JPH11212874A - System and method for communication data secrecy control - Google Patents

Abstract

PROBLEM TO BE SOLVED: To establish a system that improves secrecy of data obtained from a server system and has functions of data secrecy transfer and storage control independent of applications of the server system and of a client system without deteriorating the operability of a user of the client system. SOLUTION: Data ordered from a server system 20 are enciphered by an enciphering/decoding part 13 and retained in a cash file 17. When data become necessary, a key is obtained from a recognition part 24 by a line monitoring part 14 and, by decoding the data and using them, it is ensured that raw data are not retained in the cash file 17 and secrecy of the data can be improved.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a data communication and storage technique between a server system and a client system, and more particularly to a communication data concealment control system and a communication data concealment control method relating to confidential storage and reproduction control of communication data.

[0002]

2. Description of the Related Art Conventionally, a data concealment function in data communication between a server system and a client system is roughly classified into the following two methods. (1) Data concealment function of communication channel (2) Data concealment function of stored data The function (1) is to add a data concealment function such as encryption to the communication layer of the server system and the client system.
This prevents data tapping and tampering on the communication path.
Actually, there are a method of providing a security function in a communication control device itself such as a router or an access server, or communication control software and a protocol module of a client system, and a method of providing a security function in a server application and a client application.

On the other hand, data received from a server is stored in a file system in a client system in some cases. However, confidentiality to a third party may be required depending on data.

However, since raw data that is not encrypted is passed from the communication layer to the application of the client system, the raw data is stored in the file system, and the confidentiality of the data cannot be satisfied.

In order to solve this problem, there is a method in which the function (2) for concealing stored data is also used. For example, there is a method in which a module for encrypting a file is introduced into a client system, and once stored data is concealed and saved again by a user.

However, in this method, the following (a):
As shown in (b), confidentiality of data may not be maintained. (A) Some client applications have a data caching function. A typical one is a WWW (World Wide Web) browser.

In this WWW browser, raw data is stored in a cache file even when data concealment of a communication path functions. Therefore, data may be stolen by a third party.

(B) When using a module for encrypting a file, a key is required for encryption / decryption. The problem is how to store this key.
For example, in a method in which a key is encrypted with a password or the like and stored in a file in the client system, if the password is broken, data can be stolen. In particular, the user often gives an easy password in terms of operability, and the password is likely to be decrypted.

In the above (1), when the data concealment function is used between the application of the server system and the application of the client system, not only the function is required on both sides, but also the application on the server system side requires the data concealment function. Each time confidentiality setting is required, the operation of the data creator or the administrator becomes complicated.

[0010]

With the development of wireless / wired communication infrastructure, the number of cases in which client systems are moved and operated has been increasing. For example, a sales clerk may use a telephone line to connect to an in-house server system and view data from a customer. In this case, in an operation that accesses highly confidential data such as customer data, in order to access the data, it is necessary to connect to the in-house system and transfer the data every time.

On the other hand, there is a method of temporarily storing confidential data in a client system in order to reduce communication costs. In this case, the stored data concealment function of (2) described above is used. However, since the device is moved and used, the risk of theft or loss of the device increases, and the problem of (b) above occurs. And confidential data may be stolen by third parties. Of course, even if the stored data concealing function described in the above (2) is used, there is no effect in the case of the above (a), so that the confidential data can be easily stolen by a third party. I will.

Further, when data concealment is performed between applications of the server system and the client system,
Setting / management is also an issue. It is also necessary to increase confidentiality without depending on the application as much as possible.

Therefore, the present invention has been made in consideration of the above circumstances, and solves the above-mentioned problems, improves the confidentiality of data obtained from the server system without impairing the operability of the user of the client system, An object of the present invention is to provide a communication data concealment control system having a data concealment transfer and storage control function independent of applications of a server system and a client system, and a communication data concealment control method.

[0014]

According to the present invention, there is provided a communication system used for data communication between a server system and a client system, wherein the client system is provided in place of a client application. A communication means for performing data communication with the server application, and processing of the header information of the data so that the client application does not cache when it is determined that the data obtained from the server application by the communication means is encrypted. And means for transferring to the client application.

