ENCRYPTION KEY DISTRIBUTION SYSTEM, KEY DISTRIBUTION SERVER, LOCKING TERMINAL, VIEWING TERMINAL, ENCRYPTION KEY DISTRIBUTION METHOD, AND COMPUTER-READABLE MEDIUM

• US 20070177740A1
• Filed: 04/05/2007
• Published: 08/02/2007
• Est. Priority Date: 10/08/2004
• Status: Abandoned Application

• Current Assignee: Softbank BB Corporation (SoftBank Group Corp.)
• Original Assignee: Softbank BB Corporation (SoftBank Group Corp.)
• Inventors: Nakajima, Keiichi
• Application Number:
  US11/697,200
• Publication Number:
  US 20070177740A1
• Time in Patent Office: Days
• US Class Current: 380/277
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

It is aimed to provide an encryption key distribution system which can be easily operated, highly freely share the data therein, and achieve high reliability for authentication of one or more unlocking right owners who are assigned to each encrypted folder. An encryption key distribution system 500 stores a lock used to lock a folder on a PC 100, and stores an unlocking key corresponding to the lock on a key distribution server 200. To view a locked folder (hereinafter referred to as the encrypted folder), a mobile telephone 300 accesses the key distribution server 200, and is authenticated by using authentication data unique to the mobile telephone 300. Under the condition that the authentication is successful, the key distribution server 200 distributes the unlocking key to the PC 100. The PC 100 unlocks the encrypted folder by using the unlocking key distributed from the key distribution server 200, thereby displaying the contents of the folder.

Claims

1. An encryption key distribution system comprising:

a locking terminal that stores thereon an encryption key used to encrypt a folder and generates an encrypted folder by encrypting the folder by using the encryption key;

a key distribution server that stores thereon, in association with the encryption key, a decryption key used to decrypt the encrypted folder which is encrypted by the locking terminal using the encryption key;

a viewing terminal that (i) stores thereon the encrypted folder which is encrypted by the locking terminal using the encryption key, (ii) when receiving a request to view the encrypted folder, transmits the request to view the encrypted folder to the key distribution server, and (iii) when receiving the decryption key corresponding to the encrypted folder from the key distribution server, unlocks the encrypted folder by using the decryption key; and

a mobile communication terminal that is registered in the key distribution server as an authentication key used to authenticate a user, wherein

when receiving the request to view the encrypted folder from the viewing terminal, the key distribution server transmits the decryption key to the viewing terminal, under a condition that the key distribution server receives an access from the mobile communication terminal owned by the user who is set as an unlocking right owner of the encrypted folder.

2. The encryption key distribution system as set forth in claim 1, wherein

the key distribution server comprises:

a decryption key database that stores thereon the decryption key in association with a key ID that identifies a combination of the encryption key and the decryption key;

a user database that stores thereon authentication data unique to the mobile communication terminal owned by the user, in association with a user ID of the user; and

an authentication section that, when the key distribution server receives the request to view the encrypted folder from the viewing terminal, (i) receives a viewing request including therein (a) the user ID of the unlocking right owner who is entitled to decrypt the encrypted folder and (b) the key ID that identifies the encryption key used to generate the encrypted folder, (ii) acquires an address of the viewing terminal, (iii) reads the authentication data from the user database by using, as a key, the user ID of the unlocking right owner included in the viewing request, and (iv) waits for the access from the mobile communication terminal, and

when receiving the access from the mobile communication terminal, the authentication section of the key distribution server (I) receives the authentication data from the mobile communication terminal, (II) compares the authentication data received from the mobile communication terminal with the authentication data read from the user database, (III) successfully authenticates the mobile communication terminal under a condition that the compared pieces of authentication data match each other, (IV) reads the decryption key from the decryption key database by using, as a key, the key ID included in the viewing request, under a condition that the authentication of the mobile communication terminal is successful, and (V) transmits the read decryption key to the acquired address of the viewing terminal.

3. The encryption key distribution system as set forth in claim 1, wherein

the locking terminal includes a locking section that generates the encrypted folder by encrypting the folder by using the encryption key, and writes, into the encrypted folder, (i) the user ID of the unlocking right owner who is entitled to decrypt the encrypted folder and (ii) the key ID that identifies the encryption key used to generate the encrypted folder.

