypted password has been deleted from the storage means 150 of the file management device 101), the acquisition means 302 cannot acquire the encrypted password and therefore cannot decrypt the encrypted password.

[0060] The file decryption means 308 mainly decrypts the encrypted file acquired from the file management device 101 using the password decrypted by the password decryption means 307 when the terminal 300 functions as the destination terminal, and stores the decrypted file in the storage means. Note that when the terminal 300 functions as the destination terminal, if deletion instruction information instructing the destination terminal to delete the encrypted password designated by the source user is transmitted to the file management device 101 (if the encrypted password has been deleted from the storage means 150 of the file management device 101), the encrypted file cannot be decrypted even if it has been acquired, since there is no decrypted password.

[0061] Furthermore, the file decryption means 308 may distribute the decrypted files to a destination folder set for each source user who has provided the encrypted file.

[0062] Next, a flow from encryption to decryption of a file in the file providing system 100 will be described. FIG. 5 is a diagram illustrating the flow of encryption and decryption in the file providing system according to the embodiment of the present invention.

[0063] First, when a file is saved in a source folder, in the source terminal 300A, the acquisition means 302 acquires the file. As a result, in the source terminal 300A, the file encryption means 303 encrypts the file with a random password and generates an encrypted file. This encrypted file is provided to the file management device 101. Then, the file management device 101 identifies a destination user of the encrypted file based on the user information DB (see FIG. 4), and provides the encrypted file to the identified destination user's terminal 300B.

[0064] Next, in the source terminal 300A, the password encryption means 305 generates a common key from the destination user's decryption public key received from the file management device 101 and the source user's encryption private key. The password encryption means 305 then encrypts the password with the generated common key to generate an encrypted password. This encrypted password is provided to the file management device 101, and is provided from the file management device 101 to the destination terminal 300 via the storage means 250 (blockchain).

[0065] Here, if the source terminal 300A transmits deletion instruction information to the file management device 101 to instruct the file management device 101 to delete the encrypted password, the file management device 101 deletes the encrypted password stored in the password storage area of ​​the storage means 150 or the storage means 250. In this case, the destination terminal 300B cannot obtain the encrypted password, and therefore cannot decrypt the encrypted file even if it obtains it.

[0066] Next, if the deletion instruction information has not been transmitted to the file management device 101, the destination terminal 300B obtains the encrypted password from the storage means 250, and the password decryption means 307 generates a common key from the destination user's private key for decryption and the source user's public key for encryption. This common key is the same as the common key generated by the password encryption means 305 of the source terminal 300A. Then, the password decryption means 307 decrypts the encrypted password with the generated common key to obtain the password.

[0067] Then, in the destination terminal 300B, the file decryption means 308 decrypts the provided encrypted file using the password to obtain the file, and stores the file in a destination folder set for the source user who provided the encrypted file.

[0068] [File provision processing] Next, a file providing process executed by the file providing system 100 will be described. In the following process flow diagram (flowchart), the processing order of each step may be changed as long as the relationship between the input and output of each step is not lost. FIG. 6 is a flow chart showing a file providing process executed by the file providing system according to an embodiment of the present invention. In the following description, terminal 300A is a source terminal operated by a source user, and terminal 300B is a destination terminal operated by a destination user.

[0069] The file providing system 100 starts the file providing process, for example, when a file is saved in a source folder set by the setting means 301 of the terminal 300A. The file providing system 100 may start the file providing process when a source user operates the source folder or a file saved in the source folder.

[0070] In step S1, the acquisition means 302 of the terminal 300A acquires a file saved in a source folder specified by the source folder information received by the setting means 301, and stores the file in a storage device.

[0071] In step S2, the file encryption means 303 of the terminal 300A reads the file acquired by the acquisition means 302 in step S1 from the storage means, encrypts it with a randomly generated password, generates an encrypted file, and stores it in the storage means.

[0072] In step S3, the password encryption means 305 of terminal 300A receives the public key of the destination user from the file management device 101, generates a common key from the destination user's public key and the private key for encryption generated by the key generation means 304, and encrypts the password generated by the file encryption means 303 in step S2 and used to encrypt the file with the common key, thereby generating an encrypted password.

