WO2006051592A1

WO2006051592A1 - Storage, access control system, and access control method

Info

Publication number: WO2006051592A1
Application number: PCT/JP2004/016735
Authority: WO
Inventors: Mariko Sawamura; Takehisa Mizuguchi; Shoji Sakurai; Tatsuji Munaka
Original assignee: Mitsubishi Denki Kabushiki Kaisha
Priority date: 2004-11-11
Filing date: 2004-11-11
Publication date: 2006-05-18

Abstract

Temporary permission of access to data or a program is given to another person or device, access to data or programs other than the data or program is prevented, and access by a person other than the person to be given access permission is prevented. Storages (100) are installed in portable telephones A and B (200, 300). In each storage (100), a temporary password creating section (109) creates a password (temporary password) effective for a certain time, and a temporary data management section (110) sets the temporary password to the data stored in a private storage section (102) so as to temporarily permit another person or device to make an access and performs authentication and access control of the portable telephones A and B (200, 300) by means of the temporary password.

Description

Specification

Storage device, access control system, and access control method

Technical field

[0001] The present invention relates to a storage device, an access control system, and an access control method.

Background art

In the conventional technology, when performing access control to data, a user is authenticated, and it is confirmed whether the user has an access right to data. For user authentication, one-time passwords that change each time are also used to improve security (for example, Patent Document 1).

[0003] As an access control method for data exchange, there is a method of distributing data by encrypting with an access key stored in a user ID (IDentification) card (for example, Patent Document 2).

Patent Document 1: Japanese Patent Laid-Open No. 11-3033

Patent Document 2: JP 2002-281012 A

Disclosure of the invention

Problems to be solved by the invention

[0004] In conventional access control based on user authentication such as Patent Document 1, a user who accesses data is stored in the system where the data is stored and correctly registered as a user unless it is identified as a user. Because you can't access it, you can't give temporary access, such as 1 hour or 5 minutes! There is a problem.

[0005] When you want someone to temporarily access specific data or services,

In the case of user authentication using a (Circuit) card, it is not desirable for security to tell others the password or PIN (Personal Identification Number) that is normally used by the user. Therefore, the IC card is handed over to another person after entering his / her own password or PIN and the access restrictions are removed, and there is a risk of unauthorized access to other data services. [0006] In Patent Document 2, access control depends on a key held by a user, and there is a problem that data can be distributed only to a partner who has previously distributed the key.

[0007] Although it is possible for a user to temporarily set a password for data and perform access control, when a human sets a temporary password or PIN, a similar value is set. There is a problem of being apt to choose. This means that if a temporary password is broken, other passwords of the user are likely to be broken, and there is a risk that more important information may be leaked.

[0008] The present invention temporarily grants access to data and programs to other people and other devices, prevents access to data and programs other than the data and programs that the user wants to permit, and accesses from other than those who give permission. The purpose is to prevent.

Means for solving the problem

The storage device of the present invention

In a storage device attached to the first electronic device and the second electronic device,

A data storage unit for storing data;

A password generator for generating a first password;

A password storage unit for storing the first password generated by the password generation unit;

A password transmission unit for transmitting the first password stored in the password storage unit to the first electronic device;

A password receiving unit that also receives the second password of the second electronic device, the first password stored in the password storage unit and the second password received by the password receiving unit; And an access control unit that controls access from the second electronic device to the data stored in the data storage unit based on the collation result.

[0010] The storage device further includes:

A data reading unit configured to read the data stored in the data storage unit and transmit the data to the second electronic device by access from the second electronic device controlled by the access control unit; It is characterized by. [0011] The storage device further includes:

A data writing unit is provided that receives new data from the second electronic device and writes it in the data storage unit by access from the second electronic device controlled by the access control unit.

[0012] The data storage unit includes:

Memorize the program with the data,

The storage device further includes:

A program execution unit that executes a program stored in the data storage unit by access from the second electronic device controlled by the access control unit is provided.

[0013] The storage device further includes:

It has an authentication unit that authenticates users,

The access control unit

The access from the second electronic device is controlled based on the result of the authentication unit authenticating the user.

[0014] The data storage unit,

A private storage unit that accepts only access from a user authenticated by the authentication unit; and a public storage unit that accepts access from all users including the user who are authenticated by the authentication unit. And

[0015] The storage device further includes:

A current time acquisition unit for acquiring the current time;

An expiration date setting unit for setting an expiration date of the first password generated by the password generation unit;

An expiration date storage unit that stores the expiration date set by the expiration date setting unit, the access control unit,

The current time acquired by the current time acquisition unit is compared with the expiration date stored in the expiration date storage unit, and based on the comparison result, the second electronic device is accessed. It is characterized by controlling.

[0016] The password generation unit

Generating a first secret key instead of the first password, encrypting the data stored in the data storage unit with the first secret key,

The password storage unit

Storing the data encrypted by the password generation unit;

The nose word transmitter

Transmitting the first secret key generated by the password generation unit to the first electronic device;

The password receiver

Receiving the second secret key from the second electronic device instead of the second password, and

The data stored in the password storage unit is decrypted with the second secret key received by the password receiving unit, and collated with the data stored in the data storage unit.

[0017] The access control system of the present invention includes:

In an access control system comprising a first electronic device, a second electronic device, and a storage device attached to the first electronic device and the second electronic device,

The storage device

A data storage unit for storing data;

A password generator for generating a first password;

A password receiving unit that also receives the second password of the second electronic device, the first password stored in the password storage unit and the second password received by the password receiving unit; Based on the matching result, the data An access control unit that controls access from the second electronic device to the data held by the storage unit,

The first electronic device is:

A first storage device mounting unit for receiving the first password transmitted by the password transmission unit;

A display unit for displaying the first password received by the first storage device mounting unit,

The second electronic device is

An input unit for inputting an input value;

A second storage device mounting unit that transmits the second password to the password receiving unit based on an input value input by the input unit is provided.

[0018] The storage device further includes:

It has an authentication unit that authenticates users,

The access control unit

[0019] The data storage unit includes:

[0020] The first electronic device further includes:

A first storage unit for storing the first password received by the first storage device mounting unit;

The display unit

The first password stored in the first storage unit is displayed.

[0021] The storage device further includes:

It has an authentication unit that authenticates users, The access control unit

[0022] The data storage unit includes:

[0023] The first electronic device further includes:

A first communication unit for transmitting the first password received by the first storage device mounting unit;

The second electronic device further includes:

A second communication unit that receives the first password transmitted by the first communication unit, the second storage device mounting unit,

As the second password, the first password received by the second communication unit is transmitted to the password receiving unit.

[0024] The storage device further includes:

It has an authentication unit that authenticates users,

The access control unit

[0025] The data storage unit includes:

[0026] The access control method of the present invention includes: In an access control method using a storage device attached to the first electronic device and the second electronic device,

The storage device

Remember the data,

Generate a first password,

Remember the generated first password,

Sending the stored first password to the first electronic device;

Receiving a second password from the second electronic device;

Collating the stored first password with the received second password, and controlling access from the second electronic device to the stored data storage unit based on the collation result It is characterized by.

