JP2009259115A - Storage device with security function and storage method with security function - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a storage device having a security function and a storage device having a security function that restricts the handling of data stored in a storage medium formed by the storage device itself and that can enhance user convenience. <P>SOLUTION: The storage device 10 having the security function includes a storage medium 11 for storing information, a position detection means 13 substantially integrated with the storage medium for detecting the position of the storage device, and a comparison means for presetting a place where the storage device 10 is located and comparing the preset place with a measured position. If the measured position is different from the preset place, access to the storage medium 10 is prohibited. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a storage device having a security function. The present invention also relates to a storage device having a security function capable of restricting the handling of data stored in a storage medium formed by the storage device itself and improving user convenience.

In recent years, in order to enhance the security function, a technique in which a terminal device or the like performs mutual authentication and restricts handling of data stored in the terminal device or the like has become widespread.
Patent Document 1 relates to an authentication system in which terminal devices and the like perform mutual authentication, an authentication method thereof, and devices constituting the system, and in particular, the terminal device is prevented from being illegally operated by being taken out from a regular place. Techniques to do this are disclosed.

  Here, the terminal device 10 receives authentication information that only the server 50 can know from the server 50 and authenticates the server 50, and the server 50 authenticates only the terminal device 10 from the terminal device 10 and the terminal device. The terminal device 10 is authenticated by receiving the position information indicating the current position of 10 and verifying the authentication information and verifying that the current position corresponds to the registered position information. Therefore, when rewriting the data or program of the terminal device 10, if the terminal device 10 is not placed in a proper place, mutual authentication with the server 50 is unsuccessful, and the data and program of the terminal device 10 are Rewriting is stopped. Therefore, a technique is disclosed that can prevent an unauthorized operation by taking the terminal device 10 out of a regular place.

  However, this Patent Document 1 discloses an authentication method for downloading data from a server to a terminal device, but this restricts data download, restricts the storage device, and the storage device It does not limit the handling of data stored in the storage medium to be configured. In particular, in recent years, from the viewpoint of protecting personal information and the like, there is a problem that the storage device constituting the storage medium storing the data has been lost, and the storage device itself is difficult to handle.

For this reason, there has been a demand for a storage device having a security function that limits the handling of data stored in the storage medium that it constitutes and that can improve the convenience of the user.
JP2004-70593

  The present invention has been made in view of the above circumstances, and an object thereof is to provide a storage device having a security function. Another object of the present invention is to provide a storage device having a security function that can limit the handling of data stored in a storage medium formed by the storage device itself and can improve the convenience for the user. To do.

  A storage device having a security function according to the present invention includes a storage medium for storing information, a position detection unit configured to be substantially integrated with the storage medium and detecting the position of the storage device, and the storage device And a comparison unit configured to compare a preset location with the measured location, and when the measured location is different from the preset location, the storage medium Access to is prohibited.

  The storage method having the security function according to the present invention is configured substantially integrally with a storage medium, and the step of detecting the position of the storage device and the location where the storage device is located are preset and preset. And a step of comparing the measured position with the measured position, and when the measured position is different from the preset position, access to the storage medium is prohibited.

  According to the above configuration, it is possible to provide a storage device having a security function. Further, it is possible to provide a storage device having a security function that can limit the handling of data stored in a storage medium configured by the storage device itself and can improve user convenience. There is.

For example, the conventional storage device has the following requirements.
Request 1. PCs that are not allowed to be taken out: HDDs that contain important information can only be used in certain places, such as security-controlled sections, and cannot be accessed when taken outside.

  Request 2. Lending laptops to students at universities, etc .: For example, a student has a low attendance rate, so he wants to stop using his laptop. However, students do not leave the university with their PCs home.

  Request 3. Homeworking: A homeworker, Mr. A, lent a PC to work from home, but there is a situation and wants to immediately prevent Mr. A from seeing the local HDD of the rented PC. However, Mr. A's house is far away.

