JP2013084115A - Determination program and determination device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To properly determine use propriety of an external storage medium even when it is impossible to communicate with a server.SOLUTION: A determination program is configured to cause a computer to execute processing of: determining whether the computer can communicate with an authentication device having pieces of registration information concerning use propriety of a plurality of external storage media which can exchange information with the computer, when one of the external storage media is detected; transmitting identification information for identifying the external storage medium to the authentication device when it is possible to communicate with the authentication device; receiving authentication information concerning the use propriety of the external storage device from the authentication device; storing identification information in a storage unit on the basis of the authentication information; and determining the use propriety of the external storage medium by referring to the storage unit if it is impossible to communicate with the authentication device.

Description

  The present invention relates to a determination program and a determination apparatus.

  Conventionally, in order to prevent information leakage from a computer terminal, there is a technique for monitoring the movement of information to an external storage medium that causes information leakage. For example, there is a conventional technique in which identification information of an external storage medium permitted to be used is registered in a server, and when the external storage medium is connected to a terminal, the server is inquired whether the external storage medium can be used. Further, for example, there is a conventional technique in which an external storage medium having a wireless function directly inquires of a server whether or not the external storage medium can be used.

  For example, there is a technique that uses license information in order to prevent downloaded content from being moved to an external storage medium. The license information is information including a decryption key for decrypting the encrypted content and information indicating whether the content can be copied. In this technique, the content is encrypted, and when the encrypted content is downloaded to the terminal, the above-described license information is also distributed to the terminal. In the terminal, the content is browsed by using the decryption key in the license information, and it is determined whether to permit the movement of the content based on whether or not copying is possible in the license information. When the content is moved to the external storage medium, it is necessary to move the license information to the external storage medium in order to decrypt the content. For this reason, when the content is further moved, the determination is made again based on whether or not copying is possible in the license information.

  In addition, for example, there is a technique that uses a policy in order to control the movement of information to an external storage medium. This policy is, for example, information set by an administrator such as “Terminal A permits use of external storage media a to e during period M”. Then, by distributing this policy to each terminal and determining whether or not the connected external storage medium matches the policy, whether or not the external storage medium can be used is controlled.

JP 2009-288911 A JP 2004-133654 A

Systemwalker Desktop Keeper V14g Function, [online], [Search September 26, 2011], Internet <URL: http://systemwalker.fujitsu.com/jp/desktop_keeper/function/#a01-01>

  Here, in the case of individually controlling the availability of the external storage medium for each terminal, a technique using a policy and a technique using license information are effective. In this technique, regardless of which external storage medium is connected to any terminal, it is necessary to store policies regarding all external storage media to be managed in all terminals in order to control the availability. Therefore, the technology that inquires the server whether or not the external storage medium can be used is less than the technology that sets the same policy for multiple terminals, so that the search load on each terminal, memory used, communication traffic volume, etc. are reduced. From the viewpoint of.

  However, the technique of inquiring the server has a problem that the external storage medium cannot be used at all when communication with the server is impossible. Here, it is conceivable to use an external storage medium having a wireless function. However, with this technique, it is not possible to control the movement of information for a general external storage medium having no wireless function.

  The disclosed technique has been made in view of the above, and an object thereof is to provide a determination program and a determination apparatus that can use an external storage medium even when communication with a server is impossible.

  In one aspect, the technology disclosed in the present application, when an external storage medium capable of exchanging information with a computer is detected, registration information regarding whether or not the computer and a plurality of external storage media including the external storage medium can be used. A computer is caused to execute a process of determining whether or not communication with an authentication device is possible. In addition, in the disclosed technique, when communication with the authentication apparatus is possible, the computer executes a process of transmitting identification information for identifying the external storage medium to the authentication apparatus. In addition, the disclosed technology causes a computer to execute processing for receiving authentication information related to the availability of an external storage medium from an authentication device. Further, the disclosed technique causes a computer to execute processing for storing identification information in a storage unit based on authentication information. In addition, when the disclosed technology is not communicable with the authentication device, the computer refers to the storage unit and causes the computer to execute processing for determining whether the external storage medium can be used.

  According to one aspect of the technology disclosed in the present application, there is an effect that an external storage medium can be used even if communication with the server is impossible.

FIG. 1 is a block diagram illustrating a functional configuration of the authentication server according to the first embodiment. FIG. 2 is a block diagram illustrating a functional configuration of the determination apparatus according to the first embodiment. FIG. 3 is a diagram illustrating an example of information stored in the registration DB. FIG. 4 is a diagram illustrating an example of information stored in the history DB. FIG. 5 is a flowchart illustrating the processing procedure of the determination apparatus according to the first embodiment. FIG. 6 is a flowchart illustrating the processing procedure of the determination apparatus according to the first embodiment. FIG. 7 is a diagram illustrating a computer that executes a determination program.

  Embodiments of a determination program and a determination apparatus disclosed in the present application will be described below in detail with reference to the drawings. Note that the present invention is not limited to the embodiments. Each embodiment can be appropriately combined within a range in which processing contents do not contradict each other.

