JP2007164652A - Method for managing secondary storage device in user terminal and user terminal - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To easily and safely attain management of a user terminal by prohibiting inappropriate writing to a secondary storage device by the user even when writing to the secondary storage device is permitted when writing to the secondary storage device is required in a system which prevents diffusion of important data stored in a file server and uses a terminal having the secondary storage device to which writing control is performed as the user terminal. <P>SOLUTION: In the user terminal having the nonvolatile secondary storage device to which the writing control is performed, when an operation required to be stored in the secondary storage device occurs on system management such as update of an OS and an application installed in the secondary storage device, required writing processing to the secondary storage device is performed at a state that an account is not given to the user by a login function of the OS. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention prevents a user from newly installing an inappropriate application to the secondary storage device, changing OS settings, saving data, and the like in a user terminal having a secondary storage device subjected to write control. The present invention relates to a method for easily managing a secondary storage device in a user terminal and a user terminal.

A thin client system has been devised as a system for preventing important data stored in a file server from spreading from user terminals.
The thin client system generally uses a PC (diskless PC) not equipped with a non-volatile secondary storage device in the terminal as a terminal, but a PC having a non-volatile secondary storage device that prohibits writing. There are also systems that use as a thin client terminal.
The present invention is directed to a system that uses a PC having a nonvolatile secondary storage device that prohibits writing as a thin client terminal.

In such a system, the user downloads important data from a file server to a volatile storage medium via a network and uses it in the same manner as a general thin client system. An OS and an application are installed in a nonvolatile secondary storage device, and in a normal operation, writing to the nonvolatile secondary storage device is prohibited and used.
In this system, there is a case where writing to a nonvolatile secondary storage device is necessary for system management.
For example, updating the OS and applications installed in the non-volatile secondary storage device.
Conventionally, when it becomes necessary to write to the secondary storage device such as an update file of an update, the write prohibition in the secondary storage device is canceled, the PC is restarted, and the terminal accesses the file server. Prohibit and prevent illegal data from being saved to the file server, then complete the writing of updates etc. to the secondary storage device in the terminal, and prohibit the writing to restart It was.

As such a related technique, a technique such as the following Patent Document 1 has been proposed.
JP2003-303104A

However, as described above, when it is necessary to write to the secondary storage device such as an update file of the update, the write prohibition in the secondary storage device is canceled, the PC is restarted, and the file is transferred from the terminal. Prohibit access to the server and prevent unauthorized data from being saved to the file server, and then complete the writing of updates, etc. to the secondary storage device in the terminal, and disable the write and restart When the method is adopted, it means that the user can freely write to the secondary storage device when writing to the secondary storage device is permitted. Although it can be prohibited, users can change OS settings, install illegal applications, save data, etc. to secondary storage devices in the terminal. The problem that is occurring.
In some cases, installing a malicious tool, such as a Trojan horse, on the secondary storage device while the write protection on the secondary storage device has been released will allow fraud such as data leakage. Problems arise.

  According to the present invention, important data of a file server is allowed to be stored only in a volatile storage medium in the terminal to prevent the important data from spreading, and is stored in a non-volatile secondary storage device in the user terminal. Even if the update of the updated OS or application is necessary and write control to the secondary storage device is permitted, secondary storage such as new application installation, OS setting change, data storage, etc. by the user An object of the present invention is to provide a method and a user terminal that prohibits inappropriate writing into a device and realizes management of a user terminal easily and safely.

In order to solve the above-described problem, the user terminal management method according to the present invention writes to the secondary storage device when an operation for updating data in the nonvolatile secondary storage device is required. The update data is written by the login function of the OS installed in the user terminal before the user logs in to the OS or after the user logs out. After the processing is completed, the secondary storage device is prohibited from being written and restarted.
Here, login refers to an operation for acquiring an account (usage authority) in the OS, and logout refers to the reverse operation.
In other words, in the present invention, when writing to a non-volatile secondary storage device, the user is improperly written by performing the writing process to the secondary storage device without giving an account to the user. It is possible to achieve the objective without doing it. Although the login function may vary depending on the OS, it is a common function to be attached to the current OS. In the present invention, the OS with the login function or an alternative function is the secondary of the user terminal. It is assumed that it is installed in the storage device.