There was a demand to solve these problems.
Hereinafter, embodiments of the present invention that solve the above-described requirements will be described with reference to the drawings.
FIG. 1 is a block diagram showing a configuration of a storage device having a security function according to an embodiment of the present invention.
Reference numeral 11 denotes a storage medium (HDD, semiconductor memory, etc.), reference numeral 12 denotes a GPS receiving unit, reference numeral 13 denotes a position identification unit, reference numeral 14 denotes a normal position storage unit, and reference numeral 15 denotes a communication unit.
Reference numeral 10 denotes a storage device having a security function, for example, a personal computer (PC). Or it is information communication terminals, such as a mobile telephone and a portable information communication terminal, for example.

  The storage device 10 having this security function includes a storage medium (HDD, semiconductor memory, etc.) 11, a GPS receiving unit 12, a position identifying unit 13, a normal position storing unit 14, and a communication unit 15 therein. .

Data is stored in the storage medium (HDD, semiconductor memory, etc.) 11 as described above.
The position identifying unit 13 includes a terminal for connecting to the GPS receiving unit 12 and an external antenna. GPS is an abbreviation for Global Positioning System (GPS), also called Global Positioning System or Global Positioning System, and is a satellite positioning system for examining the current position on the earth. The GPS receiving unit 12 is a receiving unit that receives this information. In addition, radio waves transmitted from a mobile base station (CDMA) or wireless LAN (Wi-Fi) are received by the antenna.

The normal position storage device 14 is composed of a semiconductor memory or the like, and stores the correct position where the storage device 10 should be located, that is, the normal position, as data.
Then, the position identification unit 13 compares the normal position stored in the normal position storage device 14 with the position of the storage device 10 that is observed and received by the GPS reception unit 12, and identifies the position. It has.

  The communication unit 15 includes a LAN terminal (not shown) and a wireless (CDMA) antenna, and includes means for transmitting / receiving an encryption authentication protocol to / from the storage device management server 10 described later and acquiring a domain name from the LAN.

In addition, the correct position storage device 14 is configured such that only an administrator who is restricted by a password or the like can write the correct position of the storage device 10.
Reference numeral 16 denotes an access blocking unit. For example, a firewall is provided, and a means for blocking access from the PC host to the storage medium 10 through the bus is provided.

  Here, the firewall will be described. A firewall is software that controls communication between a specific computer network and the outside of the computer network and maintains the security of the internal computer network, or hardware equipped with the software. . A cracking attempt to penetrate an internal computer network from the outside is compared to a fire, and the expression “firewall” is used to stop it.

In the embodiment of the present invention, the means for blocking access (firewall) may be configured by software or hardware.
FIG. 2 is a diagram showing a system configuration including a storage device having a security function according to the embodiment of the present invention and a server provided outside.
Reference numeral 31 denotes a position observation satellite, reference numeral 32 denotes a mobile phone base station, and reference numeral 33 denotes a wireless LAN. These are connected to the storage device 10 as described above.
Reference numeral 20 denotes a storage device management server. As described above, the storage device 10 includes the storage device management server 20, the position observation satellite 31, the mobile phone base station 32, the wireless LAN 33, and the like, for example, every time when the storage device 10 is turned on, It is possible to select the timing, such as every time an access request is received.

The storage device 10 has a unique ID (here, storage device number 01) for each storage device, and is stored inside each device.
In FIG. 2, on the right side of the storage device management server 20, an access permission list for the storage device number 01 (that is, the storage device 10) stored in the storage device management server 20 is shown.

  Here, accessible locations are indicated by north latitude, east longitude, and domain name, and authorized users are user A and user B (password management). Similarly, the access permission / prohibition list for the storage device number 02 is indicated by north latitude, east longitude, and domain name.

  If the user can access the list recorded in the management server 20 and the notified position matches the normal position registered in the list, the management server 20 uses the encrypted authentication protocol. Is used to notify the storage device 10 of permission that only the management server 20 can issue.

