JP2004220400A - File protecting method and file protection program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To fully secure safety by preventing access from an operating system. <P>SOLUTION: This file protection program moves a target program from a non-protected region M1 to a protected region M2 managed by a file system of the operating system. Thus, by moving the target file from the non-protected region M1 to the protected region M2, the operating system is not only prevented from accessing the target file but also prevented from knowing existence of the target file, and since the existence of the file is not known and the risk of improper processing such as furtive looking, alteration or deletion of the file contents is sharply reduced, full safety is secured compared to such a conventional case solely for encoding data. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a file protection method and a file protection program for protecting a file stored in a storage device such as a hard disk device from unauthorized viewing, deletion, or modification.
[0002]
[Prior art]
As a conventional file protection method, a method of encrypting a part or all of data included in a file to be protected has been generally used (for example, see Patent Document 1).
[0003]
[Patent Document 1]
JP-A-9-204330 (page 3-4, FIG. 1)
[0004]
[Problems to be solved by the invention]
However, in the above-described conventional example, there is no possibility that the contents of the file are illegally known by being encrypted. However, if the file operation software such as Windows Explorer is used, the existence of the file can be prevented. Was possible, and it was hard to say that sufficient security was secured. Note that some operating systems have a function to prevent files with a specific extension from being displayed on the screen.However, this does not prevent the operating system from accessing the file. It is difficult to secure sufficient safety in terms of protection.
[0005]
The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a file protection method and a file protection program that can prevent access from an operating system and ensure sufficient security. It is in.
[0006]
[Means for Solving the Problems]
In order to achieve the above object, a first aspect of the present invention is a file protection method for protecting a file stored in a storage device, comprising: creating a protection area inaccessible from an operating system in the storage device; When protecting the file, the file stored in the unprotected area of the storage device accessible from the operating system is moved to the protected area, and when the protection of the file is released, the file is stored in the protected area. The file is moved to the unprotected area.
[0007]
According to a second aspect of the present invention, in the first aspect of the present invention, before executing the moving process of the file, authentication of whether or not a user who intends to perform the moving process is a previously authorized user is performed. It is characterized by performing.
[0008]
According to a third aspect of the present invention, in the first or second aspect of the invention, the protection area is managed by a dedicated file system having a different system from a file system of the operating system.
[0009]
According to a fourth aspect of the present invention, there is provided a file protection program for protecting a file stored in a storage device in order to achieve the above-mentioned object. A function of copying a file stored in an unprotected area of the storage device accessible from an operating system to the protected area, and a function of deleting the copied file from the unprotected area. It is characterized by making it.
[0010]
According to a fifth aspect of the present invention, in the fourth aspect of the present invention, it is determined whether or not the user who intends to cause the computer to perform the moving process before executing the file moving process is a previously authorized user. And a function of performing authentication of the user.
[0011]
According to a sixth aspect of the present invention, in the fourth or fifth aspect of the present invention, the computer is provided with a function of managing the protected area with a dedicated file system having a different system from the file system of the operating system.
[0012]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, an embodiment of a file protection program embodying the file protection method of the present invention will be described in detail. In this embodiment, Windows (R) is exemplified as the operating system. However, the present invention is not limited to this, and can be applied to all operating systems such as UNIX (R) and MacOS (R).
[0013]
The file protection program according to the present embodiment includes a CPU, a chipset, a RAM, a storage device (such as a hard disk device), a display device, and an input device such as a keyboard and a mouse. As an operating system, for example, Microsoft Windows. Function of creating a protected area (to be described later) inaccessible from the operating system in a storage device on a general computer equipped with an operating system (hereinafter abbreviated as "Windows (R)") (protected area creating function) A function (file copy function) of copying a file stored in an unprotected area (described later) of the storage device accessible from the operating system to the protected area (file copying function); and copying the copied file to the unprotected area. Ability to delete from A file deletion function) and a function (user authentication) for authenticating whether or not a user (user) who intends to perform the moving process before executing the file moving process is a previously authorized user. 2), and includes three program modules of a disk access class 1, a protection area operation class 2, and a user interface class 3, as shown in FIG. Note that a "class" defines a model of an object in which data and a method as an operation procedure thereof are put together in object-oriented programming.
