JP4867927B2 - ACCESS CONTROL SYSTEM, ACCESS CONTROL METHOD, INFORMATION PROCESSING DEVICE, AND ACCESSED MEDIUM - Google Patents

Description

  The present invention relates to an access control system, an access control method, an information processing apparatus, and an accessed medium, and in particular, performs access control from an information processing apparatus to an external device that is an accessed medium connected to the information processing apparatus using a password. The present invention relates to an access control system, an access control method, an information processing apparatus for performing access control, and an access target medium.

  In recent years, with the miniaturization and weight reduction of devices such as an external storage device, unauthorized take-out of confidential information, which is data stored in the storage device, has become a social problem. For this reason, there is an increasing need for a technology for restricting access to devices in which confidential information is stored. In view of this, there are Patent Document 1, Patent Document 2, and Patent Document 3 listed below as mechanisms for releasing a restriction of access and obtaining a desired operation under certain conditions.

  Patent document 1 is a method for preventing illegal use of computer software. In Patent Document 1, when the installation of the computer software is started, the hardware of the installation destination reads the product serial number of the recording medium on which the computer software is recorded and the volume serial number of the hardware. Announce the number and volume serial number to the user. At the same time, the hardware generates an unannounced password from these numbers. Then, when the user notifies the management center of the volume serial number and the product serial number announced, the management center generates a return password encrypted in the same manner as the hardware based on such information. Return to user. Then, the user inputs the return password to the hardware. At this time, if the hardware determines that the input return password matches the unannounced password generated in the hardware, the hardware permits installation of the computer software. Thereby, illegal use of computer software can be prevented.

  Patent Document 2 is an OS activation method that activates an OS (Operating System) based on authentication by a program in an external storage medium to protect information in the hard disk. In Patent Document 2, when it is determined that the power is turned on, a boot device that can be started by searching a basic input / output system (BIOS) stored in a storage unit is searched and stored in an external storage medium. Start the boot OS, link the unique information to the external storage medium to the input password input from the input means, convert it into a hash value, generate the unlock password for the hard disk to be started, and the hard disk to be started has security settings If it is determined that the hard disk is unlocked with the unlock password, the hard disk security is set if it is determined that the hard disk has not been security-set, and the MBR (Master Boot) of the hard disk that has been unlocked is set. Record), start the OS boot loader, to start.

Patent Document 3 discloses a magnetic disk device and a recording data theft prevention method capable of preventing the recorded data from being stolen by making it difficult to access from a connected host system. The microprocessor of the magnetic disk device according to Patent Document 3 sets the password sent from the host system by writing it in an EEPROM (Electrically Erasable and Programmable Read Only Memory). After that, when the power is turned on, an access command to the magnetic disk from the host system is not executed unless the same password as the password set in the EEPROM is input from the host system. Therefore, it is possible to prevent the recorded data on the magnetic disk from being stolen.
International Publication No. 00/043867 Pamphlet JP 2007-066123 A Japanese Patent Application Laid-Open No. 07-044330

  In Patent Document 1, password issue request processing by the user, password issue and return processing by the management center, and password input processing by the user are required. Furthermore, the premise of Patent Document 1 is the existence of a management center that manages passwords. When the password is issued, the management center rejects the issuance if the volume serial number has already been issued for the product serial number, or if the number of issued passwords is greater than or equal to the predetermined number (number of licenses) It is necessary to manage. Therefore, there is a problem that the password management system becomes complicated and the password issuing procedure is complicated.

  Moreover, in patent document 2, since there exists an input means which receives the input of a password, the input process by a user is needed. Therefore, there is a problem that it is complicated because it is necessary to input and manage the password by the user himself / herself. Further, Patent Document 3 does not specifically disclose how to generate a stored password.

  The present invention has been made to solve such problems, and does not require password management and password input by the user, and information processing is performed using a password uniquely determined by the combination of the information processing apparatus and the accessed medium. An object of the present invention is to provide an access control system, an access control method, an information processing apparatus, and an access medium that can be accessed only when the apparatus and the access medium are connected.

  The access control system according to the present invention is an access control system that performs access control from an information processing apparatus to an access target medium (for example, the external device 2 in FIG. 1) connected to the information processing apparatus using a password. The information processing apparatus generates a password using the accessed medium identification information for identifying the accessed medium and the information processing apparatus identification information for identifying the information processing apparatus acquired from the accessed medium And a password input unit for inputting the password generated by the password generation unit to the accessed medium. The accessed medium is stored in a password setting unit that stores a password input by the password input unit in a password storage unit, a password input by the password input unit when access authentication is performed, and the password storage unit. Access authentication means for executing access authentication based on the password.

