JP5054181B2 - Simple medium use management system, computer, simple medium use management program, and simple medium use program - Google Patents

Description

  The present invention relates to a use management system for a portable nonvolatile data storage device (hereinafter referred to as a simple medium) that can be attached to and detached from a computer. In particular, the present invention manages a simple medium that can be used in a computer having a simple medium mounting unit such as a memory card or a removable disk, and a simple medium use management system for preventing information leakage through the simple medium. The present invention relates to a computer including a mounting unit and a program for causing a computer to manage or use a simple medium.

  In order to prevent information leakage from computers, there is a technology that restricts reading and writing of simple media. For example, as shown in Patent Document 1, in a media drive connected to a computer, authentication information stored in a predetermined area on a removable medium attached to the media drive and a detachable tamper-resistant attached separately. There is known a security system that performs authentication using authentication information stored in a storage medium (hard key) and permits access to the removable medium only when the authentication is successful.

JP 2002-15511 A

  For example, information leakage easily occurs when a simple medium is loaded on a computer (client) that constitutes a computer system such as a company, information in the system is copied to the simple medium, and the simple medium is taken out to the outside. . Even if there is no intention of information leakage, information leakage may occur as a result of loss of a simple medium. In recent years, since the storage capacity of simple media has increased, the damage caused by information leakage is large, and prevention of information leakage is important for security measures.

  In order to prevent information leakage through such a simple medium, it is not realistic to completely prohibit the use of the simple medium. Therefore, it is necessary to grasp the usage status of the simple medium such as what kind of simple medium is attached to which client and read / write information, and manage the information so that the information is not copied to an inappropriate simple medium.

  For example, it is necessary to limit the simple media that can be used in the computer system so that a personal memory card that cannot be grasped by the administrator is inserted into the client and information is not copied. Also, it is necessary to limit the security level of the simple medium that permits copying of information so that a third party cannot easily retrieve the information even if the simple medium is lost.

  Furthermore, the management of simple media must be performed in consideration of the contents of work mainly executed by each client constituting the computer system and the contents of information to be processed.

  In the technique of Patent Literature 1, access authentication to a memory device mounted on a media drive of a computer is performed using authentication information stored in another storage medium (hard key) detachable from the computer. Then, a hard key corresponding to the authentication information is distributed to the user, and when one memory device is shared by a plurality of users, the hard key is distributed for each user.

  However, in the technique of Patent Document 1, it is necessary to manage hard key distribution in order to handle authentication information stored in a physical storage medium that is detachable from a computer as a hard key, which increases the burden on the administrator. become.

  In addition, since users with hard keys can read and write data to removable media on any computer that can be equipped with the corresponding removable media, there are restrictions on simple media that can be taken outside. Cannot be managed or managed.

  Furthermore, it is difficult to realize the use management of the simple medium, such as restricting the use of the simple medium according to the individual security policy set for each section in the company.

  An object of the present invention is to restrict the use of a simple medium (for example, a personal simple medium) that is not permitted to be used from the outside in a client of a computer system, and only a simple medium whose use permission has been confirmed in advance. A simple medium usage management system that can be used to prevent information leakage, a computer including a simple medium mounting unit, a method executed in the system, and a management server for managing the computer using the simple medium, or It is to provide a program for functioning as the client.

In order to take security measures for a computer system , the present invention comprises a management server and a client having a simple medium mounting portion which is a removable portable data storage medium, and manages the use of the simple medium of the client. a simple medium use management system, the management server 1) client attributes or use permission simple medium information is name simple medium which is a manufacturer name or model number identifies the type of simple media to allow the use Use permission simple medium information transmission means for transmitting to the client, the client 1) use permission simple medium information storage means for storing use permission simple medium information received from the management server, and 2) attachment to the attachment portion. from the simple medium, which is, also attributes of simple medium which is a manufacturer name or model number to identify the type of pre-Symbol simple media A simple medium information collecting means for collecting simple medium information is Name, 3) the use permission simple medium information simple storage means with reference to a manufacturer name or model number identifies the type of the simple medium of the simple medium information The information that is the attribute or name of the medium is searched, and the useable simple medium information includes information that is the attribute or name of the simple medium that is the manufacturer name or model number that identifies the type of the simple medium of the simple medium information. A simple medium collating means for permitting a write process, a read process, or a read / write process on the simple medium.

  As a result, data stored in the client cannot be copied to the simple medium unless the simple medium attached to the client is of a type that is permitted for use by the management server. Can be prevented.

