JP4972074B2 - File management system - Google Patents

Description

The present invention relates to a file management system for managing files in a computer terminal.

  In recent years, in organizations such as companies, thorough management of confidential information including personal information is desired. There are various causes of leakage of confidential information. For example, a computer terminal that stores files containing confidential information (hereinafter referred to as “important files”) is lost or stolen. Confidential information stored in may be leaked. Important files include files that contain confidential information, files that are stored in a predetermined file server or storage area, files that are designated as important in advance, and predetermined characters (such as keywords) in the file name. A file included, a file output (generated or saved) from a predetermined application, an encrypted or encrypted file, an attached file included in an e-mail, and the like.

  The important file is originally subjected to encryption processing or access restriction processing. Therefore, if important files are encrypted, even if a computer terminal is lost or stolen, the risk of information leakage will be greatly reduced, but you will forget to encrypt, or you will not be able to delete encrypted files. Since it is necessary to perform decryption when used, there is a case where encryption is not performed due to the trouble.

  Therefore, as described in Patent Documents 1 to 3 below, there is a system that automatically encrypts a file when a predetermined condition is satisfied.

JP-A-2005-285111 JP 2007-58257 A JP 2007-26105 A

  The inventions described in Patent Document 1 and Patent Document 2 are systems that automatically encrypt a file when the file is sent to the outside of a computer terminal, such as when the file is transmitted by electronic mail. Use of these systems is useful for preventing information leakage such as attached files in e-mail transmission or the like, but is not effective when the file itself is not sent to the outside as described above. Therefore, when the computer terminal is lost or stolen, the acquirer can easily acquire the important file by directly operating the computer terminal.

  The above problem can be partially solved by a system for encrypting a file in a computer terminal as in the invention described in Patent Document 3. However, even if such a system is used, it is necessary for the user to specify which important file is to be encrypted. If the computer terminal is lost or stolen, it cannot be encrypted at that time. That is, as described above, in order to use an important file that was originally encrypted on a computer terminal, it is necessary to decrypt the important file into plain text. However, since it is very troublesome to decrypt important files every time they are used, in practice, they are often not encrypted again and stored in a computer terminal in plain text.

  Then, even if a system for encrypting files in the computer terminal is provided, after the computer terminal is lost or stolen, those important files cannot be automatically encrypted again. In other words, even if a conventional system such as Patent Document 3 is used, in the case of loss or theft, an important file that was originally encrypted but decrypted and stored as plain text is again stored in the computer terminal. The original holder cannot automatically encrypt it.

  Therefore, also in the above-mentioned case, when the computer terminal itself is lost or stolen, there is a problem that the acquirer can easily acquire the important file by directly operating the computer terminal.

  Therefore, in view of the above problems, the present inventor automatically performs concealment processing on important files that are originally encrypted even if the computer terminal is lost or stolen. Invented a file management system that prevents information leakage of important files even if they are stolen.

  A first invention is a file management system for automatically concealing a file in a computer terminal, the file management system including an operation log information storage unit for storing operation log information of the computer terminal, and the computer When the state monitoring unit that monitors the moving state of the terminal and the state monitoring unit detects that the terminal is in a predetermined state, operation log information of a predetermined process among operation log information stored in the operation log information storage unit An operation log information search unit that searches for a file, and a concealment processing unit that performs a concealment process on the file using file identification information and storage location information in the operation log information searched by the operation log information search unit And a file management system.

  By configuring as in the present invention, when a computer terminal is in a predetermined state, for example, lost or stolen, a file for which a predetermined process has been performed is searched, and the file is automatically concealed. Processing can be performed. As a result, information leakage can be prevented in a predetermined state such as lost or stolen. The concealment process is a process that makes it difficult or impossible to access a file such as file encryption, file deletion, and file movement.

  A second invention is a file management system for automatically concealing a file in a computer terminal, the file management system including an operation log information storage unit for storing operation log information of the computer terminal, and the computer A state monitoring unit that monitors the movement state of the terminal; an operation log information search unit that searches operation log information of a predetermined process among operation log information stored in the operation log information storage unit; and the state monitoring unit , A concealment processing unit that performs concealment processing on the file using the file identification information and the storage location information in the operation log information searched by the operation log information search unit And a file management system.

  Even when configured as in the present invention, the same technical effects as those of the above-described invention can be obtained.

  In the above invention, the operation log information search unit can be configured as a file management system that searches the operation log information storage unit for operation log information including operation details for changing the file storage state. .

