WO2023090297A1

WO2023090297A1 - Storage device and program

Info

Publication number: WO2023090297A1
Application number: PCT/JP2022/042268
Authority: WO
Inventors: 貴旨宮長; 秀治竹島
Original assignee: ＶｅｒｂａｔｉｍＪａｐａｎ株式会社
Priority date: 2021-11-22
Filing date: 2022-11-14
Publication date: 2023-05-25

Abstract

[Problem] To protect data without impairing convenience. [Solution] Provided is a storage device 10 including a connection interface 110, a memory chip 120, and a memory controller 130. The connection interface 110 gives and receives information to and from an electronic device that accepts file operation from a user. The memory chip 120 has a storage area 122 that stores data. The memory controller 130 manages, when a command received from the electronic device as a connection destination is a command other than a protection OFF command, data reading and writing to the storage area 122 so as to prohibit, for the electronic device as the connection destination, at least overwriting of the data stored in the storage area 122.

Description

Storage device and program

The present invention relates to storage devices.

Conventionally, hard disk drives equipped with magnetic disks and heads have been used as storage devices for storing various types of data. is progressing. For example, Japanese Patent Laid-Open No. 2002-200303 is cited as a prior art related to a storage device using a memory chip.

JP-A-5-73433

Specific examples of storage devices (also referred to as storage media) using memory chips include SSDs (Solid State Drives) and USB (Universal Serial Bus) memories equipped with flash memories. These storage devices are equipped with memory controllers for controlling data writing to and reading from the memory chips.
In recent years, as the need for information security has increased, there has been a demand for rewritable storage media such as SSDs that are used by general users to take countermeasures against peeping and falsification of data by third parties. Here, for example, it is conceivable to encrypt the entire data stored in the storage medium and to make the data confidential by requiring the user to enter authentication information such as a password each time the storage medium is connected to the computer. However, it is troublesome to enter the password, and there is a risk that if the password is forgotten, all data will be inaccessible. That is, convenience is sacrificed for data protection.

The purpose of the present invention is to protect data without impairing convenience.

A storage device according to a first aspect of the present invention comprises a computer that accepts file operations from a user, a connection interface for exchanging information with a computer, and a storage area, as well as the following memory controller. When the command received from the computer is a command other than a predetermined command, the memory controller instructs the computer to transfer the data stored in the storage area to the storage area so as to prohibit at least overwriting of data stored in the storage area. manages the reading and writing of data in

As a result, unless a predetermined command has been received from the computer connected to the connection interface, at least overwriting of the data stored in the storage area is prohibited. Therefore, if a dedicated application program AP is used to issue a predetermined command, even if the storage device of the first aspect is connected to a computer in which the dedicated application program AP is not installed, the storage area of the storage device can be There is no possibility that the data stored in the memory will be altered (at least overwritten). By installing the dedicated application program AP on the computer used by the user, the user can control ON/OFF of protection of the storage area by the predetermined command.

In a preferred aspect, the memory controller prohibits rewriting until receiving the predetermined command, and permits rewriting from receiving the predetermined command until receiving a predetermined second command.
By installing the dedicated application program AP on the computer used by the user, the user can turn off the protection of the storage area by the predetermined command and turn on the protection by the predetermined second command. be able to.

In a preferred aspect, when the memory controller does not receive the predetermined command, the memory controller prohibits new writing of the file stored in the storage area, but permits reading of the file.
This allows the storage device to function as a ROM (Read Only Memory) until a predetermined command is received.

In a preferred embodiment, the memory controller permits recording of a new file in the storage area when the predetermined command is not received. Thereby, overwriting (rewriting) of the data stored in the storage area can be prohibited until the predetermined command is received.

In a preferred embodiment, the storage area includes a data area in which files specified by the user are stored, and a management area for storing access history to the data area. Then, the memory controller stores a log in the management area at least when the rewriting process is executed. This makes it possible to record at least that the rewriting process has been executed.

In a preferred aspect, the memory controller, in response to a request from the computer, generates an illegal disconnection indicating that the connection with the computer has been terminated after receiving the predetermined command and before receiving the predetermined second command. Information is stored in the management area. As a result, it is possible to record that the connection with the computer has been illegally disconnected before the predetermined second command is received.

In a preferred embodiment, a pattern data string that is not recorded by the OS (Operating System) is stored in a predetermined area within the management area of the storage device. By using the MBR (Master Boot Record) or boot sector as the predetermined area, it is possible to detect a change in the partition assigned to the data area or a reformatting of the data area.

In another aspect of the present invention, a step of acquiring identification information of a storage device connected to the computer in a computer; and outputting a predetermined command for releasing the write prohibition.
According to this program, even if a command instructing reading and writing of data stored in the storage area is received from a computer connected to the connection interface, if a predetermined command is not received prior to the command, at least the storage area overwriting of data stored in the

In a preferred aspect, the program receives a specification of data to be written from a user after outputting the predetermined command; and outputting to the computer. Thus, the user can turn off the protection of the storage area of the storage device using the predetermined command and then turn the protection on with the predetermined second command.

