JP2012234513A - Log collection system of external storage device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a log collection system of an external storage device capable of surely acquiring log data and preventing the log data from being altered, deleted, and leaked so as to perform appropriate management of information and increase security.SOLUTION: An external storage device includes a USB interface, and a storage unit for storing data. An information processing device includes a control unit for controlling access to the storage unit. The storage unit of the external storage device is configured with a user area for storing data files and a read-only memory, and includes a plurality of areas including a management area for storing a control program for checking password information and collecting log data on the basis of input information. When the external storage device is connected to the information processing device through the USB interface, the control unit of the information processing device enables access to the user area according to a checking result and collects logs of user operation.

Description

  The present invention relates to a log collection system for an external storage device having a log data acquisition function.

  In recent years, small external storage devices with a large data capacity such as a USB flash memory have been widely used as storage media for storing data. When a small external storage device is used, it is easy to take out data. Therefore, it is necessary to manage the taking out of such data. In particular, management of data handling is particularly important when the data is confidential information.

  As a method of managing the handling of data stored in the external storage device, the user is limited by ID and password, the access to the terminal device is managed, and the operation history is collected as a log file. There is a known method for managing the actual usage by checking the above. In addition, the password authentication program stored in the external storage device is automatically activated on the personal computer by the AUTHORUN file, and after authenticating the password, the log data describing the password authentication result and the access contents to the external storage device Is stored as a part of the password authentication program code as a usage history (see, for example, Patent Document 1).

JP 2009-199215 A

  As described above, collecting the log data of the external storage device makes the status of access to the external storage device clear, but it is difficult to appropriately manage information when the log data is altered or deleted. It will be something.

  In Patent Document 1, it is difficult to delete or falsify log data by automatically storing log data as part of a password authentication program without automatically storing the log data in the log file using the AUTORUN file. However, the AUTORUN file functions only on a specific operating system, has no versatility, and has no design freedom. In addition, there is a high possibility that the function of the AUTORUN file is restricted or invalidated by the user's malicious intention. In such a case, the password authentication program is not automatically executed, and log collection cannot be automatically executed. Furthermore, if the user maliciously deletes the AUTHORUN file and the password authentication program, the password authentication program will not be executed from the next time, and the file can be accessed without leaving a log.

  Therefore, an object of the present invention is to collect log data of an external storage device that can reliably acquire log data, prevent falsification, deletion, and leakage of log data, and can appropriately manage information and improve security. Is to provide a system.

  That is, the present invention is an external storage device log collection system including an external storage device and an information processing device, and the external storage device includes a USB interface and a storage unit for storing data, and the information processing device Includes a control unit that controls access to the storage unit, and the storage unit of the external storage device includes a user area that stores a data file and a read-only memory. And a control area for storing a control program for collecting log data. The control unit of the information processing apparatus is configured such that the external storage device is connected to the information processing apparatus via the USB interface. In this case, it is possible to access the user area according to the result of the collation and collect user operation logs. Providing logging system of the external storage device to.

  Here, the storage unit further includes a secret area that cannot be accessed even when the input information matches the password information, and the log data is stored in the secret area. It is preferable.

  The present invention also provides an external storage device used in the log collection system for the external storage device described above.

  According to the log collection system of the external storage device according to the present invention, the external storage device is connected to the information processing apparatus via the USB interface even if the authentication program and the log collection software are not installed in the information processing apparatus in advance. Thus, the control unit of the information processing apparatus reads the control program from the management area of the external storage device, and automatically performs verification of passwords input from the user and collection of log data based on the control program. Logs can be reliably collected even when employees of the company use the external storage device connected to an external information processing device such as an outside office, business partner, home or Internet cafe, and management is ensured. It can be carried out. Moreover, in order to access the user area where the data file is stored, password authentication is required, and further log collection of user operations is forcibly performed, so of course leakage of data stored in the external storage device, Tampering can be suppressed and security can be improved.

  In addition, the storage unit of the external storage device further includes a secret area that cannot be accessed even when the input information matches the password information, and the log data is stored in the secret area. Data browsing, deletion, tampering, etc. cannot be performed, and data can be managed safely.