  In the above invention, the operation log information search unit searches the operation log information storage unit for operation log information including an operation content indicating a file decryption process, and uses the file identification information in the searched operation log information. The operation log information stored in the operation log information storage unit is searched for whether or not the encryption process is performed on the file in the operation log information after the file decryption process, and the operation log information in the searched operation log information When the file is not concealed, the file management system can extract at least file identification information and storage location information from the retrieved operation log information.

  Important files are often encrypted at any stage. Therefore, when an important file is used, it is executed after decrypting the encrypted file. As a result, the decrypted history remains as operation log information. Therefore, when the computer terminal is in a predetermined state, for example, lost or stolen, the operation log information that was originally encrypted and decrypted is searched, and the file in the operation log information is concealed. This will increase the possibility of preventing important files from leaking information.

  In the above-described invention, an encryption process can be used as the concealment process. That is, a file management system that automatically encrypts a file in a computer terminal, the file management system including an operation log information storage unit that stores operation log information of the computer terminal, and a movement state of the computer terminal An operation for searching operation log information of a predetermined process among operation log information stored in the operation log information storage unit when the state monitoring unit detects a predetermined state in the state monitoring unit File management comprising: a log information search unit; and an encryption processing unit that encrypts and stores the file using the file identification information and the storage location information in the operation log information searched by the operation log information search unit System.

  The file management system of the first invention can be realized by executing the following program on a computer terminal. That is, when the computer terminal that stores the operation log information in the storage device detects that the computer terminal is in a predetermined state in the state monitoring unit that monitors the movement state of the computer terminal, the operation log stored in the storage device Among the information, the operation log information search unit for searching operation log information of a predetermined process, the file identification information in the operation log information searched by the operation log information search unit, and the storage location information, and the file It can be configured like a file management program that functions as a concealment processing unit that performs concealment processing.

  The file management system of the second invention can be realized by executing the following program on a computer terminal. That is, a computer terminal that stores operation log information in a storage device, a state monitoring unit that monitors a movement state of the computer terminal, and operation log information of a predetermined process among operation log information stored in the storage device. When the operation log information search unit to be searched and the state monitoring unit detect that it is in a predetermined state, the file is used by using the file identification information and the storage location information in the operation log information searched by the operation log information search unit. It can be configured like a file management program that functions as a concealment processing unit for concealing.

  By executing these programs on a computer terminal, the above-described file management system can be configured, and the same technical effect can be obtained.

According to the present invention, it is possible to prevent information leakage of important files by automatically concealing important files even if the computer terminal is lost or stolen.

  An overall conceptual diagram of the file management system 1 of the present invention is shown in FIG. 1, and an exemplary conceptual diagram of a system configuration is shown in FIG.

  The file management system 1 of the present invention is realized by a computer terminal 2 used in an organization such as a company.

  The computer terminal 2 includes an arithmetic device 20 such as a CPU that executes arithmetic processing of a program, a storage device 21 such as a RAM or a hard disk that stores information, processing results of the arithmetic device 20 and information stored in the storage device 21. And a communication device 24 that transmits and receives via a network such as the Internet or a LAN. Each function (each unit) realized on the computer is executed when a unit (program, module, etc.) for executing the process is read into the arithmetic unit 20. When using the information stored in the storage device 21 in the processing, each function reads the corresponding information from the storage device 21 and uses the read information for processing in the arithmetic device 20 as appropriate. The computer may include an input device 23 such as a keyboard, a mouse, and a numeric keypad, and a display device 22 such as a monitor. FIG. 3 schematically shows an example of the hardware configuration of the computer terminal 2. Further, the functions of the computer terminal 2 may be distributed in a plurality of computer terminals 2 or servers.

  Each means in the present invention is only logically distinguished in function, and may be physically or practically the same area.

  In addition, the computer terminal 2 downloads and saves a file (in addition to a normal file, an important file that has been encrypted, etc.) to be used in business operations from a predetermined file server 3. Further, in the computer terminal 2, information such as the application name and file name executed in the computer terminal 2 is periodically updated or at a predetermined timing such as when a new application or file is executed or terminated. It is preferable to have a function of generating and storing operation log information that is a history. For this function, an application name or file name executed in the computing device 20 of the computer terminal 2 may be extracted, or an application name or file name in the memory may be extracted. That is, so-called operation log information may be stored in the computer terminal 2.

  The file management system 1 includes an operation log information storage unit 4, a state monitoring unit 5, an operation log information search unit 6, and a concealment processing unit 7.

  The operation log information storage unit 4 stores operation log information in the computer terminal 2. An example of the operation log information is shown in FIG. The operation log information may be information indicating the operation content in each computer terminal 2, for example, “file copy”, “file selection”, “drive addition”, “file decryption”, “file encryption”, “ Information indicating the operation of the user of the computer terminal 2 such as “Save File”, “Delete File”, and “Save Attachment”, and information indicating the execution status of the computer terminal 2 are applicable. The operation log information includes information for identifying the computer terminal 2, information indicating the operation content, the name of the file or application that is the operation target of the operation content, information indicating the location of the file or application, date / time or date / time It contains information that has been digitized. FIG. 6 schematically shows an example of the operation log information storage unit 4.

