JP2022021473A - Information processing equipment, information processing device control method, information processing system and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To control access to an external storage device having a plurality of areas while achieving both security and user convenience.
An information processing device, wherein the information processing device intercepts a request to an external storage device having a first area for storing first information and a second area for reading and writing. And a control means for controlling the request intercepted by the intercepting means based on the setting information in which the content of the control executed for the external storage device is set, and the control means is the first information. The control is changed based on any one or a combination of process information, information identifying an external storage device, and a first information storage destination in the information processing device.
[Selection diagram] Fig. 1

Description

The present invention relates to an information processing apparatus, a control method for the information processing apparatus, an information processing system and a program.

External storage devices such as CDs, DVDs, and USB storage devices (hereinafter referred to as "USB memory") are widely used as storage devices for information processing devices. It is easy for the user to write or duplicate the digital data in the information processing device as a file in the external storage device. Therefore, information leakage may increase via an external storage device. Therefore, as disclosed in Patent Document 1, an information processing device that controls the use of an external recording device such as a CD is known.

In recent years, in order to prevent troubles such as virus contamination, infection, and information leakage in USB memory, USB memory equipped with security functions such as anti-virus software (hereinafter referred to as "security USB memory") has been provided. Has been done. The security USB memory includes, for example, a CD area in which an authentication application (for example, Startup.exe) is stored, and a storage area. Security When the USB memory is connected to the information processing device, the CD drive is mounted, and the authentication application stored in the CD area is started, the authentication application prompts the user to input the access authentication key. If the verification of the access authentication key is successful, the drive of the USB memory is mounted and the writing / reading to the storage area becomes possible.

Japanese Unexamined Patent Publication No. 2014-153888

However, if the information processing device is set to "prohibit use" (prohibit writing / reading) of the CD / DVD and "permit use" (permit writing / reading) of the USB memory, the CD / Since the DVD cannot be used, the security USB memory cannot be used. There is also a security USB memory that writes to the CD area when switching from the CD area to the storage area. If the setting is to "permit read only" for the CD / DVD and "permit use" for the USB memory, an error will occur because the CD / DVD cannot be switched from the CD area to the storage area, and the security USB memory may be used. Can not. Also, in consideration of security, the use of security USB is permitted, but the use of CD / DVD may be prohibited.

Therefore, an object of the present invention is to control access to an external storage device (for example, a security USB) having a plurality of areas while achieving both security and convenience.

In order to solve the above problems, the present invention has the following configurations. That is,
It is an information processing device
An intercepting means for intercepting a request to an external storage device having a first area for storing the first information and a second area for reading and writing.
A control means for controlling a request intercepted by the intercepting means is provided based on the setting information in which the content of the control executed for the external storage device is set.
The control means changes control based on any one or a combination of the process information of the first information, the information identifying the external storage device, and the storage destination of the first information in the information processing device. ..

According to the present invention, it is possible to control access to an external storage device having a plurality of areas while achieving both security and user convenience.

System configuration diagram showing a configuration example of an information processing system Hardware configuration diagram showing client terminal device 110 Hardware configuration diagram showing server device 120 The figure which shows the example of the setting information 121 The figure which shows the example of the setting information 121 Flow chart showing processing of client terminal device 110 Flow chart showing the process of step S604 Diagram showing a configuration example of the authorization process information list Flow chart showing the process of step S604 The figure which shows the configuration example of the permitted memory information list. Flow chart showing the process of step S604

Hereinafter, preferred embodiments of the present invention will be described with reference to the drawings. In addition, the embodiment described below shows an example when the present invention is concretely implemented, and is one of the specific examples of the configuration described in the claims.

[First Embodiment]
<System configuration diagram>
First, the information processing system configuration according to the present embodiment will be described with reference to the system configuration diagram of FIG. As shown in FIG. 1, the information processing system according to the present embodiment has information processing devices 110, 120, and an external storage device 130, and each information processing device is connected to a network 140 such as a LAN or the Internet. There is. Hereinafter, the information processing device 110 may be referred to as a client terminal device, and the information processing device 120 may be referred to as a server device. The number of client terminal devices 110 and server devices 120 may be plural. Further, the client terminal device 110 and the server device 120 may be any device as long as they can execute each process described later as those performed by the information processing device such as a PC / portable terminal device. Further, although the terminal device 110 is connected via the network 140, it may be standalone without the network 140. The information processing system may be configured by using a thin client (for example, a terminal service). A thin client is a computer architecture in which an information processing device (client terminal device) remotely connects to a server computer and executes an application program on the server computer using a virtual desktop environment generated on the server computer.

