JP2012118877A - Information processing apparatus, information processing method and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a device which is capable of preventing information leakage without reducing convenience.SOLUTION: An information processing apparatus is provided which can be connected with a network. The information processing apparatus includes detection means which detects a connection style of the network, and access restriction means which specifies an access restriction corresponding to the network connection style detected by the detection means from a storage device storing access restriction information to which the connection style of the network and a restriction of access to a file are made correspondent, and restricts the access to the file in accordance with the specified access restriction.

Description

  The present invention relates to an information processing apparatus, an information processing method, and a program.

In recent years, information leakage from information processing devices that store confidential information has increased, and measures to prevent this include taking information processing devices outside and prohibiting connection to external networks. . However, depending on the business form, it is often necessary to take out the information processing apparatus to the outside or to connect to a network, and uniform measures cause inconveniences such as a reduction in business efficiency.
Therefore, as a method for reducing the risk of information leakage while allowing the information processing apparatus to be taken outside, Patent Document 1 discloses a method for restricting information operations depending on the use area of the information processing apparatus.
Further, in Patent Document 2, when a file access request is made from the client terminal to the management server, the management server transmits the usage level of the file to the client terminal, so that the confidentiality of the file in the client terminal is increased. A method of keeping is disclosed.

JP 2003-288275 A JP 2009-265854 A

However, it is difficult to deal with information leakage via the network by a method of performing operation control depending on the location of the information processing apparatus as in the system described in Patent Document 1.
Further, in the system described in Patent Document 2, it is necessary to communicate with the management server every time a confidential file is accessed. If the management server is unavailable, the confidential file cannot be used.

  The present invention has been made in view of such problems, and an object thereof is to provide a mechanism capable of preventing information leakage without reducing convenience.

  Therefore, the present invention is an information processing apparatus that can be connected to a network, and includes access restriction information in which detection means for detecting a network connection form, and network connection form and file access restriction are associated with each other. Access restriction means for specifying an access restriction corresponding to the network connection form detected by the detection means from the storage device in which the detection means is stored, and restricting access to the file according to the specified access restriction. And

  According to the present invention, it is possible to provide a mechanism capable of preventing information leakage without reducing convenience.

It is a figure which shows an example of the system configuration | structure of a file access restriction system. It is a figure which shows an example of the hardware constitutions of an information processing terminal. It is a figure which shows an example of the function of the file server shown in FIG. 1, and an information processing terminal. It is a flowchart which shows an example of the file access restriction process performed with an information processing terminal. It is a figure which shows an example of access restriction information. It is a flowchart which shows an example of the process at the time of completion | finish of file writing. It is a figure which shows an example of an access restriction object file. It is a flowchart which shows an example of a process in case an information processing terminal acquires a file from a file server. It is a flowchart which shows an example of the synchronous process of access restriction information. It is a flowchart which shows an example of the synchronization process of network definition information. It is a figure which shows an example of network definition information. It is a flowchart which shows an example of the synchronous process of access restriction information. It is a figure which shows an example of access restriction information. It is a figure which shows an example of an access restriction rule. It is a flowchart which shows an example of the process in a file server when a file is transmitted (upload) from an information processing terminal to a file server. It is a flowchart which shows an example of the process at the time of the administrator of a file server changing an access restriction rule. It is a flowchart which shows an example of the inspection process of the file which is not an access restriction object stored in the information processing terminal.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

<Embodiment 1>
FIG. 1 is a diagram illustrating an example of a system configuration of a file access restriction system.
Note that the configuration of various terminals connected to the network 103 in FIG. 1 is an example, and there are various configuration examples depending on applications and purposes.
Reference numeral 101 denotes an LDAP (Lightweight Directory Access Protocol) server. The LDAP server 101 provides a directory service for managing directory information of organizations and individuals using a corporate network. Note that the directory service applicable to this embodiment is not limited to LDAP, and may be other services such as Active Directory.
Reference numeral 102 denotes a file server. The file server 102 has a function of storing confidential files and non-confidential files used in business, and a user authentication function using the LDAP server 101.
An information processing terminal 104 is an example of an information processing apparatus. The information processing terminal 104 performs transmission / reception of files with the file server 102, detection of a network connection form, and access restriction of a restriction target file by a dedicated program.
Reference numeral 105 denotes a network connection outside the organization, which corresponds to any network such as a corporate network at another base, a personal network of the owner of the information processing terminal, and a public network.