  The state monitoring unit 5 monitors the state of the computer terminal 2, and when a predetermined condition is satisfied, detects the state to start the file concealment process. In this state, the network connection of the computer terminal 2 is monitored and detected when the network connection is disconnected. Alternatively, the computer terminal 2 is provided with a predetermined detection device such as an inclination sensor, an acceleration sensor, or a vibration sensor, thereby detecting inclination, acceleration, vibration, or the like.

  That is, the state monitoring unit 5 monitors whether the computer terminal 2 has physically moved from the installation location. This is because the physical movement of the computer terminal 2 may lead to theft or loss. The state monitoring unit 5 detects a physical movement of the computer terminal 2 to start a file concealment process to be described later.

  Furthermore, there are other methods for detecting the physical movement of the computer terminal 2 performed by the state monitoring unit 5. For example, the computer terminal 2 has a built-in GPS communication device, periodically acquires its own position information and passes it to the state monitoring unit 5, and the state monitoring unit 5 physically changes the computer terminal 2 according to the change in the position information. There is a method of detecting a simple movement. Various methods can be used as a method of acquiring the position information of the computer terminal 2. For example, there are acquisition of location information using a wireless LAN access point, acquisition of location information using base station / area information such as PHS and mobile phone, acquisition of location information using a wireless IC tag such as RFID, etc. The method is not limited to these, and any method may be used.

  In addition, there is a method in which the state monitoring unit 5 determines the movement of the computer terminal 2 based on an indirect condition. The state monitoring unit 5 acquires the power supply source information, and the state monitoring unit 5 detects the movement of the computer terminal 2 from the acquisition of information indicating that the power supply source has been switched to the charged internal battery. To obtain network connection information, network domain changes, network segment changes, network connection method changes (for example, wired connection / wireless connection, network device switching, etc.) There is a method for detecting the movement of the terminal 2.

  When the state monitoring unit 5 detects that the computer terminal 2 satisfies or satisfies a predetermined condition, the operation log information search unit 6 stores the operation log information stored in the operation log information storage unit 4. Among them, the operation log information including “file decryption” as the operation content is searched. Then, the file name (file identification information) and storage location information are extracted from the retrieved operation log information.

  That is, the operation log information search unit 6 uses the operation log information to search whether the originally encrypted file is decrypted, and when there is a decrypted file, information on the file name and storage location. To extract.

  The operation log information search unit 6 detects operation log information related to an important file including information that should not be leaked to the outside, such as confidential information, among files stored in the computer terminal 2, and the operation log information. To extract the file name (file identification information) and storage location information of the important file. That is, the operation log information for the important file as the operation content is searched for including the operation content for changing the storage state in the computer terminal 2.

  As described above, an important file is a file containing confidential information, a file stored in a predetermined file server or storage area, a file previously designated as important, a predetermined character (keyword) Etc.), a file output (generated or saved) from a predetermined application, an encrypted or encrypted file, an attached file included in an e-mail, or the like.

  For example, the operation log information search unit 6 includes operation log information indicating that the file is acquired (downloaded) from a predetermined file server or storage area storing the important file, or an important file provided in the file server. Operation log information indicating that the information is acquired from a predetermined folder in which is stored may be detected. In this case, the operation log information stored in the operation log information storage unit 4 includes “file copy” as the operation content, and storage location information of the copy source file included in the operation log information. However, it is preferable to search for a predetermined file server or a predetermined folder in the file server.

  Further, the operation log information search unit 6 stores, in the operation log information storage unit 4, the file stored in the computer terminal 2 among the files attached to the received e-mail as an important file. Of the operation log information, operation log information including “Save attached file” as the operation content may be searched.

  The operation log information search unit 6 searches the decrypted file thus searched for whether it is further encrypted after the decryption process, and if it is not encrypted, it is a decrypted file. As such, the file name and storage location information may be extracted. This is because it is not necessary to automatically conceal if the user of the computer terminal 2 voluntarily encrypts (conceals) again after decryption.

  This is the operation log information after the operation log information whose operation content is “file decryption” based on the file name and storage location information of the retrieved decrypted file, and the file name and storage What is necessary is just to search for operation log information indicating that the location information is the same and the operation content is concealed such as “file encryption”.

