JP2012203699A - Portable storage medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To conceal information stored in information storage areas assigned to each user from a user who does not have an access right, in a portable storage medium used by a plurality of users.SOLUTION: Each function of a user authentication part 112 and an access control part 113 is realized by a CPU of a host computer 12 executing a user authentication program and an access control program stored in an information storage part 114. The user authentication part 112 authenticates whether or not a user who is using the host computer 12 has use authority. The access control part 113 makes the host computer 12 recognize only an information storage area assigned to each user in the information storage part 114 as a file system, on the basis of information storage area designation information stored in the information storage part 114 and performs writing/reading information as encrypting/decrypting it using an encryption/decryption key stored in the information storage part 114.

Description

  The present invention relates to a portable storage medium shared by a plurality of users.

  In recent years, with the development of an information society, it has become possible for governments and the private sector to easily handle enormous amounts of personal information and business information. Along with this, incidents and accidents related to information leakage occur frequently, and the need for information security measures related to information leakage prevention, such as the establishment of the Personal Information Protection Law and the spread of information security management systems, is increasing.

  One of the main causes of information leakage is loss or theft of a portable storage medium such as a USB (Universal Serial Bus) memory or an SD card. A portable storage medium such as a USB memory is convenient and easy to carry, but has a very high risk of loss or theft. As a countermeasure, encryption of information stored in a portable storage medium is common, but in the case of an administrative or private organization, the use of a personally owned portable storage medium should be used in case of loss. A portable storage medium that is prohibited and managed by an organization is often shared by a plurality of users. In such operations, the same password is shared by multiple users, which not only has the risk of password leakage, but also allows information stored in portable storage media to be referenced between each other's users. This may lead to information leakage.

In solving this problem, it is conceivable to use the methods disclosed in Patent Document 1 and Patent Document 2.
Patent Document 1 discloses a method of dividing a storage area in an IC (Integrated Circuit) card. By using this method, information stored in the IC card is stored in an area determined for each user, so that a plurality of users cannot refer to each other's information. However, since the IC card is expensive and has a small storage capacity, it is not suitable for handling a large amount of information.
Patent Document 2 discloses a method for providing a user authentication means such as an IC card by storing a PIN code and a user authentication application in a ROM area of a USB memory that can only read data. By this method, advanced access control equivalent to that of an IC card can be realized in a widely used USB memory. However, since it is not possible to assign a recording area to each user by holding a PIN code etc. for each user, when a USB memory is shared by multiple users, operations such as sharing a password can be performed. Necessary.

JP 2004-334542 A JP 2004-362516 A

  A portable storage medium such as a USB memory that has been widely spread generally does not have an access control program inside the medium. For this reason, when processing such as authentication of a user who uses a portable storage medium and access control from the host computer to the portable storage medium, a general-purpose OS (operating system) on the connected host computer is used. The method of performing is common.

  However, when this method is adopted, control is performed by a general-purpose OS, which may lead to information security vulnerability.

  In addition, since a PIN code and password for authenticating a user are associated with the medium, when a portable storage medium is shared by a plurality of users, all users share a single PIN code and password. There is an information security problem.

  An object of the present invention is to realize user authentication in a portable storage medium such as a USB memory shared by a plurality of users without being controlled by a general-purpose OS such as a host computer. The information storage area is logically divided, the divided information storage areas are assigned to each user as accessible areas for each user, and the information stored in the individual information storage areas is divided. To provide a portable storage medium that can be concealed from a user without access rights.

In order to achieve the above object, the portable storage medium of the present invention provides:
A portable storage medium removable from a host device having a CPU and memory,
An information storage area divided into a plurality of areas;
Authentication information for authenticating the usage authority for each of a plurality of users, one or more information storage area designation information for designating the divided information storage areas accessible to the respective users, and the information storage A user authentication information storage area in which a first encryption / decryption key corresponding to the area designation information is stored;
Activated when the portable storage medium is connected to the host device, read into the memory of the host device and executed by the CPU of the host device, and uses the host device using the host device A user authentication program that functions as a user authentication unit that verifies authentication information input by a user and authentication information stored in the user authentication information storage area and authenticates the user's usage authority A user authentication program storage area in which is stored,
Activated in response to being authenticated by the user authentication means that the user has authority to use, read into the memory of the host device and executed by the CPU of the host device. Based on the information storage area designation information stored in the storage area, the divided information storage areas accessible by the user are identified, and the identified information storage areas are recognized as file systems by the host device. And writing into each of the divided information storage areas while encrypting information from the host device using the first encryption / decryption key stored in the user authentication information storage area. Access control storing an access control program that functions as an access control means for decoding while reading information from the storage area And program storage area,
An information storage unit.