  The access control method according to the present invention is an access control method in which access control from an information processing apparatus to an access target medium (for example, the external device 2 in FIG. 1) connected to the information processing apparatus is performed using a password. An authentication password generation step of generating an authentication password using the accessed medium identification information for identifying the accessed medium and the information processing apparatus identification information for identifying the information processing apparatus acquired from the accessed medium An authentication password input step for inputting the password generated by the authentication password generation step to the access target medium, a password input by the authentication password input step, and a password preset in the access target medium An access authentication step for performing access authentication based on

  The information processing apparatus according to the present invention is an information processing apparatus connected to an access target medium (for example, the external device 2 in FIG. 1) that performs access control using a password. Password generation means for generating a password using access medium identification information for identifying the access medium and information processing apparatus identification information for identifying the information processing apparatus acquired from the access medium, and the password A password input unit configured to input the password generated by the generation unit to the accessed medium;

  An accessed medium (for example, the external device 2 in FIG. 1) according to the present invention is an accessed medium that performs access control from a connected information processing apparatus using a password. A password generated using access medium identification information for identifying the accessed medium and information processing apparatus identification information for identifying the information processing apparatus, which are input from the information processing apparatus, is stored in a password storage unit. A password setting unit; a password input from the information processing apparatus when performing access authentication; and an access authentication unit that executes access authentication based on the password stored in the password storage unit.

  According to the present invention, password management and password input by the user are not required, and access is possible only when the information processing apparatus and the accessed medium are connected with a password uniquely determined by the combination of the information processing apparatus and the accessed medium. It is possible to provide an access control system, an access control method, an information processing apparatus, and an accessed medium that can be performed.

  Hereinafter, specific embodiments to which the present invention is applied will be described in detail with reference to the drawings. In the drawings, the same elements are denoted by the same reference numerals, and redundant description will be omitted as necessary for the sake of clarity.

  FIG. 1 is a block diagram showing a common overall configuration of an access control system according to each embodiment of the present invention. The access control system 100 in FIG. 1 includes an information processing apparatus 1 and an external device 2.

  The information processing apparatus 1 is a general-purpose computer system, and includes a CPU (Central Processing Unit), a RAM (Random Access Memory), a ROM (Read Only Memory), and a nonvolatile storage device as components not shown. The information processing apparatus 1 sets a password for restricting access to the external device 2 by reading and executing an OS (Operating System) and an access control program stored in a RAM, ROM, or a nonvolatile storage device by the CPU. , And processing such as release of access restriction. As shown in FIG. 1, the information processing apparatus 1 includes an external device identification information acquisition unit 11, an external device identification information storage unit 12, an information processing device identification information storage unit 13, a password generation unit 14, and a password. Input means 15.

  The external device identification information acquisition unit 11 acquires external device identification information for identifying the external device 2 from the external device 2 and stores the external device identification information in the external device identification information storage unit 12. At that time, the external device identification information acquisition unit 11 requests the external device 2 for device information including the external device identification information, and acquires device information returned from the external device 2. The external device identification information acquisition unit 11 extracts external device identification information from the acquired device information. Here, the device information includes a serial number, which is identification information unique to the external device 2, a serial number, a product model number, a vendor name, which is identification information of the manufacturer, or a vendor code. Information shall be either of these.

  The external device identification information storage unit 12 stores a serial number 121 that is external device identification information. Here, it is assumed that the serial number 121 is identification information unique to the external device 2. The serial number 121 may be a manufacturing number of the external device 2.

  The information processing device identification information storage unit 13 stores a serial number 131 that is information processing device identification information for identifying the information processing device 1. Here, the serial number 131 is identification information unique to the information processing apparatus 1. For example, a serial number stored in a nonvolatile memory such as an EEPROM on a motherboard that is a component of the information processing apparatus, a manufacturing number, or the like It is. Alternatively, the serial number 131 may be stored in, for example, a battery-backed volatile memory. It is assumed that the serial number 131 is stored in the information processing apparatus identification information storage unit 13 before being read by the password generation unit 14 described later. For example, it may be stored when the information processing apparatus 1 is initially set or updated when the setting is changed.

  The password generation unit 14 generates a password from the serial number 121 and the serial number 131. At this time, the password generation unit 14 reads the serial number 121 from the external device identification information storage unit 12 and reads the serial number 131 from the information processing device identification information storage unit 13.

  The password input unit 15 uses the password generated by the password generation unit 14 as a password included in various requests to the external device 2. Here, the various requests to the external device 2 include, for example, a request for setting a password for restricting access to the external device 2, a request for releasing access restriction for releasing the access restriction of the external device 2, and other passwords. Change, deletion, etc.

  The external device identification information storage unit 12 and the information processing apparatus identification information storage unit 13 may be a nonvolatile storage device such as a hard disk drive or a flash memory, or a volatile storage such as a DRAM (Dynamic Random Access Memory). It may be a device. Further, the information processing device identification information storage unit 13 may be a ROM.

