JP4945669B2 - Data processing control method, information processing apparatus, and data processing control system - Google Patents

Description

  The present invention relates to a data processing control method, an information processing apparatus, and a data processing control system for protecting a user terminal from writing to a secondary storage device and prohibiting writing to an external medium.

Conventionally, when a confidential file is stored in the secondary storage device of the user terminal, there is a method for controlling the export of confidential data by encrypting and storing the file. In this method, even if a file is taken out, the information itself is not taken out because it is encrypted. For example, in Patent Document 1, an automatic file encryption system that is highly convenient for the user is realized by interrupting the file I / O processing of the OS and automatically performing encryption / decryption processing.
For example, there is a method for performing confidential file editing and preventing information leakage by controlling access to a removable device or a printing device.

JP-A-11-149414

However, if a confidential file such as customer information is encrypted and stored in the mobile PC and lost, there is an unacceptable social trend simply because there is no risk of leakage of confidential information because it is encrypted. If a company loses an encrypted file, the company must announce that it has been lost, and it will be severely criticized socially, which may endanger corporate life. For this reason, there is a great need for a personal computer that is at risk of being lost, such as a mobile PC, even if the confidential information is used / viewed but not stored. However, the automatic file encryption system disclosed in Patent Document 1 cannot meet this need.
The present invention has been made in view of such circumstances, and provides a mechanism that enables more secure information reference.

  In order to solve the above-described problem, in the present invention, the OS and the application are in the user terminal. Regarding the data writing of the OS and the application, the difference between the writing is hooked by the filter driver which is the kernel module of the OS, A mechanism for saving to the server is provided. As a result, the OS or application appears to be writing data to the local disk, but in practice it can be forcibly saved on the server at the network destination. By adopting such a mechanism, it is not necessary to manually upload a locally created file to the server as compared to a method that simply caches in memory and prohibits writing to the secondary storage device. Confidential data can be automatically collected on the server in the same usage form. Also, system updates that should be originally saved, such as application settings and OS patches, are saved on the server side, and there is no need to prepare a special update mode.

  That is, the present invention relates to a data processing control method for a secondary storage device in an information processing device including a secondary storage device, which is implemented in the information processing device and provided in a lower layer of a file system in the information processing device. The obtained secondary storage device control means acquires a processing request to the secondary storage device by an arbitrary application operating in the information processing device via the file system, and when this processing request is a data write request, Instead of executing the writing process to the secondary storage device, the writing process to the volatile memory is executed, and the secondary storage device control means reads from the secondary storage device when the processing request is a data reading request. When the target data is read and the change data obtained by changing the read target data exists in the volatile memory, Read change data from sexual memory, presented by overwriting the modified data to the read target data.

  The present invention also relates to a data processing control method for a secondary storage device in an information processing device including a secondary storage device and a volatile memory. The data processing control method is implemented in the information processing device and includes a file system in the information processing device. The secondary storage device control means provided in the lower layer acquires a processing request to the secondary storage device by an arbitrary application operating in the information processing device via the file system, and this processing request is a data read request. If there is a change, the read data is read from the secondary storage device and the change data obtained by changing the read data is present in the volatile memory. The change data is read from the data, and the change data is overwritten on the data to be read and presented.

  Furthermore, the present invention is a data processing control method for a secondary storage device in a first information processing device having a secondary storage device and a volatile memory, the file access being implemented in the first information processing device The control means acquires a processing request to the secondary storage device by an arbitrary application operating in the first information processing apparatus, determines the request content, and the file or folder that is the target of this processing request is the network destination If it is to be transferred to the second information processing apparatus, it is transferred to the second information processing apparatus. If the file or folder that is the target of the processing request is not to be transferred to the second information processing apparatus, it is mounted on the first information processing apparatus and provided in a lower layer of the file system in the information processing apparatus. The secondary storage device control means acquires a processing request via the file system and performs a write process with the volatile memory instead of executing a write process to the secondary storage device. The secondary storage device control means reads the data to be read from the secondary storage device when the processing request is a data read request, and changes obtained by changing the data to be read When the data exists in the volatile memory, the changed data is read from the volatile memory, and the changed data is overwritten on the data to be read and presented.

  The present invention is an information processing apparatus including a secondary storage device, a secondary storage device control means for controlling processing for the secondary storage device, and a volatile memory, and the secondary storage device control means includes information The secondary storage device control means provided in the lower layer of the file system in the processing device acquires a processing request to the secondary storage device by an arbitrary application operating in the information processing device via the file system, and When the processing request is a data write request, the write processing to the volatile memory is executed instead of executing the write processing to the secondary storage device. Further, when the processing request is a data read request, the secondary storage device control means reads the data to be read from the secondary storage device and changes obtained by changing the data to be read. When the data exists in the volatile memory, the changed data is read from the volatile memory, and the changed data is overwritten on the read target data and presented.