The invention's effect

[0027] According to the present invention, it is possible to temporarily grant access to data and programs to other people and other devices, to prevent access to data and programs other than the data and programs to be permitted, and to prevent access from other than the other party to whom permission is granted It becomes possible.

BEST MODE FOR CARRYING OUT THE INVENTION

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[0029] Embodiment 1.

In the following, a mode in which the user A who owns the storage device passes the storage device to the user B and reads the data will be described.

FIG. 1 is a block diagram showing a configuration of a storage device according to the present embodiment and a mobile phone to which the storage device is attached.

[0031] The mobile phone A200 is an example of a first electronic device, and the mobile phone B300 is an example of a second electronic device.

The storage device 100 is attached to the mobile phone A200 and the mobile phone B300.

[0032] In the storage device 100, the storage unit 101 is an area for storing data, and the private storage unit 102 is an area in the storage unit 101 for storing data and programs accessible only by the owner of the storage device 100 The public storage unit 103 is a storage area for storing data and programs that can be accessed by anyone in the storage unit 101. The authentication unit 108 identifies the owner for access to the private storage unit 102. The controller 104 controls the storage device 100, the input / output of the electronic device in which the storage device 100 is mounted, and the inside of the storage device 100. Temporary password generation unit 109 generates a password that is valid for a certain period of time (hereinafter referred to as a temporary password). Temporary data management unit 110 uses the temporary password generated by temporary password generation unit 109 to temporarily permit access from another person or another device to the data stored in private storage unit 102. Set for data and perform authentication and access control by temporary password

In the controller 104, the password transmission unit 105 transmits the temporary password generated by the temporary password generation unit 109 to the electronic device in which the storage device 100 is mounted. The password receiving unit 106 receives a temporary password from the electronic device in which the storage device 100 is installed. If the temporary password received by the password receiving unit 106 is correct, the data reading unit 107 reads the data stored in the storage unit 101 and transmits the data to the electronic device in which the storage device 100 is attached.

In temporary data management section 110, password storage section 112 stores the temporary password generated by temporary password generation section 109. The expiration date setting unit 114 sets the expiration date of the temporary password when the temporary password is generated. The expiration date storage unit 113 stores the expiration date. The current time acquisition unit 115 acquires the current time. The access control unit 111 determines whether the temporary password has not expired or the temporary password is correct, and controls access to the data stored in the storage unit 101.

[0036] Here, the temporary password may be, for example, a 4-digit numerical power PIN or PIN! /.

[0037] Since the private storage unit 102 is a storage area that can be accessed only when the user authentication by the authentication unit 108 is successful, when data in which a temporary password is set is stored in the private storage unit 102, When the data is accessed, authentication using the temporary password by the temporary data management unit 110 is performed in addition to user authentication by the authentication unit 108. Here, for example, the temporary data management unit 110 performs only temporary password authentication and access control on the data, and the authentication unit 108 You can omit user authentication.

[0038] Since the public storage unit 103 is a storage area that can be accessed regardless of the presence or absence of user authentication by the authentication unit 108, when data in which a temporary password is set is stored in the public storage unit 103. When the data is accessed, the temporary data manager performs authentication and access control with the temporary password for the data.

The mobile phone A200 is a terminal used by the user A with the storage device 100 attached. In the mobile phone A200, a storage device IZF (interface) 201 connects the storage device 100 and the mobile phone A200. The display unit 204 performs display on a screen such as an LCD (Liquid Crystal Display). The input unit 203 is, for example, a numeric key and accepts input from the user A. The storage unit 202 is an area for storing data, such as a nonvolatile memory.

[0040] Cellular phone B300 is a terminal used by user B with storage device 100 attached. In the mobile phone B300, a storage device IZF (interface) 301 connects the storage device 100 and the mobile phone B300. A display unit 304 displays on a screen such as an LCD. The input unit 303 is a numeric key, for example, and accepts input from the user B force. The storage unit 302 is an area for storing data, such as a nonvolatile memory.

Next, the operation of the storage device 100 will be described. When user A passes data in storage device 100 of user A to user B, the operation of storage device 100 is divided into an operation for setting a temporary password and an operation for controlling access to data. The former is the operation of the storage device 100 when the user A attaches the storage device 100 to the mobile phone A200 and sets a temporary password, and the latter is the user A disconnects the storage device 100 from the mobile phone A200. This is an operation of the storage device 100 when the user B attaches the storage device 100 to the mobile phone B300 of the user B, inputs a temporary password, and acquires data.

First, the temporary password setting operation will be described.

FIG. 2 is a sequence diagram showing data transmission / reception between the storage device 100 and the mobile phone A 200, and FIG. 3 is a flowchart showing a temporary word setting operation of the storage device 100. Here, it is assumed that the storage device 100 is mounted on the storage device mounting IZF 201 of the mobile phone A200.

[0044] The mobile phone A200 requests a list of data stored in the storage unit 101 of the storage device 100. The data list request to be transmitted is transmitted to the storage device 100 via the storage device mounting IZF201. When the storage device 100 receives the data list request transmitted from the mobile phone A200 in the controller 104 (S101), the storage device 100 transmits a list of data stored in the storage unit 101 to the mobile phone A200 (S102).

[0045] From the data stored in the storage unit 101 of the storage device 100, the user A sets data for which a temporary password is applied on the data selection screen displayed on the display unit 204 of the mobile phone A 200. Is specified. The mobile phone A200 obtains the identifier (data name, data, file name, directory name, etc.) of the specified data (hereinafter referred to as specified data) from the input unit 203 and sets a temporary password for the specified data. To send a temporary password setting request. The controller 104 of the storage device 100 passes the received temporary password setting request to the temporary data management unit 110 (S103). The temporary data management unit 110 causes the temporary password generation unit 109 to generate a temporary password (S104), and sets a temporary password for the designated data (S105).

After setting the temporary password, the temporary data management unit 110 notifies the mobile phone A 200 of the temporary password from the password transmission unit 105 of the controller 104 (S106). The cellular phone A200 receives the temporary password from the storage device IZF201 and displays the received temporary password on the display unit 204. Here, the mobile phone A 200 stores the temporary password in the storage unit 202 according to the setting of the user A, for example, and displays it on the display unit 204 later.

[0047] User A stores the temporary password displayed on display unit 204 by some method (including taking notes).

[0048] In step S104, the temporary password generation unit 109 generates a temporary password by using a random number generation function with arguments such as values indicating data attributes such as the current time, data update time, and data size. Or a hash function, or a function that uses a random number as an input value and generates a character string or PIN that varies depending on the value of the random number. In addition, for example, it is also possible to store an encryption key in the private storage unit 102 and use the data that has been encrypted or signed with the encryption key or the value indicating the current time or data attribute as a temporary password. . In addition, these methods are used in combination. You can do it.

Here, step S 105 will be described in detail.

FIG. 4 is a flowchart showing details of the password setting operation performed by the storage device 100.

