WO2006092860A1

WO2006092860A1 - Access right managing device, access right managing method, access right managing program, and access right setting device

Info

Publication number: WO2006092860A1
Application number: PCT/JP2005/003583
Authority: WO
Inventors: Takehisa Mizuguchi; Mariko Sawamura; Jyunya Ujiie
Original assignee: Mitsubishi Denki Kabushiki Kaisha
Priority date: 2005-03-03
Filing date: 2005-03-03
Publication date: 2006-09-08

Abstract

An access right setting terminal (2) sets an access right to require an access to a data storage unit (13) of a memory card (1). An access right information storage section (15) of the memory card (1) stores access right information representing the access right set by the access right setting terminal (2). After the access right information storage section (15) stores the access right information, an access right managing unit (12) counts connections each time the memory card (1) is connected to a memory card using terminal or an access right setting terminal (3), judges from the count of connections whether or not it needs to delete the access right information stored in the access right information storage section (15), and deletes the access right information if it has judged to delete the access right information.

Description

Specification

ACCESS RIGHT MANAGEMENT DEVICE, ACCESS RIGHT MANAGEMENT METHOD, ACCESS RIGHT MANAGEMENT PROGRAM, AND ACCESS RIGHT SETTING DEVICE

Technical field

The present invention relates to an access right management device that manages access rights. For example, the present invention relates to a memory card that manages access rights that permit access to data that the user has.

Background art

In recent years, memory cards typified by small flash “memory” cards and SD (Secure Digital) cards have become widespread, and their capacities have been increasing year by year. For this reason, it is considered that various types of information will be stored on a single memory card. Also, since memory cards are carried and used, it is important to take measures against information leakage when lost.

[0003] Japanese Patent Laid-Open No. 7-129736 accesses data in a memory card to prevent information leakage.

Authenticate with a password before (read 'write · erase), and allow access based on the result.

[0004] Furthermore, Japanese Patent Application Laid-Open No. 2003-296196 discloses a method of limiting the amount of data read out when password authentication fails.

[0005] Japanese Patent Laid-Open No. 2001-117661 discloses a method of deleting the contents of a memory stored in a memory card when a password is mistaken for a certain number of times.

[0006] Japanese Patent Laid-Open No. 2002-169889 discloses a system for recording medical records and prescription information on a memory card as an application example of a memory card.

[0007] When various types of information are stored in a memory card, it may be necessary to temporarily give the memory card to a person other than the owner of the memory card to access the internal data. For example, there is a case where a patient passes a memory card with a medical chart to the hospital to refer to the medical chart. In addition, there are cases in which a force is temporarily transferred to another person to transfer a file in the memory card. In these cases, there is a user request to give permission to access the memory card to be temporary rather than permanent. However, in the above prior art, authentication is performed using a permanent password. For this reason, there is a problem that it is necessary to convey a permanent password to those who use the memory card temporarily. Also, if a password different from the owner is set on the memory card and the password is invalidated after being used by a third party, it must be invalidated by the user's operation, which is troublesome. was there.

Patent Document 1: JP-A-7-129736, page 6, Fig. 1

Patent Document 2: JP 2003-296196, page 8, Fig. 1

Patent Document 3: JP 2001-117661, page 10, page 6

Patent Document 4: JP-A-2002-169889, page 12, Fig. 1

Disclosure of the invention

Problems to be solved by the invention

An object of the present invention is to make it possible to set a temporary access right to a memory card so that the memory card can be handed over to a third party and used only temporarily. It is also intended to be able to release temporary access rights that do not require special user operations after using a third party power card.

Means for solving the problem

[0010] The access right management apparatus of the present invention includes:

Access requesting device that requests access Access target part that is requested to access as an access target,

An access right information storage unit for storing access right information indicating an access right for allowing access to the access target unit;

The access right indicated by the access right information stored in the access right information storage unit is based on the number of times of connection and the number of times of connection every time connection with any other device including the access request device is established. An access right management unit that determines whether or not the access right is invalid, and denys access to the access target unit from the access requesting device when the access right is determined to be invalid;

It is provided with. [0011] The other device includes:

It includes an access right setting device that can change at least the change and deletion of the access right information stored in the access right information storage unit.

[0012] The access right information storage unit includes:

As the access right information,

By using an account for identifying a user, access right information for each user indicating access right information for each user is stored,

The access right management unit

Each time it is connected to any of the other devices including the access requesting device, the number of connections is counted, and each of the user-specific access right information stored in the access right information storage unit based on the counted number of connections The access right to the access target unit is determined based on the access right information for each user indicating the access right determined to be invalid when it is determined whether or not at least one access right is invalid. Access to the access target unit by the access requesting device requesting access is denied.

[0013] The access right information storage unit includes:

Storing a predetermined initial value as part of the access right information;

The access right management unit

Based on the counted number of connections and the predetermined initial value, it is determined whether or not the access right indicated by the access right information stored in the access right information storage unit is invalid.

[0014] The access target unit includes:

A data storage unit for storing predetermined data is included.

[0015] The data storage unit,

A plurality of storage areas for storing data;

The access right information stored in the access right information storage unit is:

Access to at least one of the plurality of storage areas is permitted.

[0016] The access target unit includes: A wireless communication unit capable of wireless communication is included.

[0017] The access right management method of the present invention includes:

Access request device capability for requesting access Access right information for storing an access target part that is requested to be accessed as an access target, and access right information indicating an access right for permitting access from the access requesting device to the access target part An access right management apparatus comprising a storage unit, and an access right management method for managing the access right information.

Determines whether the access right indicated by the access right information is invalid based on the number of times of connection and the number of connections every time it is connected to any of the other devices including the access requesting device,

When it is determined that the access right is invalid, access to the access target unit is denied.

[0018] An access right management program of the present invention includes:

Access request device capability for requesting access Access right information for storing an access target part that is requested to be accessed as an access target, and access right information indicating an access right for permitting access from the access requesting device to the access target part An access right management program for causing an access right management device having a storage unit to execute the process for managing the access right information! /,

A process of determining whether or not the access right indicated by the access right information is invalid based on the number of times of connection and counting the number of connections every time it is connected to any other device including the access requesting device;

A process of denying access to the access target unit when the access right is determined to be invalid;

Is executed by the access right management apparatus.

[0019] The access right setting device of the present invention includes:

An access right setting control unit configured to set an access right to be stored as the access right information in the access right management apparatus, and to store the set access right as the access right information in the access right management apparatus; Features. [0020] The access right management device of the present invention includes:

The access request device that requests access to the access target unit based on the access right information stored in the access right information storage unit counts the number of access requests every time an access request is received, and counts the number of access requests counted And determining whether the access right indicated by the access right information stored in the access right information storage unit is invalid, and determining that the access right is invalid, the access request device power to the access target unit It has an access right management unit that denies access.