Further, the present invention is a computer having a simple medium mounting portion which is a removable portable data storage medium. In order to take security measures for the computer, 1) the kind of simple medium permitted to be used is selected. and use permission simple medium information memory means for storing attributes or use permission simple medium information is name simple medium which is a manufacturer name or model number for identifying, 2) from the simple medium which is mounted to the mounting portion, prior Symbol simple medium a simple medium information collecting means for collecting simple medium information is an attribute or name simple medium which is a manufacturer name or model number identifies the type, 3) the use permission simple medium information by referring to the simplified medium storage means searching information is an attribute or the name of a simple medium which is a manufacturer name or model number identifies the type of the simple medium of information, the simple to the use permission simple medium information Simple information that permits write processing, read processing, or read / write processing to the simple medium when the information that is the attribute or name of the simple medium that is the manufacturer name or model number that identifies the type of the simple medium of the medium information is included. Medium verification means.

  As a result, a computer capable of reading and writing simple media can be allowed to use only certain types of simple media, thus preventing information leakage due to writing information to unauthorized simple media. Can be planned.

  The present invention is also a method comprising processing steps executed in the above-mentioned simple medium use management system.

  Further, the present invention can be implemented as a processing program that is read and executed by a computer. The program of the present invention can be stored in an appropriate recording medium such as a portable medium memory, a semiconductor memory, and a hard disk, which can be read by a computer, provided by being recorded on these recording media, or a communication interface. It is provided by transmission and reception using various communication networks.

  The invention related to the present invention includes a management server and a client including a mounting unit for a simple medium that is a removable portable data storage medium, and uses a simple medium for managing the use of the simple medium of the client. In the management system, the management server and the client include the following processing means.

The management server collects simple medium information for identifying the simple medium from 1) client information storage means for storing client information for identifying the client, and 2) a simple medium attached to the attachment portion of the management server. Simple medium information collecting means, 3) selecting a client that permits use of the simple medium, and collecting client information of the selected client from the client information storage means, and 4) in accordance with a predetermined rule, An authentication key creating means for creating an authentication key using the simple medium information and the client information; and 5) a management data writing means for storing management data including the authentication key in a predetermined area of the simple medium. .

  The client includes 1) a simple medium information collecting means for collecting simple medium information of the simple medium from a simple medium attached to the attachment unit of the client; and 2) a management for collecting management data from the simple medium. Data collection means, 3) client information collection means for collecting client information of the client, and 4) a client authentication key using the simple medium information and the client information in accordance with rules used by the authentication key creation means of the management server. And 5) collating the client authentication key with the authentication key included in the management data, and writing to the simple medium when the client authentication key and the authentication key match. Authentication key verification means for permitting processing, reading processing or reading / writing processing.

  In the related invention, the management server can select a client that is a terminal that permits the use of a certain simple medium, and can create an authentication key that is valid only for the selected client. For example, the administrator can specify a simple medium permitted to be used for each client in the computer system, and distributes the simple medium in which the authentication key for the specific client is embedded to the client users.

  The client creates a client authentication key based on the simple medium information of the simple medium and its own client information each time the simple medium distributed by the administrator is loaded in the loading unit, and is stored in the simple medium. The authentication key in the management data is collated with the client authentication key. Only when the collation results match, a predetermined access process to the loaded simple medium, that is, a write process, a read process, or a read / write process is permitted, and data is read from or written to the simple medium.

  On the other hand, when a simple medium other than the appropriate distributed simple medium is loaded in the loading unit, appropriate simple medium information cannot be collected, and an appropriate client authentication key is not created and stored in the simple medium. Authentication key and client authentication key do not match. For this reason, write processing, read processing, or read / write processing on the loaded simple medium is rejected, and data read / write on the simple medium is prohibited.

  Therefore, in the case where the writing process is set to be rejected due to authentication failure, if a simple medium other than the simple medium for which use permission has been set in advance is loaded in the client, data cannot be written to the simple medium.

  As a result, the data stored in the client cannot be copied to the simple medium, so that information leakage via the simple medium can be prevented.

  If management data including the authentication key is illegally copied to another simple medium, the simple medium information of the copy destination simple medium is different from the simple medium information used when creating the authentication key. The verification process of the authentication key in will fail. Therefore, it is not possible to write data to a simple medium in which the authentication key has been illegally copied.

  As described above, according to the related invention, only when a simple medium set in the management server is used in a predetermined client, read / write processing to the simple medium is permitted, and only the simple medium approved for use by the administrator is used. Restrict the use so that the client can read and write data. Therefore, it is possible to manage the use of simple media and prevent information leakage.

  In the related invention, the management server writes the management data as an area where data can only be read.

  As a result, the client user cannot falsify the authentication key stored in the simple medium.

  In the related invention, the management server further comprises medium usage history information collecting means for collecting medium usage history information relating to the simple medium used by the client and its attachment / detachment time and storing the medium usage history information in the medium usage history information storage means.

  As a result, the management server can identify the simple medium used by the client and accumulate usage history information such as the attached / detached time. Therefore, the administrator can find an operation such as information copying from the operation history of writing or reading data on the simple medium performed by the client.

