JP2008171116A - Storage device and its access control system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent tampering of data to be stored in a specific region of a storage device. <P>SOLUTION: When recognizing that a terminal is legal as an access destination, a server generates management authentication information for permitting access. The terminal is provided with a specific region set in a storage device to which access is permitted when predetermined conditions are satisfied, and configured to acquire management authentication information generated by the server, and to manage it by a management part. When a request for access from the server or the other access origin to the specific region is made, the permission of the access is authenticated by referring to the management authentication information to be managed by the management part. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a storage device and an access control system thereof, and more particularly to prevent tampering or deletion of stored data when accessing a storage device storing data that requires protection of content related to copyright. Is related to access control.

Services that distribute contents such as movies and music using communication means such as the Internet and digital broadcasting have been put into practical use. Since digital content distributed over a network can be easily copied, it is important to protect the copyright. As a means for protecting the copyright, a method of encrypting and distributing content is performed. This encrypts content by, for example, a common key encryption method and creates a decryption key for decrypting the encrypted content at the same time. Encrypted content cannot be played back without a corresponding decryption key, so the information that pairs the decryption key and its usage conditions can be safely managed to prevent unauthorized use of the content and protect the rights of content authors Can do.
In addition, it is required to safely protect the operation log on the terminal due to information leakage or internal control. Therefore, falsification and deletion can be prevented by access control and encryption for log data.

  For example, Patent Document 1 (Japanese Patent Application Laid-Open No. 2002-229859) discloses a disk storage medium that can set a plurality of predetermined areas in a disk drive as a plurality of secret areas that require special access conditions, and each secret. Each secret area using a plurality of key information corresponding to the area and unique information common to each secret area, and area specific information for each secret area generated from the key information and the unique information A disk drive having authentication means for executing an authentication process for determining whether or not to permit access every time is disclosed.

JP 2002-229859 A

  When the above-described conventional technique is applied to a terminal, a program operating on the terminal performs authentication using information used for authentication and accesses a secret area of the disk drive. At this time, since the program operating on the terminal handles information used for authentication, there is a possibility that information used for authentication may be acquired by a third party by analyzing the execution program.

  An object of the present invention is to provide a storage device and an access control system for the storage device that can prevent falsification of data stored in the storage device.

  An access control system according to the present invention is preferably an access control system including a terminal having a storage device and a server connected to the terminal via a network and capable of accessing a storage area of the storage device. Includes a processing unit that generates management authentication information that permits access when the terminal recognizes that the terminal is valid as an access destination, and the terminal is permitted to access when a predetermined condition is satisfied. As an access control system comprising: a first storage area set in the storage device; and a management unit that manages management authentication information generated by the processing unit and used to access the first storage area Composed.

In a preferred example, the terminal establishes a cryptographic communication session using public key cryptography, and communicates information with the server.
Further preferably, the processing unit in the server performs authentication related to a storage device using the management authentication information (first management authentication information), generates second management authentication information, and generates second management authentication. A secure session with the terminal is started using the information.
Preferably, the processing unit of the server is used for authentication during write access, read access, or deletion access to the first storage area of the storage device, using the second management authentication information. Generate and manage different credentials for each.
Preferably, the processing unit of the server generates different credentials used for authentication during write access, read access, or deletion access to the first storage area of the storage device, and the terminal includes: Either the write credential, the read credential, or the delete credential generated by the processing unit is received and held in the management unit set in the storage device.
Preferably, the management unit provided in the terminal stores the second management authentication information, the write credential, the read credential, or the delete credential in a storage area or a memory formed in a storage device. And manage.
Preferably, when a plurality of first storage areas are set in the storage device, the processing unit of the server corresponds to each first storage area, and the write credential or the read credential. Or create and manage delete credentials.
Preferably, when a plurality of first storage areas are set in the storage device, the management unit acquires the write credential, the read credential, or the delete credential acquired from the server. Managed in association with one storage area.
Preferably, when a plurality of first storage areas are set in the storage device, the management unit acquires the write credential, the read credential, or the delete credential acquired from the server. Managed in association with one storage area.
Preferably, the terminal establishes a cryptographic communication session with the server to exchange information, receives the second management authentication information from the server, closes the cryptographic communication session, and writes the information from the server. When the credential, the read credential, or the delete credential is received, the encryption communication session is re-established.