[0021] The access right information storage unit includes:

As the access right information,

The access right management unit

Each time an access request is received from the access requesting device that requests access to the access target unit based on any of the user-specific access right information stored in the access right information storage unit, the access request count is counted. It is determined whether or not the access right indicated by the access right information for each user related to the access request is invalid based on the counted number of access requests, and when the access right is judged to be invalid, it is judged invalid. The access request unit that requests access to the access target unit based on the user-specific access right information indicating the access right is denied access to the access target unit.

[0022] The access right information storage unit includes:

Storing a predetermined initial value as part of the access right information;

The access right management unit Based on the counted number of access requests and the initial value, it is determined whether or not the access right indicated by the access right information stored in the access right information storage unit is invalid.

[0023] The access target unit includes:

A data storage unit for storing predetermined data is included.

[0024] The data storage unit includes:

A plurality of storage areas for storing data;

Access to at least one of the plurality of storage areas is permitted.

[0025] The access target unit includes:

A wireless communication unit capable of wireless communication is included.

[0026] The access right management method of the present invention includes:

The access request device that requests access to the access target unit based on the access right information stored in the access right information storage unit counts the number of access requests every time an access request is received, and counts the number of access requests counted And determining whether or not the access right indicated by the access right information stored in the access right information storage unit is invalid,

[0027] The access right management program of the present invention includes:

Access request device capability for requesting access Access right information for storing an access target part that is requested to be accessed as an access target, and access right information indicating an access right for permitting access from the access requesting device to the access target part With a storage unit An access right management program for causing the access right management device to execute processing for managing the access right information! /,

The access request device that requests access to the access target unit based on the access right information stored in the access right information storage unit counts the number of access requests every time an access request is received, and counts the number of access requests counted Determining whether the access right indicated by the access right information stored in the access right information storage unit is invalid based on

Is executed by the access right management apparatus.

[0028] The access right management program of the present invention includes:

An access right setting control unit configured to set an access right to be stored as the access right information in the access right management apparatus, and to store the set access right as the access right information in the access right management apparatus; Features.

The invention's effect

[0029] According to the present invention, a temporary access right can be easily set. In addition, after using the memory card by a third party, the temporary access right can be easily released without any special user operation.

BEST MODE FOR CARRYING OUT THE INVENTION

[0030] Embodiment 1.

Embodiment 1 will be described with reference to FIG. 1 and FIG. In the first embodiment, for example, the following case is assumed. This is the case when the patient gives his / her memory card with medical records to the hospital and the hospital refers to the contents of the memory card and appends it. Or, the file stored in the memory card owner memory card may be handed over to another person. In such a case, a usage scene is assumed in which a temporary access right for temporarily permitting access to data on the memory card is set and the memory card is passed to another person. The memory card is an example of an access right management device that manages access rights. This access right management device includes an access target unit that is required to access other devices. In the case of the memory card shown below, the data storage unit is the access target unit. In the wireless communication card described later, the wireless communication unit is an access target.

FIG. 1 shows a configuration of a memory card utilization system according to the first embodiment. As shown in FIG. 1, the memory card utilization system includes a memory card 1 (an example of an access right management device), an access right setting terminal 2 (an example of an access right setting device), and a memory card utilization terminal 3 (an access request terminal). An example of an apparatus). The owner of the memory card 1 connects the memory card 1 to the access right setting terminal 2 and sets a temporary access right. The owner of the memory card 1 gives the memory card 1 to another person, for example. Others can connect the memory card 1 to the memory card using terminal 3 and use the memory card based on the temporary access right. Details will be described later.

FIG. 2 shows a configuration of the memory card 1 and the access setting terminal 2. FIG. 3 shows the configuration of the memory power utilization terminal 3.

4 and 5 are diagrams showing specific examples of the external appearance of the memory card 1 and the memory card using terminal 3. In FIG. 4, the memory card 1 is connected to a mobile phone 60 which is an example of the memory card using terminal 3. In FIG. 5, the memory card 1 is connected to a mobile terminal 70 which is an example of the memory card using terminal 3. The mobile terminal 70 can perform wireless communication when a wireless communication card 4 described later is connected.

FIG. 6 is a hardware configuration diagram of the memory card 1 shown in FIG. In FIG. 6, the memory card 1 includes a CPU (Central Processing Unit) 80 that executes a program. The CPU 80 is connected to the ROM 82, the connection unit 83, and the nonvolatile memory 90 via the bus 81. The connection unit 83 is a part for connecting to the access right setting terminal 2 or the memory card using terminal 3.

The nonvolatile memory 90 stores a data group 91 (an example of an access target), access right information 92, and a program group 93. The program group 93 is executed by the CPU 80.

The program group 93 in the memory card 1 stores a program for executing the function described as “part” in the description of the embodiment described below. The program is read and executed by the CPU 80.

[0037] In the following description of the embodiments, the memory card 1 is referred to as "part". What is described below may be realized by firmware stored in the ROM 82. Alternatively, it may be implemented by software alone, hardware alone, a combination of software and hardware, or a combination of firmware.

FIG. 7 is a diagram showing an example of the appearance of the access right setting terminal 2 shown in FIG. In FIG. 7, the access right setting terminal 2 includes a system unit 140, a CRT (Cathode Ray Tube) display device 121, a keyboard (KZB) 122, a mouse 123, and a compact disk device (CDD) 124. These are connected by a cable. The system unit 140 includes a card insertion part 141 for inserting the memory card 1 and an FDD (Flexible Disk Drive) 142.

FIG. 8 is a hardware configuration diagram of the access right setting terminal 2 according to the first embodiment.

In FIG. 8, the access right setting terminal 2 includes a CPU 160 that executes a program. The CPU 160 is connected to the ROM 143, RAM 144, CRT display device 121, KZB122, mouse 123, FDD142, CDD124, card insertion unit 141, and magnetic disk device 150 via the bus 161.

The magnetic disk device 150 stores an operating system (OS) 151, a window system 152, a program group 153, and a file group 154. The program group 153 is executed by the CPU 160, the OS 151, and the window system 152.

[0041] The program group 153 stores a program for executing the function described as "part" by the access right setting terminal 2 in the description of the embodiment described below. The program is read and executed by the CPU 160.

In the description of the embodiment described below, what is described as “part” by the access right setting terminal 2 may be realized by firmware stored in the ROM 143. Alternatively, it may be implemented by software alone, hardware alone, a combination of software and hardware, or a combination of firmware.