  The external device 2 is a peripheral device having an interface that can be connected to a general-purpose computer system such as the information processing apparatus 1. The external device 2 is, for example, a hard disk drive or a flash memory having a standard of an HDD (Hard Disk Drive) such as USB (Universal Serial Bus), SCSI (Small Computer System Interface), or ATA (AT Attachment). It is a non-volatile storage device. In addition, the external device 2 includes an interface that accepts various requests from the information processing apparatus 1 to be connected as a configuration (not shown). As shown in FIG. 1, the external device 2 includes an external device identification information storage unit 21, a password setting unit 22, a password storage unit 23, and an access authentication unit 24.

  The external device identification information storage unit 21 stores a serial number 211 that is external device identification information for identifying the external device 2. Here, the serial number 211 is identification information unique to the external device 2, and is equivalent to the serial number 121 described above. The external device identification information storage unit 21 may store the device information of the external device 2 described above in addition to the serial number 211. The external device identification information storage unit 21 may be a ROM. Note that the serial number 211 is stored in the external device identification information storage unit 21 in advance when used in the present invention. For example, it may be stored by the manufacturer of the external device 2.

  Based on the password setting request from the information processing apparatus 1, the password setting unit 22 extracts the password included in the request and stores it in the password storage unit 23.

  The password storage unit 23 stores the password 231 stored from the password setting unit 22. The password storage unit 23 may be a non-volatile storage device.

  The access authentication means 24 performs access authentication based on the access restriction release request from the information processing apparatus 1, and releases the access restriction of the external device 2 when the access authentication is performed. For example, when the access to the external device 2 is restricted, the access authentication unit 24 extracts the password included in the request, compares the password and the password stored in the password storage unit 23, and matches. The access restriction of the external device 2 is released.

  It should be noted that any algorithm may be used as an algorithm for generating a password in the password generation means 14. For example, the password may be generated by inputting the serial number 121 and the serial number 131 as seeds into the pseudorandom function. The access authentication by the access authentication means 24 may be a method other than password matching. In addition, since the functions of the password generation unit 14 and the access authentication unit 24 are well known as publicly known technologies, detailed description thereof is omitted here.

  Further, the access restriction and cancellation mechanism using a password in the external device 2 is well known as a publicly known technique, and thus detailed description thereof is omitted here.

  As described above, the access control system 100 performs access control of the external device 2 by setting a password for restricting access from the information processing apparatus 1 to the external device 2 and releasing access restriction.

  In the password setting, first, the external device 2 is connected to the information processing apparatus 1. Then, based on the password setting instruction from the user, the external device identification information acquisition unit 11 of the information processing apparatus 1 acquires the serial number 211 stored in the external device identification information storage unit 21 of the external device 2, and external device identification The serial number 121 is stored in the information storage unit 12. Next, the password generation unit 14 generates a password based on the serial number 121 and the serial number 131. Then, the password setting unit 22 of the external device 2 stores the password input from the password input unit 15 in the password storage unit 23 as the password 231. Thereafter, the external device 2 is removed from the information processing apparatus 1 to be in an access restricted state. Therefore, after that, even if the external device 2 is connected to another information processing apparatus, the other device 2 cannot access the external device 2.

  In the access restriction release, first, the information processing apparatus 1 is connected in an access restricted state, that is, in a state where the password 231 is stored in the password storage unit 23 of the external device 2. Next, the password generation unit 14 generates a password based on the serial number 121 and the serial number 131. Then, the access authentication unit 24 of the external device 2 performs access authentication from the password input from the password input unit 15 and the password 231 and cancels the access of the external device 2 because they match. As a result, the information processing apparatus 1 can access the external device 2.

  In this way, the access control system 100 can generate a unique password between the information processing apparatus 1 and the external device 2. Further, the generated password is not stored in the information processing apparatus 1, and it is not necessary to directly hold the password itself. In addition, since the external device 2 is restricted in access after the password is set, it is difficult to read the password 231 stored in the password storage unit 23. Therefore, password management can be made more secure. Furthermore, in the access control system 100, since the generated unique password can be managed safely, the user does not need to input and manage the password.

<Example 1>
A processing example is given below as Example 1 of the access control system according to the present exemplary embodiment. The first embodiment of the present invention has the entire configuration of FIG. FIG. 2 is a flowchart illustrating the password setting process of the access control system according to the first embodiment of the present invention. Here, it is assumed that no password is stored in the password storage unit 23 of the external device 2, that is, no access restriction is made.