It is a figure which shows the example of the external storage device in the log collection system A of the external storage device which is embodiment of this invention. An example in which a USB memory device 50, which is an example of an external storage device, transmits and receives data to and from the information processing device 200 via a connector 2 is shown. It is a functional block diagram which shows the structure of the log collection system A of an external storage device. It is explanatory drawing which shows the internal area | region of the memory | storage part of a USB memory device. It is a flowchart which shows the operation | movement process of the log collection system A of an external storage device.

  The present invention will be described in more detail with reference to the accompanying drawings.

<Overall configuration of external storage device>
A log collection system for an external storage device of the present invention includes an external storage device and an information processing device. Examples of the external storage device include a USB flash memory (hereinafter referred to as “USB memory device”), a hard disk drive (HDD), a magneto-optical disk (MO) drive, and an optical disk (CD, DVD, Blu-ray Disk) drive. A flash memory drive (SSD), a memory card (SD memory card) drive, or the like can be used. In this embodiment, an example in which a USB memory device is used as an external storage device is shown. The USB memory device is a recording medium that can be connected to the USB terminal of the information processing device. FIG. 1 is a diagram illustrating an example of an external storage device in a log collection system A of an external storage device according to an embodiment of the present invention. FIG. 2 shows an example in which a USB memory device 50, which is an example of an external storage device, transmits and receives data to and from the information processing device 200 via the connector 2. FIG. 3 is a functional block diagram showing the configuration of the log collection system A of the external storage device. The USB memory device 50 has a shape in which a connector 2 corresponding to a USB interface protrudes from the housing 1 to the outside, and can be connected to the USB terminal 260 of the information processing device 200. The information processing apparatus 200 has a USB terminal 260 for connecting the USB memory device 50. As shown in FIG. 2, by inserting the connector 2 into the USB terminal 260 of the information processing device 200, the information processing device 200 writes data to the USB memory device 50, and the data stored in the USB memory device 50 can be stored. The information processing apparatus 200 can read the information.

  The information processing apparatus 200 is, for example, a stationary personal computer, a notebook personal computer, a mobile phone, a PDA (Personal Digital Assistant), a digital camera, a small digital video camera, a game machine, other mobile terminals, a company or a hospital This includes computer equipment, car navigation, etc.

  As shown in FIG. 3, the information processing apparatus 200 has a general computer configuration in which a storage unit 210, an input unit 220, a control unit 230, a communication unit 240, and a display unit 250 are connected to a bus line. The storage unit 210 is configured by a storage device such as a semiconductor memory, for example, and executes programs and programs executed by the control unit 230 such as information input from the input unit 220, OS, device drivers, and application programs. Various information such as necessary information is stored. The application program stored in the storage unit is executed to realize various functions.

  The input unit 220 accepts various instructions by the user's operation and input of data such as characters and numbers. The control unit 230 is constituted by, for example, a CPU, determines the operation of the entire information processing apparatus 200 by executing a program stored in the storage unit 210, gives a command to the entire information processing apparatus 200, and further displays the display unit. A display instruction is issued to 250.

  The communication unit 240 transmits / receives various data to / from the USB memory device 50 and other external devices. In addition to the USB terminal 260, the information processing apparatus 200 has an interface for connecting to a network such as a LAN or the Internet (not shown) or a public telephone line. The display unit 250 displays an instruction menu and information for the user.

  The USB memory device 50 includes a connector 2, which is a USB interface, a controller 10, and a storage unit 20, and these are connected by a bus.

  The controller 10 is constituted by, for example, a CPU, and determines the operation of the entire USB memory device 50 by executing a program stored in the storage unit 20, and gives a command to the entire USB memory device 50.

  The storage unit 20 is configured by a flash memory in the USB memory device 50 of this example, and is input from the program executed by the controller 10, information necessary for executing the program, and the input unit 220 of the information processing device 200. Various types of information such as information related to user identification information are stored. FIG. 4 is an explanatory diagram showing an internal area of the storage unit 20 of the USB memory device 50. The storage unit 20 includes a user area 21, a management area 22, and a secret area 23. The user area 21 includes a data file storage unit 24, the management area 22 includes a program storage unit 25, and the secret area 23 includes an authentication data storage unit 26 and a log data storage unit 27. The storage unit 20 includes a RAM (not shown), and the RAM temporarily holds data generated by the controller 10.

  The user area 21 is an area that can be accessed only when the user authentication is successful. The user area 21 stores data given from the information processing apparatus 200 or data generated by the controller 10 in a nonvolatile manner. The data file storage unit 24 in the user area 21 stores information for managing data files and directories.

