JP2011039728A - Data storage device, data storage system, data writing method and data reading method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a data storage device capable of making difficult the leakage of data in the data storage device or falsification to the data in the data storage device. <P>SOLUTION: The data storage device includes: a memory; a storage part storing reference position information indicating a reference position and a use condition of the memory part; and a control part acquiring present position information indicating a present position of its own device when receiving a writing request of an effect of writing data of a writing target into the memory or a reading request of an effect of reading data of a reading target from the memory as an operation request, and executing operation corresponding to the operation request by the use of the memory when a relation between the present position and the reference position satisfies the use condition. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a data storage device, a data storage system, a data writing method, and a data reading method.

  At present, it is possible to easily obtain data indicating the current position (see Non-Patent Document 1), and the importance of data management is increasing. As a device that manages data at a high level, for example, a data storage device that can prevent data leakage by using a password is known.

  This data storage device encrypts data using a fixed password when data is written, stores the encrypted data, and reads data using a fixed password when data is read. Decrypt the encrypted data in the storage device and output the decrypted data (for example, dm-crypt in Linux).

Network space-time information server, [online], [Search July 28, 2009], Internet <URL: http://www2.nict.go.jp/w/w114/tsp/research/labo3/nst.html>

  In a data storage device that can prevent data leakage using a password, the password is fixed. For this reason, when the data storage device is stolen together with a password, there is a problem that data in the data storage device is leaked or data in the data storage device is falsified.

  In particular, the data storage device corresponding to the serial ATA standard is easier to be stolen than the data storage device corresponding to the parallel ATA standard. This is because the serial ATA standard is compatible with hot swapping, and therefore there is a high possibility that the data storage device corresponding to the serial ATA standard is easily detachable.

  As measures against theft, in addition to entering / exiting the room where the data storage device is installed, each data storage device is physically locked and fixed. However, in this case, every time the data storage device breaks down, the troublesome work of unlocking, exchanging, and locking again has to be performed. It is also necessary to manage the key itself.

  An object of the present invention is to provide a data storage device, a data storage system, a data writing method, and a data reading method capable of making it difficult to leak data in the data storage device or to tamper with data in the data storage device. It is.

  The data storage device of the present invention writes a data to be written to the storage unit as an operation request, a storage unit that stores a storage unit, reference position information indicating a reference position, and a use condition of the storage unit. When receiving a write request to the effect or a read request to read data to be read from the storage unit, current position information indicating the current position of the device is acquired, and the relationship between the current position and the reference position is And a control unit that executes an operation according to the operation request using the storage unit when the use condition is satisfied.

  A data writing method of the present invention is a data writing method in a data storage device, and stores a reference position information indicating a reference position and a use condition of the storage unit in a storage unit, When a write request for writing data to be written is received, current position information indicating the current position of the device itself is acquired, and when the relationship between the current position and the reference position satisfies the use condition, the storage unit A control step of writing the data to be written to

  The data reading method of the present invention is a data reading method in a data storage device, and stores a reference position information indicating a reference position and a use condition of the storage unit in the storage unit, and from the storage unit When a read request for reading data to be read is received, current position information indicating the current position of the device itself is acquired, and when the relationship between the current position and the reference position satisfies the use condition, the storage unit And a control step of reading out the data to be read from.

  According to the present invention, when the relationship between the current position and the reference position satisfies the use condition, data is written or data is read using the storage unit. For this reason, for example, if the data storage device is stolen and the relationship between the current position of the data storage device and the reference position does not satisfy the use condition, data access to the storage unit can be prohibited, and data leakage in the data storage device Alternatively, it becomes possible to make it difficult to falsify data in the data storage device.

1 is a block diagram illustrating a data storage system according to an embodiment of the present invention. It is the figure which showed the relationship between a data storage system, the writing side terminal, and the reading side terminal. It is a flowchart for demonstrating the operation | movement at the time of data writing. It is the figure which showed the detail of the algorithm for performing step S302. It is the figure which showed the detail of the algorithm for performing step S303. It is a flowchart for demonstrating the operation | movement at the time of data reading. It is the figure which showed the detail of the algorithm for performing step S602. It is the figure which showed the detail of the algorithm for performing step S603. It is a block diagram for demonstrating the effect of this embodiment.

  Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

  FIG. 1 is a block diagram showing a data storage system according to an embodiment of the present invention. In FIG. 1, the data storage system includes a location information distribution server 1 and a data storage device 2. FIG. 2 is a diagram showing a relationship between the data storage device 2 and the writing side terminal 101 and the reading side terminal 102 that use the data storage device 2.

  The position information distribution server 1 distributes current position information indicating the current position of the data storage device 2 (hereinafter simply referred to as “current position information”) to the data storage device 2.

  The location information distribution server 1 is a network space-time information server described in Non-Patent Document 1, for example. The location information distribution server 1 may be, for example, a GPS (Global Positioning System) satellite or an access point capable of transmitting an SSID (Service Set Identifier) in a wireless LAN (Local Area Network) unique to the building.

  The data storage device 2 includes a storage unit 21, a storage unit 22, and an encryption unit 23.

  The storage unit 21 stores encrypted data.

  The storage unit 22 stores reference position information indicating the reference position and usage conditions of the storage unit 21.

  As the reference position, a position determined by an authorized user as the installation position of the data storage device 2 is used. Note that the reference position may be a position of an area determined by a legitimate user as the installation position of the data storage device 2. In this case, for example, SSID is used as the reference position information.

  The use condition is such that the distance between the current position of the data storage device 2 and the reference position is shorter than a predetermined distance (hereinafter referred to as “determination distance”). The determination distance is set to an appropriate value, for example, 10 meters by a legitimate user. The determination distance is not limited to 10 meters and can be changed as appropriate. The use condition is not limited to the above condition, and may be a condition that the current position of the data storage device 2 matches the reference position, for example.

  The encryption unit 23 is an example of a control unit, and converts plaintext data and encrypted data (specifically, encryption and decryption).

  When the encryption unit 23 receives a write request for writing the data to be written in the storage unit 21 or a read request for reading the data to be read from the storage unit 21 as an operation request, Obtained from the location information distribution server 1.

  When the position information distribution server 1 distributes the current position information to the data storage device 2 periodically (for example, every minute), the encryption unit 23 stores only the latest current position information in the storage unit 22. It may be stored and the latest current position information may be acquired from the storage unit 22 when an operation request is received. In this case, the encryption unit 23 stores the new current position information from the position information distribution server 1 even if the distribution interval (for example, 1 minute) of the current position information by the position information distribution server 1 has elapsed. It is desirable to delete the latest current position information in the unit 22.

  The encryption unit 23 receives the plaintext data (data to be written) and the encryption key from the writing side terminal 101 together with the write request (operation request), and reads the encryption key together with the read request (operation request). Accept from the side terminal 102.

  The encryption unit 23 reads the reference position information and the use conditions from the storage unit 22 when the current position information is acquired after receiving the write request (operation request), the plaintext data, and the encryption key.

  When the relationship between the current position indicated by the current position information and the reference position indicated by the reference position information satisfies the use condition, the encryption unit 23 generates encrypted data by encrypting the plaintext data using the encryption key. Then, a series of write operations of writing the encrypted data into the storage unit 21 are executed as operations corresponding to the operation request.

  If the relationship between the current position indicated by the current position information and the reference position indicated by the reference position information does not satisfy the use conditions, the encryption unit 23 does not perform a series of write operations. In addition, when the current position information cannot be acquired, the encryption unit 23 determines that the relationship between the current position indicated by the current position information and the reference position indicated by the reference position information does not satisfy the use condition, The write operation is not performed.

  On the other hand, the encryption unit 23 reads the reference position information and the use conditions from the storage unit 22 when acquiring the current position information after receiving the read request (operation request) and the encryption key.

  When the relationship between the current position indicated by the current position information and the reference position indicated by the reference position information satisfies the use condition, the encryption unit 23 stores the encrypted read target data (encrypted data). A series of read operations of reading from 21, decrypting the encrypted read target data using an encryption key to generate plain text data, and outputting the plain text data to the read-side terminal 102, Execute as an action according to

  Note that if the relationship between the current position indicated by the current position information and the reference position indicated by the reference position information does not satisfy the use condition, the encryption unit 23 does not perform a series of reading operations. In addition, when the current position information cannot be acquired, the encryption unit 23 determines that the relationship between the current position indicated by the current position information and the reference position indicated by the reference position information does not satisfy the use condition, The read operation is not performed.