  The file name and storage location may have been changed. Therefore, first of all, the file name and the storage location information are extracted from the retrieved decrypted file. Then, the operation log information including the file name and the storage location information, and the operation log information after the operation log information including the operation content of the “file decryption” is searched. Then, if the file name and the storage location information are changed, for example, operation log information including “file name change”, “file copy”, “file paste”, and the like as the operation content can be searched. In that case, the file name and storage location information after the change are further used to search for operation log information including operation contents indicating concealment such as “file encryption”, as described above. That's fine. The operation indicating concealment is not limited to “file encryption” but includes “file deletion”, “file move (predetermined folder)”, and the like. An operation indicating concealment is stored in advance, and the determination can be made by comparing the operation or operation procedure with the operation content. The operation indicating concealment stored in advance may be a process or a process procedure performed by the concealment processing unit 7 described later.

  The concealment processing unit 7 retrieves and extracts the file name of the file stored in the computer terminal 2 while being decrypted from the files that were originally encrypted by the operation log information retrieval unit 6. Based on the information on the storage location, concealment processing such as encryption processing is automatically performed on the file. When encryption processing is used as concealment processing, encryption processing is executed using a predetermined password (when encryption processing is used as concealment processing, concealment processing unit 7 functions as an encryption processing unit. ). Then, even if the computer terminal 2 is found, the encrypted file can be decrypted and used again, and the computer terminal that does not know the password by the encryption process using the password The acquirer of 2 cannot use the encrypted file. This password can be arbitrarily set by the user of the computer terminal 2, an administrator, etc., and is known to them.

  As a password for encryption, biometric information of a user who uses the computer terminal 2, for example, information such as a fingerprint, a vein, and an iris may be stored in advance, and the information may be used for encryption. Thereby, when the computer terminal 2 is discovered, the biometric information of the user can be read by the computer terminal 2 and can be decoded.

  The file encrypted by the concealment processing unit 7 is stored in a predetermined area of the storage device 21 of the computer terminal 2, for example, in the same directory as the storage location of the file subjected to encryption processing or another directory. Note that the plaintext file that is the subject of the encryption process is deleted from the storage device 21.

  The concealment processing unit 7 conceals the important file in a format in which the contents of the important file including confidential information among the files stored in the computer terminal 2 are not leaked to the outside. Therefore, any method other than the above-described file encryption processing (or re-encryption processing) can be used as long as the storage state is changed to a format in which the contents are not easily leaked to the outside. It may be.

  For example, the concealment processing unit 7 may delete the file itself that has been searched and extracted by the operation log information search unit 6. As a result, the file itself is lost, and the data is not leaked to the outside.

  Further, the concealment processing unit 7 may move the storage location of the file searched and extracted by the operation log information search unit 6. The destination may be in a predetermined folder originally created in the computer terminal 2, or a new folder for saving important files may be created in the computer terminal 2 and saved in that folder. . At this time, it is preferable that the folder to be moved is a place (hierarchy) that is difficult for outsiders to access. Thereby, it is possible to prevent the data included in the file from leaking to the outside.

  Further, the concealment processing unit 7 moves the storage location of the file searched and extracted by the operation log information search unit 6 and whose storage location is on the desktop of the computer terminal 2. May be. It is even better if the destination is as described above. As a result, it is possible to prevent the contents of data in a place (such as a place that is easily noticeable) accessible to outsiders from being leaked.

  Next, an example of the processing process of the file management system 1 of the present invention will be described with reference to the flowchart of FIG. 4 and the conceptual diagram of FIG. In each of the following embodiments, a case where an encryption process is used as the concealment process will be described. However, other concealment processes can be similarly realized.

  When an operation is performed on the computer terminal 2 or an application is executed, it is generated as operation log information and stored in the operation log information storage unit 4 (S100).

  Further, the state monitoring unit 5 constantly monitors the state of the computer terminal 2. For example, the computer terminal 2 is disconnected from the network (for example, the LAN cable is disconnected from the computer terminal 2), and the inclination is detected by the computer terminal 2. When a predetermined trigger state such as (the tilt sensor has detected tilt) is detected (S110), it is notified to the operation log information search unit 6.

  When the state monitoring unit 5 detects a triggering state, the operation log information search unit 6 includes “file decryption” as operation content from the operation log information stored in the operation log information storage unit 4. The operation log information is searched (S120). That is, it is searched whether or not the decryption process is being executed for the file that was originally encrypted.

  Information on the file name and storage location after the decryption process is extracted from the operation log information searched in this way. The file name and storage location information extracted here are the files that were originally encrypted and are now decrypted and stored as the file name and storage location information.

  When the operation log information stored in the operation log information storage unit 4 is shown in FIG. 6, since each file with the file name “AAAAAAA” and the file name “BBBBBBB” is decrypted, information on the file name and the storage location is obtained. Will be extracted. This is schematically shown in FIG.