According to such a configuration, the operation of setting the cache to unusable by the client application becomes unnecessary, and the operability in operation is improved. Further, according to the present invention, in the above configuration, the server system is not the client system but the server system performs data communication with the server application in place of the client application, and the data acquired from the server application by the communication unit is encrypted. In the case where it is determined that the data is read, the header information of the data is changed so that the client application does not cache the data, and then the data is transferred to the client application.

According to such a configuration, the operation of setting the cache to be unusable by the client application becomes unnecessary, and the operability in operation is improved. Further, according to the present invention, in the above configuration, the client system may be configured such that, when it is determined that the data obtained from the server application is encrypted in the communication unit that performs data communication with the server application instead of the client application. After caching in the encrypted state, and processing the header information of the data so that the client application does not cache,
It is characterized by having means for transferring to a client application.

According to such a configuration, since the communication means of the client system, not the client application, performs caching of the confidential data, it is possible to improve the operability in operation and at the same time reduce the communication cost.

Further, according to the present invention, in the above-mentioned configuration, the server system determines that the data obtained from the server application is encrypted by the communication means for performing data communication with the server application instead of the client application. In this case, there is provided a means for caching the data in an encrypted state, processing the header information of the data so that the client application does not cache the data, and transferring the processed data to the client application.

According to such a configuration, the communication means of the server system, not the client application, caches the confidential data, so that the operability can be improved and the communication costs of the plurality of client systems can be reduced.

Further, according to the present invention, in the above configuration, the server system authenticates a request source, holds a list of keys corresponding to the request source, and distributes the key to the request source when the authentication is correctly performed. Means, wherein the client system is a communication means for performing data communication with a server application on behalf of the client application;
A means for inquiring the authentication means of the server system, encrypting and caching data using the delivered key, and transferring the data to the client application, and a request for data transfer from the client application, It is determined whether the data is stored in the cache, and if it is stored,
A means for transferring data to the client application after decrypting the data using the key, and monitoring the state of the line connected to the server system, and invalidating the delivered key when the line is disconnected. It is characterized by having means.

According to such a configuration, even the unencrypted data is encrypted and cached by the communication means of the client system, so that the communication cost can be reduced and the confidentiality can be increased. In addition, since the encryption function operates only when the line is connected, more confidential operation becomes possible.

Further, according to the present invention, in the above configuration,
6. The client system according to claim 5, wherein the client system has a means for monitoring a state of a line connected to the server system and invalidating the delivered key after a lapse of a predetermined time even if the line is disconnected. It is characterized by the following.

According to such a configuration, even if the line is disconnected, the encryption function operates for a certain period of time, so that the operability in operation is improved and the communication cost can be reduced. Further, according to the present invention, in the above-described configuration, the communication means of the server system has a function of holding a confidential designation and a list of specific data in advance, and a request for acquiring the corresponding data is generated from a client application. In this case, for data that is obtained from the server application and matches the confidential list of the data, a means for processing the header information of the data and transferring the processed data to the client application so that the client application does not cache the data is provided. And

According to such a configuration, data concealment can be designated by the server system communication means instead of the server application, so that management can be concentrated. Furthermore, the communication means of the server system caches data, so that the communication cost of a plurality of client systems can be reduced.

Further, according to the present invention, in the above configuration, both the client system and the server system have communication means for performing data communication with the server application instead of the client application. The application of the client system communicates with the server application, and the communication means of the server system acquires the relevant data from the server application when a request for acquiring the corresponding data is issued from the client application, and acquires the data from the server application. For the data that matches the confidential list, the confidential designation is added to the header information and then transferred to the communication means of the client system. The communication means of the client system is obtained from the communication means of the server system. De If it is determined that the confidential designation is the data, as the client application does not cache, on changing the header information of the data,
In addition to the function of transferring the data to the client application, a key is obtained from the server system according to claim 5, and the data is encrypted using the obtained key and cached.

According to such a configuration, data confidentiality can be designated by the communication means of the server system, not by the server application, and the client system can specify the concealed data only when connected to the server system. Cache available.