The storage device according to the present invention is preferably set in a storage device that can be accessed when a predetermined condition is satisfied in a storage device that can be connected to a server via a network. Used to authenticate the server to allow the first storage area, a storage medium having a second storage area that can be freely accessed, and the server to allow access to the first storage area. Management authentication information that is acquired by the server and managed by the server, and when the server accesses the first storage area, the management authentication information managed by the management unit is used. And an authentication control unit for authenticating.
Preferably, the management authentication information generated by the server includes first management authentication information, second management authentication information generated based on a result of authentication using the first management authentication information, The access control information is generated based on the result of authentication using the management authentication information of No. 2, and the authentication control unit is first acquired in response to a request from the server and managed by the management unit. The first management authentication information sent from the server is verified by referring to the management authentication information of the server, and the server is authenticated. When the server authentication is successful, the second management authentication information received from the server is managed. When the storage device receives the second management authentication information from the server in response to the request from the server, the authentication control unit refers to the second management authentication information managed by the management unit. Verify the second authentication information from the server and It authenticates the server, upon a successful server authentication, sets the access authentication information received from the server to the management unit.
Preferably, the management unit manages, as the access authentication information, a write credential, a read credential, or a delete credential used for authentication when accessing the first storage area.
Preferably, when a plurality of first storage areas are set in the storage device, the management unit includes a set including the write credential, read credential, or delete credential for each first credential. It is managed in association with the storage area.

The access control method according to the present invention is preferably an access control method in which a storage device of a terminal is accessed from a server via a network, and access is permitted when a predetermined condition is satisfied in advance in the storage device. A step of defining a first storage area, a step of generating management authentication information for permitting access to the first storage area when the terminal recognizes that the terminal is valid as an access destination in the server, and The management authentication information is acquired from the server and stored and managed in the management unit, and when there is an access request to the first storage area from an access source that may include the server or others, the management unit holds the management authentication information And authenticating access permission with reference to the management authentication information.
Preferably, the server performs authentication relating to the storage device using the first management authentication information as the management authentication information, and the second management authentication information is obtained when the authentication using the first management authentication information is successful. And generating access authentication information when authentication using the first management authentication information is successful. The terminal stores the first management authentication information obtained in advance from the server. In response to the step and the request from the server, the first management authentication information sent from the server is verified by referring to the first management authentication information, and the server is authenticated. Acquiring the second management authentication information received from the server and storing it in the management unit; and receiving the second management authentication information from the server in response to a request from the server, A step of verifying the second authentication information from the server with reference to the held second management authentication information and authenticating the server, and received from the server when the server authentication is successful as a result of the authentication. Setting the access authentication information in the management unit.
Preferably, the server generates a write credential, a read credential, or a delete credential used for authentication when accessing the first storage area as the access authentication information, and the management unit of the terminal includes: Holds the write credential, read credential, or delete credential received from the server.
Preferably, when storing a specific program in the first storage area, the server rewrites the program stored in the first storage area using a write credential set in the management unit. The terminal cannot rewrite the program stored in the first storage area, and is only allowed to read and execute it on the processing device.
Preferably, when the license for using the content is stored in the first storage area, the server rewrites the license stored in the first storage area using the write credential set in the management unit. The terminal reads the license using the read credentials set in the first storage area, and permits the use of the content using the license.

  The program according to the present invention is preferably a program executed by a processing device to manage access to a storage area of a storage device connectable to a server via a network, and a predetermined condition is satisfied Means for requesting the server to set access authentication information for the first storage area to which access is permitted, and access to the first storage area is permitted if the server recognizes that the terminal is valid as an access destination Means for generating management authentication information and access authentication information, means for acquiring management authentication information and access authentication information received from the server in the terminal and holding them in the management unit, and access sources that may include the server or others When an access request is made to the first storage area, the access authentication information held in the management unit is referred to It means for performing a testimony, configured as a program executable on a processing device having a.

  According to the present invention, since there is no authentication information for rewriting data in the secret area in a device other than a storage device such as a hard disk having a secret area, the data in the data can be rewritten by analyzing the program in the device. Authentication information cannot be obtained. For this reason, data in the secret area can be protected from tampering more safely with data that does not need to be changed in the apparatus.

  In addition, when managing data in the hard disk, the authentication information necessary for deletion is not stored in a device other than a storage device such as a hard disk having a secret area, so that data in the secret area can be safely deleted from unauthorized deletion. Can be protected.