  The encryption unit 23 is a computer such as a CPU (Central Processing Unit), for example, and operates by reading a program defining the operation of the data storage device 2 from a recording medium such as a memory and executing it.

  Next, the operation will be described.

  First, the operation at the time of data writing will be described. FIG. 3 is a flowchart for explaining the operation at the time of data writing.

  When the encryption unit 23 receives the write request, the plaintext data, and the encryption key (step S301), the encryption unit 23 obtains the current position information, the current position indicated by the current position information, and the storage unit 22 It is determined whether the relationship with the reference position indicated by the reference position information satisfies a use condition in the storage unit 22 (a condition that the distance between the current position of the data storage device 2 and the reference position is shorter than the determination distance). (Step S302).

  If the distance between the current position of the data storage device 2 and the reference position is shorter than the determination distance (step S302), the encryption unit 23 determines that the data storage device 2 has not been illegally moved, and determines the encryption key. Using this, plain text data is encrypted to generate encrypted data, and the encrypted data is written in the storage unit 21 (step S303). Thereafter, the encryption unit 23 ends the writing operation normally.

  On the other hand, if the distance between the current position of the data storage device 2 and the reference position is equal to or greater than the determination distance (step S302), the encryption unit 23 determines that the data storage device 2 has been illegally moved due to theft or the like, Information indicating a write error is transmitted to a predetermined transmission destination (for example, a security center) without performing a series of write operations (step S304). Thereafter, the encryption unit 23 performs an end operation at the time of abnormality such as, for example, turning off the power.

  FIG. 4 is a diagram showing details of the algorithm for executing step S302, and FIG. 5 is a diagram showing details of the algorithm for executing step S303.

  Next, the operation at the time of data reading will be described. FIG. 6 is a flowchart for explaining the operation at the time of data reading.

  When the encryption unit 23 receives the read request and the encryption key (step S601), the encryption unit 23 acquires the current position information, the current position indicated by the current position information, and the reference position information in the storage unit 22 It is determined whether or not the relationship with the reference position indicated by satisfies the use condition in the storage unit 22 (condition that the distance between the current position of the data storage device 2 and the reference position is shorter than the determination distance) (step S602). ).

  If the distance between the current position of the data storage device 2 and the reference position is shorter than the determination distance (step S602), the encryption unit 23 determines that the data storage device 2 has not been illegally moved and is encrypted. The read target data (encrypted data) is read from the storage unit 21, and the encrypted read target data is decrypted using the encryption key and output (step S603). Thereafter, the encryption unit 23 ends the reading operation normally.

  On the other hand, if the distance between the current position of the data storage device 2 and the reference position is equal to or greater than the determination distance (step S602), the encryption unit 23 determines that the data storage device 2 has been illegally moved due to theft or the like, Information indicating a read error is transmitted to a predetermined transmission destination (for example, a security center) without performing a series of read operations (step S604). Thereafter, the encryption unit 23 performs an end operation at the time of abnormality such as, for example, turning off the power.

  FIG. 7 is a diagram showing details of the algorithm for executing step S602, and FIG. 8 is a diagram showing details of the algorithm for executing step S603.

  According to the present embodiment, when the encryption unit 23 accepts a write request or a read request as an operation request, the encryption unit 23 acquires current position information, and the relationship between the current position and the reference position of the data storage device 2 is a use condition. When satisfy | filling, the operation | movement according to an operation request | requirement is performed using the memory | storage part 21. FIG.

  Therefore, for example, when the data storage device 2 is stolen and the relationship between the current position and the reference position of the data storage device 2 does not satisfy the use condition, data access to the storage unit 21 can be prohibited, and the data storage device 2 It is possible to make it difficult to leak data or to alter data in the data storage device 2 (see FIG. 9).

  Therefore, the need for physically locking and fixing the data storage device 2 can be reduced as a theft countermeasure for preventing data leakage and tampering. Therefore, by omitting the locking itself, the troublesome management of the key can be eliminated, and the troublesome locking work at the time of exchanging the data storage device can be eliminated. Also, if the key is shared by a plurality of data storage devices, the troublesome management of the key can be reduced.