  An example of a functional configuration of the determination apparatus and the authentication server according to the first embodiment will be described. FIG. 1 is a block diagram illustrating a functional configuration of the authentication server according to the first embodiment. FIG. 2 is a block diagram illustrating a functional configuration of the determination apparatus according to the first embodiment. As illustrated in FIGS. 1 and 2, the determination device 100 and the authentication server 20 are connected via a network 10. For example, the authentication server 20 stores information indicating whether or not the external storage medium can be used. For example, when an external storage medium is connected, the determination apparatus 100 inquires of the authentication server 20 if it can communicate with the authentication server 20, and can use the authentication server 20 if it cannot communicate with the authentication server 20. Whether or not it can be used is determined by referring to the history regarding the external storage medium determined to be. Note that the determination apparatus 100 corresponds to, for example, a computer. The network 10 may be any type of communication network, such as the Internet (Internet), a LAN (Local Area Network), or a VPN (Virtual Private Network), whether wired or wireless. Hereinafter, a case where the determination apparatus 100 and the authentication server 20 can communicate with each other is also referred to as “online”, and a case where the communication cannot be performed is also referred to as “offline”.

  Here, the external storage medium corresponds to, for example, a USB (Universal Serial Bus) memory, but is not limited thereto. For example, the external storage medium uniquely identifies the external storage medium such as a PC (Personal Computer) card, a CD (Compact Disc), a DVD (Digital Versatile Disc), a BD (BlueRay Disc), and a drive storing the external storage medium. Any device that can acquire identification information may be used. For example, the connection form between the external storage medium and the determination apparatus 100 may be wired or wireless. Hereinafter, the external storage medium is also referred to as “device”.

  As illustrated in FIG. 1, the authentication server 20 includes a communication control unit 21, a server storage unit 22, and a server control unit 23. The communication control unit 21 controls communication regarding various information transmitted and received between the authentication server 20 and the determination apparatus 100. The communication control unit 21 corresponds to, for example, a network interface card (NIC). The authentication server 20 is an example of a server and an authentication device.

  The server storage unit 22 has a registration DB (Database) 22a. The server storage unit 22 corresponds to, for example, a semiconductor memory device such as a random access memory (RAM), a read only memory (ROM), and a flash memory, and a storage device such as a hard disk or an optical disk.

  For example, the registration DB 22a stores information indicating whether or not a device can be used. FIG. 3 is a diagram illustrating an example of information stored in the registration DB. As illustrated in FIG. 3, for example, the registration DB 22 a stores “ID (Identification)”, “expiration date”, “last connection date / time”, and “extension availability” in association with each other. Among these, ID shows the identification information which identifies a device uniquely. The expiration date indicates the expiration date of the device. The last connection date / time indicates the date / time when the device was last communicated with the authentication server 20. The extension permission / inhibition is information indicating whether or not the device expiration date is extended for a predetermined period when the device communicates with the authentication server 20. The extension permission / inhibition “1” indicates that the expiration date is extended for a predetermined period. For example, every time a device communicates with the authentication server 20, the expiration date of the corresponding device is extended by 30 days by the registration update unit 23 b described later. Is done. The extension availability “0” indicates that the expiration date is not extended. For example, in the registration DB 22a, one record is registered each time a new device is connected to a drive device (not shown in FIG. 1) of the authentication server, for example. In this case, only devices that are determined to be usable by the administrator are connected to the drive device by the administrator. Note that information about a new device may be received from another computer communicating with the authentication server, and one record may be registered each time it is received. Further, when a new device is connected to the drive device, one record regarding the device may be registered together with information on whether or not the new device can be used. In this case, the administrator receives information as to whether or not the new device can be used from an input device connected to or communicating with the authentication server. Then, the authentication server registers the received information in each record. For example, in addition to the information shown in FIG. 3, the registration DB 22a stores a flag indicating availability for each record.

  As illustrated in FIG. 3, for example, the registration DB 22 a has an ID “101”, a usage period “2011/2/15 15:00”, a last connection date and time “2011/1/15 15:00”, and whether extension is possible. “1” is stored in association with each other. That is, in the registration DB 22a, the expiration date of the device with the ID “101” is 15:00 on February 15, 2011, the date and time when the device was last connected is 15:00 on January 15, 2011, and the device The fact that the expiration date is extended for a predetermined period each time is connected is stored. The registration DB 22a stores the other devices in the same manner.

  The server control unit 23 includes an authentication unit 23a, a registration update unit 23b, and a response unit 23c. The function of the server control unit 23 can be realized by an integrated circuit such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA). Further, the function of the server control unit 23 can be realized by, for example, a CPU (Central Processing Unit) executing a predetermined program.

  The authentication unit 23a authenticates whether the device can be used. For example, the authentication unit 23a receives the ID of a device connected to the determination apparatus 100, and searches the registration DB 22a using the received ID as a search key. The authentication unit 23a refers to the expiration date corresponding to the searched ID, and determines whether or not the current date is before the expiration date.