[Example 1]
Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
FIG. 1 is a diagram illustrating a configuration example of an access control system according to an embodiment. FIG. 2 is a flow diagram for setting write credentials.
In FIG. 1, a terminal 61 has a hard disk (HDD) 50 and is connected to the server 100 via a network 60 to constitute an access control system for the HDD 50. The terminal 61 also controls a main CPU 51 that processes data in the terminal 61, a memory 53 that stores programs and data, a ROM 54 that stores programs that control basic I / O, and an I / F with external devices. Network I / F control unit 55, and hard disk I / F control unit 52 that controls I / F with HDD 50.

  The HDD 50 includes a circuit board 40 on which the hard disk controller 20 is mounted, and an HDA unit 21 in which a disk, a spindle motor, and a magnetic head are mounted and housed in a housing. The storage area 25 of the HDA unit 21 has a normal area 26 for storing normal data used by the user, and a system area 27 for storing programs 71 and application data 72.

The hard disk controller 20 is a CPU 10 for controlling access to a storage area, a memory 11 for storing a control program, a buffer control unit for performing control for temporarily storing data read from the HDA unit and data to be written in the buffer RAM 22 12. Servo control unit 13 for controlling the spindle motor of the HDA unit 21; I / F control unit 14 for performing I / F with the host; modulation / demodulation and error correction of signals performed when writing to and reading from the HDA unit 21 The signal processing unit 15 is configured to include an authentication control unit 16 that controls authentication when accessing data stored in the HDA unit 21 and a credential management unit 18 that manages credentials used during authentication.
The circuit board 40 is mounted with a hard disk controller 20, a buffer RAM 22 for temporarily storing data, and a nonvolatile memory 23 for storing digest data. In this example, the hard disk controller 20 is shown with integrated functions for controlling the hard disk, but is not limited to this, and the circuit board 40 has some functions as external components. May be implemented.

  The credential management unit 18 includes a write credential 32 used for authentication at the time of writing and a management credential 31 used when changing the write credential 32.

  The server 100 has a memory and a CPU (not shown). The application program 91 and application data 92 in the memory, first and second management credentials 101 and 102 as management credentials, and server write credentials 103 are stored. Hold. Here, the management credentials 101 and 102 and the server writing credentials 103 are encryptions or passwords. An application program is executed by the CPU. When the first and second management credentials 101 and 102 and the server write credential 103 are encryption, they are generated by causing the CPU to execute a predetermined random number generation program.

Next, a credential setting operation will be described with reference to FIGS.
FIG. 8 shows a timing chart of each operation in the credential setting corresponding to FIG.
First, the operation for setting the write credentials will be described.
The installer stored in the normal area 26 of the storage area 25 of the HDD 50 of the terminal 61 is activated to load the installation program into the memory 53, and the main CPU 51 executes the installation program. Then, the main CPU 51 sets the certificate of the certificate authority in the management credential 31 of the credential management unit 18 in the HDD 50, and simultaneously generates a public key pair (S101). At this time, the management credential 31 is set with the certificate of the certificate authority and the public key pair (public key and secret key) generated in the hard disk.

Next, the terminal 61 requests the server 100 to set write credentials (S102). In this case, authentication is performed between the server 100 and the terminal 61 to confirm that it is not an unauthorized server or terminal (installer).
Then, the server 100 authenticates with the HDD 50 using the first management credential (certificate) corresponding to the certificate of the certificate authority set by the installer operating on the terminal 61 for the HDD 50, and temporarily A session key shared by the HDD 50 and the server 100 is shared and a secure session is started (S103). At this time, in the HDD 50, the authentication control unit 16 controls the authentication and the secure session using the management credential 31 of the credential management unit 18.

If necessary, the server 100 changes the management credentials to the second management credentials 102 (S105). This operation is not essential, but it is meaningful when, for example, the first management credential is managed using a public key or a common key, and the common key is changed to a secret key in order to strengthen confidentiality management. It is. For example, the public key pair generated in the hard disk is changed to a certificate (public key) issued by a certificate authority and a private key. When using common key authentication instead of public key authentication, it is desirable to change the key shared between the server and the hard disk to a secret key from the viewpoint of security.
Thereafter, the secure session is once closed (S106).

  Then, the server 100 starts a secure session using the HDD 50 and the second management credential 102 set in step S105 (S107). At this time, since the main CPU 51 of the terminal 61 only handles the exchange of data between the HDD 50 and the server 100, the shared session key cannot be known.

