WO2018173528A1

WO2018173528A1 - Usb device management system and usb device management method

Info

Publication number: WO2018173528A1
Application number: PCT/JP2018/004239
Authority: WO
Inventors: 真弥藏本
Original assignee: 日本電気株式会社
Priority date: 2017-03-21
Filing date: 2018-02-07
Publication date: 2018-09-27
Also published as: JP6828805B2; JPWO2018173528A1

Abstract

Provided is a USB device management system which integrates and manages USB devices which are mounted upon a plurality of terminals, said system comprising: a USB use permission information database in which use permissions of the USB devices are registered in association with a combination of USB device information which identifies the USB devices, terminal identification information which identifies the terminals, and personal authentication information of users of the terminals; a USB control unit which transmits to a USB use management device the terminal identification information, the personal identification information, and the USB device information which relate to an operation upon the USB device which has been mounted upon the terminal, and controls the USB device which has been mounted upon the terminal according to information of the use permissions which has been received from the USB use management device; and a USB use management device which transmits, to the USB control unit, the information of the use permissions which are registered in the USB use permission information database and which is associated with the combination of the terminal identification information, the personal authentication information, and the USB device information having been received from the USB control unit.

Description

USB device management system and USB device management method

The present invention relates to a USB device management system and a USB device management method.

USB (Universal Serial Bus) devices are externally connected devices that can be easily connected to a terminal such as a computer such as a USB memory to exchange data. However, leakage of information in the terminal and virus infection of the terminal frequently occur using a USB device such as a USB memory. Therefore, a technique for protecting information of a USB device has been proposed. Patent Documents 1 and 2 describe techniques for managing information on USB devices via a network. Patent Document 3 describes a technique for managing the use of a USB device using a serial number.

JP 2013-190880 A JP 2011-180837 A JP 2007-148733 A

There is a method of prohibiting the USB connection itself as a general security measure regarding the connection of the USB device. However, this method loses the convenience that is the original feature of USB. Due to the prohibition of the USB connection itself, the use of the terminal is restricted, and the work efficiency is lowered.

In addition, there is generally a method in which a device for recording authentication information such as an IC (Integrated Circuit) chip is additionally mounted on the USB memory itself, and the USB memory is authenticated when used on the terminal side. However, there is a problem that it is necessary to prepare a USB memory having such a special function, and a normal USB memory cannot be used.

In order to solve this problem, there is a technology for authenticating the USB memory without using an IC chip or the like by using the serial ID of the USB memory for authentication. However, there is a USB device serial ID in which a value that is not unique to the USB device is set by the USB device. Some USB devices do not have a serial ID set. Therefore, the method of using only the serial ID of the USB device for authentication lacks the certainty of identification. Further, this method can be applied only to a USB device having a unique serial ID, and cannot be applied to all USB devices.

In the first place, USB recording media such as USB memory are often small and light, and are easily lost or stolen. Therefore, the following problem arises only by the method of enabling only a specific USB memory on the terminal side by USB memory authentication. In other words, when a malicious person obtains a usable USB memory, the USB memory can be connected to a terminal and information leakage or virus infection can be performed.

Furthermore, information leakage and virus infection by USB memory in companies may be caused not only by crimes by outsiders, but also by internal workers who can use USB originally due to lack of information literacy. Such a USB memory security threat has been supposed to be used. For this reason, it is difficult to specify all the individuals, terminals, and dates and times that are the cause. If the individual, terminal, date and time, or USB device that caused the security threat cannot be identified, there may be a delay in dealing with the threat or a situation in which the worst threat cannot be dealt with. As a result, it is not possible to take measures to prevent the increase in damage and the recurrence of similar security threats.

Generally, there is a method of ensuring security by restricting use of the terminal itself to a specific person. However, such a method cannot be used in an operation method or system based on the assumption that an unspecified number of people use the terminal.

In an environment where a large number of terminals are handled, the importance of confidential information handled by the user who operates the terminal and the terminal differs depending on the operation method and usage of the terminal. Therefore, it is desired that the operation can be performed at different security levels according to the operation method and application, and the settings of each terminal can be managed collectively.

In such a situation, it is possible to identify a terminal, an individual, and a USB device that cause a security threat without restricting functions other than the USB of the terminal and without impairing the convenience that is the original feature of the USB device as much as possible. Integrated management of USB device usage status monitoring and USB device usage control is required.

In view of the above-described problems, an object of the present invention is to provide a USB device management system and a USB device management method capable of performing integrated management of USB device usage status monitoring and USB device use control.

In order to solve the above-described problem, a USB device management system according to an aspect of the present invention is a USB device management system that manages USB devices attached to a plurality of terminals in an integrated manner, and identifies the terminals. A USB usage permission information database in which the right to use the USB device is registered corresponding to a combination of terminal identification information, personal authentication information of the user of the terminal, and USB device information for identifying the USB device; The terminal identification information, the personal authentication information of the user, and the USB device information related to operations on the USB device attached to the terminal are transmitted to the USB usage management device and received from the USB usage management device. According to the usage authority information, the USB control unit that controls the USB device mounted on the terminal, and the USB control unit The usage control information registered in the USB usage permission information database corresponding to the combination of the received terminal identification information, the user personal authentication information, and the USB device information is sent to the USB control unit. A USB usage management device for transmission.

A USB device management method according to an aspect of the present invention is a USB device management method for managing USB devices attached to a plurality of terminals in an integrated manner, wherein the USB control unit of the terminal is attached to the terminal. The terminal identification information for identifying the terminal, the personal authentication information of the user, and the USB device information for identifying the USB device are transmitted to the USB usage management apparatus, and the USB usage management apparatus is connected to the terminal. Reference is made to the USB usage permission information database in which the usage authority of the USB device is registered corresponding to the combination of the identification information, the personal authentication information of the user, and the USB device information, and received from the USB control unit The USB use permission information data corresponding to a combination of the terminal identification information, the user personal authentication information, and the USB device information. The usage authority information registered in the database is transmitted to the USB control unit, and the USB control unit of the terminal is attached to the terminal according to the usage authority information received from the USB usage management device. The USB device is controlled.