  If the current date and time is before the expiration date, the authentication unit 23a sets the usage flag “1” for the corresponding ID. On the other hand, when the current date and time is not earlier than the expiration date, the authentication unit 23a sets the usage flag “0” in the corresponding ID. This use flag is information indicating whether or not the device can be used. For example, the use flag “1” indicates that the corresponding device can be used, and the use flag “0” indicates that the corresponding device cannot be used.

  The registration update unit 23b updates the device registration DB 22a. For example, the registration update unit 23b updates the last connection date / time of the corresponding device to the current date / time.

  For example, when the use flag “1” is set for the corresponding ID by the authentication unit 23a, the registration update unit 23b refers to whether or not the corresponding device can be extended. When the extension is permitted or not “1”, the registration / update unit 23b extends the expiration date of the device for a predetermined period. For example, the registration update unit 23b sets a date 30 days after the current date as a new expiration date. For example, “30 days” is set as the predetermined period, but the predetermined period is not limited to this, and an arbitrary period may be set by the user.

  The response unit 23c responds whether the device can be used. For example, the response unit 23c transmits the authentication result by the authentication unit 23a to the determination apparatus 100. For example, the response unit 23c associates the received ID, the expiration date, the last connection date and time, and the use flag set by the authentication unit 23a, and transmits them to the determination apparatus 100. For example, the response unit 23c corresponds to the ID “101”, the expiration date “20111/2/15 15:00”, the last connection date “2011/1/15 15:00”, and the usage flag “1”. At the same time, it is transmitted to the determination apparatus 100.

  As illustrated in FIG. 2, the determination apparatus 100 includes a communication control unit 110, a storage unit 120, and a control unit 130. The determination device 100 is connected to the input device 101, the output device 102, and the drive device 103. The input device 101 is a device that receives input of various types of information, and corresponds to, for example, a keyboard and a mouse. The output device 102 is a device that outputs various types of information, and corresponds to, for example, a display or a monitor. The driving device 103 is a device that reads and writes information on various storage media, and corresponds to, for example, a USB hub port. For example, a device is connected to the driving device 103. Further, for example, the drive device 103 delivers information to the device. Although a case where a device is connected to the driving device 103 is described here, the present invention is not limited to this. For example, a device may be connected to a physical interface provided in the determination apparatus 100.

  The communication control unit 110 controls communication related to various information transmitted and received between the authentication server 20 and the determination apparatus 100. The communication control unit 110 is, for example, a network interface card (NIC).

  The storage unit 120 has a history DB 121. The storage unit 120 corresponds to, for example, a semiconductor memory device such as a random access memory (RAM), a read only memory (ROM), and a flash memory, and a storage device such as a hard disk or an optical disk.

  The history DB 121 stores, for example, devices that are determined to be usable by the authentication server 20. FIG. 4 is a diagram illustrating an example of information stored in the history DB. As illustrated in FIG. 4, for example, the history DB 121 stores “ID”, “expiration date”, and “last connection date” in association with each other. For example, in the history DB 121, a maximum of 30 records are registered by the history update unit 134 described later. Here, a case where a maximum of 30 records are registered in the history DB 121 will be described, but the present invention is not limited to this. For example, the maximum number of records registered in the history DB 121 may be set to an arbitrary value by a user using the determination apparatus 100.

  As illustrated in FIG. 4, for example, the history DB 121 associates the ID “101”, the expiration date “20111/2/15 15:00”, and the last connection date “2011/1/15 15:00”. Remember. That is, the history DB 121 indicates that the expiration date of the device with the ID “101” is 15:00 on February 15, 2011, and the last connection date and time is 15:00 on January 15, 2011. Remember. The history DB 121 also stores other devices in the same manner.

  The control unit 130 includes a detection unit 131, an inquiry unit 132, a determination unit 133, and a history update unit 134. The function of the control unit 130 can be realized by an integrated circuit such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA). Further, the function of the control unit 130 can be realized, for example, by a CPU (Central Processing Unit) executing a predetermined program.

  The detection unit 131 detects a device. For example, the detection unit 131 detects that a device is connected to the drive device 103. In addition, for example, the detection unit 131 stops passing information to the drive device 103 to which the device is connected. For example, the detection unit 131 acquires the device ID from the device connected to the drive device 103.

  The inquiry unit 132 inquires whether the device can be used. For example, the inquiry unit 132 transmits the device ID acquired by the detection unit 131 to the authentication server 20. For example, the inquiry unit 132 determines whether the transmission is successful. For example, the inquiry unit 132 determines whether or not the transmission is successful by determining the success or failure of Connect or the success or failure of Send. For example, the inquiry unit 132 receives the authentication result from the response unit 23c.

  Further, the inquiry unit 132 inquires about the availability of the device in the history DB 121. For example, the inquiry unit 132 transmits all IDs stored in the history DB 121 to the authentication server 20 at a predetermined timing. The inquiry unit 132 is an example of a first determination unit and an inquiry unit.