  The server 100 encrypts the server write credential 103 using the shared session key and transmits it to the terminal 61. The server write credential 103 is temporarily stored in the memory 53 via the network I / F control unit 55, further transferred to the HDD 50 via the hard disk I / F control 52 by the main CPU 51, and a session key is used by the authentication control unit 16. And is set to the write credential 32 of the credential management unit 18 (S108). Thereafter, the secure session is closed, and the operation of setting the write credentials is completed.

By operating in this way, the server write credentials 103 can be safely set in the HDD 50, and the server write credentials cannot be known in a terminal other than the HDD 50.
Although the case where the installer stored in the normal area 26 is executed has been described here, the installer may be stored in the memory 53 from the server 100 via the network 60 and executed.

  With the above operation, after the server 100 sets the write credentials, the server and the HDD 50 authenticate using the write credentials, and the server stores the application program and the AP data used by the application program in the system area 27 of the HDD 50. .

  When the application is operated, a program loader stored in the normal area 26 of the HDD 50 is activated, and the program loader reads and operates the program 71 stored in the system area 27. The program 72 reads the AP data 72 if necessary and uses the data. As described above, since the program and AP data stored in the system area are loaded from the main CPU 51 of the terminal 61 every time the program is executed, even if the program and AP data are altered on the memory 53, they are restored to their original state. can do.

  In the present embodiment, for example, a computer virus check program and its virus definition data are provided from the server 100 to the terminal 61 and stored in the system area 27, and the confidentiality of the terminal 61 is allowed without changing the data. It is possible to keep and manage. That is, by authenticating from the server 100 using the write credential 103 and the write credential 32, an updated computer virus check program and new virus definition data can be written in the system area 27. Cannot be written or changed. In the terminal 61, the computer virus check program written in the system area 27 and its virus definition data (including updated ones) are only read and used. In addition, if the data defines the operation and function of the terminal as AP data, it cannot be easily changed by the user. Therefore, the function can be operated only when the terminal is stably operated or an additional fee is paid. It is also possible to do so.

  In the above example, only write credentials for the system area 27 are set, and writing from other than the server 100 is restricted. In this case, data and programs in the system area 27 can be freely read from the server 100 and the terminal 61. However, there may be a case where it is desired to restrict read access to the system area 27 from the server 100 and the terminal 61. In such a case, it is preferable to set and manage read credentials in addition to the write credentials 32. In this case, the server 100 generates and manages read credentials by executing a random number generating program different from that for generating write credentials. The setting of the read credentials is substantially the same as in the second embodiment described later.

  In the above example, the management credential 31 and the write credential 32 are held in order to prevent falsification of programs and AP data stored in one system area. However, when a plurality of system areas are defined in the storage area 21 and access to each system area is managed, a set of the management credential 31 and the write credential 32 is set corresponding to each system area, and a credential management unit 18 is preferable. In that case, the server 100 generates each set of credentials. The idea of this modification can be similarly applied to second and third embodiments described later.

Next, the authentication operation between the server and the HDD will be described in detail with reference to FIGS.
First, a case where public key authentication is used will be described with reference to FIG.
The server 100 transmits a server certificate to the HDD 50 (T001). Next, the HDD 50 verifies the signature of the server certificate using the certificate authority public key Ko, and confirms that the server certificate has not been tampered with and is a certificate issued by the certificate authority (T002). Then, the HDD 50 transfers the HDD public key Khdo to the server (T003). In the server, the CPU generates a random number N1s (T004) and transfers it to the HDD 50 (T005). In the HDD 50, the CPU 10 generates a random number N1hd (T006), and generates a signature SN1s using the HDD private key for the transmitted random number N1s (T007). Then, the random number N1hd and the signature SN1s are transferred to the server (T008).

In the server 100, the signature SN1hd is generated by the CPU using the server secret key Ksp for the transmitted random number N1hd (T009). Then, the signature SN1s is verified using the HDD public key Khdo, and it is confirmed that the HDD 50 owns the private key (T010). Then, the random number N2s is generated and encrypted with the HDD public key Khdo (T011), and the signature SN1hd and the encrypted random number N2s are transmitted to the HDD 50 (T012).
Next, the HDD 50 verifies the signature SN1hd using the host public key Kso included in the server certificate, and confirms that the server possesses the private key (T013). Then, a random number N2hd is generated, encrypted with the server public key Kso (T014), and the encrypted random number N2hd is transferred to the server (T015).