  The present invention also controls a secondary storage device, file access control means for controlling file access to the secondary storage device and a server connected via the network, and processing for the secondary storage device. And a volatile memory, and the secondary storage device control means is provided in a lower layer of the file system in the information processing apparatus, and the file access control means When a processing request to the secondary storage device by an arbitrary application operating on the processing device is acquired and the request content is determined, and the file or folder that is the target of this processing request is to be transferred to the network destination server And forward to the server. If the file or folder that is the target of the processing request should not be transferred to the server, the secondary storage device control means acquires the processing request via the file system and executes the write processing to the secondary storage device. Instead, write processing is performed with the volatile memory. When the processing request is a data read request, the secondary storage device control means reads the data to be read from the secondary storage device and changes the data to be read. When the change data exists in the volatile memory, the change data is read from the volatile memory, and the change data is overwritten on the data to be read and presented.

  Furthermore, the present invention is a data processing control system for performing data write control, comprising an information processing device and a server connected to the information processing device via a network, wherein the information processing device is a secondary storage device And a secondary storage device control means for controlling processing on the secondary storage device, an external storage medium write control means, and a volatile memory. The secondary storage device control means is provided in a lower layer of the file system in the information processing apparatus, and the external storage medium write control means is connected to the portable external storage medium used by being connected to the information processing apparatus. Write processing of data stored in the secondary storage device and data obtained by changing the data is prohibited. The secondary storage device control means acquires a processing request to the secondary storage device by an arbitrary application operating in the information processing device via the file system, and when this processing request is a data write request Executes a write process to a volatile memory instead of executing a write process to a secondary storage device. Further, the secondary storage device control means stores the data written in the volatile memory in the server.

  The present invention also provides a data processing control system for performing file writing control, comprising an information processing device and a server connected to the information processing device via a network, the information processing device being a secondary storage device A file access control means for controlling file access to the server and the secondary storage device, a secondary storage device control means for controlling processing on the secondary storage device, an external storage medium write control means, It has volatile memory. The secondary storage device control means is provided in a lower layer of the file system in the information processing apparatus, and the external storage medium write control means is connected to the portable external storage medium used by being connected to the information processing apparatus. Write processing of data stored in the secondary storage device and data obtained by changing the data is prohibited. Further, the file access control means acquires a processing request to the secondary storage device by an arbitrary application operating on the information processing apparatus, determines the request content, and the file or folder that is the target of the processing request is the network destination. If it should be transferred to another server, it is transferred to the server. If the file or folder that is the target of the processing request is not to be transferred to the server, the secondary storage device control means obtains the processing request via the file system and executes the writing process to the secondary storage device Write processing to and from volatile memory.

  Furthermore, the present invention is an information processing apparatus comprising a secondary storage device, an external storage medium write control means, a secondary storage device control means for controlling processing for the secondary storage device, and a volatile memory, The external storage medium writing control means writes data stored in the secondary storage device and data obtained by changing the data to a portable external storage medium connected to the information processing device. The secondary storage device control means is provided in a lower layer of the file system in the information processing device, and the secondary storage device control means performs processing to the secondary storage device by an arbitrary application operating in the information processing device. Get the request through the file system. If this processing request is a data write request, the secondary storage device control means executes the write processing to the volatile memory instead of executing the write processing to the secondary storage device. Data written in the memory is stored in a server connected to the information processing apparatus via the network.

  The present invention also provides a secondary storage device, an external storage medium write control means, a file access control means for controlling file access to a secondary storage device and a server connected via a network, A secondary storage device control means for controlling processing for the storage device, and an information processing device comprising a volatile memory, wherein the secondary storage device control means is provided in a lower layer of the file system in the information processing device, The external storage medium writing control means writes data stored in the secondary storage device and data obtained by changing the data to a portable external storage medium connected to the information processing device. Ban. Then, the file access control means acquires a processing request to the secondary storage device by an arbitrary application operating in the information processing device, determines the request content, and the file or folder that is the target of this processing request is the network destination. If it should be transferred to another server, it is transferred to the server. If the file or folder that is the target of the processing request is not to be transferred to the server, the secondary storage device control means obtains the processing request via the file system and executes the writing process to the secondary storage device In addition, a writing process is performed with the volatile memory.

  Further features of the present invention will become apparent from the best mode for carrying out the present invention and the accompanying drawings.

  According to the present invention, it is possible to realize a mechanism that makes it possible to refer and edit confidential information more securely.

It is a figure which shows the structure of the data processing control system by the 1st Embodiment of this invention. 1 is a diagram illustrating an internal architecture of a system according to a first embodiment of the present invention. It is the figure which showed the schema of the primary cache management table. It is the figure which showed the schema of the secondary cache management table. It is a flowchart for demonstrating the process of the secondary storage device write control driver at the time of user terminal starting. It is a flowchart for demonstrating the process of the secondary storage device write control driver at the time of file access. It is a flowchart for demonstrating the process in the case of caching data. It is a flowchart for demonstrating the process in the case of taking out data from a cache. It is a figure which shows the structure of the data processing control system by the 2nd Embodiment of this invention. FIG. 5 is a diagram illustrating an internal architecture of a system according to a second embodiment of the present invention. It is a flowchart for demonstrating the process of the file access control driver at the time of file access. It is a flowchart for demonstrating the process of the secondary storage device write control driver at the time of file access.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. In addition, embodiment by this invention is only an example in implement | achieving this invention, and this invention is not limited by this.

