Information processing system and control method of information processing system

• US 9,514,315 B2
• Filed: 10/24/2014
• Issued: 12/06/2016
• Est. Priority Date: 11/15/2013
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Chujo, Yoshihisa, Hashimoto, Tsuyoshi
• Primary Examiner(s): Pearson, David
• Assistant Examiner(s): VU, PHY ANH TRAN
• Application Number:
  US14/522,709
• Publication Number:
  US 20150143114A1
• Time in Patent Office: 774 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30

Abstract

A first information processing device holds data and a key for encryption. A second information processing device does not have rights to share data not encrypted with the first information processing device and a client. The first information processing device transmits data and key to the client when receiving a request to use the data. The first information processing device generates first encrypted data encrypted with the key, and transmits it to the second information processing device. The client transmits information obtained by encrypting the result of processing on the data with the key to the second information processing device until the use of the data ends. The first information processing device acquires second encrypted data received by the second information processing device from the second information processing device, and decrypts and stores it when notified that the use of the data has ended.

Claims

1. An information processing system comprising:

a first information processing device that holds data and a key used to encrypt the data;

a client device that uses the data;

a second information processing device that does not have a right to share, or a right to access, data that is not encrypted with the first information processing device and the client device, and

a third information processing device having a right to share data that is not encrypted with the first information processing device and the client device, wherein

the first information processing device;

upon receipt of a request to use the data from the client device, the first information processing device;

specifies one of the second information processing device and the third information processing device, whichever has a lighter load, as a communication target, which will be the information processing device that the client device communicates with when use of the data ends;

notifies the client device of identification information of the communication target;

transmits the data and the key to the client device upon receipt of a request from the client device, wherein the request is transmitted when the client device uses the data; and

generates first encrypted data, which is the data encrypted with the key, and transmits the first encrypted data to the communication target;

the client device;

in a case where the received identification information of the communication target is identification information of the second information processing device, transmits a second encrypted data obtained by encrypting a result of processing on the data with the key to the second information processing device when use of the data ends, the second information processing device updates the first encrypted data stored in a cache area within the second information processing device, using the second encrypted data; and

in a case where the received identification information of the communication target is identification information of the third information processing device, transmits the second encrypted data to the third information processing device when the use of the data ends, the third information processing device stores the second encrypted data in a cache area within the third information processing device; and

the first information processing device acquires the second encrypted data, which is a most recent data that the second or third information processing device has received from the client device, decrypts the second encrypted data, and stores the decrypted data when notified by the client device that the use of the data has ended.

2. The information processing system according to claim 1, wherein the client device has identification information of a device having a right to share data that is not encrypted, and

the client device determines that the third information processing device has been specified as the communication target in a case where the received identification information of the communication target is identification information of the device having the right to share data that is not encrypted.

3. A control method of an information processing system comprising:

holding, by a first information processing device, data and a key used to encrypt the data;

using, by a client device, the data;

a second information processing device not having a right to share, or a right to access, data that is not encrypted with the first information processing device and the client device, and

a third information processing device having a right to share data that is not encrypted with the first information processing device and the client device, wherein

the first information processing device;

transmitting the data and the key to a client device upon receipt of a request from the client device, wherein the request is transmitted when the client device uses the data;

specifying one of the second information processing device and the third information processing device, whichever has a lighter load, as a communication target, which will be the information processing device that the client device communicates with when use of the data ends;

notifying the client device of identification information of the communication target;

transmitting the data and the key to the client device upon receipt of a request from the client device, wherein the request is transmitted when the client device uses the data; and

generating first encrypted data, which is the data encrypted with the key, and transmitting the first encrypted data to the communication target;

the client device;

in a case where the received identification information of the communication target is identification information of the second information processing device, transmits a second encrypted data obtained by encrypting a result of processing on the data with the key to the second information processing device when use of the data ends, the second information processing device updates the first encrypted data stored in a cache area within the second information processing device, using the second encrypted data; and

in a case where the received identification information of the communication target is identification information of the third information processing device, transmits the second encrypted data to the third information processing device when the use of the data ends, the third information processing device stores the second encrypted data in a cache area within the third information processing device; and

the first information processing device acquires the second encrypted data, which is a most recent data that the second or third information processing device has received from the client device, decrypts the second encrypted data, and stores the decrypted data when notified by the client device that the use of the data has ended.

4. The control method of an information processing system according to claim 3, wherein the client device has identification information of a device having a right to share data that is not encrypted, and

the client device determines that the third information processing device has been specified as the communication target in a case where the received identification information of the communication target is identification information of the device having the right to share data that is not encrypted.

5. A non-transitory computer-readable recording medium having stored therein a control program for causing an information processing device to perform a process comprising:

holding, by a first information processing device, data and a key used to encrypt the data;

using, by a client device, the data;

a second information processing device not having a right to share, or a right to access, data that is not encrypted with the first information processing device and the client device, and

a third information processing device having a right to share data that is not encrypted with the first information processing device and the client device, wherein

the first information processing device;

transmitting the data and the key to a client device upon receipt of a request from the client device, wherein the request is transmitted when the client device uses the data;

specifying one of the second information processing device and the third information processing device, whichever has a lighter load, as a communication target, which will be the information processing device that the client device communicates with when use of the data ends;

notifying the client device of identification information of the communication target;

transmitting the data and the key to the client device upon receipt of a request from the client device, wherein the request is transmitted when the client device uses the data; and

generating first encrypted data, which is the data encrypted with the key, and transmitting the first encrypted data to the communication target;

the client device;

in a case where the received identification information of the communication target is identification information of the second information processing device, transmits a second encrypted data obtained by encrypting a result of processing on the data with the key to the second information processing device when use of the data ends, the second information processing device updates the first encrypted data stored in a cache area within the second information processing device, using the second encrypted data; and

in a case where the received identification information of the communication target is identification information of the third information processing device, transmits the second encrypted data to the third information processing device when the use of the data ends, the third information processing device stores the second encrypted data in a cache area within the third information processing device; and

the first information processing device acquires the second encrypted data, which is a most recent data that the second or third information processing device has received from the client device decrypts the second encrypted data, and stores the decrypted data when notified by the client device that the use of the data has ended.