JP2012014454A - External storage device connection device and access control method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To allow acquisition of a trail of information outside a company using an external recorder.SOLUTION: The external storage device connection device 10 is equipped with: a plug 11; an insertion part 12; a log file storage part 109; a registration information storage part 105; a permission means 106; and a recording part 107. The plug is inserted into a receptacle provided in a host, and the external storage device is inserted into the insertion part. A log file is stored in the log file storage part. Registration information in which information showing the external storage device is recorded is stored in the registration information storage part. The permission means permits access from the host to the external storage device when the information showing the external storage device is recorded in the registration information. The recording part records, when the access from the host to the external storage device is permitted by the permission means, and there is the access from the host to a file in the external storage device, a type of the access, accessed file information, and host information showing the host in the log file.

Description

  Embodiments described herein relate generally to an external storage device connection device and an access control method that are inserted between an external storage device and a host.

  In recent years, there have been reports of cases of loss of recording media outside the company and intentional information leakage by insiders of companies, and it is desirable to be able to obtain information protection and trails outside the company.

  At present, in an integrated management system for taking measures against information leakage introduced in a company, use restrictions are made by using identification information of a recording medium. In addition, there is a product that can be used and restricted by authenticating the recording medium alone. However, these systems and recording media cannot acquire a general-purpose recording medium or a trail of information outside the company.

JP 2008-108231 A

  It is desired to make it possible to obtain a trail of information outside the company using a general-purpose recording medium.

  An object of the present invention is to provide a recording medium connecting apparatus and an access control method that allow an external information apparatus to obtain a trail of information outside the company.

  According to the embodiment, the external storage device connection apparatus includes a plug, an insertion unit, a log file storage unit, a registration information storage unit, a permission unit, and a recording unit. The plug is inserted into a receptacle provided in the host. An external storage device is inserted into the insertion unit. The log file is stored in the log file storage unit. The registration information storage unit stores registration information in which information indicating the external storage device is recorded. The permission unit permits access from the host to the external storage device when information indicating the external storage device is recorded in the registration information. The recording unit is permitted to access the external storage device from the host by the permission unit, and when there is access from the host to a file in the external storage device, an access type indicating the type of access, File information indicating the accessed file and host information indicating the host are recorded in the log file.

It is a figure which shows an example of a structure of the USB memory connection apparatus of embodiment. It is a block diagram which shows an example of the system configuration | structure of the USB memory connection apparatus of embodiment. It is a figure which shows the usage example of the USB memory connection apparatus of embodiment. It is a figure which shows the usage example of the USB memory connection apparatus of embodiment. The figure which shows an example of the content recorded on the connection computer log file of embodiment. The figure which shows an example of the content recorded on the access log file of embodiment. 6 is an exemplary flowchart illustrating an example of a processing procedure performed by an authentication program when the USB memory connection device of the embodiment is connected to a computer. 6 is an exemplary flowchart illustrating an example of a processing procedure of a control program when registered device information is transferred from the authentication program of the embodiment to a USB memory connection device. The flowchart which shows an example of the process sequence of a control program when a log file transfer request is received. 6 is an exemplary flowchart illustrating an example of a processing procedure of a control program when a USB memory is connected to the USB memory connection device according to the embodiment. The flowchart which shows an example of the procedure of the transfer process of the data between a computer and USB memory. 6 is a flowchart illustrating an example of a system configuration of the memory card connection device according to the embodiment. 5 is a flowchart illustrating an example of a system configuration of the USB memory according to the embodiment.

  Hereinafter, embodiments will be described with reference to the drawings.

  The configuration of a USB memory connection device as an external storage device will be described with reference to FIGS.

  FIG. 1 is a diagram illustrating an appearance of a USB memory connection device according to an embodiment.

  As shown in FIG. 1, the USB memory connection device 10 is provided with a USB plug 11. The USB memory connection device 10 is provided with a USB receptacle 12.