Further, an external storage device 130 can be connected to the client terminal device 110. The external storage device 130 may be described in, for example, Startup. It has a CD area 131 (first area) for storing application programs (first information) such as exe, and a storage area 132 (second area for reading and writing) for storing files and information. There is.

For example, the external storage device 130 is connected to the information processing device, the CD / DVD drive is mounted, and the authentication application program stored in the CD area is started. When the authentication application prompts the user to input the access authentication key and the verification of the access authentication key is successful, the drive of the USB memory is mounted and the writing / reading to the storage area becomes possible. Examples of the external storage device 130 include a USB memory, a mobile terminal, a card reader / writer, an image reader, and the like. In the information processing system according to the present invention, the external storage device 130 does not necessarily have to be one of the components, and any information processing system that can use the external storage device may be used.

<Client terminal device 110>
The hardware configuration of the client terminal device 110 according to the present embodiment will be described with reference to FIG. The client terminal device 110 and the server device 120 will be described as having the same hardware configuration. However, the hardware configuration will be described by taking the client terminal device 110 as an example. The CPU (Central Processing Unit) 11 controls the operation of the entire device by executing various processes using the computer programs and data stored in the RAM 12 and the ROM 13, and will be described later as those performed by the device. Execute each process.

The RAM (Random Access Memory) 12 stores an area for temporarily storing computer programs and data loaded from the storage device 16 and various data received from an external device via the I / F (interface) 17. It has an area for temporary storage. Further, the RAM 12 also has a work area used by the CPU 11 to execute various processes. As described above, the RAM 12 can appropriately provide various areas. The ROM (Read Only Memory) 13 stores the setting data of the present device, the boot program, and the like.

The operation unit 14 is composed of a mouse, a keyboard, or the like, and various instructions can be input to the CPU 11 by being operated by the operator of the present apparatus. The display unit 15 is composed of a CRT, a liquid crystal screen, an OLED, or the like, and can display the processing result by the CPU 11 with an image, characters, or the like.

The storage device 16 is a large-capacity information storage device typified by a hard disk drive device. The storage device 16 stores an OS (operating system) and computer programs and data for causing the CPU 11 to execute each process described later as performed by the device. This computer program includes security software 111. The security software 111 is a program for security management that ensures the safety of data, programs, and the like of the client terminal device 110, and has, for example, a function of limiting the connection of the device according to the setting of whether or not the device can be connected. .. The computer programs and data stored in the storage device 16 are appropriately loaded into the RAM 12 according to the control by the CPU 11, and are processed by the CPU 11.

The I / F17 is composed of various interfaces. It includes a network interface for connecting to the network 140 and a device interface for connecting the external storage device 130. Each of the above parts is connected to the bus 18.

<Server device 120>
As shown in FIG. 3, it is assumed that the hardware configuration of the server device is the same as the hardware configuration of the client terminal device 110 described above. In FIG. 3, the same member as the member shown in FIG. 2 will not be described in detail. That is, the CPU 31 of the server device 120 uses the computer programs and data stored in the storage device 36 of the server device 120 to perform data communication with an external device via the I / F 37 of the server device 120, and also performs data communication with the server. Each process described later is executed as what the device performs. Further, the setting information 121 is registered in the storage device 36 of the server device 120.

In the setting information 121, the content of the control executed for the external storage device (USB memory, CD / DVD, etc.) is set. 4 and 5 are diagrams showing an example of the setting information 121. Specifically, as shown in FIG. 4, the target device name (USB memory, CD / DVD, etc.) and the control method (permission, read-only permission, write-protection, prohibition, etc.) that can be used by the client terminal device 110 are registered. ing. For example, in the setting information 121 of the client terminal device 110, the USB memory is registered as "use permission" and the CD / DVD is registered as "read only permission". Further, the setting information 121 may be identification information of the USB memory to be permitted (information indicating the USB memory to which access is permitted when access is permitted by the target USB memory). As shown in FIG. 5, this information may be information such as a vendor ID, a product ID, a serial number, etc. that can individually identify the USB memory, or information such as permitting the entire USB memory. Further, the setting information 121 may be identification information of a USB memory to be prohibited (information indicating a USB memory for which access is prohibited when access is prohibited by the target USB memory).

