JP2010267089A - Information processor, control method, computer program, and storage medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a security function which easily prevents leakage of information even in a general-purpose storage medium for example, and is advantageous in cost. <P>SOLUTION: This invention may be applied to an information processor equipped with an interface to be connected to a detachable storage medium, and a control means for reading and executing a security program stored in the storage medium through the interface. The control means functions as a read/write control means for permitting writing of the data to the security region secured in the storage medium and reading of the data from the security region by reading and executing the security program. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to an information processing apparatus, a control method for the information processing apparatus, a computer program, and a recording medium, and more particularly, to a technique for suppressing information leakage involving a removable storage medium.

  Currently, portable USB storage devices are widely used as external storage devices for information processing apparatuses such as personal computers. However, the USB storage device is highly convenient, but it can be a source of leakage of confidential information depending on how the user uses it. Patent Document 1 describes a USB storage device including a fingerprint authentication unit. The USB storage device is provided with a free area that a user can freely use and a secret area that can be used only by a person who has been authenticated by the fingerprint authentication unit.

Japanese Unexamined Patent Publication No. 2006-301772, FIGS. 1 to 3

  However, in the technique described in Patent Document 1, since the USB storage device has a fingerprint authentication unit mounted thereon, the cost will be higher than that of a general-purpose storage medium, and usability will be reduced. In general, USB storage devices have different specifications for each device. Therefore, a personal authentication function such as a fingerprint authentication unit must be prepared for each device in accordance with the specifications of the device. Further, in the invention described in Patent Document 1, a security function cannot be installed later on a USB storage device that is currently popular. If the personal authentication function breaks down and the secret area can be directly accessed, the user information cannot be protected. That is, there is a risk of information leakage or unauthorized use of software.

  Therefore, an object of the present invention is to solve at least one of such problems and other problems. For example, an object of the present invention is to provide a cost-effective security function that easily suppresses information leakage even in a general-purpose storage medium. Other issues can be understood throughout the specification.

  The present invention can be applied to, for example, an information processing apparatus including an interface for connecting a removable storage medium and a control unit that reads and executes a security program stored in the storage medium via the interface. The control unit functions as a read / write control unit that allows data to be written to and read from the security area secured in the storage medium by executing the security program.

  According to the present invention, reading / writing of data with respect to a partial area of the storage medium is permitted according to the security program. Therefore, since it is possible to add a security function for suppressing information leakage without depending on the specifications of the storage medium, it is easy to reduce the cost.

1 is a schematic configuration diagram showing an information processing apparatus 1 and a general-purpose USB storage device 10 connected thereto. 4 is a flowchart showing initialization processing of the USB storage device 10 in the information processing apparatus 1. It is the figure which showed an example of the folder hierarchy. It is a figure which shows an example of setting data. 4 is a flowchart showing a processing flow of the information processing apparatus 1 when the USB storage device 10 is inserted into the information processing apparatus 1. 4 is a flowchart showing processing in the information processing apparatus 1 for writing data to the USB storage device 10. 4 is a flowchart showing processing in the information processing apparatus 1 for reading data from the USB storage device 10. 1 is a schematic configuration diagram showing an information processing apparatus 1 and a general-purpose USB storage device 10 connected thereto. 4 is a flowchart showing a processing flow of the information processing apparatus 1 when the USB storage device 10 is inserted into the information processing apparatus 1.

  FIG. 1 is a schematic configuration diagram showing an information processing apparatus 1 and a general-purpose USB storage device 10 connected thereto. The information processing apparatus 1 is a computer that can be connected to an external storage device via a general-purpose interface, such as a personal computer. The USB storage device 10 is an example of a storage medium that can be attached to and detached from the interface 8 included in the information processing apparatus 1. The storage medium may be another type of storage device having a storage area, such as an FD (flexible disk) or an SD card. In other words, any type of storage device may be used as long as it can secure a program storage area for storing a security program and a security area for which reading and writing are restricted according to the present invention.

  Here, for ease of explanation, it is assumed that the interface 8 for connecting the USB storage device 10 is a USB interface. However, the interface of the present invention is not limited to this, and may be another type of interface such as IEEE 1394, wireless USB, or eSATA.