Further, according to the present invention, in the above configuration, the communication means of the server system obtains the data requested from the communication means of the client system from the server application and matches the data with a confidential list of the data. The feature that the corresponding data is encrypted in advance using the key of the client that is the requester and is transferred to the client communication means, and the client system includes:
When the encrypted data is received from the communication means of the server system, a key is obtained, the data is decrypted using the key, and the data is transferred to the client application. It is characterized by being stored in a state of.

According to such a configuration, the client system does not need to encrypt the data to be stored in the cache.
Costs can be reduced.

[0029]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described below with reference to the drawings. (First Embodiment) FIG. 1 is a diagram conceptually showing a configuration of a client system 10 and a server system 20 according to a first embodiment of the present invention.

The client system 10 includes an application unit 11, a communication unit 12, an encryption / decryption unit 13, a line monitoring unit 14, a key unit 15, a cache file 16, and a cache file 17.

The application unit 11 is application software installed in the client system 10 and requests data from the application unit 21 of the server system 20.

The communication unit 12 controls transmission and reception of data transmitted from the application unit 11 to the server system 20 or data received from the server system 20. The encryption / decryption unit 13 connects to the communication unit 12 and the cache file 17 and encrypts data to be transmitted / received and stores it in the cache file 17, or decrypts the data if it is encrypted, and decrypts the data from the cache file 17. Take out. Here, the server system 2 performs this encryption / decryption.
A key issued by the authentication unit 24 is required.

The line monitoring unit 14 connects to the communication unit 12 and the key unit 12, receives a key request from the communication unit 12, checks whether a valid key is held, obtains a key, and obtains the obtained key. Is stored in the key unit 15.

On the other hand, the server system 20 includes an application unit 21, a communication unit 22, a secret data name list unit 23,
It comprises an authentication unit 24 and a key list unit 25. The application unit 21 is application software installed in the server system 20, and provides data and the like based on a request from the application unit 11.

The communication unit 22 controls transmission and reception of data transmitted from the application unit 21 to the client system 10 or data received from the client system 10.

The confidential data name list unit 23 is connected to the communication unit 22 and holds confidential data name list information. The authentication unit 24 connects to a key list unit 25 that stores list information such as a user name and a password and a key corresponding thereto, authenticates the user of the client system 10, and issues a key.

If the gist of the present invention has not been implemented,
Application section 11 of client system 10
And the application section 21 of the server system 20 are communicating directly with each other, and the cache data used for communication by the application section 11 is stored in the cache file 16 as it is. That is, even if the data is confidential data, the content can be read by directly accessing the cache file.

Hereinafter, communication between the application unit 11 and the application unit 21 will be described with reference to the flowcharts of FIGS. First, the user using the client system 10 is required to use the application unit 1
1 to issue a request to the application unit 21 operating on the server system. Actually, the request of the application unit 11 is passed to the communication unit 12 by resetting the communication address and the port and imitating the communication unit 12 as the application unit 21 (step A1 in FIG. 2).

The communication unit 12 checks whether data for the request exists in the cache file 17 (step A2 in FIG. 2). Cache file 17
If it does not exist (NO in step A2 in FIG. 2), the line is connected and the request is passed to the communication unit 22.
After the processing in (1), data is obtained from the communication unit 22 (step A8 in FIG. 2).

The processing in the communication section 22 will be described later with reference to the flowchart of FIG. The communication unit 12 is a communication unit 2
If the data returned from step 2 does not have a mark indicating that it is confidential data (N in step A9 in FIG. 2).
O), the received data is not stored in the cache file 17, but is transmitted to the application unit 11 as it is (Step A7 in FIG. 2), and the process ends.

If the data returned from the communication unit 22 is marked with confidential data (YES in step A9 in FIG. 2), the communication unit 12
Get more keys. The process of obtaining this key will be described later with reference to the flowchart of FIG.

The key is obtained and the data is encrypted / decrypted by the unit 13
And then stored in the cache file 17 (step A11 in FIG. 2). Application section 11
Is marked as non-cacheable (step A in FIG. 2).
6) Return unencrypted data (step A7 in FIG. 2).