Instead of collectively managing the setting information 121 in the client terminal device 110 by the storage device 16 of the server device 120, each client terminal device 110 may hold its own setting information 121. .. However, in such a case, the server device 120 is not essential. The setting information 121 in FIGS. 4 and 5 is an example, and a user name, a terminal name, or the like may be registered.

<Processing of client terminal device>
Next, the security software 111 stored in the storage device 16 of the client terminal device 110 will be described with reference to FIG. Here, an external storage device 130 (for example, a security USB memory) having a CD area 131 in which an application program (for example, Startup.exe) is stored and a storage area 132 will be described as an example. Further, as shown in FIG. 4, the setting information 121 will be described assuming that the USB memory is registered as "use permission" and the CD / DVD is registered as "read only permission".

The security software 111 is software for changing the control method to the external storage device connected to the own device (here, the client terminal device 110) and controlling the access to the external storage device. The procedure of FIG. 6 will be described assuming that each client terminal device 110 holds its own setting information 121. Further, in the present embodiment, in the client terminal 110, for example, a Windows (registered trademark) operating system (OS) is executed, and the program is executed under the control thereof. Not limited to Windows, operating systems such as MacOS and Linux (registered trademark) may be used.

The CPU 11 loads the security software 111 from the storage device 16 into the RAM 12, and activates the loaded security software 111. The security software 111 may be automatically started as a service program, or may be arbitrarily started in response to an operation instruction from the user. The CPU 11 loads the file system filter driver of the security software 111 according to the security software 111, and monitors the file system of the client terminal device 110. The file system filter driver is a program located on the file system driver and in the layer below the system call API, and can monitor the processing of all file systems. At this time, the security software 111 transmits the setting information 121 to the loaded file system filter driver.

When the USB memory is inserted, the file system is created. Therefore, in S601, the CPU 11 detects the created file system according to the security software 111, and the I / O Request Packet of the file system (hereinafter, "IRP"). ") Is monitored. For example, the file system filter driver intercepts IRPs such as IRP_MJ_WRITE and IRP_MJ_SET_INFOMATION.

In S602, the CPU 11 determines whether or not the target device is a CD / DVD from the intercepted IRP according to the security software 111.

When it is determined that the target device is not a CD / DVD (NO in S602), in S603, the CPU 11 controls the target device (use permission / use prohibition (write) based on the setting information 121 according to the security software 111. -Reading prohibited) -Reading only allowed). For example, in the setting information 121 as shown in FIG. 4, since the USB memory is "usable", the file system filter driver returns STATUS_SUCCESS to the driver of the USB memory so that it can be used. Further, the determination may be made based on the identification information (device name, vendor ID, product ID, serial number, etc.) of the USB memory passed in S601 and the setting information as shown in FIG.

When it is determined that the target device is a CD / DVD (YES in S602), the CPU 11 proceeds to S604 according to the security software 111.

Although the filter driver technology is used here as the filtering method, another method such as an API hook may be adopted. The API hook means to monitor the API request and replace the API request with another content. Further, the control process may be performed using the device manager. For example, an API called RegisterDeviceNotification is used to monitor the device manager. The device manager is one of the utility programs included in Windows OS, and can manage the hardware that composes the computer. The contents of management include a list of devices connected to the computer, confirmation of normal operation, and switching between valid and invalid devices.

<Process 1 in step S604>
The details of the process in step S604 will be described with reference to FIG. 7 showing a flowchart of the process. Here, it is assumed that the permission process information list indicating the process for which use is permitted is transmitted from the server device 120 to the client terminal device 110 and stored as the setting information 121, as shown in FIG. The process name is an example, and may be a process ID, a hash value, the presence or absence of a digital signature of the process, the name of the manufacturing company of the process, or the like.

In S701, the CPU 11 acquires process information that identifies the started process according to the security software 111. Specifically, the application program name (process name) stored in the started CD area is acquired. It should be noted that what is acquired is not limited to the process name, but may be a process ID, a hash value, the presence or absence of a digital signature of the process, the name of the manufacturing company of the process, and the like.

In S702, the CPU 11 compares the process information acquired in S701 with the permitted process information list according to the security software 111, and determines whether or not the process is a licensed process.