Preferably,
The encryption / decryption key stored in the user authentication information storage area is the encryption / decryption key for accessing each of the divided information storage areas, the authentication information input by the user, and the information storage. Encrypted using the second encryption / decryption key created using the information storage area designation information stored in the user authentication information storage area of
The access control means creates the second encryption / decryption key using the authentication information input by the user and the information storage area designation information stored in the user authentication information storage area, Decrypting the first encryption / decryption key stored in the user authentication information storage area using the second encryption / decryption key, and using the decrypted first encryption / decryption key, Information is written into each divided information storage area while encrypting information from the host device, and decrypted while reading information from each divided information storage area.

  According to the present invention, in a portable storage medium such as a USB memory shared by a plurality of users, user authentication is realized without being controlled by a general-purpose OS such as a host computer. The information storage area is logically divided, the divided information storage areas are assigned to each user as accessible areas for each user, and the information stored in the individual information storage areas is divided. It can be concealed from users without access rights.

It is a figure which shows an example of a structure of the portable storage medium which concerns on embodiment of this invention. It is a figure which shows an example of the data structure of the information storage part of a portable storage medium. It is a figure which shows an example of the data structure of a user authentication information storage area. It is the figure which showed an example of a response | compatibility of the access key (encryption) stored in the user authentication information storage area, and the access key (plaintext) used in order to access the information storage area | region actually divided | segmented. It is the flowchart which showed an example of the procedure until the information storage area of a portable storage medium is allocated to a user. It is the flowchart which showed an example of the procedure until it acquires the access key (plaintext) required for utilization of an information storage area. It is a figure which shows an example of a structure of an access control part. It is a figure which shows the connection state of the virtual apparatus in the portable storage medium seen from the host computer. It is a figure which shows the example in which a host computer recognizes the information storage area for every user.

  A portable storage medium according to an embodiment of the present invention will be described below with reference to the drawings.

FIG. 1 is a diagram showing an example of the configuration of a portable storage medium according to an embodiment of the present invention.
The portable storage medium (USB memory) 11 includes a USB interface 111 and an information storage unit 114.
The USB interface 111 manages communication with the host computer 12 and transmits / receives data (information) to / from the USB interface 122 of the host computer 12.
The information storage unit 114 is a storage device configured with, for example, a flash memory. As will be described later, the information storage unit 114 stores a user authentication program and an access control program.
The host computer 12 includes a CPU (Central Processing Unit), a memory composed of a RAM (Random Access Memory), etc., a USB controller 121 for communicating with a portable storage medium (USB memory) 11, and a USB interface. 122.
The user authentication program and the access control program are read from the information storage unit 114 of the portable storage medium (USB memory) 11 into the memory, and the CPU executes the programs so that the user authentication unit 112 and the access control unit 113 Each function is realized.
The user authentication unit 112 authenticates whether or not a user who intends to use the portable storage medium (USB memory) 11 has a proper use authority. The access control unit 113 performs control so that data can be read / written from the host computer 12 only in an area in the information storage unit 114 to which the user authenticated by the user authentication unit 112 has the use authority.

  When the portable storage medium (USB memory) 11 is connected to the host computer 12, the user authentication unit 112 is activated, and the user authentication unit 112 performs user authentication processing. Only when the user authentication is successful, by the control of the access control unit 113, an area of the information storage unit 114 that the user has access to is recognized as a USB storage device by the host computer 12 and can be used.

FIG. 2 is a diagram illustrating an example of a data structure of the information storage unit 114 of the portable storage medium (USB memory) 11. The information storage unit 114 includes a user authentication program storage area 21, a user authentication information storage area 22, an access control program storage area 23, and an information storage area 24. The information storage area 24 is logically divided into one or more areas so that a plurality of users can use the area separately. Here, an example is shown in which the information storage area is divided into three information storage areas: an information storage area A241, an information storage area B242, and an information storage area C243.
Note that the information storage unit 114 can have various configurations. The information storage unit 114 is composed of, for example, one flash memory, and logically includes a user authentication program storage area 21, a user authentication information storage area 22, an access control program storage area 23, and an information storage area 24. It may be divided. The information storage unit 114 includes, for example, one ROM (Read Only Memory) and one flash memory. The ROM is logically stored in the user authentication program storage area 21 and the access control program storage area 23. The flash memory may be logically divided into a user authentication information storage area 22 and an information storage area 24.

