JP6193149B2 - Storage connection system, storage connection device, storage sharing method, and program - Google Patents

Description

  Embodiments described herein relate generally to a storage connection system, a storage connection device, a storage sharing method, and a program.

  In a system such as a plant monitoring system where security is important, a system may be constructed on a closed network (closed network) without being connected to an external network such as the Internet. This eliminates external security risks such as virus infection via the network.

  Even in such a system, data generated by the system such as plant data collected by the monitoring system may be used for secondary use or may be desired to be backed up. In this case, plant data may be downloaded by connecting an external storage such as a USB (Universal Serial Bus) memory to a device (terminal / server) storing the data. In some cases, such as when the backed up data is returned and reused, an external storage in which the data is stored is connected to a device in the system.

  However, if anti-virus software (also called anti-virus software) is installed on a device in the system to prevent malware infection due to the connection of external storage, the load caused by the anti-virus software will affect the business processing of that device. There was a possibility of giving.

JP 2008-299864 A

  The problem to be solved by the present invention is to provide a storage connection system, a storage connection device, a storage sharing method, and a program capable of safely connecting an external storage while suppressing the influence on the business process by the anti-virus software. That is.

The storage connection system of the embodiment has a user operation terminal device and a storage connection device. Storage connection device is a connection user operation terminal Rutotomoni, external storage is connected. The storage connection device has a shared folder access unit, a hidden sharing setting unit, and a storage information notification unit. Shared folder access unit, to the connection to an external device, from the external apparatus, in accordance with the access request a share name shared folder to access the shared folder of the specified share name. The hidden sharing setting unit sets the external storage connected to the own device to hidden sharing. Storage information notification unit, upon being requested to share name of the external storage that is set in the shared Shi hidden, requesting external device determines whether the user operation terminal, when a user operation terminal Only notify the requested share name. The user operation terminal device has an external storage information acquisition unit and a storage access unit. The external storage information acquisition unit requests the storage connection device for a shared name of the external storage, and acquires the shared name of the external storage notified as a response to the request. The storage access unit makes an access request specifying the shared name of the external storage acquired by the external storage information acquisition unit to the storage connection device.

The schematic block diagram which shows the plant monitoring system 100 of embodiment. The schematic block diagram which shows the user operation terminal device 10 of embodiment. 1 is a schematic block diagram showing a storage connection device 20 of an embodiment. The schematic diagram which shows the storage selection screen G of embodiment. FIG. 6 is a sequence diagram showing an operation of the storage connection system 70 of the embodiment.

  Hereinafter, a storage connection system, a storage connection device, a storage sharing method, and a program according to embodiments will be described with reference to the drawings.

  FIG. 1 is a schematic block diagram showing the configuration of the plant monitoring system 100. The plant monitoring system 100 is a system that monitors plants such as water and sewage treatment facilities, factory production facilities, and power plant facilities. The plant monitoring system 100 may also perform control in addition to monitoring.

  The plant monitoring system 100 includes a user operation terminal device 10, a storage connection device 20, servers 40a and 40b, plant controllers 50a and 50b, and a network 60. Further, the user operation terminal device 10 and the storage connection device 20 operate as a storage connection system 70. The user operation terminal device 10 provides a user interface of the plant monitoring system 100. For example, the user operation terminal device 10 acquires and displays data (hereinafter referred to as plant data) related to a plant generated or collected by the servers 40a and 40b and the plant controllers 50a and 50b. The plant data includes, for example, information representing measured values by devices constituting the plant, operating states of those devices, operating states of the plant controllers 50a and 50b, and the like. Moreover, the user operation terminal apparatus 10 has input devices, such as a mouse | mouth and a keyboard, for example, and receives the user operation which controls server 40a, 40b and plant controller 50a, 50b.

  The storage connection device 20 is a device to which the external storage 30 is connected. In the storage connection device 20, anti-virus software is operated in order to prevent computer virus infection through the connected external storage 30. The external storage 30 is an external storage that can be attached to and detached from the storage connection device 20 even when the storage connection device 20 is operating, such as a USB memory or a CD-R (Compact Disc Recordable).