FIG. 2 is a diagram illustrating an example of a hardware configuration of the information processing terminal 104.
A CPU 201 performs control of the entire information processing terminal 104 and execution of each process of the information processing terminal described later using programs and data stored in the RAM 202 and the ROM 203.
A RAM 202 is an area for temporarily storing programs and data loaded from the HDD 204 and the storage medium drive 206, and data received via the network I / F, and when the CPU executes various processes. A work area is provided.
A ROM 203 stores setting data, a boot program, and the like of the information processing terminal 104.
An HDD 204 stores an operating system and programs and data for causing the CPU 201 to execute each process described below performed by the information processing terminal 104. Some or all of the programs and data are loaded into the RAM 202 in accordance with instructions from the CPU 201, and the information processing terminal 104 executes processing to be described later when the CPU 201 performs processing using this.
That is, the CPU 201 of the information processing terminal 104 executes processing based on the program, thereby realizing the functions and flowcharts of the information processing terminal 104 described later. Similarly, when the CPU of the file server executes a process based on a program stored in the HDD or the like of the file server, a process related to the file server function and flowcharts described later is realized.
Reference numeral 205 denotes a network I / F for connecting the information processing terminal 104 to an in-house LAN and other networks, and the information processing terminal 104 communicates with an external device via the network I / F 205.

Reference numeral 206 denotes an external storage drive that reads programs and data recorded on a storage medium such as a CD-ROM, CD-R / RW, DVD-ROM, DVD-R / RW, DVD-RAM, and outputs them to the RAM 202. It is. This reading operation is controlled by the CPU 201.
A keyboard 207 inputs various instructions to the CPU 201.
A pointing device 208 such as a mouse inputs various instructions to the CPU 201.
Reference numeral 209 denotes a video I / F that functions as an I / F for supplying an image to be displayed on the display device 210 to the display device 210 as a signal.
Reference numeral 210 denotes a display device, which is composed of a CRT, a liquid crystal, or the like, and displays a processing result by the CPU 201 with a screen or characters.
Reference numeral 211 denotes a peripheral device I / F, which includes a USB port, an IEEE 1394 port, and the like, and can be connected to the peripheral device via the peripheral device I / F 211. The connection form with the peripheral device may be wired or wireless.
A bus 212 connects the above-described units.

FIG. 3 is a diagram illustrating an example of functions of the file server 102 and the information processing terminal 104 illustrated in FIG.
Reference numeral 301 denotes an access restriction management service that operates on a file server, and provides functions of a network definition information management unit 302, an access restriction rule management unit 303, and a communication control unit 304.
A network definition information management unit 302 provides a function for managing addition / change / deletion of a network connection mode assumed by the administrator.
Reference numeral 303 denotes an access restriction rule management unit which provides a function for an administrator to define files and directories that are subject to access restriction, operations to be restricted, and users to be restricted.
A communication control unit 304 controls the exchange of various information with the information processing terminal 104.
Reference numeral 312 denotes an access restriction agent that runs on the information processing terminal 104, and provides functions of the communication control unit 313, the post-processing unit 314, and the access restriction unit 315.
A communication control unit 313 controls exchange of various information with the file server 102.
A post-processing unit 314 controls processing after file writing processing.
Reference numeral 315 denotes an access restriction unit that provides a function of restricting file access based on restriction information stored in the access restriction database 317.

Next, a file access restriction process performed by the information processing terminal 104 will be described with reference to FIG.
First, the access restriction unit 315 detects an access request to a file from a user (step S401).
Next, the access restriction unit 315 determines whether an access right to the file is given on the OS to the user who has requested access in step S401 (step S402). If the access right is not given (No in step S402), the access restriction unit 315 rejects the access (step S408).
If the access right is given (Yes in Step S402), the access restriction unit 315 next determines whether or not the file access restriction information is in the access restriction information 319 (FIG. 5) (Step S403).
If there is no access restriction information (No in step S403), the access restriction unit 315 determines that the file is not a target for access restriction, and permits access by the user (step S409).
When there is access restriction information (Yes in step S403), the access restriction unit 315 obtains access restriction information (access restriction information acquisition) in step S404.
Next, the access restriction unit 315 detects the current network connection form (for example, whether it is an in-house LAN or a public LAN) (step S405). As a method for detecting the network connection form, for example, the access restriction unit 315 uses a network configuration tool attached to the OS (ipconfig for Windows (registered trademark), ifconfig for LINUX (registered trademark)) or the like. To detect.