When data corresponding to the request received from the application unit 11 is stored in the cache file 17 (YES in step A2 in FIG. 2), the communication unit 12 performs communication in order to obtain consistency of the cache. The update information of the data is obtained through the step 22 (step A3 in FIG. 2).

If the data has been updated (YES in step A4 in FIG. 2), new data is obtained in the same manner as in the case of NO in step A2 (step A1 in FIG. 2).
0). If the data has not been updated (NO in step A4 in FIG. 2), a key is obtained from the line monitoring unit 14.

The process of obtaining the key at this time will be described later with reference to the flowchart of FIG. When the key is obtained, the data is decrypted and extracted from the cache file 17 via the encryption / decryption unit 13 (step A5 in FIG. 2), and the application unit 11 is marked as non-cacheable (step A5 in FIG. 2). A6), unencrypted data is returned (step A7 in FIG. 2).

In addition, when the line is not connected by the user setting, the consistency of the cache is not checked, so that the communication cost can be suppressed. Here, the processing in the communication section 22 after the above-described NO in step A2 of FIG. 2 or YES in step A4 will be described with reference to the flowchart of FIG.

If the data does not exist in the cache file 17 (NO in step A2 in FIG. 2), the communication unit 22
Receiving a request from the communication unit 12 (step B in FIG. 3)
1).

The communication section 22 issues a request to the application section 21 to obtain data (step B in FIG. 3).
2). At the same time, the data name is stored in the secret data name list
(Step B3 in FIG. 3).
At step B3, a mark indicating that the data is confidential is added to the header of the data (step B3 in FIG. 3).
5), and return it to the communication unit 12 (step B4 in FIG. 3).

If the data obtained from the application unit 21 does not match the confidential data name list unit 23 (NO in step B3 in FIG. 3), the data is returned to the communication unit 12 without performing anything on the header (FIG. 3). 3 steps B4).

Thus, the processing in the communication section 22 is completed, and the communication section 12 acquires data from the communication section 22 (step A8 in FIG. 2). Also in the case of YES in step A4 described above, the communication unit 12 acquires data from the communication unit 22 by the processing in step B1 and subsequent steps similarly to the above (step A10 in FIG. 2).

Next, the process of obtaining a key from the line monitoring unit 14 after the processing in step A4 or NO in step A4 in FIG. 2 will be described with reference to the flowchart in FIG. The encryption / decryption unit 13 needs a key to encrypt and store the data in the cache file 17 or decrypt and retrieve the data. This key is obtained from the authentication unit 24 of the server system 20 via the line. This key is obtained and managed by the line monitoring unit 14 as follows.

When receiving the key request from the communication unit 12 (step C1 in FIG. 4), the line monitoring unit 14 first checks whether a valid key is held (step C2 in FIG. 4). Here, "valid" means that the line is connected and the key has been obtained, or that the line is not connected but the validity time of the previously obtained key has not expired. If a valid key is held (step C2 in FIG. 4)
Is returned to the communication unit 12 (step C in FIG. 4).
7).

On the other hand, if the valid key is not held (NO in step C2 in FIG. 4), the line monitoring unit 14 connects the line (step C3 in FIG. 4) and obtains the key from the authentication unit 24. (Step C4 in FIG. 4), and is stored in the key unit 15 (Step C5 in FIG. 4).

The authentication unit 24 holds a key list unit 25 storing, for example, a user name and a password, and a key corresponding to the user name and password. If there is an entry that matches the user name and the password sent by the line monitoring unit 14, May return the key to the line monitoring unit 14.

At this time, the validity time of the key obtained by the line monitoring unit 14 is not yet determined, so that the validity time of the key is set to the maximum (step C6 in FIG. 4), and the key is transmitted to the communication unit 1.
2 (Step C7 in FIG. 4).

When the line monitoring unit 14 detects that the line has been disconnected, a valid time is set. The effective time setting process when the disconnection of the line is detected will be described with reference to the flowchart of FIG.

When detecting that the line has been disconnected (step D1 in FIG. 5), the line monitoring unit 14 determines whether or not the key is held (step D2 in FIG. 5). If the key is held here (YES in step D2 in FIG. 5), the validity period of the key is set (step D3 in FIG. 5). If the key is not held (NO in step D2 in FIG. 5), the process ends.