The user authentication program storage area 21 is an area in which a user authentication program for authenticating a user of the portable storage medium (USB memory) 11 is stored. In order to prevent unauthorized rewriting, an ISO9660 file system or the like is used. Is provided to the host computer 12 as a read-only file system using.
The user authentication information storage area 22 is an area for storing user authentication information such as a user ID and a PIN code. This area is not recognized as a file system by the host computer 12, but the user authentication unit 112. Can be referenced.
The access control program storage area 23 is an area for storing an access control program, and is activated and usable after user authentication. This area is also provided to the host computer 12 as a read-only file system using the ISO9660 file system or the like in order to prevent unauthorized rewriting.
The information storage area 24 becomes available after user authentication, and data reading and writing by the host computer 12 is performed on this area. Access to the information storage area 24 is performed via the access control unit 113.

FIG. 3 is a diagram illustrating an example of the data structure of the user authentication information storage area 22. The user authentication information storage area 22 stores a user ID 31, a PIN code 32, an available area 33, and an access key (encryption) 34.
The user ID 31 stores an ID (user identification information) for uniquely identifying the user. The PIN code 32 stores a PIN code used as a user password. The available area 33 stores one or more pieces of information storage area designation information for designating divided information storage areas that can be accessed by the user. The access key (encryption) 34 stores an encrypted encryption / decryption key for accessing each information storage area 24.

The PIN code 32 is stored in a format that cannot be restored to the original information by hashing the PIN code used at the time of user authentication.
The access key (encryption) 34 is an encryption / decryption key that is paired with the available area 33. The encryption / decryption key is created using the user ID 31, the PIN code 32, and the available area 33, and the encryption / The access key (plain text) for accessing each information storage area 24 is encrypted and stored using the decryption key. When different users access the same divided information storage area 24, the same encryption / decryption key is required. In such a case, the access key (encryption) 34 can be defined separately for each user by encrypting the access key (plain text) for accessing each information storage area 24 with information specific to the user. It is what.
In addition to the user ID 31, the PIN code 32, and the usable area 33, for example, an encryption / decryption key is created by using a predetermined unique value stored in a predetermined area inside the medium. Can be improved.
As a result, it is not necessary to hold an access key (encryption / decryption key) that is unique for each logically divided information storage area 24 in plain text, and an access key for each divided information storage area 24 It is possible to separate the PIN code input at the time of user authentication.

FIG. 4 shows an example of the correspondence between the access key (encryption) 34 stored in the user authentication information storage area 22 and the access key (plain text) 41 used to access the actually divided information storage area 24. FIG. The arrow in the figure indicates that the user, ADMIN, USER01, and USER05 who can access the information storage area A241 use the access key (encryption) 34 of the user authentication information storage area 22 to access key (plaintext) 411. Is generated and an image for accessing the information storage area A241 is shown.
After the user authentication by the user authentication unit 112, the access control unit 113 is created using the user ID 31, the PIN code 32, and the available area 33 so that the host computer 12 can access only the information storage area that can be used. The access key (encrypted) 34 is decrypted with the encrypted / decrypted key thus generated to generate an access key (plaintext) 41. Then, the access control unit 113 uses the access key (plaintext) 41 to write the data to the information storage area 24 while encrypting it, and reads the data from the information storage area 24 while decrypting it.

  Usually, the access key for encrypting or decrypting the data of the portable storage medium is one-to-one with the medium. However, by providing the data structure shown in FIG. Dividing into logical areas, it is possible to flexibly set combinations of information storage areas accessible to the user.

FIG. 5 is a flowchart showing an example of a procedure until the information storage area 24 of the portable storage medium (USB memory) 11 is used.
The portable storage medium (USB memory) 11 connected to the host computer 12 activates only the user authentication program storage area 21 in the medium simultaneously with the connection (S51). At this time, only the user authentication program storage area 21 can be accessed from the host computer 12 and the information storage area 24 cannot be accessed at all.
After the user authentication program storage area 21 is activated, the CPU of the host computer 12 reads the user authentication program from the user authentication program storage area 21 of the portable storage medium (USB memory) 11 into the memory, executes it, and uses it. The person authentication unit 112 is activated (S52). Then, the CPU of the host computer 12 prompts the user to input a user ID and a PIN code. At this time, the host computer 12 is used for a user interface with the user.

