JP2008084140A - Secondary storage device write prohibition system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a secondary storage device write prohibition system which installs necessary programs and updates an OS and virus pattern file while storing data stored in a file server to a secondary storage device of a terminal device, and preventing impermissible programs from being installed to a terminal. <P>SOLUTION: In an update mode, accessible data are restricted so as to prevent the restricted data from being stored to a hard disk 19. To be specific, an access to the file server or a proxy 15 is prohibited. Then, installation of application is restricted so that only an installation program stored in an installation server 13 is started, and with respect to update of the OS and virus pattern file, only a specific Web server is made accessible. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  Even if a terminal device such as a personal computer is stolen, the present invention is a technique for preventing data and personal information stored in a secondary storage device in the terminal device from being stolen. Is related to installation and program updates.

  As a countermeasure against loss or theft of a terminal device, it is becoming common to encrypt data stored in a hard disk. Furthermore, even if it is encrypted, if the personal information is lost, it will be necessary to announce the loss case, so the thin client that does not have a hard disk or the data written to the hard disk is cached in memory and the power is shut off Then, a technique has been developed in which the stored write data is erased.

  However, unless the write data is always cached in the memory and written to the hard disk, even application programs and program update data that do not interfere with theft cannot be reflected on the hard disk. Then, every time the terminal device is activated, installation work and update work of the application program are required, and memory is wasted.

  As a solution to such a problem, in the prior art, only a specific user operation is permitted by controlling a GUI (Graphical User Interface), and an operating system (hereinafter simply referred to as “OS”) is used. Updates and virus pattern file updates are possible. Further, like the invention described in Patent Document 1, there is a method using HDD encryption technology and external storage medium prevention technology.

JP-A-11-149414

  However, in the case of the invention described in Patent Document 1, it is necessary to obtain an administrator's hand when installing an application, and a new management cost is generated. Furthermore, there is a possibility that the administrator will intentionally or mistakenly store data that should not be stored in the hard disk.

  The present invention has been made to solve such problems of the prior art, and stores data stored in a file server in a secondary storage device of a terminal device or a terminal device of an unauthorized program. It is to provide a secondary storage device write prohibition system capable of installing a necessary program and updating an OS and a virus pattern file while preventing installation on a computer.

  In order to achieve the above object, an invention according to claim 1 includes a terminal device that has a secondary storage device and is operated by a user, and a file server that stores files used in the terminal device. An installation server storing an installation program, an update server storing at least one update data of an operating system, a program, and a virus pattern file, and an update server proxy accessing the update server via a network And a proxy that accesses a general Web site via the network, and the terminal device is connected to a normal mode that prohibits writing of data to the secondary storage device, and to the install server and the update server proxy. While allowing access to the Characterized by comprising an update mode for updating the update data by prohibiting access to Rusaba and proxies.

  According to a second aspect of the present invention, a terminal device that has a secondary storage device and is operated by a user, a file server that stores files used by the terminal device, and an installation program are stored. Installed server, an update server storing at least one update data of an operating system, a program, and a virus pattern file, an update server proxy for accessing the update server via a network, and via the network And a proxy that accesses a general Web site, the terminal device identifies a program that updates the update data started from the installation server, and permits writing of the program to the secondary storage device To update the update data. It is characterized in.

  Data stored in the file server can be stored in the secondary storage device of the terminal device, and installation of necessary programs can be performed while preventing unauthorized programs from being installed on the terminal device. The pattern file can be updated.

[First Embodiment]
Hereinafter, a first embodiment of a hard disk write prohibition system to which the present invention is applied will be described.
As shown in FIG. 1, the hard disk write prohibition system in this embodiment includes a terminal device 11, a file server 12, an installation server 13, an update server proxy 14, a proxy 15, and an update server 16. Here, the terminal device 11, the file server 12, the installation server 13, the update server proxy 14, and the proxy 15 are connected to each other via a LAN (Local Area Network) 17 so as to be able to transmit data to each other.

