JP4030936B2 - External storage device - Google Patents

Description

  The present invention relates to an external storage device, and more particularly to an external storage device that protects stored data by authenticating a user who accesses the storage device.

  As external storage devices having an interface (USB, IEEE 1394, etc.) that can be hot-plugged even in an operable state have become smaller and more portable, data sharing between information processing devices has become easier. However, since anyone can easily carry and use it, data in the external storage device can be easily altered or stolen.

Such a situation can be avoided by taking measures such as encrypting the data to be stored, but it cannot be used in an information processing apparatus that does not have a function for decrypting , and convenience is impaired. There is an inconvenience.

  That is, since data protection is intended only for a specific information processing device, when data protection in an external storage device is performed, it is necessary to provide a data protection function for all information processing devices in a connection relationship ( For example, see Patent Document 1.)

JP 2001-154918 A (pages 2 and 3, FIG. 1)

  As described above, conventional external storage devices often include means for protecting stored data on the side of the information processing device, so when multiple information processing devices are connected to one external storage device, Data protection measures must be provided in the information processing apparatus.

  An object of the present invention is to provide data protection in a storage device by providing a function on the storage device side for authenticating the user of the external storage device and ensuring the security of the stored data in order to improve the above drawbacks. It is to provide an external storage device to be realized.

An external storage device according to the present invention connects a storage device and the information processing device by identifying a user who accesses the storage device in a storage device provided with an interface that can be hot-plugged into or removed from any information processing device. An authentication mechanism for determining whether or not the authentication mechanism includes an input mechanism for receiving authentication data for identifying a user of the storage device, and the authentication data received by the input mechanism. An authentication comparison mechanism that determines whether or not to connect a storage device to the information processing device, and a connection control mechanism that controls connection between the storage device and the information processing device according to the determination of the authentication comparison mechanism, The authentication comparison mechanism determines a means for setting a plurality of the authentication data for granting use permission and whether or not the input authentication data can be connected to the storage device. Characterized in that it comprises a stage.
Further, in the external storage device of the present invention, the hot-pluggable interface is a USB interface.

Furthermore, in the external storage device of the present invention, the input mechanism is a numeric input device using a numeric keypad, and realizes an ID number authentication function using numeric characters.
Further, the external storage device of the present invention is a storage device having an interface that can be hot-plugged into and removed from any information processing device, and identifies the user who accesses the storage device to connect the storage device and the information processing device. Determining whether to connect, further comprising an authentication mechanism for converting data transferred between the storage device and the information processing device based on a preset conversion rule, the authentication mechanism, An input mechanism for receiving authentication data for identifying a user of the storage device, and an authentication comparison for determining whether to connect the storage device to the information processing device based on the authentication data received by the input mechanism A connection control mechanism for controlling the connection between the storage device and the information processing device in accordance with the determination of the authentication comparison mechanism, and a conversion rule set in advance. A security mechanism for converting data transferred between the storage device and the information processing device, wherein the authentication comparison mechanism sets means for setting a plurality of the authentication data to be used, and the input Means for determining whether or not the authentication data can be connected to the storage device .
Furthermore, in the external storage device of the present invention, the security mechanism includes a data conversion rule setting mechanism that generates a data conversion rule based on authentication data input from the input mechanism, the storage device, and the information processing device. And a data conversion mechanism for converting data exchanged between them according to the data conversion rules.

  That is, the present invention protects data in an external storage device by adding a user authentication function to an external storage device having a hot-pluggable interface (USB, IEEE 1394, etc.). Further, by adding an authentication function to the external storage device side, data protection in the external storage device can be performed without adding a special function to the information processing device side.

  The external storage device according to the present invention has the following remarkable effects.

  The first effect is that the external storage device with an authentication function of the present invention is recognized as a simple external storage device from the viewpoint of the information processing device, and therefore does not require a special function for data protection in the information processing device.

  The second effect is that no special function is required for the information processing apparatus, so that it can be used regardless of the OS and model, and data protection can be performed without impairing the convenience of carrying.

  The third effect is that access to the external storage device from an unauthorized user is electrically blocked, so unnecessary access is reduced and data destruction is reduced.

  The fourth effect is that the authentication mechanism operates independently and does not add a function to the external storage device itself. Therefore, the present invention can be easily applied to various external storage devices by combining the existing external storage device and the authentication mechanism. Can be realized.

  The fifth effect is that the power required for the authentication mechanism can be supplied from the bus, so that a dedicated power supply device can be omitted.

  The present invention will be described below with reference to the drawings.