FIG. 3 is a flowchart for explaining the operation of the storage device having the security function according to the embodiment of the present invention.
Reference numeral 100 is a start step here. Subsequently, the process proceeds to the step denoted by reference numeral 101.
Reference numeral 101 denotes a step of measuring the position of the storage device 10 at a predetermined authentication timing using GPS as described above. Then, it progresses to the step which attached | subjected code | symbol S103.

  Reference numeral 103 denotes a step in which the storage device 10 determines whether the measured position is a correct position stored in the primary position storage device 14 in the storage device 10. When it is determined that the position of the storage device 10 is a preset location, the process proceeds to the step denoted by reference numeral 104 (Yes). If the location of the storage device 10 is not determined to be a preset location, the process proceeds to the step denoted by reference numeral 105 (No).

Reference numeral 104 denotes a step in which the storage device 10 raises the firewall. Then, it progresses to the step which attached | subjected the code | symbol 101, and repeats the said process.
Reference numeral 105 denotes a step in which the storage device 10 prohibits access to the external storage medium 11 without raising a firewall.
That is, in the storage device having a security function according to the embodiment of the present invention, a storage medium that stores information, and a position that is substantially integrated with the storage medium and detects the position of the storage device A detecting unit and a communication unit configured to communicate with an externally provided server in which a location where the storage device is located is preset, and the storage device is not located in a location preset in the server In this case, communication with the server provided outside is stopped.

  In other words, in the embodiment of the present invention, for example, the storage device 10 is set in a computer center or the like with entry security, and is suitable for a situation in which it cannot be moved out of the computer center or the like.

  Then, the position identification device 13 operates at a predetermined authentication timing and measures the position of the storage device 10. When the position of the storage device 10 is not set in the regular position storage device by the administrator in advance or when the position cannot be measured, the firewall is not raised.

  As the position information here, it is possible to select the background measured by the GPS 21, the position measured via the mobile base station 32, the domain name acquired from the wireless LAN 33 or the wired LAN, and combinations of these ranges.

  In the embodiment of the present invention, if the storage device 10 is determined not to be in the correct position by using the position identification device 13 such as the GPS 12, the firewall is closed. It is possible to deal with such problems.

FIG. 4 is a flowchart for explaining the operation of a storage device having a security function according to another embodiment of the present invention.
Reference numeral 200 is a start step here. Subsequently, the process proceeds to the step denoted by reference numeral 201.
Reference numeral 201 denotes a step in which the storage device 10 communicates with the management server 20 at a predetermined authentication timing as described above. Subsequently, the process proceeds to the step denoted by reference numeral 202.

Reference numeral 202 denotes a step in which the storage device 10 notifies the management server 20 of the storage device number (ID) and the user name. Subsequently, the process proceeds to the step denoted by reference numeral 203.
Reference numeral 203 denotes a step in which the management server 20 checks a list stored in advance in the management server 20. Subsequently, the process proceeds to the step denoted by reference numeral 204.
Reference numeral 204 denotes a step of determining whether or not the storage device 10 is accessible in this list. When it is determined that the storage device 10 is accessible, the process proceeds to the step denoted by reference numeral 205 (Yes). If it is not determined that the storage device 10 is accessible, the process proceeds to the step denoted by reference numeral 207 (No).

Reference numeral 205 denotes a step in which the management server 20 notifies the storage device 10 of access permission. Subsequently, the process proceeds to the step denoted by reference numeral 206.
Reference numeral 206 denotes a step in which the storage device 10 raises the firewall. Subsequently, the process proceeds to the step denoted by reference numeral 201.
Reference numeral 207 denotes a step in which the management server 20 stops communication with the storage device 10. Subsequently, the process proceeds to the step denoted by reference numeral 201 and the above process is repeated.
That is, in a storage device having a security function according to an embodiment of the present invention, a storage medium for storing information and a server that is substantially integrated with the storage medium and provided externally are communicated. And a communication information to be outputted, and an authentication information output means for outputting information related to authentication of the storage device to the externally provided server, and the storage device can be accessed in a list stored in the server in advance. If not, communication with the externally provided server is stopped.