The update server proxy 14, the proxy 15, and the update server 16 are connected to the Internet 18 as a network, and a general website (not shown) is also connected to the Internet 18.
The terminal device 11 is a device used by a user. The terminal device 11 includes a hard disk 19 as a secondary storage device, a memory 20, and a CPU (Central Processing Unit), a control device, an input / output device, and the like (not shown). The hard disk 19 provided in the terminal device 11 stores an application 21, an OS 22, various data, and the like that run on the terminal device 11.

Next, the OS 22 stored in the hard disk 19 will be described in detail.
The OS 22 includes an application activation control module 23, a login control module 24, an external storage medium control module 25, a hard disk writing control module 26, and a network control module 27.

  The application activation control module 23 is OFF when the OS 22 is activated and is not activated. In the case of Windows (registered trademark), which is one of the OSs 22, the user starts an application from an explorer, a task manager, or a command prompt. The application activation control module 23 has a function of looking at the storage folder of the application program file activated by the user and canceling the activation of the application if there is no application on the installation server 13.

  The login control module 24 is executed when the user selects a login mode after user authentication. Starts and stops necessary modules depending on the login mode.

  The external storage medium control module 25 is OFF when the OS 22 is activated, and is not activated. When the external storage medium control module 25 is turned on, reading from a DVD (Digital Versatile Disk) provided in the terminal device 11 as an external storage medium (not shown) is prohibited. As a result, data stored on the DVD cannot be copied or installed on the hard disk 19.

The hard disk writing control module 26 is ON when the OS 22 is activated. The outline of the hard disk writing control module 26 is as follows.
(1) Write data to the hard disk 19 is stored in a cache memory which is a high-speed storage device provided in the CPU of the terminal device 11.
(2) As for reading from the hard disk 19, it is read out if it is stored in the cache memory, and is read from the hard disk 19 if it is not stored in the cache memory.
The hard disk 19 is a cache target of the hard disk write control module 26. The cache data of the hard disk write control module 26 is stored in the memory 20.

  The network control module 27 is OFF when the OS 22 is activated and is not activated. When the network control module 27 is turned on, the access destination server is limited to only the install server 13 and the update server proxy 14, and control is performed so that the file server 12 and the proxy 15 cannot be accessed. . On the other hand, when the network control module 27 is OFF, there is no such limitation, and reading / writing of data stored in the file server 12 and browsing of a Web server connected to the Internet 18 through the proxy 15 are possible. Is possible.

  The file server 12 stores files to be executed by the terminal device 11. The file server 12 can read and write files stored in the file server 12 when the network control module 27 is OFF, but cannot access when the network control module 27 is ON. .

  The installation server 13 stores installation program data for installation in the terminal device 11. Generally, a folder is divided for each program, and when an installation program in a necessary folder is activated, the installation program is installed in the terminal device 11.

The update server proxy 14 is set so that only the update server 16 can be accessed via the Internet 18.
The proxy 15 is a computer that can access a general Web site connected to the Internet 18 via the Internet 18. When the network control module 27 is ON, the terminal device 11 cannot access the proxy 15. That is, when the network control module 27 is ON, the terminal device 11 cannot access a general website.

  The update server 16 stores update data of programs, OS, and virus pattern files. The terminal device 11 can update the program, OS, and virus pattern file by accessing the update server 16 using a Web browser.

Next, a method for prohibiting a write operation to the hard disk 19 by the hard disk write prohibition system configured as described above will be described. The following processing is executed under the control of control means such as a CPU based on a program stored in a ROM (Read Only Memory) (not shown) of the terminal device 11.
First, as shown in FIG. 2, the user selects whether the login mode executed by the login control module 24 is the normal mode in which writing to the hard disk 19 is prohibited or the update mode (step). S1).