  Each of the servers 40a and 40b stores the plant data distributed from the plant controllers 50a and 50b as filing data in the internal storage of its own device. The plant controllers 50a and 50b acquire plant data from the devices constituting the target plant and distribute them to the servers 40a and 40b, respectively. Moreover, the plant controllers 50a and 50b may control those devices and include the control content and the operation status of the own device in the plant data.

  The network 60 is a closed local area network (LAN) that is not connected to an external network such as the Internet. The network 60 connects the user operation terminal device 10, the storage connection device 20, the servers 40a and 40b, and the plant controllers 50a and 50b so that they can communicate with each other.

  FIG. 2 is a schematic block diagram illustrating the configuration of the user operation terminal device 10. The user operation terminal device 10 includes a plant data display unit 11, a storage selection unit 12, an external storage information acquisition unit 13, a network communication unit 14, a storage access unit 15, an internal storage 16, and a plant data reception unit 17. The plant data display unit 11 displays plant data acquired from the internal storage 16 or the external storage 30 to the user. Further, the plant data display unit 11 copies plant data stored in the internal storage 16 to the external storage 30 or copies plant data stored in the external storage 30 to the internal storage in accordance with a user instruction. At this time, the plant data display unit 11 acquires the folder configuration of the internal storage 16 or the external storage 30 from the storage selection unit 12, and instructs the storage access unit 15 to read and write the plant data using the folder configuration. . In the present embodiment, the folder configuration indicates the configuration of all folders and files stored in the storage, but may be the configuration of folders and files below a specific folder.

  The storage selection unit 12 receives a user operation for designating a storage from which plant data is read or written. The storage selection unit 12 acquires the folder configuration of the storage designated by the user operation, and notifies the plant data display unit 11 of it. When the storage specified by the user operation is the internal storage 16, the storage selection unit 12 specifies the internal storage 16 and requests the storage access unit 15 to acquire the folder configuration of the internal storage 16.

  When the storage specified by the user operation is the external storage 30, the storage selection unit 12 first requests the external storage information acquisition unit 13 to acquire the shared name of the external storage 30. The storage selection unit 12 then requests the storage access unit 15 to acquire the folder configuration of the external storage 30 by specifying the acquired share name.

  When requested by the storage selection unit 12, the external storage information acquisition unit 13 requests the shared name of the external storage 30 from the storage connection device 20 via the network communication unit 14. The external storage information acquisition unit 13 notifies the storage selection unit 12 of the share name acquired as a response to this request. The network communication unit 14 communicates with other devices via the network 60. Communication with other devices via the network 60 by each unit of the user operation terminal device 10 is performed by the network communication unit 14.

  The storage access unit 15 acquires the folder configuration of the internal storage 16 and reads / writes a specified file to / from the internal storage 16 or the external storage 30. The storage access unit 15 reads and writes files from / to the external storage 30 via the network communication unit 14. The internal storage 16 is a storage device provided in the user operation terminal device 10 such as an HDD (Hard Disk Drive). The plant data receiving unit 17 receives the plant data distributed by the plant controllers 50 a and 50 b via the network communication unit 14 and stores it in the internal storage 16.

  FIG. 3 is a schematic block diagram showing the configuration of the storage connection device 20. The storage connection device 20 includes a storage information notification unit 21, a hidden shared storage unit 22, a hidden share setting unit 23, a virus countermeasure unit 24, a connection detection unit 25, a USB access unit 26, a network communication unit 27, and a shared folder access unit 28. Including. The storage information notification unit 21, the hidden shared storage unit 22, the hidden sharing setting unit 23, and the connection detection unit 25 constitute an application unit 29. The application unit 29 is realized by a computer included in the storage connection device 20 reading and executing application software.

