Electronic information encryption system

Abstract

We provide an electronic information encryption system that allows for the secure storage and management of electronic information. [Solution] The user terminal 4 encrypts a single character of character information 200, which is represented as binary data, into binary encrypted information 202 using an encryption key 300, and divides the encrypted binary encrypted information 202 into multiple divided binary information 203. Then, based on a predetermined conversion table 400 that associates the divided binary information 203 with encryption symbols 204, the multiple divided divided binary information 203 are converted into an encryption symbol sequence 205. The converted encryption symbol sequence 205 is stored and managed in the electronic information management server 2.

Description

[Technical Field]

[0001] The present invention relates to an electronic information encryption system that encrypts, stores and manages electronic information. [Background Art]

[0002] Electronic information is encrypted for the purpose of preventing malicious third parties from accessing the electronic information, and the encrypted electronic information is stored and managed in a storage device. Patent Document 1 below describes an electronic information management device that encrypts electronic information, divides the encrypted electronic information into a plurality of fragments, and stores these fragments at random physical locations in a storage device. [Prior Art Documents] [Patent Documents]

[0003] [Patent Document 1] Japanese Unexamined Patent Application Publication No. 2003-143131 [Summary of the Invention] [Problem to be Solved by the Invention]

[0004] Along with the improvement of computer computing power and the development of decryption technology, there is a constant demand for an electronic information storage management system with improved security.

[0005] The present invention has been made in view of such circumstances, and an object of the present invention is to provide an electronic information encryption system capable of safely storing and managing electronic information. [Means for Solving the Problem]

[0006] To solve the above problem, the invention described in claim 1 is an electronic information encryption system for encrypting, storing, and managing electronic information including character information, comprising: an encryption unit that encrypts a single character of the character information, which is represented as binary data, into binary encrypted information using an encryption key; a division unit that divides the encrypted binary encrypted information of the single character into a plurality of divided binary information; a conversion unit that converts the plurality of divided binary information into a sequence of encrypted symbols based on a predetermined conversion table that associates the divided binary information with encryption symbols; and a symbol sequence storage unit that stores the converted sequence of encrypted symbols.

[0007] The invention according to claim 2 is characterized in that, in addition to the configuration described in claim 1, when encrypting the character information which is composed of multiple characters, the characters to be encrypted are selected in an order from the first character to the subsequent characters, and the encryption unit encrypts the characters to be encrypted into binary encrypted information using the encryption key.

[0008] The invention according to claim 3 is characterized in that, in addition to the configuration described in claim 1 or 2, it comprises: a reverse conversion unit that reverse-converts the encrypted symbol sequence stored in the symbol sequence storage unit into the plurality of partitioned binary information based on the conversion table; a combination unit that combines the reverse-converted plurality of partitioned binary information to restore the binary encrypted information; and a decryption unit that decrypts the restored binary encrypted information into the single character of the character information using the encryption key.

[0009] The invention according to claim 4, in addition to the configuration described in claim 2, comprises a partial match search unit that performs a partial match search of a partial match search string, wherein when searching for the multiple character encryption symbol sequence that partially matches the partial match search string from the encryption symbol sequence stored in the symbol sequence storage unit, the characters to be encrypted are selected in the order from the first search character to the subsequent search characters of the partial match search string, the encryption unit encrypts the search characters to be encrypted into search binary encryption information using the encryption key, the splitting unit splits the search binary encryption information into a plurality of split search binary information, the conversion unit converts the plurality of split search binary information into a search encryption symbol sequence, the converted search encryption symbol sequence is aggregated for the entire partial match search string to constitute a partial match search encryption symbol sequence, and the partial match search unit retrieves the multiple character encryption symbol sequence that partially matches the configured partial match search encryption symbol sequence from the symbol sequence storage unit.

[0010] The invention according to claim 5 is characterized in that, in addition to the configuration of claim 1, it comprises a variation element generation unit that generates variation elements that cause a change in the encryption key by performing a predetermined operation on the binary encryption information, and an encryption key variation unit that generates a variation encryption key by applying the generated variation elements to the encryption key, wherein when encrypting the character information composed of multiple characters, the characters to be encrypted are selected in order from the first character to the subsequent characters, the encryption key variation unit applies the variation element generated one character before the character to be encrypted to the encryption key to generate the variation encryption key for the character to be encrypted, the encryption unit encrypts the character to be encrypted into the binary encryption information using the generated variation encryption key, and the variation element generation unit generates the variation elements based on the binary encryption information of the character to be encrypted.

[0011] The invention according to claim 6, in addition to the configuration of claim 5, comprises: a reverse conversion unit that reverse-converts the encrypted symbol sequence stored in the symbol sequence storage unit into the plurality of partitioned binary information based on the conversion table; a combination unit that combines the reverse-converted plurality of partitioned binary information to restore the binary encrypted information; and a decryption unit that decrypts the restored binary encrypted information into the single character of the character information using the encryption key, wherein when decrypting the encrypted symbol sequence in which the character information composed of the plurality of characters is encrypted, the characters to be decrypted are set in order from the first character to the subsequent characters, and the corresponding characters to be decrypted With respect to the encrypted symbol sequence, the encryption key variation unit applies the variation element generated one character before the character to be decrypted to the encryption key to generate the variation encryption key for the character to be decrypted, the inverse transformation unit inversely transforms the character to be decrypted into the plurality of partitioned binary information corresponding to the character to be decrypted, the concatenation unit restores the binary encryption information corresponding to the character to be decrypted, the decryption unit decrypts the binary encryption information of the character to be decrypted using the variation encryption key of the character to be decrypted, and the variation element generation unit generates the variation element based on the binary encryption information of the character to be decrypted.

[0012] The invention according to claim 7, in addition to the configuration described in claim 5 or 6, comprises a prefix matching search unit that performs a prefix matching search of a prefix matching search string, and when searching for the multiple characters of the encryption symbol sequence that prefixly matches the prefix matching search string from the encryption symbol sequence stored in the symbol sequence storage unit, the characters to be encrypted are set in the order from the first search character to the subsequent search characters of the prefix matching search string, the encryption key variation unit applies the variation element that occurred one character before the character to be encrypted to the encryption key to generate the variation encryption key for the character to be encrypted, and the encryption unit uses the generated variation encryption key to perform the encryption target search statement The method is characterized by: encrypting characters into search binary encrypted information; the division unit dividing the search binary encrypted information into a plurality of divided search binary information; the conversion unit converting the plurality of divided search binary information into a search encrypted symbol sequence; the variation element generation unit generating variation elements based on the search binary encrypted information of the target search character; aggregating the search encrypted symbol sequences converted by the conversion unit for the entire prefix-matching search string to form a prefix-matching search encrypted symbol sequence; and the prefix-matching search unit retrieving the encrypted symbol sequences of the plurality of characters that prefix-match the configured prefix-matching search encrypted symbol sequence from the symbol sequence storage unit.

[0013] The invention according to claim 8 is an electronic information encryption system for encrypting, storing, and managing electronic information, comprising: an encryption unit that encrypts a single unit of electronic information, defined by a predetermined unit data length, represented as binary data, into binary encrypted information using an encryption key; a division unit that divides the encrypted binary encrypted information of the single unit of data into a plurality of divided binary information; a conversion unit that converts the plurality of divided binary information into a sequence of encrypted symbols based on a predetermined conversion table that associates the divided binary information with encryption symbols; and a symbol sequence storage unit that stores the converted sequence of encrypted symbols.

[0014] The invention according to claim 9 is characterized in that, in addition to the configuration described in claim 8, when encrypting the electronic information composed of multiple unit data, the unit data to be encrypted are selected in an order from the first unit data to the subsequent unit data, and the encryption unit encrypts the unit data to be encrypted into binary encrypted information using the encryption key.

[0015] The invention according to claim 10 is characterized in that, in addition to the configuration described in claim 8 or 9, it comprises: a reverse conversion unit that reverse-converts the encrypted symbol sequence stored in the symbol sequence storage unit into the plurality of partitioned binary information based on the conversion table; a combination unit that combines the reverse-converted plurality of partitioned binary information to restore the binary encrypted information; and a decryption unit that decrypts the restored binary encrypted information into the unit data of the electronic information using the encryption key.

[0016] The invention according to claim 11 is an electronic information encryption system for encrypting, storing, and managing electronic information including character information, wherein the user terminal comprises an encryption unit that encrypts a single character of the character information represented in binary data into binary encrypted information using an encryption key, a division unit that divides the encrypted binary encrypted information of the single character into a plurality of divided binary information, a conversion unit that converts the plurality of divided binary information into an encrypted symbol sequence based on a predetermined conversion table that associates the divided binary information with encryption symbols, and an encrypted symbol sequence transmission unit that transmits the encrypted symbol sequence converted by the conversion unit, and the electronic information management server comprises an encrypted symbol sequence reception unit that receives the encrypted symbol sequence transmitted from the user terminal and a symbol sequence storage unit that stores the received encrypted symbol sequence.

[0017] The invention according to claim 12 is characterized in that, in addition to the configuration described in claim 11, when the user terminal encrypts the character information composed of multiple characters, the characters to be encrypted are selected in an order from the first character to the subsequent characters, the encryption unit encrypts the characters to be encrypted into binary encrypted information using the encryption key, the splitting unit divides the encrypted binary encrypted information of the multiple characters into a plurality of divided binary information, the conversion unit converts the divided binary information of the multiple characters into an encrypted symbol sequence based on the conversion table, and the encrypted symbol sequence transmission unit sends the converted encrypted symbol sequence of the multiple characters to the electronic information management server.

[0018] The invention according to claim 13 is characterized in that, in addition to the configuration described in claim 11 or 12, the user terminal comprises: a reverse conversion unit that reverse converts the sequence of encrypted symbols sent from the electronic information management server into the plurality of partitioned binary information based on the conversion table; a combination unit that combines the reverse converted plurality of partitioned binary information to restore the binary encrypted information; and a decryption unit that decrypts the restored binary encrypted information into the single character of the character information using the encryption key.

[0019] The invention according to claim 14, in addition to the configuration described in claim 12, comprises: a user terminal comprising a partial match search encrypted symbol sequence configuration unit that encrypts a partial match search string into a symbol sequence; and a partial match search encrypted symbol sequence transmission unit that transmits the configured partial match search encrypted symbol sequence; the electronic information management server comprising a partial match search encrypted symbol sequence reception unit that receives the partial match search encrypted symbol sequence transmitted from the user terminal; and a partial match search unit that performs a partial match search of the partial match search string using the received partial match search encrypted symbol sequence; and when searching for the encrypted symbol sequence of multiple characters that partially matches the partial match search string from the encrypted symbol sequence stored in the symbol sequence storage unit, the user terminal uses the following search characters as the search characters to be encrypted in order from the first search character to the subsequent search character of the partial match search string. The encryption unit encrypts the target search character into search binary encryption information using the encryption key, the splitting unit splits the search binary encryption information into a plurality of split search binary information, the conversion unit converts the plurality of split search binary information into a search encryption symbol sequence, the partial match search encryption symbol sequence constructing unit aggregates the converted search encryption symbol sequence for the entire partial match search string to construct the partial match search encryption symbol sequence, the partial match search encryption symbol sequence sending unit sends out the constructed partial match search encryption symbol sequence, and in the electronic information management server, when the partial match search encryption symbol sequence sent from the user terminal is received by the partial match search encryption symbol sequence receiving unit, the partial match search unit retrieves the encryption symbol sequence of the plurality of characters that partially match the received partial match search encryption symbol sequence from the symbol sequence storage unit.

[0020] The invention according to claim 15 is characterized in that, in addition to the configuration described in claim 1, 2, or 5, it comprises an identification code-attached encryption key storage unit that stores a plurality of identification code-attached encryption keys, each of which is an encryption key and an identification code that uniquely identifies the encryption key, and when an identification code is specified, an identification code-attached encryption key matching the specified identification code is retrieved from the identification code-attached encryption key storage unit, the encryption unit uses the encryption key contained in the retrieved identification code-attached encryption key to encrypt the binary encryption information, and the specified identification code is associated with the encryption symbol sequence converted by the conversion unit and stored in the symbol sequence storage unit.

