JP5424325B2 - Security management device, security management method and program - Google Patents

Description

  The present invention relates to a security management device, a security management method, and a program for managing security of information stored in a storage device.

  For information appliances that store information, management of stored information such as backup management and security management is one of the issues (see, for example, Patent Documents 1 and 2).

  On the other hand, a video recording apparatus that secures a free space by compressing old video information that has been recorded for a long time has been disclosed (for example, see Patent Document 3). Similarly, in a storage device (for example, a hard disk) of a personal computer (PC), it is necessary to take measures against an old file that has not been accessed for a while.

JP-T-2004-504645 JP 2008-123049 A JP 2007-235225 A

  In a PC, the contents and existence of old files that have not been accessed for a while are often forgotten. In such a state, even if a file leaks to the outside, it is often not noticed, and it becomes difficult to determine what kind of file has leaked. However, such files may contain files that should be kept secret. Therefore, it is necessary to enhance security management of old files against hard disk theft and unauthorized access.

  Since the PC stores a huge number of files, it is difficult to search for and find old files that should be kept secret.

  The present invention has been made in view of the above circumstances, and an object thereof is to provide a security management device, a security management method, and a program capable of efficiently managing the security of old information stored in a storage device. To do.

In order to achieve the above object, a security management device according to the first aspect of the present invention provides:
An extraction unit for extracting information whose last access date and time when access was performed is earlier than a predetermined time from the information stored in the storage device;
A changing unit that changes the content of the information so that use of the information extracted by the extracting unit is restricted;
Equipped with a,
The extraction unit includes:
Information that the last access date and time when access was performed is earlier than the first time point is extracted as a candidate,
Among the extracted candidates, information whose last access date and time when access was performed is earlier than the second time point is extracted as a change target .

In this case, the extraction unit
When the CPU of the information processing apparatus that processes the information stored in the storage device is in an empty state, the CPU extracts information whose last access date and time when access was performed is earlier than a predetermined time To
It is good as well.

In addition, the changing unit
When the CPU of the information processing apparatus that processes the information stored in the storage device is in an empty state, the content of the information extracted by the extraction unit is changed using the CPU.
It is good as well.

The information stored in the recording device is classified and managed,
The extraction unit includes:
Extract the classification that contains the information that the last access date and time accessed for each classification is earlier than the predetermined time,
The changing unit is
Of the information included in the extracted classification, change the content of all the information whose last access date and time is earlier than the predetermined time,
It is good as well.

In addition, when access is made to the information changed so that the use is restricted by the change unit, the change unit further includes a release unit that releases the use restriction.
It is good as well.

In addition, the changing unit
The information may be encrypted.

In addition, the changing unit
Change the content of the information so that authentication is required when using it.
It is good as well.

The security management method according to the second aspect of the present invention is:
An extraction step of extracting information from the information stored in the storage device that the last access date and time of access is earlier than a predetermined time point;
A change step of changing the content of the information so that use of the information extracted in the extraction step is limited;
Only including,
In the extraction step,
Information that the last access date and time when access was performed is earlier than the first time point is extracted as a candidate,
Among the extracted candidates, information whose last access date and time when access was performed is earlier than the second time point is extracted as a change target .

The program according to the third aspect of the present invention is:
An extraction procedure for extracting, from the information stored in the storage device, information whose last access date and time when access was performed is earlier than a predetermined time point;
A change procedure for changing the content of the information so that use of the information extracted in the extraction procedure is limited;
To the computer ,
In the extraction procedure,
Information that the last access date and time when access was performed is earlier than the first time point is extracted as a candidate,
Among the extracted candidates, information whose last access date and time when access was performed is earlier than the second time point is extracted as a change target .

  According to the present invention, old information that has not been accessed for a predetermined period is encrypted. For this reason, the security level of old information can be improved. In addition, since only old information is encrypted, efficient security management is possible.

It is a block diagram which shows the structure of the computer concerning one Embodiment of this invention. It is an example of the hardware constitutions of the file storage part of FIG. It is an example of the folder structure of the file storage part of FIG. It is a figure which shows an example of the format of a file. It is a figure which shows an example of a format of a candidate list. It is a flowchart of a first time starting process. It is a flowchart of a list generation process. It is a flowchart of a folder investigation process. It is a flowchart of PC starting processing. It is a flowchart of an automatic encryption process. It is a flowchart of a file open process. 12A and 12B are diagrams illustrating registration examples of candidate lists.