[0043] The configuration of the memory card 1 will be described with reference to FIG. The memory card 1 is a storage medium capable of storing various data. Memory card 1 has access control unit 11, The access right management unit 12 and the data storage unit 13 (an example of an access target unit) are provided. The storage area 14 of the data storage unit 13 includes a plurality of storage areas A and a single storage area D partitioned to store data. The access right management unit 12 manages access rights and passwords for data stored in the data storage unit 13. The access control unit 11 interfaces with other devices, and controls access to the data storage unit 13 according to the access right.

[0044] It should be noted that the access control unit 11, the access right management unit 12, and the data storage unit 13 are desirably configured so that they cannot be operated separately by using a technique called anti-tanno. . Accordingly, it is desirable for security to prevent access to data in the data storage unit 13 without the access control unit 11 and the access right management unit 12.

The access right setting terminal 2 will be described with reference to FIG. The access right setting terminal 2 is a terminal for setting an access right and a password managed by the access right management unit 12 in the memory force 1. The access right setting terminal 2 includes a setting side memory card interface unit 23, an access right setting control unit 22, and a setting side display operation unit 21. The setting side memory card interface unit 23 communicates with the memory card 1. The access right setting control unit 22 sets or changes the access right of the memory card 1. The setting-side display operation unit 21 displays information to the user and receives operations from the user. Specific examples of the access right setting terminal 2 include a mobile phone terminal, a PDA (Personal Digital Assistant), a PC (Personal Computer), and the like.

The memory card using terminal 3 will be described with reference to FIG. The memory card using terminal 3 is a terminal that accesses the data stored in the memory card 1 and uses the data stored in the memory card 1. The memory card use terminal 3 includes a use side memory card interface unit 33, a memory card use unit 32, and a use side display operation unit 31. The user side memory card interface unit 33 interfaces with the memory card 1. The memory card utilization unit 32 accesses data in the memory card 1. The user-side display operation unit 31 displays information to the user and accepts user-friendly operations. The memory card using terminal 3 is, for example, a mobile phone terminal, a PDA or a PC. FIG. 9 is an example of access right information managed by the access right management unit 12 of the memory card 1. As shown in FIG. 2, the access right management unit 12 of the memory card 1 includes an access right information storage unit 15. The access right information storage unit 15 stores the access right information shown in FIG. In FIG. 2, the access right information storage unit 15 is located inside the access right management unit 12, but may be located anywhere on the memory card 1. The example of access right information shown in Fig. 9 consists of an account name, password, valid count, accessible area, and authenticated flag. These will be described. In Fig. 9, the account name ^ 111 & 5 61: "and" 1156 8 "

Two accounts are registered. Each account stores a password, valid count, accessible area, and authenticated flag. This series of information is access right information for each account (an example of access right information for each user).

(1) “Account name” is a name for identifying the user of the memory card 1.

(2) The “password” is used to authenticate whether or not the user is a valid user. The terminal connected to the memory card 1 (the access right setting terminal 2 or the memory card using terminal 3) also authenticates depending on whether the input passwords match.

(3) “Effective count” (an example of a predetermined initial value) is an index indicating the number of times the access right of this account can be used. Each time the memory card 1 is connected to a terminal (the access right setting terminal 2 or the memory card using terminal 3), the “valid count” is decremented by one. When this valid count reaches 0, the access right management unit 12 determines that the access right for the corresponding account is invalid. Once it is determined to be invalid, access is not allowed. If the valid count is “permanent”, the access right is valid regardless of the number of times.

(4) “Accessible area” indicates an object that is accessible to an external terminal (memory card using terminal 3) with respect to the memory card 1. The accessible object is the data storage unit 13 or the access right information storage unit 15. In FIG. 9, the account “master” can access the access right information and all the storage areas 14. The account “use A” indicates that only the storage area A can be accessed.

(5) The “authenticated flag” is all No when the memory card 1 is connected to the terminal (the access right setting terminal 2 or the memory card using terminal 3). After that, if the user is successfully authenticated by comparing the passwords, “Yes” indicating that the user has been authenticated is displayed. FIG. 10 shows a sequence when the use scene is assumed. In the first embodiment, assuming the usage scene of FIG. 10, the memory card 1 is used in the following procedure.

(1) First, the owner of the memory card 1 inserts the memory card 1 into the access right setting terminal 2 possessed by the owner (Sl). Then, a temporary access right is set for the memory card 1 ^^ (S2). After setting the temporary access right, the owner passes the memory card 1 to another user (S3).

(2) The other user inserts the memory card 1 into the memory card using terminal 3 (S4). Then, other users access the data in the memory card 1 using the access right temporarily set (S5). After that, when the memory card 1 is returned to the owner, the temporary access right and password set previously are invalidated without any special operation.

A procedure for inserting the owner card 1 of the memory card 1 into the access right setting terminal 2 and setting the access right and password for the memory card 1 will be described with reference to FIG. 11 and FIG. FIG. 11 is a flowchart of the operation of the memory card 1. FIG. 12 is an operation flowchart of the access right setting terminal 2. FIGS. 13 and 14 show the exchange sequence between the memory force 1 and the access right setting terminal 3 based on FIGS. FIGS. 13 and 14 illustrate the sequence between the memory card 1 and the access right setting terminal 3 by extracting the main steps of FIGS. 11 and 12. That is, the step numbers in FIG. 13 and FIG. 14 are the step numbers in FIG. 11 and FIG.

[0050] The description will be made mainly with reference to FIGS.

(1) First, when the memory card 1 is connected to the access right setting terminal 2, the access control unit 11 of the memory card 1 is connected to another device (in this case, the access right setting terminal).

The access right management unit 12 is notified that it has been connected to 2) (S 101).

(2) In response to this, the access right management unit 12 executes “access right update process at the time of card connection” (S102). Details of this processing will be described with reference to FIG. This “access right update process at the time of card connection” is a characteristic process of the memory card 1.

(3) Thereafter, the memory card 1 waits to receive a request from the connected terminal (in this case, the access right setting terminal 2) (S103).

[0051] When the memory card 1 is connected to the access right setting terminal 2 (S201) and the user operates the setting side display operation unit 21 to start the access right setting operation (S202), the access right setting terminal 2 The right setting control unit 22 requests the memory card 1 to refer to the access right information (S203).

(1) The memory card 1 receives the access right information reference request from the access control unit 11 (S103). The access control unit 11 checks the request type (S104). (2) Here, since the access right information reference request is received from the access right setting terminal 2, the access right management unit 12 checks whether or not the user has the right to refer to the access right information (S110).