In a preferred aspect, if the obtained identification information is registered in advance, the program determines whether or not setting information about data rewrite prohibition is recorded in the storage device, indicates that rewriting of data is permitted, storing prohibition information to the effect that writing to the storage device is prohibited in a management area of the storage device; and storing the prohibition information in the management region. If so, causing the computer to further execute a step of rejecting a write request from a user to the storage device.

In a preferred aspect, the program determines whether or not a data string of a predetermined pattern is stored in a predetermined area in the management area of the storage device when the acquired identification information is registered in advance. and rejecting the user's write request to the storage device if the data string is not stored.

In a preferred aspect, the program, when connected to the storage device, stores information indicating that the connection with the computer has been terminated after receiving the predetermined command and before receiving the predetermined second command, When obtained from the storage device, the second predetermined command is output to the storage device.

1 is a diagram showing a configuration example of a computer system 1 including a storage device 10 and a personal computer 20 having a dedicated application program AP installed according to an embodiment of the present invention; FIG. 4 is a flow chart showing the flow of release processing executed by the personal computer 20 according to the dedicated application program AP. 4 is a flow chart showing the flow of write processing executed by the personal computer 20 according to the dedicated application program AP. It is a figure for demonstrating the operation|movement in this embodiment. It is a figure which shows the structural example of 1 A of computer systems concerning a modification. It is a figure which shows the structural example of the computer system 1B concerning a modification. It is a figure which shows the structural example of the log file concerning a modification.

Various technically preferable limitations are attached to each embodiment described below. However, embodiments of the present invention are not limited to the forms described below.

A. Embodiment FIG. 1 is a diagram showing a configuration example of a computer system 1 including a storage device 10 and a personal computer 20 having a dedicated application program AP installed according to an embodiment of the present invention. In FIG. 1, "personal computer" is written as "PC", and the same applies hereinafter in this specification. The storage device 10 is an SSD having a function of protecting stored data, and is detachably attached to the PC 20 .

The storage device 10 is shipped with protection enabled. That is, when the user uses the storage device 10 for the first time after purchasing it, the protection is always effective. When the protection is valid, reading data from the storage device 10 is permitted, but writing data to the storage device 10 is prohibited. Writing data to the storage device 10 in general means rewriting data already stored in the storage device 10 , renaming data already stored in the storage device 10 , and writing new data to the storage device 10 . Data can be read from the storage device 10 even when the protection is valid. In other words, the storage device 10 with protection enabled functions as a ROM (Read Only Memory).

A dedicated application program AP paired with the storage device 10 is pre-installed in the PC 20 . The dedicated application program AP is sold together with the storage device 10, for example. For installation, for example, the user who purchased the storage device 10 performs the installation work on the PC 20 to which the user wants to connect and use the storage device 10 (if there are multiple such PCs 20, all of them). This dedicated application program AP is a program for allowing the user to control ON (protection enabled)/OFF (protection released) of protection (that is, data writing) of the storage device 10 . Identification information for uniquely identifying the storage device 10 is registered in the dedicated application program AP in advance, and this identification information is also stored in the storage device 10 in advance. Specific examples of this identification information include the device ID and serial number of the storage device 10 . In the PC 20, the dedicated application program AP may be executed as a resident application and kept in a running state at all times.

Further, it is also possible to distinguish between commands from the dedicated application program AP and commands from others, and the storage device 10 can handle only commands from the PC 20 on which the dedicated application program AP is being executed. As a result, it is possible to prevent acceptance of commands maliciously issued to the storage device 10 due to cyberattacks or the like. In order to achieve this, prior to the instruction issued from the dedicated application program AP to the storage device 10, a command indicating that it is from the dedicated application program AP may be issued to the storage device 10. FIG. Alternatively, a unique command different from the command issued from the OS may be used as the command issued from the dedicated application program AP.

The PC 20, which is running the dedicated application program AP as an application, uses the instruction to write data to the storage device 10 as a trigger to execute a release process for releasing the protection of the storage device 10.

FIG. 2 is a flowchart showing the flow of cancellation processing. As shown in FIG. 2, the release process in this embodiment includes a confirmation step SA110 and a protection OFF step SA120.

At the confirmation step SA110, the PC 20 acquires identification information from the storage device 10 connected to itself. In protect OFF step SA120, PC 20 first determines whether or not the identification information acquired in confirmation step SA110 is registered in advance.

Next, when the PC 20 determines that the identification information acquired in the confirmation step SA110 is registered in advance, the PC 20 outputs to the storage device 10 a protect OFF command, which is a command instructing release of protection. do. A protect OFF command is an example of a predetermined command in the present invention. If the PC 20 determines that the identification information acquired in the confirmation step SA110 is not pre-registered, it may handle the storage device 10 as a ROM without outputting the protect OFF command. An error message may be output to notify the user of the discrepancy in the identification information.

