JP2007316968A - External storage device with security function, and security management method for external storage device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To improve secrecy of data without advanced registration of identification information and to prevent information leak in the event of theft in an external storage device with security function to be connected with a computer for use and a security management method therefor. <P>SOLUTION: The computer includes a specific information retention part retaining specific information thereof, and the external storage device includes a control part, a management memory for registering management information, and a switch for switching modes. The control part includes a means which clears the management memory and also lays a storage main body in an unusable state in an initialization mode, and reads the specific information of the computer in a general mode; a means which registers, when the specific information is not registered in the management memory, the read specific information thereto; and a means which compares, when the specific information is registered, this specific information with the read specific information, and enables use of the storage main body when the specific information is registered or when the matching by the comparison means is successful. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to an external storage device with a security function and a security management method for the external storage device.

  In recent years, information from theft of external storage devices or access to external storage devices by others is often read. However, external storage devices have a security function and can be used by limiting the number of computers that can be used. It is desired to prevent information leakage during theft.

  Conventionally, security of an external storage device is performed by a method of setting a password and inputting a password from software running on a computer. Since manual password authentication can be hit if it is made many times, there is a possibility that the security may be released by a third party.

  Conventional example 1 in which a security function is provided in an external storage device is shown in FIG. 4 (see Patent Document 1). In the figure, 50 is an external storage device controller, 51 is a switching device, 52 is an encryption / decryption device, 53 is a device number storage memory, 54 is a switching device, 55 is an external storage device, and a, c to g are signals. Represents the path. The purpose of this example is to prevent the data stored in the external storage device 55 from being read correctly by a device other than the main device in which the data is written, and between the data transfer paths of the external storage device control unit 50 and the external storage device 55. An encryption / decryption device 52 is arranged, and the encryption / decryption device 52 encrypts data from the external storage device control unit 50 using the data in the device number storage memory 53 for storing the device number unique to the main unit as a key. The data stored in the external storage device 55 can be decrypted only by the main device having the same device number. Further, since the command for controlling the external storage device 55 does not need to be encrypted, the control command has a path a for passing directly to the external storage device 55 without passing through the encryption machine.

Another conventional example 2 (see Patent Document 2) is also known as a security system for disk devices. In the conventional example 2, a disk device for storing data is provided detachably with respect to the host, a table for storing identification information (ID) registered in each is provided, and the disk device is connected to the host for power supply. At the time of input, an identification information transmission command is transmitted from the disk device to the host. In response to this command, the identification information is sent from the table held by the host to the disk device. The disk device checks the identification information from the host against the identification information held in its own table. Allows data stored in the device to be accessed from the host.
Japanese Patent Laid-Open No. 10-143438 JP-A-8-6729

  The technique of the above-mentioned Patent Document 1 has a problem that it is expensive in that it requires an encryption / decryption device. Further, the technique disclosed in Patent Document 2 has a problem that it requires time and effort to register identification information in both the host and the magnetic disk.

  The present invention does not require an encryption / decryption device, and does not need to pre-register identification information that can be arbitrarily set, thereby improving the confidentiality of data and preventing the leakage of information during theft. An object is to provide an external storage device provided.

  FIG. 1 shows the principle configuration of the present invention. In the figure, 1 is a computer, 10 is a unique information holding unit for holding unique information such as a manufacturing number (machine number) and MAC address of components basically held by the computer 1, and 2 is provided with a security function according to the present invention. An external storage device, 20 is a control unit for controlling security functions, 20a is unique information reading means, 20b is unique information storage means, 20c is unique information comparison means, 20d is initialization means, and 21 is management for security. A nonvolatile management memory for storing information, 21a is a unique information storage unit for storing management information read from the computer 1, and 21b is a log information storage unit for storing security authentication results. 22 is a storage unit body for storing data such as a hard disk in an external storage device, 23 is a display means for displaying whether the mode status and security authentication are good (OK) or not (NG), and 24 is an initialization mode valid This is a mode switch that switches between enabling and disabling (normal mode).

  With the unique information set in the unique information holding unit 10 of the computer 1, the external storage device 2 is connected. When the external storage device 2 is used for the first time, if the mode switch 24 is switched to the initialization mode, the initialization memory 20d initializes the management memory 21 and the storage unit body 22 (data deletion), and The storage device 2 is disabled, the computer 1 and the external storage device 2 are disconnected, and the initialization mode is set to the normal mode.

  In a state where the external storage device 2 is connected to the computer 1 and the mode switch 24 is switched to the normal mode, the unique information is read from the unique information holding unit 10 of the computer 1 by the unique information reading means 20a. At this time, the unique information storage unit 21a of the management memory 21 is read. However, in the initialized state (the unique information is not stored in the unique information storage unit 21a), the unique information may not be read. Detected. In this case, the read unique information is registered in the unique information storage unit 21a of the management memory 21 by the unique information storage unit 20b, the external storage device 2 can be used, and data can be recorded in the storage unit body 22.