  The USB memory connection device 10 is used in the form shown in FIG. 3 or the form shown in FIG. The USB memory connection device 10 shown in FIG. 3 is inserted into a receptacle 31 of a computer 30 in a network 50 including an integrated management server (server computer) 20. In the network 50, a computer 40 having a USB receptacle 41 into which a USB plug 61 of the USB memory 60 is inserted is provided. Note that the USB plug 11 of the USB memory connection device 10 can also be inserted into the USB receptacle 41 of the computer 40. Further, the USB plug 61 of the USB memory 60 can be inserted into the USB receptacle 31 of the computer 30.

  The computers 30 and 40 cannot freely access the USB memory 60 inserted in the receptacles 31 and 41. For example, the computers 30 and 40 can access the USB memory when information indicating the USB memory in which the plugs are inserted into the receptacles 31 and 41 is registered in the security policy distributed from the integrated management server 20. . Information indicating the USB memory 60 is registered in the security policy.

  When the application program executed by the computer 30 or 40 accesses (reads, writes, or deletes) the USB memory 60 from the computer 30 or 40, the history of access date and time and type is recorded in the log file 1091, and the log file 1091 is periodically transmitted to the integrated management server 20. By recording the access history, the file (original) can be traced from the USB memory 60.

  When the computers 30 and 40 write data to the USB memory 60, the data is written after being encrypted by an application program executed by the computers 30 and 40. When the computers 30 and 40 read data from the USB memory 60, the read data is decoded by an application program executed by the computers 30 and 40.

  Information indicating the USB memory registered in the security policy (hereinafter, registered device information) is stored in the USB memory connection device 10.

  When the USB memory 60 is used in a computer outside the network 50, the USB memory connection device 10 is inserted between the USB memory 60 and the computer 70 as shown in FIG. When the information of the USB memory 60 inserted in the receptacle 12 is registered in the registration information, the USB memory connection device 10 stores the history of access (reading, writing, deleting) from the computer 70 to the USB memory 60. To record. By recording the access history, the file (original) can be traced from the USB memory 60.

  When the USB memory 60 is used by a computer outside the network 50, the data in the USB memory 60 is encrypted and cannot be used. By sandwiching the USB memory connection device 10 between the USB memory 60 and the computer 70, the data in the USB memory 60 can be decrypted by the USB memory connection device 10. In addition, when data is written in the USB memory 60, the data written by the USB memory connection device 10 can be encrypted.

  Next, the system configuration of the USB memory connection device 10 will be described with reference to FIG. FIG. 2 is a diagram illustrating a system configuration of the USB memory connection device according to the embodiment.

  The USB memory connection device 10 includes a USB controller 101, a CPU (Central Processing Unit) 102, a RAM (Random Access Memory) 103, an encryption / decryption module 104, a registered device information recording module 105, an authentication program recording module 106, and a password recording. A module 107, a control program recording module 108, a log file recording module 109, and the like are provided.

  The USB controller 101 controls communication with the USB memory (60) inserted in the USB receptacle 12 and communication with the computer (30, 40) in which the USB plug 11 is inserted. The data transferred from the computer (30, 40) to the USB memory (60) and the data transferred from the USB memory (60) to the computer (30, 40) are transferred to the CPU. The control program executed by the CPU 102 analyzes the type of transferred data and performs processing according to the analysis result.

  The encryption / decryption module 104 encrypts data that is write-accessed from the computer (30, 40). The encryption / decryption module 104 decrypts data read-accessed from the computer (30, 40).

  The registered device information recording module 105 is a recording area (flash memory) in which registered device information 1051 indicating the USB memory registered in the security policy is recorded. The registered device information 1051 describes identification information as information indicating a registered USB memory. The identification information includes a vendor ID, a device ID, and the like.

  The authentication program recording module 106 stores an authentication program 1061 executed by the computer (30, 40, 70). The authentication program recording module 106 can only be read-accessed from the computer. The authentication program 1061 is a program executed by the computer (30, 40, 70) when the USB plug 11 is inserted into the computer (30, 40, 70). The authentication program 1061 is automatically executed when, for example, the USB plug 11 is inserted into the computer (30, 40, 70). Note that the authentication program 1061 may be executed by a user operation.