4. The encryption key distribution system as set forth in claim 1, wherein

the viewing terminal includes:

a viewing request section that, when the viewing terminal receives the request to view the encrypted folder, establishes a connection with the key distribution server, and transmits, as the viewing request of the encrypted folder, the user ID of the unlocking right owner and the key ID which are written in the encrypted folder, to the key distribution server; and

an unlocking section that decrypts the encrypted folder the viewing of which is requested, by using the decryption key received from the key distribution server.

5. The encryption key distribution system as set forth in claim 1, wherein

when the viewing terminal transmits the request to view the encrypted folder to the key distribution server, the mobile communication terminal accesses the key distribution server to transmit the authentication data unique to the mobile communication terminal.

6. The encryption key distribution system as set forth in claim 5, wherein

the authentication section of the key distribution server (i) stores, onto the decryption key database, the number of times at which the authentication section transmits the decryption key to the viewing terminal, as the number of unlocking operations based on the decryption key, in association with the key ID, (ii) updates the number of unlocking operations based on the decryption key by incrementing the number, every time the authentication section transmits the decryption key to the viewing terminal, and (iii) transmits the number of unlocking operations to the locking terminal in association with the key ID, every time the authentication section updates the number of unlocking operations,

the locking terminal further includes a management database that stores thereon, in association with the key ID, the number of unlocking operations based on the decryption key which is received from the key distribution server,

when encrypting the folder by using the encryption key, the locking section (i) reads the number of unlocking operations from the management database by using, as a key, the key ID that identifies the encryption key to be used, (ii) modifies the encryption key by using the number of unlocking operations which is read from the management database in accordance with a predetermined algorithm, and (iii) encrypts the folder by using the modified encryption key,

when reading the decryption key and transmitting the read decryption key to the address of the viewing terminal, the authentication section (I) reads the number of unlocking operations from the decryption key database by using, as a key, the key ID that identifies the decryption key, (II) modifies the decryption key by using the read number of unlocking operations in accordance with the same predetermined algorithm used by the locking terminal to modify the encryption key, and (III) transmits the modified decryption key to the address of the viewing terminal, and

the unlocking section decrypts the encrypted folder which is generated by encrypting the folder by using the modified encryption key, by using the modified decryption key.

7. The encryption key distribution system as set forth in claim 5, wherein

the locking terminal writes, into the single encrypted folder, a plurality of user IDs which identify a plurality of unlocking right owners.

8. The encryption key distribution system as set forth in claim 7, wherein

the key distribution server stores, on the user database, an e-mail address of the mobile communication terminal owned by the user, in association with the user ID,

when receiving the request to view the encrypted folder, the viewing terminal (i) requests a user to input a user ID, and (ii) when the user inputs the user ID, further transmits, to the key distribution server, a different user ID than the user ID input into the viewing terminal, which is selected from the plurality of user IDs which are written in the encrypted folder to identify the plurality of unlocking right owners for the encrypted folder, under a condition that the input user ID is included in the plurality of user IDs written in the encrypted folder, and

when successfully authenticating the user identified by the user ID input into the viewing terminal as the unlocking right owner of the encrypted folder, the key distribution server reads an e-mail address of a mobile communication terminal from the user database by using, as a key, the different user ID than the user ID input into the viewing terminal which is selected from the plurality of user IDs written in the encrypted folder, and sends an e-mail, to the read e-mail address, informing that the decryption key to decrypt the encrypted folder is distributed.

9. The encryption key distribution system as set forth in claim 5, wherein

the key distribution server stores, on the user database, an e-mail address of the mobile communication terminal owned by the user, in association with the user ID,

when receiving the request to view the encrypted folder, the viewing terminal (i) requests a user to input a user ID, and (ii) when the user inputs the user ID, transmits the input user ID to the key distribution server, under a condition that the input user ID is included in the user ID which is written in the encrypted folder to identify the unlocking right owner for the encrypted folder, and

the key distribution server reads the e-mail address of the mobile communication terminal owned by the user from the user database by using, as a key, the user ID input into the viewing terminal, and sends an e-mail, to the read e-mail address, including a message informing that a necessary procedure is required to be performed to authenticate the user of the mobile communication terminal as the unlocking right owner of the encrypted folder.