  The management area 22 is an area that is read first when the USB memory device 50 is activated, and is an area that stores information for activating the driver of the USB memory device 50. This is an area that can be viewed on the OS of the information processing device 200 by connecting the USB memory device 50 to the information processing device 200. The program storage unit 25 in the management area 22 includes at least a control program for operating the USB memory device 50 and other programs, and data input in advance as a setting value for causing the USB memory device 50 to perform an operation specific to the USB memory device 50. keeping.

  The secret area 23 is an area that cannot be viewed unless a dedicated program is used. Even after the user authentication is successful, the secret area 23 is not notified from the USB memory device 50 to the information processing device 200, and cannot be accessed from the information processing device 200. It is an area. The authentication data storage unit 26 in the secret area 23 stores data necessary for user authentication. The log data storage unit 27 in the secret area 23 stores the log data collected by the controller 10. The secret area 23 may have a plurality of log data storage units 27 by storing the log data in a plurality of areas in the secret area 23. By storing the log data in the secret area 23 that cannot be accessed even when the input information and the password information match, it is not possible to easily perform actions such as viewing, deleting, and falsifying the log data, Data can be managed safely.

<Operation processing of USB memory device>
Next, an operation process of the USB memory device 50 according to the present embodiment when the USB memory device 50 is connected to the information processing device 200 will be described.

  The external storage device log collection system A includes an external storage device 50 and an information processing device 200. When the USB memory device 50 is connected to the information processing device 200 via the connector 2, the control unit 230 of the information processing device 200 moves to the user area 21 based on the result of matching based on the control program of the USB memory device 50. And collect user operation logs. That is, the control program includes a series of programs for performing both user authentication and log collection. The timing of starting log collection is not particularly limited. In the following description, an example of starting log collection at the same time as user authentication is started will be described. However, for example, log collection may be performed after user authentication is performed and access is permitted. You can do it. The information processing apparatus 200 includes a user authentication function for performing user authentication based on the control program read from the external storage device 50 as described above, and can set a password and change a password. When the input information related to the user identification information input from the input unit 220 matches the identification information input in advance and stored in the storage unit 20 of the USB memory device 50, the control unit 230 performs information processing. It is possible to access the user area 21 from the device 200. The control unit 230 of the information processing apparatus 200 stores data input from the information processing apparatus 200 via the USB terminal 260 and the connector 2 of the information processing apparatus 200 in the storage unit 20 described later. Also, the data stored in the storage unit 20 is read out and output to the information processing apparatus 200 via the connector 2 and the USB terminal 260 of the information processing apparatus 200.

  Furthermore, the information processing apparatus 200 has a log information collection function for collecting logs based on the control program read from the external storage device 50 as described above. Specifically, for example, when the above-described user authentication is started The access status between the information processing device 200 and the USB memory device 50 is monitored, and user operation logs are collected and stored in the storage unit 20 of the USB memory device 50.

  FIG. 5 is a flowchart showing an operation process of the log collection system A of the external storage device. When the connector 2 of the USB memory device 50 is inserted into the USB terminal 260 of the information processing device 200, the process proceeds to step S1. In step S1, the control unit 230 of the information processing device 200 recognizes the connection to the information processing device 200 of the USB memory device 50, and proceeds to step S2. When it is recognized that the USB memory device 50 is connected to the information processing device 200, the management area 22 of the storage unit 20 can be accessed read-only. In step S <b> 2, the information processing apparatus 200 reads the control program stored in the USB memory device 50.

  In step S3, the control program stored in the management area 22 of the storage unit 20 is activated. The activation of the control program may be executed after receiving a user instruction, or automatically when the control unit 230 of the information processing device 200 recognizes the connection to the information processing device 200 of the USB memory device 50. You may make it perform to. Then, a dialog for inputting the password is displayed on the display of the information processing apparatus 200, and log data collection is started. The collected log data is stored in the log data storage unit 27 of the secret area 23 that is an area that can be accessed only by using a specific program. Log data to be stored includes, for example, execution date / time, host name, input password, whether authentication is possible, creation of files and folders for the user area 21, rename, deletion, reading, writing, and movement of files and folders. Such information is collected.