According to the present invention, it is possible to perform integrated management of USB device usage status monitoring and USB device usage control.

It is a block diagram which shows the structural example of the USB apparatus management system which concerns on 1st Embodiment. It is explanatory drawing of the system administrator in the USB device management system which concerns on 1st Embodiment, the user of a terminal, and a USB device. It is explanatory drawing of the USB use authority which can be set with the USB device management system which concerns on this embodiment. It is explanatory drawing of the content registered into the USB use permission information database. It is explanatory drawing of the setting information of USB apparatus permission registration from the terminal registered in the USB permission registration information database. It is explanatory drawing of the permission registration log | history from the terminal registered into the USB permission registration information database. It is explanatory drawing of the content registered into the USB utilization condition log | history database. It is a flowchart which shows the operation | movement when a user connects or disconnects USB to a terminal. It is a 1st flowchart which shows the operation | movement at the time of a user operating the USB apparatus connected to the terminal. It is a 2nd flowchart which shows the operation | movement at the time of a user operating the USB apparatus connected to the terminal. It is a 1st flowchart which shows the operation | movement at the time of registering a use authority semiautomatically from the terminal to USB use permission information DB51. It is a 2nd flowchart which shows the operation | movement at the time of registering a use authority semiautomatically to USB use permission information DB51 from a terminal. It is a schematic block diagram which shows the basic composition of the USB apparatus management system in one Embodiment.

Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a diagram illustrating a configuration example of a USB device management system 1 according to the first embodiment. As shown in FIG. 1, a USB device management system 1 according to the first embodiment includes

terminals

11, 12, 13 such as PCs (personal computers), and a USB usage management device 41 composed of servers on a network. USB usage permission information database 51, USB permission registration information database 61, and USB usage status history database 71 are provided.

The terminal 11 includes a USB control unit 111, a personal authentication information input unit 113, a USB terminal 114, a terminal information acquisition unit 115, and a USB information acquisition unit 116. Further, data 112 is stored in the terminal 11. The USB control unit 111 communicates with the USB usage management device 41 via the network 91 and controls the use authority of the USB device attached to the terminal 11. The personal authentication information input unit 113 collects personal authentication information from the user of the terminal 11. The personal authentication information is information that can identify an individual such as biometrics authentication or face authentication.

USB devices

31, 32, and 33 (see FIG. 2) can be connected to the USB terminal 114. The terminal information acquisition unit 115 acquires terminal identification information unique to the terminal such as a MAC (Media Access Control) address and an electronic certificate. The USB information acquisition unit 116 acquires information (USB device information) for identifying a USB device such as a serial ID, a vendor ID, and a product ID.

The terminal 12 and the terminal 13 are configured similarly to the terminal 11. That is, the terminal 12 includes a USB control unit 121, a personal authentication information input unit 123, a USB terminal 124, a terminal information acquisition unit 125, and a USB information acquisition unit 126. The terminal 12 stores data 122. The terminal 13 includes a USB control unit 131, a personal authentication information input unit 133, a USB terminal 134, a terminal information acquisition unit 135, and a USB information acquisition unit 136. In addition, data 132 is stored in the terminal 13.

In addition, although the three

terminals

11, 12, and 13 are illustrated here, the number of terminals is not limited to three. If the terminal has the same components as the terminal 11, such as the terminal 12 and the terminal 13, the USB usage management device 41 gives the usage authority regardless of the number of terminals by connecting to the network 91. Integrated management is possible.

The USB usage management device 41 manages the operation contents that can be executed on the USB device (hereinafter referred to as USB usage authority) and the usage history of the USB device. The USB usage management device 41 can be connected to the USB control unit (

USB control unit

111, 121, 131) of each terminal (

terminal

11, 12, 13) to be managed via the network 91. In addition, the USB usage management device 41 can access the USB usage permission information database 51, the USB usage status history database 71, and the USB permission registration information database 61.

The USB use permission information database 51 stores USB use authority and information on terminals, users, and USB devices. The USB permission registration information database 61 stores USB device permission registration setting information from the terminal and terminal permission registration history information. The USB device permission registration setting information from the terminal is setting information related to registration processing for permitting USB use authority in the terminal. The terminal permission registration history information is a history of registration processing for permitting USB use authority in the terminal. In the USB usage status history database 71, when a USB device is used, the terminal and user using the USB device, information on the used USB device, operation details at the time of use, operation target, operation occurrence time, etc. Is recorded.

FIG. 2 is a diagram for explaining a system administrator, a terminal user, and a USB device in the USB device management system 1 according to the first embodiment.

In FIG. 2, a system administrator 81 represents a person who has authority to use the USB device management system 1 to set USB device control and view the usage status of the USB device. The system administrator 81 can edit the registration contents of the USB usage permission information database 51 using the USB usage management device 41. Further, the system administrator 81 can use the USB usage management device 41 to edit the USB device permission registration setting from the terminal in the USB permission registration information database 61 and browse the permission registration history from the terminal. Further, the system administrator 81 can browse the contents recorded in the USB usage status history database 71 using the USB usage management device 41.

Each of the user 21, the user 22, and the user 23 represents a person who uses any one of the terminal 11, the terminal 12, and the terminal 13. In the present embodiment, there is no limit on the number of users. Note that the user 21, the user 22, and the user 23 can be identified by personal authentication information such as biometric authentication and face authentication. Further, the terminal 11, the terminal 12, and the terminal 13 can be identified by terminal identification information representing information unique to the terminal such as a MAC (Media Access Control) address or an electronic certificate.

The USB device 31, the USB device 32, and the USB device 33 are general external connection devices that can be attached to the USB terminal 114, the USB terminal 124, and the USB terminal 134 of the terminal 11, the terminal 12, and the terminal 13, respectively. The USB device 31, the USB device 32, and the USB device 33 each have a serial ID, a vendor ID, and a product ID as their own USB device information. The USB device 31 stores data 311, the USB device 32 stores data 321, and the USB device 33 stores data 331. In the present embodiment, the number of USB devices is not limited and a plurality of USB devices can be handled.