  FIG. 1 is a block diagram showing a first embodiment of the present invention. In the figure, an external storage device (an external storage device with an authentication function) 102 according to the present invention provides a user who accesses the storage device 107 in a storage device 107 provided with an interface that can be hot-plugged into and removed from any information processing device 101. An authentication mechanism 106 is provided that identifies and determines whether to connect the storage device and the information processing device.

  Here, the authentication mechanism 106 includes an input mechanism 105 that accepts authentication data for identifying a user of the storage device, and the storage device based on the authentication data received by the input mechanism. An authentication comparison mechanism 104 that determines whether or not to connect to the computer, and a connection control mechanism 103 that controls connection between the storage device and the information processing device in accordance with the determination of the authentication comparison mechanism.

  FIG. 2 is a configuration diagram showing a specific example of the external storage device.

  In FIG. 2, an information processing device 201 and a USB storage device with ID authentication function (hereinafter referred to as this device) 202 are connected by a USB interface. That is, the USB connector 208 and the authentication mechanism 206 in the apparatus 202, and the authentication mechanism 206 and the storage device 207 are also connected by the USB interface.

  The authentication mechanism 206 starts operating when power is supplied to the USB interface.

  The input mechanism 205 is a numeric keypad, and inputs authentication data by numbers from the user.

  Note that various input methods such as a keyboard, a fingerprint authentication mechanism, and a pen input are conceivable as the input mechanism. Here, a numerical input type input mechanism is used.

  The authentication comparison mechanism 204 determines whether or not the use of the storage device 207 should be permitted from the authentication data input from the input mechanism 205 and issues a connection permission / prohibition instruction of the connection control mechanism 203.

  The connection control mechanism 203 controls the connection between the information processing device 201 and the storage device 207, and stores information and the information processing device 201 after the power is turned on until an instruction to permit the connection is issued from the authentication comparison mechanism 204. The devices 207 are kept in an unconnected state, and when there is a connection permission instruction from the authentication comparison mechanism 204, the information processing device 201 and the storage device 207 are connected. Once in the connected state, the connected state is maintained until the connection instruction from the authentication comparison mechanism 204 is canceled or the power supply to the authentication mechanism 206 is cut off.

  The storage device 207 is a storage device in a format that conforms to the USB storage standard.

  In the above embodiment, the case where there is one storage device 207 is shown, but a configuration in which a plurality of storage devices are connected to the authentication mechanism is also possible. In this case, the connection control mechanism is configured so that the storage device to be used can be selected based on the input authentication data.

  In this embodiment, the authentication mechanism 206 is configured to be supplied with power from the USB interface. However, it is also possible to receive power from an external power source. In that case, the power supply from the USB interface is used as an operation trigger of the authentication mechanism 206.

  Further, the authentication mechanism 206 and the storage device 207 are configured as independent devices, and can be used in combination as necessary.

  FIG. 3 is an explanatory diagram showing the state transition of the external storage device (USB storage device with ID authentication function) shown in FIG.

  Here, an example of a 4-digit ID number is shown as the authentication data (hereinafter, the authentication data is referred to as an ID number). In addition, a case where the ID number permitted to be used is “3232” will be described.

  When this apparatus 202 is connected to the information processing apparatus 201 being energized, power is supplied from the information processing apparatus 201 to the authentication mechanism 206 through the USB interface (301). The authentication mechanism 206 starts the operation with the power supply from the USB bus as a trigger and shifts to a state of waiting for the input of the ID number from the user (302).

  At this time, the connection control mechanism 203 is in an unconnected state, and the information processing apparatus 201 and the storage device 207 are not connected. Therefore, the information processing apparatus 201 recognizes that there is no connected USB device.

  Here, when the ID number “1192” is input from the input mechanism 205, it is determined whether or not the input ID number “1192” is an ID number that is permitted to use the storage device 207 by the authentication comparison mechanism 204. (303).

  In the case of the present embodiment, since the ID number permitted to be used is “3232”, the authentication comparison mechanism 204 determines that the ID number is not the permitted ID number and discards the input ID number “1192”. Then, the process returns to the ID number input waiting state again (305).

  When the ID number “3232” permitted is input from the input mechanism 205, the authentication comparison mechanism 204 determines that the ID number permitted to be used is input, and sends the information processing apparatus 201 to the connection control mechanism 203. And the storage device 207 are instructed to be connected (304).

