JP2020126440A - Authentication system - Google Patents

Abstract

To safely authenticate an external storage device connected to a host device, without installing an application for authentication in the host device.SOLUTION: A first host authentication control unit 15 causes a first external storage device 6 to establish authentication for a host device 3 when host identification information and first host authentication data are matched. A second host authentication control unit 25 also, in a same method, causes a second external storage device 7 to establish authentication for the host device 3. A first external authentication control unit 16 causes the first external storage device 6 to establish authentication for the second external storage device 7 when second external identification information and first external authentication data are matched. A second external authentication control unit 26 also, in a same method, causes the second external storage device 7 to establish authentication for the first external storage device 6. A first access control unit 17 allows prescribed accesses to the first external storage device 6 under the condition that each of the aforementioned authentication is established in full.SELECTED DRAWING: Figure 2

Description

The present invention relates to an authentication system, and more particularly to a technique for authenticating an external storage device connected to a host device.

Data in a host device such as a personal computer is moved using an external storage device such as a hard disk or a USB memory, but secure authentication is required from the viewpoint of data protection.

In order to solve such a problem, an authentication method for mutually authenticating between an external storage medium and a computer has been proposed (for example, refer to Patent Document 1).

In this method, a computer encrypts an authentication message used for authentication with an organization authentication key that is unique to a specific organization and is used for an authentication process, and the encrypted authentication message is transmitted from the computer to an external storage medium. On the other hand, the encrypted authentication message sent by the external storage medium is decrypted by the medium authentication key unique to the storage medium and asymmetric with the organization authentication key, and further, the decrypted authentication message is transmitted by the external storage medium. It is encrypted again with the medium authentication key. The re-encrypted authentication message is sent to the computer, which decrypts the re-encrypted authentication message with the organizational authentication key. The computer determines the success or failure of the authentication by comparing the first authentication message with the authentication message obtained by decrypting the re-encrypted one (see paragraph [0051] of Patent Document 1).

According to this method, it is possible to perform mutual secure authentication between the external storage medium and the computer with a simple configuration.

By the way, in a computer program (hereinafter, also referred to as an “app”), installation of other apps on the computer is prohibited (restricted) from the viewpoint of security, such as a certain kind of measuring instrument software. There is something that has been done.

However, since the above authentication method is based on the assumption that at least the computer has a function of encrypting/decrypting data (see paragraph [0001] of Patent Document 1, FIG. 1 and the like), such a function It is necessary to install the application that realizes to the computer. Therefore, as described above, when an application that prohibits (limits) the installation of other applications on the computer is installed, it is difficult to apply the authentication method.

JP, 2008-147946, A

The present invention solves such a conventional problem, and an authentication system capable of safely authenticating an external storage device connected to the host device without installing an application for authentication in the host device. Etc. are intended to be provided.

An authentication system according to the present invention, a host device including a host storage unit, a first external storage device that is connected to the host device and includes a first external storage unit and a first external control unit, An authentication system comprising: a second external storage device that is connected to a host device and that includes a second external storage unit and a second external control unit, wherein the first external storage unit is , A first external storage device that is permitted to be combined with the first external storage device and data for identifying a host device that is permitted to be combined with the first external storage device. Data for storing a first external authentication data including data for specifying a storage device, and a second external storage unit for specifying a host device permitted to be combined with the second external storage device. And storing second host authentication data including the following, and second external authentication data including data specifying another external storage device that is allowed to be combined with the second external storage device, The first external control unit reads the host identification information, which is information for identifying the host device, via the host device, and the read host identification information and the first external storage unit that is stored in the first external storage unit. A first host authentication control unit that determines whether or not the first host authentication data corresponds, and, on the condition that they correspond, controls to establish authentication of the host device by the first external storage device; , The second external identification information, which is information for identifying the second external storage device, is read via the host device, and the read second external identification information and the first external storage unit are read. It is determined whether or not the stored first external authentication data corresponds, and on condition that they correspond, authentication of the second external storage device by the first external storage device is established. And a first external authentication control unit for controlling the host identification information. The second external control unit reads the host identification information, which is information for identifying the host device, through the host device, and reads the read host identification information. It is determined whether or not the information corresponds to the second host authentication data stored in the second external storage unit, and on condition that they correspond, the host device by the second external storage device A second host authentication control unit that controls to establish authentication of the first external storage device, and first external identification information that is information that identifies the first external storage device, is read via the host device, and the read It is determined whether the external identification information No. 1 corresponds to the second external authentication data stored in the second external storage unit. A second external authentication control unit that controls to establish the authentication of the first external storage device by the second external storage device on the condition that the second external storage device is turned off. The external control unit of at least one of the external control unit and the second external control unit further includes authentication of the host device by the first external storage device, authentication of the host device by the second external storage device, On the condition that both the authentication of the second external storage device by the first external storage device and the authentication of the first external storage device by the second external storage device are established, the one external control The external storage device including the unit is provided with an access control unit that controls to allow predetermined access.

The features of the present invention can be broadly shown as above, but the configuration and contents thereof will be further clarified by the following disclosure in consideration of the drawings together with the objects and features.

The authentication system according to the first invention of the present application is a first external storage device that includes a host device that includes a host storage device, and a first external storage device and a first external control device that are connected to the host device. An authentication system comprising: a device; and a second external storage device connected to a host device and including a second external storage unit and a second external control unit, the first external connection device comprising: The storage unit allows the combination of the first external storage device and the first host authentication data including the data specifying the host device which is allowed to be combined with the first external storage device. And a first external authentication data including data specifying the external storage device, and the second external storage unit is a host device that is permitted to be combined with the second external storage device. The second external authentication data including the specifying data and the second external authentication data including the data specifying the other external storage device that is allowed to be combined with the second external storage device. The first external control unit stores the host identification information, which is information for identifying the host device, via the host device, and stores the read host identification information and the first external storage unit. The first host authentication that determines whether or not the first host authentication data that is present corresponds to the first host authentication data, and controls that the authentication of the host device by the first external storage device is established on the condition that they correspond. The control unit and the second external identification information that is information for identifying the second external storage device are read via the host device, and the read second external identification information and the first external attachment are read. Authentication of the second external storage device by the first external storage device is performed on condition that it corresponds to the first external authentication data stored in the storage unit and the condition is satisfied. A first external authentication control unit for controlling to satisfy the above condition, and the second external control unit reads the host identification information, which is information for specifying the host device, through the host device and reads the host identification information. The second external storage device is determined on the condition that the host identification information and the second host authentication data stored in the second external storage unit correspond to each other, and the correspondence is established. A second host authentication control unit that controls the host device to be authenticated by the host device, and the first external identification information that is information that identifies the first external storage device is read and read via the host device. Whether or not the first externally attached identification information and the second externally attached authentication data stored in the second externally attached storage unit correspond to each other. And a second external authentication control unit that controls to establish authentication of the first external storage device by the second external storage device on the condition that the first external storage device is authenticated. The external control unit of at least one of the external control unit and the external control unit of the second external storage unit further includes authentication of the host device by the first external storage device and authentication of the host device by the second external storage device. One of the external devices is provided on condition that the authentication, the authentication of the second external storage device by the first external storage device, and the authentication of the first external storage device by the second external storage device are all established. An external storage device including a control unit is provided with an access control unit that controls to permit predetermined access.

