JP4786622B2 - Storage device and storage medium control method - Google Patents

Description

The present invention, USB (Universal Serial Bus) memory or the like, a recording medium for storing data, a storage device and a storage medium control apparatus for controlling access to the recording medium (reading and writing of data).

  As a storage means for easily carrying data, a USB memory is widely used. There is a problem in that the stored contents of the USB memory can be referred to without discrimination by connecting the USB memory to a PC (Personal Computer) or the like. Therefore, when the USB memory is lost, there is a possibility that data stored in the USB memory may be leaked to a non-authorized person or leaked to an external network.

As one of countermeasures, Patent Document 1 discloses a recording medium control apparatus and a recording medium control method that can set permission / prohibition of writing and reading to / from a recording medium using a key.
JP 2005-115807 A

  However, when the technique of Patent Document 1 is used, physical access to the USB memory can be controlled using a key, but access to a file stored in the USB memory is controlled for each authorized person. I can't. Further, if the client PC is allowed to access the USB memory, it can be accessed from the external network as it is. Furthermore, in the conventional technology, since the setting of access authority to a file is often set at the time of login for each user ID, the authorized person grants part of his own access authority to others as necessary. Attempting to do so places a heavy burden on user management operations.

  The present invention has been made in view of the above problems, and a main object of the present invention is to flexibly and reliably control access from an information processing apparatus to a recording medium.

In order to solve the above-described problems, the present invention provides a storage device including a storage medium and a storage medium control device that controls access to the storage medium from an information processing device, and the storage medium control device includes: A storage unit for storing a key authority level management table indicating a correspondence relationship between key data possessed by a key and an authority level of access to the storage medium, and the storage medium control device are connected to the information processing device. , When acquiring the key data from the key, refer to the key authority level management table, specify the authority level corresponding to the acquired key data,
And a processing unit that prohibits or permits writing and reading of data to and from the storage medium by the information processing apparatus according to the authority level.

  According to this configuration, since access (data writing and reading) to the storage medium is controlled according to the authority level corresponding to the key data, access is not possible unless the key data is acquired from the key. Therefore, even if the storage medium control device and the USB memory composed of the storage medium are lost during transportation, the data in the storage medium will not be leaked or tampered with unless there is a key. In addition, an authorized person or user possessing a key allows the storage medium control device to read the key data to allow others to access the data in the storage medium only when necessary or to access the data on their own be able to.

The present invention is also a storage device , wherein the storage unit uses the authority level key for each combination of the authority level and a data level for classifying data stored in the storage medium. A data reference management table indicating whether or not the data can be referred to, and the processing unit refers to the data reference management table and identifies a data level that can be referred to by the authority level identified from the key data The data including the specified data level in the header is read from the storage medium and output to the information processing apparatus.

  According to this configuration, data that can be referred to by the authority level corresponding to the key is output to the information processing apparatus, and the information processing apparatus handles only the output data. Data cannot be accessed. Therefore, by using the key, security control for the data in the storage medium can be reliably performed.

Further, the present invention is a storage device , wherein the storage unit further stores a data update management table indicating a correspondence relationship between the authority level and a data level of data created or updated at the authority level, When the processing unit receives a data creation or update request from the information processing apparatus, the processing unit refers to the data update management table, identifies a data level corresponding to the authority level identified from the key data, The data including the specified data level in the header is created or updated and stored in the storage medium.

  According to this configuration, since the data level corresponding to the authority level of the key at that time is set in the header of the data stored in the storage medium, by using the same key, the same data level as when stored You can refer to level data (including data you created or updated).

Further, the present invention is a storage device , and when connected to the information processing device, the information processing device prohibits access to the storage medium when the information processing device is connected to a network. It is characterized by that.

  According to this configuration, since the information processing apparatus can access data in the storage medium only when the information processing apparatus is disconnected from the network, it is possible to prevent the data from flowing out to the network. it can. In other words, it can be limited to handle confidential information only in an environment isolated from the outside.

  The present invention includes a storage medium control method. In addition, the problems disclosed in the present application and the solutions thereof will be clarified by the column of the best mode for carrying out the invention and the drawings.