  In the related invention, the management server includes security function determination means for determining whether the simple medium has an encryption function or a security lock function (hereinafter simply referred to as a security function). The authentication key creating means creates the authentication key when the simple medium has the security function.

  The management server can determine whether or not the simple medium has a security function and create an authentication key for setting permission for use. Therefore, even when a simple medium in which data is written is taken out, the data stored in the simple medium is protected and information leakage can be prevented.

  In the simple medium use management system according to the related invention, the management server 1) collects simple medium information for collecting simple medium information for identifying the simple medium from the simple medium mounted on the mounting unit of the management server. Means, 2) an authentication key creating means for creating an authentication key using the simple medium information according to a predetermined rule, and 3) management data for storing management data including the authentication key in a predetermined area of the simple medium The client includes: 1) a simple medium information collecting means for collecting simple medium information of the simple medium from a simple medium attached to the attachment unit of the client; and 2) management data from the simple medium. And 3) client authentication using the simple medium information in accordance with the rules used by the authentication key creating means of the management server And 4) collating the client authentication key with the authentication key included in the management data, and when the client authentication key and the authentication key match, And an authentication key collating unit that permits a write process, a read process, or a read / write process.

  As a result, for example, it is possible to eliminate the use of a simple medium that has not been used by the management server in advance, such as a private simple medium brought in from outside, so that information leakage can be prevented.

  Further, the related invention is a computer including a mounting unit for a simple medium that is a removable portable data storage medium, and determines whether the simple medium has an encryption function or a security lock function. When it is determined that the simple medium is provided with the encryption function or the security lock function, security function determination means is provided that permits a write process, a read process, or a read / write process to the simple medium.

  As a result, in a computer capable of reading and writing simple media, it is possible to permit use of only simple media having a security function, so that information leakage due to reading of information by a third party can be prevented.

  In the present invention, each time a simple medium is attached to a client, the simple medium information and the attached client information are collected to create an authentication key. Therefore, a client whose use permission is set for each simple medium by the management server. Data can be read from and written to the simple medium only when used in the. Therefore, it is possible to prevent information leakage by managing the use of simple media in the computer system.

  Further, according to the present invention, it is possible to manage so that only a simple medium permitted to be used based on the presence or absence of a security function or a specific type can be read / written. Therefore, it is possible to prevent information leakage due to loss of a simple medium, information leakage using an unmanaged simple medium, and the like.

It is a figure which shows the structural example of this invention. It is a figure which shows the example of a simple medium and simple medium information. It is a figure which shows the client information and the information of a client group which are memorize | stored in a client management database. It is a figure which shows the example of the client selection screen displayed by a client selection means. It is a figure for demonstrating the creation process of an authentication key. It is a figure which shows the flow of a process of a management server. It is a figure which shows the flow of a process of a client. It is a figure which shows the structural example of this invention in another Example. It is a figure which shows the flow of a process of a management server. It is a figure which shows the structural example of this invention in another Example. It is a figure which shows the example of a use permission simple medium list | wrist. It is a figure which shows the flow of the use permission determination process of the simple medium using use permission simple medium information. It is a figure which shows the flow of the use permission judgment process of the simple medium by security function discrimination | determination.

  The best mode for carrying out the present invention will be described below with reference to the drawings.

  FIG. 1 is a diagram showing a configuration example of the present invention.

  The system according to the present invention includes a management server 1 and a plurality of clients 2 that can transmit and receive data to and from the management server 1 through a network N. The client 2 does not always need to be connected to the management server 1 through the network N. The processing of the present invention in the management server 1 or the client 2 is executed independently.

  The management server 1 includes a mounting portion (not shown) for the simple medium 3, prepares the simple medium 3 that is set to permit use for each client 2, and causes the client 2 to use the simple medium 3, It is a server that manages the use of the simple medium 3 by the client 2.

  The client 2 is a computer terminal provided with a mounting portion (not shown) for the simple medium 3.

  The simple medium 3 is a portable nonvolatile data storage device such as a memory card or a removable disk that is detachable from the mounting unit.

  The management server 1 includes a simple medium information collecting unit 11, a client information collecting unit 12, a client selecting unit 13, an authentication key creating unit 14, a management data writing unit 15, a simple medium management database (simple medium management DB) 16, and a client management database. (Client management DB) 17, medium usage history database (medium usage history DB) 18, input means 110, and display device 111.

  The simple medium information collecting unit 11 is a processing unit that collects simple medium information from the simple medium 3 attached to the attachment unit of the management server 1 and stores it in the simple medium management DB 16.

  FIG. 2 is a diagram illustrating an example of the simple medium 3 and the simple medium information. The simple medium information is information for uniquely identifying the simple medium 3 and is stored in a predetermined area of the simple medium 3. The simple medium information is, for example, information such as a manufacturer name that identifies the manufacturer of the simple medium 3, a model number that identifies the type of the simple medium 3, and a single identification ID for identifying the individual simple medium 3. The area of the simple medium 3 in which the simple medium information is stored is an area where data can be read but cannot be written.