As described above, the communication unit 12 obtains the key and performs the subsequent processing. (Second Embodiment) FIG. 5 is a configuration diagram conceptually showing a client system 30 and a server system 40 in a second embodiment.

The difference from the first embodiment is that the encryption / decryption function is distributed to the client system 30 and the server system 40. The client system 30 includes an application unit 31, a communication unit 32,
It comprises a decryption unit 33, a line monitoring unit 34, a key unit 35, a cache file 36, and a cache file 37.

The application unit 31 is application software installed in the client system 30 and makes a data request to the application unit 41 of the server system 40.

The communication section 32 controls transmission and reception of data transmitted from the application section 31 to the server system 40 or data received from the server system 40. If the data is encrypted, the decryption unit 33 decrypts the data and extracts it from the cache file 37.
This decryption requires a key issued by the authentication unit 44 of the server system 40.

The line monitoring unit 34 receives the key request from the communication unit 32 and checks whether a valid key is held.
The key is obtained, and the obtained key is stored in the key unit 35. On the other hand, the server system 40 includes an application unit 41,
It comprises a communication unit 42, a secret data name list unit 43, an authentication unit 44, a key list unit 45, and an encryption unit 46.

The application section 41 is application software installed in the server system 40, and provides data and the like based on a request from the application section 31.

The communication section 42 controls transmission and reception of data transmitted from the application section 41 to the client system 30 or data received from the client system 30.

The confidential data name list section 43 holds confidential data name list information. The authentication unit 44 authenticates the user of the client system 30 and issues a key. The key list section 45 holds list information such as a user name, a password, and a key corresponding thereto.

The encryption section 46 encrypts the data and passes it to the communication section 42. The operation of the above configuration is described below with reference to FIG.
This will be described with reference to the flowcharts of FIGS.

The user using the client system 30 uses the application unit 31 to execute the application unit 41 running on the server system 40.
Issue a request to. Actually, the communication address and the port are reset, and the communication unit 32 is changed to the application unit 41.
The request from the application unit 31 is passed to the communication unit 32 (step E in FIG. 7).
1).

The communication unit 32 checks whether data for the request exists in the cache file 37 (step E2 in FIG. 7). Cache file 37
If it does not exist (NO in step E2 in FIG. 7), the line is connected, the request is passed to the communication unit 42, and the communication unit 42
After the processing in (1), data is acquired from the communication unit 42 (step E8 in FIG. 7).

The processing in the communication section 42 will be described later with reference to the flowchart shown in FIG. If the data returned from the communication unit 42 does not have a mark indicating that it is confidential data (NO in step E9 in FIG. 7), the communication unit 32 does not store the received data in the cache file 37, and Application section 31
(Step E7 in FIG. 7), and the process ends.

If the data returned from the communication unit 42 is marked with confidential data (YES in step E9 in FIG. 7), the communication unit 32 keeps the data in the cache file 37 as encrypted. (Step E11 in FIG. 7).

Next, a key is obtained from the line monitoring unit 34.
The process of obtaining this key will be described later using the flowchart of FIG. Get the key and cache file 37
Is decrypted via the decryption unit 34 (step E12 in FIG. 7), the application unit 31 is marked as non-cacheable (step E12 in FIG. 7).
6) Return unencrypted data (step E7 in FIG. 7).

If the data corresponding to the request received from the application unit 31 is stored in the cache file 37 (YES in step E2 in FIG. 7), the communication unit 32 executes the communication unit 32 to make the cache consistent. The data update information is obtained via 42 (step E3 in FIG. 7).

If the data has been updated (YES in step E4 in FIG. 7), new data is obtained in the same manner as in the case of NO in step E2 in FIG. 7 (step E in FIG. 7).
10).

If the data has not been updated (NO in step E4 in FIG. 7), the communication unit 32 of the client system 30 adds the confidential information to the header of the data received from the communication unit 42 of the server system 40. At this time, since the data is encrypted, a key is obtained from the line monitoring unit 34 and the data stored in the cache file 37 is decrypted (step E5 in FIG. 7), and non-cacheable information is added to the header. (Step E6 in FIG. 7), and then transferred to the application unit 31 (Step E7 in FIG. 7). Further, the data is stored in the cache file 37 in an encrypted state without being decrypted.