The access restriction unit 315 determines whether or not the network connection form detected in step S405 is defined in the access restriction information (FIG. 5) (step S406).
If the access restriction unit 315 is not defined (No in step S406), the access restriction unit 315 determines that the risk of information leakage is very high due to an unknown network that is not assumed by the administrator of the file server 102, and denies access (step). S408). Note that when an unknown network is detected in step S406, access restrictions on the unknown network may be defined to determine whether access is possible.
If the access restriction unit 315 is defined in the access restriction information (FIG. 5) (Yes in step S406), the access restriction unit 315 determines whether an access right is given for an operation performed on the file to be accessed (step S407). . The operation here means reading or writing.
If the access right is not given to the operation (No in step S407), the access restriction unit 315 rejects the access (step S408). For example, in the example of FIG. 5, access to the file with the hash value “a38497d0c00937ef8b8945a34ce52edd” is set to be prohibited while being connected to the public LAN, and therefore access is denied.
When the access right is given to the operation (Yes in step S407), the access restriction unit 315 gives access permission to the operation (step S409), and ends this flowchart.

Next, processing at the end of file writing will be described with reference to FIG.
First, the post-processing unit 314 determines whether the target file is included in the access restriction target file (FIG. 7) (step S501).
When the post-processing unit 314 is not included in the access restriction target file table (No in step S501), the flowchart ends.
If the post-processing unit 314 is included in the access restriction target file table (Yes in step S501), the post-processing unit 314 determines the type of write operation (step S502).
If the write operation is a move or rename (move / rename in step S502), the post-processing unit 314 changes the corresponding file name in the access restriction target file table to the file name after the change (step S503), and performs the process. finish. That is, in the case of simply renaming, it is possible to hold the restriction information without changing the information related to the access restriction on the file by only updating the file name.
When the writing operation is writing, that is, file overwriting (writing (overwriting) in step S502), the post-processing unit 314 calculates a hash value of the file after writing (step S504).

Next, the post-processing unit 314 acquires a hash value from the entry of the access restriction target file table corresponding to the file before writing. Then, the post-processing unit 314 adds new access restriction information to the access restriction information table using the ID of the entry of the access restriction information table corresponding to the hash value as a derivation source ID (step S505). That is, when the file is overwritten (updated), the post-processing unit 314 keeps the information about the original file (the file before update) and newly sets the restriction information for the new file (file after update). Generated and added in association with the pre-update file.
The post-processing unit 314 updates the hash value of the access restriction target file table of the target file (updated file) with the hash value calculated in step S504 (step S506), and ends the process.
If the write operation is a copy (copy in step S502), the post-processing unit 314 adds the copy destination file information to the access restriction target file table (step S507), and ends the process.

Next, processing when the information processing terminal 104 acquires a file from the file server 102 will be described with reference to FIG.
First, the information processing terminal 104, which is a client, certifies the file server 102 with qualification information (user identification information required for login to the server such as a user name and password, and a user who is a legitimate user). Information) is transmitted (step S601).
The file server 102 collates the qualification information transmitted from the information processing terminal 104 using the LDAP server 101 (step S609), and transmits whether or not login is possible to the information processing terminal 104 (not shown). If it is determined in step S609 that the transmitted qualification information is invalid (No in step S610), the file server 102 ends the process.
The information processing terminal 104 receives the login permission / inhibition from the file server, and terminates the process if the login has failed (No in step S602).
If the login is successful (Yes in step S602), the information processing terminal 104 executes the access restriction information synchronization processing of the information processing terminal 104 (step S603).
As shown in FIG. 9, the access restriction information synchronization process (step S603) is performed in the order of network definition information synchronization (step S701) and access restriction information synchronization (step S702).

The synchronization of network definition information will be described with reference to FIG.
First, the information processing terminal 104 acquires all entries from the network definition information 318 (FIG. 11), and proceeds with processing for each entry (step S801).
In step S802, the information processing terminal 104 determines whether the connection form name of the entry exists in the server-side network definition information 306 (FIG. 11).
When the information processing terminal 104 exists on the server side (Yes in step S802), the entry is updated with the contents on the server side (step S803).
If the information processing terminal 104 does not exist on the server side (No in step S802), the information processing terminal 104 determines that the entry has been deleted on the server side, and deletes the entry on the information processing terminal side (step S804).
The above process is performed for all the acquired entries, and when the process is completed for all the entries, the process proceeds to step S805.
In step S805, the entry newly added to the network definition information on the server side is added to the network definition information on the information processing terminal side.
Through the processing in steps S803, 804, and 805 described above, the network definition information on the information processing terminal side matches the network definition information on the server side.