  Next, an embodiment of the present invention will be described in detail with reference to the drawings. The security management apparatus according to the present embodiment is mounted on a computer that is a management target of security management.

  As shown in FIG. 1, a computer 100 that is a security management target according to the present embodiment includes an operation unit 1, a display unit 2, a clock unit 3, a file storage unit 4, and a main control unit 5. Prepare.

  The operation unit 1 includes a keyboard and a pointing device such as a mouse. The operation unit 1 receives inputs from those operations and outputs them to the main control unit 5.

  The display unit 2 is a display having a display screen. The display unit 2 displays information using graphics configured by a GUI (Graphical User Interface).

  The clock unit 3 has a timer. The clock unit 3 can acquire the current time using this timer.

  The file storage unit 4 is a storage device composed of a hard disk or the like. Various files are stored in the file storage unit 4. In FIG. 1, the files stored in the file storage unit 4 are roughly divided into a file group 10, a security management task 11, another task group 12, and a candidate list 13.

  The file group 10 is a collection of files that are targets of security management in this embodiment.

  The security management task 11 is a task program file prepared for performing security management processing of the file group 10 according to the present embodiment. The file of the security management task 11 stores the procedure for the initial activation process and the automatic encryption process. The initial activation process includes subroutines such as a list generation process and a folder investigation process. Automatic encryption processing performs file encryption processing. Furthermore, threshold values (candidate threshold values, processing threshold values) and the like are defined in the security management task 11. Details of the initial activation process, automatic encryption process, candidate threshold, and process threshold will be described later.

  The other task group 12 is a collection of processing procedures for tasks other than the security management task 11 and various data used in the tasks. The other task group 12 includes a PC activation process executed when the PC is turned on, a file open process for opening a file stored in the file storage unit 4, and the like. Details of the PC activation process and the file open process will be described later.

  The candidate list 13 is a list used by the security management task 11. The candidate list 13 lists folders that are candidates for encryption.

  The hardware configuration of the file storage unit 4 is arbitrary. For example, as shown in FIG. 2, the file storage unit 4 can be composed of two storage devices 30, 31 such as a hard disk device. In the example shown in FIG. 2, the storage device 30 is set as the C drive of the virtual drive, and the storage device 31 is set as the D drive of the temporary drive. The present invention is not limited to the hardware configuration shown in FIG.

  As shown in FIG. 3, various files stored in the file storage unit 4 are stored in folders. Each folder can store a plurality of files. In one folder, about 10 files are stored on average. For example, “file1” and “file2” are stored in Folder A. Folders can have a hierarchical structure. For example, Folder C is stored under Folder B. In FolderC, “file3” and “file4” are stored.

  The main control unit 5 includes a CPU and a memory (both not shown). Various functions are realized by the CPU executing the program stored in the memory. This CPU is a CPU having the ability to execute a multitasking operating system (OS).

  Files stored in the file storage unit 4 include program files and data files.

  Various programs described in the program file are read into the memory of the main control unit 5 and executed by the CPU according to the operation input of the operation unit 1. The security management task 11 and other task group 12 correspond to this program file.

  Various data described in the data file is read into the memory of the main control unit 5 as necessary by execution of a program by the CPU, and values are updated as necessary. The candidate list 13 corresponds to this data file. The execution result of the program is displayed on the display unit 2. During execution of this program, the current time is acquired from the clock unit 3 as necessary.

  The file group 10 includes a program file and a data file.

  Returning to FIG. 1, the main control unit 5 includes a file system 20, a task management unit 21, a busy detection unit 22, and a security management unit 23.

  The file system 20 manages the files stored in the file storage unit 4. By managing the file system 20, a virtual drive (see FIG. 2) in the file storage unit 4 is realized, and a hierarchical folder structure (see FIG. 3) in the file storage unit 4 is realized.

  The task management unit 21 manages activation and termination of tasks (programs) executed by the CPU. For example, the task programs of the security management task 11 and the other task group 12 are started and ended under the management of the task management unit 21.