[0073] In step S4, the transmission means 306 of the terminal 300A provides the file management device 101 with the encrypted file generated by the file encryption means 303 in step S2 and the encrypted password generated by the password encryption means 305 in step S3.

[0074] In step S5, the receiving means 110 of the file management device 101 receives the encrypted file provided from the terminal 300A in step S4 and source folder information of the source folder in which the encrypted file is stored, and stores them in the storage means 150. The receiving means 110 also receives the encrypted password provided from the terminal 300A in step S4, and stores it in the password storage area of ​​the storage means 150 or the storage means 250.

[0075] In step S6, based on the source user's operation, terminal 300A determines whether or not there is an erase instruction to erase the encrypted password specified by the source user, and if it is determined that there is an erase instruction, it proceeds to step S7, and if it is determined that there is no erase instruction, it terminates the processing in terminal 300A.

[0076] In step S7, the transmission means 306 of the terminal 300A transmits the erasure instruction information to the file management device 101.

[0077] In step S8, the file management device 101 determines whether or not erasure instruction information has been received from the terminal 300A, and if it is determined that the erasure instruction information has been received, it proceeds to step S9, and if it is determined that the erasure instruction information has not been received, it proceeds to step S10.

[0078] In step S 9 , the deleting means 120 of the file management device 101 deletes the encrypted password stored in the password storage area of ​​the memory means 150 or the storage means 250 .

[0079] In step S10, the providing means 130 of the file management device 101 provides the encrypted file, the source folder information of the encrypted file, and the encrypted password of the encrypted file, which are accepted by the accepting means 110 in step S5, to the destination user (the destination user's terminal 300B) directly or via the storing means 250 constituting the block chain, based on the destination user information associated with the source folder information in the user information DB (see FIG. 4). Note that, if the encrypted password has been erased by the erasing means 120 in step S9, the providing means 130 does not provide the encrypted password to the destination user (the destination user's terminal 300B).

[0080] In step S11, the acquisition means 302 of the terminal 300B acquires the encrypted file provided from the file management device 101 and stores it in the storage device. The acquisition means 302 also acquires the encrypted password of the encrypted file from the file management device 101 via the storage means 250 (blockchain) and stores it in the storage device.

[0081] In step S12, the password decryption means 307 of the terminal 300B receives the public key of the providing user from the file management device 101, generates a common key from the public key of the providing user and the private key for decryption generated by the key generation means 304, and decrypts the encrypted password acquired by the acquisition means 302 in step S11 with the common key.

[0082] In step S13, the file decryption means 308 of the terminal 300B decrypts the encrypted file obtained from the file management device 101 in step S11 using the password decrypted by the password decryption means 307 in step S12, and stores the decrypted file in the storage means.

[0083] According to such a file providing system 100, a source folder is associated with destination user information, a file stored in the source folder is encrypted with a password to generate an encrypted file, and the password is further encrypted based on the source user information and the destination user information of the destination user set in the source folder to generate an encrypted password. The encrypted file is then provided to a destination terminal operated by the destination user, the encrypted password is decrypted, and the encrypted file is decrypted with the decrypted password.

[0084] Therefore, by setting a destination user (destination user information) in the source folder in advance, the source user can save a file in the source folder and provide the file in an encrypted state to the destination user (destination terminal) where it can be decrypted. Therefore, when providing a file, it is possible to more easily improve security against information leakage.

[0085] According to the file providing system 100, when a source user provides different files to multiple destination users, the source user can provide the destination users with encrypted files and decrypt them simply by saving the files to be provided to the destination users in a source folder for each destination user. Also, since the password used to encrypt the file is encrypted based on the source user information and the destination user information for each destination user to generate an encrypted password, a different encrypted password can be generated for each destination user. Therefore, even when different files are provided to a plurality of destination users, it is possible to more simply and easily improve security against information leakage.

[0086] Also, for example, there may be a case where a plurality of groups each including a plurality of destination users are present, and a different file is to be provided to each of the plurality of groups. According to the file providing system 100, in such a case, the source user can provide and decrypt the encrypted file to all the destination users by simply designating the destination users included in a certain group for one source folder and storing the file to be provided to all the destination users included in the group in the source folder. Therefore, even when different files are provided to each of a plurality of groups, it is possible to more simply and easily improve security against information leakage.