[0014]
The disk access class 1 is stored in a storage area (referred to as a "protected area") M2 of a storage area of a storage device as shown in FIG. Write and read data by accessing. Note that access to the unprotected area M1 under the control of the operating system (writing and reading of data) is performed by using a file input / output command (or a file input / output function) prepared in the operating system. Have gone through.
[0015]
The protection area operation class 2 is a class for operating the protection area M2. As will be described later, processing higher than the disk access class 1, for example, writing data to the protection area M2 through the disk access class 1 or writing data from the protection area M2. (A part of the file copy function). Here, the protection area operation class 2 also performs processing of creating a protection area M2 in a storage area of a storage device when the file protection program of the present embodiment is installed in a computer, and implements a protection area creation function. . By creating the protected area M2, the capacity of the non-protected area M1 is reduced by the capacity of the protected area M2. Also, since a method and procedure for creating a new storage area by deleting a part of the existing storage area (partition) are well known in the art, detailed description thereof will be omitted.
[0016]
On the other hand, the user interface class 3 is a class that utilizes the user interface function of the operating system, interprets input data from an input device such as a keyboard or a mouse, and causes the protected area operation class 2 to start processing. Further, at the time of starting the program, the disk access class 1 is converted into an instance (data as an actual value based on the class by object-oriented programming) and transferred to the protection area operation class 2.
[0017]
Meanwhile, the protection area M2 managed by the dedicated file system is provided with a parameter block PB, a file path area FPA, an allocation table AT, and a data area DA as shown in FIG. Various parameters are stored in the parameter block PB as shown in FIG. Among these parameters, the user information structure includes a user ID individually assigned to each of a plurality of users, a user name corresponding to each user ID, and a user ID corresponding to each user ID, as shown in FIG. The password is configured with a correspondingly set and encrypted password, and is used in a user authentication process described later. In the file path area PA, as shown in FIG. 3B, a path (absolute path) PS where the file to be protected is stored in the non-protected area M1 and the file is protected. The user ID of the user and the number AU of the first allocation unit (described later) of the data of the file are stored. Further, the allocation table AT includes used / unused divisions of the allocation units of all numbers and the location of the data of the file stored in the protection area M2, that is, one or a plurality of allocations including the data constituting the file. The unit number is stored.
[0018]
On the other hand, the allocation unit stored in the data area DA includes the creation date and time when the file was created by the protection process, the access date when the file was accessed after creation, the update date and time when the file data was updated, the file size, and the data size. It is composed of Since the size of data included in one allocation unit has an upper limit, a file composed of data having a size exceeding the upper limit is divided into a plurality of allocation units and stored.
[0019]
Next, the operation of the file protection program according to the present embodiment will be described with reference to the flowcharts of FIGS.
[0020]
First, a process of moving a file existing in the unprotected area M1 to the protected area M2 and hiding it (file moving processing) will be described with reference to the flowchart of FIG. When the file protection program is started, first, the user interface class 3 performs a user authentication process (step SA1) shown in the flowchart of FIG. That is, a log-in screen for asking the user to input a user ID and a password is displayed on the screen of the computer (step SB1), and when the user ID and the password are input by an input device such as a keyboard or a mouse (step SB2). Then, the user information structure registered in the parameter block of the protection area M2 is read (step SB3), and it is checked whether or not there is one that matches the input combination of the user ID and the password (step SB4). If there is the same combination, the user is authenticated as a pre-registered regular user, and the user authentication process ends (step SB5). On the other hand, if there is no identical combination, the user is not authenticated as an authorized user (step SB6), and the file protection program is forcibly terminated (step SB7).
