JP2011039975A - External storage device capable of preventing information leakage, method thereof, and program thereof - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To eliminate an opportunity of wrong decryption or the like in an external storage device, and to prevent information leakage even when there is omission of erasure or the like. <P>SOLUTION: An external storage device stores first identification information for identifying an information processing device to which access to data held by the external storage device itself is permitted. When it is detected that the external storage device is connected to the information processing device, second identification information for identifying the information processing device is acquired from the information processing device. The first identification information is compared with the second identification information, and, if the two agree with each other, access to the data held by the external storage device itself is permitted. In any of the cases where the second identification information cannot be acquired, the first identification information is not stored, and the first identification information and the second identification information do not agree with each other, the data held by the external storage device itself, and the first identification information are initialized, and then new data writing from the information processing device is permitted. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to preventing leakage of information due to an accident such as loss or theft in a portable external storage device connected to a processing device.

  In general, information leakage prevention measures implemented in a portable external storage device include authentication using a password or the like, data encryption, and incorporating information leakage prevention software into an information processing device such as a PC. In the situation where such a preventive measure is taken, when temporarily transferring data with an arbitrary information processing apparatus (hereinafter, “PC” will be described as a specific example of the information processing apparatus), or if the password by the compatibility problem of software with the side PC can not pass data, troublesome operations such as encryption setting is required.

  In view of such points, Patent Document 1 discloses an IC memory card using a recognition code (ID code).

  In the technique described in Patent Document 1, a recognition code (ID code) known only to the card owner is stored on an IC memory card, and the recognition code and the recognition code supplied from the main body side are compared. To protect the data.

JP 04-163650 A

  By using the technique described in Patent Document 1 described above, the user's operation can be simplified. However, with the above-described technology, there are many cases in which inconvenience occurs due to software compatibility and operability with the counterpart terminal when transferring data in a conference or the like.

Also, when protecting with encryption, password protection, information leakage prevention software, etc.
Since the data is stored semi-permanently in the portable storage device, it is stored in the portable storage device by giving an opportunity to illegally release the encryption, password, and information leakage prevention software functions. The risk of data leakage is included.

  In addition, in the portable external storage device as described above, once stored data is kept due to omission of deletion by the operator or forgetting to delete, important information that the administrator does not recognize leaks when lost or stolen. Contains danger.

  Therefore, the present invention does not give an opportunity to illegally release encryption, password, and information leakage prevention software functions, and information leakage that can prevent leakage of important information even if there is omission or forgetting to erase An object is to provide a deterrent external storage device, a method thereof, and a program thereof.

  According to the first aspect of the present invention, in the external storage device connected to the information processing device, a first identification for identifying an information processing device that permits access to data held by the external storage device itself Management information storage means for storing information, and identification information management for acquiring second identification information for identifying the information processing apparatus from the information processing apparatus when it is detected that the information processing apparatus is connected Means, the first identification information and the second identification information are compared, and when the first identification information and the second identification information match, access to the data held by itself is permitted. And when the identification information management means fails to acquire the second identification information, the management information storage means does not store the first identification information, Identification information and previous When the second identification information does not match, if any of the cases, the data held by itself and the first identification information are initialized and then new data writing from the information processing apparatus is permitted. An external storage device is provided.

  According to a second aspect of the present invention, an external storage method in an external storage device connected to an information processing device, the information processing device permitting access to data held by the external storage device is identified. Preparing a management information storage area for storing first identification information for the purpose, and second identification information for identifying the information processing apparatus when it is detected that the information processing apparatus is connected. When the identification information management step acquired from the information processing apparatus, the first identification information, and the second identification information are compared, and the first identification information and the second identification information match. And a control step for permitting access to the data held by the device, and when the identification information management step fails to acquire the second identification information, the management information storage area stores the first identification information. If the information is not stored, the first identification information and the second identification information do not match, and the data held by itself and the first identification information when one of the cases is true An external storage method is provided in which new data writing from the information processing apparatus is permitted after initialization.

  According to a third aspect of the present invention, in an external storage program installed in an external storage device connected to the information processing device, an information processing device that allows access to data held by the external storage device is identified Management information storage means for storing the first identification information for performing information processing, and second identification information for identifying the information processing device when the connection to the information processing device is detected. The identification information management means acquired from the apparatus, the first identification information, and the second identification information are compared, and when the first identification information and the second identification information match, the self Control means for permitting access to the data to be held, and when the identification information management means cannot acquire the second identification information, the management information storage means stores the first identification information. Na In the case where the first identification information and the second identification information do not match, when any of the cases, the data held by itself and the first identification information are initialized after the initialization An external storage program is provided that causes a computer to function as an external storage device that permits writing of new data from an information processing device.