When it is determined that the process is a usage permission process (YES in S702), the CPU 11 changes the usage permission (writing / reading permission) to control according to the security software 111 (S703). That is, in the setting information 121 shown in FIG. 4, the CD / DVD is "only read permitted", but if it is determined that the process is a permission process, "writing" to the CD / DVD is also possible. At this time, the setting information 121 may be temporarily changed from "read only permission" to "use permission" and restored after the process is completed.

If it is determined that the process is not a license process (NO in S702), the process is terminated and the process proceeds to S603 to perform control based on the setting information 121.

When using a USB memory having a plurality of areas (for example, CD area 131 and storage area 132), when switching between areas (CD area 131 to storage area 132), the client terminal device 110 makes a request similar to a write request. May be performed for the CD area 131. When the CD / DVD is "read only permitted" as in the setting information 121 shown in FIG. 4, an error occurs because the area cannot be switched, and the USB memory having a plurality of areas cannot be used. However, as described above, if it is determined that the process is a permission process, it is possible to write to the USB memory having a plurality of areas, and it is possible to use the USB memory having a plurality of areas.

Further, when the authentication application program stored in the CD area is started, the user is requested to input the access authentication key, and the access authentication key is collated, the client terminal device 110 makes a request similar to the write request in the CD area. May be done for. When the CD / DVD is "read only permitted" as in the setting information 121 shown in FIG. 4, an error occurs because the access authentication key cannot be collated, and the USB memory having a plurality of areas cannot be used. However, as described above, if it is determined that the process is a permission process, it is possible to write to the USB memory having a plurality of areas, and it is possible to use the USB memory having a plurality of areas.

Further, a USB memory having a plurality of areas has a different application (process) for each memory in the CD area. As described above, by changing the control method according to the process, it is possible to perform different control for each USB memory having a plurality of areas.

<Process 2 in step S604>
The details of another process in step S604 will be described with reference to FIG. 9 showing a flowchart of the process. Here, as shown in FIG. 10, a permission memory information list (usage permission company name, vendor ID, product ID, etc.) indicating the memory for which access is permitted is transmitted from the server device 120 to the client terminal device 110, and the setting information 121. Described as being stored as. The permitted memory information list is an example, and is not limited to this as long as it is information that identifies an external storage device.

In S901, the CPU 11 identifies the CD / DVD mounted by the USB memory having a plurality of areas inserted in the client terminal device 110 according to the security software 111 (manufacturing company name, vendor ID, product ID). Etc.) to get.

In S902, the CPU 11 compares the memory information acquired in S901 with the permitted memory information list according to the security software 111, and determines whether or not the memory is a licensed memory.

When it is determined that the memory is a use permission memory (YES in S902), the CPU 11 changes to use permission (write / read permission) and controls according to the security software 111 (S903). That is, in the setting information 121 shown in FIG. 4, the CD / DVD is "only read permitted", but if it is determined that the memory is a licensed use memory, "writing" to the CD / DVD is also possible. At this time, the setting information 121 may be temporarily changed from "read only permission" to "use permission", and the external storage device 130 may be removed from the client terminal device 110 and then restored.

When it is determined that the memory is not a licensed memory (NO in S902), the process is terminated and the process proceeds to S603 to perform control based on the setting information 121.

When the CD / DVD is "read only permitted" as in the setting information 121 shown in FIG. 4, an error occurs because the area cannot be switched, and the USB memory having a plurality of areas cannot be used. However, as described above, if it is determined that the memory is licensed, it is possible to write to the USB memory having a plurality of areas, and it is possible to use the USB memory having a plurality of areas.

Further, as in the setting information 121 shown in FIG. 4, when the CD / DVD is "read only permitted", the access authentication key cannot be collated and an error occurs, and the USB memory having a plurality of areas cannot be used. .. However, as described above, if it is determined that the memory is licensed, it is possible to write to the USB memory having a plurality of areas, and it is possible to use the USB memory having a plurality of areas.

In addition, as described above, by changing the control method according to the licensed memory information (company name, vendor ID, product ID, etc.), the application stored in the USB memory having multiple areas can be upgraded. Even if it does, control can be performed.

<Process 3 in step S604>
The details of another process in step S604 will be described with reference to FIG. 11 showing a flowchart of the process.

In S1101, the CPU 11 acquires information indicating a save destination in which the started program (application program stored in the started CD area) is saved according to the security software 111. That is, the information indicating the storage destination in the client terminal device 110 is acquired.

In S1102, the CPU 11 determines whether or not the storage destination indicated by the information acquired in S1101 is in the CD / DVD drive according to the security software 111.