[0021]
When the user is authenticated as a legitimate user by the user authentication process, a file to be protected selected by the user using a file management utility of the operating system (for example, Explorer in Windows®) (hereinafter, “target file”) ) Is received by the protection area operation class 2 (step SA2). Subsequently, the protection area operation class 2 searches for an unused allocation unit AU number with reference to the allocation table AT (step SA3), and the data of the target file received by the protection area operation class 2 from the operating system is authenticated. The data is written in the allocation unit of the unused number of the data area in the protection area M2 via the disk access class 1 together with the user ID (step SA4). Then, it is determined whether or not all the data of the target file has been written (step SA5), and the processing of the above-described steps SA3 to SA5 is repeated until all the data of the target file has been written to the protection area M2. Then, the information of the absolute path of the target file is written to the file path area FPA of the allocation table AT (step SA6). That is, the file copy function is realized by the processing of steps SA4 to SA6 described above.
[0022]
Subsequently, the protected area operation class 2 deletes the target file from the non-protected area M1 via the operating system (step SA7), and the user interface class 3 updates the file display state by the file management utility of the operating system, whereby The target file previously displayed on the computer screen disappears and cannot be seen by the user (step SA8). That is, the file deletion function is realized by the processing of steps SA7 and SA8 described above.
[0023]
Next, a process (restoring process) of returning the target file moved to the protected area M2 to the non-protected area M1 will be described with reference to the flowchart of FIG.
[0024]
First, when the file protection program is started, the user authentication process (step SC1) shown in the flowchart of FIG. 6 is first performed by the user interface class 3, and if the authentication is successful, the restoration process is continued. Interrupt and forcefully terminate.
[0025]
If the user is authenticated as an authorized user by the user authentication process, the protected area operation class 2 creates a list of files stored in the protected area M2 with reference to the file path area FPA, and the user interface class 3 executes the above list. It is displayed on the screen of the computer (step SC2). When the user selects a target file to be restored from the list by the user interface class 3, the information of the selected file (target file) is transferred to the operating system (step SC3). Further, the protection area operation class 2 reads information on the absolute path of the target file from the file path area FPA (step SC4).
[0026]
Subsequently, the protection area operation class 2 reads the number of the head allocation unit AU of the data of the target file from the file path area FPA (step SC5), and reads the data of the allocation unit AU of that number from the data area DA (step SC6). . Further, the data read by the protected area operation class 2 is transferred to the operating system (step SC7), and is written back to the non-protected area M1 by the operating system. Then, it is determined whether or not all the data of the target file has been written back on the allocation table AT of the protected area M2 (step SC8). Is repeated. Finally, if the protection area operation class 2 deletes the target file from the protection area M2 and updates the allocation table AT (step SC9), the restoration processing ends.
[0027]
In the present embodiment, the process of moving one file from the non-protected area M1 to the protected area M2 and restoring from the protected area M2 to the non-protected area M1 has been described. However, even if the user selects a plurality of files at the same time, Obviously, the same movement processing and restoration processing as described above can be performed. In the file system of the operating system, files are managed in a tree structure using folders or directories. In this file protection program, a moving process and a restoring process are performed for each folder or directory in the same procedure as described above. It is also possible.
[0028]
As described above, in the file protection program of the present embodiment, by moving the target file from the non-protected area M1 to the protected area M2, not only the access to the target file but also the existence of the target file can be known from the operating system. Can not be done. In other words, if the file is not known, there is no danger of the file contents being stolen or tampered or deleted. Property can be ensured. In addition, since the target file is hidden from the operating system by moving to the protection area M2 created in the storage device, even if a failure occurs in the operating system and it becomes impossible to start and the operating system needs to be reinstalled, Only the unprotected area M1 needs to be formatted while the protected area M2 is left as it is, and the file to be protected can be restored using the file protection program even after the operating system is reinstalled.
[0029]
【The invention's effect】
The invention according to claim 1 is a file protection method for protecting a file stored in a storage device, wherein a protected area inaccessible from an operating system is created in the storage device to protect the file. Moves the file stored in the unprotected area of the storage device accessible from the storage area to the protected area, and removes the protection of the file when the file stored in the protected area is unprotected. The file moved to the protected area is inaccessible from the operating system, and even the existence of the file can be hidden from the operating system, ensuring sufficient security A file protection method can be provided.