  First, the information processing apparatus 1 requests device information from the external device 2 (S101). Specifically, the external device identification information acquisition unit 11 of the information processing apparatus 1 transmits a request for device information to the external device 2. Next, the external device 2 sends a device information response to the information processing apparatus 1 (S102). Specifically, the external device 2 receives the device information request from the external device identification information acquisition unit 11, reads the device information including the serial number 211 stored in the external device identification information storage unit 21, and Information is transmitted to the information processing apparatus 1 as a response.

  Subsequently, the information processing apparatus 1 stores external device identification information (S103). Specifically, the external device identification information acquisition unit 11 receives a device information response from the external device 2, extracts the serial number 211 (serial number 121) from the device information, and extracts the external device identification information storage unit 12. To store. Here, the serial number 121 has the same data content as the serial number 211, and indicates the serial number of the external device 2 in the information processing apparatus 1.

  Then, the information processing apparatus 1 reads the serial number 131 from the information processing apparatus identification information storage unit 13 (S104). Further, the information processing apparatus 1 reads the serial number 121 from the external device identification information storage unit 12 (S105). Note that step S104 does not need to be performed at this position, and may be executed before step S101, that is, between the start of the password setting process and step S106.

  Thereafter, the information processing apparatus 1 generates a password (S106). Specifically, the password generation unit 14 of the information processing apparatus 1 generates a password using the serial number 131 and the serial number 121 read out in steps S104 and S105.

  Then, the information processing apparatus 1 requests the external device 2 to set a password (S107). Specifically, the password input unit 15 of the information processing apparatus 1 transmits a password setting request including the password generated in step S <b> 106 to the external device 2.

  Thereafter, the external device 2 stores the password (S108). Specifically, the external device 2 receives the password setting request from the password input unit 15, extracts the password from the request by the password setting unit 22, and stores it in the password storage unit 23 as the password 231.

  Thereafter, the external device 2 is turned off by being removed from the information processing apparatus 1, and is connected to the connectable information processing apparatus next time, and then turned on and started up in the password storage unit 23. Since the password 231 exists, the access is restricted. Note that the mechanism for restricting the access is not limited to this. For example, even if the external device 2 is not removed, the access control state can be set by restarting the information processing apparatus 1 itself or resetting the external device 2.

  Next, the access release process will be described. FIG. 3 is a flowchart illustrating the access release processing of the access control system according to the first embodiment of the present invention. Here, it is assumed that it is after the access setting process of FIG. That is, it is assumed that the password 231 is stored in the password storage unit 23 of the external device 2, that is, access is restricted. In addition, it is assumed that the serial number 121 having the same contents as the serial number 211 is stored in the external device identification information storage unit 12 of the information processing apparatus 1. In this state, it is assumed that the external device 2 is connected to the information processing apparatus 1 and the information processing apparatus 1 releases the access restriction of the external device 2. When the external device 2 is connected to an arbitrary information processing apparatus and the password is set, the external device 2 requests the connected information processing apparatus for a password for releasing the access restriction. It may be.

  First, the information processing apparatus 1 reads the serial number 131 from the information processing apparatus identification information storage unit 13 (S201). Further, the information processing apparatus 1 reads the serial number 121 from the external device identification information storage unit 12 (S202). Note that the order of steps S201 and S202 may be reversed. Subsequently, the information processing apparatus 1 generates a password (S203). Specifically, since it is the same as step S106, description thereof is omitted.

  Then, the information processing apparatus 1 requests the external device 2 to release access restriction (S204). Specifically, the password input unit 15 of the information processing apparatus 1 transmits an access restriction release request including the password generated in step S <b> 203 to the external device 2.

  Thereafter, the external device 2 performs access authentication (S205). Specifically, the external device 2 receives the access restriction release request from the password input unit 15 and performs access authentication processing shown in FIG.

  FIG. 4 is a flowchart illustrating the access authentication process of the access control system according to the first embodiment of the present invention. First, the access authentication means 24 extracts the password (password A) generated in step S203 from the access restriction release request (S251). Next, the access authentication unit 24 reads the password 231 (password B) from the password storage unit 23 (S252).

  Thereafter, the access authentication unit 24 determines whether the password A and the password B match (S253). When it is determined that the password A and the password B match, the access authentication unit 24 releases the access restriction of the external device 2 (S254). If it is determined that the password A and the password B do not match, the access authentication unit 24 ends the access authentication process.

  Here, the password 231 (password B) stored in the password storage unit 23 in the password setting process of FIG. 2 and the password A input from the information processing apparatus 1 in the access authentication process of FIG. Since the passwords are generated from 121 and the serial number 131, they match. For this reason, the access restriction is released and the external device 2 can be used only when it is connected to the information processing apparatus 1.