  Next, the operation log information search unit 6 stores in the operation log information stored in the operation log information storage unit 4 whether there is a file re-encrypted by the user among these files (decrypted and saved files). Based on the search (S130, S140).

  In the above case, the file name “AAAAAAA” is stored in “\\ MyDocuments \ task 1 \ ...” and the file name “BBBBBBB” is stored in “\\ MyDocuments \ task 2 \ ...” in S120. It is determined that the files have been re-encrypted based on the operation log information. That is, the operation log information including “file encryption” as the operation content is searched based on the file name, storage location information, and the like.

  At this time, for the operation log information after the operation content “file decryption” searched in S120, that is, for the file name “AAAAAAA”, operation log information and files after “November 6, 2007 16:10:25” The name “BBBBBBBB” may be searched for operation log information after “November 6, 2007 16:20:36” and including “file encryption”.

  Then, since the operation log information “file encryption” is stored for the file name “BBBBBBB”, it is searched that the file is already encrypted. Therefore, since it can be determined that it is not necessary to automatically encrypt the file, the operation log information search unit 6 finally stores the file with the file name “AAAAAAA” stored in “\\ MyDocuments \ task 1 \...” Is automatically encrypted, and the file name and storage location information are passed to the concealment processing unit 7.

  FIG. 8 schematically shows the above processing.

  The concealment processing unit 7 executes an encryption process based on a preset password for the file that was originally encrypted but stored in plain text, searched by the operation log information search unit 6 (S150). ). In the above case, the encryption process is executed based on a preset password for the file with the file name “AAAAAAAA” stored in “\\ MyDocuments \ task 1 \...”. Further, it is preferable to delete the plain text file “AAAAAAA” from the storage device 21 after executing the encryption process. Note that the file name of the file that has been encrypted may be the same as it is, or may be changed to a file name that automatically indicates encryption. For example, the file name “AAAAAAA” may be a file name indicating that the file has been encrypted, such as “AAAAAAA_encrypt”. By changing the file name to indicate that the file has been automatically encrypted in this way, the file search is facilitated.

  Further, by changing the file name in this way, it is possible to save the encrypted file in a directory different from the plain text file. This is because if the encrypted file is stored in the same file, the malicious third party who obtains the computer terminal 2 knows the existence of the automatically encrypted file and somehow decrypts the password. This is because if the existence of an automatically encrypted file is not known, such an action will be prevented. When the original owner of the computer terminal 2 retrieves the computer terminal 2, if the file does not exist in the directory originally saved as plain text, it automatically recognizes that the file has been encrypted, and This is because it is easy to restore the file to the original location by searching for the file using a part of the file name changed as described above.

  Next, different embodiments of the file management system 1 of the present invention are schematically shown. In this embodiment, the operation log information is managed by the management server. An overall conceptual diagram in the case of the present embodiment is shown in FIG. A conceptual diagram of the system configuration is shown in FIG.

  The management server is a server that manages each computer terminal 2. Further, FIG. 10 shows a case where the file stored in the file server 3 is downloaded to the computer terminal 2 via the management server. However, the computer terminal 2 downloads the file directly from the file server 3 without going through the management server. Needless to say.

  Each computer terminal 2 includes a state monitoring unit 5, an operation log information search unit 6, and a concealment processing unit 7. Each computer terminal 2 has a function of generating operation log information in the computer terminal 2 and transmitting it to the management server.

  The state monitoring unit 5 and the concealment processing unit 7 are the same as those in the first embodiment.

  When the operation log information search unit 6 detects that the state monitoring unit 5 is in a predetermined trigger state, the operation log information received from the management server or the downloaded file as described later is an encrypted file. On the basis of information such as a flag indicating “”, a file that was originally an encrypted file but is stored in the computer terminal 2 as plain text is searched.

  The management server includes an operation log information acquisition unit 8, an operation log information storage unit 4, a download detection unit 9, and a data transmission unit 10.

  The operation log information acquisition unit 8 acquires operation log information in the computer terminal 2 from each computer terminal 2 regularly or irregularly, and stores it in the operation log information storage unit 4. The acquired operation log information is stored in the operation log information storage unit 4 together with the date and time and information for identifying which computer terminal 2 is the operation log information. Further, when the management server acquires operation log information from each computer terminal 2, it may be acquired via a network, or the operation log information is recorded on a recording medium such as a DVD in the computer terminal 2, and the recording medium May be obtained by reading the operation log information from the management server.

  The operation log information storage unit 4 stores operation log information of each computer terminal 2 as described above. At this time, the operation log information is preferably stored for each computer terminal 2 or for each user, but this need not be the case.