That is, in this authentication system, the host device is authenticated by the first external storage device and the second external storage device, and the mutual authentication between the first external storage device and the second external storage device is performed. On the condition that all are satisfied, predetermined access is allowed to at least one of the first external storage device and the second external storage device.

Thus, in addition to the establishment of the authentication of the host device by the two external storage devices, the establishment of the mutual authentication between the two external storage devices is an essential requirement for the authentication establishment for access. More secure authentication can be realized as compared with the case where only establishment of mutual authentication between the host device and one external storage device is an essential requirement for authentication establishment.

Then, each process in this authentication system, that is, a process of authenticating a host device by two external storage devices, a process of performing mutual authentication between the two external storage devices, and at least one external storage device The processing for permitting a predetermined access to each is configured to be executed by the external control unit of one and/or both external storage devices by themselves or by controlling the host device.

Therefore, for example, when these processes are executed by using an application, even if the external control units of one and/or both external storage devices execute the processing independently (standalone), the execution of the application is finalized. Even if the CPU of the host device is in charge, the application itself may be installed in one and/or both external storage devices, and need not be installed in the host device.

That is, it is possible to realize an authentication system capable of safely authenticating an external storage device connected to the host device without installing an application for authentication in the host device.

An authentication system according to a second invention of the present application is the authentication system according to the first invention of the present application, wherein the host device is a first host device in which transmitted data is stored in a first host storage unit as a host storage unit, The predetermined access permitted by the access control unit is performed by encrypting the transmitted data stored in the first host storage unit of the first host device and then encrypting the transmitted data of the external storage device including the access control unit. It is characterized in that it is a process of writing to an external storage unit.

Therefore, for example, when data transfer between different host devices is performed using an external storage device, secure authentication can be performed without installing an application on the first host device side, and then the first The transmitted data stored in the host device can be encrypted and then copied to the external storage device. Therefore, the data can be safely moved from the first host device to the external storage device.

An authentication system according to a third invention of the present application is the authentication system according to the first invention of the present application, wherein the host device is a second host device including a second host storage unit as a host storage unit, and an access control unit is provided. The external storage unit of the provided external storage device further stores encrypted transmitted data, and the predetermined access permitted by the access control unit is an external storage device provided with the access control unit. Is a process of decrypting the encrypted transmitted data stored in the external storage unit and then writing the decrypted data in the second host storage unit of the second host device.

Therefore, for example, when data transfer between different host devices is performed using an external storage device, secure authentication can be performed without installing an application on the second host device side, and thereafter, external authentication can be performed. The encrypted transmitted data stored in the storage device can be decrypted and then copied to the second host device. Therefore, the data can be safely moved from the external storage device to the second host device.

The first external storage device according to the fourth invention of the present application is characterized by being used in the authentication system according to any one of the first to third inventions of the present application.

Therefore, by using the first external storage device for the authentication system, the same effect as that of the first to third inventions can be obtained.

The second external storage device according to the fifth invention of the present application is characterized by being used in the authentication system according to any one of the first to third inventions of the present application.

Therefore, by using the second external storage device for the authentication system, the same effect as that of the first to third inventions can be obtained.

A program according to a sixth invention of the present application is a program for causing a computer to execute the function of the first external storage device according to the fourth invention of the present application.

Therefore, by causing the computer to execute the program, the same effect as the fourth aspect of the invention can be obtained.

A recording medium according to the seventh invention of the present application is a recording medium storing the program according to the sixth invention of the present application.

Therefore, by causing a computer to execute the program stored in this recording medium, the same effect as the sixth aspect of the invention can be obtained.

A program according to the eighth invention of the present application is a program for causing a computer to execute the function of the second external storage device according to the fifth invention of the present application.

Therefore, by causing the computer to execute the program, the same effect as the fifth aspect of the invention is achieved.

A recording medium according to the ninth invention of the present application is a recording medium storing the program according to the eighth invention of the present application.

Therefore, by causing a computer to execute the program stored in this recording medium, the same effect as that of the eighth aspect of the invention can be obtained.

The authentication method according to the tenth invention of the present application is a host device including a host storage unit, a first external storage device connected to the host device and including a first external storage unit, and connected to the host device. And a second external storage device having a second external storage unit, wherein the first external storage unit is a combination with the first external storage device. A first host authentication data including data specifying a permitted host device and a first external device including data specifying another external storage device permitted to be combined with the first external storage device. The second external storage unit stores second authentication data, the second external storage unit including second authentication data including data specifying a host device permitted to be combined with the second external storage device. And a second external authentication data including data specifying another external storage device that is allowed to be combined with the second external storage device, and the first external storage device is stored. Host identification information, which is information for identifying the host device, is read via the host device, the read host identification information, and the first host authentication data stored in the first external storage unit. Determines whether or not corresponds, and on the condition that they correspond, a first host authentication control step of controlling to establish authentication of the host device by the first external storage device, and a second external storage device. The device reads the host identification information, which is information identifying the host device, via the host device, the read host identification information, and the second host authentication stored in the second external storage unit. A second host authentication control step of controlling whether or not the host data is authenticated by the second external storage device, on the condition that they correspond to each other. The external storage device reads the second external identification information, which is information for identifying the second external storage device, via the host device, and the read second external identification information and the first external identification information. The second external storage device by the first external storage device is determined on the condition that the first external authentication data stored in the external storage unit corresponds to the first external authentication data. A first external authentication control step of controlling to establish the authentication of the second external storage device, and the second external storage device stores the first external identification information, which is information for identifying the first external storage device, in the host. The first external identification information read by the device and the second external storage unit are recorded. It is determined whether or not the stored second external authentication data corresponds, and on the condition that they correspond, authentication of the first external storage device by the second external storage device is established. And a second external authentication control step for controlling the external external storage device of at least one of the first external storage device and the second external storage device. Authentication, authentication of a host device by a second external storage device, authentication of a second external storage device by a first external storage device, and authentication of a first external storage device by a second external storage device On the condition that all of the above are satisfied, an access control step of controlling to permit predetermined access to the one external storage device is provided.