  The client information collecting means 12 collects client information from each client 2 and stores it in the client management DB 17, or collects medium usage history information related to the attachment / detachment of the simple medium 3 at the client 2 and stores it in the medium usage history DB 18. It is a processing means.

  The client information is information that uniquely identifies the client 2. For example, the IP address, MAC address, client name (computer name), etc. of the client 2 are used. Further, the management server 1 may be information such as an ID uniquely assigned to each client 2.

  FIG. 3 is a diagram showing client information and client group information stored in the client management DB 17. The client management DB 17 stores client information of the client 2 and a client group composed of one or a plurality of clients 2.

  The client information is collected from each client 2 via the network N and stored in the client management DB 17. However, the client information may be prepared in advance in the management server 1 as the client management DB 17.

  The medium usage history information includes information (simple medium information) for specifying the simple medium 3 used by the client 2, time information (date and time) when the simple medium 3 is inserted into the attachment unit, and the simple medium 3 is extracted from the attachment unit. Time information (date and time).

  The client selection unit 13 refers to the client management DB 17 to generate a client selection screen for designating a client 2 that is permitted to use a certain simple medium 3 and displays the client selection screen on the display device 111. This is a processing means for collecting client information of the client 2 selected by the client management DB 17 from the client management DB 17.

  FIG. 4 is a diagram illustrating an example of a client selection screen displayed on the display device 111 by the client selection unit 13. For example, the administrator selects one or a plurality of clients 2 whose use is permitted on the client selection screen displayed by the client selection unit 13 via the input unit 110. A check mark is added to the icon of the selected client 2 and the selection is determined.

  In addition, when the clients 2 are configured in groups, the client 2 can be specified for each client group when selecting the clients 2 that are permitted to use the simple medium 3. The client selection unit 13 selects all the clients (arries, taurus) constituting the group specified by the group name shown in FIG. 3 when the use permission is selected in the client group such as “General Affairs Department”. Collect client information for.

  Further, the client selection means 13 can select all the clients 2 in the system as objects to be permitted for use.

  The authentication key creating means 14 uses simple medium information collected from the simple medium 3 attached to the attachment unit and client information of the client 2 selected as a terminal that permits use of the simple medium 3 in accordance with a predetermined rule. Processing means for creating an authentication key.

  Further, the authentication key creating means 14 creates an authentication key using the simple medium information of the simple medium 3 when, for example, the simple medium 3 is set to be allowed to be used by all clients 2.

  The management data writing means 15 is processing means for storing management data including the authentication key created by the authentication key creating means 14 in a predetermined area of the simple medium 3. The management data writing means 15 stores the management data in an area where the client 2 can only read and cannot write.

  The client 2 includes a simple medium information collection unit 21, a management data collection unit 22, a client information collection unit 23, an authentication key creation unit 24, and an authentication key collation unit 25.

  The simple medium information collecting means 21 is a processing means for collecting simple medium information from the simple medium 3 inserted in the mounting part of the client 2.

  The management data collection unit 22 is a processing unit that collects management data from the simple medium 3 inserted in the mounting unit of the client 2.

  The client information collecting unit 23 is a processing unit that collects client information of the client 2.

  The authentication key creating unit 24 creates a client authentication key using the simple medium information or the simple medium information and the client information collected by the client information collecting unit 23 according to the rules used by the authentication key creating unit 14 of the management server 1. It is a processing means.

  The authentication key collating means 25 collates the client authentication key and the authentication key included in the management data, and when the client authentication key and the authentication key match, the data writing process, the reading process or the It is a processing means that permits any one of the reading and writing processes.

  In the authentication key collating means 25, it is assumed that processing to be permitted or rejected is set in advance. Information leakage through the simple medium usually occurs when the simple medium 3 on which information is written is taken out to the outside, so that the writing process is set as a target of permission or rejection.

  When the authentication key collating means 25 detects the insertion of the simple medium 3, the authentication key collating means 25 prohibits the read / write processing to the simple medium 3, and if both keys match as a result of collation between the client authentication key and the authentication key, Write, read, or read / write processing is allowed.

  In the following, the processing of the present invention will be described by dividing it into processing on the management server 1 side and processing on the client 2 side.

  The management server 1 is assumed to have a client management DB 17 in advance.

  In the management server 1, when the simple medium 3 is inserted into the mounting portion, the simple medium information collecting unit 11 collects simple medium information [maker name: abcd, model number: efgh, single unit identification ID: df0c12b49e] from the simple medium 3. To do.

  The client selection means 13 refers to the client management DB 17 to display a client selection screen on the display device 111, and allows the administrator to select a client 2 that is permitted to use from the displayed client selection screen. When the client 2 selected by the administrator is specified via the input unit 110, the client information of the specified client 2 is collected from the client management DB 17.