[0021] The invention according to claim 16, in addition to the configuration described in claim 15, comprises: a reverse conversion unit that reverse-converts the encrypted symbol sequence stored in the symbol sequence storage unit into the plurality of partitioned binary information based on the conversion table; a combination unit that combines the reverse-converted plurality of partitioned binary information to restore the binary encrypted information; and a decryption unit that decrypts the restored binary encrypted information into the single character of the character information using the encryption key, wherein when decrypting the encrypted symbol sequence stored in the symbol sequence storage unit, the decryption unit retrieves the encryption key with an identification code that matches the identification code associated with the encrypted symbol sequence to be decrypted from the encryption key with an identification code storage unit, and decrypts using the encryption key contained in the retrieved encryption key with an identification code.

[0022] The invention according to claim 17 is an electronic information encryption system that encrypts, stores and manages electronic information including character information, wherein the encryption key management server comprises: an encryption key-with-identification-code storage unit that stores a plurality of encryption keys-with-identification-codes each formed as a pair of an encryption key and an identification code that uniquely identifies the encryption key; an identification code receiving unit that receives the identification code transmitted from the electronic information management server; and an encryption key-with-identification-code transmitting unit that extracts the encryption key-with-identification-code matching the received identification code from the encryption key-with-identification-code storage unit, and transmits the extracted encryption key-with-identification-code, and the electronic information management server comprises: an electronic information receiving unit that receives the electronic information transmitted from a user terminal; an identification code transmitting unit that transmits the designated identification code to the encryption key management server; an encryption key-with-identification-code receiving unit that receives the encryption key-with-identification-code transmitted from the encryption key management server; an encryption unit that encrypts one character of the character information represented as binary data into binary encrypted information by using the encryption key included in the received encryption key-with-identification-code; a dividing unit that divides the binary encrypted information obtained by encrypting said one character into a plurality of pieces of divided binary information; a conversion unit that converts the plurality of divided pieces of divided binary information into an encrypted symbol string based on a predetermined conversion table that associates the divided binary information with encryption symbols; and a symbol string storage unit that stores the encrypted symbol string converted by the conversion unit and the identification code transmitted from the identification code transmitting unit in association with each other.

[0023] The invention according to claim 18, in addition to the configuration according to claim 17, is characterized in that, when encrypting the character information composed of a plurality of characters in the electronic information management server, characters are set as encryption target characters in an order from the first character to subsequent characters; the encryption unit encrypts the encryption target character into the binary encrypted information by using the encryption key included in the encryption key-with-identification-code; the dividing unit divides the binary encrypted information of the plurality of encrypted characters into the plurality of pieces of divided binary information; and the conversion unit converts the plurality of pieces of divided binary information of the plurality of divided characters into the encrypted symbol string based on the conversion table.

[0024] The invention according to claim 19, in addition to the configuration according to claim 17 or 18, further comprises: an inverse conversion unit that inversely converts the encrypted symbol string stored in the symbol string storage unit into the plurality of pieces of divided binary information based on the conversion table; a combining unit that combines the plurality of inversely converted pieces of divided binary information to restore the binary encryption information; and a decryption unit that decrypts the restored binary encryption information into the one character of the character information using the encryption key, wherein when decrypting the encrypted symbol string stored in the symbol string storage unit, the electronic information management server transmits the identification code associated with the encrypted symbol string to be decrypted to the encryption key management server, and when receiving the identification code-attached encryption key matching the transmitted identification code from the encryption key management server, the decryption unit performs decryption using the encryption key included in the received identification code-attached encryption key. Effects of the Invention

[0025] According to the invention of claim 1, one character of character information encrypted into binary encryption information is divided into a plurality of pieces of divided binary information, and further, the plurality of pieces of divided binary information are converted into an encrypted symbol string based on a conversion table and then stored. As described above, since double security measures of encryption and conversion into encrypted symbols by a conversion table are implemented, even if the stored encrypted symbol string is stolen, decryption thereof is difficult, and electronic information can be stored and managed safely.

[0026] According to the invention of claim 2, character information composed of a plurality of characters is encrypted.

[0027] According to the invention of claim 3, the encrypted symbol string is decrypted into original character information.

[0028] According to the invention of claim 4, a partial matching search for a partial matching search character string can be performed on a stored encrypted symbol string.

[0029] According to the invention of claim 5, when encrypting character information composed of multiple characters, the characters to be encrypted are selected in order from the first character to the subsequent characters, and a variable element that occurred one character before the character to be encrypted is applied to the encryption key to generate a variable encryption key. Then, the characters to be encrypted are encrypted using this variable encryption key. In this way, since the encryption key changes sequentially for each character to be encrypted, it becomes more difficult to decrypt the encrypted symbol sequence, and the security of the stored electronic information is improved.

[0030] According to the invention of claim 6, character information composed of multiple characters is decoded.

[0031] According to the invention of claim 7, a prefix match search of a prefix match search string can be performed on a stored sequence of encrypted symbols.

[0032] According to the invention of claim 8, a single unit of electronic information data is encrypted into binary encrypted information, which is then divided into multiple partitioned binary information. Furthermore, this multiple partitioned binary information is converted into an encrypted symbol sequence based on a conversion table before being stored. In this way, a double security measure is in place: encryption and conversion to encrypted symbols using a conversion table. Therefore, even if the stored encrypted symbol sequence is stolen, it is difficult to decrypt it, and electronic information can be stored and managed securely.

[0033] According to the invention of claim 9, electronic information composed of multiple unit data is encrypted.

[0034] According to the invention of claim 10, the encrypted symbol sequence is decrypted into the original unit data of electronic information.

[0035] According to the invention of claim 11, the user terminal encrypts a single character of character information into binary encrypted information, divides it into multiple partitioned binary information, and further converts these partitioned binary information into an encrypted symbol sequence based on a conversion table and stores it in the electronic information management server. In this way, a double security measure is in place, which involves encryption and conversion to encrypted symbols using a conversion table. Therefore, even if the stored encrypted symbol sequence is stolen, it is difficult to decrypt it, and electronic information can be stored and managed securely.

[0036] According to the invention of claim 12, character information consisting of multiple characters is encrypted at the user terminal, and the encrypted symbol sequence is stored in the electronic information management server.

[0037] According to the invention of claim 13, the encrypted symbol sequence is decrypted back into the original character information at the user terminal.

[0038] According to the invention of claim 14, a partial match search of a partial match search string can be performed on a sequence of encrypted symbols stored in an electronic information management server.

[0039] According to the invention of claim 15, an encryption key with an identification code is stored in the encryption key storage unit with an identification code, and when an identification code is specified, the encryption key corresponding to that identification code is retrieved and encryption is performed by the encryption unit. For example, by associating an identification code with each department of an organization or each individual user in advance, when a person belonging to that department or an individual user stores electronic information, the associated identification code is automatically specified, the encryption key corresponding to the specified identification code is retrieved, and encryption is performed. In this way, since electronic information is automatically encrypted and stored without the person belonging to the department or the individual user being aware of it, human error is eliminated and security is improved.

[0040] According to the invention of claim 16, an encryption key with an identification code that matches the identification code associated with the encryption symbol sequence to be decrypted is retrieved, and decryption is performed using the encryption key contained in that encryption key with an identification code. When a user reads encrypted electronic information, the associated identification code is automatically retrieved and decryption is performed, thus improving work efficiency by eliminating the need for decryption processing while maintaining high security. Furthermore, even if the management authority of the electronic information is transferred to a different department within the organization, for example, decryption is performed using the identification code associated with the encrypted electronic information. Therefore, even when the management authority of electronic information is transferred to a different department, the process of decryption and re-encryption, which is required each time to match the encryption key of that department, can be eliminated, improving work efficiency.

[0041] According to the invention of claim 17, a single character of character information is encrypted into binary encrypted information, which is then divided into multiple partitioned binary information. Furthermore, these partitioned binary information is converted into an encrypted symbol sequence based on a conversion table before being stored. In this way, a double security measure is in place: encryption and conversion to encrypted symbols using a conversion table. Therefore, even if the stored encrypted symbol sequence is stolen, it is difficult to decrypt it, and electronic information can be stored and managed securely.

[0042] Furthermore, the encryption key management server stores encryption keys with identification codes. The electronic information management server receives the encryption key with the identification code corresponding to the specified identification code from the encryption key management server and uses the encryption key contained within that encryption key to perform encryption. Since the electronic information management server does not store the encryption keys, there is no risk of encryption keys being leaked even if the electronic information management server is subjected to a security attack.

[0043] Furthermore, by pre-associating identification codes with each department within an organization or with each individual user, when a person belonging to that department or an individual user stores electronic information, the associated identification code is automatically selected, the encryption key corresponding to the selected identification code is retrieved, and encryption is performed. In this way, electronic information is automatically encrypted and stored without the individual belonging to the department or the individual user being aware of it, eliminating human error and improving security.

[0044] According to the invention of claim 18, character information composed of multiple characters is encrypted.

[0045] According to the invention of claim 19, an encryption key with an identification code that matches the identification code associated with the encryption symbol sequence to be decrypted is retrieved from the encryption key management server, and the encryption key contained in that encryption key with an identification code is used to perform decryption. When a user reads encrypted electronic information, the associated identification code is automatically retrieved and decryption is performed, thus improving work efficiency by eliminating the need for decryption processing while maintaining high security. Furthermore, even if the management authority of the electronic information is transferred to a different department within the organization, for example, the identification code associated with the encrypted electronic information is used to perform decryption. Therefore, even when the management authority of electronic information is transferred to a different department, the process of decryption and re-encryption, which is required each time to match the encryption key of that department, can be omitted, improving work efficiency. [Brief explanation of the drawing]

[0046] [Figure 1] This is a schematic block diagram of the electronic information encryption system according to the first embodiment of this invention. [Figure 2] This is a schematic functional block diagram of the user terminal according to the first embodiment. [Figure 3] This figure shows an example of a conversion table that associates segmented binary information with encryption symbols according to the first embodiment. [Figure 4] This is a diagram illustrating the single-character encryption process according to the first embodiment. [Figure 5] This diagram illustrates the string encryption process according to the first embodiment, where (a) shows the process of encryption using the same encryption key, and (b) shows the process of encryption using a variable encryption key generated by applying a variable element to the encryption key. [Figure 6] This figure shows an example of a data structure according to the first embodiment, where (a) shows the data structure of electronic information and (b) shows the data structure of encrypted electronic information. [Figure 7] This is a diagram illustrating the single-character decoding process according to the first embodiment. [Figure 8] This is a schematic functional block diagram of the electronic information management server according to the first embodiment. [Figure 9] This diagram illustrates the flow of storing and reading electronic information in the electronic information encryption system according to the first embodiment, where (a) shows the flow of storing electronic information and (b) shows the flow of reading electronic information. [Figure 10] This is a schematic block diagram of the electronic information encryption system according to a second embodiment of the present invention. [Figure 11] This is a schematic block diagram of the electronic information encryption system according to a third embodiment of the present invention. [Figure 12] This figure shows an example of the structure of an encryption key with an identification code according to the third embodiment, where (a) shows the state in which the identification code and the encryption key form a pair, and (b) shows the state in which the encryption key has been decrypted and has become an encryption key. [Figure 13] This figure shows an example of a data structure according to the third embodiment, where (a) shows the data structure of electronic information and (b) shows the data structure of encrypted electronic information. [Figure 14] This is a schematic functional block diagram of the cryptographic key management server according to the third embodiment. [Figure 15] This is a schematic functional block diagram of the electronic information management server according to the third embodiment. [Figure 16] This is a schematic functional block diagram of the user terminal according to the third embodiment. [Modes for carrying out the invention]

[0047] [First Embodiment of the Invention] A first embodiment of this invention will be described with reference to Figures 1 to 9.