[0053] Here, a process in which the access right management unit 12 of the memory card 1 determines whether or not there is an access right will be described with reference to FIG. FIG. 15 is a flowchart showing the operation of the access right management unit 12 for determining whether or not the access right exists (an example of determining whether or not the access right is invalid). In order to determine whether there is an access right, the access right management unit 12 repeats the following processing (S801-S805) for all the accounts registered in the access right information managed by the access right management unit 12.

(1) First, the access right management unit 12 checks whether or not the account authentication flag is Yes (S802).

(2) If No, move to next account processing.

(3) If the authenticated flag is Yes, the valid count is checked to check whether it is “permanent” or greater than 0 (S803). When the valid count is 0 (NO in S803), the access right management unit 12 determines that the access right of the account is invalid. If it is determined to be invalid, the access request is rejected as shown in S111 of FIG.

(4) If this condition is not met, move to the next account process. If the condition is satisfied, it is checked whether or not the request type (reference Z update of access right information, storage area) is included in the accessible area of the account (S804).

(5) If it is included, the access right presence / absence determination process is terminated as “access right” (S807).

(6) If it is included, move on to the next account.

(7) Even if the processing is completed for all accounts (S801 to S805), if there is no access right, the access right presence / absence determination process is terminated as “no access right” (S80). 6).

In the case described in FIG. 13, there is no authenticated account as shown in FIG. Therefore, the access right management unit 12 determines that there is no access right. The access control unit 11 responds with a request rejection as “no right” (S111). The memory card 1 again waits for a request from the access right setting terminal 2 (S103).

The access right setting terminal 2 receives a “request reject” response (S204). The access right setting control unit 22 checks the received response (S205). In this case, since the request is rejected due to “no right”, the setting-side display operation unit 21 requests the user to input “account name” and “password” (S210). When the user inputs an account name and password (S211), the access right setting control unit 22 of the access right setting terminal 2 sends a “user authentication request” including the account name and password to the memory card 1 (S212).

(1) When the memory card 1 receives a “user authentication request” from the access right setting terminal 2 (S 103, S 104), the access right management unit 12 receives a user whose account name and password match. It is checked whether or not it is registered in the access right information (S120).

(2) —If there is no matching account (NG), the access control unit 11 returns an authentication failure to the access right setting terminal 2 (S121), and the access right setting terminal 2 receives the authentication failure ( S213, S214), “Authentication failed”, etc. are displayed (S215), and the process is terminated (S226).

(3) If the authentication is successful, the access right management unit 12 of the memory card 1 changes the authenticated flag of the corresponding account in the access right information to Yes (S122).

(4) For example, in the example of the access right information shown in FIG. 9, when the account name “master” and its password “mstrpass” are entered, as shown in FIG. 16, the access right information is stored in the account name “master”. Is changed to “Yes”.

(5) Thereafter, the access control unit 11 responds to the access right setting terminal 2 that the authentication is successful (S123).

[0057] When the access right setting terminal 2 receives the authentication success (S213, S214), the memory card again

Request access right information to 1 (S203).

(1) When the memory card 1 receives the “access right information reference request” (S 103, S 104), The access right management unit 12 checks again whether or not it has the right to refer to the access right information (S110).

(2) This time, as shown in the example in Figure 16, the account with the account name “master” has already been authenticated, and the “access right information” is included in the accessible area. 12 judges that there is a right.

(3) Therefore, the memory card 1 sends an “access right reference response” to the access right setting terminal 2 via the access control unit 11 (S 112).

(4) This “access right reference response” includes access right information managed by the access right management unit 12.

(1) When the access right setting terminal 2 receives the access right reference response (S204, S205), the setting side operation display unit 21 displays the access right information on the screen (S220).

(2) FIG. 17 shows an example of a display screen of the access right setting terminal (for example, displayed on the CRT display device 121 of FIG. 7). In this example, a part of the account information included in the access right information managed by the access right management unit 12 in the memory card 1 is displayed in the “existing access right” area.

(3) These pieces of information are a screen displaying the access right information included in the access right reference response in S112 of FIG.

(4) In addition, in FIG. 17, the input items for adding a new account are displayed in the “change access right” area. In the example of Fig. 17, in order to add access rights to memory card 1, enter "tmpuser" as the account name, "tmppass" as the password, "2" as the valid count, and "B" as the accessible area. Has been.

(5) After entering the necessary information in this “access right change area” and selecting the “execute” button (S221), an “access right information change request” is sent from the access right setting terminal 2 to the memory card 1. It is transmitted (S222).

(6) This “access right information change request” includes the account name, password, valid count, and accessible area information entered by the user.

[0060] (1) When the memory card 1 receives the "access right information change request" (S103, S104), it determines whether or not the access right management unit 12 has the right to change the access right information. Check (S 13 0)

(2) Here, as shown in FIG. 16, since the account with the account name “master” has been authenticated and “access right information” is included in the accessible area, the access right management unit 12 Judge that there is.

(3) Therefore, the access right management unit 12 changes the access right information according to the information included in the access right information change request (S131).

(4) In this case, the account name “tmpuser” included in the access right information change request is added as a new account because it is not included in the existing access right information (FIG. 16).

(5) Figure 18 shows an example of the access right information after the change. A new account is added according to the account name, password, valid count, and accessible area information entered by the user in S221.

(6) Thereafter, the memory card 1 transmits an access right information change result response (change success) to the access right setting terminal 2 (S132).

When the access right setting terminal 2 receives the access right information update result response (S223), the access right setting control unit 22 confirms the response (S224). In this case, since the change is successful, the setting side operation display unit 21 displays “Access right has been changed” or the like (S225), and the operation ends (S226). If a change failure is responded, the setting side operation display unit 21 displays “access right change failed” or the like (S230). The access right setting terminal 2 ends the operation (S226).

As a result of the above operations and operations, an account (account name “tmpuser”) having a new access right is registered in the access right information storage unit 15 of the access right management unit 12 in the memory card 1 ( (Figure 18). The access rights for this account are valid until the effective count, which is 2 at this point, reaches 0.

The above is the procedure for inserting the owner card 1 of the memory card 1 into the access right setting terminal 2 and setting the access right and password for the memory card 1.

Next, the operation using the memory card 1 will be described with reference to FIG. 19 and FIG. In this operation, memory card 1 is connected to memory card using terminal 3 and memory card 1 is used. The effective count is subtracted by connecting memory card 1 to memory card using terminal 3, The reason why the access right becomes invalid will be explained.