When the save destination is in the CD / DVD drive (YES in S1102), the CPU 11 changes to use permission (write / read permission) and controls according to the security software 111 (S1103). That is, in the setting information 121 shown in FIG. 4, the CD / DVD is "read only permitted", but if it is determined that the save destination is in the CD / DVD drive, "writing" to the CD / DVD is also possible. It becomes. At this time, the setting information 121 may be temporarily changed from "read only permission" to "use permission" and restored after the process is completed.

When the program not stored in the CD / DVD drive is started (NO in S1102), the process is completed and the process proceeds to S603 to perform control based on the setting information 121. Alternatively, if the program stored outside the CD / DVD drive is started, it may be changed to the use prohibited (write / read prohibited) state because there is a possibility of a virus or the like.

As described above, by changing the control method according to the save destination of the process, general-purpose control can be performed without managing the process name, vendor ID, and the like.

As described above, according to the present embodiment, since the control is changed based on the process information, the memory information, or the storage destination of the process, it is possible to perform the control while achieving both security and convenience.

Further, the process of changing the use regardless of the setting information is not limited to the above-mentioned specific example. Controls may be changed based on any or a combination of process information, memory information, or process destinations. For example, it may be a combination of "if it matches the permission process name list and matches the permission memory information, change to permission".

Further, in the present embodiment, the list is described as a list of permission targets (permission process information list, permission memory information list), but the list may be a list of prohibition targets.

Further, in the present embodiment, the setting information 121 is described as assuming that the USB memory is registered as "use permission" and the CD / DVD is registered as "read only permission", but the USB memory is "use permission" and the CD. / DVD can control access to a USB memory having a plurality of areas even when it is registered as "use prohibited" (write prohibited / read prohibited).

Further, in the present embodiment, in S602 of FIG. 6, a process of determining whether or not the target device is a CD / DVD is performed from the intercepted IRP. However, the processing of S602 may be omitted by filtering the IRP for the CD area and the IRP for the storage area, respectively. In that case, if "NO" is determined in S702 of FIG. 7, S902 of FIG. 9, and S1102 of FIG. 11, control may be performed based on the setting information 121 shown in S603.

<Other embodiments>
The present invention supplies a program that realizes one or more functions of the above-described embodiment to a system or device via a network or storage medium, and one or more processors in the computer of the system or device reads and executes the program. It can also be realized by the processing to be performed. It can also be realized by a circuit (for example, ASIC) that realizes one or more functions.

Claims (9)

It is an information processing device
An intercepting means for intercepting a request to an external storage device having a first area for storing the first information and a second area for reading and writing.
A control means for controlling a request intercepted by the intercepting means is provided based on the setting information in which the content of the control executed for the external storage device is set.
The control means changes control based on any one or a combination of the process information of the first information, the information identifying the external storage device, and the storage destination of the first information in the information processing device. An information processing device characterized by this. The information processing apparatus according to claim 1, wherein the process information is any or a combination of a process name, a process ID, a process hash value, and a process digital signature. The information processing device according to claim 1 or 2, wherein the information for identifying the external storage device is any one or a combination of a manufacturing company name, a vendor ID, a product ID, and a serial number. The information processing apparatus according to any one of claims 1 to 3, wherein the storage destination of the first information is a CD drive or a DVD drive. The information processing apparatus according to any one of claims 1 to 4, wherein the first area is mounted as a CD drive or a DVD drive, and the second area is mounted as a USB drive. Even if the setting information is registered as read-only permission for the first area,
The control means writes to the first area based on any or a combination of the process information of the first information, the information identifying the external storage device, and the storage destination of the first information. The information processing apparatus according to any one of claims 1 to 5, wherein the information processing apparatus is permitted. It is a control method for information processing equipment.
An intercepting step of intercepting a request to an external storage device having a first area for storing the first information and a second area that can be read and written.
It is provided with a control process for controlling the request intercepted in the intercept process based on the setting information in which the content of the control executed for the external storage device is set.
The control step changes control based on any or a combination of the process information of the first information, the information identifying the external storage device, and the storage destination of the first information in the information processing device. A control method for an information processing device, which is characterized in that. The information processing apparatus according to any one of claims 1 to 6, and the information processing apparatus.
An information processing system including a server device that transmits the setting information to the information processing device via a network. A program for making a computer function as each means of the information processing apparatus according to any one of claims 1 to 6.

Images