  Note that either the process of collecting simple medium information from the simple medium 3 or the process of collecting client information of a selected client by selecting a client may be executed first. It may be executed in parallel.

  Subsequently, the authentication key creating means 14 creates an authentication key for each client 2.

  FIG. 5 is a diagram for explaining the authentication key creation process.

Assume that three clients (gemini, leo, and vigo) 2 are selected by the client selection unit 13 as the clients 2 that are scheduled to permit use of the simple medium 3. The client information collected by the client selection means 13 is as follows:
Client information of client (gemini) 2 [startdygc08],
Client information [idgmesbon10] of client (leo) 2,
Client information of client (virgo) 2 [fbazbchlp11].

  The authentication key creating means 14 receives the simple medium information and creates an authentication key for the client (gemini) 2 using all or a part of the simple medium information (for example, manufacturer name, model number) and client information [startdygc08]. Similarly, the authentication key of the client (leo) 2 is created using the simple medium information and the client information [idgmesbon10], and the authentication key of the client (virgo) 2 is created using the simple medium information and the client information [fbazbchlp11]. . For example, the authentication keys [abcdefghhartdygc08], [abcdefghidgemesbon10], and [abcdefghfbazbchlp11] for the three clients 2 of gemini, leo, and virgo are created.

  In addition, when the client 2 to be permitted to be used is designated by a group name, an authentication key may be created using information (group name or group ID) indicating the belonging group stored in the client 2 in advance.

  If all clients 2 are designated as clients to be permitted to use, an authentication key is created using only the simple medium information of the simple medium 3.

  Further, the authentication key creating means 14 creates management data including the created three authentication keys and stores it in a predetermined area of the simple medium 3. As a result, only the three clients 2 of gemini, leo, and virgo can use the simple medium 3. The other clients 2 are prohibited from reading and writing data because the authentication keys do not match.

  Next, it is assumed that the simple medium 3 in which the management data shown in FIG. 5 is stored in the client 2 is inserted into the client (gemini) 2.

  The simple medium information collecting unit 21 of the client 2 collects simple medium information [manufacturer name: abcd, model number: efgh, single unit identification ID: df0c12b49e] from the simple medium 3. Further, the management data collection unit 22 collects management data (management data including authentication keys [abcdefghtdygc08], [abcdefghidmesbon10], [abcdefghfbazbchlp11]) from the simple medium 3. The client information collecting unit 23 collects client information [startdygc08] of the client 2.

  The authentication key creating unit 24 creates a client authentication key using the simple medium information and the client information by the same processing method as the authentication key creating unit 14. Here, since the client information is [shortdygc08], the client authentication key becomes [abcdefhshstartdygc08] by a predetermined creation process. Although the authentication key creation logic is simple here for the sake of simplicity, the authentication key is actually created by an encryption process such as a character replacement process based on a predetermined rule.

  Then, the authentication key collating means 25 collates the authentication key included in the management data with the client authentication key, and since there is an authentication key that matches the client authentication key in the management data, the read / write processing to the simple medium 3 is performed. Allow (access permission).

  Here, the client authentication key may be created by using information indicating the belonging group stored in advance as client information. Alternatively, the client authentication key may be created using only the simple medium information of the simple medium.

  On the other hand, when the simple medium 3 is inserted into the mounting part of the client 2 other than the three of gemini, leo, and virgo, the client information that is the basis of the client authentication key is different, so the verification fails, and the simple medium 3 No read / write operations are permitted.

  In the client 2, when read / write processing to the simple medium 3 is permitted, data is written to the simple medium 3 by the data read / write function of the client 2.

  FIG. 6 is a diagram illustrating a processing flow of the management server.

  In the management server 1, the simple medium information collecting means 11 collects the simple medium information from the simple medium 3 inserted in the mounting portion (step S11). Then, the client selection means 13 designates the client 2 that is permitted to use on the client selection screen created with reference to the client management DB 17 (step S12), and collects client information of the designated client 2 from the client management DB 17 ( Step S13).

  The authentication key creating means 14 creates an authentication key using the simple medium information and the client information (step S14), and stores management data including the authentication key in a predetermined area of the simple medium 3 (step S15).

  In addition, the process of step S11 may be performed after the process of step S13.

  FIG. 7 is a diagram showing the flow of processing of the client.

  In the client 2, the simple medium information collecting means 21 collects the simple medium information from the simple medium 3 inserted in the mounting portion (step S21). Furthermore, management data is collected from the simple medium 3 by the management data collecting means 22 (step S22). If there is management data in the simple medium 3 (step S23), client information of the client 2 itself is collected (step S24).