  The authentication program 1061 is a program that determines whether the computer is connected to the integrated management system by attempting communication with the integrated management server 20. If the authentication program 1061 determines that the computer is not connected to the integrated management system, the input password input by the user's keyboard operation matches the registered password 1071 stored in the password recording module 107. An authentication process for determining whether to do is executed. The password recording module 107 is an invisible area in which a file stored by a filer executed by the computer (30, 40, 70) cannot be displayed, and an authentication program is received from the computer (30, 40, 70). Only 1061 can have read access.

  A control program 1081 is stored in the control program recording module 108. The control program 1081 is a program that is loaded into the RAM 103 and executed by the CPU 102. The control program 1081 controls the data transfer between the computer (70) and the USB memory (60), controls the encryption / decryption of data, analyzes the transfer data, and outputs the log data to the log file 1091 in the log file recording module 109 of the analysis result. Is a program for performing recording and USB memory (60) connection control. Note that the log file 1091 includes a connected computer log file in which information on the connected computer is recorded, and an access log file with access information indicating details of access.

  As described above, the data transferred from the computer (70) to the USB memory (60) and the data transferred from the USB memory (60) to the computer (70) are transferred to the control program 1081. The control program 1081 analyzes the type of transferred data. For example, if the type of transferred data is a control transfer protocol used for USB device control or the like, the control program instructs the USB controller 101 to transfer the transferred data to the transmission destination. If the type of transferred data is a data transfer protocol, the file system information in the USB memory (60) is acquired. If the data transfer is a write, read, delete, etc. access to the file, the connected computer information indicating the computer (70) whose access to the USB memory (60) is authenticated is recorded in the connected computer log file. The access information indicating the details of is recorded in the access log file. The connected computer information includes inventory information and login information. The access information includes access date and time, file information (file name, path in the partition), and an access type indicating any of storage, reference, and deletion.

  If the transferred data is read data, the control program 1081 decrypts the data transferred from the USB memory using the encryption / decryption module 104, and transfers the decrypted data to the computer. Process. If the transferred data is write data, the control program 1081 encrypts the data transferred from the computer using the encryption / decryption module 104 and writes the encrypted data to the USB memory. I do.

  The contents recorded in the connected computer log file will be described with reference to FIG. As shown in FIG. 5, connection IDs 211 and 221 are assigned to the connected computer log file 1091A for each connected computer. The inventory information 212 and 222 and the login information 213 and 223 are associated with the connection IDs 211 and 221.

  Next, contents recorded in the access log file will be described with reference to FIG. As shown in FIG. 6, access information 311, 312, 121, 322 is associated with each connection ID 211, 212 in the access log file 1091 B. In the access information 311, 312, 121, 322, access date / time 311 A, 312 A, 321 A, 322 A, access type 311 B, 312 B, 321 B, 322 B, and file information 311 C, 312 C, 321 C, 322 C are described.

Next, a procedure of processing by the authentication program when the USB memory connection device is connected to the computer will be described with reference to the flowchart of FIG.
When the authentication program recording module 106 is recognized by the computer (step 401), the authentication program 1061 is automatically executed by the computer (step 402). The authentication program 1061 determines whether the computer is connected to the integrated management system (step 403). When it is determined that it is connected to the integrated management system (Yes in Step 403), the authentication program 1061 acquires registered device information from the integrated management server 20, and registered device information stored in the registered device information recording module 105. 1051 is updated (step 404). Subsequently, the authentication program 1061 transmits a log file transfer request to the USB memory connection device 10 in order to acquire the log file 1091 in the log file recording module 109, and from the USB memory connection device 10 in response to the log file transfer request. The transmitted log file is received (step 405). The authentication program 1061 and the log file 1091 are transmitted to the integrated management server 20 (step 406). After the transmission, the authentication program ends (step 411).

  If it is determined that the computer is not connected to the integrated management system (No in Step 403), the authentication program 1061 displays an input prompt for the user to enter an input password on the computer display (Step 407). When the input password is input, the authentication program executes an authentication process for determining whether the input password matches the registered password recorded in the password recording module.