  According to the present invention, access from an information processing apparatus to a recording medium can be controlled flexibly and reliably.

  Hereinafter, the best mode for carrying out the present invention will be described with reference to the drawings. When a USB memory (storage medium control apparatus + storage medium) is connected to a computer (information processing apparatus) such as a PC when the storage medium control apparatus according to an embodiment of the present invention is connected to a network When the computer is not connected to the network, on the other hand, when the computer is not connected to the network, the individual files in the storage medium from the computer according to the authority level according to the key data acquired by the storage medium control device To control access to.

≪Configuration and overview of USB memory and its surroundings≫
FIG. 1 is a diagram showing the configuration of a USB memory and its periphery. The USB memory 1 includes a storage medium control device 2 and a storage medium 3 and is connected to a PC (information processing device) 4. The PC 4 can access the storage medium 3 via the storage medium control device 2. The PC 4 may be connected to the terminal 6 via the network 5. When the PC 4 and the terminal 6 are connected to the network, the storage medium control device 2 prohibits access from the PC 4 and the terminal 6 to the storage medium 3 of the USB memory 1. Note that the PC 4 is not necessarily a PC, and may be a PDA (Personal Digital Assistants), a server computer, or the like as long as the USB memory 1 is connected and the storage medium 3 is accessed. The network 5 is a network that communicates with other than the department (such as an external organization) that shares confidential information, such as the Internet. The terminal 6 is a node that can communicate with the PC 4 via the network 5 and is, for example, a PC, a mobile phone, a PDA, or the like.

  FIG. 2 is a diagram illustrating a configuration of the storage medium control apparatus. The storage medium control device 2 includes a key input unit 21, a PC communication unit 22, a medium input / output unit 23, a processing unit 24, and a storage unit 25. The key input unit 21 recognizes the shape of the inserted key or reads information (such as a user ID) stored in the touched key, and processes data (key data) such as shape and information. Pass to 24. Corresponding to the key being a physical key, a magnetic card, or an IC (Integrated Circuit) tag, for example, the key input unit 21 is realized by a keyhole and a cylinder lock with an image sensor, a magnetic sensor, or an IC tag reader, respectively. . The PC communication unit 22 has a data communication function with the PC 4 and includes a part connected to the USB terminal of the PC 4 and a part for controlling a serial interface. The medium input / output unit 23 has a file data input / output function with the storage medium 3, and includes a part connected to the storage medium 3, a part for controlling a serial interface, and the like.

  The processing unit 24 has a function of controlling the entire storage medium control device 2, and in particular, the READ received from the PC communication unit 22 according to the key data from the key input unit 21 and each table stored in the storage unit 25. And WRITE requests are checked, and access to the storage medium 3 via the medium input / output unit 23 is controlled. The processing unit 24 is realized by a CPU (Central Processing Unit) executing a program stored in a predetermined memory. The storage unit 25 stores data from the processing unit 24 and reads the stored data. The storage unit 25 is realized by a nonvolatile storage device such as a flash memory or a hard disk device.

<< Data structure >>
3 and 4 are diagrams showing a configuration of data stored in the storage unit of the storage medium control device. These data are tables necessary for the storage medium control device 2 to control access from the PC 4 to the storage medium 4 and are set in advance through the PC 4 or the like.

  FIG. 3 shows the configuration of the key authority level management table. The key authority level management table 25A includes key data 25A1 which is information stored in the key shape and key acquired from the key input unit 21, and authority level 25A2 relating to file access given to the key corresponding to the key data. Consists of records that contain According to FIG. 3, the key data 25A1 may include various data such as key shape and information, but these are classified into one of authority levels 25A2 of L1, L2 and L3. The authority level 25A2 is not limited to three.