  The information processing apparatus 1 includes, for example, a CPU 2, a ROM 3, a RAM 4, a hard disk drive (HDD) 5, an input device 6, a display device 7, an interface 8, and a system bus 9. The CPU 2 is a processor that controls each unit based on computer programs stored in the ROM 3 and the HDD 5. The CPU 2 of the present invention executes the automatic installation program 101 and the security program 102 read from the USB storage device 10. As a result, the CPU 2 functions as a read / write control unit that permits data writing to the security area secured in the USB storage device 10 and data reading from the security area.

  A RAM (Random Access Memory) 4 functions as a work area. A ROM (Read Only Memory) 3 is a non-volatile storage element and stores firmware and the like. The HDD 5 stores an OS (Operating System), application programs, and the like. Note that the CPU 2 stores and installs the security program 102 in the HDD 5 by executing the automatic installation program 101. The CPU 2 and each unit send and receive commands and data via the system bus 9.

  The input device 6 is a device for a user to input an instruction to the information processing device 1 and includes a keyboard and a mouse. The input device 6 is used, for example, when inputting authentication data (password) and security area setting information. The input information is accepted by the CPU 2. The display device 7 is composed of, for example, a CRT or a liquid crystal display device, and displays a processing result by the CPU 2 by an image, characters, or the like. The interface 8 is connected to the USB interface 11 included in the USB storage device 10 via the USB bus 15. That is, the information processing apparatus 1 and the USB storage device 10 transmit and receive data bidirectionally via the USB bus 15.

  Hereinafter, description will be made on the assumption that the information processing apparatus 1 is a personal computer. However, the type and model are not limited as long as the device has arithmetic processing capability, and the present invention can be applied as the information processing apparatus 1. For example, even an information processing apparatus not via a network can be employed as the information processing apparatus 1.

  On the other hand, the USB storage device 10 includes a USB interface 11, a controller 12, a light emitting diode (LED) 14, and a flash memory 13 that is a nonvolatile storage unit. The controller 12 reads, writes, and deletes data from and to the flash memory 13 in accordance with instructions received from the information processing apparatus 1 via the USB interface 11. The USB interface 11 communicates with the information processing apparatus 1 via the USB bus 15. That is, packets based on the USB standard are transmitted and received. The LED 14 is a light emitter that is lit when a file is being read from, written to, or deleted from the flash memory 13. The LED 14 indicates to the user that a file is being read from, written to, and deleted from the flash memory 13.

  The flash memory 13 is a semiconductor memory that does not require a memory holding operation, and can store files and information. Instead of the flash memory 13, other types of nonvolatile storage devices may be employed. The flash memory 13 includes, for example, a program storage area, a free area, and a secret area. The program storage area stores an automatic installation program 101, a security program 102, setting data 103, and the like. The program storage area may be the free area itself or a part thereof.

  The automatic installation program 101 is a computer program or script that is executed when the USB storage device 10 is connected to the information processing apparatus 1 (for example, autorun.inf). Here, the automatic installation program 101 is used to install the security program 102 into the information processing apparatus 1. The security program 102 permits writing data into and reading data from the security area secured in the USB storage device 10 only when the security program 102 is executed by the information processing apparatus. Reading and writing data to the security area cannot be executed unless the security program 102 being executed permits it. However, when the security program 102 is not being executed, writing to the security area (secret area) may be permitted through the OS. On the other hand, reading / writing of data to / from a free area that is a non-security area is permitted regardless of whether or not the security program 102 is being executed. That is, data can be freely read and written according to normal OS control.

  In the present embodiment, description will be made assuming that data read / write restriction (security function) is realized by encryption processing, decryption processing, and authentication processing. That is, data written to the secret area, which is a security area, is basically encrypted. On the other hand, when the user who has succeeded in the authentication instructs to read the encrypted data from the secret area, the encrypted data is decrypted.