[0048] Figure 1 is a schematic block diagram of an electronic information encryption system 1 according to a first embodiment of the present invention, which encrypts, stores, and manages electronic information. This electronic information encryption system 1 takes data constituting electronic information as input, encrypts the input data, and encrypts the encrypted electronic information using user terminals 41, 42, ... 4 n An electronic information management server 2, which stores and manages encrypted electronic information, is connected via a communication line 9 such as the Internet. The following are user terminals 41, 42, ... 4 n It is represented by the symbol 4 (user terminal 4).

[0049] Figure 2 is a schematic functional block diagram of the user terminal 4. This user terminal 4 is configured to include a terminal control unit 40, an input unit 41, a display unit 42, an ID issuance request transmission unit 44, an ID reception unit 45, an ID storage unit 46, an encryption key generation unit 48, an encryption key storage unit 49, an encryption unit 50, a splitting unit 51, a conversion table storage unit 52, a conversion unit 53, a variable element generation unit 54, an encryption key variation unit 55, an encrypted electronic information configuration unit 56, an encrypted electronic information transmission unit 57, an inverse conversion unit 60, a combination unit 61, a decryption unit 62, a partial match search unit 65, a prefix match search unit 66, a search condition transmission unit 67, a search result screen reception unit 70, an electronic information restoration unit 71, and a communication unit 74. The user terminal 4 can be an information processing terminal such as a PC (Personal Computer) or a smartphone.

[0050] The terminal control unit 40 is configured to include a CPU (Central Processing Unit) (not shown), a non-volatile storage device such as auxiliary storage and flash memory, and a volatile memory such as RAM (Random Access Memory). The CPU performs program execution, arithmetic processing, and controls the operation of each element constituting this user terminal 4. The auxiliary storage device stores programs executed by the CPU and registered data, and uses HDDs (Hard Disk Drives) or SSDs (Solid State Drives). RAM is used as a work area for program execution and arithmetic processing by the CPU.

[0051] The input unit 41 receives input from the user, such as data and operation instructions that constitute electronic information. Input devices such as a keyboard or touch panel are used as the input unit 41. Alternatively, the input unit 41 may be configured to accept voice input by using a microphone. When voice input is used, the voice is converted into text and input. The display unit 42 displays the input data, the search results for electronic information stored in the electronic information management server 2, and the retrieved electronic information. Display devices such as a touch panel LCD (Liquid Crystal Display) or organic EL (Electro-Luminescence) are used for the display unit 42.

[0052] The ID issuance request sending unit 44 sends a request (ID issuance request) to the electronic information management server 2 to issue an ID (Identification). An ID is unique identification data composed of letters, numbers, and symbols, and different IDs may be issued to correspond to different scopes of access rights, such as for company use, department use, and personal use. The ID receiving unit 45 receives the ID issued by the electronic information management server 2. The ID storage unit 46 stores the received ID.

[0053] The encryption key generation unit 48 generates an encryption key 300, which is a common key used for encrypting and decrypting electronic information. The encryption key 300 is associated with an ID. That is, when an ID is specified, the encryption key 300 corresponding to that ID is selected, and the electronic information is encrypted or decrypted. The generated encryption key 300 is stored in the encryption key storage unit 49.

[0054] The encryption unit 50 encrypts the electronic information represented as binary data into binary encrypted information 202 using the encryption key 300 (binary encryption process 501). The partitioning unit 51 partitions the encrypted binary encrypted information 202 into multiple partitioned binary information 203 (partitioning process 502).

[0055] The conversion table storage unit 52 stores a conversion table 400 that associates the segmented binary information 203 generated by a conversion table generation unit (not shown) with the encryption symbols 204.

[0056] Figure 3 shows an example of a conversion table 400. When the partitioned binary information 203 consists of 6 bits, the partitioned binary information 203 represents a number from 0 to 63 in decimal. The conversion table 400 is composed of encryption symbols 204 consisting of non-repeating characters, numbers, or symbols that are one-to-one correspondences to the numbers from 0 to 63 represented by the partitioned binary information 203. The combination of the number represented by the partitioned binary information 203 and the encryption symbols 204 can be arbitrarily constructed.

[0057] This conversion table 400 is associated with an ID and an encryption key 300. When an ID is specified and the encryption key 300 is retrieved from the encryption key storage unit 49, the conversion table 400 corresponding to that encryption key 300 is selected from the conversion table storage unit 52. Then, the selected conversion table 400 is used to perform the conversion from the partitioned binary information 203 to the encryption symbol 204.

[0058] The conversion unit 53 shown in Figure 2 converts the multiple partitioned binary information 203 separated by the partitioning unit 51 into multiple encryption symbols 204 based on the conversion table 400, and constructs an encryption symbol sequence 205 (conversion process 503).

[0059] Figure 4 is an explanatory diagram illustrating the encryption process of a single character of character information 200 contained in electronic information. In this example, the character information 200 is the letter "A" of the alphabet, and the single character encryption process 500 is performed. The character information 200 uses the UTF-16 (UCS transformation format 16bit) character encoding scheme, where each character is represented by 16 bits of binary data.

[0060] The character information binary data 201 representing the character information 200 "A" is encrypted using the encryption key 300 in a binary encryption process 501 to obtain 16-bit binary encrypted information 202. Any encryption algorithm can be used in this binary encryption process 501. The simplest example of an encryption algorithm is to add the binary data of the encryption key 300 to the character information binary data 201 to construct the binary encrypted information 202. In this example, the binary encrypted information 202 has a 16-bit structure, but it does not need to be 16 bits long and can have a longer bit length.

[0061] Next, a partitioning process 502 is performed to divide the binary encrypted information 202 into three partitioned binary information 203. Since each partitioned binary information 203 consists of 6 bits, the binary encrypted information 202 is divided into the lower 6 bits, the middle 6 bits, and the upper 4 bits. The lower 6 bits and the middle 6 bits are used to form two partitioned binary information 203, and the upper 4 bits are padded with 2 bits of "0 (zero)" to form a third partitioned binary information 203 with 6 bits. In this example, it is divided into three partitioned binary information 203, but the number of partitions can be increased, for example, by dividing the binary encrypted information 202 into four 4-bit partitions and padding them to form four partitioned binary information 203.

[0062] Next, a conversion process 503 is performed to retrieve the encryption symbols 204 corresponding to the numerical values ​​from 0 to 63 indicated by the partitioned binary information 203 from the conversion table 400, thereby obtaining the three encryption symbols 204 "s", "d", and "K" corresponding to the three partitioned binary information 203. Finally, the three encryption symbols 204 are aggregated to form an encryption symbol sequence 205 called "sdK". Encrypted electronic information is formed using the encryption symbol sequence 205 thus constructed and stored in the electronic information management server 2.

[0063] Furthermore, the character encoding scheme used to represent character information 200 is not limited to UTF-16; any other scheme can be used. Also, the bit length of the binary data representing character information 200 may be 32 bits or other lengths besides 16 bits.

[0064] Furthermore, although Figure 4 illustrates the encryption process for character information 200, it can also be applied when the electronic information is image information such as a photograph. In the case of an image, the same encryption process can be applied to each unit of data that constitutes the image, defined by a predetermined unit data length, such as 16 bits. The image information encrypted in this way is then decrypted by the decryption process described later, similar to the character information 200.

[0065] Figure 5 illustrates the string encryption process 520 for the string "BABY".

[0066] Figure 5(a) shows that the characters to be encrypted are in the order from the first character to the subsequent characters, and the encryption unit 50 performs a binary encryption process 501 in which it encrypts the characters to be encrypted into binary encrypted information 202 using the same encryption key 300. That is, the single-character encryption process 500 described in Figure 4 is performed independently for the four characters "B", "A", "B", and "Y". When the encryption process is performed using the same encryption key 300, if the character information 200 is the same, the encryption symbol sequence 205 will also match, such as the encryption symbol sequence 205 "auH" corresponding to the first "B" and the third "B". From this string "BABY", the encryption symbol sequence 205 "auHsdKauHcTe" is generated.

[0067] Figure 5(b) shows a string encryption process 520 with a different configuration from Figure 5(a). In the string encryption process 520 shown in Figure 5(b), binary encryption processing 501 is performed by changing the encryption key 300 for each character to be encrypted. As a method for changing the encryption key 300, a change element 301 that changes the encryption key 300 is generated by applying a predetermined operation to the binary encryption information 202 obtained by the binary encryption processing 501 (change element generation process 504), and the generated change element 301 is applied to the encryption key 300 to generate a change encryption key 302 (change encryption key generation process 505). Then, the binary encryption processing 501 of the subsequent characters to be encrypted is performed using the generated change encryption key 302. As an operation to generate a change element 301 based on the binary encryption information 202, for example, the upper 12 bits of the binary encryption information 202 may be masked with "0 (zero)" to extract the lower 4 bits, and the extracted lower 4 bits may be used as the change element 301. The variable encryption key 302 may be generated by adding the variable element 301 to the encryption key 300.

[0068] When encrypting the character information 200 consisting of the four characters "BABY", the encryption unit 50 encrypts the first character "B" into first binary encrypted information 202a using the encryption key 300, and the first variable element 301a is generated based on this first binary encrypted information 202a.

[0069] For the second character "A", the first variable element 301a generated based on the first binary encryption information 202a is applied to the encryption key 300 to generate the first variable encryption key 302a. The encryption unit 50 uses this first variable encryption key 302a to encrypt the second character "A" into the second binary encryption information 202b, and the second variable element 301b is generated based on this second binary encryption information 202b.

[0070] For the third character "B", the second variable element 301b generated based on the second binary encryption information 202b is applied to the encryption key 300 to generate the second variable encryption key 302b, and the encryption unit 50 uses this second variable encryption key 302b to encrypt the third character "B" into the third binary encryption information 202c, and the third variable element 301c is generated based on this third binary encryption information 202c.

[0071] Sequentially, for the fourth character "Y" and onward, the variable element 301 generated in the character immediately preceding the character to be encrypted is applied to the encryption key 300 to generate a variable encryption key 302 for the characters to be encrypted from the fourth character "Y" onward. The encryption unit 50 then uses the generated variable encryption key 302 to encrypt the characters to be encrypted into binary encrypted information 202, and a variable element 301 is generated based on the binary encrypted information 202 of the characters to be encrypted.

[0072] In the string encryption process 520 shown in Figure 5(b), the encryption key 300 is changed for each character to be encrypted, and binary encryption processing 501 is performed. As a result, the encryption symbol sequence 205 "auH" corresponding to the first "B" and the encryption symbol sequence 205 "#-d" corresponding to the third "B" are different. This makes decryption more difficult. From the string "BABY", the encryption symbol sequence 205 "auHsdy#-d-##" is generated.

[0073] Either the string encryption process 520 shown in Figure 5(a) or Figure 5(b) may be used, or the user may be able to switch between them. Furthermore, when the encryption key 300 is generated, the user may be able to set whether to use the string encryption process 520 shown in Figure 5(a) or Figure 5(b) for that encryption key 300.

[0074] The variable element generation unit 54 shown in Figure 2 generates a variable element 301 that changes the encryption key 300 by performing a predetermined operation on the binary encryption information 202 (variable element generation process 504). The encryption key variation unit 55 applies the generated variable element 301 to the encryption key 300 to generate a varied encryption key 302 (variable encryption key generation process 505).

[0075] The encrypted electronic information component 56 constitutes encrypted electronic information obtained by encrypting electronic information.

[0076] Figure 6 shows examples of data structures; Figure 6(a) shows the data structure 100 for electronic information, and Figure 6(b) shows the data structure 120 for encrypted electronic information.

[0077] The data structure 100 for electronic information consists of an ID field 101, a file name field 102, a string A field 103, a string B field 104, a string C field 105, and an image field 106. Each field allows for the setting of an encryption flag 118. Setting the encryption flag 118 to "1" encrypts the data in that field and stores it in the electronic information management server 2. On the other hand, setting the encryption flag 118 to "0" encrypts the data and stores it in the electronic information management server 2.