When the protection of the storage device 10 is released by executing the release processing, the PC 20 writes data to the storage device 10 by executing the write processing shown in FIG. As shown in FIG. 3, the write process includes acceptance step SB110 and protect ON step SB120.

At the receiving step SB110, the PC 20 receives from the user the designation of data to be written. As a specific example of specifying data to be written, for example, file management such as a file manager that is standardly installed in the OS, or a file manager that is independently constructed by a dedicated application program separately from the file manager that is standardly installed in the OS. A file operation such as drag-and-drop of a file to the storage device 10 on the user interface screen of the application is exemplified. In protect ON step SB120, PC 20 writes data to storage device 10 in accordance with the specification of the data to be written received in receiving step SB110. When the data writing to the storage device 10 is completed, the PC 20 outputs to the storage device 10 a command for prohibiting data writing to the storage device 10 , that is, a protect ON command for enabling protection of the storage device 10 . A protect ON command is an example of a second predetermined command in the present invention.

Next, the configuration of the storage device 10 will be described with reference to FIG.
As shown in FIG. 1, the storage device 10 includes a connection interface (I/F) 110, a memory chip 120, and a memory controller .

The connection I/F 110 is, for example, a USB interface, for detachably attaching the storage device 10 to other electronic equipment such as the PC 20. The connection I/F 110 exchanges various types of information with a connected electronic device.

The memory chip 120 serves as a storage area 122 for storing various data such as files. The storage area 122 is divided into a data area 122a and a management area 122b. Various data such as files are stored in the data area 122a. The history (log) of accesses to the data area 122a is stored in the management area 122b. By referring to the history stored in the data area 122a, the user can grasp how the data area 122a was accessed. Note that the log may be recorded only when the data already stored in the data area 122a is overwritten or the name is changed (that is, the process of rewriting the stored data).

The memory controller 130 receives various commands from the connected electronic device via the connection I/F 110 . Examples of commands received by the memory controller 130 from the connected electronic device via the connection I/F 110 include new writing of data to the memory chip 120, overwriting of already stored data, renaming of already stored data, Alternatively, a command for instructing reading of data, the aforementioned protect OFF command, and the aforementioned protect ON command can be used.

If the command received from the connected electronic device while the protection of the storage device 10 is enabled is a command other than the protection OFF command, the memory controller 130 permits reading of the data stored in the storage area 122. On the other hand, it manages the reading and writing of data to the storage area 122 so as to prohibit writing to the storage area 122 in general. This is because the storage device 10 functions as a ROM until a protection OFF command is received from the connected electronic device.

When the memory controller 130 receives the protect OFF command, it cancels the protection of the storage device 10 . As a result, in addition to reading data from the storage area 122, general writing to the storage area 122 is permitted from the time the protect OFF command is received until the protection is enabled again. The memory controller 130 stores a history in the management area 122b when new data is written to the storage area 122, stored data is rewritten, or stored data is renamed. Upon receipt of the protect ON command, the memory controller 130 activates the protection of the storage device 10 (that is, restores the protect ON state).

FIG. 4 is a sequence diagram showing an operation example of the storage device 10 and the PC 20. As shown in FIG.
The storage device 10 is attached to the PC 20 at time t0. At this point, protection is ON. Next, when a file is dragged and dropped to the storage device 10 by a file management application such as a file manager, the PC 20 executes the cancellation process described above. The PC 20 acquires the identification information from the storage device 10 by executing the confirmation step SA110 described above (FIG. 4: S001). The PC 20 then executes the protect OFF step SA120 described above. As described above, the PC 20 determines whether or not the identification information obtained in confirmation step SA110 has been registered.
In this operation example, the identification information of the storage device 10 has already been registered in the dedicated application program AP of the PC 20, so the determination result of this determination is "Yes". Therefore, the PC 20 transmits a protect OFF command to the storage device 10 (FIG. 4: S002).

When the memory controller 130 of the storage device 10 receives the protection OFF command via the connection I/F 110, the protection of the storage device 10 is canceled. As shown in FIG. 4, when the memory controller 130 receives the protect OFF command at time t1 (t0<t1), the protect state of the storage device 10 is switched from ON to OFF at time t1.

At time t2 (t1<t2), the specification of the file is accepted at the acceptance step SB110 described above, and the file is written to the storage area 122 at the protection ON step SB120 ( FIG. 4 : S003). , the writing of this file is completed at time t3 (t2<t3). Then, at time t3, the protection ON command is output from the PC 20 to the storage device 10 (FIG. 4: S004). When the memory controller 130 of the storage device 10 receives the protection ON command via the connection I/F 110, the protection of the storage device 10 is returned to ON.
After that, when the user performs another file operation on the PC 20, S001 to S004 are executed. In this case, since the PC 20 has already acquired the identifier of the storage device 10, if it detects that the connection state of the storage device 10 is maintained, the process of S001 may be omitted.