FIG. 3 is a diagram showing USB use authority that can be set by the USB device management system 1 according to the present embodiment. Reading data from the USB device means referring to data in the

USB devices

31, 32, and 33. Writing data to the USB device means storing data in the

terminals

11, 12, 13 in the

USB devices

31, 32, 33. The authority to execute a file in the USB device is an authority to operate an execution file stored in the

USB devices

31, 32, and 33. Writing data from the USB device to the terminal means storing data in the

USB devices

31, 32, and 33 in the

terminals

11, 12, and 13.

FIG. 4 is a diagram showing an example of the contents registered in the USB usage permission information database 51. In the USB use permission information database 51, terminal identification information of a terminal that is permitted to use a USB device, personal authentication information of a user of the terminal, a combination of USB device information, and a USB use right permitted by the combination are registered. Has been. Each of the terminal identification information, the user personal authentication information, and the USB device information may be an unspecified arbitrary terminal, an arbitrary user, or an arbitrary USB device. For example, according to the USB usage permission information database 51 shown in FIG. 4, “Allow all users” in the “User personal authentication information” column permits any user without restricting the user. Indicates that the condition is set.

5 and 6 are diagrams showing examples of contents registered in the USB permission registration information database 61. FIG. The USB permission registration information database 61 stores two pieces of information: USB device permission registration setting information (FIG. 5) from the terminal and terminal permission registration history (FIG. 6).

FIG. 5 is a diagram showing an example of USB device permission registration setting information from the terminal registered in the USB permission registration information database 61. In the USB permission registration information database 61, conditions for performing permission registration of use of the USB device from the terminal are registered. That is, in the USB permission registration information database 61 shown in FIG. 5, the combination of the terminal identification information that can be registered for permission and the personal authentication information of the user, and information on the USB use authority that can be set by the combination are registered. ing.

FIG. 6 is a diagram showing an example of the permission registration history from the terminal registered in the USB permission registration information database 61. When the use permission registration of the USB device is performed from the terminal, the contents and time registered in the USB use permission information database 51 are recorded in the USB permission registration information database 61 shown in FIG. That is, the terminal identification information of the terminal that performed the permission registration, the personal authentication information of the user, the USB device information of the permitted USB device, the permitted USB use authority, and the time when the permission registration was performed are registered.

FIG. 7 is a diagram showing an example of contents registered in the USB usage status history database 71. When the USB device is used, the USB usage status history database 71 includes the terminal identification information of the terminal used and the personal authentication information of the user, the information of the USB device used, the operation content at the time of use, the operation target, the operation The occurrence time of is recorded. The operation contents are USB device connection / disconnection and USB use authority (reading etc.) used by the operation. The operation target is data that is the target of the operation content.

In this embodiment, the

USB control units

111, 121, 131 of the

terminals

11, 12, 13 and the USB usage management device 41 are connected via the network 91. Further, terminal identification information, user personal authentication information, and USB device information are transmitted from the

USB control units

111, 121, and 131 to the USB usage management device 41. The USB usage management device 41 includes a combination of terminal identification information that permits the use of a USB device stored in the USB usage permission information database 51 (FIG. 4), user personal authentication information, USB device information, and each terminal 11. , 12 and 13 are compared with the terminal identification information, user personal authentication information, and USB device information transmitted from the

USB control units

111, 121 and 131. Thereby, the USB usage management device 41 manages the usage authority of the USB device. Further, the USB usage management device 41 stores the usage history of the USB device in the USB usage status history database 71 (FIG. 7), and manages the usage history of the USB device.

Here, terminal-specific information such as a MAC address or an electronic certificate is used as terminal identification information for specifying the

terminals

11, 12, and 13 that use the USB device. As information for specifying the

users

21, 22, and 23, personal authentication information that can specify an individual such as biometric authentication and face authentication is used. As information for identifying the

USB devices

31, 32, and 33, USB device information such as a serial ID, a vendor ID, and a product ID registered in the USB device is generally used.

The USB device management system 1 according to this embodiment identifies a terminal, an individual, and a USB device based on a combination of terminal identification information, user personal authentication information, and USB device information. As a result, the USB device management system 1 does not require holding special data or mounting an IC chip or the like in the USB device itself, performs authentication on the terminal or system, and controls the use of the USB device.

Further, in the USB device management system 1 according to the present embodiment, when the

USB devices

31, 32, and 33 are connected to the

terminals

11, 12, and 13 and used, the used device is stored in the USB usage status history database 71 (FIG. 7). The user, the used USB device information, the USB device operation, and the operation time are recorded. That is, the USB device management system 1 records which USB device is used by each terminal and how and who uses it, and makes it possible to refer to it. Information for identifying the cause of the USB security threat is provided by such a monitoring function.

The setting of USB device usage control can be performed by a system administrator 81 having special authority. That is, the system administrator 81 uses the USB usage management device 41 to store the USB usage permission information database 51 (FIG. 4) in the terminal identification information, personal authentication information, USB device information, and the conditions (combination) of these. Register restrictions.

Separately, in the USB device management system 1 of this embodiment, USB device permission registration setting information from the terminal is stored in the USB permission registration information database 61 (FIG. 5). Based on a combination of a specific user and a terminal stored in the USB permission registration information database 61, setting of usage control is performed on the

terminals

11, 12, and 13 without using the USB usage management apparatus 41. Can do. In the case of a combination of a

specific user

21, 22, 23 or system administrator 81 and the

terminals

11, 12, 13, the following becomes possible. That is, the

user

21, 22, 23 or the system administrator 81 connects the

USB devices

31, 32, 33 to the

terminals

11, 12, 13, so that the contents of the terminal identification information, personal authentication information, and USB device information are obtained. It is possible to set the usage control of the USB device semi-automatically without being conscious. Then, the USB device management system 1 records in the USB permission registration information database 61 (FIG. 6) the terminal and user registered according to the semi-automatic setting, the set USB device information, and the USB use authority. As a result, the USB device management system 1 provides information for identifying the cause when a USB security threat occurs.

As described above, in this embodiment, control of these USB devices and monitoring of usage status are performed for a plurality of terminals for integrated management. The USB device can be controlled separately depending on the use of each terminal, the user, and the USB device.