[0078] The encrypted ID field 121, encrypted file name field 122, encrypted string A field 123, encrypted string B field 124, encrypted string C field 125, and encrypted image field 126 of the encrypted electronic information data structure 120 correspond to fields 101 to 106 of the electronic information data structure 100, respectively, and either encrypted data or unencrypted data in plain text is written based on the setting of the encryption flag 118 of the electronic information data structure 100.

[0079] By including an ID in the data structure, it becomes possible to read and search encrypted electronic information that has a specified ID set to it.

[0080] The data structure shown in Figure 6 is just one example. For instance, when handling images of photographs containing text, facsimile document images, or PDF (Portable Document Format) files as electronic information, optical character recognition (OCR) technology can be used to recognize the text, and the recognized text information 200 can be stored in a separate field from the image information. In this case, the data structure will consist of the text information 200 recognized by OCR and the image information coexisting. By retaining the text information 200 recognized by OCR, it becomes possible to perform string-based searches on photographic images and other data.

[0081] Furthermore, AI (artificial intelligence) image analysis may be performed on photographic images, facsimile document images, and PDF files to recognize text information 200. Also, if audio is input, text information 200 may be recognized by transcription using AI technology. Alternatively, images may be input to a generating AI, and the output text information 200 may be used.

[0082] Alternatively, the ID field 101 of the electronic information data structure 100 shown in Figure 6(a) may be subjected to the string encryption process 520 shown in Figure 5(b), while the other fields 102 to 106 may be subjected to the string encryption process 520 shown in Figure 5(a). By changing the string encryption process 520 applied to each field 101 to 106 of the electronic information data structure 100, decryption becomes more difficult.

[0083] The encrypted electronic information configuration unit 56 shown in Figure 2 encrypts the data input to the electronic information data structure 100 (see Figure 6(a)) according to the setting of the encryption flag 118, thereby constituting encrypted electronic information.

[0084] The encrypted electronic information transmission unit 57 transmits the encrypted electronic information configured in the encrypted electronic information configuration unit 56 to the electronic information management server 2. This encrypted electronic information transmission unit 57 functions as an "encrypted symbol sequence transmission unit".

[0085] The encrypted electronic information transmitted from the encrypted electronic information transmission unit 57 is stored and managed in the electronic information management server 2. When viewing the stored electronic information on the user terminal 4, the encrypted electronic information is received from the electronic information management server 2, and the encrypted symbol sequence 205 contained in the encrypted electronic information is decrypted on the user terminal 4 to restore the character information 200.

[0086] Figure 7 illustrates the process of decrypting the encrypted symbol sequence 205 to recover a single character of the character information 200. In this example, the single-character decryption process 510 is performed on "sdK" in the encrypted symbol sequence 205.

[0087] First, the encryption symbol sequence 205 "sdK" is divided into three encryption symbols 204 "s", "d", and "K". Each encryption symbol 204 is then inversely transformed into three partitioned binary information 203 based on the relationship defined in the transformation table 400 shown in Figure 3 (inverse transformation process 511). Two of the partitioned binary information 203 obtained by the inverse transformation hold the lower 6 bits and middle 6 bits of the binary encryption information 202, while the third partitioned binary information 203 holds the 2 bits embedded by padding and the upper 4 bits of the binary encryption information 202. Next, these three partitioned binary information 203 are combined to restore 16 bits of binary encryption information 202 (combination process 512). The restored binary encryption information 202 is then decrypted into character information binary data 201 using the encryption key 300, which is a common key also used as a decryption key (binary decryption process 513). Any decryption algorithm can be used in this binary decryption process 513. A simple example of a decryption algorithm is to subtract the binary data of the encryption key 300 from the binary encryption information 202 to construct the character information binary data 201. In this way, the recovered character information binary data 201 represents the single character "A" from the character information 200.

[0088] When decrypting the encrypted symbol sequence 205 "auHsdKauHcTe" generated by the string encryption process 520 of the string "BABY" shown in Figure 5(a), "auHsdKauHcTe" is divided into four encrypted symbol sequences 205: "auH", "sdK", "auH", and "cTe". Then, the characters to be decrypted are determined in the order from "auH" in the encrypted symbol sequence 205 corresponding to the first character "B" to the subsequent characters "A", "B", and "Y". The same encryption key 300 is used for each of the "auH", "sdK", "auH", and "cTe" in the encrypted symbol sequence 205, and the single-character decryption process 510 shown in Figure 7 is performed. Through this series of decryption processes, the string "BABY" of the character information 200 is restored.

[0089] When decrypting the encrypted symbol sequence 205 "auHsdy#-d-##" generated by the string encryption process 520 of the string "BABY" shown in Figure 5(b), "auHsdy#-d-##" is separated into four encrypted symbol sequences 205: "auH", "sdy", "#-d", and "-##".

[0090] For the encryption symbol sequence 205 "auH" corresponding to the first character "B", the encryption symbols 204 "a", "u", and "H" are inversely transformed into three partitioned binary information 203 corresponding to the first character "B" based on the transformation table 400 (inverse transformation process 511). These three partitioned binary information 203 are then combined to restore the first binary encrypted information 202a corresponding to the first character "B" (combination process 512). This first binary encrypted information 202a is decrypted using the encryption key 300 to obtain the character information binary data 201a corresponding to the first character "B" (binary decryption process 513). In addition, along with the decryption process of the first binary encrypted information 202a, the first variable element 301a is generated based on the first binary encrypted information 202a (variable element generation process 504). As an operation to generate the first variable element 301a based on the first binary encrypted information 202a, for example, the upper 12 bits of the first binary encrypted information 202a may be masked with "0 (zero)" to extract the lower 4 bits, and these extracted lower 4 bits may be used as the first variable element 301a.

[0091] For the cipher symbol sequence 205 "sdy" corresponding to the second character "A", the first variable element 301a generated based on the first binary cipher information 202a is applied to the encryption key 300 to generate the first variable encryption key 302a (variable encryption key generation process 505), and the cipher symbols 204 "s", "d", and "y" are inversely transformed into three partitioned binary information 203 corresponding to the second character "A" based on the transformation table 400 (inverse transformation process 511). Subsequently, these three partitioned binary information 203 are combined to restore the second binary cipher information 202b corresponding to the second character "A", and this second binary cipher information 202b is decrypted using the first variable encryption key 302a generated by applying the first variable element 301a to the encryption key 300 to obtain the character information binary data 201b corresponding to the second character "A" (binary decryption process 513). Furthermore, along with the decryption process of the second binary encrypted information 202b, a second variable element 301b is generated based on the second binary encrypted information 202b (variable element generation process 504).

[0092] The first variable encryption key 302a may be generated by adding the first variable element 301a to the encryption key 300.

[0093] For the encryption symbol sequence 205 "#-d" corresponding to the third character "B", the second variable element 301b generated based on the second binary encryption information 202b is applied to the encryption key 300 to generate the second variable encryption key 302b (variable encryption key generation process 505), and the encryption symbols 204 "#", "-", and "d" are inversely transformed into three partitioned binary information 203 corresponding to the third character "B" based on the transformation table 400 (inverse transformation process 511). Subsequently, these three partitioned binary information 203 are combined to restore the third binary encryption information 202c corresponding to the third character "B", and this third binary encryption information 202c is decrypted using the second variable encryption key 302b generated by applying the second variable element 301b to the encryption key 300 to obtain the character information binary data 201c corresponding to the third character "B" (binary decryption process 513). Furthermore, along with the decryption process of the third binary encrypted information 202c, a third variable element 301c is generated based on the third binary encrypted information 202c (variable element generation process 504).

[0094] Sequentially, for each encryption symbol sequence 205 corresponding to the target character to be decrypted, starting from the fourth character "Y", the variable element 301 generated one character prior to the target character is applied to the encryption key 300 to generate a variable encryption key 302 for the target character (variable encryption key generation process 505). This is then converted back into three partitioned binary information 203 corresponding to the target character (inverse conversion process 511), and these three partitioned binary information 203 are combined to restore the binary encryption information 202 corresponding to the target character (combination process 512). Then, the binary encryption information 202 of the target character is decrypted using the variable encryption key 302 for the target character, and the character information binary data 201 corresponding to the target character is obtained (binary decryption process 513). In addition, along with the decryption process of the binary encryption information 202, a variable element 301 is generated based on the binary encryption information 202 of the target character.

[0095] The reverse transformation unit 60 shown in Figure 2 reverses the encryption symbol sequence 205 into multiple partitioned binary information 203 by replacing each encryption symbol 204 constituting the encryption symbol sequence 205 with partitioned binary information 203 based on the relationships defined in the transformation table 400 (reverse transformation process 511). The concatenation unit 61 concatenates the multiple partitioned binary information 203 that have been reverse-transformed to restore the binary encrypted information 202 (concatenation process 512). The decryption unit 62 decrypts the restored binary encrypted information 202 into character information binary data 201 using the encryption key 300 (binary decryption process 513). This character information binary data 201 represents a single character of the character information 200.

[0096] The partial match search unit 65 constitutes a partial match search encryption symbol sequence used when searching for a multi-character encryption symbol sequence 205 that partially matches the partial match search string from among the encrypted electronic information stored in the electronic information management server 2.

[0097] As shown in Figure 5(a), partial matching is possible for encrypted symbol sequences 205 ("auHsdKauHcTe") where the string ("BABY") is encrypted with the same encryption key 300. The characters to be encrypted are selected in the order from the first search character to the subsequent search characters of the partial match search string, and the encryption unit 50 encrypts the characters to be encrypted into binary encrypted information 202 (search binary encrypted information) using the encryption key 300 (binary encryption process 501). Next, the splitting unit 51 splits this search binary encrypted information into multiple split binary information 203 (split search binary information) (splitting process 502), and the conversion unit 53 converts the multiple split search binary information into a search encrypted symbol sequence based on the conversion table 400 (conversion process 503). Subsequently, the converted search encrypted symbol sequences are aggregated for the entire partial match search string to form a partial match search encrypted symbol sequence. The partially matching search encryption symbol sequence configured in this way is sent to the electronic information management server 2, and encrypted electronic information containing the encryption symbol sequence 205 that partially matches the partially matching search encryption symbol sequence is retrieved from the encrypted electronic information stored in the electronic information management server 2.

[0098] If we use "AB" from the string "BABY" shown in Figure 5(a) as the partial match search string, the partial match search encryption symbol sequence will be "sdKauH".

[0099] The prefix matching search unit 66 constitutes a prefix matching encryption symbol sequence used when searching for a multi-character encryption symbol sequence 205 that prefixes to the prefix matching search string from among the encrypted electronic information stored in the electronic information management server 2.

[0100] For the encrypted character sequence 205 ("auHsdy#-d-##") obtained by encrypting the characters of the string ("BABY") as shown in Figure 5(b) using a variable encryption key 302 composed of variable elements 301 and encryption key 300, prefix matching is possible. When the prefix matching search string for the string "BABY" shown in Figure 5(b) is "BAB", the prefix matching search encryption character sequence is constructed as follows.

[0101] For the first search character "B" of the prefix matching search string "BAB", the encryption unit 50 encrypts it into first binary encrypted information 202a (first search binary encrypted information) using the encryption key 300 (binary encryption process 501). Next, the splitting unit 51 splits this first search binary encrypted information into three first split binary information 203a (first split search binary information) (splitting process 502), and the conversion unit 53 converts the three first split search binary information into the first encrypted symbol sequence 205a (first search encrypted symbol sequence), which is "auH", based on the conversion table 400 (conversion process 503). In addition, the variation element generation unit 54 generates a first variation element 301a (first search variation element) based on the first search binary encrypted information (variation element generation process 504).