  In addition, a file name that needs to be written to the secondary storage device is registered in the management server in advance, and only when the file with the file name exists in the volatile memory of the user terminal, the corresponding file is stored. It is characterized by writing to the next storage device.

Further, during the writing process to the secondary storage device, a message notifying that the user terminal cannot be operated is displayed.
In addition, when the data in the nonvolatile secondary storage device needs to be updated, the secondary storage device is set in a write-permitted state, the user terminal is restarted, and the data in the secondary storage device is updated. A user terminal that
After restarting the user terminal with the secondary storage device in a write-permitted state, before transferring the usage authority to the user, or after releasing the usage authority, the data update in the secondary storage device Log-on control means for performing a writing process for updating, and prohibiting and restarting the writing of the secondary storage device after completion of the writing process of the update data.

  According to the present invention, the important data of the file server is allowed to be stored only in the volatile storage medium in the terminal to prevent the important data from spreading, and the non-volatile secondary storage device in the user terminal Even if the update of the OS or application stored in the storage device is necessary and the write control to the secondary storage device is permitted, the user can install the application, change the OS setting, save the data, etc. Inappropriate writing to the next storage device is prohibited, and management of the user terminal can be realized easily and safely.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
FIG. 1 is a system configuration diagram for implementing the present invention. Note that the embodiment of the present invention assumes a user terminal in which an OS having a login function that is widely used is installed, but this does not limit the scope of the invention. The range is not limited as long as it has the same function. The same applies to the system and configuration.
The system illustrated in FIG. 1 includes a management server 100, a file server 103, and a user terminal 106, which are connected via a network 114.

The management server 100 stores a terminal management service 101 and a commit file 102.
The terminal management service 101 has a function of managing and controlling each user terminal 106 via the network 114. Also, it has a function of constantly monitoring update information of OSs and applications disclosed on the Internet, and requesting update to a terminal management agent 109 (described later) of the user terminal 106 when an update occurs.
The commit file 102 is a file used by the commit function. The commit function is means for writing to a secondary storage device in which writing is controlled, and is a function for writing data on the memory to the secondary storage device at the time of shutdown.
In the present invention, in order to perform a commit, an administrator needs to register a target to be written such as a file name in the commit file 102 on the management server 100 in advance. In the present invention, the commit function is used when adapting to a secondary storage device 113 (described later) in which writing of an OS update update file or the like is controlled during a real update (described later).

The file server 103 stores general data 104 and important data 105.
The important data 105 is data that must be strictly managed, such as copyright-protected content and confidential information, and is data that must be taken out of the organization and spread / lost to each terminal. .
The general data 104 is not important data 105 but is data generally used by a user.

The user terminal 106 includes a non-volatile secondary storage device 113. The secondary storage device 113 includes an OS 107, an application 108, a terminal management agent 109, an update module 111, a logon control module 112, and write control. Module 110 is installed.
The application 108 is used for handling the general data 104, the important data 105, and the like, and is an arbitrary application 108 that operates on the OS 107.
The terminal management agent 109 is automatically started when the OS 107 is started, and is a service for managing and controlling the user terminal 106 in conjunction with the terminal management service 101 of the management server 100.
Specific functions include control of the update module 111, control of the logon control module 112, control of the write control module 110, control of the commit function, and control of access to a server on the network.

The write control module 110 implements data writing to the secondary storage device 113 of the OS 107 and application 108 and prohibition of writing. When the OS 107 or the application 108 accesses the secondary storage device 113, reading from the secondary storage device 113 is performed as usual, and for writing, only the write data is cached in the volatile memory, and the actual secondary storage device 113 is read. The storage device 113 has a function that cannot be written. In practice, the combination of the filter driver that hooks the IO processing to the file system and the RAM disk technology enables the writing data to be cached in the volatile memory and the write prohibition to the non-volatile secondary storage device 113. is there.
The write control module 110 has a write prohibit mode and a write enable mode. In the write prohibit mode, as described above, the write prohibit function for the secondary storage device 113 works. In the write enable mode, a normal PC (personal computer) is used. ), The secondary storage device 113 can be written. Switching between the two modes is performed by the terminal management agent 109 and applied at the time of activation. Therefore, to change the mode, it is necessary to restart after changing the setting. Normally, the startup is always performed in the write prohibit mode, but the write permission mode is used when writing to the secondary storage device 113 is necessary for system management, such as updating of data stored in the secondary storage device 113. Start with.