  The busy detection unit 22 detects whether there is a surplus in the CPU processing capacity of the main control unit 5 at the present time. By referring to the detection result, it is possible to detect the idle state of the task execution of the CPU.

  The file system 20, the task management unit 21, and the busy detection unit 22 are generally installed as standard on currently distributed OSs (for example, Windows (registered trademark)).

  The security management unit 23 manages the security of the file group 10. The function of the security management unit 23 is realized by the security management task 11 of the file storage unit 4 being read into the memory and executed by the CPU.

  Each file stores management information in addition to its contents regardless of whether it is a program file or a data file. As shown in FIG. 4, for example, management information and file content are also registered in “file 4” stored in Folder C of the D drive.

  The management information includes, for example, a file name (11 bytes), a file attribute (1 bytes), a file creation date and time (4 bytes), a file access date and time (4 bytes), a file recording cluster (4 bytes), a file size (4 bytes), and the like. Yes. The size of each data shown in FIG. 4 is merely an example and may be changed.

  As described above, the management information always records the date and time related to the file regardless of the format of the file, and the date and time includes the most recent date and time when the file was accessed. The last access date / time is included. The time recorded as the last access date and time is the time acquired by the clock unit 3 when the file is accessed (that is, when the file is opened).

  The security management unit 23 manages the security of each file using the last access date and time included in the file management information. The function of the security management unit 23 is realized by the CPU of the main control unit 5 executing the security management task 11 and the like stored in the file storage unit 4.

  More specifically, the security management unit 23 includes an extraction unit 25 and a change unit 26. The extraction unit 25 extracts, from the files in the file group 10 stored in the file storage unit 4, a file whose access date and time of last access is before a predetermined time. The changing unit 26 encrypts the extracted file.

  By the way, the extraction unit 25 extracts a file whose access date and time of the last access is before a predetermined point in a period in which the busy detection unit 22 detects that the CPU is free.

  In addition, the changing unit 26 encrypts the extracted file in a period during which the busy detection unit 22 detects that the CPU is free.

  In addition, the extraction unit 25 extracts, for each folder, a file whose access date and time of last access is earlier than a predetermined time. More specifically, the extraction unit 25 adds the folder to the candidate list 13 if there is at least one file in the folder whose last access date and time before access is a predetermined point in time. 13, the oldest access date / time of the last access date / time of the file in the folder, that is, the oldest access date / time is registered.

  A folder in which a frequently accessed file is stored tends to have other frequently accessed files, and a folder in which a file that is not accessed is stored tends not to be accessed in the future. Therefore, the security management unit 23 searches for a folder whose earliest access date and time is before a predetermined time, and encrypts all files in the folder whose last access date and time is before the predetermined time.

  Furthermore, the extraction unit 25 performs file extraction in two stages. More specifically, as the first stage, the extraction unit 25 first determines that the last access date and time of the file is earlier than the time point based on the candidate threshold, that is, the candidate limit date (first time point). The folder to which the file belongs is registered in the candidate list 13. The candidate threshold value is a threshold value for creating a file candidate to be encrypted.

  As shown in FIG. 5, the oldest access date (4 bytes), the folder path name length (4 bytes), and the folder name (variable length) are registered in the candidate list 13.

  Subsequently, as the second stage, the extraction unit 25, among the folders registered in the candidate list 13, has a time when the oldest access date / time is based on the processing threshold and is before the processing limit date (second time). If there is a file whose last access date is before the processing limit date (second time point), all the files are encrypted. That is, the processing threshold is a threshold for determining whether or not to actually perform the encryption process.

  Further, the security management unit 23 includes a release unit 27. The canceling unit 27 decrypts the file when the file encrypted by the changing unit 26 is accessed and the file open process of the file is executed.

  Next, the operation of the computer 100 according to the present embodiment will be described with reference mainly to the flowcharts of FIGS.

  First, in the computer 100, the security management function according to the present embodiment can be enabled or disabled. When the security management function is validated, the main control unit 5 executes the initial activation process of the security management task 11 shown in FIG.

  In this initial activation process, as shown in FIG. 6, first, a list generation process subroutine is executed (step S1).