  The connection control mechanism 203 sets a connection state between the information processing apparatus 201 and the storage apparatus 207 that are not connected in accordance with an instruction from the authentication comparison mechanism 204. When the connection control mechanism 203 is in the connected state, the information processing apparatus 201 detects the connection of the storage apparatus 207, and the storage apparatus 207 is recognized by the information processing apparatus 201 in accordance with the USB hot plug (plugging in / out while power is on) specification. The device 207 can be used (306).

  When the apparatus 202 is removed from the information processing apparatus 201, the power supply from the USB is lost, and the connection control mechanism 203 returns to the unconnected state (308). For this reason, authentication work is required when the apparatus 202 is connected again.

  Also, when the power supply from the USB interface to the authentication mechanism 206 is stopped, such as when the information processing apparatus 201 shifts to the power saving state, the connection control mechanism 203 shifts to the unconnected state (309). Therefore, authentication work is required again at the time of return.

  Therefore, when the information processing apparatus 201 is not used for a predetermined time, the use of the storage device 207 is prohibited, and data protection such as when the user is away from the seat is possible.

FIG. 4 is a block diagram showing a second embodiment of the present invention. In the figure, an external storage device (external storage device with security function 402) 406 according to the present invention is a user who accesses the storage device in a storage device 407 having an interface that can be hot-plugged into and removed from any information processing device 401. To determine whether or not to connect the storage device and the information processing device, and to transfer data transferred between the storage device and the information processing device based on a preset conversion rule An authentication mechanism 406 for conversion is provided.
Here, the authentication mechanism 406 includes an input mechanism 405 that receives authentication data for identifying a user of the storage device, and the storage device based on the authentication data received by the input mechanism. Based on an authentication comparison mechanism 404 that determines whether or not to connect, a connection control mechanism 403 that controls the connection between the storage device and the information processing device according to the determination of the authentication comparison mechanism, and a preset conversion rule And a security mechanism 408 for converting data transferred between the storage device and the information processing device.
Further, the security mechanism 408 is exchanged between the data conversion rule setting mechanism 410 that generates a data conversion rule based on the authentication data input from the input mechanism, and the storage device and the information processing device. A data conversion mechanism 409 for converting data according to the data conversion rule.

  In the external storage device shown in FIG. 1 or FIG. 2, only the use permission / prohibition of the storage device can be set by authentication. However, by adding a security mechanism 408 as shown in FIG. Protection can be performed.

  In FIG. 4, the security mechanism 408 includes a data conversion mechanism 409 and a data conversion rule setting mechanism 410. The security mechanism 408 is installed between the information processing apparatus 401 and the connection control mechanism 403 or between the connection control mechanism 403 and the storage device 407. In this embodiment, it is added between the information processing apparatus 401 and the connection control mechanism 403.

  The data conversion mechanism 409 monitors input / output data exchanged between the information processing device 401 and the storage device 407, and performs data conversion in accordance with a data conversion rule. The data conversion rule setting mechanism 410 generates a data conversion rule based on the input authentication data, and instructs the data conversion mechanism 409 about the data conversion rule.

  FIG. 5 is an explanatory diagram showing state transition of the external storage device (external storage device with security function) shown in FIG.

  In this case, it is assumed that a 4-digit ID number is used for the authentication data, and “3232” and “9876” are set as the ID numbers permitted for use.

  When the external storage device 402 with a security function is connected to the information processing device 401 that is energized, power is supplied from the information processing device 401 to the authentication mechanism 406 through the connection interface (601). The authentication mechanism 406 starts operation with this power supply as a trigger, and shifts to a state waiting for input of an ID number from the user (602).

  If the ID number “3232” is input from the input mechanism 405, it is determined whether or not the ID number is permitted by the authentication comparison mechanism 404 (603). Since the ID number “3232” is a permitted ID number, the authentication comparison mechanism 404 notifies the data conversion rule setting mechanism 410 of the ID number “3232” in order to set security (604).

  The data conversion rule setting mechanism 410 generates a data conversion rule based on the ID number. In the present embodiment, for easy explanation, 0 × 01 is added to the input data to the storage device 407 as the data conversion rule when the ID number is “3232” and 0 × 01 is added when “9876”. It is assumed that a rule for subtracting from the output data is generated. Here, since the input ID number is “3232”, 0 × 01 is a value for adjusting the input / output data.

  FIG. 6 shows an example of data conversion when the character string data “USB” is stored / read out to / from the storage device 407 when the ID number “3232” is authenticated.

  In the figure, when there is a storage request for character string data of “USB” in the storage device 407, the data conversion mechanism 409 causes the “USB” (ANSI character code 0 × 55, 0 × 53, 0 × 42) according to the data conversion rule. ) Is added to each data, converted into “VTC” (0 × 56, 0 × 54, 0 × 43) and stored in the storage device 407. Conversely, when calling, "VTC" is converted to "USB" and restored.

