JP4858217B2 - Policy determination system and method via portable media - Google Patents

Description

  The present invention relates to the field of policy determination via (used) portable media.

TNC (Trusted Network Connect) transfers collected personal computer information via a network to a server (which has a point to determine the operation policy; PDP = Policy Decision Point). There is a conventional technique for notifying a designated policy to a point (hereinafter referred to as PEP = Policy Enforcement Point) for implementing the policy via a network.
JP 2004-166241 A

  The TNC assumes that the PDP and the PEP are connected via a network when the PDP and the PEP are physically separated. Based on this assumption, consider the case where a personal computer is used at another base or outside the company. Here, other bases and outside companies mean points different from the place where the department that manages this policy (hereinafter, the management department) is installed. To prevent theft, limit the period of use of a PC at another base or outside the company. For example, if you use the PC for a week, you want to take it back to the management department, check the status of the PC, and give permission to take it out. And At this time, it is troublesome to carry a personal computer from another base or outside, and it is dangerous to carry extra data (information in the personal computer).

  SUMMARY OF THE INVENTION Accordingly, an object of the present invention is to realize a TNC policy determination mechanism using a portable medium and to ensure safety.

A first invention of the present application is a policy determination system via a portable medium including a client having a policy execution unit, a server having a policy determination unit, and a portable medium having a controller unit and a storage unit.
When portable media is connected to the client,
The controller unit stores the client state storage time representing the time when the client state representing the client state is stored in the storage unit in the storage unit,
When portable media is connected to the server,
The controller unit calculates an elapsed time representing a difference between the current time and the client state storage time,
When the elapsed time exceeds the specified value, the policy decision unit determines that the portable medium cannot be used, determines the policy from the client state,
The controller unit stores the policy in the storage unit, stores the policy storage time indicating the time when the policy is stored in the storage unit in the storage unit, erases the client state from the storage unit,
When portable media is reconnected to the client,
The controller unit calculates an elapsed time 2 representing the difference between the current time and the policy storage time,
When the elapsed time 2 exceeds the predetermined value, the policy execution unit determines that the portable medium cannot be used. When the elapsed time 2 does not exceed the predetermined value, the policy execution unit performs processing according to the policy.
It is characterized by that.

When the portable medium is connected to the server,
The controller unit generates a key 2 from the key 1 and the client state that the policy determination unit has,
When portable media is reconnected to the client,
The policy execution unit restores the key 1 from the client state to the key 2.

A third invention of the present application is a policy determination system via a portable medium comprising a client having a policy execution unit, a server having a policy determination unit, and a portable medium having a controller unit and a storage unit.
When portable media is connected to the server,
The controller unit stores the policy determination module, the key 3 and the key provision condition in the storage unit, and stores in the storage unit a policy determination module storage time representing the time when the policy determination module is stored in the storage unit.
When a portable medium is connected to the client,
The controller unit calculates an elapsed time 3 that represents the difference between the current time and the policy determination module storage time. If the elapsed time 3 exceeds a predetermined value, the controller unit determines that the portable medium cannot be used, and determines the predetermined value. If the client status that represents the client status matches the key provision conditions, the policy decision module is passed to the client.
The client activates the policy decision module as a policy decision unit,
The policy decision unit calculates the policy from the client state read from the storage unit to obtain the policy result,
The policy execution unit performs processing according to the policy.

When the portable medium is connected to the server,
The controller unit stores a random value in a storage unit, generates a key 4 from the random value and the key 3,
When a portable medium is connected to the client,
When the elapsed time 3 does not exceed the predetermined value and the client state matches the key provision condition, the controller unit decrypts the key 4 from the random value to obtain the key 3, and passes the random value to the client , Pass the policy decision module encrypted with random values to the client,
The client decrypts the encrypted policy determination module from the random value, starts the decrypted policy determination module as the policy determination unit,
The controller unit delivers the key 3 to the policy execution unit.