As described above, according to this embodiment, the user can control ON/OFF of the protection of the storage device 10 by causing the PC 20 to output the protection OFF command and the protection ON command according to the dedicated application program AP. . When the storage device 10 is shipped, protection is ON, and writing to the memory chip 120 is prohibited until a protection OFF command is received. Also, when an operation such as writing to or reading from a certain file is completed, the protection ON state is always restored.

Therefore, for example, when the storage device 10 is attached to a computer device in which the dedicated application program AP is not installed, protection is always on and a protect OFF command is never received from this computer device. The state in which the protection of the storage device 10 is maintained is guaranteed. Therefore, for example, if ransomware is installed in the PC 20 and the ransomware accesses the memory controller 130 to write or alter data in the memory chip 120, the memory controller 130 does not accept writing to the memory chip 120. Since it is in this state, there is no fear that the data stored in the memory chip 120 will be altered or that virus software or the like will be written.

In addition, once the dedicated application program AP is installed in the PC 20, it is sufficient to perform file operations in the same way as normal file operations using a file manager or the like, and authentication work is performed each time the storage device 10 is connected. Also, the user's convenience is not impaired.

As a method for prohibiting rewriting of data in the storage device 10, a dedicated application program AP checks a file recorded in the storage device 10 prior to writing data to the storage device 10, and confirms that the file has already been recorded. If it is, writing may be omitted.

In addition, in order to strengthen the response to cyber-attacks, it is also effective to support only drag-and-drop of files using a file manager independently constructed by a dedicated application program. For this reason, the dedicated application program may not accept file operations such as drag-and-drop and deletion by file managers other than the file manager independently constructed by the dedicated application program.

B. Other Embodiments The PC 20 may further confirm the current protection status of the storage device 10 in confirmation step SA110. Specifically, when the PC 20 recognizes the storage device 10, the PC 20 notifies the memory controller 130 of the current protection state of the storage device 10 (ON state (state in which the protection ON command was last received from the PC 20)). or OFF state (the last received command from the PC 20 was a read command or a write command)). Information indicating the protection state may be stored as flag information in the memory controller 130 itself, or may be stored in the management area 122b and read by the memory controller 130 .

Here, as described above, if the operation is normal, the protection should be ON except when the file is being operated. is. However, an abnormal operation may be performed during communication between the storage device 10 and the PC 20, such as a malicious person pulling out the storage device 10 from the PC 20 during a file operation, or accidentally pulling it out without malice. If the memory controller 130 is not connected to the PC 20 in which the dedicated application program AP is installed, the protection ON signal will not be supplied to the memory controller 130, so there is a possibility that the protection will be canceled (that is, the security will not be guaranteed). state) will persist forever.

Therefore, when the PC 20 detects that the storage device 10 connected to the PC 20 is in the protect OFF state, the PC 20 supplies a protect ON command to the memory controller 130 to at least inhibit subsequent data writing. , forcibly restores the storage device 10 to the protection ON state.

In addition, the PC 20 preferably warns the user by displaying a message to the effect that the protection was turned off at the time of connection and to the effect that subsequent writing is prohibited. Specifically, when the dedicated application program AP accesses the history information stored in the management area 122b and reads out that information indicating the occurrence of an abnormal operation is stored, the dedicated application program AP reads, "This storage device is unprotected. The previous connection may have terminated abnormally.Forcibly protected." is displayed.

It should be noted that there is a possibility that the data has been tampered with while it is not protected, so it can be understood that the reliability of the data in this storage device 10 is no longer guaranteed. From this point of view, the PC 20 may supply a predetermined command to the memory controller 130 to deny all external access requests including reading in addition to writing in general. In this way, even if an unauthorized program (executable file) such as malware is stored in the storage device 10 while the above protection has been canceled, such a program cannot be removed from the storage device 10 by another person. There is no risk of spreading to other computers.

Specifically, when the storage device 10 is forcibly returned to the protection ON state when connected to the PC 20, the memory controller 130 stores that effect in the management area 122b. As long as the dedicated application program AP stores the information indicating that the protection has been forcibly returned to the ON state in the past, as long as the user of the PC 20 does not perform a predetermined operation, the dedicated application program AP cannot be transferred to the storage device 10. You may choose not to receive any access from The predetermined operation is, for example, inputting an administrator password.
As a result, the storage device 10 whose data may have been tampered with can be practically unusable. When the predetermined operation is executed, the dedicated application program AP deletes the information stored in the management area 122b indicating that the protection has been forcibly turned ON. As a result, the same processing as before the abnormal disconnection, including the processing of writing new data, can be performed on the storage device 10 thereafter.