[0102] For the second search character "A", the encryption key variation unit 55 applies the first search variation element to the encryption key 300 to generate the first variation encryption key 302a (first search variation encryption key) (variation encryption key generation process 505), and the encryption unit 50 uses the generated first search variation encryption key to encrypt the second search character "A" into second binary encryption information 202b (second search binary encryption information) (binary encryption process 501). Next, the splitting unit 51 splits the second search binary encryption information into three second split binary information 203b (second split search binary information) (splitting process 502), and the conversion unit 53 converts the three second split search binary information into the second encryption symbol sequence 205b (second search encryption symbol sequence), which is "sdy," based on the conversion table 400 (conversion process 503). In addition, the variation element generation unit 54 generates a second variation element 301b (second search variation element) based on the second search binary encryption information (variation element generation process 504).

[0103] Sequentially, for the third search character "B" and onward, the encryption key variation unit 55 applies the variation element 301 generated one character prior to the search character to be encrypted to the encryption key 300 to generate a variation encryption key 302 for the search characters to be encrypted from the third search character "B" onward (variable encryption key generation process 505), and the encryption unit 50 uses the generated variation encryption key 302 to encrypt the search characters to be encrypted into search binary encryption information (binary encryption process 501). Next, the division unit 51 divides this search binary encryption information into three divided search binary information (division process 502), and the conversion unit 53 converts the three divided search binary information into a search encryption symbol sequence based on the conversion table 400 (conversion process 503). In addition, the variation element generation unit 54 generates variation elements 301 based on the search binary encryption information of the search characters to be encrypted (variable element generation process 504).

[0104] When all characters of the prefix-matching search string "BAB" are converted into a search encryption symbol sequence, the converted search encryption symbol sequence is aggregated for the entire prefix-matching search string to form a prefix-matching search encryption symbol sequence "auHsdy#-d". This prefix-matching search encryption symbol sequence is sent to the electronic information management server 2, and encrypted electronic information containing an encryption symbol sequence 205 that prefixes to the prefix-matching search encryption symbol sequence is retrieved from the encrypted electronic information stored in the electronic information management server 2.

[0105] The search condition sending unit 67 sends search conditions to the electronic information management server 2 that include a partial match search command, a partial match search encrypted symbol sequence composed of the partial match search unit 65, and an ID encrypted symbol sequence 205 obtained by encrypting the ID. When sending a partial match search encrypted symbol sequence in this way, the search condition sending unit 67 functions as a "partial match search encrypted symbol sequence sending unit".

[0106] Furthermore, the search condition sending unit 67 sends search conditions to the electronic information management server 2 that include a prefix matching search command, a prefix matching search encryption symbol sequence composed of the prefix matching search unit 66, and an ID encryption symbol sequence obtained by encrypting the ID to form the encryption symbol sequence 205. In this way, when sending a prefix matching search encryption symbol sequence, the search condition sending unit 67 functions as a "prefix matching search encryption symbol sequence sending unit".

[0107] The search results screen receiving unit 70 receives the search results screen provided by the electronic information management server 2. The encrypted symbol sequence 205 included in the search results screen is decrypted and restored to character information 200. The search results screen received by the search results screen receiving unit 70 is displayed on the display unit 42, and when the user selects electronic information to read from the search results screen, the selection information is sent to the electronic information management server 2, and the electronic information management server 2 sends encrypted electronic information corresponding to the selection information.

[0108] The electronic information restoration unit 71 decrypts the encrypted electronic information sent from the electronic information management server 2 and restores it to electronic information. The restored electronic information is displayed on the display unit 42.

[0109] The communications unit 74 handles the transmission and reception of data with external parties. Communication between the user terminal 4 and the electronic information management server 2 is conducted using well-known encrypted communication.

[0110] Figure 8 is a schematic functional block diagram of the electronic information management server 2. This electronic information management server 2 is configured to include a server control unit 20, an ID issuance request reception unit 22, an ID issuance unit 23, an ID transmission unit 24, an encrypted electronic information reception unit 26, an encrypted electronic information storage unit 27, a search condition reception unit 30, a search unit 31, a server-side partial match search unit 32, a server-side prefix match search unit 33, a search result screen provision unit 34, a search electronic information transmission unit 35, and a communication unit 37. The electronic information management server 2 uses information processing equipment such as a server device or a PC.

[0111] The server control unit 20 is configured to include a CPU (not shown), an auxiliary storage device for storing programs, etc., and RAM, which is the operating area for program execution. The CPU performs program execution, arithmetic processing, and controls the operation of each element that constitutes this electronic information management server 2.

[0112] The ID issuance request receiving unit 22 receives ID issuance requests sent from the user terminal 4. The ID issuance unit 23 issues a unique ID in response to the ID issuance request. The ID transmission unit 24 sends the issued ID to the source of the ID issuance request.

[0113] The encrypted electronic information receiving unit 26 receives encrypted electronic information sent from the user terminal 4. This encrypted electronic information receiving unit 26 functions as an "encrypted symbol sequence receiving unit".

[0114] The encrypted electronic information storage unit 27 stores the encrypted electronic information received by the encrypted electronic information receiving unit 26. This encrypted electronic information storage unit 27 functions as a "symbol sequence storage unit".

[0115] The search condition receiving unit 30 receives search conditions sent from the user terminal 4. In the case of search conditions for partial matching, this search condition receiving unit 30 functions as a "partial matching encrypted symbol sequence receiving unit". In the case of search conditions for prefix matching, this search condition receiving unit 30 functions as a "prefix matching encrypted symbol sequence receiving unit".

[0116] The search unit 31 searches for encrypted electronic information stored in the encrypted electronic information storage unit 27 based on the search conditions received by the search condition receiving unit 30. If the data structure 120 of the encrypted electronic information has the configuration shown in Figure 6(b), the search unit extracts encrypted electronic information in which the encrypted ID field 121 contains an encrypted ID 131 that matches the ID encryption symbol sequence included in the search conditions, and uses this extracted encrypted electronic information as the search target.

[0117] This search unit 31 includes a server-side partial match search unit 32 and a server-side prefix match search unit 33. When the search condition is a partial match search, the server-side partial match search unit 32 retrieves encrypted electronic information that partially matches the partial match search encryption symbol sequence. On the other hand, when it is a prefix match search, the server-side prefix match search unit 33 retrieves encrypted electronic information that prefix matches the prefix match search encryption symbol sequence.

[0118] The search results screen provision unit 34 configures the search results screen and provides it to the user terminal 4. When the search electronic information transmission unit 35 receives selection information for the electronic information to be read from the user terminal 4, it transmits encrypted information corresponding to that selection information to the user terminal 4.

[0119] The communications unit 37 is responsible for sending and receiving data with external parties.

[0120] Next, the operation of the electronic information encryption system 1 according to the first embodiment of this invention will be described.

[0121] Figure 9(a) is a diagram illustrating the process of storing electronic information.

[0122] When the user selects an ID from the IDs stored in the user terminal 4 (step S1), the encryption key 300 and conversion table 400 corresponding to that ID are read from the user terminal 4. Next, the user inputs data and sets whether to store the data encrypted or stored in plain text (step S2). Once the user has finished inputting the data, the electronic information composed of the input data is encrypted using the encryption key 300 and conversion table 400, and encrypted electronic information is generated (step S3). Finally, when the user inputs a command to store the encrypted electronic information in the electronic information management server 2, the encrypted electronic information is sent to the electronic information management server 2 (step S4).

[0123] When the electronic information management server 2 receives this encrypted electronic information (step S5), it stores it in the encrypted electronic information storage unit 27 (step S6).

[0124] Figure 9(b) is a diagram illustrating the process of reading electronic information.

[0125] When the user selects an ID stored in the user terminal 4 (step S11) and enters a search string for a partial match or prefix match search (step S12), the entered search string is encrypted, and the generated encrypted search string constitutes the search conditions (step S13). These search conditions are sent from the user terminal 4 to the electronic information management server 2 (step S14).

[0126] When the electronic information management server 2 receives the search criteria (step S15), it searches for encrypted electronic information that matches the search criteria (step S16). The search results are compiled on the search results screen and provided to the user terminal 4 (step S17).

[0127] The user terminal 4 decodes and displays the received search results screen. When the user selects the electronic information to be read from the search results screen (step S18), the request for the electronic information to be read is notified to the electronic information management server 2 as selected information.

[0128] The electronic information management server 2 sends encrypted electronic information corresponding to the requested electronic information to be read to the user terminal 4 (step S19). When the user terminal 4 receives this encrypted electronic information (step S20), it decrypts the received encrypted electronic information, restores it to electronic information (step S21), and displays it (step S22).

[0129] Next, the effects of the first embodiment of this invention will be described.

[0130] According to the first embodiment of this invention, a single character of character information 200 is encrypted into binary encrypted information 202, which is then divided into multiple partitioned binary information 203. Furthermore, these partitioned binary information 203 are converted into an encrypted symbol sequence 205 based on a conversion table 400 before being stored. In this way, a double security measure is in place: encryption and conversion to encrypted symbols 204 by the conversion table 400. Therefore, even if the stored encrypted symbol sequence 205 is stolen, it is difficult to decrypt it, and electronic information can be stored and managed securely.

[0131] Furthermore, according to the first embodiment, a partial match search of a partial match search string can be performed on the encrypted symbol sequence 205 stored in the electronic information management server 2.

[0132] Furthermore, according to the first embodiment, when encrypting character information 200 composed of multiple characters, the characters to be encrypted are selected in order from the first character to the subsequent characters, and a variable element 301 that occurred one character before the character to be encrypted is applied to the encryption key 300 to generate a variable encryption key 302. Then, the characters to be encrypted are encrypted using this variable encryption key 302. In this way, since the encryption key 300 changes sequentially for each character to be encrypted, it becomes more difficult to decrypt the encryption symbol sequence 205, and the security of the stored electronic information is improved.

[0133] Furthermore, according to the first embodiment, a prefix matching search of a prefix matching search string can be performed on the encrypted symbol sequence 205 stored in the electronic information management server 2.

[0134] Furthermore, according to the first embodiment, a single unit of electronic information data is encrypted into binary encrypted information 202, which is then divided into multiple partitioned binary information 203. These partitioned binary information 203 are then converted into an encrypted symbol sequence 205 based on a conversion table 400 before being stored. In this way, a double security measure is in place: encryption and conversion to encrypted symbols 204 by the conversion table 400. Therefore, even if the stored encrypted symbol sequence 205 is stolen, it is difficult to decrypt it, and electronic information can be stored and managed securely.

[0135] [Second Embodiment of the Invention] A second embodiment of this invention will be described with reference to Figure 10. However, elements that are the same as or corresponding to those in the first embodiment will be denoted by the same reference numerals, and redundant descriptions will be omitted.

[0136] Figure 10 is a schematic block diagram of the electronic information encryption system 1A according to a second embodiment of the present invention. This electronic information encryption system 1A has a configuration in which the functions of the electronic information management server 2 in the first embodiment are installed in the user terminal 4A. For this reason, the ID issuance unit 23A, the encrypted electronic information storage unit 27A, and the search result screen provision unit 34A are included in the user terminal 4A.

[0137] Furthermore, the partial match search unit 65A constructs a partial match search encryption symbol sequence from the partial match search string, and retrieves encrypted electronic information from the encrypted electronic information stored in the encrypted electronic information storage unit 27A that includes an encryption symbol sequence 205 that partially matches the partial match search encryption symbol sequence.

[0138] Furthermore, the prefix matching search unit 66A constructs a prefix matching search encryption symbol sequence from the prefix matching search string, and retrieves encrypted electronic information from the encrypted electronic information stored in the encrypted electronic information storage unit 27A that includes an encryption symbol sequence 205 that prefixes to the prefix matching search encryption symbol sequence.

[0139] Furthermore, the user terminal 4A does not include the ID issuance request transmission unit 44, the ID reception unit 45, the encrypted electronic information transmission unit 57, the search condition transmission unit 67, and the search results screen reception unit 70.

[0140] [Third embodiment of the invention] A third embodiment of this invention will be described with reference to Figures 11 to 16. However, elements identical or corresponding to those in the first embodiment will be denoted by the same reference numerals, and redundant descriptions will be omitted.