  The fifth invention of the present application is characterized in that the key providing condition is an OS version and / or a firewall setting.

  The sixth invention of the present application is characterized in that the client state is an OS version and / or presence / absence of a firewall setting.

  Since the client state and the client state storage time used for encryption are known only by the policy determination unit of the client or server, the risk when the portable medium (USB memory) is lost can be reduced. In addition, the latest PDP can be similarly applied to a personal computer in an environment without a network connection, and the risk when the USB memory is lost can be reduced.

  In addition, when a predetermined time elapses, use of the portable medium can be made impossible, and safety can be improved.

  FIG. 1 is a configuration diagram of an embodiment of the present invention. The present invention includes a client 1, a server 2, and a portable medium 3. The client 1 includes a state collection unit 11, a policy execution unit 12, a portable medium interface 13, and a policy determination unit 19. The server 2 includes a policy determination unit 21 and a portable medium interface 22. The portable medium 3 includes a controller 31, a controller table 32, and a clock 33, and is a portable storage medium such as a USB memory.

  The state collection unit 11 is a processing unit that collects a client state (FIG. 6) representing a state of a client such as a personal computer from files or software in the personal computer and stores it in the portable medium 3.

  The policy execution unit 12 permits use of a portable medium, permits connection to a network (not shown) connected to the client 1, restores a key Erv (K) described later, obtains a key K, A processing unit for obtaining the key PRIk. The key K is a key used when encrypting content in the client 1.

  The portable medium interface 13 is a processing unit that connects the client 1 and the portable medium 3.

  The policy deciding unit 21 and the policy deciding unit 19 are processing units that calculate a policy based on permission to use a portable medium and a client state, and internally store a key K related to content encryption. The policy means, for example, permission / denial of connection with the network, and may include other matters. The policy determination unit 21 originally exists in the server 2, whereas the policy determination unit 19 starts when the policy determination module that is the substance of the policy determination unit 21 is passed to the client 1 via the portable medium 3. It is different in that it is a processed processing unit.

  The portable medium interface 23 is a processing unit that connects the server 2 and the portable medium 3.

  The controller 31 is composed of controller processing units 311 to 315, and is a processing unit that exchanges data with the client 1 and the server 2 and reads / writes data to / from the control table 32. Details will be described later.

  The controller table 32 (FIG. 7) is a storage unit that stores client status, client time storage time, return value, policy, policy storage time, key Erv (K), and the like. The controller table 32 may be in a memory unit (not shown) of a portable medium that stores data used by the application of the client 1 and the OS.

  The clock 33 is a clock that measures the current time.

  In the client state (FIG. 6), whether the OS of the client 1 is the latest version or whether a personal firewall is set in the client 1 is raised.

  Embodiments of the present invention will be described below with reference to the flowcharts of FIGS.

  First, as an overall flow, the user connects the portable medium 3 to the client 1 outside the company, and obtains the client state and the like in the portable medium 3 (FIG. 2). Next, the user connects the portable medium 3 to a server in the management department of the company, and obtains a policy or the like on the portable medium 3 (FIG. 3). Next, the user can use the client 1 in accordance with the policy after connecting the portable medium 3 to the client 1 outside the company and performing policy authentication (FIG. 4). This will be described in detail below.

  When the user connects the portable medium 3 to the client 1 (FIG. 2), the status collection unit 11 of the client 1 obtains the client status by collecting it from files and software in the personal computer, stores it in the client 1, and allows it. Transfer to the carrying medium 3 (S1).

  The controller processing unit 311 of the portable medium 3 stores the client state in the controller table 32 (S2) (FIG. 7). The index to be stored in the controller table 32 is arbitrarily selected by the user or stored in a new index.

  The controller processing unit 311 acquires the current time from the clock 33, and stores the time in the controller table 32 as the client state storage time (S3).