  FIG. 2 is a flowchart showing the initialization process of the USB storage device 10 in the information processing apparatus 1. Here, it is assumed that the security program 102 has not been installed in the USB storage device 10. Therefore, the initialization process is a process for installing the security program 102 stored in the HDD 5 in the information processing apparatus 1 in the USB storage device 10. The CPU 2 starts the security program 102 stored in the HDD 5 in the information processing apparatus 1, and the CPU 2 executes initialization processing of the USB storage device 10 according to the security program 102.

  In step S21, the CPU 2 determines from the input device 6 a secret area (security area) that only a specific user can access the flash memory 13 and a free area (non-security area) area that can be freely used by a third party. Define and set according to the information entered. In the simplest example, the secret area and the free area may be realized by different folders. The CPU 2 outputs from the display device 7 a message for prompting the user to input the name of the folder to be set as the secret area (eg, the secret area) and the file path. The user inputs the name of the folder and the file path to be set as the secret area from the input device 6. Note that the free area is not necessarily provided, but may be arbitrarily set by the user. That is, other folders that are not explicitly designated as secret areas are implicitly designated as free areas. Further, the storage capacity of the secret area and the free area may be set. The setting of the storage capacity is realized, for example, by securing a plurality of basic areas and expansion areas specifying the storage capacity after the flash memory 13 is logically formatted. Thus, the CPU 2 functions as a definition unit that defines a security area in the storage medium.

  FIG. 3 is a diagram showing an example of a folder hierarchy. According to the folder hierarchy 301, it can be seen that a local disk (C drive) and a removable disk 302 (D drive) are built in or connected to the information processing apparatus 1. Further, a secret area 303 and a free area 304 are set as folders on the removable disk 302. It is assumed that the automatic installation program 101, the security program 102, and the setting data 103 are stored in the root directory.

  FIG. 4 is a diagram illustrating an example of setting data. The CPU 2 stores the folder name (file path) 401 set as the security area in the setting data 103. A plurality of security areas may be set. Furthermore, if the user ID and password are associated with a plurality of security areas and stored in the setting data 103, security can be maintained even when the USB storage device 10 is shared among a plurality of users. The setting data 103 also stores authentication data 402 described later. The setting data 103 may be stored in the flash memory 13 or may be stored in the HDD 5.

  Here, the secret area and the free area are realized by folders, but the present invention is not limited to this. For example, each area may be determined using the physical memory address of the flash memory 13.

  In step S <b> 22, the CPU 2 determines authentication data (e.g., password) for use in the authentication process and stores it in the setting data 103. The password may be designated by the user from the input device 6 or may be determined by the CPU 2 based on a certain rule. In the latter case, the CPU 2 displays the determined password on the display device 7 so that the user can remember the password. The password may be user biometric authentication (eg, fingerprint authentication, iris authentication, voiceprint authentication) data. In this case, a biometric data input device will be required. Thus, the CPU 2 functions as a setting unit that sets authentication data for permitting reading and writing of data to the security area.

  The CPU 2 may function as an encryption key generation unit that generates different encryption keys for each security area (that is, a folder) or for each information processing apparatus. As a result, data in the USB storage device 10 encrypted in one information processing apparatus 1 cannot be decrypted in another information processing apparatus 1.

  In step S23, the CPU 2 installs the security program 102, automatic installation program 101, and setting data 103 stored in the HDD 5 in the flash memory 13 of the USB storage device 10, and ends the initialization process. By such initialization processing, the capacity and password of each area can be set / changed according to the user's circumstances.

  FIG. 5 is a flowchart illustrating a processing flow of the information processing apparatus 1 when the USB storage device 10 is inserted into the information processing apparatus 1. It is assumed that the CPU 2 monitors whether the USB storage device 10 is connected to the information processing apparatus 1 according to the OS and whether the USB storage device 10 is removed from the information processing apparatus 1. As described above, the CPU 2 functions as a detection unit that detects whether the storage medium is connected to the interface or removed from the interface.

  In step S51, the USB storage device 10 for which the initialization process has been completed is inserted (connected) into the information processing apparatus 1. When the CPU 2 detects that the USB storage device 10 is connected to the information processing apparatus 1, the CPU 2 proceeds to step S52. At this time, the CPU 2 recognizes the USB storage device 10 as a removable disk according to the OS, assigns a drive letter, recognizes a folder structure, and the like.