  The determination unit 133 determines whether or not the device can be used based on the history DB 121. For example, the determination unit 133 determines whether or not the acquired ID is in the history DB 121. When the ID is in the history DB 121, the authentication unit 23a refers to the expiration date corresponding to the ID, and determines whether or not the current date is before the expiration date. If the current date and time is before the expiration date, the determination unit 133 determines that the device can be used, and causes the detection unit 131 to cancel the stop of information transfer to the drive device 103. On the other hand, when the current date and time is not earlier than the expiration date and when the ID is not in the history DB 121, the determination unit 133 determines that the device cannot be used. That is, the delivery of information to the drive device 103 to which the device is connected remains stopped.

  For example, the determination unit 133 determines whether or not the device can be used based on the determination result received by the inquiry unit 132. For example, the determination unit 133 determines whether the use flag of the determination result is “1”. When the ID usage flag is “1”, the determination unit 133 refers to the expiration date corresponding to the ID, and determines whether or not the current date is before the expiration date. If the current date and time is before the expiration date, the determination unit 133 determines that the device can be used, and causes the detection unit 131 to cancel the stop of information transfer to the drive device 103. If the ID use flag is “0” and if the current date and time is not earlier than the expiration date, the determination unit 133 determines that the device cannot be used. That is, the delivery of information to the drive device 103 to which the device is connected remains stopped. The determination unit 133 is an example of a second determination unit.

  The history update unit 134 updates the device history DB 121 based on the determination result received by the inquiry unit 132. For example, when the use flag “1” is set in the received ID, the history update unit 134 determines whether or not the ID is in the history DB 121. When the ID is in the history DB 121, the history update unit 134 updates the expiration date and the last connection date / time of the corresponding record. On the other hand, when the ID is not in the history DB 121, the history update unit 134 stores the received ID, the expiration date, and the last connection date in the history DB 121 in association with each other. At this time, if the maximum number of records registered in the history DB 121 is exceeded, the history update unit 134 deletes the record with the oldest last connection date.

  Further, for example, when the use flag “0” is set in the received ID, the history update unit 134 deletes the corresponding record from the history DB 121. The history update unit 134 is an example of a storage unit.

  Next, a processing procedure of the determination apparatus 100 according to the first embodiment will be described. FIG. 5 is a flowchart illustrating the processing procedure of the determination apparatus according to the first embodiment. The processing shown in FIG. 5 is executed at predetermined time intervals, for example, while power is supplied from the power source to the illustrated devices.

  As illustrated in FIG. 5, in the determination apparatus 100, when the detection unit 131 detects a device (Yes in step S101), the detection unit 131 stops passing information to the drive device 103 to which the device is connected (step S102). The detection unit 131 acquires the ID of the device connected to the drive device 103 (step S103).

  The inquiry unit 132 transmits the device ID acquired by the detection unit 131 to the authentication server 20 (step S104), and determines whether the transmission is successful (step S105). Here, if the transmission is successful (step S105 Yes), the inquiry unit 132 enters a state of waiting for reception from the authentication server 20. On the other hand, when the transmission fails (No at Step S105), the inquiry unit 132 outputs information indicating that the transmission has failed to the determination unit 133.

  When receiving information indicating that the transmission has failed from the inquiry unit 132, the determination unit 133 determines whether or not the acquired ID is in the history DB 121 (step S106). When the ID is in the history DB 121 (Yes in step S106), the determination unit 133 refers to the expiration date corresponding to the ID and determines whether or not the current date is before the expiration date (step S107). If the current date and time is before the expiration date (Yes in step S107), the determination unit 133 determines that the device can be used, and causes the detection unit 131 to cancel the stop of the information delivery to the drive device 103 (step S108). ). On the other hand, if the current date and time is not earlier than the expiration date (No in step S107), the determination unit 133 determines that the device is unusable and outputs information indicating that the device is unusable to the history update unit 134.

  When the history update unit 134 receives information indicating that the device is unusable from the determination unit 133, the history update unit 134 deletes the record corresponding to the device from the history DB 121 (step S109), and ends the process.

  On the other hand, when the ID is not in the history DB 121 (No in step S106), the determination unit 133 ends the process. That is, the delivery of information to the drive device 103 to which the device is connected remains stopped.

  In the authentication server 20, the authentication unit 23a receives the device ID from the inquiry unit 132 (step S110). The authentication unit 23a determines whether or not the received ID is in the registration DB 22a (step S111). When the ID is in the registration DB 22a (Yes at Step S111), the authentication unit 23a refers to the expiration date corresponding to the ID and determines whether or not the current date is before the expiration date (Step S112). When the current date and time is before the expiration date (Yes at Step S112), the authentication unit 23a sets the usage flag “1” for the corresponding ID (Step S113).

  The registration update unit 23b updates the device registration DB 22a (step S114). For example, the registration update unit 23b updates the last connection date / time of the device to the current date / time. Further, for example, the registration update unit 23b extends the expiration date of the device for a predetermined period.