When the user ID and the PIN code are input, the user authentication unit 112 searches the user authentication information storage area 22 using the input user ID as a key, and acquires the PIN code 32. The user authentication unit 112 collates the input PIN code and the PIN code 32, and determines that the user authentication is successful when they match (S53). When the PIN code 32 is hashed, for example, the user authentication unit 112 hashes the input PIN code and collates it with the PIN code 32.
If the user authentication fails, the user ID and PIN code are prompted again, and if the user authentication is successful, the process proceeds to the next process (S54).
After completing the user authentication, the CPU of the host computer 12 reads the access control program from the access control program storage area 23 of the portable storage medium (USB memory) 11 and executes it to start the access control unit 113. As preparation for using the information storage area 24, the access control unit 113 acquires and expands a list of the information storage area 24 accessible by the user and the access key (encryption) 34 necessary for access (S55). ). Then, the access control unit 113 causes the host computer 12 to recognize the accessible information storage area 24 as a file system, and allocates the information storage area 24 to the host computer 12 as a readable and writable area (S56).

  After following these procedures, the host computer 12 can read and write data (information) in the information storage area 24 accessible by the authenticated user.

FIG. 6 is a flowchart showing an example of a procedure for obtaining an access key (plain text) 41 necessary for using the information storage area 24, and is a detailed description of step S55.
After successful user authentication in step S54, an available area 33 and an access key (encryption) 34 associated with the user ID 31 are acquired (S61). After obtaining the available area 33 and the access key (encryption) 34, the input PIN code used in step S53 is obtained (S62).
Thereafter, an encryption / decryption key is created using the user ID 31, the PIN code acquired in step S62 and the available area 33 acquired in step S61, and the access key acquired in step S61 using the encryption / decryption key. The (encryption) 34 is decrypted to generate an access key (plaintext) 41 (S63). If there are a plurality of information storage areas 24 accessible by the user, the process is repeated for all the information storage areas 24 (S64). Through the above processing, an access key (plain text) 41 that is an encryption / decryption key for accessing the information storage area 24 is generated.

  The PIN code used for creating the encryption / decryption key in step S63 is not the hashed PIN code 32 existing in the authentication information storage area 22, but the user authentication in step S53 (user ID and PIN code verification). The PIN code input by the user is used. This mechanism prevents unauthorized access to the information storage area 24 because an access key (plaintext) 41 cannot be generated from the PIN code 32 stored in the authentication information storage area 22 even if it can be illegally accessed. can do.

FIG. 7 is a diagram illustrating an example of the configuration of the access control unit 113.
The access control unit 113 includes an information storage area encryption / decryption unit 71, a virtual USB memory construction unit 72, and a virtual USB hub construction unit 73.
The information storage area encryption / decryption unit 71 performs encryption or decryption when data (information) is read or written from the host computer 12 to the information storage area 24.
The virtual USB memory construction unit 72 recognizes the information storage area 24 as a virtual USB memory.
The virtual USB hub construction unit 73 provides a virtual hub function for causing the host computer 12 to recognize a plurality of virtual USB memories recognized by the virtual USB memory construction unit 72. After the user authentication is completed, the virtual USB hub construction unit 73 refers to the user ID 31 and the available area 33 in FIG. 3 and stores only the information storage area 24 accessible by the authenticated user in the host computer 12. It is recognized as one or more USB memories (file systems).
Both of these operate when the host computer 12 recognizes the information storage area 24 after user authentication.

FIG. 8 is a diagram illustrating a connection state of virtual devices when the portable storage medium (USB memory) 11 is viewed from the host computer 12.
Via the virtual USB hub 81, the virtual USB memory A831, virtual USB memory B832, and virtual USB memory C833 are recognized by the host computer 12 as independent portable storage media. The user authentication program storage area 21 is also recognized as an independent virtual CD-ROM 82.

  When the portable storage medium (USB memory) 11 is connected, only the virtual CD-ROM 82 is recognized from the host computer 12, but after the user authentication is completed, divided information storage accessible by the user is stored. The area 24 is recognized as one or more USB memories.

FIG. 9 shows an example in which the host computer 12 recognizes the information storage area 24 for each user.
It is the portable storage medium (USB memory) 11 according to this embodiment that the host computer 12 recognizes as the E, F, and G drives for each user. One CD-ROM drive is recognized after the medium is connected, and one or more removable disk drives are recognized after the user authentication is completed.
Note that the C drive and D drive recognized by the host computer 12 for all users in the figure indicate the hard disk of the host computer 12 and the DVD-ROM drive of the host computer, and are outside the scope of the present invention. .

It is the user authentication program storage area 21 that the host computer 12 recognizes as E drive for all users in the figure, and the user authentication program storage area 21 is virtually recognized as a CD-ROM. The allocation of the user authentication program storage area 21 is as shown by the broken arrow 91 in the figure, and the host computer 12 recognizes the user authentication program storage area 21 for all users who use the medium.
On the other hand, what is recognized as the F drive and the G drive is an available information storage area 24 of the portable storage medium (USB memory) 11, and a virtual removable disk for each divided information storage area 24. Recognized as The allocation of the information storage area 24 is indicated by a solid arrow 92 in the figure. Here, the recognized information storage area 24 is different for each user, and only the information storage area 24 defined as accessible in the user authentication information storage area 22 is recognized. Depending on the combination of the user and the accessible information storage area 24, the same information storage area 24 can be shared by a plurality of users. Since the information storage area 24 that cannot be accessed by the user is not recognized by the host computer 12, unauthorized access can be prevented.

