INFORMATION SHARING SYSTEM, COMPUTER, PROJECT MANAGING SERVER, AND INFORMATION SHARING METHOD USED IN THEM

• US 20110179412A1
• Filed: 05/19/2008
• Published: 07/21/2011
• Est. Priority Date: 05/23/2007
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Sasaki, Takayuki, Nakae, Masayuki
• Granted Patent: US 9,461,819 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority

Abstract

A project managing unit 11 authenticates users of virtual machines 24-1 to 24-N and specifies a project to which the users belong. A key managing unit 12 distributes an encryption key, which is assigned in advance to the project specified by the project managing unit 11, to encryption processing units 232-1 to 232-N of virtualizing units 23-1 to 23-N. Input/output monitoring units 231-1 to 231-N of the virtualizing units 23-1 to 23-N receive input/output data generated between the virtual machines 24-1 to 24-N and devices 22-1 to 22-N, and deliver the data to the encryption processing units 232-1 to 232-N. The encryption processing units 232-1 to 232-N encrypt output (write) data and decrypt input (read) data by using the distributed encryption key.

Claims

1. An information sharing system comprising:

a computer including a virtual machine configured to provide a virtual machine environment; and

a project managing server configured to communicate with said computer,

wherein said computer includes a virtualizing unit,

said virtualizing unit includes;

an input/output monitoring unit which monitors input/output data between said virtual machine and a device; and

an encryption processing unit which encrypts or decrypts, based on a monitoring result of said input/output monitoring unit, said input/output data in accordance with a direction of input/output by using a predetermined encryption key,

said project managing server includes;

a project managing unit which manages and authenticates members of a business project based on authentication information from said computer; and

a key managing unit which generates, updates, and manages an encryption key specific to said business project, and

said project managing server supplies said encryption key managed by said key managing unit to said computer.

2. The information sharing system according to claim 1, wherein said virtualizing unit further include:

a virtual machine managing unit which stores attribute information of said virtual machine;

a metadata generating unit which generates metadata including said attribute information of said virtual machine and generates encapsulated data by linking said metadata and encrypted data encrypted by said encryption processing unit; and

a metadata verification unit, and

when said input/output monitoring unit detects that said input/output data is input from said device to said virtual machine, said metadata verification unit compares said encrypted data in said encapsulated data with said attribute information of said virtual machine to determine whether said encrypted data in said encapsulated data to be decrypted or said encapsulated data to be transferred without decryption as data read from said device.

3. The information sharing system according to claim 2, wherein said virtualizing unit includes:

an agent communication unit which select a virtual machine required to access said encapsulated data based on said metadata in said encapsulated data and instruct said virtual machine required to access said encapsulated data to access; and

an application agent unit which mutually transfers a window image of an application operated on another virtual machine and an input signal from a user input device.

4. The information sharing system according to claim 1, further comprising a project managing server including:

a project managing unit which manages and authenticates members of a business project based on authentication information from said computer; and

a key managing unit which generates, updates, and manages an encryption key specific to said business project.

5. An information sharing method used for a system including a computer including a virtual machine configured to provide a virtual machine environment, comprising:

monitoring input/output data between said virtual machine and a device; and

encrypting or decrypting, based on a monitoring result of said monitoring, said input/output data in accordance with a direction of input/output by using a predetermined encryption key.

6. The information sharing method according claim 5, further comprising:

storing attribute information of said virtual machine;

generating metadata including said attribute information of said virtual machine;

generating encapsulated data by linking said metadata and encrypted data encrypted in said encrypting; and

when said input/output data is detected as input from said device to said virtual machine in said monitoring, comparing said encrypted data in said encapsulated data with said attribute information of said virtual machine to determine whether said encrypted data in said encapsulated data to be decrypted or said encapsulated data to be transferred without decryption as data read from said device.

7. The information sharing method according to claim 6, further comprising:

selecting a virtual machine required to access said encapsulated data based on said metadata in said encapsulated data;

instructing said virtual machine required to access said encapsulated data to access; and

mutually transferring a window image of an application operated on another virtual machine and an input signal from a user input device.

8. The information sharing method according to claim 5, further comprising:

managing and authenticating members of a business project based on authentication information from said computer; and

generating, updating and managing an encryption key specific to said business project.