The update module 111 is called when an operation that needs to be written to the secondary storage device 113 occurs in system management such as updating the OS 107 or the application 108, newly installing the application 108, changing the setting of the OS 107, and the like. It has a function of safely writing to the secondary storage device 113 such as saving an update file.
There are two types of update module 111: real-time update and normal update.
In the normal update, the secondary storage device 113 is restarted in the write permission mode, the update file or the like is applied to or written in the secondary storage device 113, and restarted in the write prohibit mode after completion. Actually, among the data that needs to be written to the secondary storage device 113 in system management, the data size is relatively large, and the update file for OS 107 update, installation of a service pack, new installation of an application, and the like are targets. Become.
In the real-time update, the update file expanded on the volatile memory is applied or written to the secondary storage device 113 using the commit function when the user terminal 106 is shut down, and the update is completed. This function can be used for data of a relatively small size among the data that needs to be written to the secondary storage device 113 in system management, and the pattern file of virus removal software that does not require the OS 107 to be restarted even if writing is performed. Updates and file-by-file writing are targeted.
These two update methods eliminate the need for unnecessary restarts, improve operability, and enable simple and safe updates.

  The logon control module 112 has a function of prohibiting a user from logging in when the OS 107 is restarted in a writable mode during normal update. By prohibiting login by the user, it is possible to prohibit inappropriate operation by the user. In addition, the logon control module 112 has a function of forcibly displaying a use restriction message on the display in order to notify the user of the operation restriction. This function makes it possible to clearly indicate that the user is prohibited from performing inappropriate operations.

Hereinafter, the operation according to the above configuration will be described.
FIG. 2 is a flowchart of processing of the write control module 110.
Initially, the application 108 in the user terminal 106 attempts to access the secondary storage device 113. At this time, it is determined whether it is a writing process (s202).
In the case of the writing process, the write data is cached in the volatile memory, and the data is not written to the nonvolatile secondary storage device 113 (s206).
If it is not a write process, the process is a read process, so it is first checked whether the data to be read is cached in a volatile memory (s203). If it is cached, the data is read and used (s205). If not cached, the corresponding file data is read from the secondary storage device 113 and used (s204).

FIG. 3 is a flowchart regarding commit at the time of shutdown.
The commit is performed when the user terminal 106 that has been activated in the write-protect mode is shut down. First, the terminal management agent 109 reads the commit file 102 on the management server 100 (s301). On the commit file, file names that need to be written to the secondary storage device 113 by the administrator in advance are registered. Actually, it is a pattern file of virus removal software.
If there are files developed on the volatile memory among the files existing on the commit file 102, these files are written to the secondary storage device 113 (s303), and the commit is completed.

FIG. 4 is a flowchart regarding the update of the OS 107 or the application 108.
Normally, the user terminal 106 is activated in the write-protect mode (s401), and the user logs in (s402). At this time, the user can perform the same operation as a normal PC except that the user cannot write to the secondary storage device 113.
Here, as described above, the terminal management service 101 in the present invention always obtains the latest update information, and when an update is necessary, sends a notification to start the update to the terminal management agent 109, and accordingly The terminal management agent 109 requests the user to approve the update start (s403).
The user can select whether to start the update operation immediately or later, but if the user approves to start the update immediately, the terminal management agent 109 updates the update module 111. The update is started (s404).

  If the user denies the update start, the user terminal 106 can be used in the write-protect mode until the user logs out, but the update notification is again made when the user logs out (s405). The terminal management agent 109 requests the user to approve update start (s406). When the update is approved by the user, the terminal management agent 109 calls the update module 111 and starts the update (s408). If approval by the user is not obtained, the user is regularly prompted for approval until the update is no longer necessary.

FIG. 5 is a flowchart of the update module 111.
When the update is approved by the user in s403 and s407 in FIG. 4 and the update module 111 is called (s404 and s408), first, real-time update and normal update are determined (s501).
In the case of the normal update, the terminal management agent 109 is notified, the write control module 110 is called, and the OS 107 is restarted in the write permission mode (s502). After the restart, the logon control module 112 prohibits the user from logging in. (S503). While the user operation is prohibited, the update file necessary for the update is downloaded from the management server 100 and updated in the background (s504).
When the update is completed, the update module 111 causes the user to select either restart of the OS 107 in the write-protect mode (s506) or shutdown (s507) (s505), and perform either.