  Next, in the server 100, the CPU encrypts the encrypted random number N2hd using the server secret key, and generates a session key using the generated N2s and N2hd (T016). The HDD 50 also decrypts the encrypted random number N2s using the HDD private key, and generates a session key using the same algorithm as the server using N2hd and N2s generated by the HDD (T017).

  Since the data encrypted with the public key cannot be decrypted without the secret key, even if the data on the host I / F is eavesdropped, a random number for generating a session key if the secret key is not owned Since the main CPU 51 of the terminal 61 is not known, the session key can be safely shared. Also, data can be securely exchanged between the server and the HDD by encrypting data using the session key shared in this way. The server encrypts the server write credential using the session key (T018) and transfers it to the HDD 50 (T019). In the HDD 50, the server write credential is decrypted using the session key and set as the write credential. Yes (T120).

Next, a case where common key authentication is used will be described with reference to FIG.
First, the server 100 and the HDD 50 transmit the common secret key Kc set in the HDD management credentials 31 by the installer to the server 100 when requesting the server to set the write credentials. In this case, authentication is performed by the server and the installer, and transmission is performed using a secure session.

The server generates a random number N1s in the HDD by the CPU (T101) and transfers it to the HDD 50 (T102). The HDD 50 generates a random number N1hd (T103), and generates a response RN1s using the common secret key Kc for the transmitted random number N1s (T104). The response can be generated by encrypting a random number using the common secret key Kc. Then, the random number N1hd and the response RN1s are transferred to the server (T105).
In the server 100, the CPU generates a response RN1hd using the common secret key Kc for the transmitted random number N1hd (T106). The response RN1s is verified using the common secret key Kc, and it is confirmed that the HDD owns the common secret key Kc (T107). Then, the random number N2s is generated and encrypted with the common secret key Kc (T108), and the response RN1hd and the encrypted random number N2s are transmitted to the HDD 50 (T109).

  Next, the HDD 50 verifies the response RN1hd using the common secret key Kc, and confirms that the server owns the common secret key Kc (T110). Then, the CPU 10 generates a random number N2hd, encrypts it with the common secret key Kc (T111), and transfers the encrypted random number N2hd to the server (T112). Next, in the server 100, the encrypted random number N2hd is decrypted by the CPU using the common secret key Kc, and a session key is generated using N2s and N2hd generated by the host (T113).

  The HDD 50 also decrypts the encrypted random number N2s using the common secret key Kc, and generates a session key using the same algorithm as the server using N2hd and N2s generated by the HDD (T115). Then, the server 100 encrypts the server write credential using the session key (T114) and transfers it to the HDD (T115). The HDD 50 decrypts the server write credential using the session key and sets it as the write credential (T116).

  Also, when setting the server write credentials using common key authentication, the installer knows the common secret key Kc, so it is necessary that the installer has not been tampered with. It is necessary to authenticate with. However, once the server sets the second management credential (step S105 in FIG. 2), the second management credential and the server write credential cannot be known in the terminal thereafter. It is possible to prevent tampering more firmly.

[Example 2]
FIG. 5 shows a configuration example in the case where confidential data is included in the system area. For example, it can be used when a license including a content key used in a content distribution system is distributed.
The second embodiment is different from the first embodiment described above in that the license 73 is held in the system area 27 of the HDA unit 21 and the server read credentials 104 used for authentication at the time of reading from the server 100 and the terminal 61 are different from the first embodiment. Having license management information 112. Therefore, in addition to the processing related to the write credential in the first embodiment, management of read credential is further added.

For example, referring to FIG. 2, the terminal 61 requests the server 100 to set a write credential and a read credential (S102 ′).
After the server 100 starts a secure session using the HDD 50 and the second credential 102, the server 100 encrypts the server write credential 103 and the server read credential 104 using the shared session key, Sent to the memory 53 via the network I / F control unit 55, transferred to the HDD 50 via the hard disk I / F control 52 by the main CPU 51, decrypted using the session key by the authentication control unit 16, and credential management The writing credential 32 and the reading credential 33 of the unit 18 are set (S108 ′).
Then, the secure session is closed and the operation of setting the write credentials is completed. Then, the server read credential 104 is notified to the installer, and the normal area 26 can be encrypted and stored safely.