FIG. 19 is an operation flowchart of the memory card using terminal 3. 20 and 21 show the exchange sequence between the memory card 1 and the memory card using terminal 3. FIG. 20 and 21 show the sequence of the memory card 1 and the access right setting terminal 3 by extracting the main steps of FIG. 11 showing the operation of the memory card 1 and FIG. 19 showing the operation of the memory card using terminal 3. Is explained. The step numbers in FIGS. 20 and 21 are the step numbers in FIGS.

[0066] First, when the memory card 1 is connected to the memory card using terminal 3 (S301, S101), the access right management unit 12 of the memory mode 1 executes the “access right update process at the time of card connection” (S 102). FIG. 22 shows an operation flow chart of “access right update processing at the time of card connection” by the access right management unit 12. The “access right update process at the time of card connection” will be described with reference to FIG.

(1) When the memory card 1 is connected to another device (the access right setting terminal 2 or the memory card using terminal 3), the access right management unit 12 first authenticates access right information managed by itself. The completed flag is cleared and all are set to the initial value No (S401).

(2) After that, the valid count is updated for all accounts in the access right information (S402 force is also S407).

(3) First, it is checked whether the valid count is “permanent” (S403). If it is “permanent”, the process proceeds to the next account.

(4) If the effective count is not “permanent”, the effective count is decremented by 1 (S404).

(5) As a result, the access right management unit 12 checks whether the valid count has reached 0 (S 405). If it is 0, the access right management unit 12 determines that this account is invalid and deletes it from the access right information (S 40

6).

(6) This process is executed for all accounts in the access right information (from S402 to S40).

7) “Card access right update process” is terminated (S408).

(7) When the access right information is in the state shown in FIG. 18 and this “access right update process at card connection” is executed, the access right information is in the state shown in FIG.

(8) In FIG. 23, all the authenticated flags are No and the effective count other than “permanent” is decremented by 1 compared to FIG. As shown in FIG. 20, after executing the “card access right update process” (S 102), the memory card 1 waits for a request from the connected memory card using terminal 3 (S 103). ).

(1) Next, on the memory card using terminal 3 side, the user performs an operation of accessing data in the memory card 1 by the use side display operation unit 31 of the memory card using terminal 3 (S302).

(2) By this operation, the access target area in the data storage unit 13 of the memory card 1 and the type of data access request such as read / write / delete are specified.

(3) Here, the following operation will be described assuming that an operation for requesting reading of data in the storage area B is performed in S302. In response to this operation, the memory card utilization unit 32 transmits a “data access request” to the memory card 1 via the utilization side memory card interface unit 33 (S303). This “data access request” includes “storage area B” as the access target area, “read” t as the access type, and two parameters!

(1) The memory card 1 receives the request from the access control unit 11 (S103), and checks the request type (S104).

(2) Since the data access request is received here, the access right management unit 12 checks whether or not the user has the right to access the data stored in the data storage unit 13 (S 140).

(3) Since there is no authenticated account with the access right information in the state shown in FIG. 23, it is determined that there is no right in this case, and a request denial is returned as “no right” (S 11 1). The terminal waits again for a request for terminal power (S103).

(1) The memory card using terminal 3 receives the response (S304). The memory card using unit 32 checks the response (S305). In this case, since the request is rejected due to “no right”, the user side display operation unit 31 requests the user to input “account name” and “password” (S 310).

(2) Here, in the example of the access right information shown in FIG. 23, the subsequent operation will be described assuming that the account name “tmpuser” and its password “tmppa _SS ” are input.

(3) When the user inputs an account name and password (S311), the memory card using terminal 3 sends a user authentication request including the account name and password to the memory card 1 (S312). [0071] (1) When the memory card 1 receives a user authentication request from the terminal (S103, S104), the access right management unit 12 registers an account whose account name and password match with the access right information! It is checked whether or not to speak (S 120).

(2) If there is no matching account (NG), the authentication failure is returned to the memory card using terminal 3 (S121), and the memory card using terminal 3 receives the authentication failure (S313, S314). The display-side display operation unit 31 displays “authentication failed” or the like (S315), and the process is terminated (S330).

(3) If the authentication is successful, the access right management unit 12 changes the authenticated flag of the corresponding account of the access right information to Yes (S122).

(4) Here, because the account with the account name “tmpuser” was successfully authenticated, the access right information is changed to “Y esj” for the account with the account name “tmpuser” as shown in FIG. Thereafter, the authentication success is returned to the memory card using terminal 3 (S123).

When the memory card using terminal 3 receives the authentication success (S313, S314), it transmits a data access request to the memory card 1 again (S303).

(1) When the memory card 1 receives the data access request (S103, SI 04), the access right management unit 12 checks whether or not it has the right to access the data again (S140).

Figure 15).

(2) This time, as shown in Fig. 24, the account with the account name "tmpuser" has been authenticated, and since the accessible area includes storage area B, the access right management unit 12 has the right. Judge.

(3) Therefore, the memory card 1 accesses the data in the data storage unit 13 in response to the data access request (S141), and transmits the result as a data access response (success) to the memory card using terminal 3 (S142). ).

[0074] Upon receiving the data access response (success) (S304, S305), the memory card using terminal 3 displays the data access result (S320).

[0075] As described above, the access right of the account “tmpuser” added in the access right setting terminal 2 is valid even after the memory card 1 is replaced with the memory card using terminal 3. Can access the data inside. [0076] Here, the memory card 1 is removed from the memory card using terminal 3 and connected again. Then, since the memory card 1 is connected to another terminal (S101), the “card access right update process” is performed again (S102). Since this operation has already been described, detailed description is omitted, but in the access right information in the state of FIG. 24, the effective count of the account name “tmpuser” is subtracted from 1 (FIG. 22, S404). , 0 (S405). For this reason, the account with the account name “tmpuser” is deleted from the access right information (S406), and the memory card cannot be accessed with this account name and password. Figure 25 shows the access right information in this state.

As described above, the memory card 1 according to the first embodiment is provided with a counter for the access right for accessing the data in the memory card, and the memory card is set to another device (access right setting) more than a certain number of times. When connecting to both terminal 2 and memory card using terminal 3), the access right is determined to be invalid (NO in S803 in FIG. 15, YES in S405 in FIG. 22, YES in S405 in FIG. 27). This makes it possible to revoke access rights that are used only temporarily without any special operation.

[0078] In the above description, when the memory card 1 is connected to another terminal (both the access right setting terminal 2 and the memory card using terminal 3), the process of invalidating the access right according to the number of times is performed. I decided to do it. However, the access right may be invalidated when the connection between the memory card 1 and another terminal is disconnected.

In the above description, the account is deleted when the access right becomes invalid. However, the access right may be left invalid without deleting the account information.