10. The encryption key distribution system as set forth in claim 5, wherein

when receiving the request to view the encrypted folder, the viewing terminal requests a user to input a user ID, and transmits the input user ID and the viewing request of the encrypted folder, to the key distribution server, and

when receiving, from the viewing terminal, the viewing request of the encrypted folder and the user ID input into the viewing terminal, the key distribution server acquires a terminal ID that identifies the viewing terminal from the viewing terminal, and stores, onto the decryption key database, in association with the key ID written in the encrypted folder, a date and a time of receiving the viewing request from the viewing terminal, the terminal ID of the viewing terminal, the user ID input into the viewing terminal, and a result of the authentication of the user who accesses the key distribution server with the mobile communication terminal.

11. The encryption key distribution system as set forth in claim 10, wherein

the key distribution server stores, on the user database, an e-mail address of the user in association with the user ID, and

when the authentication of the mobile communication terminal is unsuccessful, the key distribution server reads the e-mail address of the unlocking right owner from the user database by using, as a key, the user ID of the unlocking right owner written in the encrypted folder viewing of which is requested, and sends a message, to the read e-mail address, informing that the viewing request is issued but the authentication is unsuccessful.

12. The encryption key distribution system as set forth in claim 5, wherein

the locking section writes an address of the key distribution server into the encrypted folder, and

the viewing request section establishes the connection with the key distribution server based on the address written in the encrypted folder.

13. The encryption key distribution system as set forth in claim 5, wherein

the key distribution server stores, on the user database, an e-mail address of the mobile communication terminal owned by the user in association with the user ID,

when writing the user ID of the unlocking right owner for the encrypted folder into the encrypted folder, the locking terminal transmits the user ID of the unlocking right owner to the key distribution server, and

the key distribution server reads the e-mail address of the mobile communication terminal owned by the user from the user database by using, as a key, the user ID received from the locking terminal, and sends an e-mail, to the e-mail address of the mobile communication terminal which is read from the user database, informing that the user ID received from the locking terminal is set as the user ID of the unlocking right owner for the encrypted folder.

14. The encryption key distribution system as set forth in claim 13, wherein

the key distribution server sends a message, to the locking terminal, informing that the key distribution server permits the user ID received from the locking terminal to be set as the user ID of the unlocking right owner for the encrypted folder, under a condition that the key distribution server receives a replay e-mail from the e-mail address within a predetermined time limit from a timing of sending the e-mail, and

the locking terminal sets the user ID transmitted to the key distribution server as the user ID of the unlocking right owner for the encrypted folder, under a condition that the locking terminal receives the message informing the permission from the key distribution server.

15. The encryption key distribution system as set forth in claim 13, wherein

the key distribution server provides a download website for an application program which causes the mobile communication terminal to realize a function of accessing the key distribution server and a function of transmitting the authentication data to the key distribution server, and further includes an address of the download website in the e-mail sent to the e-mail address of the mobile communication terminal.

16. The encryption key distribution system as set forth in claim 5, wherein the key distribution server stores, on the user database, an e-mail address of the user in association with the user ID,

when writing the user ID of the unlocking right owner for the encrypted folder into the encrypted folder, the locking terminal transmits the user ID of the unlocking right owner to the key distribution server,

the key distribution server (i) reads the e-mail address of the user from the user database by using, as a key, the user ID received from the locking terminal, (ii) creates a website for the user to decide whether to be registered as the unlocking right owner of the encrypted folder, (iii) sends an e-mail including therein an address of the created website, to the e-mail address read from the user database, and (iv) sends a message, to the locking terminal, informing that the key distribution server permits the user ID received from the locking terminal to be set as the user ID of the unlocking right owner for the encrypted folder, under a condition that the key distribution server detects, on the created website, input of the decision to be registered as the unlocking right owner within a predetermined time limit from a timing of sending the e-mail, and

the locking terminal sets the user ID transmitted to the key distribution server as the user ID of the unlocking right owner for the encrypted folder, under a condition that the locking terminal receives the message informing the permission from the key distribution server.