  Then, the authentication key creating means 24 creates a client authentication key using the simple medium information and the client information (step S25). Thereafter, the authentication key included in the management data of the simple medium 3 is extracted, and the extracted authentication key and the client authentication key are collated (step S26). As a result of the collation, when the authentication key and the client authentication key match (step S27), the use of the simple medium 3 is permitted (read / write processing is permitted) (step S28). On the other hand, if the authentication key does not match the client authentication key (step S27), the use of the simple medium 3 is not permitted (step S29).

  If there is no management data in step S23, use of the simple medium 3 is not permitted (step S29).

  FIG. 8 is a diagram showing a configuration example of the present invention in another embodiment.

  The processing means constituting the system shown in FIG. 8 is the same as the processing means assigned the same number as the configuration example shown in FIG.

  The management server 1 includes security function determination means 19 in addition to the processing means having the configuration shown in FIG. The security function determination unit 19 is a processing unit that determines whether the simple medium 3 has a security function.

The security function discrimination method in the security function discrimination means 19 is as follows:
1) Check the simple medium 3 directly to detect software that realizes the security function, or
2) Prepare a correspondence table or the like indicating the type of the simple medium 3 having the security function in combination with the manufacturer name or model number of the simple medium information in advance, and collate the model number of the simple medium information or the like, or
3) Manually set from the input means 110 by an administrator or the like.

  When the security function determination unit 19 determines that the simple medium 3 has a security function, it notifies the authentication key creation unit 14 that the security function is provided.

  The authentication key creating means 14 creates an authentication key only when receiving a notification that the security function is provided from the security function determining means 19.

  As a result, only the simple medium 3 provided with the security function can be used by the client 2, so that information leakage can be prevented even when the simple medium 3 is taken outside.

  FIG. 9 is a diagram showing the flow of processing of the management server in another embodiment.

  In the management server 1, the simple medium information collecting means 11 collects simple medium information from the simple medium 3 inserted in the mounting portion (step S31). Further, the security function discriminating means 19 checks whether or not there is a security function (step S32). If there is a security function (step S33), the client selection means 13 refers to the client management DB 17 and designates the client 2 that is permitted to be used (step S34). Then, client information of the designated client 2 is collected from the client management DB 17 (step S35).

  The authentication key creating means 14 creates an authentication key using the simple medium information and the client information (step S36), and stores management data including the authentication key in a predetermined area of the simple medium 3 (step S37).

  Note that the processing of steps S31 to S33 may be performed after the processing of step S35.

  FIG. 10 is a diagram showing a configuration example of the present invention in another embodiment.

  In the configuration example shown in FIG. 10, the management server 1 includes a client information collection unit 12, a client management DB 17, a medium usage history DB 18, a use permission simple medium information storage unit 120, and a use permission simple medium information transmission unit 121.

  The client 2 also includes a simple medium information collecting unit 21, a use-permitted simple medium information storage unit 210, a simple medium collating unit 211, and a security function determining unit 212.

  The client information collection unit 12, client management DB 17, medium usage history DB 18, and simple medium information collection unit 21 shown in FIG. 10 perform substantially the same processing as the processing unit assigned the same number shown in FIG. is there.

  The use-permitted simple medium information storage unit 120 is a unit that stores use-permitted simple medium information that identifies the type of the simple medium 3 that is permitted to be used by the client 2.

  The use-permitted simple medium information transmission unit 121 is a processing unit that transmits the use-permitted simple medium information to the client 2 through the network N.

  The use-permitted simple medium information storage unit 210 is a unit that stores the use-permitted simple medium information (list) received from the management server 1.

  FIG. 11 is a diagram illustrating an example of use-permitted simple medium information (list). The list includes information (management server ID) for identifying the management server 1 as a transmission source, and information (manufacturer name and model number) indicating the type of simple medium information permitted to be used. Since the management server ID is included in the list, the client 2 can confirm the transmission source of the list by judging the management server ID. The type designated as a simple medium that is permitted to be used shall have a predetermined security function, for example.

  The simple medium collating unit 211 moves the simple medium 3 to the simple medium 3 when the simple medium information (type of simple medium) of the simple medium 3 is included in the use-permitted simple medium information (list) of the use-permitted simple medium information storage unit 210. The processing means for permitting the write process, read process, or read / write process.

  The security function determination unit 212 is a processing unit that determines whether the simple medium 3 has a security function (encryption function or security lock function).

  The simple medium information collecting means 21 collects simple medium information that specifies at least the type of the simple medium from the simple medium 3 attached to the attachment unit of the client 2.

  In the client 2, when the simple medium 3 is inserted into the mounting unit, the simple medium information collecting unit 21 collects simple medium information (manufacturer name, model number, etc.) indicating the type of the simple medium from the simple medium 3. The simple medium collating unit 211 refers to the list of the use-permitted simple medium information storage unit 210 and determines whether or not the simple medium 3 is a type that is permitted to be used. As a result of the determination, if the simple medium 3 is of a type that is permitted to be used, a write process, a read process, or a read / write process to the simple medium 3 is permitted.