  The second embodiment is an example in which the read credential is set from the server. For example, the installer may set the management credential before setting the management credential. In the first embodiment, the management credentials are common for writing / reading. However, the management credentials for writing credentials and the management credentials for reading credentials for rewriting the writing credentials may be managed separately.

Next, distribution of a license for using content will be described.
First, the application program 75 for content distribution is activated on the terminal 61. When the content to be purchased is selected from the content provided by the server, the payment method and the like are selected and the purchase processing is completed, license data is generated in the license management information 112 on the server.

  The terminal 61 requests the server 100 for a license. The HDD 50 authenticates with the server 100 using the write credentials and starts a secure session. Then, the server refers to the license management information 112 and confirms whether the requested license has been purchased or has not been transmitted to another terminal. If it has been purchased and has not been transmitted to another terminal, the license is encrypted with the session key and transmitted to the HDD 50. In the HDD 50, the encryption key 17 is decrypted using the session key shared in the secure session, and the license is written in the system area 27. At this time, for further safety, the encryption processing unit 17 may encrypt and store the data using an ID unique to the HDD.

When using this license, the program 75 reads the server read credentials stored by the installer at the time of installation from the normal area 26, authenticates with the HDD 50, and shares the session key. Then, the program 75 requests the HDD 50 for a license. The HDD 50 checks whether or not the requested license is stored in the system area 27. If it is stored, the encryption processor 17 encrypts the license and transmits it to the program 75 operating on the main CPU 61. When the license stored in the system area 27 is encrypted, the license is decrypted using an ID unique to the HDD and then encrypted with the session key.
As described above, since the writing credentials are not known in the terminal 61, for example, it is possible to prevent tampering such as the license expiration date, and it is possible to protect confidential data such as a content key.

Next, license management information managed by the server 100 will be described with reference to FIG.
The license management information includes a license ID 121 that identifies a license, a user ID 122 that identifies a purchased user, a terminal ID 123 that issued the license, a license expiration date 124 that indicates the expiration date of the issued license, and license data 125.

By managing the license management information in this way, the following control is possible.
Consider a case where when a user owns a plurality of terminals, a license is requested from a certain terminal and the license has already been issued to another terminal.
First, the server searches the license ID 121 and the user ID 122 to determine whether the license is a license purchased by the user who requested the license. Next, the server refers to the terminal ID 123, requests the terminal that issued the license to delete the license, and deletes the license. Then, a license is issued to the requested terminal, and the terminal ID 123 is updated. At this time, if the terminal having the license refuses to delete the license, the license is not deleted and an error is returned to the terminal that has requested the license.

If the license cannot be connected to the terminal, the issuance license term 124 is referred to. If the term has already expired, the license is issued without deleting the license. Here, the issued license deadline 124 is set shorter than the deadline included in the license data.
In this way, a license can be shared more conveniently between a plurality of terminals.

[Example 3]
FIG. 7 shows a configuration example when log information is stored in the system area.
The third embodiment is different from the first and second embodiments in that the credential management unit 18 of the HDD 50 further has a deletion credential 34 used for authentication at the time of deletion, and the medium 82 is connected via the medium I / F 81. It is connected, and the server 100 has a server deletion credential 105 used for authentication at the time of deletion, and a log information storage area 111.

Therefore, for example, referring to FIG. 2, the terminal 61 requests the server 100 to set a deletion credential (S102 ′).
In addition, after starting a secure session using the HDD 50 and the second credential 102, the server 100 encrypts the deletion credential 105 using the shared session key and transmits it to the terminal 61, and the network I / O The data is sent to the memory 53 via the F control unit 55, transferred to the HDD 50 via the hard disk I / F control 52 by the main CPU 51, decrypted using the session key by the authentication control unit 16, and deleted credentials 34 of the credential management unit 18. (S108 ′).

  In this example, the setting of the write credential 32 and the read credential 33 in the first and second embodiments is not considered, but these credentials 32 and 33 may be set. Here, the write credential is a credential for newly writing data to the system area 26, and updating of data is not permitted.

Next, the log storing operation will be described.
When the log collection program 76 stored in the normal area 26 is activated, a log of the operation of the terminal 61, for example, a log relating to an operation to access the network 60 and an operation to the external media 82 connected to the media I / F 81 is displayed. Stored as log 74 in area 26. When storing the log, authentication with the HDD 50 is performed if necessary, and the log is stored.