  The download detection unit 9 monitors operation log information acquired from the computer terminal 2 in the operation log information acquisition unit 8 and detects information indicating that a file has been downloaded from the file server 3. For example, when the operation content of the operation log information is “file copy” and the information indicating the storage location is the file server 3, this indicates that the file has been downloaded from the file server 3 to the computer terminal 2 (file copy). Because it is, judge it. Note that the operation content indicating the download to be monitored can be arbitrarily set.

  When the download detection unit 9 detects that the file of the file server 3 has been downloaded, the data transmission unit 10 searches the operation log information storage unit 4 for operation log information for the file, and retrieves the operation log information from the computer. Transmit to terminal 2. For example, when the download detection unit 9 detects that the computer terminal 2 “ABC12345678” has downloaded the file “AAAAAAAA” based on the operation log information, the data transmission unit 10 stores the operation log information of the file “AAAAAAA” in the operation log information storage Search from part 4 and extract. Then, the extracted operation log information is transmitted to the computer terminal 2 “ABC12345678”.

  When the operation log information of the file “AAAAAAA” is extracted, when the user decrypts the file “AAAAAAA”, the operation performed on the computer terminal 2 “ABC12345678” used by the user The log information may be further extracted as a search key, and when the file “AAAAAAAA” by another user is decrypted, the identification information of the computer terminal 2 used by the user is used. What is necessary is just to search operation log information by a file name as it is, without using as a search key.

  The operation log information is received by the computer terminal 2 “ABC12345678” and stored in a predetermined area.

  The data transmission unit 10 determines whether the file is an encrypted file based on the operation log information stored in the operation log information storage unit 4 or based on the storage in the file server 3 and downloads it to the computer terminal 2. When the file that has been encrypted is an encrypted file, the above-described extraction process may be performed and operation log information may be transmitted.

  Further, a flag indicating that the file is an encrypted file may be transmitted as information without transmitting the operation log information itself.

  Next, an example of a processing process in this embodiment will be described with reference to the flowchart of FIG. 11 and the conceptual diagram of FIG.

  When an operation is performed on the computer terminal 2 or an application is executed, it is generated as operation log information and transmitted from the computer terminal 2 to the management server. The operation log information acquisition unit 8 of the management server acquires operation log information from each computer terminal 2 and stores it in the operation log information storage unit 4 (S200).

  The arbitrary computer terminal 2 downloads the encrypted file from the file server 3 to the computer terminal 2 and stores it by performing a predetermined operation there. Then, the operation log information downloaded from the file is transmitted from the computer terminal 2 to the management server, so that it is acquired by the operation log information acquisition unit 8 and stored in the operation log information storage unit 4.

  Since the operation log information acquisition unit 8 monitors the operation log information acquired from the computer terminal 2, the download detection unit 9 detects that the file has been downloaded to the computer terminal 2 based on the operation log information of the download. (S210).

  When the download detection unit 9 detects that the file of the file server 3 has been downloaded, the data transmission unit 10 searches the operation log information storage unit 4 for operation log information for the file, and retrieves the operation log information from the computer. It transmits to the terminal 2 (S210).

  Or the data transmission part 10 may transmit the flag which shows that the downloaded file is an encrypted file to the said computer terminal 2 by performing the above-mentioned process.

  The state monitoring unit 5 of the computer terminal 2 constantly monitors the state of the computer terminal 2. For example, the computer terminal 2 is disconnected from the network (for example, the LAN cable is disconnected from the computer terminal 2). When a predetermined trigger state such as the detection of tilt (the tilt sensor detects tilt) is detected (S220), it is notified to the operation log information search unit 6.

  When the state monitoring unit 5 detects a trigger state, the operation log information search unit 6 searches for operation log information including “file decryption” as the operation content from the operation log information received from the management server. (S230). That is, it is searched whether or not the decryption process is being executed for the file that was originally encrypted.

  Next, the operation log information search unit 6 stores in the operation log information stored in the operation log information storage unit 4 whether there is a file re-encrypted by the user among these files (decrypted and saved files). Based on the search (S240, S250).

  The concealment processing unit 7 performs an encryption process based on a preset password for a file searched by the operation log information search unit 6 and originally encrypted but decrypted and stored in plain text. Execute (S260). The encrypted file is stored in the computer terminal 2 as it is, and the decrypted plain text file is deleted from the storage device 21 of the computer terminal 2.

  By executing the processing as described above, even when the operation log information is stored in the management server, it is possible to obtain the same technical effect as in the first embodiment.