[0141] Figure 11 is a schematic block diagram of the electronic information encryption system 1B according to a third embodiment of the present invention. This electronic information encryption system 1B has a configuration in which an encryption key management server 8 is added to the configuration of the electronic information encryption system 1 in the first embodiment.

[0142] This encryption key management server 8 stores multiple encryption keys with identification codes, each consisting of an encryption key 300 and an identification code 902 that uniquely identifies that encryption key 300.

[0143] As shown in Figure 12(a), the structure of the encryption key with an identification code 900 is such that the identification code 902 and the encryption key 904 are associated in a one-to-one manner. The encryption key 904 is obtained by encrypting the encryption key 300 through a predetermined encryption process.

[0144] The electronic information management server 2B encrypts the data that constitutes the electronic information to create encrypted electronic information, and stores and manages that encrypted electronic information.

[0145] Electronic information management server 2B, encryption key management server 8, and user terminals 4B1, 4B2, ... 4B n(The following are user terminals 4B1, 4B2, ...4B) n Represented by the code 4B (User Terminal 4B), the user is connected via a communication line 9 such as the Internet. In the electronic information encryption system 1 of the first embodiment, as well as in the first embodiment, the data transmitted and received via the communication line 9 is encrypted based on SSL (Secure Sockets Layer) or TLS (Transport Layer Security), ensuring that information is exchanged with a high level of security.

[0146] When electronic information is sent from the user terminal 4B to the electronic information management server 2B, the electronic information management server 2B sends an identification code 902 to the encryption key management server 8, and the identification code 902 is designated. The encryption key management server 8 retrieves an encryption key with an identification code that matches the designated identification code 902 from the encryption key storage unit 81 with an identification code, and sends it to the electronic information management server 2B.

[0147] Since this identification code-attached encryption key contains the encrypted encryption key 904 (see Figure 12(a)), when the electronic information management server 2B receives the identification code-attached encryption key from the encryption key management server 8, it decrypts the encryption key 904 through a predetermined decryption process and extracts the encryption key 300. Figure 12(b) shows the state in which the encryption key 904 contained in the identification code-attached encryption key has been decrypted to become the encryption key 300. The encryption key 300 is a common key used for encrypting and decrypting electronic information.

[0148] The electronic information management server 2B uses this encryption key 300 to encrypt the electronic information received from the user terminal 4B (converting it into an encryption symbol sequence 205), and stores the encrypted electronic information, which is the result of linking the identification code 902 sent to the encryption key management server 8 with the encrypted electronic information, in the encrypted electronic information storage unit 602. The encryption key with the identification code is deleted from the electronic information management server 2B after the encryption of the electronic information is complete.

[0149] As shown in Figure 13(a), the data structure 100B of the electronic information in this electronic information encryption system 1B is the same as the data structure 100 of the electronic information shown in Figure 6(a), but with the ID field 101 removed. Also, as shown in Figure 13(b), the data structure 120B of the encrypted electronic information in this electronic information encryption system 1B is the same as the data structure 120 of the encrypted electronic information shown in Figure 6(b), but with the encrypted ID field 121 replaced by the identification code field 140. Consequently, the encrypted ID 131 is replaced by the identification code 902. In this way, the identification code 902 is linked to the encrypted electronic information.

[0150] When reading encrypted electronic information stored in the electronic information management server 2B from the user terminal 4B, the electronic information management server 2B sends an identification code 902 (see Figure 13(b)) associated with the encrypted electronic information selected from the user terminal 4B to the encryption key management server 8. The encryption key management server 8 retrieves an encryption key with an identification code that matches the specified identification code 902 from the encryption key storage unit 81 and sends it to the electronic information management server 2B.

[0151] Since the encryption key with the identification code contains the encryption key 904 (see Figure 12(a)), when the electronic information management server 2B receives the encryption key with the identification code, it decrypts the encryption key 904 through a predetermined decryption process to extract the encryption key 300 (see Figure 12(b)), and uses this encryption key 300 to decrypt the encrypted electronic information. The electronic information thus restored is provided from the electronic information management server 2B to the user terminal 4B so that the user can verify it. The encryption key with the identification code is deleted from the electronic information management server 2B after decryption is complete.

[0152] Figure 14 shows a schematic functional block diagram of the encryption key management server 8. This encryption key management server 8 is configured to include an encryption key management server control unit 80, an encryption key storage unit with identification code 81, an encryption key generation unit with identification code 82, an identification code reception unit 83, an encryption key transmission unit with identification code 84, and a communication unit 89, and an information processing device such as a server device or a PC is used.

[0153] The encryption key management server control unit 80 is configured to include a CPU (not shown), an auxiliary storage device for storing programs, etc., and RAM, which is the operating area for program execution. The CPU performs program execution, arithmetic processing, and controls the operation of each element that constitutes the encryption key management server 8.

[0154] The identification code encryption key storage unit 81 stores multiple identification code encryption keys (see Figure 12(a)), each consisting of an encryption key 300 and an identification code 902 that uniquely identifies the encryption key 300. The encryption key 904 is obtained by encrypting the encryption key 300 through a predetermined encryption process.

[0155] Prior to the operation of the electronic information encryption system 1B, the identification code encryption key generation unit 82 automatically generates multiple non-repeating identification code encryption keys and stores the generated identification code encryption keys in the identification code encryption key storage unit 81.

[0156] However, the multiple encryption keys with identification codes to be stored in the encryption key storage unit 81 may be created by, for example, an administrator and stored in the encryption key storage unit 81, rather than by the encryption key generation unit 82.

[0157] The identification code receiving unit 83 receives the identification code 902 sent from the electronic information management server 2B.

[0158] The identification code encryption key sending unit 84 extracts an identification code encryption key from the identification code encryption key generation unit 82 that matches the identification code 902 received by the identification code receiving unit 83, and sends the extracted identification code encryption key to the electronic information management server 2B. That is, it compares the identification code 902 contained in the identification code encryption key stored in the identification code encryption key storage unit 81 with the identification code 902 received by the identification code receiving unit 83, and retrieves the identification code encryption key whose identification code 902 matches. Then it sends the retrieved identification code encryption key.

[0159] The communications unit 89 handles the transmission and reception of data with external parties.

[0160] Figure 15 shows a schematic functional block diagram of the electronic information management server 2B. This electronic information management server 2B is configured to include a server control unit 20, an electronic information receiving unit 600, an encrypted electronic information storage unit 602, an identification code transmission unit 610, an identification code-attached encryption key receiving unit 612, an identification code-attached encryption key decryption unit 614, an encryption unit 616, a splitting unit 618, a conversion table storage unit 620, a conversion unit 622, a variable element generation unit 624, an encryption key variation unit 626, an encrypted electronic information configuration unit 628, an electronic information request receiving unit 630, an inverse conversion unit 632, a combination unit 634, a decryption unit 636, an electronic information restoration unit 638, an electronic information transmission unit 640, a search condition receiving unit 642, a search unit 644, a search result screen provision unit 650, a search electronic information transmission unit 652, and a communication unit 660.

[0161] The electronic information receiving unit 600 receives electronic information sent from the user terminal 4B. The received electronic information is encrypted and stored in the encrypted electronic information storage unit 602.

[0162] The encrypted electronic information storage unit 602 functions as a "symbol sequence storage unit" and stores encrypted electronic information. This encrypted electronic information storage unit 602 is divided into multiple storage areas, namely the first encrypted electronic information storage unit 603, the second encrypted electronic information storage unit 604, and the third encrypted electronic information storage unit 605. However, the number of storage area divisions is not limited to three; it may be fewer or more.

[0163] Each category can be treated as a memory area managed by each department, for example, in the case of an organization such as a company.

[0164] Furthermore, each of the storage areas of the first encrypted electronic information storage unit 603, the second encrypted electronic information storage unit 604, and the third encrypted electronic information storage unit 605 is assigned a different identification code 902. For example, when storing electronic information in the first encrypted electronic information storage unit 603, the first identification code 902 is used; when storing it in the second encrypted electronic information storage unit 604, the second identification code 902 is used; and when storing it in the third encrypted electronic information storage unit 605, the third identification code 902 is used.

[0165] The identification code sending unit 610 sends the identification code 902 to the encryption key management server 8. In the configuration described above, where an identification code 902 is assigned to each storage area of ​​the encrypted electronic information storage unit 602, for example, when storing electronic information in the first encrypted electronic information storage unit 603, the first identification code 902 is sent according to the storage area. Similarly, when storing electronic information in the second encrypted electronic information storage unit 604, the second identification code 902 is sent, and when storing it in the third encrypted electronic information storage unit 605, the third identification code 902 is sent.

[0166] The identification code encryption key receiving unit 612 obtains the identification code encryption key (see Figure 12(a)) corresponding to the identification code 902 sent from the identification code sending unit 610 from the encryption key management server 8.

[0167] The identification code encryption key decryption unit 614 decrypts the encryption key 904 contained in the identification code encryption key by a predetermined decryption process to extract the encryption key 300 (see Figure 12(b)). The extracted encryption key 300 is used to encrypt electronic information.

[0168] The encryption unit 616 and the partitioning unit 618 perform the same functions as the encryption unit 50 and partitioning unit 51 shown in Figure 2, respectively.

[0169] Specifically, the encryption unit 616 uses the encryption key 300, which has been decrypted and extracted by the encryption key decryption unit 614 with an identification code, to encrypt the electronic information represented as binary data into binary encrypted information 202 (binary encryption process 501) (see Figure 4). The splitting unit 618 splits the encrypted binary encrypted information 202 into multiple split binary information 203 (splitting process 502).

[0170] The conversion table storage unit 620 stores multiple conversion tables 400, as shown in Figure 3, which associate the partitioned binary information 203 with the encryption symbols 204.

[0171] However, each of the conversion tables 400 stored in the conversion table storage unit 620 is associated with a different identification code 902. Then, the conversion table 400 corresponding to the specified identification code 902 is selected and used to convert the divided binary information 203 to the encryption symbol 204.

[0172] The conversion unit 622, the variable element generation unit 624, the encryption key variation unit 626, and the encrypted electronic information configuration unit 628 perform the same functions as the conversion unit 53, the variable element generation unit 54, the encryption key variation unit 55, and the encrypted electronic information configuration unit 56 shown in Figure 2, respectively.

[0173] In other words, the conversion unit 622 converts the multiple partitioned binary information 203 separated by the partitioning unit 618 into multiple encryption symbols 204 based on the conversion table 400 to construct an encryption symbol sequence 205 (conversion process 503) (see Figure 4).

[0174] The variable element generation unit 624 generates a variable element 301 that changes the encryption key 300 by performing a predetermined operation on the binary encryption information 202 (variable element generation process 504). The encryption key variation unit 626 applies the generated variable element 301 to the encryption key 300 to generate a varied encryption key 302 (variable encryption key generation process 505) (see Figure 5(b)).

[0175] The encrypted electronic information configuration unit 628 configures encrypted electronic information by encrypting electronic information. The configured encrypted electronic information is stored in the encrypted electronic information storage unit 602 (first encrypted electronic information storage unit 603, second encrypted electronic information storage unit 604, third encrypted electronic information storage unit 605).

[0176] The electronic information request receiving unit 630 receives electronic information requests sent from the user terminal 4B. The electronic information request specifies the electronic information to be read from the user terminal 4B.

[0177] When the electronic information request receiving unit 630 receives an electronic information request, an identification code 902 (see Figure 13(b)) associated with the encrypted electronic information to be read is extracted and sent from the identification code sending unit 610 to the encryption key management server 8. The encryption key receiving unit 612 receives the encryption key with an identification code (see Figure 12(a)) sent from the encryption key management server 8, and the encryption key decryption unit 614 decrypts the encryption key 904 contained in the encryption key with an identification code using a predetermined decryption process to extract the encryption key 300 (see Figure 12(b)). The extracted encryption key 300 is used to decrypt the encrypted electronic information.