  As described above, the present invention provides a mechanism that makes it possible to refer and edit confidential information more securely. Therefore, in this embodiment, in addition to preventing the loss of confidential information, automatic aggregation of confidential data to a server and a function of saving application and OS settings and updates without changing the usage form are realized.

<First Embodiment>
FIG. 1 is a system configuration diagram according to the first embodiment of the present invention. The system includes a user terminal 101 and a cache server 102, and each is connected via a network 103. The user terminal 101 is an existing PC and is equipped with a memory 110 and a secondary storage device (for example, a hard disk drive HDD) 109. The OS 105, an application 106, an external medium write control driver 107, and a secondary storage device write control driver 108 are installed. Is installed. Here, the application 106 is not a specific one but means any existing application.

  For example, the user activates the OS 105 on the user terminal 101 and edits confidential data using the application 106. When saved locally after editing, the data is cached in the memory 110 (primary cache) by the secondary storage device write control driver 108, periodically sent to the cache server 102, and saved as a cache data file 104. The Therefore, no data is stored in the secondary storage device 109, and confidential data is collected in the cache server 102. That is, the secondary storage device write control driver 108 permits reading of data in the secondary storage device, but prohibits writing of data therein. As will be described in detail later, when a write command is issued, the differential data is cached in the memory 110 instead of writing the data in the secondary storage device 109. Here, the difference data refers to a difference between the original data in the secondary storage device 109 and the changed data. By this process, it appears to the user that the changed data is stored in the secondary storage device (pseudo-stored in the secondary storage device), but is not actually stored in the secondary storage device 109. It is stored in the primary cache 110 or the cache server 102.

  The external medium writing control driver 107 is a module that prohibits data writing to an external medium such as a USB memory or an external hard disk. With this module, for example, data can be blocked by applying a filter driver on the USB, so that confidential data can be prevented from leaking from the user terminal to the outside.

  The cache data file 104 stored in the cache server 102 is difference data between the initial state of the secondary storage device of the user terminal (for example, the state where the OS and necessary applications have been set) and the current file configuration. Is a file that stores The state of the latest file structure is maintained by uploading a copy of the cache stored in memory periodically to the server side.

  FIG. 2 is a diagram showing an internal architecture in the first embodiment of the present invention. The OS is assumed to be Windows (registered trademark) in particular, but it is possible to realize a similar architecture in other OSs, and the invention is not limited. Windows (registered trademark) has two operation modes, a user mode 201 and a kernel mode 202. In general, the user mode 201 is a mode in which the application 106 operates, and the kernel mode 202 is a mode in which basic components constituting the OS such as a device driver operate. The file system 203 such as NTFS or FAT operates in the kernel mode 202, and the secondary storage device write control driver 108 is disposed in the lower layer. The secondary storage device write control driver 108 is a driver that prohibits writing to the secondary storage device 109, and in response to a write request (changed data storage request) transferred from the file system 203, write data Are stored in the cache server 102 in the network 205 destination in the memory 110 or via the communication driver 204.

  The cache in the memory 110 is a primary cache, and the cache on the cache server 102 is used as a secondary cache. Basically, all the write data is stored in the primary cache and periodically copied to the secondary cache. When the size of the primary cache exceeds a set threshold, the primary cache data with a low usage frequency is discarded among the data already copied to the secondary cache. By adopting such a configuration, it is possible to prevent memory overflow due to an increase in the primary cache and to perform high-speed access to the cache. Note that when copying data in the primary cache to the secondary cache, there is LRU (Least Recently Used) as an algorithm for determining a copy block, but this algorithm is arbitrary and does not particularly limit the invention. The cache server 102 is indispensable when the user terminal 101 is used in a network environment, but the primary cache 110 is not necessarily indispensable. However, the provision of the primary cache 110 eliminates the need to access the cache server 102 one by one, so that the technical effect of increasing the processing speed can be obtained. Further, when the user terminal 101 is used in a stand-alone environment that cannot be connected to the network, the primary cache 110 is indispensable.

  FIG. 3 is a diagram showing a schema of the primary cache management table. Although this table exists in the memory 110, the writing of data therein is controlled by the secondary storage device write control driver 108. In FIG. 3, the schema is composed of four attributes: a head block number 301, a data size 302, a data pointer 303, and a primary cache flag 304. The first block number 301 is the head sector address of the data on the HDD, the data pointer 303 is the address of the data in the memory (primary cache) 110, and the primary cache flag 304 contains the data in the primary cache. It is a flag indicating whether or not there is. The primary cache flag 304 is provided because the data is erased when the power is turned off and no longer exists. When booting, the desired data is in the cache server, so the presence is immediately recognized. Because it is necessary to do. The primary cache flag 304 can immediately jump to the cache server (secondary cache) 102 and acquire the data when there is no desired data in the primary cache 110, thereby speeding up the processing. Can be achieved.