Next, the operation of the first embodiment will be described. First, an operation when the

user

21, 22, 23 connects or disconnects the

USB devices

31, 32, 33 to the

terminals

11, 12, 13 will be described.

FIG. 8 is a flowchart showing an operation when the user connects or disconnects the USB to the terminal. The USB control unit described in the flowchart of FIG. 8 may be any of the

USB control units

111, 121, and 131 of the

terminals

11, 12, and 13 shown in FIG. The user described in the flowchart of FIG. 8 represents any one of the

users

21, 22, and 23 shown in FIG. The USB device information described in the flowchart of FIG. 8 represents any one of the

USB devices

31, 32, and 33 shown in FIG. In the following description, a case where the user 21 connects and disconnects the USB device 31 to the USB terminal 114 of the terminal 11 will be described as an example.

(Step S2001) When the USB device 31 is not connected to the USB terminal 114, the USB control unit 111 sets all USB use authorities of the USB terminal 114 to invalid. That is, the USB use authority of the USB terminal 114 is set to an unauthorized state (initial state). However, the initial state is not limited to the state without authority, and may be a state with predetermined authority.

(Step S2002) The user 21 connects the USB device 31 to the USB terminal 114 of the terminal 11, and advances the process to step S2003.

(Step S2003) When the USB device 31 is connected to the USB terminal 114, the USB control unit 111 collects the serial ID, the vendor ID, and the product ID that are the USB device information of the USB device 31 from the USB information acquisition unit 116. Then, the USB control unit 111 advances the process to step S2004.

(Step S2004) The USB control unit 111 transmits the collected information to the USB usage management apparatus 41 via the network 91. The collected information includes USB device information (serial ID, vendor ID, product ID) of the USB device 31, identification information of the terminal 11 (information unique to the terminal such as a MAC address and an electronic certificate), and connection time. Then, the USB control unit 111 advances the process to step S2005.

(Step S2005) Based on the information received from the USB control unit 111, the USB usage management apparatus 41 registers that the USB device 31 is connected to the terminal 11 in the USB usage status history database 71, and the process proceeds to step S2006. To proceed.

(Step S2006) The USB usage management apparatus 41 collates the information received from the USB control unit 111 with the information stored in the USB usage permission information database 51. Accordingly, the USB usage management device 41 controls the USB device when the user 21 uses the USB device 31. The processing at this time will be described later by exemplifying operations when the user operates the USB device connected to the terminal, using the flowcharts of FIGS. 9A and 9B.

(Step S2007) The USB control unit 111 determines whether the user 21 disconnects the USB device 31 from the terminal 11. That is, the USB control unit 111 determines whether the user 21 is trying to disconnect the USB device 31 from the terminal 11. When disconnecting the USB device 31 from the terminal 11 (step S2007: Yes), the USB control unit 111 proceeds to step S2008, and when not disconnecting (step S2007: No), the process proceeds to step S2010. .

(Step S2008) The user 21 makes a request to remove the USB device 31 connected to the terminal 11, and advances the processing to step S2009.

(Step S2009) Upon receiving a request from the user 21, the terminal 11 disconnects the connection with the USB device 31 and advances the process to step S2010.

(Step S2010) The USB control unit 111 confirms the connection state of the USB device 31, and advances the process to step S2011.

(Step S2011) The USB control unit 111 determines whether or not the USB device 31 is connected to the terminal 11 as a result of the confirmation in Step S2010. When the USB device 31 is connected to the terminal 11 (step S2011: No), the USB control unit 111 proceeds to step S2006, and when the USB device 31 is disconnected from the terminal 11 (step S2011: Yes). Then, the process proceeds to step S2012.

(Step S2012) The USB control unit 111 transmits the identification information of the terminal 11, the USB device information of the USB device 31, and the disconnection time to the USB usage management device 41 via the network 91. Then, the USB control unit 111 advances the process to step S2013.

(Step S2013) The USB usage management apparatus 41 stores in the USB usage status history database 71 information indicating that the USB device 31 of the terminal 11 has been disconnected based on the received information. When the above process ends, the process returns to step S2001.

Next, the operation when the user operates the USB device connected to the terminal will be described. 9A and 9B are flowcharts showing an operation when the user operates a USB device connected to the terminal.

Each of the USB control unit, the terminal identification information, and the personal authentication information input unit described in the flowcharts of FIGS. 9A and 9B includes any one of the

terminals

11, 12, and 13 illustrated in FIG. The terminal identification information of the terminal, the

USB control unit

111, 121, or 131 of the terminal, and the personal authentication

information input unit

113, 123, or 133 are represented. Each of the user and personal authentication information described in the flowcharts of FIGS. 9A and 9B is an arbitrary one of the

users

21, 22, and 23 shown in FIG. 2 and the personal authentication of the user. Represents information. The USB device information described in the flowcharts of FIGS. 9A and 9B represents the USB device information of any one of the

USB devices

31, 32, and 33 illustrated in FIG.

In the following description, the operation will be described by taking the operation of writing the data 112 in the USB device 31 connected to the terminal 11 by the user 21 as an example.

(Step S3001) The user 21 tries to write the data 112 from the terminal 11 to the USB device 31 connected to the terminal 11. That is, in this example, a case where the user 21 tries to perform a writing operation on the USB device 31 in the terminal 11 is illustrated.

(Step S <b> 3002) When a data write operation to the USB device 31 occurs, the USB control unit 111 displays a request for personal authentication information on the terminal 11. Accordingly, the USB control unit 111 requests the user 21 for personal authentication, and the process proceeds to step S3003.

(Step S3003) Upon receiving the request for personal authentication, the user 21 uses the personal authentication information input unit 113 to input personal authentication information that can be specified by the user 21. Then, the USB control unit 111 advances the process to step S3004. The personal authentication information includes biometric authentication and face authentication.

(Step S3004) The USB control unit 111 receives the personal authentication information of the user 21 from the personal authentication information input unit 113, and advances the processing to step S3005.