  If the input password matches the registered password and the authentication process is successful (step 408), the authentication program 1061 acquires connection information including inventory information and login information from the computer, and the acquired connection information is transferred to the USB. Transfer to the memory connection device 10. After transferring the connection information to the USB memory connection device 10 or when the authentication process fails (No in Step 408), the authentication program 1061 ends (Step 411).

  Next, the processing procedure of the control program when registered device information is transferred from the authentication program 1061 to the USB memory connection device 10 will be described with reference to the flowchart of FIG.

  The control program 1081 receives the registered device information transmitted from the authentication program 1061 (step 501). The control program 1081 updates the registered device information 1051 by overwriting the registered device information 1051 recorded in the registered device information recording module 105 with the received registered device information.

  Next, the processing procedure of the control program when a log file transfer request is received will be described with reference to the flowchart of FIG.

  When receiving the log file transfer request transmitted from the authentication program 1061, the control program 1081 transmits the log file 1091 in the log file recording module 109 to the authentication program 1061 (step 601). After transmission, the control program 1081 deletes the log file 1091 recorded in the log file recording module 109 (step 602). The authentication program 1061 transmits the received log file to the integrated management server 20.

  Since the log file is recorded in the integrated management server 20, the log file 1091 in the log file recording module 109 may be deleted. By transmitting the log file to the integrated management server 20 every time the system is connected to the integrated management system and deleting the log file 1091 in the log file recording module 109, the capacity of the log file recording module 109 can be reduced.

  Next, the processing procedure of the control program 1081 when a USB memory is connected to the apparatus 10 will be described with reference to the flowchart of FIG.

  When the USB memory is connected, the control program 1081 requests the USB memory to transmit a device descriptor. The control program 1081 receives the device descriptor transmitted from the USB memory (step 701). The control program 1081 determines whether the vendor ID and device ID in the device descriptor are registered in the registered device information 1051 in the registered device information recording module 105 (step 702). If it is determined that the device is registered in the registered device information 1051, the control program 1081 notifies the computer of the connection of the USB memory (step 703).

Data transfer processing between the computer and the USB memory will be described with reference to the flowchart of FIG.
When there is a transmission from the computer to the USB memory, the control program 1081 determines whether the data is a data transfer protocol (step 801). If it is determined that it is not a data transfer protocol (No in step 801), the data is transferred to the USB memory (step 802). If the data transfer protocol is determined (Yes in step 801), the control program 1081 analyzes the command included in the data transmitted from the computer. The control program 1081 acquires file system information in the USB memory. Then, the control program 1081 records information indicating the access type (write, read, delete), connection information, access date / time, and access file information (file name, path in the partition) in the file access log information (step 804). ).

  Then, the control program determines whether the file access of the computer is deletion (step 805). If it is determined to be deleted, the data transmitted from the computer is transmitted to the USB memory (step 806). The USB memory deletes the file according to the delete command included in the data.

  If it is determined not to be deleted (No in Step 805), the control program 1081 determines whether it is a read access (Step 807). If it is determined that the access is a read access (Yes in Step 807), the read-accessed data file is acquired from the USB memory, and the data file is decrypted by the encryption / decryption module 104 (Step 808). Then, the data file decrypted as the data file read-accessed from the computer is transferred to the computer (step 809).

  When it is determined that the access is not a read access (No in Step 807), the control program 1081 determines whether the access is a write access (Step 810). If it is determined that the access is a write access (Yes in Step 810), the control program 1081 encrypts the data file written in the USB memory by the encryption / decryption module 104 (Step 811). Then, the data file in the data sent from the computer is replaced with the encrypted data file and transferred to the USB memory (step 812).

  By recording the access log, the same information leakage suppression effect as that in the integrated system can be obtained in a computer outside the integrated system. By recording the access log, if information leakage occurs, the administrator can specify the route of information leakage by referring to the log file. It is also possible to take information leakage countermeasures for general-purpose external recording devices such as USB memories.

  In the above-described embodiment, the USB memory is used as an example of the external storage device. However, a memory card such as an SD memory card may be used as the external storage device. FIG. 12 shows a system configuration of a memory card connection device when an SD memory card is used as an external storage device.