  When requested by the user operation terminal device 10, the storage information notification unit 21 notifies the request source device of the shared name of the external storage 30 stored in the hidden shared storage unit 22. It is preferable that the storage information notification unit 21 determines whether the request source is the user operation terminal device 10 and notifies the share name only when the request source is the user operation terminal device 10. Whether or not the request source is the user operation terminal device 10 may be determined based on whether or not an IP (Internet Protocol) address or a MAC (Media Access Control) address is a predetermined value. Alternatively, the determination may be made by authentication using an electronic certificate, a private key, or the like. You cannot access the shared folder unless you specify the share name. For this reason, even if an attacker has entered the network 60, it is difficult for an attacker who does not know the shared name of the external storage 30 to access the external storage 30. Further, by determining only the user operation terminal device 10 that can determine the request source and obtain the shared name, even if malware such as a computer virus is stored in the external storage 30, other devices can detect the malware. Can be made inaccessible.

  The hidden shared storage unit 22 stores the shared name of the external storage 30 set by the hidden shared setting unit 23 for hidden sharing. When requested by the connection detection unit 25, the hidden sharing setting unit 23 sets the external storage 30 to hidden sharing. The hidden sharing setting unit 23 stores the shared name of the external storage 30 set to hidden sharing in the hidden sharing storage unit 22. The anti-virus unit 24 executes white list type anti-virus software that allows only authorized programs to be executed. As a result, when an unintended program such as a computer virus is stored in the external storage 30, the program may be prevented from being executed. Further, since it is a white list type, it is not necessary to frequently update data, and the network 60 can be operated with a closed LAN.

  The connection detection unit 25 detects that the external storage 30 is connected to the USB port of the own device, and requests the hidden sharing setting unit 23 to set the hidden sharing. The USB access unit 26 has a USB port and provides each unit with access to the external storage 30 connected to the USB port. The network communication unit 27 performs communication with other devices via the network 60. Communication with other devices via the network 60 by each unit of the storage connection device 20 is performed by the network communication unit 27.

  The shared folder access unit 28 provides access to a shared folder (shared folder) to another device (external device) connected via the network 60. The shared folder access unit 28 is a function provided by an OS (Operating System) installed in the storage connection device 20. Specifically, the shared folder access unit 28 publishes the share name of the shared folder to other devices connected via the network 60, but does not publish those set as hidden sharing. Further, the shared folder access unit 28 accesses the shared folder with the specified share name in accordance with an access request specifying the share name from another device connected via the network 60.

  FIG. 4 is a schematic diagram showing the storage selection screen G. The storage selection screen G includes a radio button RB, a drive selection list DS, a folder configuration display area FS, and a selection button B. The radio button RB is a button for the user to specify which of the internal storage 16 (local drive) and the external storage 30 (secure drive) is to be accessed. The storage selection unit 12 acquires the folder configuration of the storage designated by this radio button RB.

  When the storage selected by the radio button RB has a plurality of drives, the drive selection list DS is a selection list for designating the drive name by the user. When the external storage 30 is designated by the radio button RB, a shared name may be displayed as a drive name. The folder configuration display area FS displays the folder configuration of the drive selected in the drive selection list DS of the storage selected with the radio button RB in a tree. The selection button B is a button for designating that the currently selected file / folder is the file / folder to be accessed from the folder configuration display area FS.

  FIG. 5 is a sequence diagram showing the operation of the storage connection system 70. When the external storage 30 is connected to the storage connection device 20 (S1), the connection detection unit 25 of the storage connection device 20 detects the connection, and the hidden sharing setting unit 23 sets the external storage 30 to hidden sharing ( S2). Also, the hidden sharing setting unit 23 stores the shared name of the external storage 30 set to hidden sharing in the hidden sharing storage unit 22.

  On the other hand, when the user designates a secure drive (external storage 30) as the plant data reference destination in the user operation terminal device 10 (S3), the external storage information acquisition unit 13 of the user operation terminal device 10 requests the share name. Is transmitted to the storage connection device 20 (S4). When the storage information notification unit 21 of the storage connection device 20 receives the request for the share name, it reads the share name from the hidden shared storage unit 22 and notifies the user operation terminal device 10 of it (S5). The storage access unit 15 of the user operation terminal device 10 specifies the notified share name, and requests acquisition of the folder configuration of the external storage 30 and access to the external storage 30. In response to this request, the shared folder access unit 28 of the storage connection device 20 accesses the external storage 30 (S6).