(Step S3005) The USB control unit 111 includes the USB device information of the USB device 31 (serial ID, vendor ID, product ID, etc. registered in the USB device) and personal authentication information of the user 21 (biometric authentication and face). Information such as authentication) and identification information (MAC address, electronic certificate, etc.) of the terminal 11 are transmitted to the USB usage management apparatus 41 via the network 91.

(Step S3006) The USB usage management apparatus 41 collates the information received from the USB control unit 111 with the information registered in the USB usage permission information database 51. The USB control unit 111 advances the process to step S3007. In accordance with steps S3007 to S3009, the USB usage management apparatus 41 registers the combination of the identification information of the terminal 11, the personal authentication information of the user 21, and the USB device information of the USB device 31 in the USB usage permission information database 51. It is determined whether or not.

(Step S3007) The USB usage management apparatus 41 checks whether the identification information of the terminal 11 is registered in the USB usage permission information database 51. If the identification information of the terminal 11 is registered (step S3007: Yes), the USB usage management apparatus 41 proceeds with the process to step S3008, and if not registered (step S3007: No), the process proceeds to step S3020. Proceed to Identification information of the terminal 11 is registered in the USB use permission information database 51 shown in FIG. Therefore, the USB usage management device 41 advances the process to step S3008.

(Step S3008) The USB usage management apparatus 41 checks whether or not the personal authentication information of the user 21 is registered in the USB usage permission information database 51 as a USB usage authorized person in the terminal 11. If the personal authentication information of the user 21 is registered corresponding to the identification information of the terminal 11 (step S3008: Yes), the USB usage management apparatus 41 proceeds with the process to step S3009, and if not registered. (Step S3008: No), a process is advanced to step S3020. In the USB use permission information database 51 shown in FIG. 4, personal authentication information of the user 21 as a USB use authorized person in the terminal 11 is registered. Therefore, the USB usage management device 41 advances the process to step S3009.

(Step S3009) The USB usage management apparatus 41 checks whether or not the information on the USB device 31 is registered in the USB usage permission information database 51 as USB device information that can be used by the user 21 at the terminal 11. If the information of the USB device 31 is registered corresponding to the combination of the identification information of the terminal 11 and the personal authentication information of the user 21 (step S3009: Yes), the USB usage management apparatus 41 proceeds to step S3010. If not registered (step S3009: NO), the process proceeds to step S3020. In the USB use permission information database 51 shown in FIG. 4, information on the USB device 31 is registered as USB device information that can be used by the user 21 in the terminal 11. For this reason, the USB use management apparatus 41 succeeds in collation, and the process proceeds to step S3010.

(Step S3010) The USB usage management device 41 acquires from the USB usage permission information database 51 information on the USB usage authority in the USB device 31 that can be used by the user 21 at the terminal 11 that has been successfully verified. That is, the USB usage management device 41 acquires USB usage authority information registered corresponding to the combination of the terminal 11, the user 21, and the USB device 31. Then, the USB usage management device 41 advances the process to step S3011 (FIG. 9B). Here, according to the USB use permission information database 51 shown in FIG. 4, “USB device data read” and “USB device data read” are used as the USB use authority in the case of the combination of the terminal 11, the user 21, and the USB device 31. "Write" permission is acquired.

(Step S <b> 3011) The USB usage management device 41 transmits the USB usage authority information acquired from the USB usage permission information database 51 to the USB control unit 111 of the terminal 11. Then, the USB usage management device 41 advances the process to step S3012.

(Step S 3012) The USB control unit 111 receives USB usage authority information from the USB usage management apparatus 41 via the network 91. Then, the USB control unit 111 compares the operation generated in step S3001 (FIG. 9A) with the USB use authority.

(Step S3013) The USB control unit 111 determines whether or not the operation generated in step S3001 is included in the USB usage authority received from the USB usage management apparatus 41. If there is a usage right, that is, if the generated operation is included in the USB usage right (step S3013: Yes), the USB control unit 111 advances the process to step S3014. On the other hand, when there is no use authority, that is, when the generated operation is not included in the USB use authority (step S3013: No), the USB control unit 111 advances the process to step S3018. The operation generated in step S3001 is “write data to USB device”, and the received USB usage authority is “read data from USB device” and “write data to USB device”. In this case, the generated operation “data writing to USB device” is included in the range of the received USB usage authority. For this reason, the USB control unit 111 advances the processing to step S3014.

(Step S3014) The USB control unit 111 enables “data writing to USB device”. That is, the USB control unit 111 temporarily performs setting for enabling “data writing to USB device” on the USB terminal 114. The USB control unit 111 writes the data 112 to the USB device 31 attempted by the user 21 in step S3001. Then, the USB control unit 111 advances the process to step S305.

(Step S3015) Upon completion of writing data 112 to the USB device 31 in step S3014, the USB control unit 111 invalidates the right to write to the USB device 31 temporarily enabled to execute step S3014. To do. That is, when the operation is completed, the USB control unit 111 returns the USB use authority of the USB terminal 114 to the state before the setting is changed. Then, the USB control unit 111 advances the process to step S3016.

(Step S3016) The USB control unit 111 transmits the usage history to the USB usage management device 41 via the network 91. That is, the USB control unit 111 executes the executed operation (data writing to the USB device), the operation target (data 112), the execution time, the identification information of the terminal 11, the personal authentication information of the user 21 received in step S3004, The USB device information of the USB device 31 is transmitted to the USB usage management device 41.

(Step S3017) The USB usage management apparatus 41 records the received information in the USB usage status history database 71 as a usage status history.

The above is the operation when a USB device can be used. Patterns that cannot be used by USB devices are also briefly described.

For example, in the above-described example, the case where the user 21 performs a data write operation on the USB device 31 in the terminal 11 is illustrated. On the other hand, the following example illustrates a case where the user 22 performs a data write operation on the USB device 31 in the terminal 11. In the USB use permission information database 51 shown in FIG. 4, use permission information of the USB device 31 by the user 22 in the terminal 11 is registered. However, the USB use authority corresponding to the combination is only “read data of USB device”, and does not include the USB use authority of “write data to USB device”. Since the generated operation is not included in the USB use authority (step S3013: No), the USB control unit 111 proceeds from step S3013 to step S3018.