  As shown in FIG. 12, the memory card connection device 1000 includes a USB controller 101, a CPU (Central Processing Unit) 102, an SD card slot 1001, an SD card controller 1002, a RAM (Random Access Memory) 103, an encryption / decryption module. 104, a registered device information recording module 105, an authentication program recording module 106, a password recording module 107, a control program recording module 108, a log file recording module 109, and the like. In addition, the same code | symbol is attached | subjected to the site | part same as FIG.

  An SD memory card is inserted into the SD card slot 1001. The SD card controller 1002 controls communication with the SD memory card inserted into the SD card slot 1001.

  Note that, as shown in FIG. 13, a configuration in which the USB memory connection device 10 and the USB memory 60 are combined is also possible.

  As shown in FIG. 13, the USB memory 900 includes a USB controller 101, a CPU (Central Processing Unit) 102, a RAM (Random Access Memory) 103, an encryption / decryption module 104, a registered device information recording module 105, an authentication program recording. A module 106, a password recording module 107, a control program recording module 108, a log file recording module 109, a data recording unit 901, and the like are provided. In addition, the same code | symbol is attached | subjected to the site | part same as FIG. Data is recorded in the data recording unit 901 instead of the USB memory 60.

  Although several embodiments of the present invention have been described, these embodiments are presented by way of example and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the scope of the invention. These embodiments and modifications thereof are included in the scope and gist of the invention, and are included in the invention described in the claims and the equivalents thereof.

  DESCRIPTION OF SYMBOLS 10 ... USB memory connection apparatus, 11 ... USB plug, 12 ... USB receptacle, 20 ... Integrated management server, 30, 40, 70 ... Computer, 31, 41 ... USB receptacle, 60 ... USB memory (external storage device), 61 ... USB plug, 101 ... USB controller, 102 ... CPU, 103 ... RAM, 104 ... encryption / decryption module, 105 ... registered device information recording module, 106 ... authentication program recording module, 107 ... password recording module, 108 ... control program Recording module 109... Log file recording module 1051 Registered device information 1061 Authentication program 1071 Registration password 1081 Control program 1091 Log file 1091 A Connected computer log file 109 B ... access log file.

Claims (6)

A plug inserted into a receptacle provided in the host;
An insertion section into which an external storage device is inserted;
A log file storage for storing log files;
A registration information storage unit for storing registration information in which information indicating an external storage device is recorded;
Permission means for permitting access from the host to the external storage device when information indicating the external storage device is recorded in the registration information;
When the access from the host to the external storage device is permitted by the permission means and the host accesses a file in the external storage device, an access type indicating the type of access and the accessed file And an external storage device connection device comprising: a recording unit that records host information indicating the host in the log file. A registration password storage unit for storing the registration password;
After the access to the external storage device is permitted by the permission means, a process for determining whether the password input to the host and the registered password match, and when it is determined that the password matches, the host The external storage device connection device according to claim 1, further comprising: a program storage unit that stores a program for allowing the host to execute processing for permitting access to the storage device.   2. The external storage device according to claim 1, further comprising: a program storage unit that stores a program for the host to execute processing for transmitting the log file to the server computer when communication with the server computer is possible. Connected device.   The apparatus according to claim 1, further comprising an updating unit that acquires new registration information from the server computer and updates the registration information in the registration information storage unit with the new registration information when communication with the server computer is possible. The external storage device connection device described.   The external storage device connection device according to claim 1, wherein the external storage device includes a USB memory. External storage having a plug inserted into a receptacle provided in a host, an insertion unit into which an external storage device is inserted, and a registration information storage unit in which registration information in which information of the external storage device is recorded is stored A device connection device access control method comprising:
When the information indicating the external storage device inserted into the physical interface is recorded in the registration information stored in the registration information storage unit, the host is allowed to access the external storage device,
When access from the host to the external storage device is permitted by the permission unit and a file in the external storage device is accessed from the host, the access type indicating the type of access and the accessed file are indicated. An access control method for recording file information and host information indicating the host in a log file.

Images