  In each of the above-described embodiments, the case where the decrypted file is retrieved from the operation log information and encrypted again has been described. However, when the decrypted file is copied by the computer terminal 2, the copy is performed. The encrypted file can also be configured to be encrypted.

  In this case, since the decrypted file name can be specified based on the operation log information, the file name is extracted, and the operation log information for the file name is searched from the operation log information storage unit 4. Then, among the retrieved operation log information, the operation log information indicating the operation content of the copy operation for the file is specified, the operation log information indicating the operation content of the paste operation corresponding to the operation log information is specified, and the file By extracting the name, it is possible to specify a newly copied file from the decrypted file. Based on the extracted file name and information on the storage location, the file can be encrypted.

  In addition to the copy operation, the present invention can be similarly applied when the file name is changed. For example, in the operation log information, if there is operation log information of the operation content indicating the change of the file name, the file is changed based on the file name changed based on the operation log information and the storage location information. Encrypt.

  By executing the processing as described above, even when there are a plurality of decrypted files copied, it is possible to automatically encrypt them.

  In each of the above-described embodiments, it is desirable to determine a decrypted file based on operation log information as a file to be automatically encrypted, and to encrypt the file again. In addition to determining the file based on the operation log information, the file is determined based on the operation log information for a predetermined operation, for example, a copy operation or a move operation from a file server, and the file is encrypted again. Also good. For example, it may be configured to automatically encrypt a file flagged as an important file.

  In the first embodiment, the operation log information search unit 6 searches for the operation log information when the state monitoring unit 5 causes the computer terminal 2 to be in a predetermined state, but the operation log information search unit 6 By retrieving the operation log information in each time the operation log information is acquired or at a predetermined timing or periodically, file identification information and storage information of important files are acquired in advance, and the state monitoring unit 5 When it is detected that the status has been reached, the concealment processing unit 7 performs concealment processing on the file using the file identification information of the important file searched by the operation log information search unit 6 and the storage location information. You can also That is, the file identification information and the storage location of the important file searched by the operation log information search unit 6 are stored in the important file information storage unit (not shown), and when the computer terminal 2 enters a predetermined state, Information related to the important file is read from the important file information storage unit and the concealment process is executed. As a result, the start of executing the concealment process for the important file can be accelerated after the timing when the change in the movement state of the computer terminal 2 is detected.

  In each of the embodiments described above, the important file is determined based on the operation log information, and the order is not specified when the concealment process is performed on the file. However, the important file storage location in the computer terminal 2 The order in which the concealment process is performed on the file may be determined according to the level of the saved folder. With this configuration, it is possible to proceed with concealment processing in order from a file that can be easily accessed by an outsider (a file in a folder having a shallow hierarchy), thereby preventing leakage of important information. For example, a file whose storage location is the root folder is first concealed, and for files stored in other folders, the upper and lower levels (hierarchy depth) of the storage hierarchy The order of the concealment processing can be determined according to the above.

  In the above-described embodiment, the content of the predetermined condition for starting the concealment process for the file is set according to the hierarchy of the file storage location for the moving state of the computer terminal 2 monitored by the state monitoring unit 5 You may do that. With this configuration, files that can be easily accessed by outsiders are concealed even if the state of the computer terminal 2 is insignificant, and leakage of important files that are easily noticeable is prevented. Can be prevented. For example, when the state monitoring unit 5 monitors the vibration information of the computer terminal 2, a plurality of levels (stages) are provided according to the magnitude of the vibration, and the file whose storage location is the desktop is Even if the vibration is low (the level of vibration is low), concealment processing is performed immediately. For files stored in other folders, etc., if the vibration is larger, the magnitude of the vibration and the storage hierarchy It can be configured so that the concealment process can proceed according to the upper and lower levels.

  Each means (each function) in the file management system 1 of the present invention may be appropriately distributed in the computer terminal 2 or the management server in addition to the above-described embodiments. There are various patterns of variations in the distributed arrangement, and any arrangement form may be used.

  In addition, the pattern of dispersion | distribution arrangement | positioning is not limited above, Various dispersion | distribution arrangement | positioning can be performed. In these cases, when each function of the management server is used at the time of processing at each computer terminal 2, the inquiry is sent from the computer terminal 2 to the management server, and the result is sent to the processing at the computer terminal 2. Use. The processing result is executed by the computer terminal 2.

  When the management server 12 that is a computer that manages each computer terminal 2 and the file server 3 are integrated, the processing may be performed using operation log information of the management server. Even if they are not integrated, they may be processed using the operation log information of the file server 3.