  With the unique information recorded (the unique information is registered in the unique information storage unit 21a of the management memory 21), the external storage device 2 is connected to the computer 1 and the mode switch 24 is set to the normal mode to When accessing the storage unit main body 22 of the storage device 2, the unique information of the computer 1 is read by the unique information reading means 20a. Subsequently, the unique information comparing means 20c is driven and the unique information read from the computer 1 is compared with the unique information registered in the unique information storage unit 21a. Otherwise, the external storage device 2 is disabled. If they do not coincide with each other, they are registered as error information in the log information storage unit 21b. Subsequently, it is identified whether the number of error information (number of errors) has reached a predetermined numerical value n. 2 may be initialized to an unusable state.

  It should be noted that not only one unique information but also a plurality of unique information (for example, both a manufacturing number (machine number) and a MAC address) are registered and a check (comparison) is performed on the plurality of unique information. it can.

  According to the present invention, it is possible to maintain the confidentiality of data by giving the external storage device security and limiting the computers that can be used. The user simply connects the external storage device to the computer, does not require any operation, can perform security settings, and can realize complete automation.

  Further, even if the external storage device of the present invention is illegally taken out in a state where data is stored and connected to a different computer, the storage unit body cannot be accessed due to an authentication mismatch, and information leakage can be prevented. . In addition, if it is determined that unauthorized use has been made by recording log information that does not match the authentication, it is possible to voluntarily prevent information leakage by initializing (or physically formatting) the storage unit that stores the user data. it can.

  In addition, security management is effective regardless of the presence or absence of a security function on the computer side, and by using the unique information of the computer, tampering can be prevented and information leakage at the time of theft can be prevented.

  FIG. 2 shows the configuration of the embodiment. In the figure, 3 and 4 correspond to 1 and 2 in FIG. 1, 3 is a computer, 30 is a unique information holding unit, and 4 is a hard disk corresponding to an external storage device. 40 is a control unit, 40a in the control unit 40 is a CPU, 40b is a ROM storing a program, 40c is a RAM storing data, and 41 is a management memory (21 in FIG. 1) composed of a nonvolatile memory. 41a is unique information, and 41b is log information in which a security authentication result is recorded. Reference numeral 42 denotes a storage unit main body (corresponding to 22 in FIG. 1). 43 is a display unit (corresponding to 23 in FIG. 1), 44 is a mode changeover switch (corresponding to the mode switch 24 in FIG. 1) for switching the external storage device 4 to the initialization mode or the normal mode, and 45 is the computer 3 Interface.

  FIG. 3 is a flowchart of the embodiment, which is executed by a program in the CPU 40a of the control unit 40 of the external storage device 4 of FIG.

  The flowchart of FIG. 3 will be described below. First, it is determined whether the initialization mode is set (S1 in FIG. 3). This determination is performed by identifying which mode switch 44 in FIG. 2 is set to. In initialization mode, perform physical formatting. In the physical format, the management memory 41 is cleared and the storage unit main body 42 is initialized (a specific pattern is written and data is erased) (S2 in FIG. 3), and the external storage device 4 is disabled (FIG. 3). S3), the computer 3 and the external storage device 4 are further disconnected, and the initialization mode is set to the normal mode (S4). In this case, the connection between the external storage device 4 and the computer 3 (interface 45 in FIG. 2) is disconnected, and the mode switch (44 in FIG. 2) is switched from the initialization mode to the normal mode, and the process returns to step S1.

  If it is determined in step S1 that the mode is the normal mode, the unique information is acquired from the unique information holding unit 30 of the computer 3 and the unique information 41a is read from the management memory (41 in FIG. 2) (S5 in FIG. 3). It is determined whether or not the unique information 41a is registered in the management memory 41 (S6). In this case, it is determined whether or not the unique information has been read from the management memory 41. If the unique information cannot be read (no unique information is registered), the external storage device 4 is in an initialized state (accordingly, The data is not recorded in the external storage device), and the unique information acquired from the unique information holding unit 30 of the computer 3 is registered in the management memory 41 (S12 in FIG. 3), and the external storage device 4 can be used. The state is entered (data can be written to the storage unit main body 42) (S13).

  In step S6, it is determined that the management information is registered in the management memory 41 when the security function is working effectively. The unique information acquired from the computer 3 that is the connection destination and the management memory The unique information read from 41 is compared (S7 in FIG. 3). If there is a match in this comparison, it is found that there is no problem in authentication, and the external storage device 4 can be used (S13 in FIG. 3). If the comparison does not match, log information (41b in FIG. 2) is obtained. ) Is recorded (S8 in FIG. 3), and an error check is performed (S9). Here, it is determined whether or not the number of errors recorded in the log information exceeds the range of a specified number n (for example, n = 5). The device is automatically initialized (S10 in FIG. 3) to prevent illegal use of the storage unit body. When it is determined in step S9 that it is within the specified range, and after the processing in step S10, the external storage device is disabled (S11 in FIG. 3).