[0051] Temporary data management unit 110 of storage device 100 checks whether the designated data designated by user A is stored in private storage unit 102 of storage unit 101 (S111). When the specified data is stored in the public storage unit 103 instead of the private storage unit 102, the temporary password generated by the temporary password generation unit 109 and the expiration date setting unit are set for the specified data. Set the validity period of the temporary password (S11 8). When the designated data is stored in the private storage unit 102, the authentication unit 108 transmits a user authentication request for requesting user authentication to the mobile phone A200 via the controller 104 (S112). The cellular phone A200 receives the user authentication request in the storage device wearing IZF201 and displays a screen for requesting user authentication on the display unit 204. The user A inputs the requested authentication information from the input unit 203, and this authentication information is transmitted from the storage device mounting IZF 201 to the storage device 100 as a user authentication response.

The user authentication response is received by the authentication unit 108 via the controller 104 (S113). The authentication unit 108 performs user authentication based on the received information (S114). If the user authentication fails, the temporary data management unit 110 rejects the temporary password setting (S117). At this time, the storage device 100 may notify the mobile phone A200 that the temporary password setting is rejected, and the mobile phone A200 may display a message to that effect on the display unit 204. If the user authentication is successful in step S114, the designated data is copied to the public storage unit 103 (S115), and the temporary password generated by the temporary password generation unit 109 is copied to the copied data. Then, the validity period of the temporary password set by the validity period setting unit is set (S116).

[0053] In SI 15, the designated data in the private storage unit 102 is not copied to the public storage unit 103, but the temporary password 51 and its valid period 53 are directly set for the designated data in the private storage unit 102. Also good. In this case, when the specified data is accessed, user authentication by the authentication unit 108 may be omitted, and access control may be performed by authentication using only a temporary password. Next, the data access control operation will be described.

FIG. 5 is a sequence diagram showing data transmission / reception between the storage device 100 and the mobile phone B300, and FIG. 6 is a flowchart showing an access control operation to data in the storage device 100. At the start of this operation, user A removes storage device 100 from mobile phone A200, passes storage device 100 to user B, and notifies user B of a temporary password. User B may store the notified temporary password in storage unit 302 of mobile phone B300. Therefore, the following is an operation of the storage device 100 after the user B attaches the storage device 100 to the mobile phone B300.

[0056] The mobile phone B300 transmits a data list request for requesting a list of data stored in the storage unit 101 of the storage device 100 to the storage device 100 via the storage device mounting IZF301. When the storage device 100 receives the data list request transmitted from the mobile phone B300 in the controller 104 (S201), the storage device 100 transmits the data list stored in the storage unit 101 to the mobile phone B300 (S202).

[0057] Here, when the data for which the storage device 100 has set a temporary password in step S116 in FIG. 4 is stored in the public storage unit 103, a list of only the data stored in the public storage unit 103 is stored in step S202. May be sent. In addition, regardless of whether the storage device 100 stores the data for which the temporary password is set, either in the private storage unit 102 or the public storage unit 103, it sends a list of only the data for which the temporary password is set. Also good.

[0058] From the data stored in the storage unit 101 of the storage device 100, the user B displays the data for which the temporary password is set on the data selection screen displayed on the display unit 304 of the mobile phone B300. specify. The mobile phone B300 obtains the identifier (data name, data ID, file name, directory name, etc.) of the specified data specified from the input unit 303, and sends an access request to the specified data via the storage device IZF301. To do. The controller 104 of the storage device 100 passes the received access request to the temporary data management unit 110 (S203).

In the temporary data management unit 110, the access control unit 111 compares the current time acquired by the current time acquisition unit 115 with the expiration date stored in the expiration date storage unit 113, and designates the specified data. Check whether the temporary password set in is within the validity period (S20 Four). If the valid period has expired, access to the designated data is denied (S209). At this time, the storage device 100 may notify the mobile phone B300 that access to the designated data is denied, and the mobile phone B300 may display a message to that effect on the display unit 304. Further, the temporary password may be invalidated, the temporary password stored in the password storage unit 112 may be deleted, or the designated data itself may be deleted.

If the temporary password is within the valid period in step S204, the access control unit 111 transmits a temporary password request for requesting the temporary password to the mobile phone B300 via the controller 104 (S205). ). The mobile phone B300 receives the temporary password request at the storage device I ZF301 and displays a screen for requesting the temporary password on the display unit 304. The user B inputs the temporary password notified from the user A or the temporary password stored in the storage unit 302 from the input unit 303, and the temporary password is transmitted from the storage device mounting IZF 301 to the storage device 100.

The temporary password is received by the password receiving unit 106 of the controller 104 (S206) and passed to the temporary data management unit 110. In temporary data management unit 110, access control unit 111 compares the received temporary password with the temporary password stored in password storage unit 112 (S207). If the temporary passwords do not match, access to the specified data is denied (S209). At this time, the storage device 100 may notify the mobile phone B300 that access to the designated data is denied, and the mobile phone B300 may display a message to that effect on the display unit 304. In addition, the temporary password may be invalidated, the temporary password stored in the password storage unit 112 may be deleted, or the designated data itself may be deleted.

[0062] If the temporary passwords match in step S207, the data reading unit 107 acquires the designated data from the storage unit 101 and transmits it to the mobile phone B300 (S208). The mobile phone B300 receives the designated data and displays it on the display unit 304 or stores it in the storage unit 302.

[0063] In the present embodiment, instead of setting a temporary password for specific data as described above, temporary passwords are set for the entire private storage unit 102 and the entire storage unit 101 in the same manner. It is also possible to set. In addition, the data in the storage unit 101 If you have an aisle structure, you can also set a temporary password for the entire directory below a specific directory.

[0064] In the above, when a temporary password is set for the data in the private storage unit 102, it is copied to the public storage unit 103 in step S115 of FIG. 4, and a temporary password is set for the copied data. In addition, user authentication for the private storage unit 102 can be omitted. On the other hand, if you want to perform access control with higher security for special data, set a temporary password for the data in the private storage unit 102, and perform user authentication and temporary access to the private storage unit 102. It is also possible to use password authentication together.

[0065] In the present embodiment, a secret key may be used as a temporary password! In this case, in step S104 in FIG. 3, the temporary password generation unit 109 of the storage device 100 generates a secret key, and in step S105, the temporary data management unit 110 encrypts the designated data with the secret key. The encrypted data is stored in the password storage unit 112. In step S106, the nosword transmitter 105 transmits the secret key to the mobile phone A200. In step S206 of FIG. 6, the password receiving unit 106 receives the secret key from the mobile phone B300. In step S207, the access control unit 111 decrypts the data stored in the password storage unit 112 using this secret key. Check if you can do it. If the data decryption is successful, the data reading unit 107 transmits the designated data to the mobile phone B300.

[0066] When the secret key is used as described above, the secret key and the data obtained by encrypting the designated data with the secret key are stored in the password storage unit 112 or the storage unit 101, and a temporary password is stored for the secret key. When setting and controlling access to specified data, it is possible to verify the temporary password against the secret key. At this time, for example, the storage unit 101 does not store the designated data, only the data obtained by encrypting the designated data is stored, and as a result of collating the temporary password, access to the private key is permitted. The specified data can be decrypted and provided.