  In the embodiment of the present invention, specification authentication is performed using the communication device 15 (LAN, wireless). Therefore, the user cannot access the storage device 10 unless the management server 20 gives permission. Therefore, it is possible to cope with the problems such as the above request 2 and request 3.

  FIG. 5 is a flowchart for explaining the operation of the storage device having the security function according to the embodiment, which is a combination of the embodiment described in FIG. 3 and the embodiment described in FIG.

Reference numeral 100 is a start step here. Subsequently, the process proceeds to the step denoted by reference numeral 101.
Reference numeral 101 denotes a step of measuring the position of the storage device 10 at a predetermined authentication timing using GPS as described above. Then, it progresses to the step which attached | subjected code | symbol S102.

Reference numeral 102 denotes a step in which the storage device 10 sends a measurement result to the management server 20. Then, it progresses to the step which attached | subjected code | symbol S103.
Reference numeral 103 is a step in which the management server 20 compares the registered normal position with the measurement result sent from the storage device 10 to determine whether or not the storage device 10 is in the normal position. If it is determined that the storage device 10 is in the normal position registered in the management server 20, the process proceeds to a step denoted by reference numeral 104 (Yes). If it is not determined that the storage device 10 is in the normal position registered in the management server 20, the process proceeds to the step denoted by reference numeral 105 (No).

Reference numeral 104 denotes a step in which the storage device 10 raises the firewall. Then, it progresses to the step which attached | subjected the code | symbol 201. FIG.
Reference numeral 105 denotes a step in which the management server 20 stops communication with the storage device 10.
Reference numeral 201 denotes a step in which the storage device 10 communicates with the management server 20 at a predetermined authentication timing as described above. Subsequently, the process proceeds to the step denoted by reference numeral 202.

Reference numeral 202 denotes a step in which the storage device 10 notifies the management server 20 of the storage device number (ID) and the user name. Subsequently, the process proceeds to the step denoted by reference numeral 203.
Reference numeral 203 denotes a step in which the management server 20 checks a list stored in advance in the management server 20. Subsequently, the process proceeds to the step denoted by reference numeral 204.
Reference numeral 204 denotes a step of determining whether or not the storage device 10 is accessible in this list. When it is determined that the storage device 10 is accessible, the process proceeds to the step denoted by reference numeral 205 (Yes). If it is not determined that the storage device 10 is accessible, the process proceeds to the step denoted by reference numeral 207 (No).

Reference numeral 205 denotes a step in which the management server 20 notifies the storage device 10 of access permission. Subsequently, the process proceeds to the step denoted by reference numeral 206.
Reference numeral 206 denotes a step in which the management server 20 continues communication with the storage device 10. Subsequently, the process proceeds to the step denoted by reference numeral 101 and the above process is repeated.
Reference numeral 207 denotes a step in which the management server 20 stops communication with the storage device 10.
That is, in the storage device having a security function according to the embodiment of the present invention, a storage medium that stores information, and a position that is substantially integrated with the storage medium and detects the position of the storage device A detecting unit and a communication unit configured to communicate with an externally provided server in which a location where the storage device is located is preset, and the storage device is not located in a location preset in the server In this case, communication with the server provided outside is stopped.

  In the storage device having a security function according to the embodiment of the present invention, a storage medium for storing information and a server that is substantially integrated with the storage medium and provided externally are communicated. And a communication information to be performed and an authentication information output means for outputting information related to authentication of the storage device to the externally provided server, the storage device being accessible in a list stored in advance in the server If not, the communication with the server provided outside is stopped.

  In the embodiment of the present invention, if the storage device 10 is determined not to be in the correct position by using the position identification device 13 such as the GPS 12, the firewall is closed. It is possible to deal with such problems. In the embodiment of the present invention, since the specification authentication is performed using the communication device 15 (LAN, wireless), the user cannot access the storage device 10 unless the management server 20 gives permission. . Therefore, it is possible to cope with the problems such as the above request 2 and request 3.