  The response unit 23c transmits the authentication result by the authentication unit 23a to the determination apparatus 100 (step S115). That is, the response unit 23c transmits the received ID, the expiration date, the last connection date and time, and the use flag set by the authentication unit 23a to the determination device 100 in association with each other.

  On the other hand, when the current date and time is not earlier than the expiration date (No at Step S112), the authentication unit 23a sets the usage flag “0” for the corresponding ID (Step S116), and proceeds to the process at Step S114.

  On the other hand, when the ID is not in the registration DB 22a (No at Step S111), the authentication unit 23a proceeds to the process at Step S116.

  In the determination apparatus 100, the inquiry unit 132 receives the authentication result from the response unit 23c (step S117). Here, the inquiry unit 132 outputs the authentication result to the determination unit 133. In addition, the determination apparatus 100 may perform the processing after S106 described later when the authentication result is not received from the authentication server 20 even after a predetermined time has elapsed since the transmission of the device ID was successful in S105. . In addition, the determination apparatus 100 may determine that the use is prohibited when the authentication result is not received from the authentication server 20 even after a predetermined time has elapsed since the transmission of the device ID was successful in S105.

  The determination unit 133 refers to the authentication result received from the response unit 23c and determines whether or not the use flag of the device ID is “1” (step S118). When the ID use flag is “1” (step S118 Yes), the determination unit 133 determines that the device can be used, and causes the detection unit 131 to cancel the stop of the information transfer to the drive device 103 (step S119). ).

  The history update unit 134 updates the device history DB 121 (step S120). For example, the history update unit 134 determines whether or not the history DB 121 has an ID for which the use flag “1” is set. When the ID is in the history DB 121, the history update unit 134 updates the expiration date and the last connection date / time of the corresponding record. On the other hand, when the ID is not in the history DB 121, the history update unit 134 stores the received ID, the expiration date, and the last connection date in the history DB 121 in association with each other. At this time, if the maximum number of records registered in the history DB 121 is exceeded, the history update unit 134 deletes the record with the oldest last connection date.

  On the other hand, when the ID use flag is “0” (No in step S118), the determination unit 133 determines that the device is unusable, and outputs the ID determined to be unusable to the history update unit 134.

  The history update unit 134 deletes the record of the ID determined as unusable by the determination unit 133 from the history DB 121 (step S121), and ends the process. That is, the delivery of information to the drive device 103 to which the device is connected remains stopped.

  Next, processing for inquiring whether or not a device in the history DB 121 can be used will be described. FIG. 6 is a flowchart illustrating the processing procedure of the determination apparatus according to the first embodiment. The processing shown in FIG. 6 is executed, for example, when power is supplied from the power source to each of the illustrated devices, or when a predetermined time interval or a specific event occurs.

  In the determination apparatus 100, the inquiry unit 132 transmits all IDs stored in the history DB 121 to the authentication server 20 at a predetermined timing (step S201).

  In the authentication server 20, the authentication unit 23a receives all IDs stored in the history DB 121 from the inquiry unit 132 (step S202). The authentication unit 23a selects one ID from the received IDs (step S203). The authentication unit 23a determines whether or not the selected ID is in the registration DB 22a (step S204). If the ID is in the registration DB 22a (Yes in step S204), the authentication unit 23a refers to the expiration date corresponding to the ID and determines whether the current date is before the expiration date (step S205). When the current date and time is before the expiration date (Yes at Step S205), the authentication unit 23a sets the usage flag “1” for the corresponding ID (Step S206).

  On the other hand, when the current date and time is not earlier than the expiration date (No at Step S205), the authentication unit 23a sets the usage flag “0” for the corresponding ID (Step S208), and proceeds to the processing at Step S207.

  On the other hand, when the ID is not in the registration DB 22a (No at Step S204), the authentication unit 23a proceeds to the process at Step S208.

  The authentication unit 23a repeatedly executes the processing from step S203 to step S208 until all received IDs are selected (No in step S207). When all the received IDs are selected (step S207 Yes), the authentication unit 23a proceeds to the process of step S209.

  The response unit 23c transmits the authentication result by the authentication unit 23a to the determination apparatus 100 (step S209). That is, the response unit 23c associates all received IDs, the expiration date, the last connection date and time, and the use flag set by the authentication unit 23a, and transmits them to the determination device 100.

  In the determination apparatus 100, the inquiry unit 132 receives the authentication result from the response unit 23c (step S210). Here, the inquiry unit 132 outputs the authentication result to the history update unit 134.

  The history update unit 134 updates the device history DB 121 (step S211). For example, the history update unit 134 deletes, from the history DB 121, a record of an ID for which the use flag “0” is set among all received IDs.

