JP2004199318A - Security system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a security system, a security method and a security program capable of securing security by performing encryption/decoding of data independently of classification of a storage device. <P>SOLUTION: It is determined whether a specific storage device is used or not. When the specific storage device is not used, processing of a read or write request of a file in the case of not a system used by a computer system is immediately bypassed to a lower layer, and the encryption/decode of the data is performed in the case of a system used by the computer system. When the specific storage device is used, it is determined whether the encryption/decode of the data is performed or not by the system used by the computer system by determining the file system which is a read or write object of the file. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a security system, a security method, and a security processing program for encrypting a data file on a computer system in order to secure the security of the file.
[0002]
[Prior art]
Security of the data files stored in the storage device, such as protection of confidential data, is required, so the importance of security technology for encrypting data files is increasing, and reading and writing files from the storage device is also important. Sometimes there is a method of transparently encrypting and decrypting.
[0003]
The method of transparently encrypting / decrypting this file when reading / writing is to use a file input / output request to determine whether to read or write a file from a storage device, and if it is determined that the file is to be read, The data to be read is decrypted, and if it is determined that the file is to be written, the data to be written is encrypted.
[Patent Document] Japanese Patent Application Laid-Open No. 2001-027964
[Problems to be solved by the invention]
In this prior art, a file read / write request from a storage device may be requested by a computer system with paged input / output or a computer system without paged input / output. At the time of reading or writing, encryption / decryption of data by paged input / output or encryption / decryption other than paged input / output is selected according to the method used by the computer system.
Here, paging input / output will be briefly described.
Exchanging data in units of “pages” between the main memory and the hard disk when using the virtual memory is called paging. Swap is a word with a similar meaning. Swap transfers data in process units, whereas paging exchanges data in page units. The page size varies depending on the system, but is generally smaller than the process. Therefore, paging requires less data to be moved than swapping, and the processing is faster. A file for storing a memory area created on the hard disk at the time of paging is referred to as a “paging file”.
In this specification, an attempt to read and write a file input / output such as read / write by paging is referred to as paged input / output.
[0005]
However, if a computer system uses the method of reading and writing files from a storage device, and encrypts / decrypts data, the method used by a computer system for a specific storage device is different from that used by a computer system. May be different. Specifically, when a computer system uses paged I / O to read and write files from a storage device, a specific device (eg, CD-R / RW) reads and writes files. Depending on the file system that manages the file, there are a method that involves paged I / O and a method that does not involve paged I / O. In such a case, data is encrypted when data is read from or written to a specific device. There are cases where encryption / decryption can and cannot be performed.
[0006]
The present invention has been made in view of the above problems, and a main object of the present invention is to provide a security system capable of ensuring security by encrypting / decrypting data regardless of the type of storage device. A security method and a security program are provided.
[0007]
[Means for Solving the Problems]
In order to achieve the above object, according to the method of the present invention, when reading or writing a file from a storage device, it is determined that the file is a specific storage device. File read / write requests that do not use the specified method bypass the processing immediately to the lower layer, encrypt / decrypt data in the case of the method used by the computer system, and perform data encryption / decryption in the case of a specific storage device. Is to determine whether to encrypt / decrypt data by the method used by the computer system by determining the file system to be read or written.
[0008]
Also, the method of the present invention comprises a storage device type determining means for determining the device type of a storage device when reading and writing a file from a storage device, and determining whether the reading and writing method is paged input / output. , A file system type determining unit for determining a file system type for managing a file on the storage device, and a unit for encrypting / decrypting data.
[0009]
In the present invention, it is preferable that the storage device type determination unit, the paged input / output determination unit, and each unit for encrypting / decrypting data are provided in a filter driver operating in a kernel space.
[0010]
BEST MODE FOR CARRYING OUT THE INVENTION
The present invention will be described with reference to the drawings.
FIG. 1 is a functional block diagram showing an embodiment of the present invention, and FIG. 2 is a flowchart showing an operation procedure of the embodiment.
[0011]
As shown in FIG. 1, an application program 1 that operates in a user space to transparently encrypt / decrypt data when reading / writing a file from / to a specific storage device according to the present embodiment. Via the I / O manager 2, a filter driver 7 including a device type determining unit 3, an encrypting / decrypting unit 4, a file system determining unit 5, and a paged input / output determining unit 6, and bypassing the filter driver 7 It comprises a lower layer 8 for processing file input / output requests, including a file system, and a storage device 9, and the function of each means will be described below.
[0012]
The device type determination means 3 of the filter driver 7 has a function of determining the type of the storage device of the file input / output request destination, and determines whether the storage device is a disk on a computer system, a floppy disk drive, or a CD. -It can be determined whether the drive is a ROM drive.
[0013]
When reading a file from the storage device 9, the encryption / decryption means 4 decrypts the data, passes the decrypted file data to the application program 1, and writes the file to the storage device 9. It has a function to encrypt data in cases.
[0014]
The file system discriminating means 5 has a function of discriminating the type of a file system that manages files and is used by the storage device 9 that is a file input / output destination.
[0015]
The paged input / output determination means 6 has a function of determining whether the file input / output is performed in pages, or whether the file input / output is performed without pages.
[0016]
Next, with reference to the configuration of FIG. 1 and the flowchart of FIG. 2, the encryption processing method in the specific device of the present embodiment will be described in detail.
First, when a file input / output request from the application program 1 to the storage device 9 occurs, the file input / output request of step A1 in FIG. 2 arrives at the filter driver 7 via the I / O manager 2; The device type determining means 3 determines that the storage device type is CD-ROM, and executes step A3 if the storage device type is a CD-ROM drive, and executes step A5 if the storage device type is not the CD-ROM drive.
[0017]
In step A3, if the file system discriminating means 5 determines that the file system is not CDFS, the process proceeds to step A4, and if the file system is CDFS, the process proceeds to step A5.
[0018]
In steps A4 and A5, it is determined that the file input / output method is paged input / output. In step A4, if it is not paged input / output, step A6 is executed. In step A5, paged input / output is performed. If it is determined, the data is encrypted / decrypted using the encryption / decryption means 4 in step A6.
Then, in step A7, the process is terminated by bypassing the file input / output request to the lower layer.
[0019]
【The invention's effect】
As described above, according to the encryption processing method in the specific storage device of the present invention, data can be encrypted / decrypted regardless of the storage device, and the protection of confidential data for which security is desired can be protected. In doing so, the effect is exhibited.
[Brief description of the drawings]
FIG. 1 is a functional block diagram showing an embodiment of the present invention. FIG. 2 is a flowchart showing an operation procedure of the present embodiment.
1 ... Application program, 2 ... I / O manager, 3 ... Device type discriminating means, 4 ... Encryption / decryption means, 5 ... File system discriminating means, 6 ... Page conversion Input / output determination means, 7: Filter driver, 8: Lower layer, 9: Storage device

Claims (1)

Means for determining a storage device to which a file input / output request is made when encrypting / decrypting data when reading / writing a file in response to a file input / output request to a storage device on a computer system; If the storage device is determined, the means for determining the type of the file system that manages the file used by the storage device and the method of reading / writing the file used by the operating system are paged input / output. Means for judging whether or not the file is read / written according to the type of the file system, and means for encrypting / decrypting data by a method other than the paged input / output. Security system characterized by at least Temu.

Images