  In step S52, the CPU 2 reads and executes the automatic installation program 101 in the USB storage device 10, and installs the security program 102 in the HDD 5 of the information processing apparatus 1 according to the automatic installation program 101. As described above, when the storage medium is connected to the interface, the CPU 2 functions as an installation unit that installs the security program in the information processing apparatus.

  The CPU 2 starts the installed security program 102 according to the automatic installation program 101. The CPU 2 displays a dialog or the like for prompting the user to input a password via the display device 7 according to the security program 102. Thus, the CPU 2 functions as a receiving unit that receives authentication data when the security program is activated.

  In step S53, the CPU 2 executes authentication processing based on the password input from the input device 6 and the password stored in the flash memory 13 or the HDD 5. As described above, the CPU 2 functions as an authentication unit that executes the authentication process by comparing the received authentication data with the authentication data set by the setting unit. The CPU 2 compares the two and determines that the authentication is successful if the two match, and determines that the authentication fails if the two do not match. If the authentication fails, the process proceeds to step S56. In step S <b> 56, the CPU 2 ends the security program 102 and uninstalls the security program 102 from the information processing apparatus 1. In this manner, the CPU 2 functions as an uninstalling unit that uninstalls the security program from the information processing apparatus when the storage medium is removed from the interface.

  On the other hand, if the authentication is successful in step S53, the process proceeds to step S54. In step S54, the CPU 2 switches on the secret area mode, which is one of the functions provided in the security program 102, to ON. The CPU 2 stores the secret area mode information in the RAM 4. The secret area mode information is data such as a flag indicating whether the secret area mode is ON or OFF. When the secret area mode is turned on, the security program 102 continues to be resident thereafter. That is, the CPU 2 identifies the secret area 303 in accordance with the security program 102 and the setting data 103 and monitors data reading / writing with respect to the secret area 303. This is because the CPU 2 encrypts data to be written to the secret area 303 and decrypts data read from the secret area 303.

  In step S <b> 55, the CPU 2 determines whether the USB storage device 10 has been removed from the information processing apparatus 1. When the USB storage device 10 is removed from the information processing apparatus 1, the process proceeds to step S56. In step S56, the security program 102 is terminated and automatic uninstallation is performed.

  FIG. 6 is a flowchart showing processing in the information processing apparatus 1 for writing data to the USB storage device 10. In step S61, the CPU 2 generates a data (information) write request in accordance with the application program. The CPU 2 monitors the data (information) write request in accordance with the resident security program 102. If the CPU 2 detects the occurrence of the write request, the process proceeds to step S62.

  In step S62, the CPU 2 reads the secret area mode information from the RAM 4 according to the security program 102, and determines whether or not the secret area mode is ON. If the secret area mode is ON, the process proceeds to step S63.

  In step S <b> 63, the CPU 2 determines whether the area in which data is written is the secret area 303 according to the security program 102. Information for specifying an area in which data is written is received from the OS. When the secret area 303 is the target folder, the process proceeds to step S64.

  In step S <b> 64, the CPU 2 encrypts the write target data according to the security program 102. Thus, the CPU 2 functions as an encryption unit that encrypts data when writing data to the security area.

  In step S <b> 65, the CPU 2 writes the encrypted data in the secret area 303 in the flash memory 13 in accordance with the security program 102. Thus, since encryption is performed before storing in the flash memory 13, it is possible to prevent the user from forgetting to encrypt the confidential information.

  On the other hand, if the data write target folder is not the secret area 303 (eg, the data write target folder is the free area 304) in step S63, step S64 is skipped and the process proceeds to step S65.

  In step S65, the CPU 2 writes the data in the free area 304 without encryption.

  If the secret area mode is not ON in step S62, step S63 and step S64 are skipped and the process proceeds to step S65. In step S <b> 65, the CPU 2 writes the data as it is without encrypting it regardless of whether the target area for writing the data is the secret area 303 or the free area 304.

  FIG. 7 is a flowchart showing processing in the information processing apparatus 1 for reading data from the USB storage device 10.