  In the write / read request transmitted from the file system to the secondary storage device write control driver, the head address and size information of the block to be accessed on the secondary storage device are specified. When data write occurs, the head block address and size information of the write data are acquired from this request and registered in the primary cache management table. Then, physical memory is secured, write data is copied, and cache data is configured. In the data pointer 303, a pointer on the physical memory in which actual cache data is stored is registered. The primary cache flag 304 is a flag indicating whether or not the cache data is included in the primary cache as described above. The primary cache management table holds entries relating to all cached data, but not all data is stored in the primary cache. When this flag is TRUE, cache data exists in the memory, and the data pointer 303 is a pointer to the cache data. When the flag is FALSE, it means that the cache data is not in the primary cache but exists only in the secondary cache of the cache server, and the data pointer 303 becomes an invalid value.

  FIG. 4 is a diagram showing a schema of the secondary cache management table. This schema is composed of three attributes: a first block number 401, a size 402, and a data offset 403. The first block number 401 and the size 402 respectively indicate the first block number and size on the secondary storage device 109 of each cached data. A data offset 403 indicates a location where the entry data is stored in the cache data. The secondary cache is overwritten with the primary cache to indicate the latest cache state, and the secondary cache management table does not hold all cache data entries but is the latest state in real time. is not. However, the latest state is obtained when the primary cache is copied to the secondary cache at shutdown or periodically.

  FIG. 5 shows a flowchart of processing of the secondary storage device write control driver 108 when the user terminal is activated (the primary cache is empty at this time). When the user terminal is activated, the OS loads the secondary storage device write control driver (step S501). Next, the OS initializes a communication-related driver (step S502). In the case of Windows (registered trademark), the timing at which the OS loads the driver is determined by the registered contents of the driver. Therefore, the secondary storage device write control driver can be loaded before the communication-related driver is loaded.

  Next, the secondary storage device write control driver 108 accesses the cache server using the initialized communication driver (step S503). At this time, it is determined whether or not the cache server 102 is accessible (step S504). That is, for example, it is determined whether or not the server has been accessed by actually accessing the server (whether a network link can be attached). When the power of the cache server 102 is off, even if the service is running, if the service itself has an error, the access is impossible.

  If it is determined that access is possible, the secondary storage device write control driver 108 acquires the secondary cache table from the cache server and creates the primary cache table (step S505). When it is determined that the cache server 102 cannot be accessed, the write data is cached only in the memory 110 and the write prohibition function is operated (step S506).

  Accordingly, when the network environment is present and the cache server is activated in a state where the cache server can be accessed, the cache server is activated in a mode for saving the cache. However, if this is not the case, only the data is cached in the memory and the write data is started in a mode not synchronized with the cache server, and the write data is erased when the power is turned off.

  FIG. 6 is a flowchart of processing of the secondary storage device write control driver 108 when accessing a file existing in the secondary storage device 109. In FIG. 6, when the application accesses a file (step S601), the secondary storage device write control driver 108 acquires a write processing request from the file system (step S602). When the request is acquired, it is determined whether or not it is a writing process (step S603). If it is determined that the write process is performed, the write data (which will be described later, difference data between the changed data and the data on the HDD) is cached in the memory 110 (step S608), and the write request process is completed (step S609). .

  On the other hand, if it is determined in step S603 that the process is not a write process, the process at that time is a read process. In this case, the data is first read from the secondary storage device (step S604). Next, it is determined whether the read data is already in the memory 110 (primary cache) (step S605). If it is not in the primary cache, the read data is transferred to the file system as it is (step S607). If it is in the primary cache, the primary cache is overwritten with the read data and transferred to the file system (step S606). Specific processing contents when registering data in the cache or acquiring data from the cache will be further described with reference to FIGS.

FIG. 7 shows a flowchart of processing when data is cached. The flowchart in FIG. 7 describes step S608 in FIG. 6 in detail.
In FIG. 7, when data writing is first executed and a data cache request is generated (step S701), it is determined whether or not the write data has been cached in the memory 110 (step S702). If it is determined that it is not cached, it is registered in the primary cache on the memory 110 (step S706).

  If it is determined that the cache has been completed, an overlapping portion with the write data is searched from the cache list (primary cache management table: see FIG. 3) (step S703). If already cached, there will always be an overlap. Of the overlapping portion, the portion not in the primary cache is checked from the primary cache flag 304 of the primary cache management table and downloaded from the secondary cache (step S704). Finally, the write data is registered in the primary cache on the memory (step S705). In this registration, a process of overwriting the overlapping portion of the write data on the cache of the cache list and newly registering the other portion is executed.