  Next, the effect of the determination apparatus 100 according to the first embodiment will be described. When the determination apparatus 100 detects an external storage medium, the determination apparatus 100 determines whether the determination apparatus 100 and the server can communicate with each other. If the determination apparatus 100 can communicate with the server, the determination apparatus 100 inquires of the server whether the external storage medium can be used. The determination apparatus 100 stores information related to availability of the external storage medium received from the server in the storage unit. When it is not possible to communicate with the server, the determination device 100 refers to the storage unit and determines whether or not the external storage medium can be used. For this reason, the determination apparatus 100 can appropriately determine whether or not the external storage medium can be used even if communication with the server is not possible. For example, since the determination apparatus 100 stores information related to the availability of the external storage medium received from the server in the storage unit, the external storage medium can be used by referring to the storage unit even when communication with the server is impossible. can do.

  That is, when the determination apparatus 100 is applied to a plurality of terminals that communicate with the server, for example, each terminal stores the history of the devices determined to be usable by the server as devices that have been used. deep. When offline, each terminal determines whether or not the device can be used by referring to the history, so that a device having a history of use can be used. In particular, since users of terminals are generally limited to specific individuals or individuals belonging to specific groups, even if a huge number of devices are registered in the server, each terminal There is no need to store all devices. Since each terminal stores a device having a history of use as a history, it is possible to appropriately determine whether or not the device is likely to be used.

  In addition, for example, the determination apparatus 100 stores identification information for identifying an external storage medium determined to be usable by the server in the storage unit. Therefore, even if communication with the server is impossible, the determination device 100 refers to the storage unit. An external storage medium can be used.

  For example, the determination apparatus 100 stores the identification information of the external storage medium and the usage period of the external storage medium in the storage unit in association with each other. Further, for example, the determination apparatus 100 refers to the storage unit, and when the date and time when the external storage medium is detected is included in the usage period associated with the identification information of the external storage medium, the determination apparatus 100 can use the external storage medium. When it is determined that the external storage medium is not included in the usage period, it is determined that the external storage medium cannot be used. For this reason, even if the determination apparatus 100 cannot communicate with the server, the external storage medium can be used by referring to the storage unit.

  Further, for example, if the external storage medium is usable as a result of inquiring whether or not the external storage medium can be used, the determination device 100 uses the usage period associated with the identification information if the external storage medium has the identification information in the storage unit. Is updated to the usage period extended by the authentication device for a predetermined period. For this reason, the determination apparatus 100 can stop using an external storage medium that has not been used for a predetermined period.

  In addition, for example, when the external storage medium is unusable as a result of inquiring whether the external storage medium can be used, the determination apparatus 100 stores the external storage medium identification information in the storage unit if the external storage medium identification information exists in the storage unit. Delete from. Therefore, even if the determination apparatus 100 cannot communicate with the server, the external storage medium determined to be usable by the server can be used by referring to the storage unit.

  In addition, for example, when the determination apparatus 100 detects an external storage medium that can exchange information with the computer, the determination apparatus 100 includes an authentication apparatus having registration information regarding whether or not a plurality of external storage media including the external storage medium can be used. Determines whether or not communication is possible. If the determination apparatus 100 can communicate with the authentication apparatus, the determination apparatus 100 transmits identification information for identifying the external storage medium to the authentication apparatus. The determination apparatus 100 receives authentication information related to the availability of the external storage medium from the authentication apparatus. The determination apparatus 100 stores the identification information in the storage unit based on the authentication information. If the determination apparatus 100 cannot communicate with the authentication apparatus, the determination apparatus 100 refers to the storage unit and determines whether or not the external storage medium can be used. For this reason, the determination apparatus 100 can appropriately determine whether or not the external storage medium can be used even if communication with the server is not possible. For example, since the determination apparatus 100 stores information related to the availability of the external storage medium received from the server in the storage unit, the external storage medium can be used by referring to the storage unit even when communication with the server is impossible. can do.

  Although the embodiments of the present invention have been described so far, the present invention may be implemented in other embodiments besides the above-described embodiments. Therefore, other embodiments will be described below.

  In the first embodiment, the history DB 121 has been described as storing devices determined to be usable by the authentication server 20, for example. However, the present invention is not limited to this. For example, the history DB 121 may store devices that are determined to be unusable by the authentication server 20. According to this, even when the determination apparatus 100 is offline, it is possible to disable a device whose use has been prohibited in the past, and to use a device that has no history of use being prohibited.

  Further, among the processes described in the first embodiment, all or a part of the processes described as being automatically performed can be manually performed, or the processes described as being manually performed can be performed. All or a part can be automatically performed by a known method. For example, in the first embodiment, the case where the process of inquiring whether or not the device in the history DB 121 is available is automatically performed. However, the process may be started manually. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters shown in the above-described document and drawings can be arbitrarily changed unless otherwise specified. For example, FIG. 3 illustrates the case where the registration DB 22a stores the extension permission / prohibition for each device, but the extension permission / prohibition need not be stored. For example, it may be set whether extension is possible for all devices registered in the registration DB 22a.