  In step 71, the CPU 2 generates a data read request to the USB storage device 10 according to an arbitrary application program. In step S72, the CPU 2 reads the secret area mode information from the RAM 4 according to the security program 102, and determines whether or not the secret area mode is ON. If the secret area mode is ON, the process proceeds to step S73.

  In step S <b> 73, the CPU 2 determines whether or not the area from which data is read is the secret area 303 according to the security program 102. The CPU 2 also acquires information for specifying an area (read target area) from which data is read from the OS. If the read target area is the secret area 303, the process proceeds to step S74. The CPU 2 determines whether the data that is the target of reading is encrypted data. Whether or not it is encrypted data is determined, for example, according to whether or not specific information exists in the head portion of the encrypted data. If it is encrypted data, the process proceeds to step S75.

  In step S75, the CPU 2 decrypts the encrypted data according to the security program 102. As described above, the CPU 2 functions as a decryption unit that decrypts data when the encrypted data is read from the security area.

  In step S76, the CPU 2 passes data to the application program according to the security program 102, and writes the data to the RAM 4. That is, the decrypted data is not stored in the flash memory 13. Therefore, even when the USB storage device 10 is removed from the information processing apparatus 1 after the decryption process, the decrypted data cannot be read from the USB storage device 10. As a result, leakage of confidential information can be prevented. As described above, the CPU 2 functions as a read / write control unit that stores the decrypted data in the volatile storage unit included in the information processing apparatus without storing the decrypted data in the storage medium.

  On the other hand, if it is determined in step S73 that an area (eg, free area 304) that is not the secret area 303 is a read target, steps S74 and S75 are skipped and the process proceeds to step S76. Similarly, if it is determined in step S74 that the data to be read is not encrypted data, step S75 is skipped and the process proceeds to step S76. In step S76, the CPU 2 passes the data to the application program without decrypting the data.

  If it is determined in step S72 that the secret area mode is not ON, steps S73 to 75 are skipped and the process proceeds to step S76. In step S76, the CPU 2 reads the read target data without performing the decryption process regardless of whether the read target area is the secret area 303 or the free area 304.

  Of the processes executed by the automatic installation program 101 and the security program 102 described above, an operating system (OS) running on the computer may perform part or all of the processes. It goes without saying that the case where the functions of the above-described embodiments are realized by the processing is also included in the technical scope of the present invention.

  As described above, reading of data stored in the secret area 303 and writing to the secret area 303 are controlled by the CPU 2 in accordance with the security program 102. In other words, if the authentication process is successful when the security program is being executed by the information processing apparatus, the CPU 2 performs encryption and decryption for reading and writing data to and from the security area. On the other hand, if the authentication process fails, the CPU 2 does not perform encryption and decryption for reading and writing data to and from the security area. Therefore, the data to be written in the secret area 303 is automatically encrypted and written without the user's intention. Data to be read from the secret area 303 is also automatically decrypted without the user's intention. Therefore, if the user has succeeded in authentication, there is no need to instruct for the encryption or decryption process.

  In addition, when the secret area mode is ON due to successful authentication, the data written in the secret area 303 is encrypted. Therefore, when the secret area mode is OFF, such as when authentication fails, the data cannot be decrypted. That is, an unauthenticated user cannot decrypt and use the encrypted data. This means that if the security program 102 is being executed, only a specific user who has succeeded in authentication can save and delete data to be protected and concealed. If a free area 304 that does not require authentication is also prepared, a third party may use this free area 304. This is because the CPU 2 permits reading / writing of data to / from the non-security area secured in the storage medium regardless of the success or failure of user authentication. Therefore, a single USB storage device 10 can be safely shared by a specific user and a third party.

  When the encrypted data is read from the flash memory 13, the decrypted data is written to the RAM 4 instead of the flash memory 13. That is, the decrypted data is not written to the flash memory 13. Therefore, even when the USB storage device 10 is removed from the information processing apparatus 1 after the decryption process, the data stored in the secret area 303 is still encrypted. Therefore, leakage of confidential information stored in the secret area 303 can be prevented.