  The controller processing unit 311 calculates a return value based on the client state storage time (the calculation method may be arbitrary, but the client state storage time may be used as it is) and passes the return value to the client 1. And stored in the controller table 32 (S4).

The state collection unit 11 stores the passed return value in the client 1 (S5).
Next, when the user connects the portable medium 3 to the server 2 (FIG. 3), the policy determination unit 21 of the server 2 requests the portable medium 3 to acquire the client state (S6).

  The controller processing unit 312 of the portable medium 3 acquires the current time from the clock 33, reads the client state, the client state storage time, and the index from the controller table 32, and calculates the difference between the current time and the client state storage time. A certain elapsed time is calculated, and the elapsed time, client state, and index are passed to the server 2 (S7).

  If the elapsed time of the client state storage time exceeds a predetermined value, the policy determination unit 21 determines that the portable medium 3 cannot be used. If the elapsed time of the client state storage time does not exceed the predetermined value, the policy determination unit 21 The use is determined to be permitted, and the result is passed to the controller processing unit 312 together with the index (S8).

  The controller processing unit 312 stores the passed result of permission to use the portable medium in the corresponding index of the controller table 32 (S9).

  The policy determination unit 21 calculates a policy for each index based on the passed client state (details will be described later), and passes the determined policy, the key K and the index related to the content encryption to the controller processing unit 312 (S10). ).

  Policy calculation will be described (FIG. 5). If the client state “OS is the latest version” is No, the policy determining unit 21 determines that the connection is not permitted as a policy (S31, No), and proceeds to the next step if Yes (S31, yes). ). If “whether personal firewall is set” in the client state is No, it is determined that the connection is not permitted as a policy (S32, No), and if Yes, the connection is permitted (S32, Yes). The connection permission refers to connection permission from the outside client 1 to the internal network.

  The controller processing unit 312 generates a key RV from the return value obtained in S4 and the client state. For example, if the return value is 0x10a739bc, the client state "is the latest version of OS" Yes is 0x1, and "is the personal firewall set?" Yes is 0x2, the sum of the client states is the logical sum of these To 0x00000003.

The key RV is generated by the following formula.
Key RV = (Return value of client status) xor (Total of client status)
Then, the passed key K is encrypted using this key RV using an existing technique, a key Erv (K) is generated, and stored in the corresponding index of the controller table 32 (S11).

  If there is a problem with the strength of the key RV in the client state alone, a dummy result can be entered. For example, if a result such as 0x923ab3c0 is entered as dummy information, the above-described inference of the key RV becomes difficult.

  The method for generating the key Erv (K) may be any other method as long as the client state is used.

  The controller processing unit 312 acquires the current time from the clock 33, and stores the time as the policy storage time together with the policy in the corresponding index of the controller table 32 (S12) (FIG. 8).

  The controller processing unit 312 deletes the client state of the corresponding index (S13). As a result, the client state, which is a seed for generating the key Erv (K), is deleted, and the client 1 returns to the client 1 to generate the key Erv (K). It must be collected.

  Next, when the user connects the portable medium 3 to the client 1 (FIG. 4), the policy execution unit 12 of the client 1 sends a return value and requests a policy (S14).

  The controller processing unit 313 identifies an index from the returned return value, acquires the current time from the clock 33, compares it with the policy storage time stored in the controller table 32, and compares the current time with the client state storage time. The elapsed time, which is the difference between the two, is calculated and passed to the policy execution unit 12. Further, the key Erv (K) and the policy stored in the controller table 32 are passed to the policy execution unit 12 (S15).

  If the passed elapsed time exceeds a predetermined value, the policy execution unit 12 determines that the portable medium 3 cannot be used. If the elapsed time does not exceed the predetermined value, the next step is continued (S16).

  The policy execution unit 12 generates a key RV from the client state obtained in S1 and the return value obtained in S5 with the same logic as in S9, and uses the existing technology based on this key RV to pass the key Erv (K ) And the key K is obtained (S17). The user can encrypt the content using this key K.