(Step S3018) The USB control unit 111 updates the USB device use authority to the received USB authority. That is, the USB control unit 111 sets the USB use authority of the USB terminal 114 to “read data of USB device”. As a result, the USB control unit 111 prevents the operation (data writing to the USB device) generated in step S3001 from being executed. Then, the USB control unit 111 advances the process to step S3019.

(Step S3019) The USB control unit 111 notifies the user that there is no authority.

Further, a case where the user 22 intends to use the USB device 32 at the terminal 12 is illustrated. In this case, the registration information in the USB usage permission information database 51 shown in FIG. 4 does not register permission information for the user 22 to use the USB device 32 at the terminal 12. That is, the USB usage authority is not registered corresponding to the combination of the terminal 12, the user 22, and the USB device 32. For this reason, the authentication (collation) performed in steps S3007 to S3009 fails, and the process proceeds to step S3020.

(Step S3020) The USB usage management apparatus 41 transmits the fact that collation has failed to the USB control unit 111, and advances the processing to step S3021.

(Step S <b> 3021) The USB control unit 111 removes all authority to use the USB device. That is, the USB use authority of the USB terminal 114 is set to the initial state. As a result, the USB control unit 111 advances the process to step S3022 without executing the process generated in step S3001.

(Step S3022) The USB control unit 111 notifies the user that the authentication has failed.

Next, USB device control settings will be described. As described above, the system administrator 81 can use the USB usage management device 41 to edit the registration contents of the USB usage permission information database 51 that handles setting information for control of the USB device. Therefore, if the system administrator 81 has previously registered terminal identification information, user personal authentication information, USB device information, and USB usage authority in the USB usage permission information database 51, the USB device is registered under the registered conditions. Can be used.

However, in a large-scale system, it is troublesome for the system administrator 81 to obtain all the registration contents registered in the USB usage permission information database 51 and input the contents using the USB usage management apparatus 41. It is also inconvenient if you want to use an unregistered USB device temporarily. Therefore, in this embodiment, in order to ensure the convenience of the USB device, it is possible to semi-automatically register the contents to be registered in the USB usage permission information database 51.

Specifically, in this embodiment, a USB permission registration information database 61 shown in FIG. 5 is provided. The USB permission registration information database 61 stores USB device permission registration setting information from the terminal. When the combination of the terminal and the user registered in the USB permission registration information database 61 is matched, the user can register the USB use authority corresponding to the USB device connected to the registered terminal in the USB use permission information database 51. . At this time, the user need not be aware of the contents of the terminal identification information, personal authentication information, and USB device information to be registered. That is, it is registered in the USB usage permission information database 51 with the conditions (combination) of the terminal identification information, the user personal authentication information, and the USB device information read by the

USB controllers

111, 121, 131 of the

terminals

11, 12, 13. The

However, the USB usage authority to be registered can be registered only within the range of allowable USB usage authority set in the USB permission registration information database 61 in advance. Further, unlike the system administrator 81, this user is a USB usage permission information database other than the browsing of the USB usage status history database 71 and the USB permission registration information database 61 and the permission registration of new USB devices by the user. 51 cannot be edited or viewed.

FIG. 10A and FIG. 10B are flowcharts showing an operation when the use authority is semi-automatically registered in the USB use permission information database 51 from the terminal. Each of the USB control unit, the terminal identification information, and the personal authentication information input unit described in the flowcharts of FIGS. 10A and 10B is the USB control unit 111 of any one of the

terminals

11, 12, and 13. 121, 131, terminal identification information and personal authentication information input unit.

The user and personal authentication information described in the flowcharts of FIGS. 10A and 10B represent any one of the

users

21, 22, and 23 and the personal authentication information of the user. The USB device information described in the flowcharts of FIGS. 10A and 10B represents the USB device information of any one of the

USB devices

31, 32, and 33.

Hereinafter, the case where the user 21 can use the USB device 33 connected to the terminal 11 by the user 21 in the terminal 11 will be described as an example. Further, it is assumed that information as shown in FIG. 5 is registered in advance in the USB permission registration information database 61 by the system administrator 81.

(Step S4001) The user 21 connects the USB device 33 to the terminal 11.
(Step S4002) As the USB device 33 is connected, the processing from steps S2002 to S2005 in FIG. 8 is performed. As a result, information indicating that the USB device 33 is connected to the terminal 11 is recorded in the USB usage status history database 71.

(Step S4003) The user 21 inputs the USB usage authority (in this example, data reading of the USB device) that the user 21 wants to use to the USB device 33 connected to the terminal 11 to the USB control unit 111, and the USB Request permission to use the device 33. The USB control unit 111 advances the process to step S4004.

(Step S4004) The USB control unit 111 requests personal authentication information from the user 21 of the terminal 11, and the process proceeds to step S4005.

(Step S4005) The user 21 inputs the personal authentication information of the user 21 using the personal authentication information input unit 113, and the process proceeds to step S4006.

(Step S4006) The USB control unit 111 receives the personal authentication information of the user 21 from the personal authentication information input unit 113, and advances the processing to step S4007.

(Step S4007) The USB control unit 111 transmits information used for verification to the USB usage management apparatus 41 via the network 91. The information used for the verification includes the USB device information (serial ID, vendor ID, product ID) of the USB device 33, requested information on the USB usage authority to be permitted (data reading of the USB device), and personal authentication information of the user 21. (Biometrics authentication, face authentication, etc.) and identification information (MAC address, electronic certificate, etc.) of the terminal 11 are included.

(Step S4008) The USB usage management device 41 collates the received information with the information registered in the USB permission registration information database 61. The USB usage management device 41 proceeds to step S4009 in FIG. 10B.

(Step S4009) The USB usage management device 41 checks whether the identification information of the terminal 11 is registered in the USB permission registration information database 61. If it is registered (step S4009: Yes), the USB usage management apparatus 41 advances the process to step S4010. If not registered (step S4009: No), the USB usage management apparatus 41 advances the process to step S4016. Here, the identification information of the terminal 11 is registered in the USB permission registration information database 61 shown in FIG. Therefore, the USB usage management device 41 advances the process to step S4010.