[0178] The inverse conversion unit 632, the coupling unit 634, the decoding unit 636, and the electronic information restoration unit 638 perform the same functions as the inverse conversion unit 60, the coupling unit 61, the decoding unit 62, and the electronic information restoration unit 71 shown in Figure 2, respectively.

[0179] In other words, the reverse transformation unit 632 reverse-transforms the encryption symbol sequence 205 into multiple partitioned binary information 203 by replacing each encryption symbol 204 constituting the encryption symbol sequence 205 with a partitioned binary information 203 based on the relationship defined in the transformation table 400 (reverse transformation process 511) (see Figure 7). The concatenation unit 634 concatenates the multiple partitioned binary information 203 that have been reverse-transformed to restore the binary encrypted information 202 (concatenation process 512). The decryption unit 636 decrypts the restored binary encrypted information 202 into character information binary data 201 using the encryption key 300 (binary decryption process 513) (see Figure 7).

[0180] The electronic information restoration unit 638 decrypts the encrypted electronic information stored in the encrypted electronic information storage unit 602 and restores it to electronic information.

[0181] The electronic information transmission unit 640 transmits the restored electronic information to the user terminal 4B, which is the requester.

[0182] The search condition receiving unit 642 receives search conditions for encrypted electronic information stored in the encrypted electronic information storage unit 602 (first encrypted electronic information storage unit 603, second encrypted electronic information storage unit 604, third encrypted electronic information storage unit 605) sent from the user terminal 4B.

[0183] The search unit 644 includes a partial match search unit 646 and a prefix match search unit 648, and performs a search according to the search conditions received by the search condition reception unit 642.

[0184] The partial match search unit 646 and the prefix match search unit 648 perform searches according to the request based on processing that is substantially the same as that of the partial match search unit 65 and the prefix match search unit 66 shown in Figure 2, respectively.

[0185] The search results screen provision unit 650 configures the search results screen and provides it to the user terminal 4B. The search electronic information transmission unit 652 decrypts the searched encrypted electronic information in response to a request from the user terminal 4B and transmits the electronic information to the user terminal 4B.

[0186] The communications unit 660 is responsible for sending and receiving data with external devices.

[0187] Figure 16 is a schematic functional block diagram of the user terminal 4B. This user terminal 4B is configured to include a terminal control unit 40, an input unit 41, a display unit 42, an electronic information transmission unit 700, an electronic information request transmission unit 702, an electronic information reception unit 704, a search condition transmission unit 67B, a partial match search electronic information transmission unit 706, a prefix match search electronic information transmission unit 708, a search result screen reception unit 70, and a communication unit 74.

[0188] The electronic information transmission unit 700 transmits electronic information to be stored in the electronic information management server 2B. At the same time, it transmits instructions on which of the first encrypted electronic information storage unit 603, the second encrypted electronic information storage unit 604, or the third encrypted electronic information storage unit 605 of the electronic information management server 2B should be used to store the information.

[0189] The electronic information request transmission unit 702 sends an electronic information request to the electronic information management server 2B specifying the electronic information that the user intends to read with the user terminal 4B.

[0190] The electronic information receiving unit 704 receives electronic information sent from the electronic information management server 2B. The received electronic information is displayed on the display unit 42 for the user to confirm.

[0191] The search condition transmission unit 67B transmits search conditions for electronic information stored in the electronic information management server 2B. This search condition transmission unit 67B includes a partial match search electronic information transmission unit 706 and a prefix match search electronic information transmission unit 708, and the search information that is the target of the partial match search or prefix match search is transmitted to the electronic information management server 2B.

[0192] The search results screen reception unit 70 receives the search results screen provided by the electronic information management server 2B. The search results screen is displayed on the display unit 42 for the user to confirm.

[0193] Next, the effects of the first embodiment of this invention will be described.

[0194] According to a third embodiment of this invention, an encryption key with an identification code is stored in the encryption key storage unit 81, and when an identification code 902 is specified, the encryption key 300 corresponding to that identification code 902 is retrieved and encryption is performed by the encryption unit 616. For example, by associating an identification code 902 with each department of an organization or each individual user in advance, when a person belonging to that department or an individual user stores electronic information, the associated identification code 902 is automatically specified, the encryption key 300 corresponding to the specified identification code 902 is retrieved, and encryption is performed. In this way, since electronic information is automatically encrypted and stored without the person belonging to the department or the individual user being aware of it, human error is eliminated and security is improved.

[0195] Furthermore, according to the third embodiment, an encryption key with an identification code that matches the identification code 902 associated with the encrypted electronic information to be decrypted (encryption symbol sequence 205) is retrieved, and decryption is performed using the encryption key 300 contained in that encryption key with an identification code. When a user reads the encrypted electronic information, the associated identification code 902 is automatically retrieved and decryption is performed, thus improving work efficiency by eliminating the need for decryption processing while maintaining high security. In addition, even if the management authority of the electronic information is transferred to a different department within the organization, for example, the identification code 902 associated with the encrypted electronic information is used to perform decryption. Therefore, even when the management authority of the electronic information is transferred to a different department, the process of decryption and re-encryption, which is required each time to match the encryption key of that department, can be omitted, improving work efficiency.

[0196] Furthermore, according to the third embodiment, the encryption key management server 8 stores an encryption key with an identification code, and the electronic information management server 2B receives the encryption key with an identification code corresponding to the specified identification code 902 from the encryption key management server 8 and performs encryption using the encryption key 300 contained in that encryption key with an identification code. Since the electronic information management server 2B does not store the encryption key 300, even if the electronic information management server 2B is subjected to a security attack, there is no risk of the encryption key 300 being leaked.

[0197] [Other embodiments of the invention] It should be noted that the embodiments described above do not limit the technical scope of the present invention, and each element can be appropriately modified without departing from the spirit of the invention. [Explanation of Symbols]

[0198] 1,1A,1B…Electronic information encryption system, 2,2B…Electronic information management server, 4,4A,4B,41,42,4 n ,4B1,4B2,4B n...User terminal, 8...Encryption key management server, 9...Communication line, 20...Server control unit, 22...ID issuance request reception unit, 23,23A...ID issuance unit, 24...ID transmission unit, 26...Encrypted electronic information reception unit (encryption symbol sequence reception unit), 27,27A...Encrypted electronic information storage unit (symbol sequence storage unit), 30...Search condition reception unit (partial match search encrypted symbol sequence reception unit) (prefix match search encrypted symbol sequence reception unit), 31...Search unit, 32...Server-side partial match search unit, 33...Server-side prefix match search Sections 34, 34A…Search Results Screen Provisioning Section, 35…Search Electronic Information Transmission Section, 37…Communication Section, 600…Electronic Information Reception Section, 602…Encrypted Electronic Information Storage Section (Symbol String Storage Section), 603…First Encrypted Electronic Information Storage Section, 604…Second Encrypted Electronic Information Storage Section, 605…Third Encrypted Electronic Information Storage Section, 610…Identification Code Transmission Section, 612…Identification Code-Attached Encryption Key Reception Section, 614…Identification Code-Attached Encryption Key Decryption Section, 616…Encryption Section, 618…Partitioning Section, 620…Conversion Table Storage 622...Conversion unit, 624...Variable element generation unit, 626...Encryption key variation unit, 628...Encrypted electronic information configuration unit, 630...Electronic information request reception unit, 632...Inverse conversion unit, 634...Combination unit, 636...Decryption unit, 638...Electronic information restoration unit, 640...Electronic information transmission unit, 642...Search condition reception unit, 644...Search unit, 646...Partial match search unit, 648...Forward match search unit, 650...Search result screen provision unit, 652...Search electronic information transmission unit, 660...Communication unit, 40...Terminal control unit, 41...Input unit, 42...Display unit, 44...ID issuance request transmission unit, 45...ID reception unit, 46...ID storage unit, 48...Encryption key generation unit, 49...Encryption key storage unit, 50...Encryption unit, 51...Partitioning unit, 52...Conversion table storage unit, 53...Conversion unit, 54...Variable element generation unit, 55...Encryption key variation unit, 56...Encrypted electronic information configuration unit, 57...Encrypted electronic information transmission unit (encryption symbol sequence transmission unit), 60...Inverse conversion unit, 61...Combination unit, 62...Decryption unit, 65,65A...Partial match search unit, 66,66A…Forward matching search unit, 67…Search condition transmission unit (Partial matching search encryption symbol sequence transmission unit) (Forward matching search encryption symbol sequence transmission unit), 70…Search result screen reception unit, 71…Electronic information restoration unit, 74…Communication unit, 700…Electronic information transmission unit, 702…Electronic information request transmission unit, 704…Electronic information reception unit, 67B…Search condition transmission unit, 706…Partial matching search electronic information transmission unit, 708…Forward matching search electronic information transmission unit, 80…Encryption key management server control unit, 81…Encryption key storage unit with identification code, 82…Encryption key generation unit with identification code, 83…Identification code reception unit, 84…Encryption key transmission unit with identification code 89...Communication section, 100,100B...Data structure of electronic information, 101...ID field, 102...File name field, 103...String A field, 104...String B field, 105...String C field, 106...Image field, 111...ID, 112...File name, 113...String A, 114...String B, 115...String C, 116...Image, 118...Encryption flag, 120,120B...Data structure of encrypted electronic information, 121...Encrypted ID field, 122...Encrypted file name field, 123...Encrypted string A field, 124...Encrypted Encryption string B field, 125... Encryption string C field, 126... Encryption image field, 131... Encryption ID, 132... Encryption file name, 133... Encryption string A, 134... Encryption string B, 135... Encryption string C, 136... Encryption image, 140... Identification code field, 200... Character information, 201, 201a, 201b, 201c... Character information binary data, 202, 202a, 202b, 202c... Binary encrypted information, 203, 203a, 203b, 203c... Split binary information, 204... Encryption symbol, 205, 205a, 205b, 205c... Encryption symbol sequence, 300... Encryption key, 301, 301a, 301b, 301c... Variable elements, 302, 302a, 302b, 302c... Variable encryption key, 400... Conversion table, 500... Single character encryption process, 501... Binary encryption process, 502... Splitting process, 503... Conversion process, 504... Variable element generation process, 505... Variable encryption key generation process, 510... Single character decryption process, 511... Inverse conversion process, 512... Concatenation process, 513... Binary decryption process, 520... String encryption process, 900... Structure of encryption key with identification code, 902... Identification code, 904... Encryption key

Claims

1. An electronic information encryption system that encrypts, stores, and manages electronic information including textual information, An encryption unit that encrypts a single character of the aforementioned character information, which is represented as binary data, into binary encrypted information using an encryption key, A splitting unit that divides the single-character encrypted binary information into multiple split binary information units, A conversion unit converts the divided binary information into a sequence of encryption symbols based on a predetermined conversion table that associates the divided binary information with the encryption symbols, An electronic information encryption system characterized by comprising a symbol sequence storage unit that stores the converted encryption symbol sequence.

2. When encrypting the aforementioned character information, which consists of multiple characters, The electronic information encryption system according to claim 1, characterized in that the characters to be encrypted are selected in order from the first character to the subsequent characters, and the encryption unit encrypts the characters to be encrypted into binary encrypted information using the encryption key.

3. A reverse conversion unit that reverse-converts the encrypted symbol sequence stored in the symbol sequence storage unit into the plurality of partitioned binary information based on the conversion table, A combining unit that combines the multiple reverse-transformed partitioned binary information to restore the binary encrypted information, The electronic information encryption system according to claim 1 or 2, further comprising a decryption unit that decrypts the restored binary encrypted information into the single character of the character information using the encryption key.

4. It includes a partial match search unit that performs a partial match search on a string, When searching for the multiple-character encrypted symbol sequence that partially matches the partial match search string from the encrypted symbol sequence stored in the symbol sequence storage unit, The characters to be encrypted are determined in the order from the first search character to the subsequent search character of the partial match search string, the encryption unit encrypts the characters to be encrypted into search binary encrypted information using the encryption key, the splitting unit divides the search binary encrypted information into a plurality of split search binary information, and the conversion unit converts the plurality of split search binary information into a search encrypted symbol sequence. The converted search encryption symbol sequence is aggregated over the entire partial match search string to form a partial match search encryption symbol sequence. The aforementioned partial match search unit, The electronic information encryption system according to claim 2, characterized in that the configured partial-match search encryption symbol sequence and the multiple-character encryption symbol sequence that partially matches are retrieved from the symbol sequence storage unit.