FIG. 8 is a flowchart of processing when data is fetched from the cache. The flowchart in FIG. 8 describes step S605 in FIG. 6 in detail.
In FIG. 8, first, a cache read request is generated (step S801). Next, it is determined whether the read data has been cached in the memory (primary cache) 110 (step S802). If the read data is not cached, a result without cache is returned to the caller (function of the secondary storage device control driver 108) (step S806). If the read data is cached, an overlap portion between the read data and the cache exists, so the overlap portion is searched (step S803). Actually, the head block address and size information of the read data and the head block address and size information of each cache are compared to find out where the overlapping portion is already cached within the range of the read data. Next, the overlapping part that is not in the primary cache (memory 110) is downloaded from the secondary cache (cache server 102) (step S804). Finally, this overlapping portion is returned to the caller, and the process is terminated (step S805).

  By adopting the configuration as described above, all write data to the local area is stored in the cache server. In this case, installation and update of applications and OS components are all stored in the cache server. Therefore, the contents of the change are not stored locally, but are stored in the cache server, and the normal usage pattern is not impaired. Furthermore, no special update mode or the like is required for updating OS patches or virus patterns.

<Second Embodiment>
Next, a second embodiment according to the present invention will be described. In the first embodiment, when it is desired to leave data in the secondary cache, not only individual data but also system information (for example, all data of the system itself that does not depend on the user, such as a change in network settings) is left. On the other hand, in the second embodiment, the process of leaving only the data for each user in the secondary cache is executed instead of leaving all the information including the system information. Further, in the second embodiment, file-based cache processing is executed. Furthermore, since the data for each user has strong personal attributes, it is left in the secondary cache even during processing.

  FIG. 9 is a system configuration diagram according to the second embodiment of the present invention. The system has a configuration in which a user terminal 901 is connected to a file server 902 via a network 903. The user terminal 901 includes a memory 911 and a secondary storage device 910, and an OS 905, an application 906, a file access control driver 907, an external medium write control driver 908, and a secondary storage device write control driver 909 are installed. ing. The file access control driver 907 is a filter driver positioned above the file system and hooks a file I / O to perform I / O control for each file / folder. Specifically, a write / read request to a specific folder is redirected to a specified folder on the file server. For example, in the case of Windows XP (registered trademark), access requests to two folders, Documents and Settings and Program Files, are redirected to two designated folders copied to the file server 902 at the network destination. Thereby, access to these two folders is substantially access to the folder on the file server 902. As an actual implementation method, the IRP_MJ_CREATE request issued at the time of file open processing is hooked, the folder path on the file server 902 at the network destination is specified as a new path, and a STATUS_REPARSE error is returned. Function can be realized. The secondary storage device write control driver 909 has a function of caching write data in the memory 911 when there is a write request, searching the cache at the time of a read request, merging the overlapped portion, and returning it to the file system. It is a filter driver. Unlike the case of the first embodiment, this filter driver has a function of simply caching in the memory 911 and prohibits writing to the secondary storage device 910, but the write data is erased when the power is turned off. The Therefore, writing to a file in a folder that has not been redirected to the file server 902 by the file access control driver 907 is prohibited by the secondary storage device write control driver 909.

  FIG. 10 is a diagram showing an internal architecture in the second embodiment of the present invention. The OS of the user terminal 902 is divided into two operation modes: a user mode 1001 and a kernel mode 1002. The user mode 1001 is an application 906, the kernel mode 1002 is a file access control driver 907, a file system 1003, and a secondary storage device. The write control driver 909 and the communication driver 1004 are operating. The file access control driver 907 is a higher-level filter driver of the file system, and monitors the file I / O and performs redirection processing.

  The secondary storage device write control driver 909 is located in the lower part of the file system, and caches write data in the memory 911 in response to a file access request from the upper part. For the read data, the cache (memory 911) is searched, and if it is not in the cache, it is read from the secondary storage device 910. If there is, the portion is read from the secondary storage device 910 and the data in the cache (memory 911) and the secondary data are read. For the overlapping portion with the data in the storage device 910, the read data is overwritten and returned to the upper file system.

  In the system having the architecture of FIG. 10, when the user terminal 901 cannot access the file server 902, it is cached in the memory 911, but when it is accessible, data is sequentially cached in the file server 902. Note that data that is not redirected to the file server 902, such as data that is not file data (for example, system information), is only cached in the memory 911, and thus is always deleted when the user terminal 901 is powered off.

  FIG. 11 shows a flowchart of processing of the file access control driver at the time of file access. First, when a file open request is received for a file stored in the secondary storage device (step S1101), the file access control driver 907 checks the access request destination file or folder name, and the access request destination file / folder. Judge whether or not it is a redirect target (step S1102).

  If it is determined in step S1102 that the file is to be redirected, a redirect destination file path is set (step S1103), and a STATUS_REPARSE error is returned (step S1104). As a result, the I / O manager performs re-analysis and re-issues an open request to the file path of the redirect destination, thereby executing file access redirection.