Therefore, by implementing the method using the host device, the first external storage device, and the second external storage device, the same effect as the first aspect of the invention can be obtained.

An authentication method according to an eleventh invention of the present application is the authentication method according to the tenth invention of the present application, wherein the host device is a first host device in which transmitted data is stored in a first host storage unit as a host storage unit, The predetermined access permitted in the access control step is an external storage device that encrypts the transmitted data stored in the first host storage unit of the first host device and then executes the access control step. Is a process of writing to the external storage unit.

With this configuration, the same effect as the second aspect of the invention can be obtained.

An authentication method according to a twelfth invention of the present application is the authentication method according to the tenth invention of the present application, wherein the host device is a second host device including a second host storage unit as a host storage unit, and an access control step is provided. The external storage unit of the executing external storage device is further configured to store the encrypted transmitted data, and the predetermined access permitted in the access control step is the external connection executing the access control step. This is a process of decrypting the encrypted transmitted data stored in the external storage unit of the storage device and then writing the decrypted data in the second host storage unit of the second host device.

With this configuration, the same effect as the third aspect of the invention can be obtained.

FIG. 1 is a block diagram showing the overall configuration of an authentication system 2 according to an embodiment of the present invention. FIG. 2 is a block diagram illustrating the configuration of the host device 3, the first external storage device 6, and the second external storage device 7, which are the components of the authentication system 2. FIG. 3 is a block diagram showing an example of the hardware configuration of the host device 3 shown in FIG. 2, and the first external storage device 6 and the second external storage device 7. FIG. 4 is a flowchart showing an example of the flow of processing (transmission authentication processing) performed during transmission of transmitted data between the transmission-side computer 4, the external hard disk 6, and the USB memory 7. FIG. 5 is a flowchart showing an example of a detailed processing flow of one step constituting the transmission authentication processing. FIG. 6 is a flowchart showing an example of a detailed processing flow of other steps constituting the transmission authentication processing. FIG. 7 is a flowchart showing an example of a detailed processing flow of still another step constituting the transmission authentication processing. FIG. 8 is a flowchart showing an example of a detailed processing flow of still another step constituting the transmission authentication processing. FIG. 9 is a flowchart showing an example of the flow of processing (reception authentication processing) performed when receiving transmitted data between the receiving-side computer 5, the external hard disk 6, and the USB memory 7. FIG. 10A is a drawing showing an example of the data structure of the first host authentication data. FIG. 10B is a diagram showing an example of the data structure of the first external authentication data.

FIG. 1 is a block diagram showing the overall configuration of an authentication system 2 according to an embodiment of the present invention.

The authentication system 2 includes a host device 3, a first external storage device 6, and a second external storage device 7. Both the first external storage device 6 and the second external storage device 7 are configured to be connectable/disconnectable (disconnecting) to/from the host device 3, but in the state shown in FIG. The first external storage device 6 is connected to the host device 3 and can communicate with the host device 3. The second external storage device 7 is connected to the host device 3 and can communicate with the host device 3. Unless otherwise specified, “connected” means “connected in a communicable state”.

FIG. 2 is a block diagram illustrating the configuration of the host device 3, the first external storage device 6, and the second external storage device 7, which are the components of the authentication system 2.

As shown in FIG. 2, the host device 3 includes a host storage unit 10 and a host control unit 9.

The first external storage device 6 includes a first external storage unit 13 and a first external control unit 14. The second external storage device 7 includes a second external storage unit 23 and a second external control unit 24.

The first external storage unit 13 of the first external storage device 6 includes first host authentication data including data specifying a host device that is permitted to be combined with the first external storage device 6. , And a first external authentication data including data specifying another external storage device that is permitted to be combined with the first external storage device 6.

The second external storage unit 23 of the second external storage device 7 stores second host authentication data including data specifying a host device that is permitted to be combined with the second external storage device 7. , Second external authentication data including data specifying another external storage device that is permitted to be combined with the second external storage device 7.

The first external control unit 14 of the first external storage device 6 includes a first host authentication control unit 15, a first external authentication control unit 16, and a first access control unit as an access control unit. It is equipped with 17.

The first host authentication control unit 15 reads the host identification information, which is information identifying the host device 3, via the host device 3, and stores the read host identification information and the first external storage unit 13. It is determined whether the first external storage device 6 authenticates the host device 3 on the condition that it corresponds to the first host authentication data that has been stored. The host control unit 9 is controlled so as to cause it.

The first external authentication control unit 16 reads the second external identification information, which is information for identifying the second external storage device 7, via the host device 3, and reads the read second external external information. It is determined whether the identification information and the first external authentication data stored in the first external storage unit 13 correspond, and the first external authentication data is provided on condition that the identification information corresponds. The host controller 9 is controlled so as to determine that the authentication of the second external storage device 7 by the external storage device 6 has been established.

The first access control unit 17 authenticates the host device 3 by the first external storage device 6, authenticates the host device 3 by the second external storage device 7, and authenticates the second external device by the first external storage device 6. A predetermined access to the external storage device 6 on condition that the authentication of the external storage device 7 and the authentication of the first external storage device 6 by the second external storage device 7 are all established. The host control unit 9 is controlled so as to determine that is allowed.

The second external control unit 24 of the second external storage device 7 includes a second host authentication control unit 25 and a second external authentication control unit 26.

The second host authentication control unit 25 reads the host identification information, which is information for identifying the host device 3, via the host device 3, and stores the read host identification information and the second external storage unit 23. The second external storage device 7 determines that the authentication of the host device 3 has been established, on the condition that the second host authentication data has been verified. The host control unit 9 is controlled so as to cause it.

The second external authentication control unit 26 reads the first external identification information, which is information for identifying the first external storage device 6, via the host device 3, and reads the read first external external information. It is determined whether or not the identification information corresponds to the second external authentication data stored in the second external storage unit 23, and the second external authentication data is provided on condition that the identification information corresponds. The host controller 9 is controlled so that it is determined that the authentication of the first external storage device 6 by the external storage device 7 has been established.

In this embodiment, the case where the host device 3 corresponds to the first host device 4 and the case where the host device 3 corresponds to the second host device 5 are illustrated.

When the host device 3 corresponds to the first host device 4, the first host device 4 stores the transmitted data in the first host storage unit 11 as the host storage unit 10.

In this case, the predetermined access determined to be permitted by the first access control unit 17 of the first external storage device 6 connected to the first host device 4 is the first access of the first host device 4. This is a process of encrypting the transmitted data stored in the host storage unit 11 and writing the encrypted data in the first external storage unit 13 of the first external storage device 6.