  Next, when the update mode is selected (step S2), the external storage medium control module 25 and the network control module 27 are switched ON, and the hard disk write control module 26 is switched OFF (step S3). When the external storage medium control module 25 is switched to ON, reading from the external storage medium is prohibited. In addition, since the network control module 27 is switched to ON, the access destination server is limited to only the install server 13 and the update server proxy 14, and access to the file server 12 and the proxy 15 becomes impossible.

  On the other hand, when the normal mode is selected in step S2, the states of the external storage medium control module 25, the network control module 27, and the hard disk write control module 26 are not switched. Then, a normal login process is executed (step S4), and writing to the hard disk 19 is prohibited in the terminal device 11.

As described above, the hard disk write prohibition system according to the first embodiment has the following effects.
When logging in to the terminal device 11 in the update mode, the network control module 27 and the external storage medium control 25 are ON, and the external storage medium, the file server 12, and the proxy 15 cannot be accessed. Therefore, it is impossible to copy a file from an external storage medium or the file server 12 to the hard disk 19 or download a file from the Web site connected to the Internet 18 to the hard disk 19. On the other hand, since the update server 16 can be accessed through the install server 13 and the update server proxy 14, the OS 22 and the virus pattern file can be updated. In other words, the user data in the file server 12 can be stored in the hard disk 19 and necessary programs can be installed while preventing unauthorized programs from being installed, and the OS, programs, and virus pattern files can be updated. it can.

[Second Embodiment]
Next, a second embodiment of the hard disk write prohibition system to which the present invention is applied will be described. Since the system configuration is the same as that of the first embodiment, only differences from the first embodiment will be described here.

In the second embodiment, the hard disk writing control module 26 is improved.
That is, if it is possible to determine which program is going to write data to the hard disk 19, it is not necessary to provide a normal mode for prohibiting data writing to the hard disk 19. That is, only the program stored in the installation server 13 should be given write permission to the hard disk 19. Moreover, it is sufficient to give write permission to the update data of the program, OS, and virus pattern file stored in the update server.

  In the present embodiment, the application activation control module 23 identifies a program activated from a file on the installation server 13 or a program for updating the OS or virus pattern file. Specifically, the application activation control module 23 identifies the process ID assigned to the program and notifies the hard disk writing control module 26 of it. The hard disk write control module 26 writes the write request from the notified program to the hard disk 19 without caching.

As described above, the hard disk write prohibition system according to the second embodiment has the following effects.
Without installing the normal mode, the user data in the file server 12 can be stored in the hard disk 19 and the installation of necessary programs can be performed while preventing the installation of unauthorized programs. Virus pattern files can be updated.

The block diagram which shows a hard-disk write prohibition system. The flowchart which shows operation | movement of a login control module.

Explanation of symbols

DESCRIPTION OF SYMBOLS 11 ... Terminal device (personal computer), 12 ... File server, 13 ... Installation server, 14 ... Update server proxy, 15 ... Proxy, 16 ... Update server, 17 ... LAN, 18 ... Internet as a network, 19 ... Secondary storage Hard disk as a device, 20 ... memory, 21 ... application, 22 ... OS (operating system).

Claims (2)

A terminal device having a secondary storage device and operated by a user;
A file server storing files used in the terminal device;
An installation server that stores the installation program; and
An update server storing update data of at least one of an operating system, a program, and a virus pattern file;
An update server proxy for accessing the update server via a network;
A proxy for accessing a general website via the network,
The terminal device
A normal mode for prohibiting the writing of data to the secondary storage device;
A secondary storage comprising: an update mode for updating the update data by prohibiting access to the file server and proxy while permitting access to the install server and update server proxy Device write protection system. A terminal device having a secondary storage device and operated by a user;
A file server storing files used in the terminal device;
An installation server that stores the installation program; and
An update server storing update data of at least one of an operating system, a program, and a virus pattern file;
An update server proxy for accessing the update server via a network;
A proxy for accessing a general website via the network,
The terminal device identifies a program for updating the update data started from the installation server, and updates the update data by permitting writing of the program to the secondary storage device. Secondary storage device write protection system.

Images