When the network definition information synchronization process ends, the process proceeds to the access restriction information synchronization process shown in the flowchart of FIG.
In step S901, the information processing terminal 104 acquires all entries from the access restriction information 319 (FIG. 5), and proceeds with processing for each entry.
In step S902, the information processing terminal 104 determines whether access restriction information having the same hash value as the entry exists on the server side.
If there is access restriction information having the same hash value as the entry acquired in step S901 on the server side (Yes in step S902), the information processing terminal 104 advances the process to step S903. If there is no access restriction information having the same hash value as the entry acquired in step S901 on the server side (No in step S902), the information processing terminal 104 advances the process to step S908.
In step S903, the information processing terminal 104 acquires an entry of server side access restriction information, and proceeds to step S904.
In step S904, the information processing terminal 104 determines whether or not a derivation source ID is set in the access restriction information entry on the information processing terminal side.
In the information processing terminal 104, when the derivation source ID is set (Yes in step S904), that is, the currently processed entry is an entry for the updated file, and information about the file is also sent to the server side. If it exists, the derivation source ID is deleted (step S905) because it is not necessary to follow the derivation source (the processing of step S908 to step S912 need not be executed).
In step S906, the information processing terminal 104 determines whether there is a difference between the entry on the server side acquired in step S903 and the entry on the information processing terminal side currently processing.
If the information processing terminal 104 determines that there has been a change (Yes in step S906), it updates the entry on the information processing terminal side to match the information on the server side (step S907).

If there is no access restriction information having the same hash value as the entry acquired in step S901 on the server side, the information processing terminal 104 determines whether or not a derivation source ID is set for the entry on the information processing terminal side in step S908. Judging.
When the derivation source ID is not set (No in step S908), that is, when there is no file-related entry from the server even though the file is not updated, the information processing terminal 104 stores the access restriction information of the entry. It is determined that it has been deleted from the server side, and it is also deleted from the information processing terminal side (step S912).
When the derivation source ID is set (Yes in step S908), that is, when there is no information about the updated file on the server side, the information processing terminal 104 is an information processing terminal corresponding to the derivation source ID in the temporary variable. The access restriction information entry on the side is stored (step S909).
In step S910, the information processing terminal 104 determines whether access restriction information having the hash value of the entry stored in the temporary variable in step S909 exists on the server side. That is, it is determined whether or not the server has information about the file before update.
If the corresponding access restriction information does not exist on the server side (No in step S910), the information processing terminal 104 returns to step S908 and determines whether the derivation source ID is set. That is, the derivation source of the file before the update is further traced and examined.
When the corresponding access restriction information exists on the server side (Yes in step S910), the information processing terminal 104 acquires the entry (information about the file before update) from the server, and advances the process to step S906 (step S911). ). That is, the information processing terminal 104 applies the access restriction information before update.
The information processing terminal 104 performs the above processing on all entries of the access restriction information acquired in step S901.
Note that the processing for acquiring various types of information from the server in the flowcharts shown in FIGS. 10 and 12 is shown in step S611 in FIG.

Returning to the flowchart of FIG.
In step S <b> 604, the information processing terminal 104 transmits a file acquisition request to the file server 102.
The file server 102 receives the file acquisition request from the information processing terminal 104 (step S612), determines whether the file can be acquired (step S613), and transmits the result to the information processing terminal 104 (not shown). In step S613, whether or not the file can be acquired is determined according to an access restriction rule set for the file by the file creator, the server, the department administrator, or the like. For example, if the access restriction rule “prohibit file acquisition by general user” is set for the file, if the login user is a general user, the file acquisition fails (step S613: NO). Become.
If the file cannot be acquired (No in step S613), the file server 102 ends the process.
If the file can be obtained (Yes in step S613), the file server 102 transmits the requested file and access restriction access restriction information corresponding to the file to the information processing terminal 104 (step S604). finish.
The information processing terminal 104 receives the result of file availability (not shown) and determines whether it is possible (step S605).
If the file cannot be acquired (No in step S605), the information processing terminal 104 ends the process.
If the file can be acquired (Yes in step S605), the information processing terminal 104 receives the file and the restriction information from the file server 102 (step S606).