  The policy execution unit 12 performs processing according to the policy. That is, if the policy is permission to connect to the internal network, the client 1 is permitted to connect to the internal network (S18).

  Next, an embodiment in which a policy determination module (a load module that is the substance of the policy determination unit 21) is also stored in a portable medium will be described.

  First, as an overall flow, the user connects the portable medium 3 to a server in the management department of the company, and obtains a policy determination module or the like in the portable medium 3 (FIG. 9). Next, the user can use this client after connecting the portable medium 3 to the client 1 outside the company and performing policy authentication (FIGS. 10 and 11). This will be described in detail below.

  When the user connects the portable medium 3 to the server 2 (FIG. 9), the policy determination unit 21 passes the policy determination module, the secret key PRIk, and the key provision condition (FIG. 12) to the controller processing unit 314 of the portable medium 3. (S51).

  The controller processing unit 314 stores the policy determination module and the key provision condition in the controller table 32 (S52).

  The controller processing unit 314 acquires the current time from the clock 33 and stores the time in the controller table 32 as the policy determination module storage time (S53).

  The controller processing unit 314 calculates an arbitrary random value RV (S54), encrypts the secret key PRIk with the random value RV using an existing technique, generates a key Erv (PRIk), and generates a key Erv ( PRIk) and the random value RV are stored in the controller table 32 (S55).

  When the user connects the portable medium 3 to the client 1 (FIG. 10), the status collection unit 11 of the client 1 collects from files and software in the personal computer to obtain the client status, and the controller processing unit of the portable medium 3 It is passed to 315 (S56).

  The controller processing unit 315 stores the passed client state in the controller table 32 (S57).

  The controller processing unit 315 obtains the current time from the clock 33 and compares the policy determination module storage time stored in the controller table 32 with the elapsed time that is the difference between the current time and the policy determination module storage time. If it exceeds the predetermined value, it is determined that the portable medium 3 cannot be used. If the elapsed time does not exceed the predetermined value, the next step is continued (S58).

  The controller processing unit 315 determines whether or not the client status matches the key provision condition. If the client status does not match, the controller processing unit 315 cancels the subsequent processing, and if the client status matches, determines that the key may be provided to the client 1, The process proceeds to step S59.

  The controller processing unit 315 obtains the secret key PRIk by decrypting the key Erv (PRIk) with the random value RV using the existing technology, and sends the random value RV to the client 1 (S60).

  The state collection unit 11 requests loading of the policy determination module. At that time, the request is made together with the random value RV (S61).

  When the random value RV matches, the controller processing unit 315 encrypts the policy determination module with the random value RV using the existing technology and passes it to the client 1 (S62).

  The state collection unit 11 decrypts the policy determination module encrypted with the random value RV using the existing technology (S63), and executes the decrypted policy determination module. That is, the policy determination module is activated as the policy execution unit 19 (S64).

  The policy determination unit 19 reads the client state and random value stored in the controller table 32, calculates a policy based on the client state, and passes the policy and random value RV to the policy execution unit 12 (S65) (FIG. 11).

  The policy execution unit 12 performs processing according to the policy. That is, if the passed policy is permission to connect to the internal network, the client 1 is permitted to connect to the internal network (S66).

  The policy execution unit 12 requests acquisition of the secret key PRIk. At that time, the request is made together with the random value RV (S67).

  If the random values RV match, the controller processing unit 315 passes the secret key PRIk to the policy execution unit 12 (S68).