On the other hand, when the host device 3 corresponds to the second host device 5, the second host device 5 includes the second host storage unit 12 as the host storage unit 10.

In this case, the first external storage unit 13 of the first external storage device 6 connected to the second host device 5 further stores encrypted transmitted data. Then, the predetermined access determined to be permitted by the first access control unit 17 is performed by decrypting the encrypted transmitted data stored in the first external storage unit 13 and then performing the second access. This is a process of writing to the second host storage unit 12 of the host device 5.

The host device 3 in the present invention is not limited to the case corresponding to the first host device 4 or the case corresponding to the second host device 5.

Further, the predetermined access determined to be permitted by the first access control unit 17 of the first external storage device 6 is not limited to the above processing (operation).

The predetermined access permitted by the first access control unit 17 may be configured to include, for example, a process of browsing, writing, and/or erasing some data in the first external storage unit 13. it can.

Further, in this embodiment, the second external controller 24 of the second external storage device 7 does not include an access controller. Therefore, the second external storage device 7 functions as an external storage device dedicated to authentication.

However, the present invention is not limited to this, and the same configuration as the access control unit 17 described above is provided only in the second external control unit 24 of the second external storage device 7. Alternatively, both the second external control unit 14 of the first external storage device 6 and the second external control unit 24 of the second external storage device 7 may be provided.

Both the second external control unit 14 of the first external storage device 6 and the second external control unit 24 of the second external storage device 7 are provided with the same configuration as the access control unit 17. With this configuration, for example, the transmitted data stored in the host device is copied (distributed or duplicated) to both the first external storage device 6 and the second external storage device 7 and moved. It becomes possible.

FIG. 3 is a block diagram showing an example of the hardware configuration of the host device 3 and the first external storage device 6 and the second external storage device 7 shown in FIG. 3 is used, and an external hard disk 6 and a USB memory 7 are used as the first external storage device 6 and the second external storage device 7, respectively.

In FIG. 3, the hardware configuration of the computer 3 as the host device 3 is a general concept of the sending-side computer 4 as the first host device 4 and the receiving-side computer 5 as the second host device 5. Is illustrated.

The computer 3 is not particularly limited, but in this example, it has the same configuration as a general personal computer.

The computer 3 includes an auxiliary storage device 55 configured as an HDD (hard disk drive) including a hard disk or an SSD (solid state drive) equipped with a flash memory, which functions as the host storage unit 10, an external hard disk 6, or a USB memory 7. A CPU 51 corresponding to the host controller 9 that executes the installed program under the control of the external hard disk 6 or the USB memory 7, a main storage device 54 that functions as a work area of the CPU 51, an LCD (liquid crystal display device), and the like. The display device 52, an input device 53 such as a keyboard, a mouse, and a track pad, and an interface unit 56 used for communication with the external hard disk 6 and the USB memory 7 connected to the computer 3.

The external hard disk 6 is not particularly limited, but in this example, it has the same configuration as a general external hard disk except that it has an encryption/decryption circuit 63. A ROM (Read Only Memory) area 65 that functions as a recording medium that stores a program (firmware) used for controlling the attached hard disk 6 and the like, a program (app) on the external hard disk 6 side in the authentication system 2, and transmitted data. A first external device that executes the firmware stored in the user data area 62 and the ROM area 65 that store other arbitrary data, and controls the CPU 51 of the computer 3 to execute the application stored in the ROM area 65. A MCU (Micro Controller Unit) 61 that functions as the attachment control unit 14, a RAM (Random access memory) area 64 that functions as a work area of the MCU 61, and hardware for encryption and decryption using an AES (Advanced Encryption Standard) 256 algorithm or the like. An encryption/decryption circuit 63 to be executed and an interface unit 66 used for communication with the computer 3 and the like connected to the external hard disk 6 are provided.

The USB memory 7 is not particularly limited, but in this example, it has the same configuration as a general USB memory, and its basic hardware configuration is the same as that of the external hard disk 6. Therefore, the description is omitted. When the USB memory 7 is used as an external storage device dedicated to authentication, the encryption/decryption circuit 63 is not always necessary.

Next, FIG. 4 is a flowchart showing an example of the flow of processing (transmission authentication processing) performed during transmission of transmitted data between the transmission-side computer 4, the external hard disk 6 and the USB memory 7.

5 to 8 are flowcharts showing an example of a detailed processing flow of each step constituting the transmission authentication processing.

FIG. 9 is a flowchart showing an example of the flow of the process (reception authentication process) performed when receiving the transmitted data between the receiving-side computer 5, the external hard disk 6 and the USB memory 7.

FIG. 10A is a drawing showing an example of the data structure of the first host authentication data. The data structure of the second host authentication data is the same as that of the first host authentication data, and thus the description thereof is omitted.

FIG. 10B is a diagram showing an example of the data structure of the first external authentication data. Since the data structure of the second external authentication data is the same as that of the first external authentication data, its description is omitted.

Next, an example of the authentication process in the authentication system 2 will be described. In this example, an authentication process when moving the transmitted data from the sending computer 4 to the receiving computer 5 using the external hard disk 6 and the USB memory 7 will be described as an example.

First, the transmission authentication process shown in FIGS. 4 to 8 will be described. The sending authentication process is an authentication process when the transmitted data stored in the sending computer 4 is copied (encrypted) to the external hard disk 6.

Prior to the transmission authentication processing, it is assumed that plaintext transmitted data is stored in the auxiliary storage device 55 corresponding to the first host storage unit 11 of the transmission side computer 4.

The external hard disk 6 and the USB memory 7 are connected to the sending computer 4, and the program on the external hard disk 6 side in the authentication system 2 installed in the external hard disk 6 (hereinafter referred to as “external hard disk side application”). , And a program on the USB memory 7 side in the authentication system 2 installed in the USB memory 7 (hereinafter, may be referred to as “USB memory side application”).

In the sending authentication process shown in FIG. 4, as a general rule, the external hard disk 6 (the MCU 61 thereof) or the USB memory 7 (the MCU 61 thereof) controls the sending side computer 4 (the CPU 51 thereof) to send it. The computer 4 (the CPU 51 of the computer) is configured to execute each process, but for convenience of description, each process is described as being executed by the external hard disk 6 (of the MCU 61) or the USB memory 7 (of the MCU 61). To do.

As shown in FIG. 4, in the sending authentication process, first, the sending computer 4 is authenticated by the external hard disk 6 (step S1).