  In the list generation process, as illustrated in FIG. 7, the extraction unit 25 calculates candidate limit dates (step S10). Here, the extraction unit 25 obtains the current date from the clock unit 3, and calculates a candidate limit date by subtracting a candidate threshold value (for example, two years) therefrom.

  Subsequently, the extraction unit 25 sets the root folder of the drive as a processing target (step S11). Subsequently, the extraction unit 25 executes a subroutine for folder investigation processing (step S12).

  In the folder investigation process, as shown in FIG. 8, the extraction unit 25 searches the entire hard disk and searches for a file or a folder (step S20). Subsequently, the extraction unit 25 determines whether an unsearched file or folder has been searched (step S21).

  When an unsearched file or folder is searched (step S21; Yes), the extraction unit 25 determines whether or not the searched file is a folder (step S22).

  If the searched file is not a folder (step S22; No), the extraction unit 25 acquires the last access date and time of the searched file (step S23). Subsequently, the extraction unit 25 determines whether or not the last access date is before the candidate limit date (step S24).

  When the last access date and time is before the candidate limit date (step S24; Yes), the extraction unit 25 updates the candidate list 13 in order of date (step S25). Thus, for example, as shown in FIG. 12A, the oldest access date and time (oldest last access date and time) of Folder A in which the file whose last access date and time is April 22, 2000 is stored, and the folder path name The length and folder name are registered. Then, it returns to step S20.

  In this way, an unsearched file or folder is searched for in the set folder (step S21; Yes), the searched is not a folder (step S22; No), and the last access date is from the candidate limit date. If it is before (step S24; Yes), information on the folder to which the file belongs is registered in the candidate list 13.

  During the repetition, if the searched folder is a folder (step S22; Yes), the extraction unit 25 recursively performs a folder investigation process (step S26). For example, when FolderF under FolderE is searched during the search in FolderE, the extraction unit 25 executes a folder investigation processing subroutine for FolderF (step S26).

  In this folder investigation process, an unsearched file or folder is searched in the set folder (step S21; Yes), and the searched folder is not a folder (step S22; No), and the last access date is the candidate limit. If it is before the date (step S24; Yes), information on the folder to which the file belongs is registered in the candidate list 13.

  For example, as shown in FIG. 12B, FolderF under FolderE in which a file whose last access date is November 25, 1999 is stored. Here, since the last access date / time of FolderF (November 25, 1999) is earlier than the last access date / time of FolderA that has already been registered (April 22, 2000), FolderF is better than FolderA. Inserted before. That is, in the candidate list 13, the candidates are sorted in the order of date from the oldest.

  After the folder survey process ends, the extraction unit 25 returns to step S20.

  When the search of all the files in the file storage unit 4 is completed (step S21; No), the extraction unit 25 ends the folder investigation processing subroutine. When the folder survey process is completed, the process returns to FIG. 7, and the extraction unit 25 ends the list generation process subroutine.

  Returning to FIG. 6, the extraction unit 25 performs activation setting so that the security management task 11 is activated simultaneously with the next activation of the PC (step S <b> 2). Thereafter, the extraction unit 25 ends the initial activation process.

  Next, a PC activation process executed when the PC is activated will be described. This PC activation process is executed immediately after the PC is turned on. As shown in FIG. 9, the CPU of the main control unit 5 determines whether or not the security management task 11 is activated (step S30). If the activation setting of the security management task 11 is set (step S30; Yes), the CPU of the main control unit 5 activates the security management task 11 with a low priority (step S31).

  This priority is a priority related to the execution right of the CPU by the task. Starting with a low priority means that if another task with a high priority has the right to execute the CPU, the task cannot operate using the CPU. A task having a lower priority can operate using the CPU only when a task having a higher priority than the task does not have the right to execute the CPU.

  Subsequently, the CPU performs another task activation process (step S32). The priorities of these other tasks are also set. Thereafter, the main control unit 5 shifts to normal operation.

  During normal operation of the main control unit 5, the busy detection unit 22 detects the CPU free state. When a task with high priority is being executed, the busy detector 22 detects and outputs that the CPU is busy. When the CPU is executing a background task with the lowest priority, it is detected that the CPU is in an empty state. When the CPU is currently empty, the automatic encryption process of the security management task 11 shown in FIG. 10 is executed.