(Additional remark 1) In the policy determination system via the portable medium which consists of the client which has a policy execution part, the server which has a policy determination part, and the portable medium which has a controller part and a memory | storage part,
When the portable medium is connected to the client,
The controller unit stores in the storage unit a client state storage time representing a time when the client state representing the client state is stored in the storage unit;
When the portable medium is connected to the server,
The controller unit calculates an elapsed time representing a difference between a current time and the client state storage time;
If the elapsed time exceeds a predetermined value, the policy determination unit determines that the portable medium cannot be used, determines a policy from the client state,
The controller unit stores the policy in the storage unit, stores in the storage unit a policy storage time indicating a time when the policy is stored in the storage unit, and erases the client state from the storage unit;
When the portable medium is reconnected to the client,
The controller unit calculates an elapsed time 2 representing a difference between a current time and the policy storage time;
When the elapsed time 2 exceeds a predetermined value, the policy execution unit determines that the portable medium cannot be used, and when the elapsed time 2 does not exceed the predetermined value, processing according to the policy do,
A policy decision system via a portable medium.
(Appendix 2) When the portable medium is connected to the server,
The controller unit generates a key 2 from the key 1 and the client state that the policy determination unit has,
When the portable medium is reconnected to the client,
The policy execution unit restores the key 1 from the client state to the key 2;
The policy decision system via the portable medium according to Supplementary Note 1, wherein
(Additional remark 3) In the policy determination system via the portable medium which consists of the client which has a policy execution part, the server which has a policy determination part, and the portable medium which has a controller part and a memory | storage part,
When the portable medium is connected to the server,
The controller unit stores the policy determination module, the key 3 and the key provision condition in the storage unit, and stores in the storage unit a policy determination module storage time representing the time when the policy determination module is stored in the storage unit,
When the portable medium is connected to the client,
The controller unit calculates an elapsed time 3 representing a difference between the current time and the policy determination module storage time, and determines that the portable medium cannot be used when the elapsed time 3 exceeds a predetermined value. If the predetermined value is not exceeded, and the client status representing the client status matches the key provision condition, the policy determination module is passed to the client,
The client activates the policy determination module as the policy determination unit,
The policy determination unit calculates a policy from the client state read from the storage unit to obtain a policy result,
The policy execution unit performs processing according to the policy;
A policy decision system via a portable medium.
(Appendix 4) When the portable medium is connected to the server,
The controller unit stores a random value in the storage unit, generates a key 4 from the random value and the key 3,
When the portable medium is connected to the client,
The controller unit obtains the key 3 by decrypting the key 4 from the random value when the elapsed time 3 does not exceed a predetermined value and the client state matches the key providing condition, Passing the random value to the client, passing the policy decision module encrypted with the random value to the client,
The client decrypts the encrypted policy determination module from the random value, activates the decrypted policy determination module as a policy determination unit,
The controller unit passes the key 3 to the policy execution unit.
The policy decision system via the portable medium according to Supplementary Note 3, wherein
(Supplementary Note 5) The policy determination system via a portable medium according to Supplementary Note 3 or 4, wherein the key providing condition is an OS version and / or a firewall setting.
(Supplementary note 6) The policy determination system via a portable medium according to supplementary notes 1 to 5, wherein the client state is an OS version and / or presence / absence of a firewall setting.