  If it is determined in step S1102 that it is not a redirect target, the file open request is transferred to the file system as it is (step S1105). If it is desired to save a file that is not subject to redirection, the file may be copied to the specified folder for redirection.

  FIG. 12 is a flowchart of processing of the secondary storage device write control driver 909 during file access. If the file access is not redirected to the file server 902 on the network, the write / read request is sent to the secondary storage device write control driver 909 via the file system 1003 (step S1201). Then, when the request is received, it is determined whether or not the processing request is a writing process (step S1202). In the case of the write process, the write data is cached in the memory 911 (step S1207), and the write request process is completed (step S1208). If it is determined in step S1202 that the reading process is not writing but data is read from the secondary storage device 910 (step S1203).

  Next, it is checked whether there is a cache from the head block address and the size information (step S1204). If there is no cache, the read data is transferred to the file system 1003 as it is (step S1205). When there is a cache in the memory 911, an overlapping portion between the cache data and the read data is searched, and the overlapping portion is overwritten on the read data and transferred to the file system (step S1206). With this method, writing to the secondary storage device 910 is prohibited, and write data is cached only in the memory 911. Therefore, it is possible to realize a mechanism in which the cache is erased when the power is turned off and the confidential data does not remain locally.

  As described above, in the second embodiment, the file system filter driver redirects the file server. However, in the case of a file system filter driver, since the timing of loading at the time of starting the OS is slow, if all the drives below the boot drive are redirected to the file server and an OS patch is applied, the redirect function does not work at the time of starting the OS. It can happen that a patched file is only partially loaded. Therefore, in the case of this embodiment, the OS patch must be executed in a state where the local file is updated in a writable mode state.

  The OS patch application operation by the user can be realized by providing a writable mode in which only the OS patch update operation can be performed under GUI control. For example, such an update mode can be realized by providing a GUI that stops execution of Windows (registered trademark) Shell and that can execute only batch processing for updating an OS patch from a menu button.

<Summary>
According to the embodiment described above, the secondary storage device control means mounted on the user terminal acquires a processing request to the secondary storage device by an arbitrary application, and this processing request is a data write request. In such a case, writing to the secondary storage device is prohibited, and writing processing to the volatile memory (primary cache memory) is executed instead. As a result, writing to the secondary storage device (HDD) can be prohibited to prevent leakage or loss of confidential information, and writing to the primary cache can be artificially performed instead of simply prohibiting writing to the HDD. Writing to the HDD can be performed, and processing becomes natural for the user.

  The secondary storage device control means further stores the data written in the primary cache memory in an external storage means (cache server: secondary cache) connected to the user terminal. Data stored only in the primary cache is lost when the power of the user terminal is turned off, but can be left in the server by the secondary cache. In addition, convenience can be improved because data can be managed in a server.

  Then, the secondary storage device control means is the data in the initial state of the secondary storage device (data registered and present in the HDD from the beginning) and the changed data obtained by changing the data (obtained by editing). The data is written into the primary cache memory (volatile memory). Since only the difference is stored in the memory, it is not necessary to increase the capacity of the primary cache memory. In addition, since the data is first stored in the primary cache memory and then finally stored in the cache server, there is no need to execute access to the cache server one by one, and there is an advantage that the processing speed is increased.

  When the processing request is a data read request, the read target data is read from the HDD, and the change data obtained by changing the read target data (difference data obtained by editing) ) Is read from the primary cache memory, and this changed data is overwritten on the data to be read and presented. Thereby, even if the changed data is not stored in the HDD, it can be presented to the user in the changed state. In addition, since the user can feel as if the changed data has been read from the HDD, the appearance is not different from the conventional reading process, and the user does not feel uncomfortable.

  When the user terminal is activated, the secondary storage device control means controls to access the external storage means (cache server) connected to the user terminal, and acquires attribute information of the data stored in the external storage means. The data list (primary cache management table) having the attribute information is created in the primary cache memory. The data list includes, as attribute information, an address (storage position) of the data in the HDD, a data size, and an address (storage position) in the primary cache memory. Further, the data list has information indicating whether or not the data stored in the cache server itself exists in the primary cache memory. As a result, the relationship between the original data and the changed data in the HDD can be reliably managed in the primary cache, and the data processing efficiency is improved.

  According to the second embodiment described above, the file access control means implemented in the user terminal acquires a processing request to the HDD by an arbitrary application, determines the request content, and the target of this processing request If the file or folder to be transferred is to be transferred to the file server on the network, it is transferred to the file server. If the file or folder to be processed is not to be transferred to the file server, it is mounted on the user terminal. The secondary storage device control means that acquires the processing request, prohibits the writing process to the HDD, and instead performs the writing process with the primary cache memory (volatile memory). To do. As a result, leakage and loss of confidential information can be prevented, and at the same time, automatic file aggregation to the server is possible, and the convenience of the system can be improved without changing the usage form of the user terminal. become.