[0079] In the above description, the power to specify an account name and password for each account. Of course, it is possible to omit the account name and perform authentication using only the password.

[0080] Further, an implementation in which a password is also omitted may be used. FIG. 26 shows access right information when a temporary account is added with the account name and password omitted. In FIG. 26, the account name and password are omitted as “none”. FIG. 27 is an operation flowchart of the “access right update process at the time of card connection” of the memory card 1 when mounting so that the account name and password can be omitted. In addition to the operation flowchart of FIG. 22, the processing of S501 and S502 is added. That is, the account name and password If both are “none” (S501), and if both are “none”, the authenticated flag is changed to “Yes” (S502). Since this processing is performed when the memory card is connected, it is treated as already authenticated when accessing the memory card thereafter.

In the above description, it is assumed that a valid count is set at the time of account registration, and the access right is invalidated when a certain number of connections are made by reducing the valid count when connecting to another device. However, it is not limited to this, but for example, it is possible to memorize the upper limit value and increase the counter to increase the number of counters.

In the above description, the memory card 1 and the access right setting terminal 2 or the memory card using terminal 3 are physically connected by wire. However, this is only an example, and a wireless connection may be used. In this case, it is assumed that the connection is established when the wireless line between the memory card 1 and the access right setting terminal 2 or the memory card using terminal 3 is connected, and the “access right update process at the time of card connection” is performed.

In the above description, the access right setting terminal 2 or the memory card using terminal 3 has been described as separate terminals, but it is needless to say that both functions may be provided in one terminal.

[0084] Further, in the above description, the memory card may be a storage medium having the shape of a force card described as a memory card and capable of storing data.

[0085] Further, the apparatus may not be a storage medium intended for data recording, but may be an apparatus that provides functions to other devices. For example, when the present invention is applied to a wireless communication card that provides a wireless communication function such as cellular phone communication, it is possible to temporarily lend the wireless communication card to another person for communication. The configuration in this case is shown in FIG.

FIG. 28 shows the configuration of a wireless communication card using system that uses the wireless communication card 4.

In FIG. 28, the wireless communication card 4 provides a wireless communication function to the connected terminal. The wireless communication card 4 corresponds to the memory card 1 shown in FIG. Components having the same reference numerals have similar functions. The wireless communication card 4 includes a wireless communication unit 43 (an example of an access target unit) that provides a wireless communication function, an access right management unit 12 that manages access rights and passwords for using the wireless communication unit 43, and other devices. And an access control unit 11 that controls access to the wireless communication unit 43 according to the access right. The access right setting terminal 2 is the same as in FIG. Wireless The communication card using terminal 5 is a terminal that uses the wireless communication function of the wireless communication card 4. The wireless communication card using terminal 5 corresponds to the memory card using terminal 3 of FIG. Components with the same reference have similar functions. The wireless communication card using terminal 5 includes a use side memory card interface unit 33 that interfaces with the wireless communication card, a wireless communication use unit 52 that uses the wireless communication function, and displays information to the user and receives operations from the user. A user-side display operation unit 31. The wireless communication card using terminal 5 is, for example, a PC or a PDA.

As described above, the configuration shown in FIG. 28 is almost the same as the configuration using the memory card shown in FIG. The data storage unit 13 of the memory card 1 is replaced with the wireless communication unit 43 of the wireless communication card 4, and the memory card using unit 32 of the terminal 3 using the memory card is replaced with the wireless communication using unit 52 of the terminal 5 using the wireless communication power. Only. Note that the operation when the present invention is applied to a wireless communication card is also different from the operation of the memory card only by replacing them.

[0088] In the memory card according to Embodiment 1, the access right information storage unit stores the access right information, and the access right management unit invalidates the access right indicated by the access right information based on the number of connections with other devices. Judge whether force. This makes it easy to set temporary access rights. In addition, the temporarily set access right can be easily invalidated. In addition, since the access right indicated by the access right information is determined based on the number of connections, it is possible to improve the security of data in the data storage unit to be accessed.

In the memory card of Embodiment 1, the access right management unit also reduces the valid count when connected to the access right setting terminal as another device. Therefore, it is possible to improve the security of data in the data storage unit to be accessed. Also, the set access right can be easily released.

In the memory card of the first embodiment, the access right information storage unit stores access right information for each account, and the access right management unit determines whether the access right indicated by the access right information is invalid for each account. . For this reason, it is possible to easily set and release access rights for each user. In the memory card of the first embodiment, the access right information storage unit stores a valid count as a predetermined initial value, and the access right management unit decrements the valid count every time it is connected to another device. For this reason, it is possible to set an access right according to the importance.

Since the memory card according to the first embodiment includes a data storage unit as an access target, an access right for using stored data can be easily set, and the set access right can be easily released. For this reason, the data to be stored can be used effectively among multiple people.

In the memory card according to the first embodiment, since the data storage unit is configured with a plurality of storage area capabilities, it is possible to set a privileged access right for each piece of data desired to be used by another person.

[0094] The wireless communication card of the first embodiment

The access right information storage unit stores access right information that permits access to the wireless communication unit, and the access right management unit determines whether the access right indicated by the access right information is invalid based on the number of connections with other devices. judge. Therefore, the access right for using the communication function can be easily set, and the set access right can be easily released.

The access right setting terminal according to the first embodiment includes an access right setting control unit for setting, changing, and deleting an access right, so that the access right can be easily set.

[0096] Embodiment 2.

The second embodiment will be described with reference to FIG. 29 to FIG. In the first embodiment, the access right is determined to be invalid when the memory card 1 is connected to another device a certain number of times. On the other hand, the second embodiment is an embodiment in which an upper limit is imposed on the number of accesses to the memory card 1.

The configuration of the system is the same as that of the memory card utilization system of FIG. 1 and FIG. 3, and description thereof is omitted. That is, the embodiment in which the upper limit is given to the number of connections in the first embodiment applies to the embodiment in which the upper limit is given to the number of accesses to the memory card 1.

FIG. 29 is an operation flowchart of the memory card 1. In the operation flowchart of the memory card 1 of the first embodiment shown in FIG. 11, after checking the access right to the data (S1 40), before performing the data access process (S141), the effective count of the access right information is counted. Subtraction processing (S600) has been added! FIG. 30 shows a more detailed operation flowchart of the effective count subtraction process (S600) by the access right management unit 12. This operation is almost the same as the “Access right update process at the time of card connection” in Embodiment 1 (Fig. 22). The point that the authenticated flag is not cleared and the account whose authenticated flag is Yes are valid. The difference is that only 1 is subtracted from the count.