If the real-time update is selected in s501, the update update file is adapted and written in the memory (s508). Even after the update, the user can use the user terminal 106 in the write-protect mode.
Usually, the update file used for the update is registered in advance in the commit file 102 of the management server 100 by the administrator. As shown in the flowchart for committing at shutdown (FIG. 3), the user can access the user terminal 106. The terminal management agent 109 reads the commit file 102 and adapts the data registered in the commit file and the data expanded in the volatile memory to the secondary storage device 113, and Write and shut down.

As described above, with these two update methods, it is not necessary to perform a useless restart, and data can be managed safely and easily.
Although the update has been described here, when a write occurs in the secondary storage device 113 in system management, the write can be performed by performing the same operation as the above procedure, but the description is omitted.
As described above, the update of the OS 107 and the application 108 installed in the secondary storage device 113 can be safely completed, and the illegal storage of the important data in the secondary storage device 113 such as saving to the user terminal, setting change, etc. Cannot be accessed or stored properly.

FIG. 6 is a flowchart in the case where the logon control module is called during normal update.
The example here is an example of an image displayed on a display in a Windows 2000 (registered trademark of Microsoft Corporation) environment.
In the flowchart of FIG. 5, after the normal update is selected (s501), the system is restarted in the writable mode (s502), and a login guidance screen as shown in FIG. 7 is displayed (s601).
This login guidance screen is a screen that is displayed in common after the OS is started even in the writable mode.
Here, when the user presses the [Ctrl] + [Alt] + [Del] key to log in (s602), the login screen of FIG. Is displayed, and a screen for notifying login prohibition as shown in FIG. 9 is displayed (s603), and at the same time, the login is canceled (s604).
With these operations, it is possible to prohibit the user's operation while notifying the user that the operation is explicitly prohibited. In fact, to do these on the Windows platform, GINA. Implementation is possible by customizing and installing a module called dll.

1 is a system configuration diagram showing an embodiment of a system to which the present invention is applied. It is a flowchart which shows the process of a write control module. It is a flowchart which shows the process regarding the commit at the time of shutdown. It is a flowchart which shows the process regarding update of OS and an application of a user terminal. It is a flowchart which shows a process when an update module is called. It is a flowchart which shows the process of the logon control module at the time of shutdown. It is a figure which shows the example of the screen which appears after OS starting. It is a figure which shows the example of a login screen. It is a figure which shows the example of the screen which appears when the [Control] + [Alt] + [Delete] key is pressed.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 ... Management server, 101 ... Terminal management service management server, 102 ... Commit file, 103 ... File server, 104 ... General data, 105 ... Important data, 106 ... User terminal, 107 ... OS, 108 ... Application, 109 ... Terminal Management agent, 110 ... write control module, 111 ... update module, 112 ... logon control module, 113 ... secondary storage device, 114 ... network.

Claims (4)

A non-volatile secondary storage device is provided, and only when an operation for updating data in the secondary storage device becomes necessary, the writing is permitted and restarted, and the data in the secondary storage device is A data management method for a secondary storage device in a user terminal to be updated,
When an operation for updating data in the secondary storage device becomes necessary, the user logged in to the OS or logged out by the login function of the OS installed in the user terminal. A data management method for a secondary storage device in a user terminal, wherein update data writing processing is performed later, and after completion of the update data writing processing, the secondary storage device is prohibited from being written and restarted.   A file name that needs to be written to the secondary storage device is registered in the management server in advance, and the file is stored in the secondary storage only when the file with the file name exists in the volatile memory of the user terminal. The data management method for a secondary storage device in a user terminal according to claim 1, wherein the data is written in the device.   The secondary storage device in a user terminal according to claim 1 or 2, wherein a message notifying that the user terminal cannot be operated is displayed during the writing process to the secondary storage device. Data management method. Use to update the data in the secondary storage device by restarting the user terminal with the secondary storage device in a write-permitted state when the data in the nonvolatile secondary storage device needs to be updated A user terminal,
After restarting the user terminal with the secondary storage device in a write-permitted state, before transferring the usage authority to the user, or after releasing the usage authority, the data update in the secondary storage device A user terminal, comprising: a log-on control unit that performs a write process for updating and prohibits the secondary storage device from being written after the update data write process is completed and restarts.

Images