(Step S4010) The USB usage management apparatus 41 checks whether the personal authentication information of the user 21 is registered in the USB permission registration information database 61 as a USB permission registration authority in the terminal 11. If the personal authentication information of the user 21 is registered corresponding to the identification information of the terminal 11 (step S4010: Yes), the USB usage management apparatus 41 proceeds with the process to step S4011, and if not registered. (Step S4010: No), a process is advanced to step S4016. Here, the personal authentication information of the user 21 is registered in the USB permission registration information database 61 shown in FIG. Therefore, the USB usage management device 41 advances the process to step S4011.

(Step S4011) The USB usage management apparatus 41 checks whether or not “USB device data reading” is registered in the USB permission registration information database 61 as a USB usage authority that can be registered by the user 21 at the terminal 11. The USB usage management apparatus 41, when “USB device data read” is registered corresponding to the combination of the identification information of the terminal 11 and the personal authentication information of the user 21 (step S4011: Yes), The process proceeds to S4012. On the other hand, if not registered (step S4011: No), the USB usage management apparatus 41 advances the process to step S4016. Here, in the USB permission registration information database 61 shown in FIG. 5, the USB usage authority “read data of USB device” and “to USB device” corresponding to the identification information of the terminal 11 and the personal authentication information of the user 21. "Data write" information is registered. For this reason, the USB usage management device 41 succeeds in collation, and the process proceeds to step S4012.

(Step S4012) The USB usage management apparatus 41 registers information in the USB usage permission information database 51 after successful verification. The USB usage management device 41 registers information in the USB usage permission information database 51 so that the user 21 can perform USB usage authority “data reading of USB device” to the USB device 33 at the terminal 11. Specifically, the USB usage authority “read data of USB device” is registered corresponding to the combination of the identification information of the terminal 11, the personal authentication information of the user 21, and the information of the USB device 33. The USB usage management apparatus 41 advances the process to step S4013.

(Step S4013) As shown in FIG. 6, the USB usage management apparatus 41 records registration information as permission registration history from the terminal in the USB permission registration information database 61. The USB usage management device 41 notifies the system administrator 81 of the contents, and advances the process to step S4014.

(Step S <b> 4014) The USB usage management apparatus 41 transmits the USB usage authority “data reading of USB device” of the USB device to the USB control unit 111 that is the information transmission source. The USB usage management device 41 advances the process to step S4015.

(Step S4015) The USB control unit 111 sets the use authority of the USB device 33 according to the received USB use authority. The USB control unit 111 notifies the user 21 that registration has succeeded.

The above illustrates the operation when the USB device usage permission registration is successful from the terminal. Briefly explain the patterns that cannot be registered. For example, a case where the user 23 tries to register the USB device 32 on the terminal 11 is illustrated. In this case, the setting contents of the USB permission registration information database 61 shown in FIG. That is, the user 23 is not permitted to register the USB usage authority of the USB device in the terminal 11. For this reason, the USB usage management apparatus 41 fails the authentication in steps S4009 to S4011, and proceeds to step S4016.

(Step S4016) The USB usage management apparatus 41 notifies the USB control unit 111 that the verification has failed, and the process proceeds to step S4017.

(Step S4017) The USB control unit 111 notifies the user 23 that the authentication has failed.

As described above, in the present embodiment, a USB device necessary for a use can be used by performing permission registration of the USB device and its use authority.

In this embodiment, the serial ID, the vendor ID, and the product ID that exist in any USB device are used for authentication of the USB device. Therefore, it is not necessary to perform a special security measure such as an authentication function on the USB device itself, and any USB device can be controlled. For this reason, the use of the terminal is not restricted, and the work efficiency is not reduced.

Further, in this embodiment, in order to use the USB device in the terminal, identification of the terminal, authentication of the USB device, and personal authentication of the user are required. For this reason, even with a USB device whose serial ID is not unique, the usage status can be identified by who is connected to which vendor ID and product ID of the USB device at which terminal. Even if a usable USB device is stolen or USB device information is forged into usable USB device information, personal authentication is not successful. For this reason, it is possible to prevent data taken out in the terminal via the USB device and virus infection.

In addition, the USB device management system 1 of the present embodiment combines the used operation information, USB device information, the used terminal, the used individual, and the used time information together with the USB usage status history database 71. To record. You can also browse this information. Thereby, it is easy to identify the cause of the generated security threat. In the present embodiment, terminal information, USB device information, individual, operation information, and time are also recorded. For this reason, it is possible to identify the USB device, the terminal, the individual, and the time that caused the security problem with respect to the security problem.

In this embodiment, the authority to use the USB device can be controlled for each terminal, for each user, and for each USB device. For this reason, even if the importance of the confidential information handled is different but mixed, different control can be performed. The same terminal can perform different control for each user, and the same user can perform different control for each terminal used. For this reason, control can be set according to various uses of the terminal, its user, and the USB device used, and the control information can be integrated and managed.

In the present embodiment, when the terminal is disconnected from the network 91 connected to the USB usage management device 41, the use of the USB device is restricted by the USB control unit in the terminal, and the USB device is used. Authentication is not passed. For this reason, the USB device is not used in a state of being out of the management of the USB usage management device 41. Even if the terminal is disconnected from the network 91, the terminal can be protected from security threats caused by unauthorized use of the USB device. In addition, because of this property, since the USB device is not used outside the monitoring of the usage status of the USB device, the use of the USB device in the terminal can be monitored without omission.

In this embodiment, the USB usage management device 41 can integrally manage the usage control of USB devices of a plurality of terminals. Since the system administrator 81 can perform USB control at each terminal using the USB usage management device 41, it is not necessary to make settings on each terminal.

In this embodiment, the USB device is connected to a terminal registered in the USB permission registration information database 61 and managed by the USB usage management device 41, so that the user can identify the terminal identification information and the user's personal authentication. There is no need to be aware of information and USB device information, and control of USB devices can be registered semi-automatically.