(1) When the access right management unit 12 starts the valid count subtraction process, the access right management unit 12 performs a process of updating the valid count for the account that is currently accessing data in the access right information (S701, et al. S707).

(2) First, for the account that is accessing data, whether or not the authenticated flag is “Yes” is checked (S702), and if it is “No”, the process is terminated.

(3) If “Yes”, it is checked whether the valid count is “permanent” (S703), and if it is “permanent”, the process is terminated. If the valid count is not “permanent”, 1 is subtracted from the valid count (S704).

(4) As a result, the access right management unit 12 checks whether the valid count is “0” (S705). If it is “0”, the access right management unit 12 determines that this account is invalid, and Delete from the access right information (S706) and end the process (S707)

[0100] As described above, according to the present embodiment, the effective count is reduced every time data in the memory card is accessed, thereby limiting the number of times data is accessed for the access right to the data in the memory card. The access right can be revoked if access is made more than a certain number of times.

[0101] When the memory card is connected, it does not matter if the effective count is not reduced. FIG. 31 shows an operation flowchart of the “access right update process at the time of force connection” executed when the memory card 1 is connected to another device when mounted in this way. In contrast to the “card connection access right update process” of the first embodiment shown in FIG. 22, the process of decrementing the effective count of access right information from S402 to S407 is deleted. With this implementation, the access right does not change simply by connecting the memory card 1 to another terminal.

[0102] In the memory card of the second embodiment, the access right information storage unit stores the access right information, and the access right information is stored on the basis of the number of access requests from the memory card using terminal. Determine whether the indicated access right is invalid. For this reason, temporary access Can be easily set. In addition, the temporarily set access right can be easily deleted. Further, since it is determined whether the access right indicated by the access right information is invalid based on the number of access requests, the data security of the data storage unit to be accessed can be improved.

[0103] In the memory card of Embodiment 2, the access right information storage unit stores access right information for each account, and the access right management unit accesses the access right information indicated by the number of access requests for each account. Determine whether to revoke rights. Therefore, access can be easily set and released for each user. In addition, it is possible to improve the security of the data storage data to be accessed.

In the memory card of the second embodiment, the access right information storage unit stores the valid count as a predetermined initial value, and the access right management unit decrements the valid count for each access request. For this reason, it is possible to set access rights according to importance.

The memory card according to the second embodiment includes a data storage unit as an access target,

The access right management department S determines whether the access right indicated by the access right information is invalid based on the number of access requests to the data storage section, thus preventing the use of data stored in the data storage section and data leakage Can be achieved.

[0106] In the memory card of the second embodiment, since the data storage unit is configured with a plurality of storage areas, data is used by setting an access right for each piece of data to be used by another person. be able to. In addition, data leakage can be prevented.

Further, in the above description, the power described with the memory card as an example As in the first embodiment, the access right management device may be a device that provides a function to other devices such as a wireless communication card. Since the configuration in this case is the same as that of the first embodiment (FIG. 28), description thereof is omitted. Also, regarding the operation, the operation in the case of the real memory card is simply replaced in the same manner as in the first embodiment, and the description is omitted.

In the wireless communication card according to the second embodiment, the access right information storage unit stores access right information that allows access to the wireless communication unit, and the access right management unit is based on the number of access requests to the wireless communication unit. To determine whether the access right indicated by the access right information is invalid. For this reason, the access right to use the communication function can be easily set and The access right can be easily released.

Since the access right setting terminal according to the second embodiment includes an access right setting control unit for setting, changing, and deleting an access right, the access right can be easily set.

[0109] The memory card (storage medium) according to Embodiment 1 is an access that invalidates the access right to internal data when it is connected more than the number of times that is preliminarily set when connecting to another device. A management unit is provided.

[0110] The memory card (storage medium) according to Embodiment 1 is characterized in that, when the access right is invalidated, the information of the account having the invalidated access right is deleted.

[0111] When the memory card (storage medium) of the first embodiment is set to require no authentication such as a password, the access right is automatically enabled when connected to another device. Features.

[0112] The memory card (storage medium) according to the second embodiment includes an access right management unit that invalidates an access right when an access request from another device is received more than a preset number of times. It is characterized by that.

[0113] The wireless communication card according to the first embodiment includes an access right management unit that invalidates an access right when the wireless communication card is connected more than a preset number of times when connected to another device. Features.

[0114] The wireless communication card of Embodiment 1 is characterized in that, when an access right is invalidated, information on an account having an invalid access right is deleted.

[0115] The wireless communication card according to Embodiment 1 is characterized in that the access right is automatically enabled when connecting to another device when authentication such as a password is not required. The

[0116] The wireless communication card according to the second embodiment is characterized in that it includes an access right management unit that invalidates an access right when an access request from another device is received a predetermined number of times or more.

Brief Description of Drawings

FIG. 1 is a configuration diagram of a memory card utilization system in a first embodiment.

FIG. 2 shows a configuration of a memory card and an access right setting terminal in the first embodiment. 圆 3] The configuration of the memory card using terminal in the first embodiment is shown.

FIG. 4 shows an appearance of a memory card and a memory card using terminal in the first embodiment. 5] The appearance of the memory card and the memory card using terminal in the first embodiment is shown.

FIG. 6 shows a hardware configuration of the memory card in the first embodiment.

FIG. 7 shows an appearance of an access right setting terminal in the first embodiment.

FIG. 8 shows a hardware configuration of an access right setting terminal in the first embodiment.

FIG. 9 shows an example of access right information in the first embodiment.

FIG. 10 is a flowchart showing how the memory card is used in the first embodiment.

FIG. 11 is an operation flowchart of the memory card 1 in the first embodiment.

FIG. 12 is an operation flowchart of the access right setting terminal 2 in the first embodiment.

FIG. 13 shows a sequence of exchange between the memory card 1 and the access right setting terminal 2 in the first embodiment.

FIG. 14 shows a continuation of FIG.

FIG. 15 is an operation flowchart of processing of the access right management unit 12 for determining whether or not there is an access right in the first embodiment.

FIG. 16 is an example of access right information after user authentication managed by the access right management unit 12 in the first embodiment.

FIG. 17 is an example of a display screen of access right information displayed by the access right setting terminal 2 in the first embodiment.

FIG. 18 shows an example of access right information after adding an account managed by the access right management unit 12 in the first embodiment.

FIG. 19 is an operation flowchart of the memory card using terminal 3 in the first embodiment.

FIG. 20 shows a sequence of exchange between memory card 1 and memory card using terminal 3 in the first embodiment.

FIG. 21 shows the continuation of FIG.

FIG. 22 is an operation flowchart of “access right update process at the time of card connection” of the memory card 1 according to the first embodiment.