[0030]
According to a second aspect of the present invention, in the first aspect of the present invention, before executing the moving process of the file, authentication of whether or not a user who intends to perform the moving process is a previously authorized user. In addition to the effect of the first aspect of the present invention, the security can be further enhanced by enabling only the authenticated user to execute the process of moving the file to be protected to the protected area. .
[0031]
According to a third aspect of the present invention, in the first or second aspect of the invention, the protection area is managed by a dedicated file system having a different system from the file system of the operating system. In addition to the effects, a protected area that cannot be accessed by the operating system can be easily created.
[0032]
According to a fourth aspect of the present invention, there is provided a file protection program for protecting a file stored in a storage device, wherein the computer has a function of creating a protected area in the storage device that is inaccessible from the operating system, and a function of accessing from the operating system. A function of copying a file stored in a non-protected area of the storage device into the protected area, and a function of deleting the copied file from the non-protected area. The file moved to is not accessible from the operating system, and even the existence of the file can be hidden from the operating system, and a file protection program that can ensure sufficient security can be provided.
[0033]
According to a fifth aspect of the present invention, in the fourth aspect of the present invention, it is determined whether or not the user who intends to cause the computer to perform the moving process before executing the file moving process is a previously authorized user. In addition to the effect of the invention according to the fourth aspect, the present invention is characterized in that a process of moving a file to be protected to a protected area can be executed only by an authenticated user. Properties can be further enhanced.
[0034]
According to a sixth aspect of the present invention, in the fourth or fifth aspect of the present invention, the computer is provided with a function of managing the protected area with a dedicated file system having a different system from the file system of the operating system. In addition to the effects of the fourth and fifth aspects, a protected area inaccessible from the operating system can be easily created.
[Brief description of the drawings]
FIGS. 1A and 1B are diagrams for explaining an operation of an embodiment of the present invention, and FIGS. 1A and 1B are conceptual diagrams showing storage areas of a storage device.
FIG. 2 is a program configuration diagram of the above system.
FIG. 3A is a schematic configuration diagram of a protection area in the above, and FIG. 3B is a schematic configuration diagram of a data area in the same.
FIG. 4A is a schematic configuration diagram of a parameter block in the above embodiment, and FIG. 4B is a schematic configuration diagram of a user information structure in the above embodiment.
FIG. 5 is a flowchart illustrating a file transfer process in the above embodiment.
FIG. 6 is a flowchart illustrating a user authentication process in the embodiment.
FIG. 7 is a flowchart illustrating a file restoration process in the above embodiment.
[Explanation of symbols]
M1 Unprotected area M2 Protected area 1 Disk access class 2 Protected area operation class 3 User interface class

Claims (6)

What is claimed is: 1. A file protection method for protecting a file stored in a storage device, wherein a protected area inaccessible from an operating system is created in the storage device, and the storage device is accessible from the operating system when protecting the file. Moving the file stored in the non-protected area to the protected area, and moving the file stored in the protected area to the non-protected area when releasing protection of the file. File protection method. 2. The file protection method according to claim 1, wherein before executing the file movement processing, authentication is performed as to whether or not a user who intends to perform the movement processing is an authorized user. . 3. The file protection method according to claim 1, wherein the protection area is managed by a dedicated file system different from a file system of an operating system. A file protection program for protecting a file stored in a storage device, comprising: a function of creating, in a storage device, a protection area inaccessible from an operating system to a computer; A file protection program for realizing a function of copying a file stored in a protected area to the protected area and a function of deleting the copied file from the unprotected area. Before executing the moving process of the file, the computer realizes a function of performing authentication of whether or not a user who intends to perform the moving process is a previously authorized user. Item 4. The file protection program according to Item 4. The file protection program according to claim 4 or 5, wherein the computer is configured to realize a function of managing the protection area by a dedicated file system of a different system from a file system of an operating system.

Images