SERVICE SYSTEM

• US 20120216041A1
• Filed: 02/23/2012
• Published: 08/23/2012
• Est. Priority Date: 08/28/2009
• Status: Abandoned Application

• Current Assignee: Ripplex Inc. (Casio Computer Company Limited)
• Original Assignee: Ripplex Inc. (Casio Computer Company Limited)
• Inventors: NAONO, Norihiko, OTA, Tomohisa, OHNAKA, Kunihiko
• Application Number:
  US13/403,031
• Publication Number:
  US 20120216041A1
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

Provided is a system including a first server which stores a first encryption key and a second server which stores a second encryption key. The first server has a storage unit which stores double encryption information obtained by subjecting the information to double encryption using a first encryption key and a second encryption key. The first server stores encrypted information obtained by encrypting the information by a third encryption key. The first server further stores a double encryption key obtained by encrypting the third encryption key and the second encryption key.

Claims

1-32. -32. (canceled)

33. A secret information management system for a storage process and a browsing process of secret information on one or a plurality of servers comprising:

a first server; and

a second server,

wherein

(1) in the storage process,

the secret information transmitted by a user who uses a first service provided by the first server connected via a network is received via the network and is stored in a first temporary storage region;

the secret information stored in the first temporary storage region is encrypted in a state where decryption is only possible by using both a first encryption key, which is managed by a provider by the first service, and a second encryption key, which is managed by a provider other than the provider of the first service, and encrypted secret information is generated;

the encrypted secret information is stored in an information storage region; and

the secret information, which is stored in the first temporary storage region, is deleted and

(2) in the browsing process,

the secret information is decrypted from the encrypted secret information using both the first encryption key and the second encryption key and is stored in a second temporary storage region;

the secret information stored in the second temporary storage region is received via the network by the first server or the second server which provides a second service which is provided by a provider different from the provider of the first service; and

the secret information, which is stored in the second temporary region, is deleted.

34. The secret information management system according to claim 33, wherein in the storage process, when the secret information stored in the first temporary storage region is encrypted and the encrypted secret information is generated, the first encryption key is received via the network from the first server, the secret information stored in the first temporary storage region is encrypted using the first encryption key, which is received, and the second encryption key managed by the secret information management system, and the first encryption key, which is received, is deleted following the encryption process, and in the browsing process, when the secret information is decrypted from the encrypted secret information, the first encryption key is received via the network from the first server, the secret information is decrypted from the encrypted secret information using the first encryption key which is received and the second encryption key, and the first encryption key, which is received, is deleted after the decryption process.

35. The secret information management system according to claim 33, wherein in the storage process, when the secret information stored in the first temporary storage region is encrypted and the encrypted secret information is generated, the secret information stored in the first temporary storage region is encrypted using a third encryption key stored as an encryption key which is in a state where the third encryption key can be decrypted only by using both the first encryption key and the second encryption key, and the third encryption key is deleted after the encryption process.

36. The secret information management system according to claim 35, wherein in the browsing process, when the secret information is decrypted from the encrypted secret information, the encryption key is transmitted to the first server, encryption key information generated by decrypting the encryption key using the first encryption key from the first server is received, the third encryption key is generated by decrypting the encryption key information, which is received, using the second encryption key, and the third encryption key is deleted after decrypting the secret information from the encrypted secret information.

37. The secret information management system according to claim 33, wherein when the encrypted secret information is stored in the information storage region, the encrypted secret information is correlated with an identification tag for uniquely identifying a user and is stored, and the second encryption key is correlated with identification tag and is stored within the secret information management system.

38. The secret information management system according to claim 33, wherein one or both of the first encryption key and the second encryption key are non-symmetric keys comprised from a public key used for encryption and a secret key used for decryption.

39. The secret information management system according to claim 33, wherein in the browsing process, the secret information stored in the second temporary storage region is transmitted to a second server which provides the second service provided by a provider different from the provider of the first service.

40. The secret information management system according to claim 37, wherein the first server authenticates the user in the storage process and/or in the browsing process and transmits the identification key for uniquely identifying the user to the secret information management system.

41. The secret information management system according to claim 33, wherein

(1) in the storage process

a second secret information transmitted by the user who uses the second service is received via the network and is stored in the first temporary storage region;

the second secret information, which is stored in the first temporary storage region, is encrypted in a state where decryption is only possible by using both the third encryption key, which is managed by the provider of the second service, and the second encryption key, and a second encrypted secret information is generated;

the second encrypted secret information is stored in an information storage region; and

the second secret infatuation, which is stored in the first temporary storage region, is deleted; and

(2) in the browsing process

the second secret information is decrypted from the second encrypted secret information using both the third encryption key and the second encryption key and is stored in the second temporary storage region;

the second secret information, which is stored in the second temporary storage region, is transmitted to the first server or the second server via the network; and

the second secret information, which is stored in the second temporary storage region, is deleted.

42. A server which provides a service via a network, comprising:

a first temporary storage region; and

a second temporary storage region,

where in the server received a login request of a user; and

provides a user interface for inputting secret information to be transmitted to a secret information management system by redirecting the user to the secret information management system installed on one or a plurality of servers connected via a network, the secret information management system performing a storage process and browsing process of the secret information on the one or plurality of servers;

wherein

(1) in the storage process,

the secret information transmitted by the user is received via the network and is stored in the first temporary storage region;

the secret information, which is stored in the first temporary storage region, is encrypted in a state where decryption is only possible by using both a first encryption key managed by a provider of the first service and a second encryption key managed by a provider other than the provider of the first service, and an encrypted secret information is generated;

the encrypted secret information is stored in an information storage region; and

the secret information, which is stored in the first temporary storage region, is deleted and

(2) in the browsing process,

the secret information is decrypted from the encrypted secret information using both the first encryption key and the second encryption key and is stored in the second temporary storage region;

the secret information, which is stored in the second temporary storage region, is transmitted via the network to the server or a different server which provides a different service provided by a provider different from a provider of the service; and

the secret information, which is stored in the second temporary region, is deleted.