  When the mode switch (44 in FIG. 2) is set to the initialization mode, the external storage device is initialized, management information is cleared and data is deleted, and the mode is switched to the normal mode. And can be reused.

  (Supplementary note 1) An external storage device with a security function used in connection with a computer is provided with a unique information holding unit for holding unique information in the computer, and the external storage device is registered with a control unit and management information. And a switch that can be switched to either the initialization mode or the normal mode, and the control unit clears the management memory in the initialization mode connected to the computer to Initialization means for initializing and setting the normal mode; means for reading the unique information of the unique information holding unit of the computer in the normal mode; and the management information when the unique information is not registered in the management memory Unique information storage means for registering the read unique information in the memory, and if the unique information is registered in the management memory Comparing means for comparing the recorded unique information with the read unique information, and the external storage device in either case of registration of unique information by the unique information storage means or coincidence detection by the comparing means An external storage device with a security function, wherein the storage unit main body can be used.

  (Supplementary note 2) The external storage device with a security function according to supplementary note 1, wherein the unique information holding unit of the computer holds either a manufacturing machine number or a MAC address of a component basically held by the computer.

  (Supplementary note 3) The external storage device with a security function according to supplementary note 1, wherein the management memory is configured by a nonvolatile memory.

  (Supplementary note 4) In Supplementary note 1, a log information holding area is provided in the management memory, and the controller records an error in the log information holding area of the management memory when a mismatch is detected by the comparison means. An external storage device with a security function, wherein the external storage device is made unusable when the error count of log information is determined and detected to be within a specified range.

  (Supplementary note 5) In Supplementary note 4, when the control unit detects that the number of errors in the log information exceeds the specified range, it initializes the storage area of the external storage device and cannot use the external storage device. An external storage device with a security function, characterized by being in a state.

  (Supplementary Note 6) In the security management method for an external storage device connected to a computer having means for holding unique information, the control unit of the external storage device includes a management memory for registering security information in the computer, and initialization. A switch that can be switched to either the mode or the normal mode, and the control unit clears the management memory and initializes the storage unit body in the initialization mode, and sets the storage unit body of the external storage device. In the normal mode, the unique information in the unique information holding unit of the computer is read, and if the unique information is not registered in the management memory, the read unique information is registered in the management memory. If unique information is registered in the management memory, the registered unique information is compared with the read unique information. Wherein either management memory to register the unique information, security management method of an external storage device, characterized in that matching in the comparison enable the detected external storage device.

It is a figure which shows the principle structure of this invention. It is a figure which shows the structure of an Example. It is a figure which shows the flowchart of an Example. It is a figure which shows the prior art example which provided the security function in the external storage device.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Computer 10 Specific information holding | maintenance part 2 External storage device 20 Control part 20a Specific information reading means 20b Specific information storage means 20c Specific information comparison means 20d Initialization means 21 Management memory 21a Specific information storage part 21b Log information storage part 22 Storage part Main body 23 Display means 24 Mode switch

Claims (4)

In an external storage device with a security function that is used in connection with a computer,
A unique information holding unit for holding unique information in the computer;
The external storage device includes a control unit, a management memory in which management information is registered, and a switch that can be switched between an initialization mode and a normal mode,
In the initialization mode connected to the computer, the control unit clears the management memory and initializes the storage unit body to set the normal mode, and in the normal mode state, the computer-specific information Means for reading the unique information of the holding unit, unique information storing means for registering the read unique information in the management memory when the unique information is not registered in the management memory, and unique information in the management memory Comparing means for comparing the registered unique information with the read unique information when registered,
An external storage device with a security function, wherein the storage unit main body of the external storage device can be used when either unique information is registered by the unique information storage means or when coincidence is detected by the comparison means. In claim 1,
A log information holding area is provided in the management memory;
When a mismatch is detected by the comparison means, the control unit records as an error in the log information holding area of the management memory and determines the number of error of the log information to detect that it is within a specified range. Then, the external storage device with a security function, wherein the external storage device is disabled. In claim 2,
The control unit initializes a storage area of the external storage device when it detects that the number of errors in the log information exceeds a specified range, and makes the external storage device unusable. External storage device with security function. In a security management method for an external storage device connected to a computer having means for holding unique information,
The control unit of the external storage device includes a management memory for registering security information in the computer, and a switch that can be switched between an initialization mode and a normal mode.
In the initialization mode, the control unit clears the management memory and initializes the storage unit body to disable the storage unit body of the external storage device.
In the normal mode, the unique information stored in the unique information holding unit of the computer is read. If the unique information is not registered in the management memory, the read unique information is registered in the management memory, and the unique information is stored in the management memory. When the information is registered, the registered unique information is compared with the read unique information,
A security management method for an external storage device, wherein unique information is registered in the management memory or an external storage device is made usable when a match is detected in the comparison.

Images