In this embodiment, a case will be described where the processing is performed using an electronic certificate (computer certificate) of the sending computer 4.

In this case, in the auxiliary storage device 55 (corresponding to the first host storage unit 11) of the sending computer 4, for example, the electronic certificate of the sending computer 4 encrypted using the secret key of a predetermined certificate authority, Store in advance.

In the electronic certificate, as data (host identification information) that identifies the sending computer 4, for example, a CPU ID that identifies the CPU 51 of the sending computer 4, and a built-in hard disk drive 55 that identifies the sending computer 4. The HDD serial number and the like are included.

On the other hand, the external hard disk 6 stores a public key certificate (and a predetermined root certificate) in which the public key of the predetermined certificate authority is described. The storage location of the public key certificate is not particularly limited, but, for example, in the ROM area 65 (corresponding to the first external storage unit 13) of the external hard disk 6 as plain text or encrypted. Remembered

Further, in the ROM area 65 of the external hard disk 6 (corresponding to the first external storage unit 13), the first host authentication data is stored in plain text or encrypted.

As illustrated in FIG. 10A, as the first host authentication data, information that is a combination of a CPU ID of the computer and a built-in HDD serial number, which is data that identifies a computer that is allowed to be combined with the external hard disk 6. Is remembered. In the example of FIG. 10A, a plurality of first host authentication data is stored.

In this example, the first host authentication data is stored in the external hard disk side application stored in the ROM area 65, but the first host authentication data is stored in the external hard disk side application. It can also be configured to be stored externally.

Now, as shown in FIG. 5, in the process of step S1, the MCU 61 of the external hard disk 6 (hereinafter sometimes simply referred to as “external hard disk 6”) first, the auxiliary storage device 55 of the sending computer 4. The electronic certificate of the sending-side computer 4 stored in is read out via the sending-side computer 4 (step S10).

Next, the external hard disk 6 acquires the host identification information of the sending computer 4 (the CPU ID of the sending computer 4 and the built-in HDD serial number) described in the electronic certificate (step S11). The host identification information can be acquired, for example, by decrypting the electronic certificate using the public key stored in the public key certificate stored in the external hard disk 6.

The external hard disk 6 then compares the obtained host identification information with the first host authentication data (see FIG. 10A) stored in the external hard disk 6 (step S12).

As a result of the comparison, if the same data as the host identification information of the sending computer 4 is included in the one or more first host authentication data, the external hard disk 6 of the sending computer 4 is used. It is determined that the authentication is established, and the control is moved to step S2 (steps S13 and S14).

As a result of the comparison, if the first host authentication data does not include the same data as the host identification information of the sending computer 4, the authentication of the sending computer 4 by the external hard disk 6 fails. It is determined that the error has occurred, the display device 52 of the sending computer 4 displays an error, and the sending authentication process ends (step S15).

Following step S14, as shown in FIG. 4, authentication processing of the sending computer 4 by the USB memory 7 is performed (step S2).

As described above, the electronic certificate of the sending computer 4 is stored in the auxiliary storage device 55 of the sending computer 4.

On the other hand, in the USB memory 7, as in the case of the external hard disk 6, the public key certificate and one or more second host authentication data are stored in plain text or encrypted.

As shown in FIG. 6, in the process of step S2, the MCU 61 of the USB memory 7 (hereinafter sometimes simply referred to as “USB memory 7”) is first stored in the auxiliary storage device 55 of the sending computer 4. The electronic certificate of the sending computer 4 is read (step S20).

Next, the USB memory 7 acquires the host identification information (the CPU ID of the sending computer 4 and the built-in HDD serial number) of the sending computer 4 described in the electronic certificate (step S21). The host identification information can be obtained, for example, by decrypting the electronic certificate using the public key stored in the public key certificate stored in the USB memory 7.

The USB memory 7 then compares the obtained host identification information with the second host authentication data (see FIG. 10A) stored in the USB memory 7 (step S22).

As a result of the comparison, if one or more second host authentication data includes the same information as the host identification information of the sending computer 4, the sending computer 4 is authenticated by the USB memory 7. Then, the control is moved to step S3 (steps S23 and S24).

On the other hand, as a result of comparison, when the second host authentication data does not include the same information as the host identification information of the sending computer 4, the authentication of the sending computer 4 by the USB memory 7 has failed. Then, an error message is displayed on the display device 52 of the sending computer 4, and the sending authentication process is terminated (step S25).

Following step S24, as shown in FIG. 4, the authentication processing of the USB memory 7 by the external hard disk 6 is performed (step S3).

In this embodiment, the USB memory 7 stores a company ID that identifies the company that owns the USB memory 7 (or the company that has the authority to use the same, hereinafter). The storage location of the company ID is not particularly limited, but in this example, it is stored in the ROM area 65 of the USB memory 7 (corresponding to the second external storage unit 23) as plain text or encrypted. Is configured as follows. The company ID may be included in a part of the device serial number of the USB memory 7 as plain text or in an encrypted state.

On the other hand, in the ROM area 65 (corresponding to the first external storage unit 13) of the external hard disk 6, one or more first external authentication data are stored in plain text or encrypted. ing. As illustrated in FIG. 10B, as the first external authentication data, data that specifies another external storage device that is permitted to be combined with the external hard disk 6 is described.

The first external authentication data is not particularly limited, but the device type, the company ID, and the device serial number shown in FIG. 10B are used alone or in combination to form the first external authentication data. be able to. In this example, the information combining the device type and the company ID, or the information combining the device type and the device serial number is the first external authentication data.

For example, the first external authentication data described in the first line of FIG. 10B has the device type “HDD” and the company ID “ab... ”. The attached storage device is shown.

In addition, the first external authentication data described in the second line of FIG. 10B is such that the device type is “USB” and the device serial number is “56... ”. It represents an external storage device.

The device type “HDD” indicates that the other external storage device is “external HDD (hard disk drive)” or “external SSD (solid state drive)”, and the device type “USB” is The other external storage device is a USB memory. The device serial number represents the manufacturing number of the other external storage device.

As shown in FIG. 10B, the first external authentication data may be configured to have an expiration date of authentication. After the expiration date has passed, the first external authentication data with the expiration date set is ignored in the authentication processing shown in FIG. 4 (and FIG. 9) and is not treated as the first external authentication data. ..

In this example, although the first external authentication data is stored in the external hard disk side application stored in the ROM area 65, the first external authentication data is stored in the external hard disk. It can also be configured to be stored outside the side application.

Now, as shown in FIG. 7, in the process of step S3, the external hard disk 6 first transmits the second external identification information for identifying the USB memory 7 connected to the sending computer 4 to the sending computer. (Step S31).