In this embodiment, a mobile phone has been described as an electronic device to which storage device 100 is attached. However, a mobile phone such as a PDA (Personal Digital Assistant) is used instead of the mobile phone. You can use home appliances such as terminals, PCs (Personal Computers), car navigation systems, and DVD (Digital Versatile Disc) players! /.

In addition, the storage device 100 described in the present embodiment can be realized as, for example, an IC card, a memory card, or a USB (Universal Serial Bus) memory including a memory.

[0069] In the present embodiment, as described above, in the use of the storage device 100 such as a removable memory card, the power of frequently lending and borrowing with another person is used in this case. By setting a password for the data you want to pass without telling others the password to access 102, you can allow access to specific data when exchanging data with others, and access other data. Access can be prevented. In addition, by providing a temporary password only to those who want to exchange data, it is possible to prevent access by other people.

[0070] In addition, by using a secret key as a temporary password and encrypting data with the temporary password, resistance to physical attacks can be increased.

[0071] Further, by setting a temporary password in the secret key, encryption can be performed with an encryption key, and the key can be protected with a temporary password to further increase the tolerance.

[0072] In addition, it is possible to limit the time that data can be accessed by setting the validity period for the temporary password. For example, it is illegal to set the minimum time required for delivery, such as 5 minutes. Access can be strictly prevented.

[0073] Further, by deleting the data when the temporary password is incorrect or the valid period has passed, it becomes impossible to physically access the data, and it is possible to prevent unauthorized access more strictly.

[0074] Further, when the storage device 100 of the user A is attached to the mobile phone B300 of user B by transmitting only a list of data for which a temporary password is set to the mobile phone B300, the storage device 100 is mounted By setting a temporary password, only the data you want to pass can be shown to User B, and the existence of other data or programs can be made unknown.

[0075] Further, by displaying a temporary password on the display unit 204 of the mobile phone A200, The A can easily notify the user B of the temporary password set in the storage device 100, and presents the temporary password to the other party when exchanging data with the storage device 100. It becomes easy.

[0076] Further, by storing the temporary password in the storage unit 202 of the mobile phone A200, the user A himself / herself does not need to store or make a note of the temporary password set in the storage device 100, which is convenient. Increases sex.

[0077] As described above, according to the present embodiment, when data is exchanged with another person or another device, a temporary password or PIN is set for the data and program. It allows easy data access and data exchange.

[0078] In addition, even when the problem is that humans tend to choose similar values for passwords and PINs, there is an effect that a password or PIN can be guessed by automatically generating them. .

[0079] Embodiment 2.

FIG. 7 is a block diagram showing a configuration of a storage device according to the present embodiment and a mobile phone to which the storage device is attached.

[0080] In the first embodiment, the ability to set a temporary password for the data stored in the storage unit 101 is added to the storage device 100 with the program execution unit 118 implemented by a processor, memory, or the like. Thus, it is possible to store a program in the storage unit 101, set a temporary password in the same way as the data, and permit only the user who knows the temporary password to execute the program. In FIG. 7, each unit other than the program execution unit 118 is the same as that in the first embodiment. The operation of the storage device 100 is the same as that of the first embodiment except that the program execution unit 118 executes the program when access to the program protected by the temporary password is permitted. The

[0081] As described above, in the present embodiment, the program stored in the storage device 100 is protected, and when a program is temporarily permitted to another person or another device, the temporary password is set. It can be issued and given permission.

[0082] Embodiment 3. In the following, a mode in which user A who owns a storage device gives his / her storage device to user B and writes data therein will be described.

FIG. 8 is a block diagram showing a configuration of the storage device according to the present embodiment and a mobile phone and a PC in which the storage device is mounted.

[0084] The mobile phone 400 is an example of a first electronic device, and the PC 500 is an example of a second electronic device. The storage device 100 is attached to the mobile phone 400 and the PC 500.

In the storage device 100, the storage unit 101 is a storage area for storing data and programs that can be accessed only by the owner of the storage device 100.

Authentication unit 108 identifies the owner for access to storage unit 101. The controller 104 controls the storage device 100, the input / output of the electronic device in which the storage device 100 is mounted, and the inside of the storage device 100. The temporary password generation unit 109 generates a temporary password that is valid only for a certain period. The temporary data management unit 110 secures the data area 117 in the storage unit 101 and temporarily stores the temporary password generated by the temporary password generation unit 109 to permit access by others or other devices. Set for area 117 and perform temporary password authentication and access control.

In controller 104, password transmission unit 105 transmits the temporary password generated by temporary password generation unit 109 to the electronic device in which storage device 100 is mounted. The password receiving unit 106 receives a temporary password from the electronic device in which the storage device 100 is installed. If the temporary password received by the password receiving unit 106 is correct, the data writing unit 116 writes the received data to the data area 117 secured in the storage unit 101 when the storage device 100 is installed.

In temporary data management unit 110, password storage unit 112 stores the temporary password generated by temporary password generation unit 109. The expiration date setting unit 114 sets the expiration date of the temporary password when the temporary password is generated. The expiration date storage unit 113 stores the expiration date. The current time acquisition unit 115 acquires the current time. The access control unit 111 determines whether the temporary password has not expired or the temporary password is correct, and controls access to the data area 117 of the storage unit 101. The cellular phone 400 is a terminal used by the user A with the storage device 100 attached. In the mobile phone 400, a storage device IZF (interface) 401 connects the storage device 100 and the mobile phone 400. A display unit 405 performs display on a screen such as an LCD. The input unit 404 is, for example, a numeric key and accepts input from the user A. The storage unit 403 is an area for storing data, such as a nonvolatile memory. The communication unit 402 communicates with the PC 500.

PC 500 is a terminal used by user B with storage device 100 installed. In PC500, storage device IZF (interface) 501 connects storage device 100 and PC500. The display unit 505 displays on a screen such as a CRT (Cathode Ray Tube). The input unit 504 is a keyboard or a mouse, for example, and accepts input from the user B force. The storage unit 503 is an area for storing data, such as a nonvolatile memory. Communication unit 502 communicates with mobile phone 400.

Next, the operation of the storage device 100 will be described. When user B writes data into user A's storage device 100 and returns storage device 100 to user A, the operation of storage device 100 is to set a temporary password and control access to data area 117. It can be divided into actions to be performed. The former is the operation of storage device 100 when user A attaches storage device 100 to mobile phone 400 and sets a temporary password, and the latter is user A disconnects storage device 100 from mobile phone 400. This is the operation of the storage device 100 when the user B inserts the storage device 100 into the PC 500, inputs a temporary password, and stores data.

First, the temporary password setting operation will be described.

FIG. 9 is a sequence diagram showing data transmission / reception between the storage device 100 and the mobile phone 400, and FIG. 10 is a flowchart showing a temporary password setting operation of the storage device 100. Here, it is assumed that the storage device 100 is attached to the storage device attachment IZF 401 of the mobile phone 400.