17. The encryption key distribution system as set forth in claim 5, wherein

the key distribution server (i) provides a download website for an application program which causes the mobile communication terminal to realize a function of accessing the key distribution server and a function of transmitting the authentication data to the key distribution server, (ii) when receiving the viewing request of the encrypted folder from the viewing terminal, reads the e-mail address of the mobile communication terminal owned by the unlocking right owner from the user database by using, as a key, the user ID of the unlocking right owner which is included in the viewing request, and (iii) sends an e-mail, to the read e-mail address, including therein a message informing that a necessary procedure is required to be performed to authenticate the user of the mobile communication terminal as the unlocking right owner of the encrypted folder and an address of the download website.

18. A key distribution server for distributing a decryption key used to decrypt an encrypted folder that is generated by a locking terminal, to a viewing terminal that decrypts the encrypted folder, wherein

when receiving a viewing request of the encrypted folder from the viewing terminal, the key distribution server waits for receiving an access from a mobile communication terminal of a user who is set as an unlocking right owner who is entitled to decrypt the encrypted folder and transmits the decryption key to the viewing terminal under a condition that the key distribution server successfully authenticates the mobile communication terminal.

19. The key distribution server as set forth in claim 18, comprising

a decryption key database that stores thereon the decryption key in association with a key ID that identifies a combination of an encryption key used to encrypt a folder to generate the encrypted folder and the decryption key used to decrypt the encrypted folder which is generated by using the encryption key.

20. The key distribution server as set forth in claim 18, comprising

a user database that stores thereon authentication data unique to the mobile communication terminal which accesses the key distribution server, in association with a user ID of the user of the mobile communication terminal.

21. The key distribution server as set forth in claim 18, comprising

an authentication section that (i) when the key distribution server receives the viewing request of the encrypted folder from the viewing terminal, identifies authentication data unique to the mobile communication terminal owned by the unlocking right owner, based on a user ID of the unlocking right owner, the user ID being included in the viewing request, and (ii) when the key distribution server receives the access from the mobile communication terminal, transmits the decryption key to the viewing terminal, under a condition that the authentication section successfully authenticates the mobile communication terminal based on authentication data received from the mobile communication terminal.

22. The key distribution server as set forth in claim 18, comprising:

a decryption key database that stores thereon the decryption key in association with a key ID that identifies a combination of an encryption key used to encrypt a folder to generate the encrypted folder and the decryption key used to decrypt the encrypted folder which is generated by using the encryption key;

a user database that stores thereon authentication data unique to the mobile communication terminal which accesses the key distribution server, in association with a user ID of the user of the mobile communication terminal; and

an authentication section that (i) when the key distribution server receives the viewing request of the encrypted folder from the viewing terminal, acquires an address of the viewing terminal, (ii) reads the authentication data from the user database, by using, as a key, the user ID of the unlocking right owner who is entitled to decrypt the encrypted folder, the user ID being included in the viewing request, (iii) waits for an access from the mobile communication terminal, (iv) when receiving the access from the mobile communication terminal, receives the authentication data from the mobile communication terminal, (v) compares the authentication data received from the mobile communication terminal with the authentication data read from the user database, (vi) successfully authenticates the mobile communication terminal under a condition that the compared pieces of authentication data match each other, (vii) reads the decryption key from the decryption key database by using, as a key, the key ID that identifies the encryption key used to generate the encrypted folder, the key ID being included in the viewing request, under a condition that the authentication of the mobile communication terminal is successful, and (viii) transmits the read decryption key to the address of the viewing terminal.

23. A locking terminal for generating an encrypted folder by encrypting a folder, comprising

a locking section that, when the locking terminal generates the encrypted folder by encrypting the folder by using an encryption key, writes a user ID of an unlocking right owner who is entitled to decrypt the encrypted folder and a key ID that identifies the encryption key used to generate the encrypted folder, into the encrypted folder.

24. A viewing terminal for unlocking an encrypted folder which is generated by encrypting a folder by using an encryption key, comprising:

a viewing request section that, when the viewing terminal receives a request to view the encrypted folder, reads (i) a user ID of an unlocking right owner who is entitled to decrypt the encrypted folder, (ii) a key ID that identifies the encryption key used to generate the encrypted folder, and (iii) an address of a key distribution server that stores thereon a decryption key corresponding to the key ID, from the encrypted folder, and transmits the read user ID and key ID, to the address of the key distribution server as a viewing request of the encrypted folder; and

an unlocking section that, when receiving the decryption key from the key distribution server, decrypts the encrypted folder the viewing of which is requested, by using the decryption key received from the key distribution server.