  As described above, in the first embodiment, since a password is generated based on the serial number of the external device 2 stored in the information processing apparatus 1, an external device in an access-restricted state other than the external device 2 is included in the information processing apparatus 1. When connected, the information processing apparatus 1 cannot release the access restriction of the external device. Therefore, for example, it is assumed that the OS is stored in the external device 2 and the information processing apparatus 1 starts up and uses the OS stored in the external device 2 when the external device 2 is connected. In this case, when an external device other than the external device 2 is connected to the information processing apparatus 1, the information processing apparatus 1 cannot release the access restriction of the external device, and therefore the OS is stored in the external device. However, the OS cannot be started, and the information processing apparatus 1 is not used.

<Example 2>
Next, Example 2 of the access control system according to this exemplary embodiment will be exemplified below. In the second embodiment of the present invention, external device identification information is acquired from the external device 2 each time, regardless of the password setting process and the access authentication process, as compared with the first embodiment. Therefore, it is not necessary to hold external device identification information, and passwords can be managed more safely. Furthermore, a plurality of external devices can be properly used for one information processing apparatus.

  FIG. 5 is a block diagram illustrating the overall configuration of the access control system 101 according to the second embodiment of the present invention. The access control system 101 differs from the access control system 100 of FIG. 1 in that the external device identification information acquisition unit 11 is replaced with the external device identification information acquisition unit 31 and the password generation unit 14 is replaced with the password generation unit 34. . Further, the external device identification information storage unit 12 in FIG. 1 is not shown in the information processing apparatus 3 in FIG. However, the information processing apparatus 3 may include the external device identification information storage unit 12. Other configurations are the same as those in FIG. Only the differences from FIG. 1 will be described below.

  The external device identification information acquisition unit 31 acquires external device identification information from the external device 2 in the same manner as the external device identification information acquisition unit 11. The acquired external device identification information is directly used by the password generation unit 34 instead of being read from the external device identification information storage unit 12. The external device identification information acquisition unit 31 is executed in both the password setting process and the access authentication process.

  The password generation unit 34 generates a password from the external device identification information acquired by the external device identification information acquisition unit 31 and the serial number 131.

  FIG. 6 is a flowchart showing the password setting process of the access control system according to the second embodiment of the present invention. Here, it is assumed that no password is stored in the password storage unit 23 of the external device 2, that is, no access restriction is made. In the following, detailed description of the same processing as in FIG. 2 is omitted.

  First, the information processing apparatus 3 requests device information from the external device 2 as in step S101 (S301). Next, the external device 2 sends a device information response to the information processing apparatus 3 as in step S102 (S302).

  Then, the information processing apparatus 3 extracts external device identification information from the device information (S303). Specifically, the external device identification information acquisition unit 31 receives a device information response from the external device 2 and extracts the serial number 211 from the device information.

  Subsequently, the information processing apparatus 3 reads the serial number 131 from the information processing apparatus identification information storage unit 13 as in step S104 (S304).

  Thereafter, the information processing apparatus 3 generates a password (S305). Specifically, the password generation unit 34 of the information processing apparatus 3 generates a password using the external device identification information extracted in step S303 and the serial number 131 read in S304.

  Then, the information processing apparatus 3 makes a password setting request to the external device 2 as in step S107 (S306). Thereafter, the external device 2 stores the password as in step S108 (S307).

  Next, the access release process will be described. FIG. 7 is a flowchart of the access release process of the access control system according to the second embodiment of the present invention. Here, it is assumed that it is after the access setting process of FIG. That is, it is assumed that the password 231 is stored in the password storage unit 23 of the external device 2, that is, access is restricted. In the following, detailed description of the same processing as in FIG. 3 or FIG. 6 is omitted.

  First, the information processing apparatus 3 generates a password using the external device identification information of the external device 2 and the serial number 131 in the same manner as the processing of steps S301 to S305 (steps S401 to S405). Subsequently, the information processing apparatus 3 requests the external device 2 to release the access restriction as in step S204 (S406).

  Thereafter, the external device 2 performs access authentication as in step S205 (S407). The details of the access authentication process in step S407 are the same as those in FIG.

  Here, the password 231 (password B) stored in the password storage unit 23 in the password setting process of FIG. 6 and the external device identification information acquired from the external device 2 again in the access authentication process of FIG. Since the password A is a password generated from the serial number 211 and the serial number 131, they match. Therefore, the access restriction is canceled and the external device 2 can be used only when connected to the information processing apparatus 3.

  As a result, the information processing apparatus 3 does not need to store the external device identification information of the external device 2 inside, and there is no possibility of being read. As a result, the possibility of password decryption is reduced, and the password can be managed more safely.

  Furthermore, the information processing apparatus 3 can connect not only to a single external device but also to a plurality of external devices for which passwords are set in advance, and to release access restrictions on each.