User A instructs the creation of a temporary area for user B to write data on the menu screen displayed on display unit 405 of mobile phone 400. The cellular phone 400 acquires a command for creating a temporary area from the input unit 404, and transmits a temporary area creation request via the storage device IZF 401. The controller 104 of the storage device 100 passes the received temporary area creation request to the temporary data management unit 110 (S301). [0095] In order for the access control unit 111 of the temporary data management unit 110 to create a temporary area for data writing, the authentication unit 108 carries a user authentication request for user authentication via the controller 104. Send to phone 400 (S302). The cellular phone 400 receives the user authentication request in the storage device wearing IZF 401 and displays a screen for requesting user authentication on the display unit 405. The user A inputs the requested authentication information from the input unit 404, and this authentication information is transmitted from the storage device mounting IZF 401 to the storage device 100 as a user authentication response.

The user authentication response is received by the authentication unit 108 via the controller 104 (S303). The authentication unit 108 performs user authentication based on the received information (S304). If the user authentication fails, the access control unit 111 of the temporary data management unit 110 denies access to the storage unit 101 (S308). At this time, the storage device 100 may notify the mobile phone 400 that access to the storage unit 101 is denied, and the mobile phone 400 may display a message to that effect on the display unit 405. If the user authentication is successful in step S304, the temporary data management unit 110 causes the temporary password generation unit 109 to generate a temporary password (S305), and the storage unit 101 is a temporary area for writing. The data area 117 is created, and the temporary password generated by the temporary password generation unit 109 and the validity period of the temporary password set by the expiration date setting unit 114 are set for the data area 117 (S306 ).

[0097] After setting the temporary password, the temporary data management unit 110 notifies the mobile phone 400 of the temporary password from the password transmission unit 105 of the controller 104 (S307). The cellular phone 400 receives the temporary password from the storage device IZF 401 and stores the received temporary password in the storage unit 403.

Next, an access control operation to the data area 117 will be described.

FIG. 11 is a sequence diagram showing data transmission / reception between the storage device 100 and the PC 500. Fig. 11 also shows the transmission and reception of temporary passwords between mobile phone 400 and PC 500. FIG. 12 is a flowchart showing an access control operation to the data area 117 of the storage device 100. At the time when this operation starts, the user A removes the storage device 100 from the mobile phone 400 and passes the storage device 100 to the user B. Therefore, user B Is the operation of the storage device 100 after the storage device 100 is mounted on the PC 500.

[0100] User B uses the screen displayed on display unit 505 of PC500 to store the data stored in storage unit 503 of PC500 in data area 117 of storage device 100 in which a temporary password is set. Instruct. The PC 500 acquires the specified data identifier (data name, data ID, file name, directory name, etc.) from the input unit 504, and sends a data storage request to the data area 117 via the storage device IZ F501. To do. The controller 104 of the storage device 100 passes the received data storage request to the temporary data management unit 110 (S401).

) o

[0101] In the temporary data management unit 110, the access control unit 111 compares the current time acquired by the current time acquisition unit 115 with the expiration date stored in the expiration date storage unit 113, and stores it in the data area 117. It is checked whether the set temporary password is within the valid period (S402). If the valid period has expired, access to the data area 117 is denied (S407). At this time, the storage device 100 may notify the PC 500 that the access to the data area 117 is denied, and the PC 500 may display a message to that effect on the display unit 505. Also, invalidate the temporary password, delete the temporary password stored in the password storage unit 112, or release the data area 117.

If the temporary password is within the valid period in step S402, the access control unit 111 transmits a temporary password request for requesting the temporary password to the PC 500 via the controller 104 (S403). The PC 500 receives the temporary password request in the storage device IZF 501 and displays a screen for requesting the temporary password on the display unit 304. User A designates the temporary password stored in the storage unit 403 of the mobile phone 400 from the input unit 303 and transmits the temporary password from the communication unit 402 to the PC 500. When the PC 500 receives the temporary password in the communication unit 502, the PC 500 transfers the temporary password from the storage device mounting IZF 501 to the storage device 100.

[0103] Here, before the screen for requesting a temporary password is displayed, user A sends a temporary password from mobile phone 400 to PC 500 in advance! /.

The temporary password is received by the password receiving unit 106 of the controller 104 (S404) and passed to the temporary data management unit 110. In the temporary data management unit 110, the The access control unit 111 compares the received temporary password with the temporary password stored in the password storage unit 112 (S405). If the temporary passwords do not match, access to the data area 117 is denied (S407). At this time, the storage device 100 may notify the PC 500 that the access to the data area 117 is denied, and the PC 500 may display a message to that effect on the display unit 505. Further, the temporary password may be invalidated, the temporary password stored in the password storage unit 112 may be deleted, or the data area 117 may be released.

When the temporary passwords match in step S405, the data received from the data writing unit 116 SPC500 is stored in the data area 117 (S406). Here, when transmitting a data storage request from the PC 500 to the storage device 100, data including data to be written to the data area 117 may be transmitted. Thereafter, for example, the verification of the temporary password is completed. You can send only the data!

In the present embodiment, as described above, when user authentication is required for the storage unit 101 of the storage device 100 when other person power data is received, the access restriction on the entire storage unit 101 is released. Instead of creating a temporary area in your own storage device 100, setting a temporary password in that area, and passing the storage device to the other party, you can access other areas. The data can be stored in the storage device 100 while prohibiting the data, and the data and programs already stored in the storage device 100 can be easily protected.

[0107] Further, by transmitting and receiving a temporary password between terminals equipped with storage device 100, the temporary password set in storage device 100 is stored in the terminal, and data is transferred by passing storage device 100 to another person. In this case, it is possible to pass the temporary password to the other party's terminal securely and easily without showing the temporary password to the other party, facilitating data exchange.

As described above, this embodiment secures a temporary area for storing data when data is exchanged with other people or other devices! By setting a temporary password and PIN, access to the data area is easily permitted and data can be exchanged. [0109] Embodiment 4.

In the following, a mode in which a DVD in which encrypted content is stored for copyright protection of DVD content is used together with a storage device that stores a usage right (license) for using the content will be described.

FIG. 13 shows a storage device according to this embodiment, a mobile phone in which the storage device is mounted, and D

It is a block diagram which shows the structure of a VD player.

[0111] The mobile phone 400 is an example of a first electronic device, and the DVD player 600 is an example of a second electronic device.

. The storage device 100 is attached to the mobile phone 400 and the DVD player 600.

In the storage device 100, the storage unit 101 is an area for storing data, and the storage device 10

It holds a data area 117 that stores data and programs accessible only to zero owners.

The authentication unit 108 identifies the owner for access to the data area 117. The controller 104 controls the storage device 100 and the input / output of the electronic device in which the storage device 100 is mounted and the inside of the storage device 100. Temporary password generator 109 generates a password that is valid only for a certain period. The temporary data management unit 110 uses the temporary password generated by the temporary password generation unit 109 for the data to temporarily allow access to data stored in the data area 117 by others or other devices. Authentication and access control using a temporary password.

In controller 104, password transmission unit 105 transmits the temporary password generated by temporary password generation unit 109 to the electronic device in which storage device 100 is mounted. The password receiving unit 106 receives a temporary password from the electronic device in which the storage device 100 is installed. If the temporary password received by the password receiving unit 106 is correct, the data reading unit 107 reads the data stored in the storage unit 101 and transmits the data to the electronic device in which the storage device 100 is attached.