25. A locking terminal for generating an encrypted folder by encrypting a folder, and decrypting the encrypted folder by using a decryption key received from a key distribution server, the locking terminal comprising:

a locking section that stores thereon an encryption key used to encrypt the folder, and when generating the encrypted folder by encrypting the folder by using the encryption key, writes a user ID of an unlocking right owner who is entitled to decrypt the encrypted folder and a key ID that identifies the encryption key used to encrypt the folder, into the encrypted folder;

a viewing request section that, when the locking terminal receives a request to view the encrypted folder, reads (i) the user ID of the unlocking right owner who is entitled to decrypt the encrypted folder, (ii) the key ID that identifies the encryption key used to generate the encrypted folder, and (iii) an address of the key distribution server that stores thereon the decryption key corresponding to the key ID, from the encrypted folder, and transmits the read user ID and key ID, to the address of the key distribution server as a viewing request of the encrypted folder; and

an unlocking section, when the locking terminal receives the decryption key from the key distribution server, decrypts the encrypted folder the viewing of which is requested, by using the decryption key received from the key distribution server.

26. An encryption key distribution method for distributing an encryption key by using a system including therein (i) a locking terminal that stores thereon an encryption key used to encrypt a folder, (ii) a key distribution server that stores thereon, in association with the encryption key, a decryption key used to decrypt the encrypted folder which is generated by using the encryption key, (iii) a viewing terminal that unlocks the encrypted folder, and (iv) a mobile communication terminal that is registered on the key distribution server as an authentication key used to authenticate a user, wherein

the locking terminal generates the encrypted folder by encrypting the folder by using the encryption key,

when receiving a request to view the encrypted folder, the viewing terminal transmits a viewing request of the encrypted folder to the key distribution server,

when receiving the viewing request of the encrypted folder from the viewing terminal, the key distribution server transmits the decryption key to the viewing terminal, under a condition that the key distribution server receives an access from the mobile communication terminal owned by the user who is set as an unlocking right owner of the encrypted folder, and

when receiving the decryption key corresponding to the encrypted folder the viewing of which is requested from the key distribution server, the viewing terminal unlocks the encrypted folder by using the decryption key.

27. The encryption key distribution method as set forth in claim 26, wherein

the key distribution server stores (i) on a decryption key database, the decryption key in association with a key ID that identifies a combination of the encryption key used to encrypt the folder and the decryption key used to decrypt the encrypted folder generated by using the encryption key, and (ii) on a user database, authentication data unique to the mobile communication terminal which accesses the key distribution server, in association with a user ID of the user of the mobile communication terminal,

the locking terminal encrypts the folder to generate the encrypted folder, and writes a user ID of the unlocking right owner who is entitled to decrypt the encrypted folder and the key ID that identifies the encryption key used to generate the encrypted folder, into the encrypted folder,

when receiving the request to view the encrypted folder, the viewing terminal establishes a connection with the key distribution server, and transmits, as the viewing request of the encrypted folder, the user ID of the unlocking right owner and the key ID which are written in the encrypted folder, to the key distribution server,

when receiving the viewing request of the encrypted folder from the viewing terminal, the key distribution server (i) acquires an address of the viewing terminal, (ii) reads the authentication data from the user database by using, as a key, the user ID of the unlocking right owner included in the viewing request, and (iii) waits for the access from the mobile communication terminal,

the mobile communication terminal accesses the key distribution server and transmits the authentication data to the key distribution server,

when receiving the access from the mobile communication terminal, the key distribution server (I) receives the authentication data from the mobile communication terminal, (II) compares the authentication data received from the mobile communication terminal with the authentication data read from the user database, (III) successfully authenticates the mobile communication terminal under a condition that the compared pieces of authentication data match each other, (IV) reads the decryption key from the decryption key database by using, as a key, the key ID included in the viewing request, under a condition that the authentication of the mobile communication terminal is successful, and (V) transmits the read decryption key to the address of the viewing terminal, and

the viewing terminal decrypts the encrypted folder the viewing of which is requested, by using the decryption key received from the key distribution server.