Next, the information processing terminal 104 stores the received file in the HDD 204 (step S607), updates the received restriction information (step S608), and ends the process.
The update process in step S608 is a process for updating the restriction information about the file acquired in step S606. The update process in step S603 is an update process of restriction information for all access restriction access restriction target files possessed by the client.
The information processing terminal 104 acquires only the access restriction access restriction information for the user of the qualification information transmitted to the file server when obtaining the access restriction access restriction information in FIGS.
For example, if the logged-in user is a general person and the file to be acquired is “D: ¥ Accounting ¥ Cost.xls” in FIG. 13, the corresponding access restriction IDs are 1, 2, 3, and 4, but FIG. Since the IDs of the rules corresponding to general users are 2, 3, and 4 in the access restriction rule, the access restriction access restriction information transmitted by the file server is an entry having IDs of 2, 3, and 4.

Next, processing in the file server 102 when a file is transmitted (uploaded) from the information processing terminal 104 to the file server 102 will be described with reference to FIG.
First, the communication control unit 304 receives a file from the information processing terminal 104 (step S1001).
In step S1002, the communication control unit 304 calculates a hash value of the received file.
Next, the communication control unit 304 determines whether or not access restriction access restriction information corresponding to the received file exists in the server (step S1003).
If there is access restriction access restriction information (Yes in step S1003), the communication control unit 304 advances the process to step S1004.
If there is no access restriction access restriction information (No in step S1004), the communication control unit 304 advances the process to step S1005.
In step S1004, the communication control unit 304 updates the hash value of the existing access restriction access restriction information with the hash value calculated in step S1002, and advances the process to step S1007.
In step S1005, the communication control unit 304 determines whether the file to be saved corresponds to the access restriction rule.
The communication control unit 304 newly creates and adds access restriction access restriction information (step S1006) when the access restriction rule is met (Yes in step S1005). Then, the communication control unit 304 advances the process to step S1007.
When the communication control unit 304 does not correspond to the access restriction rule (No in step S1005), the communication control unit 304 advances the process to step S1007.
In step S1007, the communication control unit 304 stores the received file in the HDD of the file server 102, and ends the process of this flowchart.
By this processing, it is possible to perform appropriate access restriction access restriction on the file uploaded to the file server 102.

Next, processing when the administrator of the file server 102 changes the access restriction rule 307 will be described with reference to FIG.
First, the access restriction rule management unit 303 accepts an access restriction rule change process from the administrator (step S1101).
The access restriction rule management unit 303 updates the access restriction rule after the administrator's change work is completed (step S1102).
Next, the access restriction rule management unit 303 acquires the added / changed access restriction rule (step S1103).
The access restriction rule management unit 303 repeats the processing from step S1105 to step S1110 for the acquired access restriction rule (step S1104).
The processing from step S1106 to step S1110 is repeated for the target file of the access restriction rule and the files under the target directory (step S1105).
In step S1106, the access restriction rule management unit 303 determines whether the access restriction access restriction information for the file exists in the access restriction access restriction information table.

If the access restriction rule management unit 303 exists (Yes in step S1106, that is, if the rule is to be updated), the process proceeds to step S1107. If the access restriction rule management unit 303 does not exist (No in step S1106, if a rule to be newly applied is created for a file for which no rule has been applied so far), the process proceeds to step S1109.
In step S1107, the access restriction rule management unit 303 determines whether the rule ID exists in the access restriction access restriction information.
If there is no access restriction rule management unit 303 (No in step S1107), the rule ID is added to the access restriction access restriction information (step S1108).
In step S1109, the access restriction rule management unit 303 calculates a hash value of the file.
In step S1110, the access restriction rule management unit 303 newly creates access restriction access restriction information using the hash value calculated in step S1109.
The access restriction rule management unit 303 executes the above processing for all the files acquired in step S1105 and the rules acquired in step S1104.
Through the above processing, even when an access restriction rule is changed or added, it is possible to apply the new changed / added rule to the file.