In addition to the above-described abnormal connection disconnection, unauthorized access to the storage device 10 is prevented even during normal reading and writing, as the protection is in the OFF state during that time. The possibility of doing so cannot be completely ruled out. For example, if the size of the file to be written is large, the write time will be long, and therefore the period of the protection OFF state will also be long. During this period, there is a possibility that a user with an illegal purpose operates the PC 20 to request writing, deletion, or renaming of other files to the storage device 10, resulting in falsification of data. is also conceivable.

Therefore, while the storage device 10 is in the protection OFF state in order to read/write a file specified by the user, any operation from the user on the PC 20, or at least an operation relating to an access request to the storage device 10, is not accepted. may Specifically, when the dedicated application program AP receives a write request for a certain file and starts the protection OFF state, it minimizes the operation screen (window) until the write processing ends and the protection ON state is reached. or make the operation screen invisible, or even if the operation screen can be seen, the operation is not accepted as much as possible, or is not accepted at all. Rejecting as much as possible means, for example, not accepting in principle, but controlling to accept operations only when a predetermined condition is met, or controlling to accept only some of a plurality of operations. . In short, while the storage device 10 is in the protection OFF state for reading/writing the file specified by the user, while the storage device 10 is in the protection OFF state for reading/writing the file specified by the user, Compared to the protection ON state, restrictions on operations are increased or the conditions for operations are made stricter.

However, in general semiconductor storage devices such as SSDs, due to their specifications, when the power supply is cut off, the protection is forcibly turned ON, the protection is forcibly turned ON, and the power supply is cut off. However, according to the above aspect, the specification of the storage device 10 can be applied to any case.
However, it is preferable that the storage device 10 has a function of forcibly turning the protection ON state when the power supply is interrupted. Specifically, the memory controller of the storage device 10 is provided with a function to detect whether or not power is being supplied to the storage device 10. , and has a function of forcibly writing information indicating that the protection is ON in the storage device 10 when the detection is made. In this case, even if such a function unique to the storage device 10 does not operate due to an abnormal operation, the protection ON state is checked when connected to the PC 20, so security is doubled. . Alternatively, the storage device 10 may be forced into the protection ON state when power is supplied from a state in which no power is supplied.

The protect state in the above embodiment is a state in which writing to the storage area 122 is prohibited in general, and the protect OFF command is a command to release the prohibition of writing to the storage area 122 in general. However, as the protect OFF command, although the prohibition of rewriting of stored data is maintained, the first command to release the prohibition of writing new data and the second command to release the prohibition of writing to the storage area in general. Two types may be provided, and the memory controller 130 may determine whether the received protect OFF command is the first command or the second command. In this case, the user can select which of the first command and the second command to output in the dedicated application program AP.

In addition, when the memory controller 130 receives the second command, it permits general writing of data to the storage area 122 until it receives the protect ON command as in the above-described embodiment. permits the reading of data stored in the storage area 122 and the writing of new data to the storage area, but prohibits rewriting of the data already stored in the storage area 122 and returns an error to the command issuing source. good. In addition, in a mode in which the prohibition of rewriting of stored data is maintained even in the protection OFF state, the dedicated application program AP may be caused to execute a process of outputting an error message when the rewriting process is instructed by the user. .

In the above-described embodiment, the protected state is a state in which writing to the storage area is prohibited in general, but writing of new data is permitted, and rewriting of existing data (change of file name, modification of data contents, etc.) is prohibited. It may be in a prohibited state. In this case, if the memory controller 130 does not receive the protect OFF command, the memory controller 130 permits the recording of new data in the storage area 122 and the reading of the data stored in the storage area 122. Data reading and writing to the storage area 122 may be managed so as to prohibit rewrite processing. This is because if the rewriting process of the stored data is prohibited, the data stored in the storage device 10 can be prevented from being altered.

According to this example, it is possible to make the storage device 10 connected to an electronic device that does not have a dedicated application program AP function as a write-once medium. A write-once medium is a recording medium in which new data can be written but written data cannot be rewritten.

Further, when the connection with the connected electronic device is canceled after receiving the protect OFF command and before receiving the protect ON command, the memory controller 130 stores illegal disconnection information indicating illegal disconnection in the management area 122b. may be stored in If the storage device 10 is removed from the connected electronic device before the protection ON command is received, such as during the writing process, the protection of the storage device 10 remains canceled and the data recorded in the storage device 10 is altered. This is because there is a risk of being equalized.

It should be noted that instead of the illegal disconnection information that explicitly indicates that the connection has been illegally disconnected, the memory controller 130 stores status information indicating "accessing" at the time when the protection is canceled in the management area 122b. , the status information may be rewritten from "accessing" to "normally terminated" when processing such as writing to the target data is completed and the protection ON state is restored. In short, when the storage device 10 is reconnected to the PC 20, information indicating that an abnormal termination has occurred should be stored in the management area 122b.