(Supplementary Note 7) Through a portable medium in a policy determination system via a portable medium including a client having a policy execution unit, a server having a policy determination unit, and a portable medium having a controller unit and a storage unit In the policy decision method
When the portable medium is connected to the client,
The controller unit stores in the storage unit a client state storage time representing a time when the client state representing the client state is stored in the storage unit;
When the portable medium is connected to the server,
The controller unit calculates an elapsed time representing a difference between a current time and the client state storage time;
If the elapsed time exceeds a predetermined value, the policy determination unit determines that the portable medium cannot be used, determines a policy from the client state,
The controller unit stores the policy in the storage unit, stores in the storage unit a policy storage time indicating a time when the policy is stored in the storage unit, and erases the client state from the storage unit;
When the portable medium is reconnected to the client,
The controller unit calculates an elapsed time 2 representing a difference between a current time and the policy storage time;
When the elapsed time 2 exceeds a predetermined value, the policy execution unit determines that the portable medium cannot be used, and when the elapsed time 2 does not exceed the predetermined value, processing according to the policy do,
A method for determining a policy via a portable medium.
(Appendix 8) When the portable medium is connected to the server,
The controller unit generates a key 2 from the key 1 and the client state that the policy determination unit has,
When the portable medium is reconnected to the client,
The policy execution unit restores the key 1 from the client state to the key 2;
The method for determining a policy via a portable medium according to appendix 7, wherein:
(Supplementary Note 9) Through a portable medium in a policy determination system via a portable medium including a client having a policy execution unit, a server having a policy determination unit, and a portable medium having a controller unit and a storage unit In the policy decision method
When the portable medium is connected to the server,
The controller unit stores the policy determination module, the key 3 and the key provision condition in the storage unit, and stores in the storage unit a policy determination module storage time representing the time when the policy determination module is stored in the storage unit,
When the portable medium is connected to the client,
The controller unit calculates an elapsed time 3 representing a difference between the current time and the policy determination module storage time, and determines that the portable medium cannot be used when the elapsed time 3 exceeds a predetermined value. If the predetermined value is not exceeded, and the client status representing the client status matches the key provision condition, the policy determination module is passed to the client,
The client activates the policy determination module as the policy determination unit,
The policy determination unit calculates a policy from the client state read from the storage unit to obtain a policy result,
The policy execution unit performs processing according to the policy;
A method for determining a policy via a portable medium.
(Supplementary Note 10) When the portable medium is connected to the server,
The controller unit stores a random value in the storage unit, generates a key 4 from the random value and the key 3,
When the portable medium is connected to the client,
The controller unit obtains the key 3 by decrypting the key 4 from the random value when the elapsed time 3 does not exceed a predetermined value and the client state matches the key providing condition, Passing the random value to the client, passing the policy decision module encrypted with the random value to the client,
The client decrypts the encrypted policy determination module from the random value, activates the decrypted policy determination module as a policy determination unit,
The controller unit passes the key 3 to the policy execution unit.
The method for determining a policy via a portable medium according to appendix 9, wherein
(Supplementary note 11) The policy determination method via a portable medium according to Supplementary note 9 or 10, wherein the key providing condition is OS version and / or presence / absence of firewall setting.
(Supplementary note 12) The policy determination method via a portable medium according to any one of Supplementary notes 7 to 11, wherein the client state is an OS version and / or presence / absence of a firewall setting.