  According to the present invention, when the portable external storage device is connected to a device other than the information processing device to be connected, the stored data is automatically deleted. Thus, like a general portable external storage device, The risk of information leakage due to loss or theft can be minimized.

It is a figure showing the basic composition of the embodiment of the present invention. It is a figure which shows the connection of the portable external storage device 1000 which is embodiment of this invention, and the information processing apparatus 2000. FIG. It is a figure (1/4) showing basic operation of an embodiment of the present invention. It is a figure (2/4) showing the basic operation | movement of embodiment of this invention. It is a figure (3/4) showing the basic operation | movement of embodiment of this invention. It is a figure (4/4) showing the basic operation | movement of embodiment of this invention.

  Next, embodiments of the present invention will be described in detail with reference to the drawings.

  First, the configuration will be described. Referring to FIG. 1, a portable external storage device 1000 according to an embodiment of the present invention includes a control unit 100, a nonvolatile memory 200, a capacitor 300, and an input / output unit 400.

  The control unit 100 also includes an identification information management tool 110, identification information 121, and a management information storage area 120 that is an area for storing a reading completion flag 122. The control unit 100 is a part that performs detection and identification control of being connected to the information processing apparatus 2000. A specific example of the information processing apparatus 2000 is a PC.

  The nonvolatile memory 200 is a data storage area. The capacitor 300 supplies power to the control unit 100 and the nonvolatile memory 200. The input / output unit 400 is a part used for connection with the information processing apparatus 2000. After the information processing device 2000 and the portable external storage device 1000 are connected, data is exchanged via the input / output unit 400. In addition, power is supplied via the input / output unit 400. An example of the connection between the information processing device 2000 and the portable external storage device 1000 is shown in FIG.

  When the input / output unit 400 of the portable external storage device 1000 is connected to the information processing device 2000, power is supplied from the connection interface and the control unit 100 starts processing. The control unit 100 activates the identification information management tool 110. The identification information management tool 110 acquires identification information unique to the information processing apparatus 2000. Arbitrary information can be set as the identification information. In this specification, the use of an IP address (Internet Protocol Address) is exemplified as an example. When an IP address is used for the identification information, the value becomes 255 to the fourth power, and the probability that the identification information coincides by chance is infinitely close to 0.

  When valid identification information 121 is stored in the management information storage area 120, the control unit 100 compares the identification information acquired from the information processing apparatus 2000. If the identification information matches, the controller 100 connects the nonvolatile memory 200, to allow data access from the information processing apparatus 2000.

On the other hand, the control unit 100 initializes the nonvolatile memory 200 and the management information storage area 120 when any of the following three cases is satisfied, and then connects the nonvolatile memory 200 to write new data. Make it possible. Here, the three cases are
1) When the identification information management tool 110 cannot acquire identification information from the information processing apparatus 2000.

  2) When valid identification information 121 is not stored in the management information storage area 120.

3) When the identification information acquired from the information processing apparatus 2000 and the identification information stored in the management information storage area 120 do not match.
It is three.

  When the information processing device 2000 completes the reading of the storage data of the portable external storage device 1000, the control unit 100 sets a reading completion flag that is paired with the storage data in the reading completion flag 122 of the management information storage area 120. To do.

  When the control unit 100 detects the completion of data writing from the information processing device 2000, the control unit 100 activates the identification information management tool and causes the operator to input the identification information of the information processing device 2000 to be connected.

  The input identification information is stored in the identification information 121 in the management information storage area 120.

  When the control unit 100 detects that the external storage device 1000 has been removed from the information processing device 2000, the control unit 100 checks the read completion flag 122 of the management information storage area 120. If the flag is set, the corresponding storage data And the corresponding reading completion flag 122 is cleared.

  In addition, when the valid identification information 121 is not stored in the management information storage area 120, the control unit 100 initializes the nonvolatile memory 200 and the management information storage area 120.

  These processes are performed by the power of the capacitor 300 that is charged while the external storage apparatus 1000 is connected to the information processing apparatus 2000.

[Description of Operation of Embodiment]
The operation when the portable storage device 1000 of FIG. 1 is connected to the information processing device 2000 will be described with reference to the flowchart of FIG.

  When the portable external storage device 1000 is connected to the information processing device 2000 (step S501), the identification information management tool 110 is automatically activated (step S502). The identification information management tool 110 tries to acquire the identification information of the information processing apparatus 2000 (step S503).

  When acquisition fails (No in step S503), initialization processing of the nonvolatile memory 200 is executed (step S507). On the other hand, if acquisition of identification information has succeeded (Yes in step S503), it is next checked whether valid identification information is stored in the identification information 121 of the management information storage area 120 (step S504).