By doing so, in the embodiment of the present invention, the client system does not need an encryption function. For example, if you apply a fast decoding algorithm,
The communication path and the communication data temporarily stored can be concealed without deteriorating the response performance.

Here, N in step E2 in FIG.
O, or the communication unit 42 after the processing of YES in step E4
Will be described with reference to the flowchart of FIG. When data does not exist in the cache file 37 (FIG. 7)
The communication unit 42 receives a request from the communication unit 32 (NO in step E2) (step F1 in FIG. 8).

The communication section 42 issues a request to the application section 41 to obtain data (step F in FIG. 8).
2). At the same time, the data name is stored in the secret data name list 43
(Step F3 in FIG. 8).
In step F3, the key for the user connected to the line is extracted from the authentication unit 44 (step F3 in FIG. 8).
5).

Using the obtained key, the data is encrypted by the encryption unit 46 (step F6 in FIG. 8). A mark indicating that the data is confidential is added to the header of the data (step F7 in FIG. 8), and the data is returned to the communication unit 32 (step F4 in FIG. 8).

If the data obtained from the application section 41 does not match the secret data name list section 43 (NO in step F3 in FIG. 8), the data is returned to the communication section 32 without performing any processing on the header (FIG. 8). 8 steps F4).

Thus, the processing in the communication section 42 is completed, and the communication section 32 acquires data from the communication section 42 (step E8 in FIG. 8). Also in the case of YES in step E4 in FIG. 7 described above, the communication unit 32 acquires data from the communication unit 42 by the processing of step F1 and subsequent steps in FIG. 8 (step E10 in FIG. 8).

Next, N in step E4 in FIG.
O or the process of obtaining the key from the line monitoring unit 34 after the process of step E11 will be described below with reference to the flowchart of FIG.

The decryption unit 33 needs a key to decrypt and retrieve the data in the cache file 37. This key is sent to the authentication unit 44 of the server system 40 via the line.
More ordered. This key is obtained and managed by the line monitoring unit 34 as follows.

When receiving the key request from the communication unit 32 (step G1 in FIG. 9), the line monitoring unit 34 first checks whether a valid key is held (step G2 in FIG. 9). Here, "valid" means that the line is connected and the key has been obtained, or that the line is not connected but the validity time of the previously obtained key has not expired.

When the valid key is held (YES in step G2 in FIG. 9), it is returned to the communication unit 32 (step G7 in FIG. 9). On the other hand, if the valid key is not held (NO in step G2 in FIG. 9), the line monitoring unit 34 connects the line (step G3 in FIG. 9), and obtains the key from the authentication unit 44 (FIG. 9). (Step G4), and store it in the key unit 35 (Step G5 in FIG. 9).

The authentication unit 44 holds a key list unit 45 storing, for example, a user name and a password, and a key corresponding to the user name and password. If there is an entry that matches the user name and the password sent by the line monitoring unit 34, May return the key to the line monitoring unit 34.

At this time, since the validity time of the key obtained by the line monitoring unit 34 has not been determined yet, the validity time of the key is set to the maximum (step G6 in FIG. 9), and the key is transferred to the communication unit 3.
2 (step G7 in FIG. 9).

When the line monitoring unit 34 detects that the line has been disconnected, a valid time is set. The process of setting the effective time when the disconnection of the line is detected is the same as the process of the flowchart of FIG. As described above, the communication unit 32 obtains the key and performs the subsequent processing.

[0088]

As described in detail above, according to the present invention, the confidentiality of data obtained from the server system is improved without impairing the operability of the user of the client system, and the application of the server system and the client system is improved. A communication data concealment method having a data concealment transfer and storage control function that does not depend on the communication data can be provided.

[Brief description of the drawings]

FIG. 1 is a block diagram conceptually showing a configuration of an entire system according to a first embodiment of the present invention.

FIG. 2 is a flowchart showing a data request processing operation centered on the communication unit 12 according to the embodiment;

FIG. 3 is a flowchart showing a confidential data check processing operation centered on the communication unit 22 according to the embodiment;

FIG. 4 is an exemplary flowchart showing a processing operation of transferring a key centered on the line monitoring unit 14 according to the embodiment.