  The data conversion rule is notified from the data conversion rule setting mechanism 410 to the data conversion mechanism 409 (604).

  When the data conversion rule is notified, the data conversion mechanism 409 starts monitoring the input / output data to the storage device 407 and starts the operation to convert the input / output data according to the conversion rule.

  The authentication comparison mechanism 404 instructs the connection control mechanism 403 to connect the information processing apparatus 401 and the storage apparatus 407 when the setting of the security mechanism 408 is completed and the data conversion mechanism 409 starts operating. The connection control mechanism 403 connects the information processing device 401 and the storage device 407 (610).

  When the connection control mechanism 403 is in the connected state, the information processing apparatus 401 recognizes that the storage device 407 is connected, and performs recognition processing according to the hot plug (plugging in / out while power is on) specification (606).

  The input / output data to the storage device 407 after the recognition is converted by the conversion mechanism 409 according to the data conversion rule. By performing this data conversion, the contents of the stored data can be concealed for users with different authentication data.

  For example, as shown in FIG. 6, “USB” stored at the time of authentication with ID number “3232” is converted to “TRA” when it is read with authentication with ID number “9876”, and is read as data that cannot be understood. .

  In addition, even when the storage device 407 is extracted and directly connected to the information processing device 401, the data stored in the data is converted (the data of “USB” stored with the ID number “3232” is Therefore, the data contents cannot be understood by a normal procedure, and theft of the data can be prevented.

  In the above embodiment, the rule for adding / subtracting a value in the input / output data as the data conversion rule has been described for the sake of simplicity. It is feasible.

  In addition, by converting a request to the storage device itself as a data conversion rule, it becomes possible to make only a specific folder accessible or to perform access control so that only data can be read.

  Note that the security mechanism 408 described in FIG. 4 may be built in as a function of the storage device 407.

  Since the user of the external storage device can be authenticated on the external storage device side, the external storage device can be provided with a user-specific key. Further, theft of data can be prevented by converting and storing the data by an ID number or the like. Therefore, a special effect is expected for data protection of external storage devices that are becoming smaller and more portable.

The block diagram which shows the 1st form of implementation of this invention. The block diagram which shows the specific example of a 1st form. Explanatory drawing which shows the state transition of the specific example of a 1st form. The block diagram which shows the 2nd embodiment of this invention. Explanatory drawing which shows the state transition of a 2nd form. Explanatory drawing which shows the data conversion example by ID number.

Explanation of symbols

101, 201, 401 Information processing device 102 External storage device with authentication function 103, 203, 403 Connection control mechanism 104, 204, 403 Authentication comparison mechanism 105, 205, 405 Input mechanism 106, 206, 406 Authentication mechanism 107, 207, 407 Storage device 202 USB storage device with ID authentication function 208 USB connector 402 External storage device with security function 408 Security mechanism 409 Data conversion mechanism 410 Data conversion rule setting mechanism

Claims (4)

In a storage device having an interface that can be hot-plugged into or removed from any information processing device,
A user who accesses the storage device is identified to determine whether to connect the storage device and the information processing device, and the storage device and the information based on a conversion rule set for each authentication data An authentication mechanism for converting data transferred to and from the processing device;
The authentication mechanism receives an authentication data for identifying a user of the storage device, and whether to connect the storage device to the information processing device based on the authentication data received by the input mechanism Based on a conversion rule set for each of the authentication data , an authentication comparison mechanism for determining whether or not, a connection control mechanism for controlling the connection between the storage device and the information processing device according to the determination of the authentication comparison mechanism A security mechanism that performs conversion when data transferred between the storage device and the information processing device is stored in or read from the storage device ;
The authentication comparison mechanism comprises an external storage comprising means for setting a plurality of the authentication data for granting use permission, and means for determining whether or not the input authentication data can be connected to the storage device. apparatus. 2. The external storage device according to claim 1, wherein the hot-pluggable interface is a USB interface. 3. The external storage device according to claim 1, wherein the input mechanism is a numeric input device using a numeric keypad, and realizes an ID number authentication function using numbers. 2. The external storage device according to claim 1, wherein the security mechanism includes a data conversion rule setting mechanism that generates a data conversion rule based on authentication data input from the input mechanism, the storage device, and the information processing device. An external storage device comprising: a data conversion mechanism that converts data exchanged between the devices according to the data conversion rule.

Images