  FIG. 4A shows the configuration of the file reference management table. In the file reference management table (data reference management table) 25B, L1, L2, and L3 which are authority levels 25B1 are set on the vertical axis, and F1, F2 which are file levels (data levels) 25B2 for classifying files on the horizontal axis, and F3 is a table indicating whether or not each file level 25B2 file can be referred to by each authority level 25B1 key. For example, if the authority level 25B1 is L1, all the file levels 25B2 can be referred to. If the authority level 25B1 is L3, only the file whose file level 25B2 is F3 can be referred to. According to FIG. 4A, L1, L2, and L3 of the authority level 25B1 are in descending order of access tolerance to the file. Further, F1, F2, and F3 of the file level 25B2 are in the order of the higher security level of the file.

  FIG. 4B is a diagram showing the configuration of the file update management table. The file update management table (data update management table) 25C includes an authority level 25C1 of a key currently associated with the key input unit 21, and a file level (data level) 25C2 of data newly created or updated at that time. Consists of records that contain According to FIG. 4B, the files whose authority level 25C1 is created or updated at L1, L2, and L3 are the file levels 25C2 of F1, F2, and F3, respectively.

≪Control device processing≫
FIG. 5 is a flowchart showing processing of the storage medium control device. When the user inserts the USB memory 1 into the USB terminal of the PC 4 (S501), the processing of the storage medium control device 2 is started. First, it is inquired whether the processing unit 24 is connected to the PC 4 via the PC communication unit 22 (S502). Then, the PC 4 answers the inquiry from the storage medium control device 2 (S503). The determination as to whether or not there is a network connection is made, for example, based on whether or not a LAN (Local Area Network) cable is connected and whether or not an IP (Internet Protocol) address is set. In the storage medium control device 2, the PC communication unit 22 receives the response from the PC 4 (S504), the processing unit 24 acquires the response, and determines whether the PC 4 is connected to the network (S505). If it is connected to the network (Y in S505), the process is terminated as it is. As a result, the processing unit 24 of the storage medium control device 2 does not respond to the request from the PC 4, so that the access from the PC 4 to the storage medium 3 cannot be performed, that is, the access is prohibited.

  If the PC 4 is not connected to the network (N in S505), the key input unit 21 reads the key data from the key inserted or touched by itself (S506). Specifically, the key shape is recognized or information stored in the key is read out. Then, the processing unit 24 acquires key data that is the key shape and information from the key input unit 21, and specifies the authority level from the key data (S507). Specifically, the authority level 25A2 corresponding to the key data 25A1 is specified with reference to the key authority level management table 25A stored in the storage unit 25. According to this, an authorized person or a user can grant an access authority to the storage medium 3 only when necessary by inserting or contacting a key into the key input unit 21 of the storage medium control device 2. it can. Further, the authority level once specified by the key is effectively held until the USB memory 1 is removed from the PC 4.

  Subsequently, the processing unit 24 specifies a file that can be referred to at that time from the specified authority level (S508). Specifically, first, the file reference management table 25B stored in the storage unit 25 is referred to, and the file level 25B2 that can be referred to from the authority level 25B1 is specified. According to FIG. 4A, for example, if the authority level 25B1 is L2, the referable file levels 25B2 are F2 and F3. Then, the storage medium 3 is referred to via the medium input / output unit 23, and the file written as F2 or F3 in the header is specified. Then, the identified file is read and transmitted to the PC 4 via the PC communication unit 22 (S509). According to this, since the authority level differs depending on the key shape and information, the files that can be referred to also differ.

  On the other hand, the PC 4 receives the file from the storage medium control device 2 and displays it on the display (S510). As a result, the user can browse the file that is determined to be referable by the key. Further, the PC 4 may instruct the storage medium control device 2 to create a new file or update the file displayed on the display in accordance with a user instruction (S511).

  In this case, in the storage medium control device 2, the processing unit 24 creates or updates a file according to the authority level at that time (S512). Specifically, the file update management table 25C stored in the storage unit 25 is referred to, the file level 25C2 is specified from the authority level 25C1 at that time, and a file including the file level 25C2 as a reference authority index in the header is created. Or update. Thereafter, when the authorized person or the user removes the USB memory 1 from the PC 4 (S513), the storage medium control device 2 ends the series of processes and does not respond to all access requests from the PC 4, that is, to the storage medium 3. Access is prohibited.