[FIG. 23] “Access when card is connected” managed by access right management unit 12 in Embodiment 1. 12 is an example of access right information after execution of “right update processing”.

24] This is an example of access right information after the memory card using terminal 3 in the first embodiment performs user authentication.

FIG. 25 shows an example of access right information after the added account in the first embodiment is deleted.

FIG. 26 is an example of access right information when the account name and password are omitted in the first embodiment.

FIG. 27 is an operation flowchart of “access right update process at the time of card connection” by the access right management unit 12 when the account name and password are omitted in the first embodiment.

FIG. 28 is a configuration diagram of a wireless communication card utilization system in the first embodiment.

FIG. 29 is a flowchart of the operation of the memory card 1 in the second embodiment.

FIG. 30 is a flowchart of the operation of “valid count subtraction processing” of the memory card 1 in the second embodiment.

FIG. 31 is a flowchart of an operation of “access right update processing at the time of card connection” of the memory card 1 when the valid count is not reduced at the time of connection in the second embodiment.

Explanation of symbols

1 memory card, 11 access control unit, 12 access right management unit, 13 data storage unit, 14 storage area, 15 access right information storage unit, 121 CRT display device, 122 K ZB, 123 mouse, 124 CDD, 140 system unit, 141 card insertion section, 142 FDD, 143 ROM, 144 RAM, 150 magnetic disk unit, 151 OS, 152 window system, 153 programs, 154 files, 160 CPU, 161 bus, 2 access right setting terminal, 21 settings Side display operation unit, 22 access right setting control unit, 23 setting side memory card interface unit, 3 memory card using terminal, 31 user side display operation unit, 32 memory card using unit, 33 user side memory card interface unit, 4 wireless Communication card, 43 wireless communication unit, 5 wireless communication card using terminal, 52 wireless communication using unit, 60 mobile phone, 70 mobile terminal, 80 CPU, 81 bus, 82 ROM, 83 connection Parts, 90 nonvolatile memory, 91 data group, 92 the access right information, 93 programs.

Claims

The scope of the claims

[1] Access requesting device that requests access The access target part that is requested to access as an access target,

An access right management device comprising:

[2] The other device is:

The access right management device according to claim 1, further comprising an access right setting device capable of at least either changing or deleting the access right information stored in the access right information storage unit.

[3] The access right information storage unit

As the access right information,

The access right management unit

Each time it is connected to any of the other devices including the access requesting device, the number of times of connection is incremented, and the access right information for each user stored in the access right information storage unit is stored based on the counted number of times of connection. The access right to the access target part is determined based on the access right information for each user indicating the access right determined to be invalid when it is determined whether or not at least one access right is invalid. 2. The access right management device according to claim 1, wherein access to the access target unit by the access requesting device requesting access is denied.

[4] The access right information storage unit Storing a predetermined initial value as part of the access right information;

The access right management unit

The access right information stored in the access right information storage unit determines whether or not the access right indicated by the access right information is invalid based on the counted number of connections and the predetermined initial value. Access right management device.

[5] The access target part is:

2. The access right management apparatus according to claim 1, further comprising a data storage unit for storing predetermined data.

[6] The data storage unit includes:

A plurality of storage areas for storing data;

6. The access right management apparatus according to claim 5, wherein access to at least one of the plurality of storage areas is permitted.

[7] The access target part is:

2. The access right management device according to claim 1, further comprising a wireless communication unit capable of wireless communication.

[8] An access request unit that requests access also stores an access target unit that is requested to be accessed as an access target, and access right information indicating an access right that permits access from the access requesting device to the access target unit. In an access right management device comprising an access right information storage unit, an access right management method for managing the access right information includes:

An access right management method comprising: denying access to the access target unit when the access right is determined to be invalid.

[9] The access requesting device that requests access is also requested to be accessed as an access target unit, and access from the access requesting device to the access target unit is authorized. An access right management program for causing an access right management device having an access right information storage unit for storing access right information indicating an access right to execute the process for managing the access right information to ,

An access right management program for causing the access right management device to execute the above.

[10] An access right to be stored as the access right information in the access right management device according to claim 1 is set, and the set access right is stored in the access right management device according to claim 1. An access right setting device comprising an access right setting control unit for storing information.

[11] Access requesting device capability to request access The access target unit that is requested to access as an access target,

The access request device that requests access to the access target unit based on the access right information stored in the access right information storage unit counts the number of access requests every time an access request is received, and counts the number of access requests counted And determining whether the access right indicated by the access right information stored in the access right information storage unit is invalid, and determining that the access right is invalid, the access request device power to the access target unit An access right management device comprising: an access right management unit that denies access.

[12] The access right information storage unit includes:

As the access right information,

By using an account for identifying a user, access right information for each user indicating access right information for each user is stored, The access right management unit

Each time an access request is received from the access requesting device that requests access to the access target unit based on any of the user-specific access right information stored in the access right information storage unit, the access request count is counted. It is determined whether or not the access right indicated by the access right information for each user related to the access request is invalid based on the counted number of access requests. If the access right is judged to be invalid, it is judged invalid. 12. The access to the access target unit by the access requesting device that requests access to the access target unit based on the user-specific access right information indicating the access right is rejected. Access right management device.

[13] The access right information storage unit includes:

Storing a predetermined initial value as part of the access right information;

The access right management unit

12. The access right according to claim 11, wherein it is determined whether or not an access right indicated by the access right information stored in the access right information storage unit is invalid based on the counted number of access requests and the initial value. Management device.

[14] The access target part is:

12. The access right management apparatus according to claim 11, further comprising a data storage unit that stores predetermined data.

[15] The data storage unit includes:

A plurality of storage areas for storing data;

15. The access right management device according to claim 14, wherein access to at least one of the plurality of storage areas is permitted.

[16] The access target part is:

12. The access right management device according to claim 11, further comprising a wireless communication unit capable of wireless communication.

[17] Access requesting device capability for requesting access An access target unit that is requested to access as an access target, and access from the access requesting device to the access target unit is authorized. In an access right management device comprising an access right information storage unit for storing access right information indicating an access right, the access right management method for managing the access right information includes:

[18] Access requesting device capability for requesting access Stores an access target unit that is requested to be accessed as an access target, and access right information indicating an access right that permits access from the access requesting device to the access target unit. In an access right management program for causing an access right management device having an access right information storage unit to execute a process for managing the access right information! /,

[19] An access right to be stored as the access right information in the access right management device according to claim 11 is set, and the set access right is stored in the access right management device according to claim 11. An access right setting device comprising an access right setting control unit for storing information.