  The external device identification information acquisition unit 31 stores the external device identification information storage unit 12 in the same manner as the external device identification information acquisition unit 11. The password generation unit 34 stores the serial number 121 in the same manner as the password generation unit 14. May be read from the external device identification information storage unit 12. In this case, the password generation unit 14 may delete the serial number 121 from the external device identification information storage unit 12 after generating the password. That is, in the second embodiment of the present invention, the external device identification information acquisition unit 31 may acquire the external device identification information of the external device 2 each time.

<Example 3>
Next, Example 3 of the access control system according to this exemplary embodiment will be exemplified below. In the third embodiment of the present invention, as compared with the first embodiment, the information processing apparatus holds a plurality of external device identification information and generates a password for releasing access restriction from the designated external device identification information. A plurality of external devices can be used properly for one information processing apparatus.

  FIG. 8 is a block diagram illustrating the overall configuration of the access control system 102 according to the third embodiment of the present invention. Hereinafter, only differences from FIG. 1 will be described, and description of other configurations similar to FIG. 1 will be omitted. The access control system 102 includes an information processing apparatus 4, an external device 2a, an external device 2b, ..., an external device 2n. Note that the number of external devices may be plural.

  The information processing apparatus 4 differs from the information processing apparatus 1 of FIG. 1 in that the external device identification information acquisition unit 11 is the external device identification information acquisition unit 41 and the external device identification information storage unit 12 is the external device identification information storage unit 42. In addition, the password generation means 14 is replaced with the password generation means 44.

  The external device identification information acquisition unit 41 acquires external device identification information from any one of the external devices 2a, 2b,..., 2n, and stores the external device identification information in the external device identification information storage unit. At this time, the external device identification information acquisition unit 41 stores each external device identification information in the external device identification information storage unit 42 unless the external device identification information is the same.

  The external device identification information storage unit 42 stores a plurality of external device identification information. Specifically, the external device identification information storage unit 42 stores serial numbers 421a, serial numbers 421b,..., Serial numbers 421n, which are external device identification information corresponding to the external devices 2a, 2b,. To do.

  The password generation unit 44 generates a password from the serial number designated by the user in the external device identification information storage unit 42 and the serial number 131.

  The external devices 2a, 2b,..., 2n are external devices having the same function as the external device 2, respectively. For example, the external device 2a stores the serial number 211a as its external device identification information in the external device identification information storage unit 21a. Similarly, the external device 2b stores its own external device identification information serial number 211b in the external device identification information storage unit 21b, and the external device 2n stores its external device identification information in the external device identification information storage unit 21n. Is stored as a serial number 211n. Also, here, the serial number 211a, serial number 211b,..., Serial number 211n, serial number 421a, serial number 421b,. Since other configurations are the same as those of the external device 2 in FIG. 1, illustration and description thereof are omitted.

  Since the information processing apparatus 4 can store a plurality of external device identification information by the access control system 102, a unique password is generated and set for each of the plurality of external devices 2a, 2b,. Can do. Therefore, for example, when the external device 2 a is connected to the information processing apparatus 4, the user designates the serial number 421 a, and the password generation unit 44 generates a password using the serial number 421 a and the serial number 131. The access restriction of the external device 2a can be released.

  From the above, in the third embodiment of the present invention, a plurality of external devices can be used properly for one information processing apparatus.

<Example 4>
Next, Example 4 of the access control system according to this exemplary embodiment will be exemplified below. In the fourth embodiment of the present invention, as compared with the first embodiment, the external device holds a plurality of passwords, and when the password matches any password, the access restriction is released. Thereby, a plurality of information processing apparatuses can be used properly for one external device.

  FIG. 9 is a block diagram illustrating the overall configuration of the access control system 103 according to the fourth embodiment of the present invention. Hereinafter, only differences from FIG. 1 will be described, and description of other configurations similar to FIG. 1 will be omitted. The access control system 103 includes an information processing device 1a, an information processing device 1b,..., An information processing device 1n, and an external device 5. The number of information processing devices may be plural.

  The information processing apparatuses 1a, 1b,..., 1n are information processing apparatuses having the same functions as the information processing apparatus 1, respectively. For example, the information processing apparatus 1a stores the serial number 131a that is its information processing apparatus identification information in the information processing apparatus identification information storage unit 13a. Similarly, the information processing apparatus 1b stores the serial number 131b, which is its information processing apparatus identification information, in the information processing apparatus identification information storage unit 13b, and the information processing apparatus 1n stores the information processing apparatus identification information storage unit 13n. The serial number 131n, which is its own information processing apparatus identification information, is stored. Other configurations are the same as those of the information processing apparatus 1 in FIG.

  The external device 5 differs from the external device 2 of FIG. 1 in that the password setting means 22 is replaced with a password setting means 52, the password storage section 23 is replaced with a password storage section 53, and the access authentication means 24 is replaced with an access authentication means 54. Is.