  If valid identification information is not stored (No in step S504), initialization processing of the nonvolatile memory 200 is executed (step S507). On the other hand, when valid identification information is stored (Yes in step S504), the identification information acquired from the information processing apparatus 2000 is compared with the identification information stored in the identification information 121 (step S505).

  If they match (Yes in step S505), the nonvolatile memory 200 is connected (step S506). As a result, the stored data can be accessed from the information processing apparatus 2000. On the other hand, if they do not match (No in step S505), the nonvolatile memory 200 is initialized (step S507). After the initialization process of the nonvolatile memory 200, the management information storage area 120 is initialized (step S508), and the nonvolatile memory 200 is connected (step S509). As a result, new data can be written from the information processing apparatus 2000.

  Next, an operation when data writing from the information processing device 2000 to the portable external storage device 1000 in FIG. 1 is completed will be described using the flowchart shown in FIG.

  When the completion of data writing from the information processing apparatus 2000 is detected (step S601), the identification information management tool 110 of the control unit 100 is automatically activated (step S602).

  The automatically activated identification information management tool 110 displays an input screen for allowing the operator (user) to input identification information on the information processing apparatus 2000, and requests identification information from the operator (step S603). When the identification information from the operator can be acquired (Yes in step S603), the input identification information is stored in the identification information 121 (step S604). On the other hand, if the identification information is not correctly input (No in step S603), the process ends without updating the identification information 121.

  Next, the operation when the information processing apparatus 2000 has completed reading of the data stored in the portable external storage apparatus 1000 of FIG. 1 will be described using the flowchart shown in FIG.

  The control unit 100 waits until it detects completion of the reading process (data transfer) of the information processing apparatus 2000 (step S701). When the completion of the reading process (data transfer) is detected (Yes in step S702), a flag indicating reading completion is set in the reading completion flag 122 of the management information storage area 120 (step S703).

  Next, the operation when the portable external storage device 1000 of FIG. 1 is detached from the information processing device 2000 will be described using the flowchart shown in FIG.

  When the portable external storage device 1000 is removed from the information processing device 2000 (step S801), the control unit 100 checks whether the reading completion flag 122 of the management information storage area 120 is set (step S802). If it is not set (2 in step S802), the process is exited. On the other hand, if it is set (Yes in step S802), the corresponding data stored in the nonvolatile memory 200 is deleted (step S803), and the reading completion flag 122 is deleted (step S804). Next, it is confirmed whether the identification information is stored in the identification information 121 of the management information storage area 120 (step S805). If stored (Yes in step S805), the process exits. If not saved (No in step S805), the nonvolatile memory 200 and the management information area 120 are each initialized (step S806).

  In the embodiment of the present invention described above, the following effects can be obtained.

  The first effect is that when a portable external storage device is connected to a device other than the information processing device to be connected, the stored data is automatically deleted, so that it is lost or stolen like a conventional portable external storage device. The risk of leaking information due to can be kept extremely low.

  The second effect is that the portable external storage device stores data only for a minimum period necessary for data transfer. Therefore, the conventional portable external storage device has the risk of information leakage due to loss or theft. It can be kept very low.

  The third effect is that this portable external storage device stores only the relevant data that is the target of data transfer, so unintentionally important data due to forgetting to erase data, omission of omission, etc. like conventional portable external storage devices Is not stored, it is possible to eliminate the risk of unintentional leakage of important information due to loss or theft.

  Although the information leakage suppression external storage device according to the embodiment of the present invention can be realized by hardware, a computer-readable recording program for causing a computer to function as the information leakage suppression external storage device It can also be realized by reading from the medium and executing it.

  Further, the information leakage suppression external storage method according to the embodiment of the present invention can be realized by hardware, but the computer reads a program for causing the computer to execute the method from a computer-readable recording medium and executes the program. Can also be realized.

  Moreover, although the above-described embodiment is a preferred embodiment of the present invention, the scope of the present invention is not limited only to the above-described embodiment, and various modifications are made without departing from the gist of the present invention. Implementation in the form is possible.