  From the viewpoint of the user who possesses the USB memory 1 and the key, the processing centering on the storage medium control device 2 can be described as follows. First, the user inserts the USB memory 1 into the PC 4 (S501). It is not possible to refer to the data in the USB memory 1 just by inserting it. Therefore, first, it is confirmed that the PC 4 is not connected to the network (related to S503). Next, the key is inserted or brought into contact with one place of the USB memory 1 (related to S506). By this operation, a screen of a list of file names that can be referred to in the storage medium 3 is displayed on the display of the PC 4 (related to S510). When the user selects and clicks the file name displayed on the display, the contents of the file are displayed (related to S510), and when a part thereof is changed (related to S511), the contents in the storage medium 3 are displayed. The file is updated (related to S512).

  Although the embodiment of the present invention has been described above, in order to make each unit in the storage medium control device 2 shown in FIG. 2 function, a program executed by the processing unit 24 is recorded on a computer-readable recording medium, It is assumed that the storage medium control apparatus according to the embodiment of the present invention is realized by causing the computer to read and execute the recorded program. Note that the program may be provided to the computer via a network such as the Internet, or a semiconductor chip or the like in which the program is written may be incorporated in the computer.

  According to the embodiment of the present invention described above, access (file writing and reading) to the storage medium 3 is controlled in accordance with the authority level corresponding to the key data, so that access is not possible unless the key data is acquired from the key. . Therefore, even if the USB memory 1 composed of the storage medium control device 2 and the storage medium 3 is lost during transportation, files in the storage medium 3 will not be leaked or tampered unless there is a key. In addition, an authorized person or a user possessing a key allows the storage medium control device 2 to read the key data, thereby permitting others to access the files in the storage medium 3 only when necessary, or accessing the files on their own. Can be.

  Next, a file that can be referred to according to the authority level corresponding to the key is output to the PC 4, and only the output data is handled in the PC 4, so that the file exceeding the authority level of the key cannot be accessed from the PC 4. Therefore, the security control for the file in the storage medium 3 can be surely performed by using the key.

  Then, since the data level corresponding to the authority level of the key at that time is set in the header of the file stored in the storage medium 3, by using the same key, data at the same level as the data level at the time of storage is stored. (Including self-created or updated data).

  Furthermore, since the PC 4 can access the file in the storage medium 3 only when the PC 4 is disconnected from the network 5, it is possible to prevent the file from flowing out to the network 5. In other words, it can be limited to handle confidential information only in an environment isolated from the outside.

<< Other embodiments >>
Although the best mode for carrying out the present invention has been described above, the above embodiment is intended to facilitate understanding of the present invention and is not intended to limit the present invention. The present invention can be changed and improved without departing from the gist thereof, and equivalents thereof are also included in the present invention. For example, the following embodiments can be considered.

(1) In the above embodiment, it is described that one authorized person or user is permitted to access data in one USB memory 1 using one key, or to access the data by oneself. However, a plurality of authorized persons or users may handle the data in one USB memory 1 using each key. In this case, the data handled by the authorized person or user may be the same or different. That is, a plurality of users having various authorities (keys) may share one USB memory 1.

(2) In the above-described embodiment, the USB memory 1 is exemplified as including the storage medium control device 2 and the storage medium 3, but the present invention may be applied to a hard disk device (HDD: Hard Disk Drive) or an external HDD. Furthermore, any other device can be applied as long as the storage medium control device 2 and the storage medium 3 are integrated.

(3) As an application example of the present embodiment, it may be applied to maintenance management and operation management of a nuclear power plant. For example, each file including maintenance information and operation information is classified into three file levels corresponding to the authority level: “Read / write”, “Read but not write”, and “Read / write impossible”. Specifically, authority levels L1, L2, and L3 are set on the vertical axis, and file levels F1, F2, and F3 are set on the horizontal axis, and whether or not each file level 25B2 can be read and written by each authority level. The reference and update of each file are controlled using a table indicating the above (the above three classifications). In the header of the newly created or updated file, the authority level and the file level specified by the “Read / Write” column are set. According to this, since it is possible to set a file level that can be read but cannot be written, more flexible access control can be realized. Note that this example may be applied to other than maintenance management and operation management of nuclear power plants.