  As shown in FIG. 10, first, the extraction unit 25 calculates a processing limit date (step S40). Here, the extraction unit 25 obtains the current date from the clock unit 3, and calculates a processing limit date by subtracting a processing threshold (for example, 3 years) therefrom.

  In the present embodiment, the candidate limit date is 2 years before the current date and the processing limit date is 3 years before the current date. Therefore, the listed folders are encrypted over 1 year. .

  Subsequently, the extraction unit 25 opens the candidate list 13 (step S41). Further, the extraction unit 25 reads the top candidate of the candidate list 13 (step S42). For example, in the example shown in FIG. 12B, FolderF whose earliest access date and time is November 25, 1999 is read as a leading candidate.

  Subsequently, the extraction unit 25 determines whether or not the date of the leading candidate is 0 (step S43). The fact that the date is 0 means that the encryption of the corresponding folder has already been processed, as will be described later. When the date is not 0 (step S43; No), the extraction unit 25 determines whether or not the oldest access date and time is before the processing limit date (step S44).

  When the earliest access date / time is before the processing limit date (step S44; Yes), the changing unit 26 selects all the files included in the folder whose final access date / time is before the processing limit date. The file is encrypted (step S45). Thereafter, the extraction unit 25 sets 0 to the date of the first candidate in the candidate list 13 (step S46).

  Next, the extraction unit 25 skips the data reading position by the length of the current candidate filter path name and reads the next candidate (step S47). Subsequently, the extraction unit 25 determines whether all candidates have been read and the candidate list 13 has been completed (step S48).

  If there is a candidate that has not yet been read and the candidate list 13 has not ended (step S48; No), the extraction unit 25 returns to step S43. Thereafter, as long as the date of the candidate registered in the candidate list 13 is not 0 (step S43; No), if the earliest access date is before the processing limit date (step S44; Yes), the changing unit 26 Of the files included in the folder, all files whose last access date is before the processing limit date are encrypted (step S45), and the candidate date is set to 0 (step S46). The extraction unit 25 and the change unit 26 repeat such processing.

  When the oldest access date / time is not earlier than the processing limit date (No at Step S44), or when all candidates are read out and the candidate list 13 is completed (Step S48; Yes). The extraction unit 25 ends the process.

  If the date of the target candidate is 0 (step S43; Yes), the extraction unit 25 determines whether or not the last candidate in the candidate list 13 has been searched (step S49). If the candidate list 13 has not ended (step S49; No), the extraction unit 25 reads the next candidate (step S47). On the other hand, when all candidates have been read and the candidate list 13 has been completed (step S49; Yes), the extraction unit 25 executes a list generation processing subroutine (see FIG. 7) (step S50) to execute the processing. finish.

  Note that, when this list generation processing subroutine is executed, the date has passed since the previous execution of the list generation processing subroutine. Therefore, there is a possibility that a file whose last access date is earlier than the candidate limit date is newly detected. Therefore, at this point, a list generation processing subroutine is executed (step S50).

  When a file whose last access date is earlier than the candidate limit date is newly detected in this list generation processing subroutine, a folder to which the file belongs is newly created in the candidate list 13 in order of date.

  By newly creating a candidate in the candidate list 13, an optimized encryption process is performed for the next year.

  In this embodiment, among the files in the folder to which the file whose last access date is earlier than the candidate limit date belongs, the file whose last access date is before the processing limit date is encrypted. Is done. However, after that, when the encrypted file in the folder is accessed, the file is decrypted (released) using the decryption key. FIG. 11 shows a file open process for canceling the encryption of the file.

  When the file is accessed, this file open process is executed. As shown in FIG. 11, first, the CPU determines whether or not the file to be opened is an encrypted file that has been encrypted (step S60). If it is determined that the file is an encrypted file (step S60; Yes), the release unit 27 decrypts the file to be opened using the decryption key (step S61). If it is not determined that the file is an encrypted file (step S60; No), the CPU proceeds to normal processing.

  After the data is decrypted (step S61), the release unit 27 determines whether the security management unit 23 is an automatically encrypted file that has been automatically encrypted (step S62). When it is determined that the file is an automatically encrypted file (step S62; Yes), the release unit 27 updates the contents of the opened file with the decrypted decrypted data (step S63). Thereby, the last access date and time of the file is also updated, and the file is excluded from the objects to be encrypted by the security management unit 23. After updating the contents of the file, the CPU proceeds to normal processing.