According to this example, if the storage device 10 is removed from the connected electronic device before the protection ON command is received, the evidence is recorded in the management area 122b of the storage device 10. If AP is used, it is possible to check the evidence and take countermeasures such as prohibiting subsequent writing.

If the identification information obtained in the confirmation step SA110 is registered in advance, the dedicated application program AP in this aspect determines whether or not the setting information regarding prohibition of data rewriting is recorded in the storage device 10. and, if the setting information indicates that rewriting of data is permitted, storing prohibition information for prohibiting writing to the storage device 10 in the management area 122b of the storage device 10; If prohibition information is stored in the area 122b, a step of rejecting a write request to the storage device 10 from the user may be further executed by the computer device at the installation destination.

At the time of shipment of the storage device 10, a pattern data string that is not recorded by the OS may be written in a predetermined area in the management area 122b. A specific example of this specific area is an MBR (Master Boot Record) or a boot sector. The MBR is an area indicated by the top address of the logical addresses in the storage device 10 . A boot sector is the leading sector of a partition provided in the storage area 122 of the storage device 10 . The memory capacity of each of the MBR and boot sector may vary depending on the type of OS, but for example it is 512 bytes. When the partition in the storage device 10 is changed by the OS, the storage contents of the MBR are changed according to the OS.

Also, when the storage area 122 in the storage device 10 is formatted by the OS, the stored contents of the boot sector are updated according to the OS. Therefore, by writing a pattern data string that the OS does not record in the MBR or boot sector when the storage device 10 is shipped, whether or not the partition has been changed or reformatted can be detected from the stored contents of the MBR or boot sector. it becomes possible to

It should be noted that the dedicated application program AP in this aspect stores a data string of a predetermined pattern in a predetermined area in the management area of the storage device when the identification information acquired in the confirmation step SA110 is registered in advance. and, if the data string is not stored, rejecting the user's write request to the storage device.

In the above embodiment, a dedicated application program AP that conspicuously characterizes the present invention was pre-installed in the PC 20 . However, the dedicated application program AP may be distributed by downloading via an electric communication line, or may be distributed in a form written on a computer-readable recording medium. As a specific example of the latter, the storage device 10 is shipped with a dedicated application program AP paired with the storage device 10 written in the data area 122a of the storage device 10, and the storage device 10 is first installed in the electronic device after shipment. There is a mode in which a dedicated application program AP is output from the storage device 10 to the electronic device at the time of connection and installed in the electronic device.

In short, in the system of the present invention, a step of acquiring identification information of a storage device connected to the computer; A step of outputting a command for releasing the prohibition of

In addition, the storage device 10 may additionally have functions other than storage. For example, the storage device 10 may be provided with an interface for connecting to a network such as a LAN, and function as a shared storage (NAS (Network Attached Storage)) accessed by a plurality of PCs. That is, the storage device 10 may be provided with a function for realizing the function of a general personal computer.

Specifically, like the storage device 10A shown in FIG. Functions may be incorporated in the control unit 140 in advance. In this case, as shown in FIG. 5, the storage device 10A may be housed in the same housing as the hardware for realizing the functions of a general personal computer. Input/output devices (not shown) such as a keyboard and a display may be connected via, for example, the connection I/F 110, or may be connected via a communication interface for connecting to a network such as a LAN. .

The operation when the storage device 10A is connected to another PC 20 via the connection I/F 110 is the same as the operation described using FIGS. That is, when there is a request from the other PC 20 to access the data stored in the storage device 10A, the memory controller 130 does not receive at least a write request unless it receives a protect OFF command generated by the dedicated application program AP. refuse. This prevents the data stored in the storage device 10A from being unintentionally rewritten or unintended data from being written.

Another method of restricting write requests is to have the OS recognize the storage device 10 as a ROM device that cannot normally be written to, so that only when the dedicated application program AP performs a write operation, the dedicated application program AP can be read. changes the OS's perception of storage device 10 from a ROM device to a writable recordable device, and after the write operation is completed, changes the OS's perception of storage device 10 back from a writable device to a ROM device. This makes it possible to reject write requests from other than the dedicated application program AP.

Furthermore, as another method of limiting write requests, in the storage device 10B shown in FIG. Commands related to writing information may not be transmitted to memory controller 130 until received. In other words, unless the storage device 10B receives the protect OFF command, the memory controller 130 will not receive at least a write-related command, so that information will not be written to the storage area 122 . This prevents the data stored in the storage device 10B from being unintentionally rewritten or unintended data from being written. The protect OFF command for the control unit 140 of the bridge board 150 used here may be the same command as the protect OFF command for the memory controller 130, but from the viewpoint of making it difficult to be hacked from the outside, the protect OFF command for the memory controller 130 is used. It is preferable to use a command different from the OFF command.