In this example, as the second external identification information, the device type of the USB memory 7, the device serial number, the above-mentioned company ID, and the like are acquired via the sending-side computer 4.

The external hard disk 6 then compares the obtained second external identification information with the first external authentication data (see FIG. 10B) stored in the external hard disk 6 (step S32). ).

As a result of the comparison, if there is data that matches the second external identification information of the USB memory 7 in one or more valid first external authentication data, the USB memory by the external hard disk 6 It is determined that the authentication of 7 is established, and the control is moved to step S4 (steps S33 and S34).

As a result of the comparison, if the valid first external authentication data does not match the second external identification information of the USB memory 7, the external hard disk 6 authenticates the USB memory 7. Determines that the failure has occurred, causes the display device 52 of the sending computer 4 to display an error, and ends the sending authentication process (step S35).

Following step S34, as shown in FIG. 4, the external hard disk 6 is authenticated by the USB memory 7 (step S4).

In this embodiment, the external hard disk 6 stores a company ID that identifies the company that owns the external hard disk 6. The storage location of the company ID is not particularly limited, but in this example, it is stored in the ROM area 65 (corresponding to the first external storage unit 13) of the external hard disk 6 as plain text or encrypted. Configured to do so. The company ID may be included in a part of the device serial number of the external hard disk 6 as plain text or in an encrypted state.

On the other hand, in the ROM area 65 of the USB memory 7 (corresponding to the second external storage unit 23), one or more second external authentication data is stored in plain text or encrypted. There is. As the second external authentication data, data that specifies another external storage device that is allowed to be combined with the USB memory 7 is described.

The structure of the second external authentication data is the same as that of the above-mentioned first external authentication data (see FIG. 10B).

In this example, the second external authentication data is stored in the USB memory side application stored in the ROM area 65, but the second external authentication data is stored in the USB memory side application. It can also be configured to be stored externally.

Now, as shown in FIG. 8, in the process of step S4, the USB memory 7 first transmits the first external identification information for identifying the external hard disk 6 connected to the sending computer 4 to the sending computer. (Step S41).

In this example, the device type, the device serial number, the company ID, etc. of the external hard disk 6 are acquired as the first external identification information via the sending computer 4.

The USB memory 7 then compares the obtained first external identification information with the second external authentication data (see FIG. 10B) stored in the USB memory 7 (step S42).

As a result of the comparison, if there is data that matches the first external identification information of the external hard disk 6 among the one or more valid second external authentication data, the external data by the USB memory 7 is used. When it is determined that the hard disk 6 has been authenticated, the control is moved to step S5 (steps S43 and S44).

As a result of the comparison, if there is no data that matches the first external identification information of the external hard disk 6 among the valid second external authentication data, the external hard disk 6 of the USB memory 7 is used. It is determined that the authentication has failed, an error is displayed on the display device 52 of the sending computer 4, and the sending authentication process ends (step S45).

Subsequent to step S44, as shown in FIG. 4, the external hard disk 6 determines that the external hard disk 6 is permitted a predetermined access (step S5).

The content of the predetermined access in step S5 is not particularly limited, but in this embodiment, the user data area 62 (see FIG. 3) corresponding to the first external storage unit 13 of the external hard disk 6 is stored. Assuming access (browsing, writing and/or deletion) to the security area 62a (not shown) set in at least a part, the transmitted data stored in the auxiliary storage device 55 of the sending computer 4 is This is a process of writing in the security area 62a of the external hard disk 6 after encryption.

However, for example, access (browsing, writing and/or deleting) itself to at least a part of the first external storage unit 13 of the external hard disk 6 (for example, the security area 62a described above) itself is the predetermined access. It can also be configured as follows.

In any case, the security area 62a can be recognized by the user only after the access to the security area 62a in step S5 is permitted (that is, on the condition that all scheduled authentications are established). It is configured as a large area.

Next, in response to the determination that the predetermined access is permitted, the external hard disk 6 encrypts the transmitted data stored in the first host storage unit 11 of the sending computer 4, The data is written in the security area 62a of the attached hard disk 6 (step S6).

The method of encrypting the transmitted data is not particularly limited, but for example, using the encryption/decryption circuit 63 mounted on the external hard disk 6 and executing the AES (Advanced Encryption Standard) 256 algorithm, It can be configured to perform so-called hardware encryption (this embodiment is assumed to be configured in this way).

The storage location of the encryption key for the hardware encryption described above is not particularly limited, but, for example, in the ROM area 65 of the external hard disk 6 or the encryption/decryption circuit 63, in plain text or encrypted Can be configured to be stored.

It should be noted that before step S5 is executed, further authentication, for example, the external hard disk 6 and/or the USB memory 7 may be configured to execute biometric authentication such as fingerprint authentication or ID/password authentication. With such a configuration, it is possible to realize a highly secure authentication system.

Next, the reception authentication process shown in FIG. 9 will be described. The reception authentication process is, for example, an authentication process for copying (decrypted) the transmitted data that has been (encrypted) copied to the external hard disk 6 in the transmission authentication process described above to the receiving-side computer 5.

Prior to the receipt authentication process, it is assumed that encrypted transmitted data is stored in a part of the user data area 62 (for example, the security area 62a) of the external hard disk 6.

Further, it is assumed that the external hard disk 6 and the USB memory 7 are connected to the receiving computer 5, and the external hard disk side application and the USB memory side application are running.

As in the case of the sending authentication process shown in FIG. 4, in the receiving authentication process shown in FIG. 9, in principle, the external hard disk 6 or the USB memory 7 controls the receiving computer 5, and the receiving computer 5 is configured to execute each process, but for convenience of description, each process will be described as being executed by the external hard disk 6 or the USB memory 7.

As shown in FIG. 9, in the reception authentication process, first, the authentication process of the receiving computer 5 by the external hard disk 6 is performed (step S51), and subsequently, the authentication process of the receiving computer 5 by the USB memory 7 is performed. (Step S52).

These authentication processes (steps S51 and S52) are different from the authentication processes in the above steps S1 and S2 in which the authentication target is the sending-side computer 4 in that the authentication target is the receiving-side computer 5, but the remaining In this respect, the authentication process in steps S1 and S2 is substantially the same, and thus detailed description thereof will be omitted.

Following step S52, the external hard disk 6 performs authentication processing for the USB memory 7 (step S53), and then the USB memory 7 performs authentication processing for the external hard disk 6 (step S54).

These authentication processes (steps S53 and S54) acquire the second external identification information and the first external identification information via the receiving-side computer 5, respectively. Although it is different from the authentication processing in steps S3 and S4 obtained through the computer 4, the other points are substantially the same as the authentication processing in steps S3 and S4, and therefore detailed description thereof will be omitted.