It is desirable that the USB ports of the respective devices other than the storage connection device 20 are physically blocked so that the user cannot easily insert the USB memory into these USB ports.
Further, the storage information notification unit 21 may notify the user operation terminal device 10 not only of the share name but also of the folder configuration of the external storage 30.
A plurality of external storages 30 may be connected to the storage connection device 20. In that case, the storage information notification unit 21 notifies the shared name of each of the plurality of external storages 30.

As described above, the storage connection device 20 includes the storage information notification unit 21 and the shared folder access unit 28 that notify the share name of the external storage 30 when requested by the user operation terminal device 10.
Further, the user operation terminal device 10 includes an external storage information acquisition unit 13 and a storage access unit 15. The external storage information acquisition unit 13 requests the shared name of the external storage 30 from the storage connection device 20. The storage access unit 15 makes an access request specifying the share name of the external storage 30 acquired by the external storage information acquisition unit 13 to the storage connection device 20.

  As a result, even if the anti-virus software is operated in the storage connection device 20, the user operation terminal device 10 performing the business process is connected to the storage connection device 20 without operating the anti-virus software on its own device. The external storage 30 can be accessed. Therefore, the external storage 30 can be safely connected while suppressing the influence of the anti-virus software.

Furthermore, the storage connection device 20 includes a hidden sharing setting unit 23 that sets the external storage 30 as a hidden shared folder when the external storage 30 is connected to the own device.
As a result, the user can easily access the external storage 30 only by connecting the external storage 30 to the storage connection device 20.

  According to at least one embodiment described above, the shared name of the external storage 30 is notified when requested by the hidden sharing setting unit 23 that sets the external storage to the shared folder of the hidden sharing and the user operation terminal device 10. By having the storage information notification unit 21 that performs this, it is possible to safely connect the external storage while suppressing the influence on the business process by the anti-virus software.

  Further, a program for realizing the function of the user operation terminal device 10 or the storage connection device 20 in FIG. 1 is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into a computer system, By executing this, the user operation terminal device 10 or the storage connection device 20 may be realized. Here, the “computer system” includes an OS and hardware such as peripheral devices.

Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used.
The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Furthermore, the “computer-readable recording medium” dynamically holds a program for a short time like a communication line when transmitting a program via a network such as the Internet or a communication line such as a telephone line. In this case, a volatile memory in a computer system serving as a server or a client in that case, and a program that holds a program for a certain period of time are also included. The program may be a program for realizing a part of the functions described above, and may be a program capable of realizing the functions described above in combination with a program already recorded in a computer system.

  Although several embodiments of the present invention have been described, these embodiments are presented by way of example and are not intended to limit the scope of the invention. These embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope and gist of the invention, and are also included in the invention described in the claims and the equivalents thereof.

DESCRIPTION OF SYMBOLS 10 ... User operation terminal device, 11 ... Plant data display part, 12 ... Storage selection part, 13 ... External storage information acquisition part, 14 ... Network communication part, 15 ... Storage access part, 16 ... Internal storage, 17 ... Plant data reception , 20 ... Storage connection device, 21 ... Storage information notification unit, 22 ... Hidden shared storage unit, 23 ... Hidden sharing setting unit, 24 ... Virus countermeasure unit, 25 ... Connection detection unit, 26 ... USB access unit, 27 ... Network Communication unit 28 ... Shared folder access unit 29 ... Application unit 30 ... External storage 40a, 40b ... Server 50a, 50b ... Plant controller 60 ... Network 70 ... Storage connection system 100 ... Plant monitoring system

Claims (9)