At this time, furthermore, the control unit 140 of the bridge board 150 does not receive the write command or No commands, including read commands, may be transmitted to memory controller 130 . Specifically, the bridge board 150 has a memory (not shown) in which the password is stored. This prevents the data in the storage device 10B from being rewritten or read by a user who does not know the password. This password may be set in advance when the storage device 10B is shipped from the factory or the like, and may be known only to the purchaser of the storage device 10B. may be used to set the storage device 10B after the fact. Also, multiple passwords may be set for each type of command (read command, write command, etc.) that the memory controller 130 can recognize, or only one password that is common to all commands may be set.

In the above-described

storage device

10, 10A, or 10B (hereinafter referred to as storage device 10, etc.), a log file for managing the write history is stored in advance in the management area 122b, and by referring to this log file, It may be checked whether the data stored in the storage device 10 has been tampered with. This log file may be created by the memory controller 130 when writing to the storage device 10 for the first time, or may be stored in the management area 122b when the storage device is shipped. It may be created in response to a log file creation command received from the PC 20 when it is first connected.

Each time the PC 20 writes one file (including writing one newly created file and rewriting one existing file) in accordance with instructions from the memory controller 130 or the dedicated application program AP, the contents of the log file to update. For example, as shown in FIG. 7, this log file contains the timing (date and time) of writing, the file name of the file to be written, and the contents of the file, using a predetermined hash function. The hash value obtained is associated and described. This means that each write adds a new record to the log file. As for the file name, the information of the storage area (path) is omitted in the figure for convenience of explanation, but the file name may include the information of the path.

Note that the hash value may be generated by the memory controller 130, or by the PC 20 or the control unit 140 in which the dedicated application program AP is installed. In the latter case, an instruction to update the log file including the hash value is supplied to the memory controller 130 together with the instruction to write the target file.

The PC 20 determines whether the data stored in the storage device 10 or the like has been tampered with by referring to this log file at a predetermined timing according to instructions from the memory controller 130 or the dedicated application program AP. The execution timing of this determination may be based on a schedule predetermined by the memory controller 130, or may be triggered by receiving a command for executing a predetermined tampering check from the connected PC 20. . In the latter case, the user may set the execution timing of the falsification check in the dedicated application program AP. As a specific timing setting, for example, every time the storage device 10 or the like is connected, arbitrary timing designated by the user and a certain cycle (every month, etc.) can be considered.

The falsification determination process will be specifically described below. Memory controller 130 first generates a hash value for each of all files currently stored in data area 122a using a predetermined hash function such as MD5 or SHA256. For example, the generated set of hash values and the set of hash values described in the log file read from the management area 122b are compared to determine whether they are the same. If they are the same (perfect match), it is determined that no falsification has occurred. If they are not the same, it is determined that falsification is suspected. In this case, the following processing may be subsequently performed.

Specifically, the PC 20, which operates according to commands from the memory controller 130 or the dedicated application program AP, stores the file names of all files described in the log file and all file names currently stored in the data area 122a. Check consistency with

As a result of this check, if a file name that is described in the log file but does not exist in the data area 122a is detected, the file with that file name has been illegally deleted, or the data in the file has not been stored. It is determined that the file name has been changed illegally. On the other hand, if a file name not described in the log file but existing in the data area 122a is detected, it is determined that the file with that file name has been illegally written or that the file name has been illegally changed. .

If a log file with a predetermined name that should exist in the data area 122a cannot be found even though some files exist in the data area 122a, unauthorized deletion of the log file is suspected. It is determined that there is a possibility of

According to instructions from the memory controller 130 or the dedicated application program AP, the PC 20 writes the result of the above determination (at least information indicating the possibility of falsification) to the management area 122b. Information indicating the result of determination is provided to the PC 20 as necessary.

It should be noted that if the log file itself is tampered with, the above tampering determination result cannot be guaranteed, so it is preferable to prohibit any write requests to the management area 122b. From this point of view, the memory controller 130 receives commands for editing or deleting the content or file name of the log file from other than the dedicated application, or updates commands for the log file supplied independently of general file write commands. is suspected of unauthorized access to log files and should preferably not be accepted.

When the log file and/or the information indicating the tampering judgment result is always output to an external device having a file lock function, or when the log file is protected, it is stored in an external device such as the storage device 10. You can remember. For example, the log file and/or the falsification determination result are stored only when the memory controller 130 receives a predetermined command generated by the dedicated application program AP described above (when connected to the PC 20 on which the AP is running). , to the PC 20 . In addition, it is preferable that the log file and/or the information indicating the falsification judgment result be given an attribute that the dedicated application program AP can only read and cannot rewrite.
At this time, the log file may be recorded in a recording device having a function of receiving the protect ON/OFF command described above.

The tampering determination process described above with respect to the storage device 10B shown in FIG. may be applied to
For example, instead of the memory controller 130, by connecting the bridge board to a storage device having a general memory controller that does not have the function of accepting the protection ON/OFF command, the bridge board can be transferred from the PC 20 to a predetermined Access to memory controller 130 (and thus memory chip 120) may be prohibited unless a password is received. That is, in one aspect, a storage device according to the present invention has at least a control section that supplies a command received from a computer to the memory controller when a predetermined password is received from the computer.