  By the way, in the above-described embodiment, it is assumed that the security program 102 is stored in the flash memory 13 of the USB storage device 10 and carried and started. However, it is not necessary to store the security program 102 or the like in the USB storage device 10 and carry it around. That is, the security program 102 is stored in the HDD 5 of the information processing apparatus 1, and an automatic start program (autorun.) Stored in the USB storage device 10 based on a start instruction from the input device 6 by the user. CPU2 starts the security program 102 based on inf).

  FIG. 8 is a schematic configuration diagram showing the information processing apparatus 1 and a general-purpose USB storage device 10 connected thereto. The parts already described are given the same reference numerals.

  Compared to FIG. 1, in FIG. 8, the security program 102 and setting data 103 are stored in the HDD 5 of the information processing apparatus 1. That is, it is assumed that the CPU 2 stores the setting data 103 in the HDD 5 in step S23 of the initialization process described above. The setting data 103 may be stored in the flash memory 13.

  Note that an encryption key may be generated for each USB storage device 10 or for each folder and stored in the setting data 103. Further, if the information processing apparatus 1 is different, the CPU 2 may generate the encryption key so as to be different. As a result, data in the USB storage device 10 encrypted in one information processing apparatus 1 cannot be decrypted in another information processing apparatus 1.

  According to FIG. 8, an automatic startup program 801 is stored in the flash memory 13. In the embodiment in which the security program 102 is activated by the user, the automatic activation program 801 is not always necessary.

  FIG. 9 is a flowchart illustrating a processing flow of the information processing apparatus 1 when the USB storage device 10 is inserted into the information processing apparatus 1. The parts already described are given the same reference numerals. Compared with FIG. 5, in FIG. 9, steps S52 and S56 are replaced with steps S92 and S96, respectively. When the CPU 2 detects that the USB storage device 10 is connected to the interface 8 in step S51, the process proceeds to step S92. The CPU 2 functions as a detection unit that detects whether a storage medium is connected to the interface.

  In step S92, the CPU 2 reads and executes the automatic startup program 801 in the USB storage device 10, and starts the security program 102 stored in the HDD 5 according to the automatic startup program 801. When executing the auto-start program 801 with autorun.inf, it is assumed that the security program 102 is installed in each information processing apparatus 1 so that the file path of the security program 102 is the same in any information processing apparatus 1. It becomes. As described above, when the detection unit detects that the storage medium is connected to the interface, the CPU 2 functions as a control unit that executes the security program stored in the storage device (HDD 5).

  Thereafter, the CPU 2 displays a dialog or the like for prompting the user to input a password via the display device 7 in accordance with the security program 102. Thereafter, steps S53 to S55 are executed, and the process proceeds to step S96.

  In step S96, the CPU 2 closes (ends) the security program 102.

  As described above, even if the security program 102 is stored in the information processing apparatus 1, a security function for suppressing information leakage can be added without depending on the specifications of the storage medium. Therefore, the cost of the security program 102 and the USB storage device 10 will be likely to be reduced.

1 Information processing device 10 USB storage device

Claims (17)