28. A computer-readable medium storing thereon a program for a key distribution server for distributing a decryption key used to decrypt an encrypted folder that is generated by a locking terminal, to a viewing terminal that decrypts the encrypted folder,

the program causing the key distribution server to realize

an authentication function of, when the key distribution server receives a viewing request of the encrypted folder from the viewing terminal, waiting for receiving an access from a mobile communication terminal of an unlocking right owner who is entitled to decrypt the encrypted folder and transmitting the decryption key to the viewing terminal under a condition that the key distribution server successfully authenticates the mobile communication terminal.

29. The medium as set forth in claim 28, wherein

the program causes the key distribution server to further realize:

a decryption key managing function of storing the decryption key in association with a key ID that identifies a combination of an encryption key used to encrypt a folder to generate the encrypted folder and the decryption key used to decrypt the encrypted folder which is generated by using the encryption key; and

a user managing function of storing authentication data unique to the mobile communication terminal which accesses the key distribution server, in association with a user ID of the user of the mobile communication terminal, and

the authentication function includes

a function of (i) when the key distribution server receives the viewing request of the encrypted folder from the viewing terminal, acquiring an address of the viewing terminal, (ii) reading the authentication data, by using, as a key, the user ID of the unlocking right owner who is entitled to decrypt the encrypted folder, the user ID being included in the viewing request, (iii) waiting for an access from the mobile communication terminal, (iv) when the key distribution server receives the access from the mobile communication terminal, receiving the authentication data from the mobile communication terminal, (v) comparing the authentication data received from the mobile communication terminal with the read authentication data, (vi) successfully authenticating the mobile communication terminal under a condition that the compared pieces of authentication data match each other, (vii) reading the decryption key by using, as a key, the key ID that identifies the encryption key used to generate the encrypted folder, the key ID being included in the viewing request, under a condition that the authentication of the mobile communication terminal is successful, and (viii) transmitting the read decryption key to the address of the viewing terminal.

30. A computer-readable medium storing thereon a program for a locking terminal for generating an encrypted folder by encrypting a folder,

the program causing the locking terminal to realize

a locking function of, when the locking terminal generates the encrypted folder by encrypting the folder by using an encryption key, writing a user ID of an unlocking right owner who is entitled to decrypt the encrypted folder and a key ID that identifies the encryption key used to generate the encrypted folder, into the encrypted folder.

31. A computer-readable medium storing thereon a program for a viewing terminal for unlocking an encrypted folder which is generated by encrypting a folder by using an encryption key,

the program causing the viewing terminal to realize

a viewing request function of, when the viewing terminal receives a request to view the encrypted folder, reading (i) a user ID of an unlocking right owner who is entitled to decrypt the encrypted folder, (ii) a key ID that identifies the encryption key used to generate the encrypted folder, and (iii) an address of a key distribution server that stores thereon a decryption key corresponding to the key ID, from the encrypted folder, and transmitting the read user ID and key ID, to the address of the key distribution server as a viewing request of the encrypted folder.

32. A computer-readable medium storing thereon a program for a locking terminal for generating an encrypted folder by encrypting a folder, receiving a decryption key used to decrypt the encrypted folder from a key distribution server, and decrypting the encrypted folder by using the decryption key,

the program causing the locking terminal to realize:

a locking function of storing an encryption key used to encrypt the folder, and when the locking terminal generates the encrypted folder by encrypting the folder by using the encryption key, writing a user ID of an unlocking right owner who is entitled to decrypt the encrypted folder and a key ID that identifies the encryption key used to encrypt the folder, into the encrypted folder;

a viewing request function of, when the locking terminal receives a request to view the encrypted folder, reading (i) the user ID of the unlocking right owner who is entitled to decrypt the encrypted folder, (ii) the key ID that identifies the encryption key used to generate the encrypted folder, and (iii) an address of the key distribution server that stores thereon the decryption key corresponding to the key ID, from the encrypted folder, and transmitting the read user ID and key ID, to the address of the key distribution server as a viewing request of the encrypted folder; and

an unlocking function of, when the locking terminal receives the decryption key from the key distribution server, decrypting the encrypted folder the viewing of which is requested, by using the decryption key received from the key distribution server.