5. A variation element generation unit generates a variation element that causes a change in the encryption key by performing a predetermined operation on the binary encryption information, The system includes an encryption key variation unit that applies the generated variation elements to the encryption key to generate a variation encryption key, When encrypting the aforementioned character information, which consists of multiple characters, The electronic information encryption system according to claim 1, characterized in that the characters to be encrypted are selected in order from the first character to the subsequent character, the encryption key variation unit applies the variation element generated one character before the character to be encrypted to the encryption key to generate the variation encryption key for the character to be encrypted, the encryption unit encrypts the character to be encrypted into binary encrypted information using the generated variation encryption key, and the variation element generation unit generates the variation element based on the binary encrypted information of the character to be encrypted.

6. A reverse conversion unit that reverse-converts the encrypted symbol sequence stored in the symbol sequence storage unit into the plurality of partitioned binary information based on the conversion table, A combining unit that combines the multiple reverse-transformed partitioned binary information to restore the binary encrypted information, The system includes a decryption unit that decrypts the restored binary encrypted information into the single character of the character information using the encryption key, When decrypting the encrypted symbol sequence, which is the character information composed of the multiple characters, The electronic information encryption system according to claim 5, characterized in that the characters to be decrypted are set in order from the first character to the subsequent characters, the encryption key variation unit applies the variation element generated one character before the character to be decrypted to the encryption key for the encryption symbol sequence corresponding to the character to be decrypted to generate the variation encryption key for the character to be decrypted, the inverse transformation unit inversely transforms the character to be decrypted into the plurality of partitioned binary information corresponding to the character to be decrypted, the combination unit restores the binary encrypted information corresponding to the character to be decrypted, the decryption unit decrypts the binary encrypted information of the character to be decrypted using the variation encryption key of the character to be decrypted, and the variation element generation unit generates the variation element based on the binary encrypted information of the character to be decrypted.

7. It includes a prefix matching search unit that performs a prefix matching search on prefix matching search strings, When searching for the multiple-character encrypted symbol sequence that matches the prefix of the prefix matching search string from among the encrypted symbol sequences stored in the symbol sequence storage unit, The characters to be encrypted are determined in the order from the first search character to the subsequent search character of the prefix matching search string, the encryption key variation unit applies the variation element generated one character before the character to be encrypted to the encryption key to generate the variation encryption key for the character to be encrypted, the encryption unit encrypts the character to be encrypted into search binary encryption information using the generated variation encryption key, the division unit divides the search binary encryption information into a plurality of divided search binary information, the conversion unit converts the plurality of divided search binary information into a search encryption symbol sequence, and the variation element generation unit generates the variation element based on the search binary encryption information of the character to be encrypted. The search encryption symbol sequence converted by the conversion unit is aggregated for the entire prefix matching search string to form a prefix matching search encryption symbol sequence. The aforementioned forward matching search unit, The electronic information encryption system according to claim 5 or 6, characterized in that the configured prefix-matching search encryption symbol sequence and the plurality of character encryption symbol sequences that prefixly match each other are retrieved from the symbol sequence storage unit.

8. An electronic information encryption system that encrypts, stores, and manages electronic information, An encryption unit that encrypts a unit of data defined by a predetermined unit data length of the electronic information represented as binary data into binary encrypted information using an encryption key, A division unit that divides the encrypted binary encrypted information of the one-unit data into a plurality of divided binary information units, A conversion unit converts the divided binary information into a sequence of encryption symbols based on a predetermined conversion table that associates the divided binary information with the encryption symbols, An electronic information encryption system characterized by comprising a symbol sequence storage unit that stores the converted encryption symbol sequence.

9. When encrypting the electronic information which is composed of multiple data units, The electronic information encryption system according to claim 8, characterized in that the unit data to be encrypted is set in an order from the first unit data to the subsequent unit data, and the encryption unit encrypts the unit data to be encrypted into binary encrypted information using the encryption key.

10. A reverse conversion unit that reverse-converts the encrypted symbol sequence stored in the symbol sequence storage unit into the plurality of partitioned binary information based on the conversion table, A combining unit that combines the multiple reverse-transformed partitioned binary information to restore the binary encrypted information, The electronic information encryption system according to claim 8 or 9, further comprising a decryption unit that decrypts the restored binary encrypted information into the one-unit data of the electronic information using the encryption key.

11. An electronic information encryption system that encrypts, stores, and manages electronic information including textual information, The user terminal is, An encryption unit that encrypts a single character of the aforementioned character information, which is represented as binary data, into binary encrypted information using an encryption key, A splitting unit that divides the single-character encrypted binary information into multiple split binary information units, A conversion unit converts the divided binary information into a sequence of encryption symbols based on a predetermined conversion table that associates the divided binary information with the encryption symbols, The system comprises an encryption symbol sequence transmission unit that transmits the encryption symbol sequence converted by the conversion unit, The electronic information management server is An encryption symbol sequence receiving unit that receives the encryption symbol sequence sent from the user terminal, An electronic information encryption system characterized by comprising a symbol sequence storage unit that stores the received encryption symbol sequence.

12. When encrypting the character information, which consists of multiple characters, in the user terminal, The characters to be encrypted are selected in order from the first character to the subsequent characters, and the encryption unit encrypts the characters to be encrypted into binary encrypted information using the encryption key. The aforementioned divided portion is The encrypted binary encrypted information of the multiple characters is divided and separated into the multiple divided binary information, The conversion unit is Based on the conversion table, the multiple partitioned binary information of the multiple characters that have been divided is converted into the encrypted symbol sequence. The aforementioned encryption symbol sequence transmission unit, The electronic information encryption system according to claim 11, characterized in that it sends the converted sequence of multiple characters of the encryption symbol to the electronic information management server.

13. The aforementioned user terminal is A reverse conversion unit that reverse-converts the sequence of encrypted symbols sent from the electronic information management server into the plurality of partitioned binary information based on the conversion table, A combining unit that combines the multiple reverse-transformed partitioned binary information to restore the binary encrypted information, The electronic information encryption system according to claim 11 or 12, further comprising a decryption unit that decrypts the restored binary encrypted information into the single character of the character information using the encryption key.

14. The aforementioned user terminal is A partial match search encryption symbol sequence component that constructs a partial match search encryption symbol sequence by encrypting a partial match search string and converting it into a symbol sequence, The system includes a partial match search encryption symbol sequence transmission unit that transmits the configured partial match search encryption symbol sequence, The aforementioned electronic information management server is A partial match search encryption symbol string receiving unit that receives the partial match search encryption symbol string sent from the user terminal, The system includes a partial match search unit that performs a partial match search on the partial match search string using the received partial match search encryption symbol sequence, When searching for the multiple-character encrypted symbol sequence that partially matches the partial match search string from the encrypted symbol sequence stored in the symbol sequence storage unit, In the aforementioned user terminal, The characters to be encrypted are determined in the order from the first search character to the subsequent search character of the partial match search string, the encryption unit encrypts the characters to be encrypted into search binary encrypted information using the encryption key, the splitting unit divides the search binary encrypted information into a plurality of split search binary information, and the conversion unit converts the plurality of split search binary information into a search encrypted symbol sequence. The aforementioned partial match search encryption symbol sequence component is: The converted search encryption symbol sequence is aggregated over the entire partial match search string to form the partial match search encryption symbol sequence. The aforementioned partial match search encryption symbol string transmission unit, The configured partial match search encryption symbol sequence is sent, In the aforementioned electronic information management server, The electronic information encryption system according to claim 12, characterized in that when the partial match search encryption symbol sequence sent from the user terminal is received by the partial match search encryption symbol sequence receiving unit, the partial match search unit retrieves from the symbol sequence storage unit the encryption symbol sequence of multiple characters that partially matches the received partial match search encryption symbol sequence.

15. The system includes an identification code-attached encryption key storage unit that stores multiple identification code-attached encryption keys, each of which consists of an encryption key and an identification code that uniquely identifies the encryption key. When the identification code is specified, the cryptographic key with the identification code that matches the specified identification code is retrieved from the cryptographic key storage unit with the identification code. The encryption unit uses the encryption key contained in the extracted encryption key with identification code to encrypt the information into binary encryption information. The electronic information encryption system according to claim 1, 2, or 5, characterized in that the specified identification code is associated with the encrypted symbol sequence converted by the conversion unit and stored in the symbol sequence storage unit.

16. A reverse conversion unit that reverse-converts the encrypted symbol sequence stored in the symbol sequence storage unit into the plurality of partitioned binary information based on the conversion table, A combining unit that combines the multiple reverse-transformed partitioned binary information to restore the binary encrypted information, The system includes a decryption unit that decrypts the restored binary encrypted information into the single character of the character information using the encryption key, The electronic information encryption system according to claim 15, characterized in that when decrypting the encrypted symbol sequence stored in the symbol sequence storage unit, the decryption unit retrieves the encryption key with an identification code that matches the identification code associated with the encrypted symbol sequence to be decrypted from the encryption key with an identification code storage unit, and decrypts the symbol sequence using the encryption key contained in the retrieved encryption key with an identification code.

17. An electronic information encryption system that encrypts, stores, and manages electronic information including textual information, The encryption key management server is, An identification code-attached encryption key storage unit stores multiple identification code-attached encryption keys, each consisting of an encryption key and an identification code that uniquely identifies the encryption key. An identification code receiving unit that receives the identification code sent from the electronic information management server, The system includes an identification code encryption key sending unit that retrieves an identification code encryption key matching the received identification code from the identification code encryption key storage unit and sends out the retrieved identification code encryption key, The aforementioned electronic information management server is An electronic information receiving unit that receives the electronic information transmitted from the user terminal, An identification code transmission unit that sends the specified identification code to the encryption key management server, An identification code-attached encryption key receiving unit that receives the identification code-attached encryption key sent from the aforementioned encryption key management server, An encryption unit that uses the encryption key included in the received encryption key with identification code to encrypt a single character of the character information represented as binary data into binary encrypted information, A splitting unit that divides the single-character encrypted binary information into multiple split binary information units, A conversion unit converts the divided binary information into a sequence of encryption symbols based on a predetermined conversion table that associates the divided binary information with the encryption symbols, An electronic information encryption system characterized by comprising a symbol sequence storage unit that stores the encrypted symbol sequence converted by the conversion unit and the identification code sent from the identification code transmission unit in association.

18. In the aforementioned electronic information management server, when encrypting the character information which consists of multiple characters, The characters to be encrypted are selected in order from the first character to the subsequent characters, and the encryption unit encrypts the characters to be encrypted into binary encrypted information using the encryption key included in the identification code encryption key. The aforementioned divided portion is The encrypted binary encrypted information of the multiple characters is divided and separated into the multiple divided binary information, The conversion unit is The electronic information encryption system according to claim 17, characterized in that, based on the conversion table, the plurality of partitioned binary information of the plurality of partitioned characters is converted into the encryption symbol sequence.

19. The aforementioned electronic information management server is A reverse conversion unit that reverse-converts the encrypted symbol sequence stored in the symbol sequence storage unit into the plurality of partitioned binary information based on the conversion table, A combining unit that combines the multiple reverse-transformed partitioned binary information to restore the binary encrypted information, The system includes a decryption unit that decrypts the restored binary encrypted information into the single character of the character information using the encryption key, The electronic information encryption system according to claim 17 or 18, characterized in that when decrypting the encrypted symbol sequence stored in the symbol sequence storage unit, the identification code associated with the encrypted symbol sequence to be decrypted is sent to the encryption key management server, and when the encryption key management server receives an encryption key with an identification code that matches the sent identification code, the decryption unit decrypts the information using the encryption key contained in the received encryption key with an identification code.

Images