FIG. 5 is a flowchart showing a processing operation for setting a key valid time centering on the line monitoring unit 14 according to the embodiment;

FIG. 6 is a block diagram conceptually showing the configuration of the entire system according to a second embodiment of the present invention.

FIG. 7 is a flowchart showing a data request processing operation centered on the communication unit 32 according to the embodiment;

FIG. 8 is a flowchart showing a processing operation of a confidential data check centering on the communication unit 42 according to the embodiment.

FIG. 9 is a flowchart showing a processing operation for transferring a key centered on the line monitoring unit according to the embodiment;

[Explanation of symbols]

 10, 30 client system 11, 31 application unit 12, 32 communication unit 13 encryption / decryption unit 14, 34 line monitoring unit 15, 35 key unit 16, 17, 36, 37 cache file 20 , 40 ... server system 21, 41 ... application unit 22, 42 ... communication unit 23, 43 ... confidential data name list unit 24, 44 ... authentication unit 25, 45 ... key list unit 33 ... decryption unit 46 ... encryption unit

Claims (18)

[Claims] 1. A communication method used for data communication between a server system and a client system, comprising: a communication unit for performing data communication with a server application of the server system; The communication means determines whether or not the data obtained from the server application is encrypted, and processes the header information of the data so that the client application of the client system does not cache when it is determined that the data is encrypted. A communication data concealment control system, comprising: means for transferring data to the client application. 2. The server system, comprising: a communication unit that performs data communication with the server application in place of the client application; and the communication unit determines that data obtained from the server application is encrypted. 2. The communication data concealment control system according to claim 1, further comprising means for changing header information of the data so that the client application does not cache the data and transferring the data to the client application. 3. The client system according to claim 1, wherein the communication unit that performs data communication with the server application in place of the client application determines that data obtained from the server application is encrypted. 2. The communication data concealment method according to claim 1, further comprising means for caching the data in an encrypted state, processing header information of the data so that the client application does not cache the data, and transferring the processed data to the client application. Control system. 4. The server system according to claim 1, wherein the server system is a communication unit that performs data communication with the server application in place of the client application, and determines that data obtained from the server application is encrypted. 3. The communication data concealment control according to claim 2, further comprising means for caching the encrypted data, processing the header information of the data so that the client application does not cache the data, and transferring the processed data to the client application. system. 5. The client system according to claim 1, further comprising means for performing authentication of a request source, holding a list of keys corresponding to the request source, and distributing the key to the request source when authentication is correctly performed. In the communication means for performing data communication with the server application on behalf of the client application, an inquiry is made to the authentication means of the server system, the data is encrypted and cached using the delivered key, and the data is transferred to the client application. Means for performing, when a data transfer request is issued from the client application, determining whether or not the data is stored in the cache, and if the data is stored, decrypting the data using the key and Means for transferring to a client application; Monitors the state of the line connected to the claim 1 communication data encryption control system according composed and means for disabling the delivered key when the line is disconnected. 6. The client system has means for monitoring a state of a line connected to the server system and invalidating a delivered key after a lapse of a predetermined time even if the line is disconnected. 6. The communication data concealment control system according to claim 5, wherein: 7. The communication means of the server system has a function of preliminarily specifying confidentiality of specific data and a list of the specified data, and when the client application issues a request for acquiring the data, the server means 5. The method according to claim 2, further comprising a step of processing header information of the data obtained from the application and matching the confidential list of the data so that the client application does not cache the data, and transferring the processed data to the client application. The communication data concealment control system described in the above. 8. Both the client system and the server system are provided with communication means for performing data communication with the server application in place of the client application, and the application of the client system is provided with the application through the two communication means. Communication means for communicating with a server application, wherein the communication means of the server system obtains data from the server application when a request for obtaining the corresponding data is issued from the client application, and obtains data corresponding to a confidential list of data. For, the confidential designation is added to the header information and transferred to the communication means of the client system. The communication means of the client system determines that the data obtained from the communication means of the server system has the confidential designation. In this case, the client application changes the header information of the data so as not to be cached, transfers the data to the client application, obtains a key from the server system, and encrypts the data using the obtained key. 8. The communication data concealment control system according to claim 5, wherein the communication data concealment control system has a function of caching. 