100 Control Unit 110 Identification Information Management Tool 120 Management Information Storage Area 121 Identification Information 122 Read Completion Flag 200 Nonvolatile Memory 300 Capacitor 400 Input / Output Unit 1000 Portable External Storage Device 2000 Information Processing Device

Claims (15)

In an external storage device connected to the information processing device,
Management information storage means for storing first identification information for identifying an information processing device that permits access to data held by the external storage device itself;
Identification information management means for acquiring, from the information processing apparatus, second identification information for identifying the information processing apparatus when it is detected that the information processing apparatus is connected;
Control means for comparing the first identification information with the second identification information, and permitting access to the data held by itself when the first identification information and the second identification information match. When,
With
When the identification information management unit cannot acquire the second identification information, and when the management information storage unit does not store the first identification information, the first identification information and the second identification When the information does not match, if any of the cases, the data held by itself and the first identification information are initialized, and then new data writing from the information processing apparatus is permitted. An external storage device. The external storage device according to claim 1,
When the completion of the data writing is detected after permitting the new data writing, the user of the information processing apparatus is requested to input the identification information, and the input of the identification information from the user in response to the request is accepted. In this case, the received identification information is stored in the management information storage unit as the first identification information. The external storage device according to claim 1 or 2,
When the information processing apparatus permitted to access by the control means finishes reading the data held by itself, a flag indicating completion of reading is set, and when the external storage device is removed from the information processing apparatus, An external storage device characterized in that, when a flag indicating completion of reading is set, the data held by itself and the flag indicating completion of reading are erased. The external storage device according to claim 3.
If the flag indicating completion of reading is set, the data held by itself if the first identification information is not saved after erasing the data held by itself and the flag indicating completion of reading And an external storage device, wherein the first identification information is initialized. The external storage device according to any one of claims 1 to 4,
An external storage device further comprising a capacitor for supplying power to the external storage device after the external storage device is detached from the information processing device. An external storage method in an external storage device connected to an information processing device,
Providing a management information storage area for storing first identification information for identifying an information processing device that permits access to data held by the external storage device;
An identification information management step of acquiring, from the information processing apparatus, second identification information for identifying the information processing apparatus when it is detected that the information processing apparatus is connected;
A control step of comparing the first identification information with the second identification information, and permitting access to the data held by itself when the first identification information and the second identification information match. When,
With
When the identification information management step cannot acquire the second identification information, and when the management information storage area does not store the first identification information, the first identification information and the second identification When the information does not match, if any of the cases, the data held by itself and the first identification information are initialized, and then new data writing from the information processing apparatus is permitted. External storage method. The external storage method according to claim 6,
When the completion of the data writing is detected after permitting the new data writing, the user of the information processing apparatus is requested to input the identification information, and the input of the identification information from the user in response to the request is accepted. In this case, the received identification information is stored in the management information storage area as the first identification information. The external storage method according to claim 6 or 7,
When the information processing apparatus permitted to access in the control step finishes reading the data held by the information processing apparatus, a flag indicating completion of reading is set, and the external storage device is removed from the information processing apparatus. An external storage method characterized by erasing the data held by itself and the flag indicating completion of reading when a flag indicating completion of reading is set. The external storage method according to claim 8, wherein
If the flag indicating completion of reading is set, the data held by itself if the first identification information is not saved after erasing the data held by itself and the flag indicating completion of reading And initializing the first identification information. The external storage method according to any one of claims 6 to 9,
An external storage method, wherein the external storage device further includes a capacitor for supplying power to the external storage device after the external storage device is removed from the information processing device. In the external storage program installed in the external storage device connected to the information processing device,
Management information storage means for storing first identification information for identifying an information processing device that permits access to data held by the external storage device itself;
Identification information management means for acquiring, from the information processing apparatus, second identification information for identifying the information processing apparatus when it is detected that the information processing apparatus is connected;
Control means for comparing the first identification information with the second identification information, and permitting access to the data held by itself when the first identification information and the second identification information match. When,
With
When the identification information management unit cannot acquire the second identification information, and when the management information storage unit does not store the first identification information, the first identification information and the second identification If the information does not match, the external storage device that permits writing of new data from the information processing device after initializing the data held by itself and the first identification information when corresponding to any of the cases An external storage program for causing a computer to function as The external storage program according to claim 11,
When the completion of the data writing is detected after permitting the new data writing, the user of the information processing apparatus is requested to input the identification information, and the input of the identification information from the user in response to the request is accepted. In the case, the external storage program stores the received identification information as the first identification information in the management information storage means. The external storage program according to claim 11 or 12,
When the information processing apparatus permitted to access by the control means finishes reading the data held by itself, a flag indicating completion of reading is set, and when the external storage device is removed from the information processing apparatus, An external storage program that erases the data held by itself and the flag indicating completion of reading when a flag indicating completion of reading is set. The external storage program according to claim 13,
If the flag indicating completion of reading is set, the data held by itself if the first identification information is not saved after erasing the data held by itself and the flag indicating completion of reading And an external storage program for initializing the first identification information. The external storage program according to any one of claims 11 to 14,
An external storage program, wherein the external storage device further includes a capacitor for supplying power to the external storage device after the external storage device is removed from the information processing device.

Images