  When the processing request is a data read request, the data to be read (original file data) is read from the HDD, and the change data obtained by changing the data to be read is 1 The data is read from the next cache memory, and the changed data is overwritten and presented on the data to be read. Thereby, even if the changed file data is not stored in the HDD, it can be presented to the user in the changed state. Further, since the user can feel as if the changed file data has been read from the HDD, the appearance is not different from the conventional reading process, and the user does not feel uncomfortable.

  Further, the present invention is not limited by the above-described disclosed embodiments, and can be reconfigured, modified, and substituted without departing from the scope defined by the claims.

101 ... User terminal 102 ... Cache server 103 ... Network 104 ... Cache data file 105 ... OS
106 ... Application 107 ... External medium write control driver 108 ... Secondary storage device write control driver 109 ... Secondary storage device 110 ... Memory 202 ... File system 206 ... Communication driver 207 ... User mode 208 ... Kernel mode 301 ... First block number 302 ... size 303 ... data pointer 304 ... primary cache flag 403 ... data offset 902 ... file server 904 ... confidential data 907 ... file access control driver

Claims (13)

A data processing control method for the secondary storage device in an information processing device including a secondary storage device,
The secondary storage device stores original data, and change data of the original data cannot be stored in the secondary storage device,
The secondary storage device control means implemented in the information processing device and provided in the lower layer of the file system in the information processing device is a file to the secondary storage device by any application operating in the information processing device. Process request is obtained via the file system, and if this process request is a data write request, the write process to the volatile memory is executed instead of the write process to the secondary storage device And
When the processing request is a data read request, the secondary storage device control means reads the original data to be read from the secondary storage device and changes the original data to be read. When the change data obtained in this manner exists in the volatile memory, the change data is read from the volatile memory, and the change data is overwritten on the original data to be read and presented. Data processing control method.   2. The data according to claim 1, wherein the secondary storage device control unit further stores the data written in the volatile memory in a server connected to the information processing device via a network. Processing control method.   The secondary storage device control means writes a difference between data in an initial state of the secondary storage device and post-change data obtained by changing the data to the volatile memory. 3. A data processing control method according to 1 or 2. A data processing control method for the secondary storage device in an information processing device including a secondary storage device and a volatile memory,
The secondary storage device stores original data, and change data of the original data cannot be stored in the secondary storage device,
The secondary storage device control means implemented in the information processing device and provided in the lower layer of the file system in the information processing device is a file to the secondary storage device by any application operating in the information processing device. When the processing request is a data read request, the original data to be read is read from the secondary storage device, and the original data to be read is added to the original data to be read. If the change data obtained by making a change exists in the volatile memory, the change data is read from the volatile memory, and the change data is overwritten on the original data to be read. A data processing control method characterized by:   When the information processing device is activated, the secondary storage device control means controls to access a server connected to the information processing device via a network, and acquires attribute information of data stored in the server. 5. The data processing control method according to claim 1, wherein a data list having the attribute information is created in the volatile memory. A data processing control method for the secondary storage device in a first information processing device comprising a secondary storage device and a volatile memory,
The secondary storage device stores original data, and change data of the original data cannot be stored in the secondary storage device,
The file access control means mounted on the first information processing apparatus acquires a request for processing the file to the secondary storage device by an arbitrary application operating on the first information processing apparatus, and displays the request content. If the file or folder that is the object of this processing request is to be transferred to the second information processing apparatus at the network destination, the file or folder is transferred to the second information processing apparatus,
If the file or folder that is the target of the processing request is not to be transferred to the second information processing apparatus, it is mounted on the first information processing apparatus and provided in a lower layer of the file system in the information processing apparatus The secondary storage device control means obtained acquires the processing request via the file system, performs a write process with the volatile memory instead of executing a write process to the secondary storage device,
When the processing request is a data read request, the secondary storage device control means reads the original data to be read from the secondary storage device and changes the original data to be read. When the change data obtained in this manner exists in the volatile memory, the change data is read from the volatile memory, and the change data is overwritten on the original data to be read and presented. Data processing control method. An information processing device comprising a secondary storage device, a secondary storage device control means for controlling processing for the secondary storage device, and a volatile memory;
The secondary storage device stores original data, and change data of the original data cannot be stored in the secondary storage device,
The secondary storage device control means is provided in a lower layer of a file system in the information processing device,
The secondary storage device control means acquires a file processing request to the secondary storage device by an arbitrary application operating in the information processing device via the file system, and the processing request is a data write request. If there is, instead of executing the writing process to the secondary storage device, executing the writing process to the volatile memory,
When the processing request is a data read request, the secondary storage device control means reads the original data to be read from the secondary storage device and changes the original data to be read. When the change data obtained in this manner exists in the volatile memory, the change data is read from the volatile memory, and the change data is overwritten on the original data to be read and presented. Information processing apparatus.   8. The information according to claim 7, wherein the secondary storage device control means further stores the data written in the volatile memory in a server connected to the information processing device via a network. Processing equipment. Secondary storage device, file access control means for controlling file access to the secondary storage device and a server connected via a network, and secondary storage for controlling processing for the secondary storage device An information processing device comprising device control means and a volatile memory;