43. The server which provides a service via a network according to claim 42, wherein the server stores the first encryption key, and in the storage process, when the secret information, which is stored in the first temporary storage region, is encrypted and the encrypted secret information is generated, the first encryption key is received via the network from the server, the secret information stored in the first temporary storage region is encrypted using the first encryption key, which is received, and the second encryption key managed by the secret information management system, and the first encryption key, which is received, is deleted after the encryption process, and in the browsing process, when the secret information is decrypted from the encrypted secret information, the first encryption key is received via the network from the server, the secret information is decrypted from the encryption secret information using the first encryption key, which is received, and the second encryption key, and the first encryption key, which is received, is deleted after the decryption process.

44. The server which provides a service via a network according to claim 42, wherein the server stores the first encrypted key, and in the storage process, when the secret information, which is stored in the first temporary storage region, is encrypted and the encrypted secret information is generated, the secret information, which is stored in the first temporary storage region, is encrypted using a third encryption key stored as an encryption key which is in a state where the third encryption key can be decrypted only by using both the first encryption key and the second encryption key, and the third encryption key is deleted after the encryption process.

45. The server which provides a service via a network according to claim 44, wherein in the browsing process, when the secret information is decrypted from the encryption secret information, the encryption key is transmitted to the server, the encrypted key information is generated by decrypting the encryption key using the first encryption key from the server is received, the third encryption key is generated by decrypting the encryption key information, which is received, using the second encryption key, and the third encryption key is deleted after decrypting the secret information from the encrypted secret information.

46. The server which provides a service via a network according to claim 42, wherein when the encrypted secret information is stored in the information storage region, the encrypted secret information is correlated with an identification tag for uniquely identifying a user and is stored, and the second encryption key is correlated with identification tag and is stored within the secret information management system.

47. The server which provides a service via a network according to claim 42, wherein one or both of the first encryption key and the second encryption key are non-symmetric keys comprised from a public key used for encryption and a secret key used for decryption.

48. The server which provides a service via a network according to claim 42, wherein in the browsing process, the secret information, which is stored in the second temporary storage region, is transmitted to a different server which provides the different service provided by a different provider from the provider of the service.

49. The server which provides a service via a network according to claim 42, wherein in the storage process and/or the browsing process an identification tag for uniquely identifying the user from identification information specified by a login request of the user is obtained and transmitted to the secret information management system.

50. A secret information management system comprising:

an information process server; and

an information storage server for performing a storage process and a browsing process respectively;

wherein

(1) In the storage process,

the information process server receives secret information sent by a user of a different server connected via a network and stores the secret information in a first temporary storage region;

a first encryption key from the different server is received;

a second encryption key from the information storage server is received;

the secret information, which is stored in the first temporary storage region, is encrypted using the first encryption key and the second encryption key and an encrypted secret information is generated;

the secret information, which is stored in the first temporary storage region, is deleted after transmitting the encrypted secret information to the information storage server; and

the information storage server stores the encrypted secret information received from the information process server;

(2) in the browsing process,

the information storage server transmits the second encrypted key and the encrypted secret information to the information process server;

the information process server receives the first encrypted key from the different server;

the second encryption key and the encryption secret information is received from the information storage server;

the encrypted secret information to the secret information is decrypted using the first encryption key and the second encryption key and is stored the secret information in a second temporary storage region; and

the secret information, which is stored in the second temporary storage region, is deleted after the secret information is transmitted to the information process server and a server other than the information storage server.

51. An information process server for communicating with an information storage server for performing a storage process and a browsing process of secret information respectively, comprising:

a first temporary storage region; and

a second temporary storage region,

wherein;

(1) in the storage process

a secret information is transmitted by a user who uses a service provided by a first server and storing the secret information in the first temporary storage region;

a first encryption key is received from the first server;

a second encryption key is received from the information storage server;

the secret information, which is stored in the first temporary storage region, is encrypted using the first encryption key and the second encryption key and an encrypted secret information is generated;

the secret information, which is stored in the first temporary storage region, is deleted after transmitting the encryption secret information to the information storage server; and

(2) in the browsing process

the information storage server sends the second encryption key and the encryption secret information to the information process server;

the first encryption key is received from the different server;

the second encryption key and the encrypted secret information is received from the information storage server;

the encrypted secret information is decrypted to the secret information using the first encryption key and the second encryption key and is stored the secret information in the second temporary storage region; and

the secret information, which is stored in the second temporary storage region, is deleted after the secret information is sent to the information process server and a server other than the information storage server.

52. A storage process server for communicating with an information process server for performing a storage process and a browsing process of secret information respectively, comprising:

a receiver;

a transmitter; and

a database storage,

wherein;

(1) in the information storage process,

an identification tag for uniquely identifying a user of a different server connected via a network is received by the receiver;

a first encryption key correlated with the identification tag and stored in the information process server is transmitted by the transmitter;

an encrypted secret information is produced by encrypting the secret information transmitted by a user of the different server using the second encryption key and the first encryption key, which is received by the receiver from the different server, and is correlated with the identification tag and the secret information key and the identification tag are stored in the database storage; and

(2) in the browsing process,

the identification tag is received by the receiver from a server other than the information process server; and

the first encryption key and the encrypted secret information, which is correlated with the identification tag, are transmitted by the transmitter to the information process server.