Comprising a user operation terminal, which a connected Rutotomoni, a storage connection device external storage is connected,
The storage connection device is:
Against connection to an external device, from the front Kigaibu device according access request specifying the share name of shared folders, and shared folder access unit to access the shared folder of the specified share name,
A hidden sharing setting unit that sets the external storage connected to the own device to hidden sharing;
When requested the shared name of the external storage that is set in the shared Shi hidden, is requesting the external device to determine whether the a user operation terminal, only when the a user operation terminal , and a storage information notification unit for notifying the shared name requested,
The user operation terminal device
An external storage information acquisition unit that requests the storage connection device for a shared name of the external storage and acquires the shared name of the external storage notified as a response to the request;
A storage connection system comprising: a storage access unit that makes an access request specifying the shared name of the external storage acquired by the external storage information acquisition unit to the storage connection device. Comprising a user operation terminal, which a connected Rutotomoni, a storage connection device external storage is connected,
The storage connection device is:
When the external storage is connected, a connection detection unit that detects this connection;
A hidden sharing setting unit for setting the external storage to be hidden sharing;
Upon receiving a request for the external storage share name from the user operation terminal device, a storage information notification unit for notifying the user operation terminal device of the share name of the external storage;
When receiving a request for access to the external storage using the shared name from the user operation terminal device, a shared folder access unit for accessing the external storage;
A storage connection system. The storage connection device is:
When the external storage is connected to its own device, the shared storage is a shared folder, and the shared name is notified to the user operation terminal device only by the storage information notification unit. having a hidden share setting unit that sets a folder, a storage access system according to claim 1 or 2. Against connection to an external device, before the Kigaibu device according access request specifying the share name of shared folders, storage connection device having a shared folder access unit to access the shared folder of the specified share name Because
A hidden sharing setting unit that sets the external storage connected to the own device to hidden sharing;
When requested the shared name of the external storage that is set in the shared Shi hidden, is requesting the external device to determine whether the a user operation terminal, only when the a user operation terminal And a storage information notifying unit for notifying the requested share name. When the external storage is connected, a connection detection unit that detects this connection,
A hidden sharing setting unit for setting the external storage to be hidden sharing;
Upon receiving a request for the shared name of the external storage from the user operation terminal device, a storage information notification unit that notifies the user operation terminal device of the shared name of the external storage;
When receiving a request for access to the external storage using the shared name from the user operation terminal device, a shared folder access unit for accessing the external storage;
A storage connection device comprising: Against connection to an external device, before the Kigaibu device according access request specifying the share name of shared folders, storage connection device having a shared folder access unit to access the shared folder of the specified share name Storage sharing method in
A first step of setting the external storage connected to the own device to hidden sharing;
A hidden second process of receiving a request for share name of the external storage that is set to shared,
When the request is received in the second process, it is determined whether or not the external device that is the request source is the user operation terminal device, and only when the request is the user operation terminal device, the requested shared name is storage sharing method and a third step of notification. When external storage is connected, a first process of detecting this connection;
A second step of setting the external storage to hidden sharing;
A third process of notifying the user operation terminal device of the share name of the external storage upon receiving a request for the share name of the external storage from the user operation terminal device;
When receiving a request for access to the external storage using the shared name from the user operation terminal device, a fourth process of accessing the external storage;
A storage sharing method. Against connection to an external device, from the front Kigaibu device according access request specifying the share name of shared folders, the computer functioning as a shared folder access unit to access the shared folder of the specified share name ,
A hidden sharing setting unit that sets the external storage connected to the own device to hidden sharing;
When requested the shared name of the external storage that is set in the shared Shi hidden, is requesting the external device to determine whether the a user operation terminal, only when the a user operation terminal , A program for functioning as a storage information notification unit that notifies the requested share name . When the external storage is connected, a connection detection unit that detects this connection,
A hidden sharing setting unit for setting the external storage to be hidden sharing;
Upon receiving a request for the shared name of the external storage from the user operation terminal device, a storage information notification unit that notifies the user operation terminal device of the shared name of the external storage;
When receiving a request for access to the external storage using the shared name from the user operation terminal device, a shared folder access unit for accessing the external storage;
As a program to make the computer function as.

Images