  The password setting means 52 extracts a password included in the request from any one of the connected information processing apparatuses 1a, 1b,..., 1n and stores it in the password storage unit 53. At this time, the password setting unit 52 stores the password of each information processing apparatus in the password storage unit 53.

  The password storage unit 53 stores a plurality of passwords. Specifically, the password storage unit 53 stores passwords 531a, 531b,..., And passwords 531n, which are passwords corresponding to the information processing apparatuses 1a, 1b,. The password storage unit 53 may be a non-volatile storage device.

  The access authentication means 54 performs access authentication based on the access restriction release request from the connected information processing apparatus 1, and releases the access restriction of the external device 2 when the access authentication is performed.

  Here, it is assumed that the password 531a is a password generated using the serial number 211 and the serial number 131a. Similarly, the password 531b is generated using the serial number 211 and the serial number 131b, and the password 531n is a password generated using the serial number 211 and the serial number 131n.

  The access authentication unit 24 performs access authentication based on an access restriction release request from the connected information processing apparatus, and when access authentication is performed, the access restriction of the external device 5 is released. At this time, the access authentication means 24 releases the access restriction when the password extracted from the access restriction release request matches any of the passwords 531a, 531b,..., 531n stored in the password storage unit 53. To do. For example, when the external device 5 is access-restricted and connected to the information processing apparatus 1 a, the access authentication unit 54 extracts the password included in the request and stores the password and the password storage unit 53. Since the password 531a is compared and matched, the access restriction of the external device 5 can be released.

  From the above, in the fourth embodiment of the present invention, a plurality of information processing apparatuses can be used properly for one external device.

<Other examples>
In the first to fourth embodiments of the present invention, the external device identification information is a serial number that is identification information unique to the external device. However, the present invention is not limited to this. For example, by using the external device identification information as the product model number, even in the first embodiment of the present invention, a plurality of external devices having the same model number can be used. Furthermore, by using external device identification information as a vendor code, a plurality of external devices manufactured by the same vendor can be used properly.

  The external device 2 in the first to fourth embodiments of the present invention is not limited to a storage device. For example, the external device 2 may be portable by an owner such as an electronic key used for electronic authentication. The accessed medium according to the embodiment of the present invention may be a built-in HDD connected to the information processing apparatus.

  Note that the information processing apparatus 1 according to the embodiment of the present invention performs processing such as setting a password for restricting access to the external device 2 and releasing access restriction when reading the BIOS instead of the OS. May be. That is, the information processing apparatus 1 may perform access control before starting the OS. Thereby, for example, access control can be performed even when the OS is stored in the external device 2.

  Furthermore, the present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the gist of the present invention described above.

It is a block diagram which shows the common whole structure of the access control system concerning each Example of this invention. It is a flowchart figure which shows the password setting process of the access control system concerning Example 1 of this invention. It is a flowchart figure which shows the access cancellation process of the access control system concerning Example 1 of this invention. It is a flowchart figure which shows the access authentication process of the access control system concerning Example 1 of this invention. It is a block diagram which shows the whole structure of the access control system concerning Example 2 of this invention. It is a flowchart figure which shows the password setting process of the access control system concerning Example 2 of this invention. It is a flowchart figure which shows the access cancellation | release process of the access control system concerning Example 2 of this invention. It is a block diagram which shows the whole structure of the access control system concerning Example 3 of this invention. It is a block diagram which shows the whole structure of the access control system concerning Example 4 of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Access control system 1 Information processing apparatus 11 External device identification information acquisition means 12 External device identification information storage part 121 Serial number 13 Information processing apparatus identification information storage part 131 Serial number 14 Password generation means 15 Password input means 2 External device 21 External device Identification information storage unit 211 Serial number 22 Password setting unit 23 Password storage unit 231 Password 24 Access authentication unit 101 Access control system 3 Information processing device 31 External device identification information acquisition unit 34 Password generation unit 102 Access control system 4 Information processing device 41 External Device identification information acquisition means 42 External device identification information storage section 421a Serial number 421b Serial number 421n Serial number 44 Password generation means 2a External device 21a External device identification information storage unit 211a Serial number 2b External device 21b External device identification information storage unit 211b Serial number 2n External device 21n External device identification information storage unit 211n Serial number 103 Access control system 1a Information processing device 13a Information processing Device identification information storage unit 131a Serial number 1b Information processing device 13b Information processing device identification information storage unit 131b Serial number 1n Information processing device 13n Information processing device identification information storage unit 131n Serial number 5 External device 52 Password setting means 53 Password storage unit 531a Password 531b Password 531n Password 54 Access authentication means

Claims (19)