  In the client 2, when read / write processing to the simple medium 3 is permitted, data is written to the simple medium 3 by the data read / write function of the client 2.

  As a result, the client 2 permits the data read / write processing only for the predetermined type of the simple medium 3, thereby preventing information leakage.

  In the client 2, when the simple medium 3 is inserted into the mounting portion, the security function determining unit 212 determines whether the simple medium 3 has a security function (encryption function or security lock function). . If the simple medium 3 has a security function as a result of the determination, a write process, a read process, or a read / write process to the simple medium 3 is permitted.

  As a result, the client 2 permits data read / write processing only in the simple medium 3 having the security function, so that information leakage can be prevented.

  FIG. 12 is a diagram showing the flow of a simple medium use permission determination process using the use permission simple medium information (list).

  In the client 2, the simple medium information collecting means 21 collects at least information (manufacturer name and model number) for specifying the type of the simple medium from the simple medium information of the simple medium 3 inserted in the mounting portion (step S51).

  Then, the simple medium matching unit 211 searches the list of the use-permitted simple medium information storage unit 210 using the manufacturer name and model number of the simple medium 3 (step S52). If there is simple medium information (manufacturer name, model number) corresponding to the list (step S53), use of the simple medium 3 is permitted (permitting read / write processing) (step S54). On the other hand, when there is no corresponding simple medium information (manufacturer name, model number), use of the simple medium 3 is not permitted (step S55).

  FIG. 13 is a diagram showing a flow of simple medium use permission determination processing by security function determination.

  In the client 2, the security function determining unit 212 checks whether the simple medium 3 has a security function (step S61). If the simple medium 3 has a security function (step S62), the use of the simple medium 3 is permitted (permitting read / write processing) (step S63). If the security function is not provided (step S62), use of the simple medium 3 is not permitted (step S64).

  Note that the client 2 shown in FIG. 10 does not always need to be connected to the management server 1 through the network N, and the client 2 executes processing independently.

Further, the client 2 may be configured to include only one processing means of the simple medium collating means 211 or the security function determining means 212.
Further, the use-permitted simple medium information may be stored in the use-permitted simple medium information storage unit 210 directly by an administrator or the like without going through the network N.

  Although the present invention has been described above with reference to the embodiments, it is obvious that the present invention can be variously modified within the scope of the gist thereof.

  The features of the embodiments and examples of the present invention are listed as follows.

(Supplementary Note 1) A simple medium usage management system configured by a management server and a client including a simple medium mounting unit which is a removable portable data storage medium, and managing the use of the simple medium of the client,
The management server
Client information storage means for storing client information for identifying a client;
Simple medium information collecting means for collecting simple medium information for identifying the simple medium from the simple medium attached to the attachment unit of the management server;
Client selection means for selecting a client that is permitted to use the simple medium, and collecting client information of the selected client from the client information storage means;
An authentication key creating means for creating an authentication key using the simple medium information and the client information according to a predetermined rule;
Management data writing means for storing management data including the authentication key in a predetermined area of the simple medium,
The client
Simple medium information collecting means for collecting simple medium information of the simple medium from a simple medium mounted on the mounting unit of the client;
Management data collection means for collecting management data from the simple medium;
Client information collecting means for collecting client information of the client;
Authentication key creating means for creating a client authentication key using the simple medium information and the client information according to the rules used by the authentication key creating means of the management server;
Authentication for permitting write processing, read processing, or read / write processing to the simple medium when the client authentication key and the authentication key included in the management data are collated and the client authentication key matches the authentication key A simple medium use management system comprising a key verification unit.

(Additional remark 2) The said management data writing means writes the said management data in the area | region which can only read data as said area | region. The simple medium use management system of the said additional remark 1 characterized by the above-mentioned.

(Additional remark 3) The said management server is equipped with the client information collection means which collects each client information from the said client, and memorize | stores it in the said client information storage means. The simple medium use management system of the said additional remark 1 characterized by the above-mentioned.

(Additional remark 4) The said management server is equipped with the medium utilization history information collection means which collects the medium utilization history information regarding the simple medium used by the said client and its attachment / detachment time from the said client, and memorize | stores it in a medium utilization history information storage means. The simple medium use management system according to appendix 1, wherein:

(Additional remark 5) The said management server is provided with the security function discrimination means which determines whether the said simple medium is provided with the encryption function or the security lock function,
The simple medium usage management system according to appendix 1, wherein the authentication key creating means creates the authentication key when the simple medium is provided with the encryption function or the security lock function.

(Supplementary Note 6) When the client information in the client information storage unit includes group information for identifying a group to which a client belongs, the client selection unit selects a group that permits use of the simple medium, and 2. The simple medium use management system according to claim 1, wherein client information of clients belonging to the selected group is collected from a client information storage unit.