Subsequent to step S54, the external hard disk 6 determines to allow a predetermined access to the external hard disk 6 (step S55).

The content of the predetermined access in step S55 is not particularly limited, but in this embodiment, the security area 62a is premised on access (browsing, writing and/or deletion) to the security area 62a of the external hard disk 6. This is a process of decrypting the data to be transmitted which is encrypted and stored in the above and then writing it in the auxiliary storage device 55 corresponding to the second host storage unit 12 of the receiving side computer 5.

However, as in the case of step S5, for example, access (browsing, writing and/or deletion) itself to at least a part of the first external storage unit 13 of the external hard disk 6 (for example, the security area 62a described above) itself. Can be configured to be the predetermined access described above.

Next, in response to the determination that the external hard disk 6 permits the predetermined access, the transmitted data encrypted and stored in the security area 62a of the external hard disk 6 is decrypted and then received. The data is written in the second auxiliary storage device 55 of the computer 5 (step S56).

The process of decrypting the transmitted data in step S56 is the reverse of the above-described encryption process (step S6). That is, the decryption process in step S56 uses the same (common) encryption key as that used in the encryption process (step S6) described above, and the decryption method corresponding to the encryption method in the encryption process. In accordance with this, the encryption/decryption circuit 63 executes.

It should be noted that before step S55 is executed, further authentication, for example, the external hard disk 6 and/or the USB memory 7 may be configured to execute biometric authentication such as fingerprint authentication or ID/password authentication. With such a configuration, it is possible to realize a highly secure authentication system.

In this way, by using the external hard disk 6 and the USB memory 7, the transferred data can be safely moved from the sending computer 4 to the receiving computer 5.

Step S1 shown in FIG. 4 or step S51 shown in FIG. 9 corresponds to the first host authentication control unit 15 in FIG. Step S2 shown in FIG. 4 or step S52 shown in FIG. 9 corresponds to the second host authentication control unit 25 in FIG. Step S3 shown in FIG. 4 or step S53 shown in FIG. 9 corresponds to the first external authentication control unit 16 in FIG. Step S4 shown in FIG. 4 or step S54 shown in FIG. 9 corresponds to the second external authentication control unit 26 of FIG. Step S5 shown in FIG. 4 or step S55 shown in FIG. 9 corresponds to the first access control unit 17 in FIG.

In the above-described embodiment, the CPU ID of the computer and the built-in HDD serial number are used in combination as the host identification information and the first (second) host authentication data in the authentication process of the computer that is the host device. However, the present invention is not limited to this. For example, it is possible to use only one of the CPU ID of the computer and the built-in HDD serial number as the host identification information and the first or second host authentication data.

Further, as the host identification information and the first or second host authentication data, the CPU ID of the computer, the internal HDD serial number, the OS (Operating System) installed in the computer, and other information for specifying the software (for example, serial number). It is also possible to use the information (for example, serial number) for specifying the motherboard, singly, or in any combination thereof.

Further, in the above-described embodiment, in the authentication processing of the computer which is the host device, the method of acquiring the host identification information of the computer based on the electronic certificate (computer certificate) of the computer including the host identification information of the computer. However, the present invention is not limited to this. For example, the host identification information may be directly acquired from the computer without using the electronic certificate.

In the above-described embodiment, the second external identification information (first external identification information) is used in the mutual authentication process between the external hard disk 6 which is the two external storage devices and the USB memory 7. The device type, company ID, and device serial number of these external storage devices are used alone or in combination as the first external authentication data (second external authentication data). The present invention is not limited to this.

As the second external identification information (first external identification information) and the first external authentication data (second external authentication data), for example, instead of the company ID or together with the company ID A group ID representing a specific group or an individual ID representing a specific individual can be used.

In the sending authentication process and the receiving authentication process shown in the above-described embodiment, the external hard disk 6 (MCU 61 of the external hard disk) or the USB memory 7 (MCU 61 of the external hard disk 6) controls the sending computer 4 (the CPU 51 of the sending computer 4) and the receiving computer 5 (the receiving computer 5). CPU 51) of each of the sending side computer 4 and the receiving side computer 5 (of the CPU 51) of the sending side computer 4 is controlled, but the present invention is not limited to this. is not.

For example, instead of causing the sending side computer 4 (the CPU 51 of the receiving side) and the receiving side computer 5 (the CPU 51 of the receiving side) to execute a part or all of the above-described processing, the external hard disk 6 (the MCU 61 of the external hard disk) or the USB memory 7 ( The MCU 61) itself can be configured to execute alone (standalone).

Further, in the above-described embodiment, the case where the external hard disk is used as the first external storage device and the USB memory is used as the second external storage device is illustrated, but the present invention is not limited to this. Not a thing. Examples of the first external storage device and the second external storage device according to the present invention include an external hard disk, an external SSD, a USB memory, and other external storage devices (external storage devices). Any one can be selected from.

Further, in each of the above-described embodiments, the case where the computer is used as the host device is illustrated, but the present invention is not limited to this. As the host device according to the present invention, for example, a general device to which an external storage device can be connected, such as a copying device or a printing device, is targeted.

Further, in the above-described embodiment, the external hard disk side application and the USB memory side application (hereinafter, these may be collectively referred to as a “program”) that constitute the authentication system 2 are respectively stored as recording media. The ROM area of an external hard disk (for example, a hard disk) and the ROM area of a USB memory (for example, a mask ROM or a flash memory) can be exemplified, but the recording medium storing the program is not limited to these. For example, an external memory card, a CD-ROM, a DVD-ROM, a flexible disk, or a magnetic tape can be used as the recording medium storing the. Further, an external hard disk or a RAM area of a USB memory or a user data area can also be used as a recording medium storing a program.

Further, the distribution mode of the program is not particularly limited, and the program may be distributed while being stored in a recording medium, or may be distributed via a wired or wireless information communication unit.

Moreover, the recording mode of the program is not particularly limited. In addition to being stored and distributed in a recording medium in a form that can be directly executed, it can also be stored and distributed in a recording medium in a compressed form so as to be decompressed and used.

Further, each function shown in the first external control unit 14 of the first external storage device 6 and the second external control unit 24 of the second external storage device 7 which constitute the authentication system 2 described above. The case where (see FIG. 2) is realized by using a program (software) has been described as an example, but the present invention is not limited to this. For example, some or all of the above functions may be configured using hardware logic.

The above block diagram, hardware configuration, flowchart, configuration of various data, and the like are given as examples, and the present invention is not limited to these.