  Each component of the determination apparatus 100 shown in FIG. 2 is functionally conceptual and does not necessarily need to be physically configured as illustrated. That is, the specific form of distribution / integration of the determination apparatus 100 is not limited to the illustrated one, and all or part of the determination apparatus 100 is functionally or physically distributed in arbitrary units according to various loads or usage conditions. -Can be integrated and configured. For example, the functions of the determination unit 133 and the history update unit 134 illustrated in FIG. 2 may be integrated into one.

  The determination apparatus 100 can also be realized by installing each function of the determination apparatus 100 in a known information processing apparatus. The known information processing apparatus corresponds to an apparatus such as a personal computer, a workstation, a mobile phone, a PHS (Personal Handy-phone System) terminal, a mobile communication terminal, or a PDA (Personal Digital Assistant).

  FIG. 7 is a diagram illustrating a computer that executes a determination program. As illustrated in FIG. 7, the computer 300 includes a CPU 301 that executes various arithmetic processes, an input device 302 that receives data input from a user, and a monitor 303. The computer 300 also includes a medium reading device 304 that reads a program or the like from a storage medium, an interface device 305 for connecting to another device, and a wireless communication device 306 for connecting to another device wirelessly. The computer 300 also includes a RAM (Random Access Memory) 307 that temporarily stores various types of information and a hard disk device 308. Each device 301 to 308 is connected to a bus 309.

  The hard disk device 308 stores a determination program having the same functions as the processing units of the inquiry unit 132, the determination unit 133, and the history update unit 134 illustrated in FIG. The hard disk device 308 stores various data for realizing the determination program.

  The CPU 301 reads out each program stored in the hard disk device 308, develops it in the RAM 307, and executes it to perform various processes. In addition, these programs can cause the computer to function as the inquiry unit 132, the determination unit 133, and the history update unit 134 illustrated in FIG.

  Note that the above determination program does not necessarily have to be stored in the hard disk device 308. For example, the computer 300 may read and execute a program stored in a computer-readable recording medium. As the computer-readable recording medium, for example, a portable recording medium such as a CD-ROM, a DVD disk, and a USB memory, a semiconductor memory such as a flash memory, a hard disk drive, and the like are supported. Further, the program may be stored in a device connected to a public line, the Internet, a LAN (Local Area Network), a WAN (Wide Area Network), etc., and the computer 300 may read and execute the program therefrom. good.

  The following supplementary notes are further disclosed with respect to the embodiments including the above examples.

(Supplementary note 1)
Whether or not communication between the computer and an authentication device having registration information regarding the availability of a plurality of external storage media including the external storage medium is possible when an external storage medium capable of exchanging information with the computer is detected Determine
If communication with the authentication device is possible, identification information for identifying the external storage medium is transmitted to the authentication device,
Receiving authentication information related to the availability of the external storage medium from the authentication device;
Based on the authentication information, the identification information is stored in a storage unit,
A determination program characterized by causing each process to determine whether or not the external storage medium can be used with reference to the storage unit when communication with the authentication apparatus is not possible.

(Additional remark 2) The process stored in the said memory | storage part stores the usability information which shows the usability of the said external storage medium, and the said identification information in the said memory | storage part,
The determination program according to appendix 1, wherein the process for determining availability is determined based on the availability information corresponding to the detected identifier of the external storage medium.

(Additional remark 3) The process stored in the said memory | storage part stores the said identification information in the said memory | storage part, when the information which judges that the said external storage medium can be used is contained in the said authentication information,
The determination according to appendix 1, wherein the process of determining whether or not the use is possible determines that the external storage medium is usable when the identifier of the detected external storage medium exists in the storage unit. program.

(Supplementary Note 4) The authentication information further includes information on a usage period related to a period during which the external storage medium can be used,
The process of storing in the storage unit stores the identification information of the external storage medium in association with the usage period in the storage unit,
In the process of determining whether or not the external storage medium is newly detected, the date and time when the external storage medium is newly detected with reference to the storage unit corresponds to the identification information of the external storage medium. Appendix 3 is characterized in that it is determined that the external storage medium can be used if it is included in the attached use period, and that the external storage medium is determined to be unusable if it is not included in the use period. The determination program described.

(Supplementary note 5)
If the external storage medium is usable as a result of receiving the authentication information in the process of receiving the authentication information, if the identification information of the external storage medium is in the storage unit, it is associated with the identification information. The determination program according to appendix 3 or 4, further comprising executing a process of updating the usage period to a usage period extended by a predetermined period by the authentication device.

(Appendix 6)
If the external storage medium is unusable as a result of receiving the authentication information in the process of receiving the authentication information, if the identification information of the external storage medium is in the storage unit, the identification information of the external storage medium The determination program according to any one of appendices 3 to 5, further comprising executing a process of deleting from the storage unit.