  On the other hand, if the file is not an automatically encrypted file (step S62; No), the CPU proceeds to normal processing.

  As described above in detail, according to the present embodiment, all old files that have not been accessed for a predetermined period are encrypted. For this reason, even if an old file that has not been accessed is leaked, the contents cannot be decrypted by a third party. Therefore, the security of the old file that has not been accessed stored in the file storage unit 4 is automatically set. Can be secured.

  In the present embodiment, the search for the encrypted file every day is minimized by creating the candidate list 13. As a result, the processing time can be shortened, so that the burden on the CPU can be reduced.

  By the way, as a typical example of a file system, for example, there is NTFS (NT File System) of Windows (registered trademark). NTFS supports a function that encrypts a file or folder containing confidential information and decrypts the file when the password is authenticated, that is, a function that manages confidential information. . All old confidential information can be encrypted using this function.

  However, the confidential information management function provided by the file system described above is refrained from reasons such as heavy processing and inefficiency in daily processing, and troubles in recovery due to hardware failure, etc. The fact is that it is not used.

  In addition, encryption using Windows (registered trademark) NTFS is an operation using a common key and is relatively light in operation, but it still performs computation and arrangement movement on 1-byte data many times. When encrypted, there is a disadvantage that processing of file access itself becomes heavy.

  Furthermore, since the key file cannot be created from a normal GUI (Graphical User Interface), there are many users who are very troublesome and not implemented. For this reason, when an accident occurs, even if there is a file that is used everyday that you want to access immediately, you cannot use it, and there is a risk that it will hinder your work.

  Therefore, in this embodiment, when the CPU is in an empty state, the security management task 11 is executed, and an old file that has not been accessed is encrypted. Thereby, it is possible to prevent the execution of other tasks from being hindered. As a result, the user does not feel heavy processing or inconvenience.

  As described above, in this embodiment, the file encryption processing is optimized so that the hard disk is not wastedly accessed, and the file is always scanned as in the case of all the anti-virus software search. I don't mean. This prevents the user from feeling uncomfortable with the operating sound of the hard disk.

  In the present embodiment, file encryption candidate management is performed in units of folders. By having candidate folders in the list, it is possible to reduce the processing load on the CPU, rather than re-searching all the files. In addition, the capacity of the candidate list 13 can be reduced.

  Further, according to the present embodiment, first, folders to which a file whose last access date is earlier than the candidate limit date (first date) belong are listed in the candidate list 13. Then, the file belonging to the folder whose last access date and time of the folder listed in the candidate list 13 is earlier than the processing limit date (second date) is encrypted. In this way, the extraction and encryption processing of old files that have not been accessed for a certain period of time can be simplified, and the processing burden on the CPU can be reduced.

  In the present embodiment, for the encrypted folder, the date of the candidate list 13 is set to 0, and the date is sequentially set to 0 to manage the progress of the encryption process and search the list. Is streamlining.

  Also, according to the present embodiment, when an automatically encrypted file is accessed by the security management unit 23, the file is decrypted. In this way, the processing load on the CPU when using the file can be reduced. As a result, it is possible to prevent the processing from becoming heavy and the operation from becoming troublesome.

  In order to distinguish between the automatically encrypted file and the file arbitrarily encrypted by the user, for example, a special identifier indicating an encryption attribute may be provided in the file management information. .

  In this embodiment, an old file that has not been accessed for a certain period is encrypted. In this way, even if the file is leaked, the use of a third party file can be restricted, so that the security of an old file that has not been accessed can be ensured.

  As described above, in this embodiment, the file is encrypted, but the file may be changed so that authentication is required at the time of use. Even in this case, even if the file is leaked, the use of the third party file can be restricted, so that the security of the old file that has not been accessed can be ensured.

  In the above embodiment, in the folder investigation process, a large number of files in the PC are searched. If the physical location of the file in the hard disk is known, the seek time of the hard disk head is minimized. As described above, a file or folder arranged in the vicinity of the accessed file may be set as the next search target. In this way, the operating speed can be increased and the burden on the PC can be reduced.