Note that it is assumed that an unspecified number of users use the terminal for providing services using the terminal in public places or event venues. Regarding the use of the USB device, only reading of the data of the USB device is permitted, and for security purposes, taking out information in the terminal (writing data to the USB device) and executing the file may be prohibited. In this case, as shown in the example of the terminal 13 in the USB usage permission information database 51 of FIG. 4, if all users and all USB devices are permitted, and the USB usage authority is “reading data of USB devices”. good.

As another example, a case where the USB device itself has a security function and the same product of the same vendor as the USB device is all implemented with this security function is illustrated. In this case, the USB usage permission information database 51 may be designated (registered) so that all USB devices equipped with this security function can be used.

In addition, it is possible to control the use of an appropriate USB device according to the usage of the terminal, the user, and the USB device, and it is possible to monitor the usage status of the USB device.

FIG. 11 is a schematic block diagram showing a basic configuration of a USB device management system in an embodiment. The USB management system according to an embodiment includes a USB usage permission information database 501, a USB usage status history database 502, a USB control unit 503, and a USB usage management device 504.

In the USB use permission information database 501, the right to use the USB device is registered in correspondence with the combination of the terminal identification information, the user personal authentication information, and the USB device information. In the USB usage status history database 502, terminal identification information, personal authentication information, USB device information, operation content, operation target, and occurrence time when a USB device is used are recorded.

When the USB device is operated on the terminal 510, the USB control unit 503 transmits the terminal identification information, the user personal authentication information, and the USB device information to the USB usage management apparatus 504. Also, the USB control unit 503 controls the USB device 515 attached to the terminal 510 according to the USB usage authority information transmitted from the USB usage management device 504.

The USB usage management device 504 collates the combination of terminal identification information, user personal authentication information, and USB device information transmitted from the USB control unit 503 with the USB usage permission information database 501. That is, the USB usage management device 504 determines whether or not the combination of the terminal identification information, the user personal authentication information, and the USB device information transmitted from the USB control unit 503 is registered in the USB usage permission information database 501. Determine. When registered, that is, when the collation is successful, the USB usage management apparatus 504 transmits the USB usage authority information registered in the USB usage permission information database 501 corresponding to the combination to the USB control unit 503. . Also, the USB usage management device 504 receives information related to the operation executed on the terminal 510 from the USB control unit 503 and registers it in the USB usage status history database 502.

Note that a program for realizing all or part of the functions of the USB device management system 1 is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into the computer system and executed. You may process each part by. Here, the “computer system” includes an OS and hardware such as peripheral devices.
Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used.
The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM or a CD-ROM, and a hard disk incorporated in a computer system. Furthermore, the “computer-readable recording medium” dynamically holds a program for a short time like a communication line when transmitting a program via a network such as the Internet or a communication line such as a telephone line. In this case, a volatile memory in a computer system serving as a server or a client in that case, and a program that holds a program for a certain period of time are also included. The program may be a program for realizing a part of the functions described above, and may be a program capable of realizing the functions described above in combination with a program already recorded in a computer system.

As described above, the embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes design changes and the like without departing from the gist of the present invention.

This application claims priority based on Japanese Patent Application No. 2017-054630 filed in Japan on March 21, 2017, the entire disclosure of which is incorporated herein.

11, 12, 13: Terminal 41: USB usage management device 51: USB usage permission information database 61: USB permission registration information database 71: USB usage

status history database

111, 121, 131: USB control unit

Claims

A USB device management system that integrates and manages USB devices mounted on a plurality of terminals,
USB in which the right to use the USB device is registered corresponding to a combination of terminal identification information for identifying the terminal, personal authentication information of the user of the terminal, and USB device information for identifying the USB device A usage permission information database;
The terminal identification information, the user's personal authentication information, and the USB device information related to operations on the USB device attached to the terminal are transmitted to the USB usage management device and received from the USB usage management device. A USB control unit for controlling the USB device attached to the terminal according to the use authority information;
The usage authority information registered in the USB usage permission information database corresponding to the combination of the terminal identification information received from the USB control unit, the personal authentication information of the user, and the USB device information. A USB usage management device that transmits to the USB controller;
USB device management system.
A USB usage history database that stores history information of the operation;
When the operation is performed, the USB control unit transmits operation information including the content of the operation, a target of the operation, and an occurrence time of the operation to the USB usage management device,
The USB usage management device stores the terminal identification information, the personal authentication information, the USB device information, and the operation information in the USB usage status history database.
The USB device management system according to claim 1.
Corresponding to the combination of the terminal identification information and the personal authentication information, a USB permission registration information database in which information on the use authority that can be set for the USB device is registered,
The USB control unit transmits request information for requesting the use authority to the USB usage management apparatus, including the terminal identification information, the personal authentication information, the USB device information, and the use authority information.
The USB usage management apparatus is configured to request the request information within a range of USB usage authority registered in the USB permission registration information database corresponding to a combination of the terminal identification information and the personal authentication information included in the request information. The USB device management system according to claim 1, wherein information that enables setting of the use authority included in the request information is registered in the USB use permission information database in the USB device information included in the USB device information.
The USB device management system according to any one of claims 1 to 3, wherein the terminal identification information is at least one of a MAC address and electronic certificate information.
The USB device management system according to any one of claims 1 to 3, wherein the personal authentication information is at least one of biometric authentication information and face authentication information.
The USB device management system according to any one of claims 1 to 3, wherein the USB device information is at least one of a serial ID, a vendor ID, and a product ID.
A USB device management method for managing USB devices attached to a plurality of terminals in an integrated manner,
The USB control unit of the terminal uses the terminal identification information for identifying the terminal, the personal authentication information of the user, and the USB device information for identifying the USB device regarding the operation on the USB device attached to the terminal. To the management device,
The USB usage management device refers to the USB usage permission information database in which the usage authority of the USB device is registered corresponding to the combination of the terminal identification information, the personal authentication information of the user, and the USB device information, The usage authority information registered in the USB usage permission information database corresponding to the combination of the terminal identification information received from the USB control unit, the personal authentication information of the user, and the USB device information. Send to the USB controller,
The USB control unit of the terminal controls the USB device attached to the terminal according to the use authority information received from the USB usage management device;
USB device management method.