  That is, when a file is downloaded from the file server 3 to the computer terminal 2, the file server 3 transmits operation log information regarding the file to the computer terminal 2 or another computer terminal, and the computer terminal 2 is transmitted from the network. In a predetermined state such as being disconnected, the operation log information relating to the file downloaded to the computer terminal 2 (operation log information received from the file server 3) is analyzed as described above, and decrypted in the past. If so, the file is re-encrypted (hidden).

  Alternatively, when a file is downloaded from the file server 3 to the computer terminal 2, the file server analyzes the operation log information regarding the file as described above, and if the file has been decrypted in the past, the information is Transmit to the computer terminal 2. When the computer terminal 2 is in a predetermined state such as being disconnected from the network, the file is re-encrypted based on the information received from the file server 3 and indicating that the file has been decrypted. (Concealment).

An important important file that is originally encrypted by the file management system 1 of the present invention is automatically encrypted even if the computer terminal 2 is lost or stolen. Information leakage of important files can be prevented.

It is a conceptual diagram which shows the whole concept of this invention. It is a conceptual diagram which shows an example of the system configuration | structure of this invention. It is a conceptual diagram which shows an example of a hardware configuration. It is a flowchart which shows an example of the processing process of this invention. It is an example of operation log information. It is a figure which shows an example of an operation log information storage part typically. It is a figure which shows typically the process of the operation log information search part. It is a figure which shows typically the process which searches the file re-encrypted. It is a conceptual diagram which shows the whole concept of this invention. It is a conceptual diagram which shows another example of the system configuration | structure of this invention. It is a flowchart which shows another example of the processing process of this invention.

Explanation of symbols

1: File management system 2: Computer terminal 3: File server 4: Operation log information storage unit 5: Status monitoring unit 6: Operation log information search unit 7: Concealment processing unit 8: Operation log information acquisition unit 9: Download detection unit 10: Data transmission unit 20: Computing device 21: Storage device 22: Display device 23: Input device 24: Communication device

Claims (7)

A file management system for automatically hiding files in a computer terminal,
The file management system includes:
An operation log information storage unit for storing operation log information of the computer terminal;
A state monitoring unit for monitoring the movement state of the computer terminal;
When the state monitoring unit detects a predetermined state, an operation log information search unit that searches operation log information of a predetermined process among operation log information stored in the operation log information storage unit;
A concealment processing unit that performs concealment processing on the file using file identification information and storage location information in the operation log information searched by the operation log information search unit;
A file management system comprising: A file management system for automatically hiding files in a computer terminal,
The file management system includes:
An operation log information storage unit for storing operation log information of the computer terminal;
A state monitoring unit for monitoring the movement state of the computer terminal;
Among the operation log information stored in the operation log information storage unit, an operation log information search unit that searches for operation log information of a predetermined process;
When the state monitoring unit detects a predetermined state, the file is concealed using the file identification information and the storage location information in the operation log information searched by the operation log information search unit. A concealment processing unit;
A file management system comprising: The operation log information search unit
Search the operation log information storage unit for operation log information including operation details for changing the file storage state;
The file management system according to claim 1 or 2, characterized by the above. The operation log information search unit
Search operation log information including the operation content indicating the file decryption process from the operation log information storage unit,
Using the file identification information in the retrieved operation log information, the operation log information storage unit stores whether or not an encryption process has been performed on the file in the operation log information after the file decryption process. Search from the operation log information,
When concealment processing is not performed on the file in the searched operation log information, at least file identification information and storage location information are extracted from the searched operation log information.
The file management system according to claim 3. A file management system for automatically encrypting files in a computer terminal,
The file management system includes:
An operation log information storage unit for storing operation log information of the computer terminal;
A state monitoring unit for monitoring the movement state of the computer terminal;
When the state monitoring unit detects a predetermined state, an operation log information search unit that searches operation log information of a predetermined process among operation log information stored in the operation log information storage unit;
Using the file identification information and the storage location information in the operation log information searched by the operation log information search unit, an encryption processing unit that encrypts and stores the file,
A file management system comprising: A computer terminal for storing operation log information in a storage device;
A state monitoring unit for monitoring the movement state of the computer terminal;
An operation log information search unit that searches operation log information of a predetermined process among operation log information stored in the storage device when detecting that the state monitoring unit is in a predetermined state;
A concealment processing unit that performs concealment processing on the file using the file identification information and the storage location information in the operation log information searched by the operation log information search unit,
A file management program characterized by functioning as A computer terminal for storing operation log information in a storage device;
A state monitoring unit for monitoring the movement state of the computer terminal;
Among the operation log information stored in the storage device, an operation log information search unit that searches operation log information of a predetermined process,
When the state monitoring unit detects a predetermined state, concealment is performed for the file using the file identification information and the storage location information in the operation log information searched by the operation log information search unit. Processing section,
A file management program characterized by functioning as

Images