  In the above description, the embodiment described with reference to FIG. 3 will be described first using the operation performed after the embodiment described with reference to FIG. 4, but the order described in FIG. It is also possible to configure so that the embodiment described with reference to FIG.

  With the configuration as described above, there is an effect that it is possible to provide a storage device having a security function. Further, it is possible to provide a storage device having a security function that can limit the handling of data stored in a storage medium configured by the storage device itself and can improve user convenience. There is.

  Note that the present invention is not limited to the above-described embodiments as they are, and can be embodied by variously modifying the constituent elements without departing from the spirit in the implementation stage.

The block diagram which shows the structure of the memory | storage device provided with the security function which concerns on embodiment of this invention. The figure which shows the system configuration | structure containing the memory | storage device provided with the security function which concerns on embodiment of this invention, and the server provided outside. The flowchart explaining operation | movement of the memory | storage device provided with the security function which concerns on embodiment of this invention. The flowchart explaining operation | movement of the memory | storage device provided with the security function which concerns on other embodiment of this invention. FIG. 5 is a flowchart for explaining the operation of the storage device having the security function according to the embodiment, in which the embodiment described in FIG. 3 and the embodiment described in FIG. 4 are combined.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 10 ... Memory | storage device provided with a security function, 11 ... Storage medium (HDD, semiconductor memory, etc.), 12 ... GPS receiving part, 13 ... Position identification part, 14 ... Normal position storage part, 15 ... Communication part, 16 ... Access blocking part , 20 ... storage device management server, 31 ... position observation satellite, 32 ... mobile phone base station, 33 ... wireless LAN.

Claims (7)

In a storage device having a security function for information stored in a storage medium,
A storage medium for storing information;
A position detection means configured to be substantially integrated with the storage medium and detecting the position of the storage device;
When the location where the storage device is located is preset, and includes a comparison unit that compares the preset location with the measured location, and the measured location is different from the preset location A storage device having a security function that prohibits access to the storage medium.   The storage device having a security function according to claim 1, wherein access to the storage medium is permitted when the measured position is not different from the preset location. In a storage device having a security function for information stored in a storage medium,
A storage medium for storing information;
A communication unit configured substantially integrally with the storage medium and communicating with a server provided outside;
An authentication information output unit that outputs information related to authentication of the storage device to the externally provided server, and the storage device is not accessible in a list stored in advance in the server Is a storage device having a security function, wherein communication with the externally provided server is stopped.   4. The security according to claim 3, wherein when the storage device is accessible in a list stored in advance in the server, communication with the server provided outside is further continued. A storage device having a function. In a storage device having a security function for information stored in a storage medium,
A storage medium for storing information;
A position detection means configured to be substantially integrated with the storage medium and detecting the position of the storage device;
A communication unit configured substantially integrally with the storage medium and communicating with a server provided outside;
The location where the storage device is located is preset in a server provided outside, the preset location is compared with the measured location, and the measured location is the preset location. If different, means for canceling communication between the storage medium and the externally provided server;
An authentication information output unit that outputs information related to authentication of the storage device to the externally provided server, and the storage device is not accessible in a list stored in advance in the server Is a storage device having a security function, wherein communication with the externally provided server is stopped. Detecting a position of the storage device configured substantially integrally with the storage medium;
Where the location where the storage device is located is preset and comprises comparing the preset location with the measured location, and if the measured location is different from the preset location, A storage method comprising a security function for prohibiting access to the storage medium. Communicating with an externally provided server using communication means configured to communicate with an externally provided server configured substantially integrally with a storage medium;
Outputting information related to authentication of the storage device to the externally provided server;
If the storage device is not accessible in a list stored in advance in the server, the storage method includes a step of canceling communication with the server provided outside the storage device. .

Images