9. The communication means of the server system acquires data from the server application with respect to the data requested from the communication means of the client system, and corresponds to a case where the data matches a secret list of data. After encrypting the data in advance using the key of the client that has requested the data, the data is transferred to the client communication unit, and the client system transmits the encrypted data from the communication unit of the server system. Upon receipt, a key is obtained, the data is decrypted using the key, the data is transferred to the client application, and the data is stored in the cache in an encrypted state. The communication data concealment control system according to claim 8. 10. A communication method used for data communication between a server system and a client system, wherein the client system performs data communication with a server application of the server system in place of a client application of the client system. If it is determined in this communication that the data obtained from the server application has been encrypted, control is performed so that the header information of the data is processed so as not to be cached by the client application and transferred to the client application. A communication data concealment control method, comprising: 11. The server system, not the client system, performs data communication with the server application in place of the client application, and determines that data obtained from the server application is encrypted by this communication. 11. The communication data concealment control method according to claim 10, wherein, when it is performed, the header information of the data is changed so as not to be cached by the client application and the data is transferred to the client application. 12. The client system, wherein the client system performs data communication with the server application in place of the client application, when the data obtained from the server application is determined to be encrypted. 11. The cache according to claim 10, wherein the cache is cached in an encrypted state, the header information of the data is processed so as not to be cached by the client application, and the data is transferred to the client application. Communication data concealment control method. 13. The server system, when performing data communication with the server application on behalf of the client application, determines that data acquired from the server application is encrypted. 12. The communication data concealment control method according to claim 11, wherein the cache is cached as it is, and the header information of the data is processed so as not to be cached by the client application, and the data is transferred to the client application. 14. The server system performs authentication of a request source, holds a list of keys corresponding to the request source, and distributes the key to the request source when the authentication is correctly performed. When performing data communication with the server application on behalf of the client application, query the server system for authentication, encrypt and cache the data using the delivered key, and transfer it to the client application. When a data transfer request is issued from the client application, it is determined whether the corresponding data is stored in the cache. If the data is stored, the data is decrypted using the key. Is transferred to the client application and connected to the server system Monitors the state of the line, according to claim 10 communication data encryption control method according to, characterized in that so as to disable the delivered key when the line is disconnected. 15. The client system monitors a state of a line connected to the server system, and invalidates a delivered key after a certain period of time even if the line is disconnected. 15. The communication data concealment control method according to claim 14, wherein: 16. In the communication of the server system, the server system has a function of preliminarily specifying confidentiality of specific data and a list of the specified data, and when a request to acquire the corresponding data is issued from the client application. For data obtained from the server application and matching the confidential list of data, the header information of the data is processed so as not to be cached by the client application, and is controlled to be transferred to the client application. The communication data concealment control method according to claim 11 or 13. 17. Both the client system and the server system perform data communication with the server application on behalf of the client application, and the application of the client system communicates with the server application via the communication. In the communication of the server system, when a request for acquiring the corresponding data is issued from the client application, the data is acquired from the server application, and the data that matches the confidential list of the data is set in the header. The confidential information is added to the information and transferred to the communication of the client system. In the communication of the client system, it is determined that the confidential information is specified in the data obtained from the communication of the server system. If the client application is disconnected, it changes the header information of the data so that the client application does not cache it, transfers it to the client application, obtains a key from the server system, and encrypts the data using the obtained key. 15. A function of caching after performing a cache operation.
17. The communication data concealment control method according to 5 or 16. 18. In the communication of the server system,
For the data requested from the communication of the client system, obtain from the server application,
When the data matches the confidential list of the data, the corresponding data is encrypted in advance using the key of the requesting client and transferred to the client, and the client system communicates with the server system. 18. The method according to claim 17, further comprising obtaining a key when receiving the encrypted data, decrypting the data using the key, transferring the data to the client application, and storing the encrypted data in the cache. Communication data concealment control method.