  In the above embodiment, the file or folder is the object of encryption, but the present invention is not limited to this. It goes without saying that any information such as personal information such as e-mail addresses in the address book and e-mail address classification information may be subject to encryption.

  In each of the above embodiments, the program executed by the computer 100 is a computer read such as a flexible disk, a CD-ROM (Compact Disk Read-Only Memory), a DVD (Digital Versatile Disk), and an MO (Magneto-Optical Disk). A system that executes the above-described processing may be configured by storing the program in a possible recording medium, distributing the program, and installing the program.

  Further, the program may be stored in a disk device or the like of a predetermined server device on a communication network such as the Internet, and may be downloaded, for example, superimposed on a carrier wave.

  In addition, when the above functions are realized by sharing an OS (Operating System), or when the functions are realized by cooperation between the OS and an application, only the part other than the OS may be stored in a medium and distributed. You may also download it.

  The present invention is suitable for security management of information stored in an information processing apparatus.

  DESCRIPTION OF SYMBOLS 1 ... Operation part, 2 ... Display part, 3 ... Clock part, 4 ... File storage part, 5 ... Main control part, 10 ... File group, 11 ... Security management task, 12 ... Other task group, 13 ... Candidate list, 20 DESCRIPTION OF SYMBOLS ... File system, 21 ... Task management part, 22 ... Busy detection part, 23 ... Security management part, 25 ... Extraction part, 26 ... Change part, 27 ... Release part, 30, 31 ... Storage device, 100 ... Computer

Claims (10)

An extraction unit for extracting information whose last access date and time when access was performed is earlier than a predetermined time from the information stored in the storage device;
A changing unit that changes the content of the information so that use of the information extracted by the extracting unit is restricted;
Equipped with a,
The extraction unit includes:
Information that the last access date and time when access was performed is earlier than the first time point is extracted as a candidate,
From among the extracted candidates, information whose last access date and time when access was performed is earlier than the second time point is extracted as a change target.
Security management device. The extraction unit includes:
When the CPU of the information processing apparatus that processes the information stored in the storage device is in an empty state, the CPU extracts information whose last access date and time when access was performed is earlier than a predetermined time To
The security management device according to claim 1. The changing unit is
When the CPU of the information processing apparatus that processes the information stored in the storage device is in an empty state, the content of the information extracted by the extraction unit is changed using the CPU.
The security management device according to claim 1, wherein the security management device is a security management device. The Symbol 憶 device information stored in is managed by classifying,
The extraction unit includes:
Extract the classification that contains the information that the last access date and time accessed for each classification is earlier than the predetermined time,
The changing unit is
Of the information included in the extracted classification, change the content of all the information whose last access date and time is earlier than the predetermined time,
The security management device according to claim 1, wherein the security management device is a security management device. When the change unit accesses the information changed so that the use is restricted, the change unit further includes a release unit that releases the use restriction.
The security management device according to any one of claims 1 to 4 , wherein The changing unit is
Encrypting the information;
The security management device according to any one of claims 1 to 5 , wherein The changing unit is
Change the content of the information so that authentication is required when using it.
The security management apparatus according to any one of claims 1 to 6 , wherein The extraction unit includes:
Files with the last access date and time of access before the first time are extracted as candidates in folder units,
From the extracted candidates, a file whose access date and time last accessed is before the second time point is extracted as a change target in units of folders.
8. The security management apparatus according to claim 1, wherein An extraction step of extracting information from the information stored in the storage device that the last access date and time of access is earlier than a predetermined time point;
A change step of changing the content of the information so that use of the information extracted in the extraction step is limited;
Only including,
In the extraction step,
Information that the last access date and time when access was performed is earlier than the first time point is extracted as a candidate,
From among the extracted candidates, information whose last access date and time when access was performed is earlier than the second time point is extracted as a change target.
Security management method. An extraction procedure for extracting, from the information stored in the storage device, information whose last access date and time when access was performed is earlier than a predetermined time point;
A change procedure for changing the content of the information so that use of the information extracted in the extraction procedure is limited;
To the computer ,
In the extraction procedure,
Information that the last access date and time when access was performed is earlier than the first time point is extracted as a candidate,
From among the extracted candidates, information whose last access date and time when access was performed is earlier than the second time point is extracted as a change target.
Program.

Images