Next, the inspection process of the non-restricted access file stored in the information processing terminal 104 will be described with reference to FIG.
First, the non-restricted file inspection unit 316 acquires a file that is not an access-restricted access restriction target, and performs the processing from step S1202 to step S1208 for each file.
In step S1202, the non-restricted file inspection unit 316 calculates a hash value of the file.
Next, the non-restricted file inspection unit 316 determines whether the access restriction access restriction information having the hash value calculated in step S1202 exists in the access restriction access restriction information of the information processing terminal 104 (step S1203).
If the file inspection unit 316 is not present (Yes in step S1203), the process advances to step S1208.
If the non-restricted file checking unit 316 does not exist (No in step S1203), the process proceeds to step S1204.
In step S1204, the non-restricted file inspection unit 316 inquires of the file server 102 whether there is access restriction access restriction information having the hash value calculated in step S1202.

In step S1205, the non-restricted file inspection unit 316 determines whether access restricted access restriction information exists in the server.
If the non-restricted file checking unit 316 does not exist (No in step S1205), the file checking unit 316 determines that the file is not subject to access restriction and starts processing for the next file. If it exists (Yes in step S1205), the corresponding access restriction access restriction information is acquired from the server (step S1206).
Next, the non-restricted file inspection unit 316 reflects the acquired access restriction information in the access restriction information 319 of the information processing terminal 104 (step S1207).
In step S1208, the non-restricted file inspection unit 316 adds file information to the access restricted access restricted file (access restricted).
The non-restricted file inspection unit 316 performs the above processing on all files that are not access targets.
In this process, the file to be restricted is not subject to the access restriction, such as obtaining the restriction target file 309 of the file server 102 without using the access restriction agent 312. Therefore, an inappropriate access right is given. This is done to prevent it from happening.
In this embodiment, all files in the information processing terminal are inspected. However, only files under a specific directory (such as a user's home directory) may be inspected.
With this configuration, it is possible to give an appropriate access right to a file only with a reliable network connection designated by the administrator, without limiting the use location of the information processing terminal.
In addition, since access to the access restriction management service is not required when determining access rights, appropriate access restrictions should be applied even if the service is unavailable due to a failure or the network is unreachable. Can do.

<Other embodiments>
The present invention can also be realized by executing the following processing. That is, software (program) that realizes the functions of the above-described embodiments is supplied to a system or apparatus via a network or various storage media, and a computer (or CPU, MPU, etc.) of the system or apparatus reads the program. It is a process to be executed.

  As mentioned above, according to each embodiment mentioned above, the mechanism which can prevent information leakage, without reducing convenience can be provided.

  The preferred embodiments of the present invention have been described in detail above, but the present invention is not limited to such specific embodiments, and various modifications can be made within the scope of the gist of the present invention described in the claims.・ Change is possible.

102 File server 104 Information processing terminal

Therefore, the present invention is an information processing apparatus that can be connected to a network , and is an access restriction in which a connection form to the network is associated with information indicating a restriction on access to a file stored in the information processing apparatus Storage in the information processing apparatus based on storage means for storing information , detection means for detecting a connection form to the network , access restriction information stored in the storage means and connection form detected by the detection means And an access control means for controlling access to the read file.

Claims (6)

An information processing apparatus that can be connected to a network,
Detecting means for detecting a network connection form;
The access restriction corresponding to the network connection form detected by the detecting means is specified from the storage device storing the access restriction information in which the network connection form and the file access restriction are associated with each other, and the specified access restriction is specified. Access restriction means to restrict access to the file,
An information processing apparatus comprising: Access restriction information obtaining means for obtaining access restriction information from the file server storing the access restriction information;
Access restriction information corresponding to the access restriction information obtained by the access restriction information obtaining means out of the access restriction information obtained by the access restriction information obtaining means and the access restriction information stored in the storage device, Synchronization means for synchronizing
The information processing apparatus according to claim 1, further comprising:   The information processing apparatus according to claim 1, further comprising an applying unit that applies the access restriction information of the file before the update to the file after the update when the file is updated.   The access restriction target setting means for making the file the access restriction target when the access restriction information corresponding to the file that is not the access restriction target exists, further comprising: The information processing apparatus described in 1. An information processing method executed by an information processing apparatus capable of connecting to a network,
A detection step of detecting a network connection type;
The access restriction corresponding to the network connection form detected in the detection step is identified from the storage device storing the access restriction information in which the network connection form is associated with the file access restriction, and the identified access restriction is specified. According to the access restriction step to restrict access to the file,
An information processing method comprising: On the computer,
A detection step of detecting a network connection type;
The access restriction corresponding to the network connection form detected in the detection step is identified from the storage device storing the access restriction information in which the network connection form is associated with the file access restriction, and the identified access restriction is specified. According to the access restriction step to restrict access to the file,
A program that executes

Images