In temporary data management section 110, password storage section 112 stores the temporary password generated by temporary password generation section 109. The expiration date setting unit 114 sets the expiration date of the temporary password when the temporary password is generated. The expiration date storage unit 113 stores the expiration date. Current time acquisition unit 115 acquires the current time To do. The access control unit 111 determines whether the temporary password has expired or the temporary password is correct, and controls access to the data stored in the data area 117.

[0116] Since the data area 117 is a storage area that can be accessed only when the user authentication by the authentication unit 108 is successful, if data in which a temporary password is set is stored in the data area 117, the data area 117 When the user is accessed, authentication using the temporary password by the temporary data management unit 110 is performed in addition to the user authentication by the authentication unit 108.

Mobile phone 400 is a terminal used by a user with storage device 100 attached. In the cellular phone 400, the storage device IZF 401 connects the storage device 100 and the interior of the cellular phone 400. A display unit 405 performs display on a screen such as an LCD. The input unit 404 is, for example, a numeric key and accepts input from the user. The storage unit 403 is an area for storing data, such as a nonvolatile memory. The communication unit 402 communicates with the DVD player 600.

[0118] A DVD player 600 is a DVD playback device used by a user with the storage device 100 mounted. In the DVD player 600, a storage device mounting IZF (interface) 601 connects the storage device 100 and the DVD player 600 inside. A display unit 607 performs display on a liquid crystal screen or a television set connected to the DVD player 600. The input unit 606 is, for example, an operation button or a remote controller, and receives input from the user. The storage unit 605 is an area for storing data, such as a nonvolatile memory. A communication unit 604 communicates with the mobile phone 400. A DVD playback unit 603 plays a DVD. The license management unit 602 manages a license for playing back content stored on a DVD.

[0119] Next, the operation of the storage device 100 will be described. In the data area 117 in the storage device 100, a plurality of licenses corresponding to the DVD content are stored by a content provider or the like. As in the first embodiment, the operation of the storage device 100 is divided into an operation for setting a temporary password and an operation for controlling access to the data area 117. The former is the operation of the storage device 100 when the user attaches the storage device 100 to the mobile phone 400 and sets a temporary password, and the latter is the operation of the storage device 100 by the user who removes the power from the mobile phone 400 and the DVD player. Attach to 600 and enter a temporary password This is the operation of the storage device 100 at the time of acquisition.

First, the temporary password setting operation will be described.

FIG. 14 is a sequence diagram showing data transmission / reception between the storage device 100 and the mobile phone 400. FIG. 14 further shows that the mobile phone 400 sends a temporary password to the DVD player 600. FIG. 15 is a flowchart showing the temporary password setting operation of the storage device 100. Here, it is assumed that storage device 100 is attached to storage device attachment IZF 401 of mobile phone 400.

[0122] On the menu screen displayed on display unit 405 of mobile phone 400, the user designates data area 117 as a target for applying a temporary password. The cellular phone 400 acquires the identifier (path name, directory ID, etc.) of the data area 117 in which the input unit 404 is also specified, and transmits a temporary password setting request via the storage device mounting IZF 401. The controller 104 of the storage device 100 passes the received temporary password setting request to the temporary data management unit 110 (S501).

[0123] In order for the access control unit 111 of the temporary data management unit 110 to access the data area 117, the authentication unit 108 transmits a user authentication request for requesting user authentication to the mobile phone 400 via the controller 104 ( S502). The cellular phone 400 receives the user authentication request in the storage device wearing IZF 401 and displays a screen for requesting user authentication on the display unit 405. The user inputs the requested authentication information from the input unit 404, and this authentication information is transmitted from the storage device mounting IZF 401 to the storage device 100 as a user authentication response.

The user authentication response is received by the authentication unit 108 via the controller 104 (S503). The authentication unit 108 performs user authentication based on the received information (S504). If the user authentication fails, the access control unit 111 of the temporary data management unit 110 denies access to the data area 117 (S508). At this time, the storage device 100 may notify the mobile phone 400 that the access to the data area 117 is denied, and the mobile phone 400 may display a message to that effect on the display unit 405. In step S504, if the user authentication is successful, the temporary data management unit 110 causes the temporary password generation unit 109 to generate a temporary password (S505) and temporarily stores the temporary data in the data area 117. The temporary password generated by the password generation unit 109 and the temporary password set by the expiration date setting unit 114 Set the effective period (S506).

[0125] After setting the temporary password, the temporary data management unit 110 notifies the mobile phone 400 of the temporary password from the password transmission unit 105 of the controller 104 (S507). The cellular phone 400 receives the temporary password from the storage device IZF 401 and transmits the received temporary password to the DVD player 600 from the communication unit 402. The communication unit 604 of the DVD player 600 receives the temporary password and stores it in the storage unit 605.

Next, the access control operation to the data area 117 will be described.

FIG. 16 is a sequence diagram showing data transmission / reception between the storage device 100 and the DVD player 600, and FIG. 17 is a flowchart showing an access control operation to the data area 117 of the storage device 100. The following is the operation of the storage device 100 after the user disconnects the storage device 100 from the mobile phone 400 and attaches it to the DVD player 600.

[0128] The user sets a DVD including the content he / she wants to watch (hereinafter referred to as “designated content”) in the DVD player 600, and instructs the playback by the input unit 606. The license management unit 602 of the DVD player 600 obtains the identifier (content name, content ID, etc.) of the designated content, and accesses the license for the designated content in the data area 117 of the storage device 100 via the storage device IZF601. Send a request. The controller 104 of the storage device 100 passes the received access request to the temporary data management unit 110 (S601).

In the temporary data management unit 110, the access control unit 111 compares the current time acquired by the current time acquisition unit 115 with the expiration date stored in the expiration date storage unit 113, and stores it in the data area 117. It is checked whether the set temporary password is within the valid period (S602). If the valid period has expired, access to the data area 117 is denied (S607). At this time, the storage device 100 may notify the DV D player 600 that the access to the data area 117 is denied, and the DVD player 600 may display a message to that effect on the display unit 607. In addition, the temporary password may be invalidated and the temporary password stored in the password storage unit 112 may be deleted.

If the temporary password is within the valid period in step S602, the access control unit 111 transmits a temporary password request for requesting the temporary password to the DVD player 600 via the controller 104 (S603). ). DVD player 600 is a storage device Mounting The IZF 601 receives a temporary password request and displays a screen for requesting a temporary password on the display unit 607. When the user designates a temporary password stored in the storage unit 605 of the DVD player 600 from the input unit 606, the temporary password is transmitted from the storage device mounting IZF 501 to the storage device 100.

The temporary password is received by the password receiving unit 106 of the controller 104 (S604) and passed to the temporary data management unit 110. In the temporary data management unit 110, the access control unit 111 compares the received temporary password with the temporary password stored in the password storage unit 112 (S605). If the temporary passwords do not match, access to the data area 117 is denied (S607). At this time, the storage device 100 may notify the DVD player 600 that access to the data area 117 is denied, and the DVD player 600 may display a message to that effect on the display unit 607. Also, disable the temporary password and delete the temporary password stored in the password storage unit 112.