  In step S4, when a password is input to the dialog displayed on the display of the information processing apparatus 200, the password input to the dialog is authenticated according to the control program.

  In step S <b> 5, the control unit 230 of the information processing device 200 receives the input information related to the user identification information input from the input unit 220 of the information processing device 200 and the identification information input in advance in the authentication data storage unit 26. , It is determined whether or not they match. Determine whether password authentication was successful. If it is determined in step S5 that the process has not been successful, the process returns to step S4. If it is determined that the process has been successful, the process proceeds to step S6.

  In step S <b> 6, the control unit 230 of the information processing device 200 permits access from the information processing device 200 to the user area 21 of the storage unit 20. As a result, data received from the information processing device 200 via the USB terminal 260 and the connector 2 of the information processing device 200 is stored in the data file storage unit 24 of the user area 21 or the data file storage unit 24 of the user area 21. Can be read out and transmitted to the information processing apparatus 200 via the connector 2 and the USB terminal 260 of the information processing apparatus 200.

  In step S <b> 7, the control unit 230 of the information processing device 200 determines whether the user area 21 has been accessed. Specifically, it is determined whether or not data writing, data reading, data deletion, or the like has been performed on a file or folder stored in the data file storage unit 24 of the user area 21. If it is determined in step S7 that the user area 21 has been accessed, the process proceeds to step S8. If it is determined that the user area 21 has not been accessed, the process returns to step S7.

  In step S <b> 8, the contents accessed to the user area 21 are recorded in the log data storage unit 27 of the secret area 23. Therefore, whenever access to the user area 21 is permitted, access monitoring is always executed.

  In step S <b> 9, the control unit 230 of the information processing device 200 determines whether or not the connector 2 of the USB memory device 50 is removed from the USB terminal 260 of the information processing device 200. If it is determined in step S9 that it has not been removed, the process proceeds to step S7, and if it is determined that it has been removed, this process ends. When the USB memory device 50 is removed, the removal is also recognized by the control unit 230 of the information processing device 200.

  According to the present embodiment, password authentication is required to access the user area in which the data file is stored, and user operation logs are automatically collected, so data stored in the external storage device is stored. Leakage and tampering can be suppressed, and security can be improved. In addition, log data is stored in a secret area of an external storage device that cannot be accessed even if the input information and password information match, so that actions such as viewing, deleting, and falsifying log data can be easily performed. Data can be managed safely.

<Modification>
As mentioned above, although embodiment of this invention was described, this invention is not limited to the thing of the content demonstrated above. For example, the log data may be encrypted by a known encryption method and stored in the log data storage unit. As a result, security in log data management can be improved. In this case, the encryption key is stored in the secret area.

  In addition, when the remaining capacity that can store log data in the concealed area is less than a predetermined amount, the log data can be stored by overwriting new log data in the oldest order of the stored log data. Good. Further, when the remaining capacity capable of storing the log data becomes a predetermined amount or less, access to the user area may be prohibited, or a predetermined number of old log data may be deleted. This makes it possible to efficiently store log data having a large capacity.

  In addition, log data may be transmitted to an external device such as a server via the information processing device in a state where the external storage device is connected to the information processing device.

  Note that the configurations described in the above embodiments and modifications may be replaced as appropriate as long as no contradiction arises. These modifications can also achieve the same effects as in the above embodiment.

A log collection system 1 housing 2 connector 10 controller 20 storage unit 21 user area 22 management area 23 secret area 27 log data storage unit 50 USB memory device 200 information processing device 230 control unit

Claims (3)

An external storage device log collection system comprising an external storage device and an information processing device,
The external storage device is
A USB interface;
A storage unit for storing data;
With
The information processing apparatus includes:
A control unit for controlling access to the storage unit;
The storage unit of the external storage device is
A user area for storing data files;
A management area configured with a read-only memory and storing a control program for collecting password data and log data verification based on input information;
A plurality of regions including
The control unit of the information processing apparatus
When the external storage device is connected to the information processing device via the USB interface, the user area can be accessed based on the result of the collation, and a log of user operations is collected. External storage device log collection system.   The storage unit of the external storage device further includes a secret area that cannot be accessed even when the input information matches the password information, and the log data is stored in the secret area. Item 2. The log collection system for the external storage device according to Item 1.   An external storage device used in the log collection system for an external storage device according to claim 1 or 2.

Images