It is a figure which shows the structure of a USB memory and its periphery. It is a figure which shows the structure of a storage medium control apparatus. It is a figure which shows the structure of a key authority level management table. It is a figure which shows the structure of the data memorize | stored in the memory | storage part of a storage medium control apparatus, (a) shows the structure of a file reference management table, (b) shows the structure of a file update management table. It is a flowchart which shows the process of a storage medium control apparatus.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 USB memory 2 Storage medium control apparatus 24 Processing part 25 Storage part 25A Key authority level management table 25A1 Key data 25A2 Authority level 25B File reference management table (data reference management table)
25B1 Authority level 25B2 File level (data level)
25C File update management table (data update management table)
25C1 authority level 25C2 file level (data level)
3 Storage medium 4 PC (information processing device)
5 Network 6 Terminal

Claims (8)

A storage device comprising a storage medium and a storage medium control device that controls access to the storage medium from an information processing device,
The storage medium controller is
A storage unit for storing a key authority level management table indicating a correspondence relationship between key data of a key and an authority level of access to the storage medium;
When the storage medium control device is connected to the information processing device and acquires the key data from the key,
Refer to the key authority level management table, specify the authority level corresponding to the acquired key data,
A processing unit that prohibits or permits writing and reading of data in the storage medium by the information processing device according to the authority level;
A storage device comprising: The storage device according to claim 1,
The storage unit
For each combination of the authority level and a data level for classifying data stored in the storage medium, a data reference management table indicating whether or not the data of the data level can be referred to by the key of the authority level is further stored And
The processor is
The data reference management table is referred to, a data level that can be referred to by the authority level specified from the key data is specified, data including the specified data level in a header is read from the storage medium, and the information processing apparatus A storage device characterized by output. The storage device according to claim 2,
The storage unit
Further storing a data update management table indicating a correspondence relationship between the authority level and a data level of data created or updated at the authority level;
The processor is
When a data creation or update request is received from the information processing apparatus, the data update management table is referred to, a data level corresponding to the authority level identified from the key data is identified, and the identified data level It was created or updated data including the header, storage device, characterized in that to be stored in the storage medium. The storage device according to any one of claims 1 to 3,
When connected to the information processing apparatus,
When the information processing apparatus is connected to a network,
Storage device and inhibits access to the storage medium from the information processing apparatus. A storage medium control method for controlling access to a storage medium of a storage apparatus comprising a storage medium control apparatus and a storage medium from an information processing apparatus,
Storing the key authority level management table indicating the correspondence relationship between the key data held by the key of the storage medium control device and the authority level of access to the storage medium in a storage unit included in the storage medium control device ;
When connected to the information processing apparatus and obtaining the key data from the key,
Referring to the key authority level management table and identifying the authority level from the acquired key data;
Prohibiting or permitting writing and reading of data in the storage medium by the information processing device according to the authority level;
The storage medium control method characterized by performing. The storage medium control method according to claim 5,
The storage medium controller is
For each combination of the authority level and the data level for classifying data stored in the storage medium, the data reference management table indicating whether or not the data at the data level can be referred to by the key of the authority level Further storing in the department;
The data reference management table is referred to, a data level that can be referred to by the authority level specified from the key data is specified, data including the specified data level in a header is read from the storage medium, and the information processing apparatus Output step;
A storage medium control method, further comprising: The storage medium control method according to claim 6,
The storage medium controller is
Further storing in the storage unit a data update management table indicating a correspondence relationship between the authority level and a data level of data created or updated at the authority level;
When a data creation or update request is received from the information processing apparatus, the data update management table is referred to, a data level corresponding to the authority level identified from the key data is identified, and the identified data level Creating or updating data including the header in the storage medium, and
A storage medium control method, further comprising: A storage medium control method according to any one of claims 5 to 7,
The storage medium controller is
When connected to the information processing apparatus,
When the information processing apparatus is connected to a network,
A method for controlling a storage medium, further comprising: prohibiting access from the information processing apparatus to the storage medium.

Images