[0132] In step S605, if the temporary news words match, the data reading unit 107 acquires a license for the specified content from the data area 117 and transmits it to the DVD player 600 (S606). The DVD player 600 receives the license, and plays the specified content in the DVD playback unit 603 according to the received license.

[0133] In the present embodiment, the form in which the DVD player 600 is used as a device for reproducing content has been described. However, instead of the DVD player 600, a music player, a car navigation device, a microwave oven, and the like are used. You can use household appliances that can be implemented.

In the present embodiment, the same user is using the mobile phone 400 and the DVD player 600. Different users may be used as in the other embodiments.

In the present embodiment, as described above, a temporary password is set for the entire data area 117, not the data stored in the data area 117, so that a plurality of licenses are assigned to the data area 117. Can be accessed from the DVD player 600 in the same way no matter what content is specified. Also, for example, if another content is executed while one content is being executed, Since it is possible to save the trouble of inputting a temporary password, convenience is improved.

[0136] Also, by sending a DVD player 60C ^ —temporary password from the mobile phone 400, the temporary password can be passed to the DVD player 600 in advance, so that when the DV D player 600 is equipped with the storage device 100, It is possible to automatically authenticate with a temporary password, access the data area 117, and obtain a license. As a result, even when it is desired to access data in the storage device 100 using a home appliance that has a poor display screen or operation interface or is difficult to use, the user can save input and improve convenience. .

[0137] The storage device described in each of the above embodiments is

A storage unit for storing data and programs;

A controller that controls input and output to and from the outside,

A temporary password generator for generating a temporary password;

A temporary data management unit that sets a temporary password generated by the temporary password generation unit for data and programs stored in the storage unit, and performs authentication and access control using the temporary password. And

[0138] The storage section

A private storage that stores data and programs accessible only to the owner;

It consists of a public storage unit that stores data and programs accessible to anyone,

The storage device further includes:

An authentication unit for identifying an owner for access to the private storage unit,

The temporary data management unit copies data and programs stored in the private storage unit to the private storage unit and the public storage unit, and performs authentication and access control using the temporary password. To do.

[0139] In the temporary data management unit, the data and the program stored in the storage unit are encrypted and stored with the temporary password, and the authentication and the temporary password are performed. After the access control is performed, the data is decrypted with the temporary password.

[0140] In the temporary data management unit, the data and program stored in the private storage unit are encrypted with the temporary password and stored in the public storage unit, and authentication and access using the temporary password are performed. After the control, the data is decrypted with the temporary password.

[0141] The temporary data management unit encrypts and stores the data and program stored in the storage unit, stores the encryption key in the storage unit, and authenticates the encryption key with the temporary password. And performing access control.

[0142] In the temporary data management unit, the data and program stored in the private storage unit are encrypted and stored in the public storage unit, the encryption key is copied to the public storage unit, and the encryption key is stored. The authentication and access control using the temporary password are performed.

[0143] The temporary password generated by the temporary password generation unit is set for any one of the storage unit and the private storage unit, and authentication and access control are performed. .

[0144] The storage device further includes:

A temporary area can be created in the storage unit,

The temporary data management unit sets the temporary password generated by the password generation unit for the temporary area, and performs authentication and access control using the temporary password.

It is characterized by that.

[0145] The storage device further includes:

When the temporary password is set by the temporary data management unit, a validity period is set for the temporary password, and the temporary password is within the validity period when authentication is performed using the temporary password. This is characterized by permitting access to data and programs within the validity period.

[0146] The temporary data management unit determines that the temporary password has expired In this case, the temporary password is invalidated, and the data or the encryption key stored in the public storage unit in which the temporary password is set is erased.

[0147] After the temporary password is set for any of data, storage unit, private storage unit, and area by the temporary data management unit, the controller temporarily receives access to the storage device for the first time. It is characterized by the fact that it can be accessed only to the target for which a password is set.

[0148] Further, the access control system described in each of the above embodiments is:

In a system comprising a storage device and a terminal having a storage device mounting IZF for mounting the storage device,

The storage device

A storage unit for storing data and programs;

A controller that controls input and output to and from the outside,

A temporary password generator for generating a temporary password;

A temporary data management unit that sets a temporary password generated by the temporary password generation unit for data and programs stored in the storage unit, and performs authentication and access control using the temporary password;

The terminal includes a display unit for performing display on a screen,

The temporary password generated by the temporary password generation unit via the controller is displayed on a display unit on the terminal.

[0149] In the access control system,

The storage unit

A private storage that stores data and programs accessible only to the owner;

The storage device further includes:

An authentication unit for identifying the owner for access to the private storage unit; It is characterized by providing.

[0150] In the access control system,

The storage device

A storage unit for storing data and programs;

A controller that controls input and output to and from the outside,

A temporary password generator for generating a temporary password;

The terminal includes a storage unit for storing a temporary password,

The temporary password generated by the temporary password generation unit via the controller is stored in a storage unit on the terminal.

[0151] In the access control system,

The storage unit of the storage device is

A private storage that stores data and programs accessible only to the owner;

A public storage unit that stores data and programs accessible to anyone, and

The storage device further includes:

And an authentication unit for identifying an owner for access to the private storage unit.

[0152] In a system comprising a storage device and a terminal having a storage device IZF for mounting the storage device,

The storage device

A storage unit for storing data and programs;

A controller that controls input and output to and from the outside,

A temporary password generator for generating a temporary password;

Temporary password generation unit for data and programs stored in the storage unit A temporary data management unit that sets the temporary password generated in step 1 and performs authentication and access control using the temporary password.

The terminal includes a communication unit that communicates with other terminals,

The temporary password generated by the temporary password generation unit is transmitted to the communication unit on the terminal via the controller, and is transmitted to another terminal by the communication unit.

[0153] In the access control system,

The storage unit

A private storage that stores data and programs accessible only to the owner;

The storage device further includes:

[0154] The terminal further includes:

When another password is received using the communication unit, the password is transmitted to the temporary data management unit of the storage device via the controller and authenticated by the password received by the temporary data management unit. And performing access control.

[0155] In the access control system,

The storage device

A storage unit for storing data and programs;

A controller that controls input and output to and from the outside,

A temporary password generator for generating a temporary password;

Temporary password generator for data and programs stored in the storage The temporary data generated by the temporary data management unit performs authentication and access control using the temporary password, and the temporary password is set to the end of the previous dife via the controller.

Positive terminal is

Storing the temporary password received in the storage unit, and accessing the data and program using the temporary password stored when access to the data and program is required;

The storage device

Check whether the received temporary password is within the validity period and whether it matches the temporary password generated by the temporary password generation unit, and if this is within the validity period and matches, the data and program It is characterized by allowing access to.

[0156] In the storage device,

To temporarily permit access to the entire storage unit, the temporary password generated by the temporary password generation unit is set for the entire storage device, and authentication and access control are performed.

It is characterized by that.