The secondary storage device stores original data, and change data of the original data cannot be stored in the secondary storage device,
The secondary storage device control means is provided in a lower layer of a file system in the information processing device,
The file access control means acquires a file processing request to the secondary storage device by an arbitrary application operating on the information processing apparatus, determines the request content, and the file or folder that is the target of this processing request Is to be transferred to the server at the network destination, forwards to the server,
If the file or folder that is the target of the processing request is not to be transferred to the server, the secondary storage device control means acquires the processing request via the file system and sends it to the secondary storage device. Instead of executing the write process, write process with the volatile memory,
When the processing request is a data read request, the secondary storage device control means reads the original data to be read from the secondary storage device and changes the original data to be read. When the change data obtained in this manner exists in the volatile memory, the change data is read from the volatile memory, and the change data is overwritten on the original data to be read and presented. Information processing apparatus. A data processing control system for performing data write control, comprising an information processing device and a server connected to the information processing device via a network,
The information processing apparatus includes a secondary storage device, secondary storage device control means for controlling processing for the secondary storage device, external storage medium write control means, and volatile memory,
The secondary storage device stores original data, and change data of the original data cannot be stored in the secondary storage device,
The secondary storage device control means is provided in a lower layer of a file system in the information processing device,
The external storage medium writing control means is configured to store data stored in the secondary storage device and data obtained by changing the data into a portable external storage medium connected to the information processing device. Prohibit write processing,
The secondary storage device control means acquires a file processing request to the secondary storage device by an arbitrary application operating in the information processing device via the file system, and the processing request is a data write request. If there is, instead of executing the writing process to the secondary storage device, executing the writing process to the volatile memory,
Further, the secondary storage device control means stores the data written in the volatile memory in the server. A data processing control system for performing file writing control, comprising an information processing device and a server connected to the information processing device via a network,
The information processing apparatus includes: a secondary storage device; file access control means for controlling file access to the server and the secondary storage device; and secondary storage for controlling processing for the secondary storage device. Device control means, external storage medium write control means, and volatile memory,
The secondary storage device stores original data, and change data of the original data cannot be stored in the secondary storage device,
The secondary storage device control means is provided in a lower layer of a file system in the information processing device,
The external storage medium writing control means is configured to store data stored in the secondary storage device and data obtained by changing the data into a portable external storage medium connected to the information processing device. Prohibit write processing,
The file access control means acquires a file processing request to the secondary storage device by an arbitrary application operating on the information processing apparatus, determines the request content, and the file or folder that is the target of this processing request Is to be transferred to the server at the network destination, forwards to the server,
If the file or folder that is the target of the processing request is not to be transferred to the server, the secondary storage device control means acquires the processing request via the file system and sends it to the secondary storage device. A data processing control system which performs a writing process with the volatile memory instead of executing a writing process. An information processing apparatus comprising: a secondary storage device; an external storage medium writing control unit; a secondary storage device control unit for controlling processing on the secondary storage device; and a volatile memory.
The external storage medium writing control means is configured to store data stored in the secondary storage device and data obtained by changing the data into a portable external storage medium connected to the information processing device. Prohibit write processing,
The secondary storage device stores original data, and change data of the original data cannot be stored in the secondary storage device,
The secondary storage device control means is provided in a lower layer of a file system in the information processing device,
The secondary storage device control means acquires a file processing request to the secondary storage device by an arbitrary application operating in the information processing device via the file system, and the processing request is a data write request. If there is, instead of executing the writing process to the secondary storage device, executing the writing process to the volatile memory,
The secondary storage device control means further stores the data written in the volatile memory in a server connected to the information processing device via a network. Secondary storage device, external storage medium write control means, file access control means for controlling file access to the secondary storage device and a server connected via a network, and processing for the secondary storage device An information processing device including a secondary storage device control means for controlling the volatile memory and a volatile memory,
The secondary storage device stores original data, and change data of the original data cannot be stored in the secondary storage device,
The secondary storage device control means is provided in a lower layer of a file system in the information processing device,
The external storage medium writing control means is configured to store data stored in the secondary storage device and data obtained by changing the data into a portable external storage medium connected to the information processing device. Prohibit write processing,
The file access control means acquires a file processing request to the secondary storage device by an arbitrary application operating on the information processing apparatus, determines the request content, and the file or folder that is the target of this processing request Is to be transferred to the server at the network destination, forwards to the server,
If the file or folder that is the target of the processing request is not to be transferred to the server, the secondary storage device control means acquires the processing request via the file system and sends it to the secondary storage device. An information processing apparatus that performs a write process with the volatile memory instead of performing a write process.