[0087] Furthermore, according to the file providing system 100, for example, if a source user accidentally saves an incorrect file in a source folder, the source user can prevent the encrypted file from being decrypted by erasing the encrypted password stored in the password storage means. Therefore, even if a wrong file is saved in the source folder, information leakage of the file can be prevented.

[0088] Although the embodiments of the present invention have been described above, it goes without saying that the technical scope of the present invention is not limited to the contents of the above-mentioned embodiments and application examples. It is clear to those skilled in the art that various modifications or improvements can be made to the above-mentioned embodiments. Furthermore, it is clear from the claims that such modifications or improvements are also included in the technical scope of the present invention. Furthermore, the embodiments, application examples, and modified examples can be combined in any configuration as long as there is no contradiction. [Explanation of symbols]

[0089] 1 CPU 2 ROM 3. RAM 4 Storage device 6. Mouse 7 Keyboard 8 Display device 9 Printing device 100 File Provisioning System 101 File management device 110 Reception methods 120 Erasing Method 130 Means of provision 150 Memory means 200 File storage means 250 Storage means 300 terminals 301 Setting method 302 Acquisition method 303 File Encryption Methods 304 Key generation means 305 Password Encryption Methods 306 Transmission Method 307 Password Decryption Method 308 File Decryption Method 400 File storage means

Claims

1. A file providing system for providing a file from a source terminal operated by a source user providing the file to a destination terminal operated by a destination user, the file comprising: a user information storage means for storing source user information, which is information relating to the source user, and destination user information, which is information relating to the destination user; a file acquisition means for acquiring the file stored in a source folder set in the source terminal; a destination setting means for associating the destination user information with the source folder; a file encryption means for encrypting the file with a password to generate an encrypted file; a password encryption means for encrypting the password based on the source user information and the destination user information of the destination user set in the source folder to generate an encrypted password; a file providing means for providing the encrypted file and the encrypted password to the destination terminal of the destination user set in the source folder; a password decryption means for decrypting the encrypted password; a file decryption means for decrypting the encrypted file using the password; A file providing system comprising:

2. the source folder is set for the destination user designated by the source user, 2. The file providing system according to claim 1, wherein said user information storage means stores said destination user information for each of said source folders.

3. a password storage means for storing the encrypted password; and an erasing unit that erases the encrypted password stored in the password storage unit based on an operation by the providing user, The password decryption means obtains the encrypted password from the password storage means, If the encrypted password has been deleted from the password storage means, The password decryption means cannot obtain the encrypted password, 3. The file providing system according to claim 1, wherein the file decryption means cannot decrypt the encrypted file.

4. A method executed by a file providing system for providing a file from a source terminal operated by a source user providing the file to a destination terminal operated by a destination user, the method comprising: storing source user information, which is information related to the source user, and destination user information, which is information related to the destination user; acquiring the file stored in a source folder set in the source terminal; A step of associating the destination user information with the source folder; encrypting the file with a password to generate an encrypted file; encrypting the password based on the source user information and the destination user information of the destination user set in the source folder to generate an encrypted password; providing the encrypted file and the encrypted password to the destination terminal of the destination user set in the source folder; decrypting the encrypted password; decrypting the encrypted file with the password; A file providing method comprising:

5. A file providing system for providing a file from a source terminal operated by a source user who provides the file to a destination terminal operated by a destination user, a user information storage means for storing source user information, which is information relating to the source user, and destination user information, which is information relating to the destination user; a file acquisition means for acquiring the file stored in a source folder set in the source terminal; a destination setting means for associating the destination user information with the source folder; a file encryption means for encrypting the file with a password to generate an encrypted file; a password encryption means for encrypting the password based on the source user information and the destination user information of the destination user set in the source folder to generate an encrypted password; a file providing means for providing the encrypted file and the encrypted password to the destination terminal of the destination user set in the source folder; a password decryption means for decrypting the encrypted password; a file decryption means for decrypting the encrypted file using the password; A program characterized by causing the program to function as a

Images