(Appendix 7) When an external storage medium capable of exchanging information with a computer is detected, the computer can communicate with an authentication apparatus having registration information regarding the availability of a plurality of external storage media including the external storage medium A first determination unit for determining whether or not
A transmitter that transmits identification information for identifying the external storage medium to the authentication device when communication with the authentication device is possible;
A receiving unit that receives authentication information related to availability of the external storage medium from the authentication device;
A storage unit that stores the identification information in a storage unit based on the authentication information;
A determination device comprising: a second determination unit that refers to the storage unit and determines whether or not the external storage medium can be used when communication with the authentication device is not possible.

(Additional remark 8) The said storage part stores the usability information which shows the usability of the said external storage medium, and the said identification information in the said memory | storage part,
The determination apparatus according to appendix 7, wherein the second determination unit makes a determination based on the usability information corresponding to the detected identifier of the external storage medium.

(Supplementary Note 9) When the authentication information includes information for determining that the external storage medium can be used, the storage unit stores the identification information in the storage unit,
The determination apparatus according to appendix 7, wherein the second determination unit determines that the external storage medium can be used when the detected identifier of the external storage medium exists in the storage unit. .

(Supplementary Note 10) The authentication information further includes information on a usage period related to a period during which the external storage medium can be used,
The storage unit stores the identification information of the external storage medium and the usage period in the storage unit in association with each other,
When the external storage medium is newly detected, the second determination unit refers to the storage unit and associates the date and time when the external storage medium is newly detected with the identification information of the external storage medium. The appendix 9 is characterized in that the external storage medium is determined to be usable when included in the specified use period, and is determined to be unusable when not included in the use period. Judgment device.

(Supplementary Note 11) If the external storage medium is usable as a result of receiving the authentication information by the reception unit, if the identification information of the external storage medium exists in the storage unit, it is associated with the identification information. The determination apparatus according to appendix 9 or 10, further comprising an update unit that updates the use period to a use period extended by a predetermined period by the authentication apparatus.

(Supplementary Note 12) If the external storage medium is unusable as a result of receiving the authentication information by the reception unit, and the identification information of the external storage medium is in the storage unit, the identification information of the external storage medium The determination apparatus according to any one of appendices 9 to 11, further comprising a deletion unit that deletes the information from the storage unit.

10 Network 100 Determination Device 101 Input Device 102 Output Device 103 Drive Device 110 Communication Control Unit 120 Storage Unit 121 History DB
130 Control Unit 131 Detection Unit 132 Inquiry Unit 133 Determination Unit 134 History Update Unit 300 Computer 301 CPU
302 Input Device 303 Monitor 304 Medium Reading Device 305 Interface Device 306 Wireless Communication Device 307 RAM
308 Hard disk device 309 Bus

Claims (6)

On the computer,
Whether or not communication between the computer and an authentication device having registration information regarding the availability of a plurality of external storage media including the external storage medium is possible when an external storage medium capable of exchanging information with the computer is detected Determine
If communication with the authentication device is possible, identification information for identifying the external storage medium is transmitted to the authentication device,
Receiving authentication information related to the availability of the external storage medium from the authentication device;
Based on the authentication information, the identification information is stored in a storage unit,
A determination program characterized by causing each process to determine whether or not the external storage medium can be used with reference to the storage unit when communication with the authentication apparatus is not possible. The process of storing in the storage unit stores, in the storage unit, availability information indicating availability of the external storage medium and the identification information,
The determination program according to claim 1, wherein the process for determining availability is determined based on the availability information corresponding to the detected identifier of the external storage medium. The process of storing in the storage unit stores the identification information in the storage unit when the authentication information includes information that determines that the external storage medium can be used.
2. The process according to claim 1, wherein the process for determining whether or not the use is allowed determines that the external storage medium can be used when the identifier of the detected external storage medium exists in the storage unit. Judgment program. The authentication information further includes information on a usage period related to a period during which the external storage medium can be used.
The process of storing in the storage unit stores the identification information of the external storage medium in association with the usage period in the storage unit,
In the process of determining whether or not the external storage medium is newly detected, the date and time when the external storage medium is newly detected with reference to the storage unit corresponds to the identification information of the external storage medium. 4. The external storage medium is determined to be usable when it is included in the attached use period, and the external storage medium is determined to be unusable when it is not included in the use period. Judgment program described in 1. In the computer,
If the external storage medium is usable as a result of receiving the authentication information in the process of receiving the authentication information, if the identification information of the external storage medium is in the storage unit, it is associated with the identification information. 5. The determination program according to claim 3, further comprising executing a process of updating the usage period to a usage period extended by a predetermined period by the authentication device. When an external storage medium capable of exchanging information with a computer is detected, whether or not the computer and an authentication device having registration information regarding the availability of a plurality of external storage media including the external storage medium can be communicated A first determination unit for determining;
A transmitter that transmits identification information for identifying the external storage medium to the authentication device when communication with the authentication device is possible;
A receiving unit that receives authentication information related to availability of the external storage medium from the authentication device;
A storage unit that stores the identification information in a storage unit based on the authentication information;
A determination device comprising: a second determination unit that refers to the storage unit and determines whether or not the external storage medium can be used when communication with the authentication device is not possible.

Images