Then, when the storage area of the log becomes small, or periodically requests the server to upload the log. If there is an upload, the server 100 authenticates with the HDD 50, reads the log, and stores it in the log storage area 111. Here, if it is necessary to prevent tampering in the transmission path, the encryption processing unit 17 encrypts the log and transmits the log.
When the log is stored in the server, the server and the HDD 50 authenticate using the deletion credentials. Then, the server requests the HDD 50 to delete the log. The HDD 50 deletes the log 74 in the system area 27 according to the request.

In this way, in the terminal 61, deletion credentials are not managed except by the credential management unit 18 in the HDD 50, so that it is possible to prevent tampering or deletion of the log stored by the log collection program 76.
It is also possible to write a meaningless log to the system area by an unauthorized program and waste the log storage area, so that only a specific program (here, the log collection program) manages it as write credentials. If configured, it is possible to prevent such an attack.

1 is a diagram illustrating an example of a storage device and an access control system thereof in Embodiment 1. FIG. FIG. 3 is a flowchart illustrating an example in which a server in the first embodiment sets credentials. FIG. 3 is a sequence diagram illustrating an example of public key authentication in the first embodiment. FIG. 3 is a sequence diagram illustrating an example of common key authentication in the first embodiment. 6 is a diagram illustrating an example of a storage device and an access control system thereof according to Embodiment 2. FIG. FIG. 10 is a diagram illustrating an example of license management information according to the second embodiment. FIG. 10 is a diagram illustrating an example of a storage device and an access control system thereof according to a third embodiment. FIG. 6 is a timing chart of each operation in the credential setting operation in the first embodiment.

Explanation of symbols

10: CPU, 11: Memory, 12: Buffer memory control unit, 13: Servo control unit, 14: Host I / F control unit, 15: Signal processing unit, 16: Authentication control unit, 17: Cryptographic processing unit, 18: Credential management unit, 20: hard disk controller, 21: HDA unit, 22: buffer RAM, 25: storage area, 26: normal area, 27: system area, 31: management credential, 32: write credential, 33: read credential, 34: Deletion credential, 40: Circuit board, 50: Hard disk (HDD), 51: Main CPU, 52: HDD I / F control unit, 53: Memory, 54: ROM, 55: Network I / F control unit, 56: System bus, 60: network, 61: terminal, 71: program, 72: AP data, 73: license, 4: log, 91: program, 92: AP data, 100: server, 101: first management credential, 102: second management credential, 103: server write credential, 104: server read credential, 103: server delete credential 111: Log information storage area, 112: License management information, 121: License ID, 122: User ID, 123: Terminal ID, 124: Issued license expiration date, 125: License data

Claims (19)