Configuration diagram of the present invention Example 1 flow (part 1) Example 1 flow (2) Example 3 flow (Part 3) Policy calculation flow Client state Controller table (acquired client status) Controller table (after saving the policy) Example 2 Flow (Part 1) Example 2 flow (2) Example 2 Flow (Part 3) Key provision conditions

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Client 2 Server 3 Portable medium 11 Status collection part 12 Policy execution part 13 Portable medium interface 21 Policy determination part 22 Portable medium interface 31 Controller 32 Controller table 33 Clock

Claims (6)

In a policy determination system via a portable medium comprising a client having a policy execution unit, a server having a policy determination unit, a portable medium having a controller unit and a storage unit,
When the portable medium is connected to the client,
The controller unit stores in the storage unit a client state storage time representing a time when the client state representing the client state is stored in the storage unit;
When the portable medium is connected to the server,
The controller unit calculates an elapsed time representing a difference between a current time and the client state storage time;
If the elapsed time exceeds a predetermined value, the policy determination unit determines that the portable medium cannot be used, determines a policy from the client state,
The controller unit stores the policy in the storage unit, stores in the storage unit a policy storage time indicating a time when the policy is stored in the storage unit, and erases the client state from the storage unit;
When the portable medium is reconnected to the client,
The controller unit calculates an elapsed time 2 representing a difference between a current time and the policy storage time;
When the elapsed time 2 exceeds a predetermined value, the policy execution unit determines that the portable medium cannot be used, and when the elapsed time 2 does not exceed the predetermined value, processing according to the policy do,
A policy decision system via a portable medium. When the portable medium is connected to the server,
The controller unit generates a key 2 from the key 1 and the client state that the policy determination unit has,
When the portable medium is reconnected to the client,
The policy execution unit restores the key 1 from the client state to the key 2;
The policy decision system via a portable medium according to claim 1. In a policy determination system via a portable medium comprising a client having a policy execution unit, a server having a policy determination unit, a portable medium having a controller unit and a storage unit,
When the portable medium is connected to the server,
The controller unit stores the policy determination module, the key 3 and the key provision condition in the storage unit, and stores in the storage unit a policy determination module storage time representing the time when the policy determination module is stored in the storage unit,
When the portable medium is connected to the client,
The controller unit calculates an elapsed time 3 representing a difference between the current time and the policy determination module storage time, and determines that the portable medium cannot be used when the elapsed time 3 exceeds a predetermined value. If the predetermined value is not exceeded, and the client status representing the client status matches the key provision condition, the policy determination module is passed to the client,
The client activates the policy determination module as the policy determination unit,
The policy determination unit calculates a policy from the client state read from the storage unit to obtain a policy result,
The policy execution unit performs processing according to the policy;
A policy decision system via a portable medium. When the portable medium is connected to the server,
The controller unit stores a random value in the storage unit, generates a key 4 from the random value and the key 3,
When the portable medium is connected to the client,
The controller unit obtains the key 3 by decrypting the key 4 from the random value when the elapsed time 3 does not exceed a predetermined value and the client state matches the key providing condition, Passing the random value to the client, passing the policy decision module encrypted with the random value to the client,
The client decrypts the encrypted policy determination module from the random value, activates the decrypted policy determination module as a policy determination unit,
The controller unit passes the key 3 to the policy execution unit.
The policy determination system via a portable medium according to claim 3. Policy decision method via portable medium in policy decision system via portable medium comprising client having policy execution unit, server having policy decision unit, portable medium having controller unit and storage unit In
When the portable medium is connected to the client,
The controller unit stores in the storage unit a client state storage time representing a time when the client state representing the client state is stored in the storage unit;
When the portable medium is connected to the server,
The controller unit calculates an elapsed time representing a difference between a current time and the client state storage time;
If the elapsed time exceeds a predetermined value, the policy determination unit determines that the portable medium cannot be used, determines a policy from the client state,
The controller unit stores the policy in the storage unit, stores in the storage unit a policy storage time indicating a time when the policy is stored in the storage unit, and erases the client state from the storage unit;
When the portable medium is reconnected to the client,
The controller unit calculates an elapsed time 2 representing a difference between a current time and the policy storage time;
When the elapsed time 2 exceeds a predetermined value, the policy execution unit determines that the portable medium cannot be used, and when the elapsed time 2 does not exceed the predetermined value, processing according to the policy do,
A method for determining a policy via a portable medium. Policy decision method via portable medium in policy decision system via portable medium comprising client having policy execution unit, server having policy decision unit, portable medium having controller unit and storage unit In
When the portable medium is connected to the server,
The controller unit stores the policy determination module, the key 3 and the key provision condition in the storage unit, and stores in the storage unit a policy determination module storage time representing the time when the policy determination module is stored in the storage unit,
When the portable medium is connected to the client,
The controller unit calculates an elapsed time 3 representing a difference between the current time and the policy determination module storage time, and determines that the portable medium cannot be used when the elapsed time 3 exceeds a predetermined value. If the predetermined value is not exceeded, and the client status representing the client status matches the key provision condition, the policy determination module is passed to the client,
The client activates the policy determination module as the policy determination unit,
The policy determination unit calculates a policy from the client state read from the storage unit to obtain a policy result,
The policy execution unit performs processing according to the policy;
A method for determining a policy via a portable medium.

Images