  In addition, by setting usage conditions as appropriate, it is possible to freely set the granularity of how much the data storage device 2 is moved so that encryption / decryption will fail.

  For example, in a situation where an SSID assigned to a predetermined wireless LAN access point is used as a reference position, an SSID (current position information) acquired from the wireless LAN access point is an SSID that is a reference position. If the same condition is used as a use condition, encryption and decryption may be disabled when the data storage device 2 is out of the communication area of a predetermined wireless LAN access point. it can.

  When the condition that the distance between the current position of the data storage device 2 and the reference position is shorter than the determination distance is used as the use condition, the operation is performed based on the distance between the current position of the data storage device 2 and the reference position. It is possible to determine whether or not to perform an operation according to the request.

  For example, in the situation where the current position information is acquired using GPS, if the determination distance is set to 500 m, the data storage device 2 may be encrypted and out of the area within the radius of 500 m from the reference position. Decryption can be made impossible.

  In the present embodiment, in a situation where a write request is accepted as an operation request, the encryption unit 23 encrypts the write target data and stores the encrypted write target data as an operation according to the operation request. The operation of writing in the unit 21 is performed. Further, in a situation where the read request is accepted as the operation request, the encryption unit 23 reads the encrypted read target data from the storage unit 21 as the operation corresponding to the operation request, and the encrypted read target The data is decoded and output.

  In this case, even if the data storage device 2 is stolen together with the encryption key, it is possible to make it difficult to leak or falsify data stored in the data storage device 2 in an encrypted state.

  In the embodiment described above, the illustrated configuration is merely an example, and the present invention is not limited to the configuration.

DESCRIPTION OF SYMBOLS 1 Position information distribution server 2 Data storage device 21 Storage part 22 Storage part 23 Encryption part 101 Writing side terminal 102 Reading side terminal

Claims (10)

A storage unit;
A storage unit for storing reference position information indicating a reference position and a use condition of the storage unit;
When an operation request is received, a write request for writing data to be written to the storage unit or a read request for reading data to be read from the storage unit, current position information indicating the current position of the device is obtained. And a control unit that executes an operation in accordance with the operation request using the storage unit when the relationship between the current position and the reference position satisfies the usage condition. The data storage device of claim 1, wherein
The use condition is a data storage device, wherein a distance between the current position and the reference position is shorter than a predetermined distance. The data storage device according to claim 1 or 2,
In the situation where the write request is accepted as the operation request, the control unit encrypts the write target data as an operation according to the operation request, and stores the encrypted write target data in the storage unit In the situation where the read request is accepted as the operation request, the encrypted data to be read is read from the storage unit as the operation corresponding to the operation request, and the encrypted A data storage device that performs an operation of decoding and outputting data to be read. A data storage device according to any one of claims 1 to 3,
A position information distribution server for distributing current position information indicating a current position of the data storage device to the data storage device;
The data storage system, wherein a control unit in the data storage device acquires the current position information from the position information distribution server. A method for writing data in a data storage device, comprising:
A storage step of storing reference position information indicating a reference position, a use condition of the storage unit, and a storage unit;
When receiving a write request to write data to be written to the storage unit, the current position information indicating the current position of the device itself is acquired, and the relationship between the current position and the reference position satisfies the use condition And a control step of writing the data to be written into the storage unit. The data writing method according to claim 5, wherein
The data writing method, wherein the use condition is that a distance between the current position and the reference position is shorter than a predetermined distance. The data writing method according to claim 5 or 6,
In the control step, as an operation in response to the write request, a data write method of performing an operation of encrypting the write target data and writing the encrypted write target data into the storage unit. A data reading method in a data storage device,
A storage step of storing reference position information indicating a reference position, a use condition of the storage unit, and a storage unit;
When a read request for reading data to be read from the storage unit is received, current position information indicating the current position of the device itself is acquired, and the relationship between the current position and the reference position satisfies the use condition And a control step of reading out the data to be read from the storage unit. The data reading method according to claim 8, wherein
The data reading method, wherein the use condition is that a distance between the current position and the reference position is shorter than a predetermined distance. The data reading method according to claim 8 or 9,
In the control step, as an operation in response to the read request, an operation of reading encrypted read target data from the storage unit and decrypting and outputting the encrypted read target data is performed. Method.

Images