An access control system that performs access control from an information processing device to an accessed medium connected to the information processing device by using a password,
The information processing apparatus includes:
Password generation means for generating a password using access medium identification information for identifying the access medium acquired from the access medium and information processing apparatus identification information for identifying the information processing apparatus;
Password input means for inputting the password generated by the password generation means to the accessed medium;
The accessed medium is
Password setting means for storing the password input by the password input means in a password storage unit;
An access control system comprising: a password input by the password input means when performing access authentication; and an access authentication means for executing access authentication based on the password stored in the password storage unit.   2. The information processing apparatus further comprises an access medium identification information acquisition unit that acquires the access medium identification information from the access medium and stores the access medium identification information in an access medium identification information storage unit. The access control system described in. The accessed medium identification information acquisition means acquires the accessed medium identification information from the accessed medium when setting a password,
The password generation means generates a password using the accessed medium identification information stored in the accessed medium identification information storage unit and the information processing apparatus identification information when performing access authentication. The access control system according to claim 2.   2. The access control according to claim 1, wherein, when performing access authentication, the information processing apparatus acquires the accessed medium identification information from the accessed medium and executes password generation by the password generation unit. system. The accessed medium identification information storage unit stores a plurality of the accessed medium identification information,
The password generation means, when performing access authentication, specifies the access medium identification information specified among the plurality of access medium identification information stored in the access medium identification information storage unit, and the information processing apparatus identification information The access control system according to claim 2, wherein a password is generated using   The access control system according to claim 1, wherein a plurality of passwords are stored in the password storage unit.   The access control system according to claim 1, wherein the accessed medium identification information is unique information for uniquely identifying the accessed medium.   The access control system according to claim 1, wherein the accessed medium identification information is identification information common to a plurality of the accessed media. An access control method for performing access control from an information processing device to an accessed medium connected to the information processing device using a password,
An authentication password generation step of generating an authentication password using the accessed medium identification information for identifying the accessed medium and the information processing apparatus identification information for identifying the information processing apparatus acquired from the accessed medium When,
An authentication password input step of inputting the password generated by the authentication password generation step to the accessed medium;
An access control method comprising: a password input in the authentication password input step; and an access authentication step of executing access authentication based on a password preset in the accessed medium. An access medium identification information obtaining step for obtaining the accessed medium identification information from the accessed medium;
A setting password generation step for generating a setting password using the accessed medium identification information acquired by the accessed medium identification information acquisition step and the information processing apparatus identification information;
A setting password input step for inputting the password generated by the setting password generation step to the accessed medium;
The access control method according to claim 9, further comprising: a password setting step for setting the password input by the setting password input step.   The authentication password generation step generates an authentication password using the accessed medium identification information acquired by the accessed medium identification information acquisition step and the information processing apparatus identification information. Item 11. The access control method according to Item 10. An access medium identification information obtaining step for obtaining the accessed medium identification information from the accessed medium;
The authentication password generation step uses the access medium identification information acquired by the access medium identification information acquisition step and the information processing apparatus identification information after the access medium identification information acquisition step for authentication. The access control method according to claim 9, wherein the password is generated. An information processing apparatus connected to an access target medium that performs access control with a password,
Password generation means for generating a password using access medium identification information for identifying the access medium acquired from the access medium and information processing apparatus identification information for identifying the information processing apparatus;
An information processing apparatus comprising password input means for inputting the password generated by the password generation means to the accessed medium. An accessed medium identification information storage unit for storing the accessed medium identification information;
14. The information according to claim 13, further comprising access medium identification information acquisition means for acquiring the access medium identification information from the access medium and storing it in the access medium identification information storage unit. Processing equipment. The accessed medium identification information acquisition means acquires the accessed medium identification information from the accessed medium when setting a password,
The password generation means generates a password using the accessed medium identification information stored in the accessed medium identification information storage unit and the information processing apparatus identification information when performing access authentication. The information processing apparatus according to claim 14.   The information processing apparatus according to claim 13, wherein when access authentication is performed, the access medium identification information is acquired from the access medium, and password generation is executed by the password generation unit. The accessed medium identification information storage unit stores a plurality of the accessed medium identification information,
The password generation means, when performing access authentication, specifies the access medium identification information specified among the plurality of access medium identification information stored in the access medium identification information storage unit, and the information processing apparatus identification information The information processing apparatus according to claim 14, wherein a password is generated using. An access medium for performing access control from a connected information processing apparatus using a password,
A password generated using access medium identification information for identifying the accessed medium and information processing apparatus identification information for identifying the information processing apparatus, which are input from the information processing apparatus, is stored in a password storage unit. Password setting means;
An access target medium comprising: a password input from the information processing apparatus when performing access authentication; and access authentication means for executing access authentication based on the password stored in the password storage unit.   19. The accessed medium according to claim 18, wherein a plurality of passwords are stored in the password storage unit.

Images