In an access control system including a terminal having a storage device and a server connected to the terminal via a network and capable of accessing a storage area of the storage device,
The server includes a processing unit that generates management authentication information for permitting access when the terminal recognizes that the terminal is valid as an access destination;
The terminal accesses a first storage area set in the storage device that is permitted to be accessed when a predetermined condition is satisfied, and the first storage area generated by the processing unit. An access control system comprising: a management unit that manages the management authentication information used to perform the authentication. 2. The access control system according to claim 1, wherein the terminal establishes a cryptographic communication session using public key cryptography, and communicates information with the server. The processing unit in the server performs authentication relating to the storage device using the management authentication information (first management authentication information), generates second management authentication information, and stores the second management authentication information. The access control system according to claim 1 or 2, wherein a secure session is started with the terminal. The processing unit of the server uses the second management authentication information to use different credentials used for authentication at the time of write access, read access, or deletion access to the first storage area of the storage device. 4. The access control system according to claim 3, wherein the access control system is generated and managed. The processing unit of the server generates different credentials used for authentication at the time of write access, read access, or deletion access to the first storage area of the storage device,
The terminal receives either the write credential, the read credential, or the delete credential generated by the processing unit, and holds the received credential in the management unit set in the storage device. The access control system according to any one of 1 to 3. The management unit provided in the terminal stores and manages the second management authentication information, the write credential, the read credential, or the delete credential in a storage area or a memory formed in the storage device. The access control system according to any one of claims 4 to 5, wherein When a plurality of first storage areas are set in the storage device, the processing unit of the server supplies the write credential, read credential, or delete credential corresponding to each first storage area. The access control system according to claim 4, wherein the access control system is generated and managed. When a plurality of first storage areas are set in the storage device, the management unit stores the write credentials, read credentials, or delete credentials acquired from the server in the first storage areas. The access control system according to claim 4, wherein the access control system is managed in association with each other. The terminal establishes a cryptographic communication session with the server to exchange information, receives the second management authentication information from the server, closes the cryptographic communication session, and 9. The access control system according to claim 4, wherein when the write credential, the read credential, or the delete credential is received, the encryption communication session is reestablished. In a storage device that can be connected to a server via a network,
A storage medium having a first storage area set in the storage device that is allowed to be accessed when a predetermined condition is satisfied, a second storage area that can be freely accessed, and the server Management authentication information used when authenticating the server in order to allow access to the first storage area, and managing to acquire and manage the management authentication information generated by the server And an authentication control unit that authenticates using the management authentication information managed by the management unit when the server accesses the first storage area. The management authentication information generated by the server includes first management authentication information, second management authentication information generated based on a result of authentication using the first management authentication information, and the second Including access authentication information generated based on the result of authentication using the management authentication information of
In response to a request from the server, the authentication control unit refers to the first management authentication information acquired in advance and managed by the management unit, and the first management authentication sent from the server If the server is authenticated by verifying the information, and the server is successfully authenticated, the second management authentication information received from the server is managed by the management unit;
When the storage device receives the second management authentication information from the server in response to the request from the server, the authentication control unit refers to the second management authentication information managed by the management unit. And verifying the second authentication information from the server to authenticate the server, and setting the access authentication information received from the server in the management unit when the server is successfully authenticated. The storage device according to claim 10. 12. The storage according to claim 11, wherein the management unit manages, as the access authentication information, a write credential, a read credential, or a delete credential used for authentication when accessing the first storage area. apparatus. When a plurality of first storage areas are set in the storage device, the management unit associates a set including the write credential, read credential, or delete credential with each first storage area. The storage device according to claim 12, wherein the storage device is managed. In an access control method for accessing the storage device of a terminal from a server via a network,
In the storage device, a step of defining a first storage area that is permitted to be accessed when a predetermined condition is satisfied, and when the server recognizes that the terminal is valid as an access destination, Generating management authentication information permitting access to the first storage area;
The terminal obtains the management authentication information from the server, stores it in the management unit and manages it, and there is an access request to the first storage area from an access source that may include the server or others. And a step of authenticating the access permission with reference to the management authentication information held in the management unit. Performing authentication related to the storage device using the first management authentication information as the management authentication information in the server, and the second management authentication information when authentication using the first management authentication information is successful. And generating access authentication information when authentication using the first management authentication information is successful,
The terminal obtains the first management authentication information from the server in advance and holds the first management authentication information. In response to the request from the server, the terminal refers to the first management authentication information and sends it from the server. The first management authentication information is verified to authenticate the server, and when the server authentication is successful, the second management authentication information received from the server is acquired and held in the management unit Steps,
When the second management authentication information is received from the server in response to the request from the server, the second authentication information from the server is referred to by referring to the second management authentication information held in the management unit Verifying the information and authenticating the server, and setting the access authentication information received from the server in the management unit when the authentication is successful as a result of the authentication. 15. The access control method according to claim 14, wherein: The server generates, as the access authentication information, a write credential, a read credential, or a delete credential used for authentication when accessing the first storage area,
16. The access control method according to claim 15, wherein the management unit of the terminal holds a write credential, a read credential, or a delete credential received from the server. When storing a specific program in the first storage area, the server may rewrite the program stored in the first storage area by using the write credential set in the management unit. 17. The access control method according to claim 16, wherein the terminal is not allowed to rewrite the program stored in the first storage area, and is only allowed to be read and executed by a processing device. . When storing the license for using the content in the first storage area, the server rewrites the license stored in the first storage area using the write credential set in the management unit. The terminal of claim 16, wherein the terminal reads the license using the read credential set in the first storage area, and permits the use of the content using the license. Access control method. A program executed by a processing device to manage access to a storage area of a storage device connectable to a server via a network,
Means for requesting the server to set access authentication information for the first storage area to which access is permitted when a predetermined condition is satisfied, and the server recognizes that the terminal is valid as an access destination A means for generating management authentication information and access authentication information for permitting access to the first storage area, and a management unit for acquiring the management authentication information and the access authentication information received from the server at the terminal. And when there is an access request to the first storage area from an access source that may include the server or others, refer to the access authentication information held in the management unit and access A program that can be executed on a processing device.

Images