An information processing apparatus,
An interface for connecting a removable storage medium;
Control means for reading and executing the security program stored in the storage medium via the interface;
The control means includes
By reading and executing the security program stored in the storage medium,
An information processing apparatus that functions as a read / write control unit that permits writing of data to a security area secured in the storage medium and reading of data from the security area. The read / write control means includes
Encryption means for encrypting the data when writing the data to the security area;
Decrypting means for decrypting the data when reading the encrypted data from the security area,
The information processing apparatus according to claim 1, wherein the read / write control unit stores the decrypted data in a volatile storage unit included in the information processing apparatus without storing the decrypted data in the storage medium. . The read / write control means includes
The information processing apparatus according to claim 2, further comprising an encryption key generation unit configured to generate a different encryption key for each security area or for each information processing apparatus. The control means includes
By reading and executing the security program stored in the storage medium,
Defining means for defining the security area in the storage medium;
Setting means for setting authentication data for permitting reading and writing of data to the security area;
Accepting means for accepting authentication data when the security program is activated;
It further functions as an authentication unit that executes an authentication process by comparing the received authentication data with the authentication data set by the setting unit,
The read / write control means includes
When the security program is executed by the information processing apparatus, if the authentication process is successful, encryption and decryption are performed on reading and writing of data with respect to the security area,
4. The information processing apparatus according to claim 2, wherein when the authentication process fails, encryption and decryption are not performed for reading and writing of data with respect to the security area. 5. The read / write control means includes
5. The information processing apparatus according to claim 4, wherein reading / writing of data with respect to the non-security area secured in the storage medium is permitted regardless of success or failure of user authentication. The control means includes
Detecting means for detecting whether the storage medium is connected to the interface or removed from the interface;
An installation means for installing the security program in the information processing apparatus when the storage medium is connected to the interface;
6. The information processing apparatus according to claim 1, further comprising an uninstaller configured to uninstall the security program from the information processing apparatus when the storage medium is removed from the interface. . A control method for reading and writing data in an information processing apparatus comprising an interface for connecting a removable storage medium and a control means for reading and executing a security program stored in the storage medium via the interface ,
The control means reading and executing a security program stored in the storage medium;
A control method comprising the step of allowing the control means to write data to a security area secured in the storage medium and to read data from the security area. A computer program for controlling reading and writing of data in an information processing apparatus comprising an interface for connecting a removable storage medium and a control means for reading and executing a computer program stored in the storage medium via the interface There,
When the computer program is executed by the control means,
A computer program for causing the information processing apparatus to function as read / write control means for permitting writing of data to a security area secured in the storage medium and reading of data from the security area. A storage medium,
A storage medium storing the computer program according to claim 8. An information processing apparatus,
An interface for connecting a removable storage medium;
A storage device storing a security program;
Detecting means for detecting whether or not the storage medium is connected to the interface;
Control means for executing a security program stored in the storage device when the detection means detects that the storage medium is connected to the interface;
The control means includes
By executing the security program,
An information processing apparatus that functions as a read / write control unit that permits writing of data to a security area secured in the storage medium and reading of data from the security area. The read / write control means includes
Encryption means for encrypting the data when writing the data to the security area;
Decrypting means for decrypting the data when reading the encrypted data from the security area,
The information processing apparatus according to claim 10, wherein the read / write control unit stores the decrypted data in a volatile storage unit included in the information processing apparatus without storing the decrypted data in the storage medium. . The control means includes
By executing the security program,
Defining means for defining the security area in the storage medium;
Setting means for setting authentication data for permitting reading and writing of data to the security area;
Receiving means for receiving authentication data when the security program is activated;
It further functions as an authentication unit that executes an authentication process by comparing the received authentication data with the authentication data set by the setting unit,
The read / write control means includes
When the security program is executed by the information processing apparatus, if the authentication process is successful, encryption and decryption are performed on reading and writing of data with respect to the security area,
12. The information processing apparatus according to claim 11, wherein when the authentication process fails, encryption and decryption are not performed for reading and writing data to and from the security area. The read / write control means includes
The information processing apparatus according to claim 12, further comprising an encryption key generation unit configured to generate a different encryption key for each security area or for each information processing apparatus. The read / write control means includes
The information processing apparatus according to claim 12 or 13, wherein reading / writing of data to / from a non-security area secured in the storage medium is permitted regardless of success or failure of user authentication. The control means includes
15. The information processing apparatus according to claim 10, further comprising means for terminating the security program when the storage medium is removed from the interface. A control method for reading and writing data in an information processing device comprising an interface for connecting a removable storage medium, a storage device storing a security program, and a control means,
The control means includes
Detecting whether the storage medium is connected to the interface;
Upon detecting that the storage medium is connected to the interface, executing a security program stored in the storage device;
A control method, comprising: writing data to a security area secured in the storage medium and permitting reading of data from the security area. A computer program,
An interface that connects a removable storage medium, a storage device that stores the computer program, a detection unit that detects whether the storage medium is connected to the interface, and the detection unit that connects the storage medium to the interface A computer program for controlling reading and writing of data in an information processing device comprising control means for executing the computer program stored in the storage device,
By executing the computer program,
A computer program for causing the information processing apparatus to function as read / write control means for permitting writing of data to a security area secured in the storage medium and reading of data from the security area.

Images