  In the embodiment described above, an example in which the portable storage medium is a USB memory has been described. However, the present invention is not limited to a USB memory. For example, the interface is changed from USB to IEEE 1394, Bluetooth (registered trademark). Various modifications and substitutions can be made without departing from the spirit of the present invention, such as changing, changing the electronic information recording method from flash memory to magnetic medium, and using an SD memory card as a portable storage medium. That is obvious.

  In the above-described embodiment, the example in which the portable storage medium is connected to the host computer has been described. However, the present invention can also be applied to the case where the portable storage medium is connected to another host device such as a mobile phone. Of course.

  As described above, according to the present invention, user authentication can be realized on a portable storage medium such as a USB memory shared by a plurality of users without being controlled by the general-purpose OS of the host device. The information storage area inside the portable storage medium is logically divided, and the divided information storage area is allocated to each user as an accessible area for each user, and stored in each divided information storage area. Information can be concealed from users without access rights.

This control is realized by a safe method that does not require sharing of a PIN code, a password, etc. among a plurality of users without using a program or the like outside the portable storage medium. Thereby, when a portable storage medium is shared by a plurality of users, it is possible to prevent password leakage by using each password.
In addition, by causing the host device to recognize only an area that can be accessed by an authenticated user among information storage areas logically divided in the portable storage medium as a virtual storage medium (file system) Of the information stored in the portable storage medium, information (such as a list of information) related to information without access rights is concealed. As a result, the security can be further improved.

DESCRIPTION OF SYMBOLS 11 ... Portable storage medium (USB memory), 111 ... USB interface, 112 ... User authentication part, 113 ... Access control part, 114 ... Information storage part, 12 ... Host computer, 121 ... USB controller, 122 ... USB interface, 21 ... User authentication program storage area, 22 ... User authentication information storage area, 23 ... Access control program storage area, 24 ... Information storage area, 241 ... Information storage area A, 242 ... Information storage area B, 243 ... Information storage Area C, 71 ... Information storage area encryption / decryption section, 72 ... Virtual USB memory construction section, 73 ... Virtual USB hub construction section, 81 ... Virtual USB hub, 82 ... Virtual CD-ROM, 831 ... Virtual USB memory A, 832 ... Virtual USB memory B, 833 ... Virtual USB memory C

Claims (2)

A portable storage medium removable from a host device having a CPU and memory,
An information storage area divided into a plurality of areas;
Authentication information for authenticating the usage authority for each of a plurality of users, one or more information storage area designation information for designating the divided information storage areas accessible to the respective users, and the information storage A user authentication information storage area in which a first encryption / decryption key corresponding to the area designation information is stored;
Activated when the portable storage medium is connected to the host device, read into the memory of the host device and executed by the CPU of the host device, and uses the host device using the host device A user authentication program that functions as a user authentication unit that verifies authentication information input by a user and authentication information stored in the user authentication information storage area and authenticates the user's usage authority A user authentication program storage area in which is stored,
Activated in response to being authenticated by the user authentication means that the user has authority to use, read into the memory of the host device and executed by the CPU of the host device. Based on the information storage area designation information stored in the storage area, the divided information storage areas accessible by the user are identified, and the identified information storage areas are recognized as file systems by the host device. And writing into each of the divided information storage areas while encrypting information from the host device using the first encryption / decryption key stored in the user authentication information storage area. Access control storing an access control program that functions as an access control means for decoding while reading information from the storage area And program storage area,
A portable storage medium comprising an information storage unit having The encryption / decryption key stored in the user authentication information storage area is the encryption / decryption key for accessing each of the divided information storage areas, the authentication information input by the user, and the information storage. Encrypted using the second encryption / decryption key created using the information storage area designation information stored in the user authentication information storage area of
The access control means creates the second encryption / decryption key using the authentication information input by the user and the information storage area designation information stored in the user authentication information storage area, Decrypting the first encryption / decryption key stored in the user authentication information storage area using the second encryption / decryption key, and using the decrypted first encryption / decryption key, Writing to each divided information storage area while encrypting information from the host device, and decrypting while reading information from each divided information storage area;
The portable storage medium according to claim 1.

Images