Although the present invention has been described above as a preferred embodiment, each term is used for descriptive purposes rather than limitation, and is intended to depart from the scope and spirit of the present invention. Instead, it can be modified within the scope of the appended claims. Also, while only a few exemplary embodiments of the present invention have been described above in detail, those skilled in the art can understand the typical implementations of the present invention without departing from the novel teachings and advantages of the invention. It will be readily appreciated that many variations in form are possible. Therefore, all such modifications are included in the scope of the present invention.

3: host device 6: first external storage device 7: second external storage device 15: first host authentication control unit 16: first external authentication control unit 17: first access control unit 25 : Second host authentication control unit 26: Second external authentication control unit

Claims (12)

A host device including a host storage unit, a first external storage device connected to the host device and including a first external storage unit and a first external control unit, and connected to the host device An authentication system comprising: a second external storage device including a second external storage unit and a second external control unit,
The first external storage unit includes first host authentication data including data that identifies a host device that is allowed to be combined with the first external storage device, and the first external storage device. And a first external authentication data including data specifying another external storage device that is allowed to be combined with
The second external storage unit includes second host authentication data including data specifying a host device that is permitted to be combined with the second external storage device, and the second external storage device. A second external authentication data including data specifying another external storage device that is allowed to be combined with
The first external control unit,
Host identification information that is information for identifying the host device is read through the host device, the read host identification information, and the first host authentication data stored in the first external storage unit. And a first host authentication control unit that controls to establish authentication of the host device by the first external storage device on the condition that they correspond,
The second external identification information, which is information for identifying the second external storage device, is read via the host device, the second external identification information read and the first external storage are read. Of the second external storage device by the first external storage device on condition that it corresponds to the first external authentication data stored in the unit. A first external authentication control unit that controls to establish authentication;
Equipped with
The second external control unit,
Host identification information, which is information for identifying the host device, is read via the host device, the read host identification information, and second host authentication data stored in the second external storage unit. And a second host authentication control unit that controls to establish authentication of the host device by the second external storage device on the condition that they correspond to each other,
First external identification information, which is information for identifying the first external storage device, is read via the host device, and the first external identification information read and the second external storage are read. Of the first external storage device by the second external storage device is determined on the condition that it corresponds to the second external authentication data stored in the unit. A second external authentication control unit that controls to establish authentication;
Equipped with
At least one external control unit of the first external control unit and the second external control unit, further,
Authentication of the host device by the first external storage device, authentication of the host device by the second external storage device, authentication of the second external storage device by the first external storage device, and Permitting predetermined access to the external storage device having the one external control unit, provided that all authentications of the first external storage device by the second external storage device have been established. Equipped with an access control unit for controlling,
Authentication system characterized by. In the authentication system according to claim 1,
The host device is a first host device that stores transmitted data in a first host storage unit as the host storage unit,
The predetermined access permitted by the access control unit is an external device provided with the access control unit after encrypting transmitted data stored in the first host storage unit of the first host device. The process is to write to the external storage unit of the external storage device,
Authentication system characterized by. In the authentication system according to claim 1,
The host device is a second host device including a second host storage unit as the host storage unit,
The external storage unit of the external storage device including the access control unit further stores encrypted transmitted data,
The predetermined access permitted by the access control unit is performed by decrypting the encrypted transmitted data stored in the external storage unit of the external storage device including the access control unit, A process of writing to the second host storage unit of the second host device;
Authentication system characterized by. The first external storage device used in the authentication system according to any one of claims 1 to 3. The second external storage device used in the authentication system according to any one of claims 1 to 3. A program for causing a computer to execute the function of the first external storage device according to claim 4. A recording medium storing the program according to claim 6. A program for causing a computer to execute the function of the second external storage device according to claim 5. A recording medium storing the program according to claim 8. A host device including a host storage unit; a first external storage device connected to the host device and including a first external storage unit; and a second external storage unit connected to the host device And a second external storage device,
The first external storage unit includes first host authentication data including data that identifies a host device that is allowed to be combined with the first external storage device, and the first external storage device. And a first external authentication data including data specifying another external storage device that is allowed to be combined with the second external storage device. Second host authentication data including data that specifies a host device that is allowed to be combined with data that specifies another external storage device that is allowed to be combined with the second external storage device. And a second external authentication data including
The first external storage device reads host identification information, which is information identifying the host device, via the host device, and stores the read host identification information in the first external storage unit. The first host authentication data is judged whether or not it corresponds, and on the condition that they correspond, control is performed to establish the authentication of the host device by the first external storage device. Host authentication control step of
The second external storage device reads host identification information, which is information for identifying the host device, via the host device, and stores the read host identification information and the second external storage unit. A second host authentication data is judged whether or not it corresponds to the second host authentication data being stored, and on the condition that the second host authentication data corresponds to the second host authentication data, control is performed to establish the authentication of the host device by the second external storage device. Host authentication control step of
The first external storage device reads the second external identification information, which is information for identifying the second external storage device, via the host device, and reads the second external identification information. It is determined whether or not the information corresponds to the first external authentication data stored in the first external storage unit, and the first external storage device is provided on the condition that they correspond. A first external authentication control step for performing control to establish authentication of the second external storage device according to
The second external storage device reads the first external identification information, which is information for identifying the first external storage device, via the host device, and reads the first external identification information. It is determined whether or not the information corresponds to the second external authentication data stored in the second external storage unit, and the second external storage device is provided on the condition that they correspond. A second external authentication control step of controlling to establish authentication of the first external storage device according to
At least one of the first external storage device and the second external storage device is an external storage device that authenticates the host device by the first external storage device, and uses the second external storage device. Authentication of the host device by the device, authentication of the second external storage device by the first external storage device, and authentication of the first external storage device by the second external storage device are all established. On the condition that the above-mentioned condition is satisfied, an access control step of controlling to permit predetermined access to the one external storage device,
Equipped with,
Authentication method characterized by. The authentication method according to claim 10,
The host device is a first host device that stores transmitted data in a first host storage unit as the host storage unit,
The predetermined access permitted in the access control step is performed by encrypting the transmitted data stored in the first host storage unit of the first host device and executing the access control step. The process is to write to the external storage unit of the external storage device,
Authentication method characterized by. The authentication method according to claim 10,
The host device is a second host device including a second host storage unit as the host storage unit,
The external storage unit of the external storage device that executes the access control step is further configured to store encrypted transmitted data,
The predetermined access permitted in the access control step is performed by decrypting the encrypted transmitted data stored in the external storage unit of the external storage device that executes the access control step, and A process of writing to the second host storage unit of the second host device;
Authentication method characterized by.

Images