The function of updating the log file at the time of writing and the falsification determination process described above can be provided to, for example, a dedicated application program AP. That is, the execution commands for updating the log file and judging falsification described above are performed based on commands supplied from the PC 20 connected to this general storage device and executing the dedicated application program AP. That is, each time the dedicated application program AP in this aspect writes one file, it also writes the contents of the log file having the file name predetermined in association with the identification ID of the storage device to the write target. The log file is updated based on the file, and the updated log file is stored in a predetermined area in the storage device. Then, at a predetermined timing while this storage device is connected, the aforementioned falsification determination is performed. That is, the hash value described in the log file stored in this storage device and all file names currently stored in this storage device are read, and the hash value is calculated based on the read file names. , tampering determination is performed by comparing both, and detailed contents of tampering (file deletion/addition, file name change, etc.) are further specified as necessary.
If the user who manages data tampering and the user who records the data are different, the user who monitors data tampering should save a log file and use that log file to check whether the data has been tampered with. can be

It should be noted that the above-described target files for tampering determination are not the entire storage device (that is, all files stored in the storage device), but a preset partial storage area or folder (aggregate of files). good too.

In short, a program according to one aspect of the present invention causes a computer connected to a storage device to store, in the storage device, a hash value generated based on the file to be written when the file is written; comparing the hash value stored in the storage device with a hash value calculated based on the file stored in the storage device; and outputting information indicating the possibility of falsification based on the result of the comparison. and causing to be performed. Here, the above-mentioned "file" is not dependent on a specific OS, other computer systems, or data contents, but refers to a data structure of the minimum unit when writing, reading, or other user operations are performed.

Reference Signs List

1, 1A, 1B... computer system, 10, 10A, 10B... storage device, 20... PC, 110... connection I/F, 120... memory chip, 122... storage area, 122a... data area, 122b... management area, 130 … Memory controller, AP … Dedicated application program

Claims

a connection interface for exchanging information with a computer that accepts file operations from a user;
a storage area;
When the command received from the computer is a command other than a predetermined command, managing the reading and writing of data in the storage area so as to at least prohibit the computer from rewriting the data stored in the storage area. and a storage device having a memory controller that
The memory controller prohibits rewriting until receiving the predetermined command, and permits rewriting from receiving the predetermined command until receiving a predetermined second command.
2. A storage device according to claim 1.
The memory controller
3. The storage device according to claim 2, wherein when the predetermined command is not received, new writing of the file stored in the storage area is prohibited, while reading of the file is permitted.
The memory controller
4. The storage device according to any one of claims 1 to 3, wherein when the predetermined command is not received, recording of a new file in the storage area is permitted.
The storage area includes a data area for storing files specified by a user and a management area for storing a history of access to the data area,
4. The storage device according to claim 2, wherein said memory controller stores a log in said management area at least when rewrite processing is executed.
In response to a request from the computer, the memory controller stores history information indicating that the connection with the computer has been terminated after receiving the predetermined command and before receiving the predetermined second command. 6. The storage device according to claim 5, stored in an area.
2. The storage device according to claim 1, wherein a data string having a pattern that is not recorded by the OS is stored in a predetermined area within the management area.
2. The storage device according to claim 1, further comprising a control unit that supplies a command received from said computer to said memory controller when a predetermined password is received from said computer.
to the computer,
obtaining identification information of a storage device connected to the computer;
a step of outputting a predetermined command for releasing the write prohibition to the storage device when the acquired identification information is registered in advance.
a step of receiving a designation of data to be written from a user after outputting the predetermined command;
10. The program according to claim 9, further causing the computer to execute a step of outputting a second predetermined command prohibiting writing to the storage device when the writing process for the data is completed.
11. The program according to claim 10, which prohibits the user from accessing the storage device from the designated data to be written until the second predetermined command is output.
If the acquired identification information is registered in advance, it is determined whether or not setting information about data rewriting prohibition is recorded in the storage device, and if the setting information permits data rewriting. a step of storing prohibition information to the effect that writing to the storage device is prohibited in a management area of the storage device,
10. The program according to claim 9, further causing said computer to execute a step of rejecting a write request from a user to said storage device when said inhibition information is stored in said management area.
When information indicating that the connection with the computer has been terminated after receiving the predetermined command and before receiving the predetermined second command is obtained from the storage device when connecting to the storage device, 11. The program according to claim 10, outputting two predetermined commands to said storage device.
determining whether or not a data string of a predetermined pattern is stored in a predetermined area in the management area of the storage device when the acquired identification information is registered in advance;
12. The program according to any one of claims 9 to 11, further causing the computer to execute a step of rejecting a user's write request to the storage device if the data string is not stored.