Brief Description of Drawings

FIG. 1 is a block diagram showing a configuration of a storage device according to Embodiment 1 and an electronic device to which the storage device is attached.

FIG. 2 is a sequence diagram showing data transmission / reception between the storage device and the first electronic device according to the first embodiment.

FIG. 3 is a flowchart showing an operation performed by the storage device according to Embodiment 1 when setting a password.

FIG. 4 is a flowchart showing details of a password setting operation performed by the storage device according to Embodiment 1.

FIG. 5 is a sequence diagram showing data transmission / reception between the storage device and the second electronic device according to the first embodiment.

FIG. 6 is a flowchart showing an operation performed by the storage device according to the first embodiment during access control. FIG. 7 is a block diagram showing a configuration of a storage device according to Embodiment 2 and an electronic device in which the storage device is mounted.

FIG. 8 is a block diagram showing a configuration of a storage device according to Embodiment 3 and an electronic device in which the storage device is mounted.

9] A sequence diagram showing data transmission / reception between the storage device and the first electronic device according to the third embodiment.

[10] FIG. 10 is a flowchart showing an operation performed by the storage device according to the third embodiment when setting a password. 11] A sequence diagram showing data transmission / reception between the storage device and the second electronic device according to the third embodiment.

FIG. 12 is a flowchart showing an operation performed by the storage device according to Embodiment 3 during access control.

FIG. 13 is a block diagram showing a configuration of a storage device according to Embodiment 4 and an electronic device in which the storage device is mounted.

14] A sequence diagram showing data transmission / reception between the storage device according to the fourth embodiment and the first electronic device.

15] A flowchart showing an operation performed by the storage device according to Embodiment 4 when setting a password. 16] A sequence diagram showing data transmission / reception between the storage device and the second electronic device according to the fourth embodiment.

FIG. 17 is a flowchart showing an operation performed by the storage device according to Embodiment 4 during access control. Explanation of symbols

100 storage devices, 101 storage units, 102 private storage units, 103 public storage units, 104 controllers, 105 password transmission units, 106 password reception units, 107 data reading units, 108 authentication units, 109 temporary password generation units, 110 temporary Data management unit 111 Access control unit 112 Password storage unit 113 Expiration date storage unit 114 Expiration date setting unit 115 Current time acquisition unit 116 Data writing unit 117 Data area 1 18 Program execution unit 200 Mobile phone A, 201, 301, 401, 501, 601 Storage device IZF, 202, 302, 403, 503, 605 Storage unit, 203, 303, 404, 504, 606 Input unit, 204, 304, 405, 505 , 607 Display unit, 300 mobile phone B, 400 mobile phone, 4 02, 502, 604 communication unit, 500 PC, 600 DVD player, 602 license management unit, 603 DVD playback unit.

Claims

The scope of the claims

[1] In a storage device attached to the first electronic device and the second electronic device,

A data storage unit for storing data;

A password generator for generating a first password;

A password receiving unit that also receives the second password of the second electronic device, the first password stored in the password storage unit and the second password received by the password receiving unit; A storage device comprising: an access control unit that controls access from the second electronic device to the data held by the data storage unit based on the collation result.

[2] The storage device further includes:

A data reading unit configured to read the data stored in the data storage unit and transmit the data to the second electronic device by access from the second electronic device controlled by the access control unit; The storage device according to claim 1.

[3] The storage device further includes:

A data writing unit that receives new data from the second electronic device and writes the new data to the data storage unit by access from the second electronic device controlled by the access control unit. Item 4. The storage device according to item 1.

[4] The data storage unit includes:

Memorize the program with the data,

The storage device further includes:

2. The storage device according to claim 1, further comprising a program execution unit that executes a program stored in the data storage unit when accessed from the second electronic device controlled by the access control unit. .

[5] The storage device further includes: It has an authentication unit that authenticates users,

The access control unit

2. The storage device according to claim 1, wherein access from the second electronic device is controlled based on a result of authenticating the user by the authentication unit.

[6] The data storage unit includes:

A private storage unit that accepts only access from a user authenticated by the authentication unit; and a public storage unit that accepts access from all users including the user who are authenticated by the authentication unit. The storage device according to claim 5.

[7] The storage device further includes:

A current time acquisition unit for acquiring the current time;

Comparing the current time acquired by the current time acquisition unit with the expiration date stored in the expiration date storage unit, and controlling access from the second electronic device based on the comparison result The storage device according to claim 1.

[8] The password generation unit

The password storage unit

Storing the data encrypted by the password generation unit;

The nose word transmitter

The password receiver

Receiving a second secret key from the second electronic device instead of the second password; The access control unit

2. The data stored in the password storage unit is decrypted with the second secret key received by the password receiving unit, and collated with the data stored in the data storage unit. The storage device described in 1.

The storage device

A data storage unit for storing data;

A password generator for generating a first password;

A password receiving unit that also receives the second password of the second electronic device, the first password stored in the password storage unit and the second password received by the password receiving unit; An access control unit that controls access from the second electronic device to the data held by the data storage unit based on the collation result;

The first electronic device is:

The second electronic device is

An input unit for inputting an input value;

An access control system comprising: a second storage device mounting unit that transmits the second password to the password receiving unit based on an input value input by the input unit. [10] The storage device further includes:

It has an authentication unit that authenticates users,

The access control unit

10. The access control system according to claim 9, wherein access from the second electronic device is controlled based on a result of the authentication unit authenticating a user.

[11] The data storage unit includes:

A private storage unit that accepts only access from a user authenticated by the authentication unit; and a public storage unit that accepts access from all users including the user who are authenticated by the authentication unit. The access control system according to claim 10.

[12] The first electronic device further includes:

The display unit

10. The access control system according to claim 9, wherein the first password stored in the first storage unit is displayed.

[13] The storage device further includes:

It has an authentication unit that authenticates users,

The access control unit

13. The access control system according to claim 12, wherein access from the second electronic device is controlled based on a result of the authentication unit authenticating a user.

[14] The data storage unit includes:

A private storage unit that accepts only access from a user authenticated by the authentication unit; and a public storage unit that accepts access from all users including the user who are authenticated by the authentication unit. The access control system according to claim 13. [15] The first electronic device further includes:

The second electronic device further includes:

10. The access control system according to claim 9, wherein the first password received by the second communication unit is transmitted to the password receiving unit as the second password.

[16] The storage device further includes:

It has an authentication unit that authenticates users,

The access control unit

16. The access control system according to claim 15, wherein access from the second electronic device is controlled based on a result of the authentication unit authenticating a user.

[17] The data storage unit includes:

A private storage unit that accepts only access from a user authenticated by the authentication unit; and a public storage unit that accepts access from all users including the user who are authenticated by the authentication unit. The access control system according to claim 16.

[18] In an access control method using a storage device attached to the first electronic device and the second electronic device,

The storage device

Remember the data,

Generate a first password,

Remember the generated first password,

Sending the stored first password to the first electronic device; Receiving a second password from the second electronic device;

Collating the stored first password with the received second password, and controlling access from the second electronic device to the stored data storage unit based on the collation result An access control method characterized by the above.