(Additional remark 7) The said authentication key preparation means uses the said group information as said client information, when the group information which identifies the group to which a client belongs is contained in the client information of the said client information storage means. The simple medium use management system according to appendix 1.

(Supplementary Note 8) The client includes a security function determination unit that determines whether the simple medium has an encryption function or a security lock function,
The authentication key verification means writes the simple medium when the client authentication key and the authentication key match, and when the simple medium is provided with the encryption function or the security lock function. Alternatively, the simple medium use management system according to the above supplementary note 1, wherein read processing or read / write processing is permitted.

(Supplementary note 9) A simple medium use management system configured by a management server and a client including a simple medium mounting unit which is a removable portable data storage medium, and managing the use of the simple medium of the client,
The management server
Simple medium information collecting means for collecting simple medium information for identifying the simple medium from the simple medium attached to the attachment unit of the management server;
An authentication key creating means for creating an authentication key using the simple medium information according to a predetermined rule;
Management data writing means for storing management data including the authentication key in a predetermined area of the simple medium,
The client
Simple medium information collecting means for collecting simple medium information of the simple medium from a simple medium mounted on the mounting unit of the client;
Management data collection means for collecting management data from the simple medium;
Authentication key creating means for creating a client authentication key using the simple medium information according to the rules used by the authentication key creating means of the management server;
Authentication for permitting write processing, read processing, or read / write processing to the simple medium when the client authentication key and the authentication key included in the management data are collated and the client authentication key matches the authentication key A simple medium use management system comprising a key verification unit.

(Supplementary Note 10) When the attachment unit detects attachment of the simple medium in the attachment unit, the client authentication key verification unit prohibits writing or reading processing to the simple medium, and the client authentication key matches the authentication key. In this case, the simple medium usage management system according to any one of the supplementary note 1 and the supplementary note 9, wherein a write process, a read process, or a read / write process to the simple medium is permitted.

(Supplementary note 11) A simple medium usage management system configured by a management server and a client including a simple medium mounting unit which is a removable portable data storage medium, and managing the use of the simple medium of the client,
The management server
A use-permitted simple medium information transmitting means for transmitting use-permitted simple medium information for identifying the type of simple medium permitted to be used to the client;
The client
Use-permitted simple medium information storage means for storing the use-permitted simple medium information;
Simple medium information collecting means for collecting simple medium information for identifying at least the type of the simple medium from the simple medium attached to the attachment unit;
Information indicating the type of the simple medium information is searched with reference to the use-permitted simple medium information storage means, and the simple medium information is included in the use-permitted simple medium information, the information is written to the simple medium. A simple medium use management system comprising: a simple medium collation unit that permits a process, a read process, or a read / write process.

(Supplementary note 12) When the simple medium collating unit of the client detects attachment of the simple medium in the attachment unit, the simple medium collating unit prohibits writing processing or reading processing to the simple medium, and the client authentication key and the authentication key match. In this case, the simple medium usage management system according to appendix 11, wherein a write process, a read process, or a read / write process to the simple medium is permitted.

(Supplementary note 13) A management server for managing the use of the simple medium in a client having a simple medium mounting portion which is a removable portable data storage medium,
Client information storage means for storing client information for identifying a client;
Simple medium information collecting means for collecting simple medium information for identifying the simple medium from the simple medium attached to the attachment unit of the management server;
Client selection means for selecting a client that is permitted to use the simple medium, and collecting client information of the selected client from the client information storage means;
An authentication key creating means for creating an authentication key using the simple medium information and the client information according to a predetermined rule;
Management data writing means for storing management data including the authentication key in a predetermined area of the simple medium.

(Supplementary note 14) The management server according to supplementary note 13, wherein the management data writing means writes the management data as an area where data can only be read.

(Supplementary note 15) The management server according to Supplementary note 13, further comprising client information collection means for collecting each client information from the client and storing the client information in the client information storage means.

(Additional remark 16) The medium utilization history information collection means which collects the medium utilization history information regarding the simple medium used by the client and its attachment / detachment time from the client and stores it in the medium utilization history information storage means is provided. The management server according to Appendix 13.

(Supplementary Note 17) Security function determination means for determining whether the simple medium has an encryption function or a security lock function,
14. The management server according to appendix 13, wherein the authentication key creating means creates the authentication key when the simple medium is provided with the encryption function or the security lock function.

(Supplementary Note 18) When the client information of the client information storage means includes group information for identifying a group to which the client belongs,
14. The management according to claim 13, wherein the client selection unit selects a group that permits the use of the simple medium, and collects client information of clients belonging to the selected group from the client information storage unit. server.

(Supplementary Note 19) When the client information of the client information storage means includes group information for identifying a group to which the client belongs,
14. The management server according to appendix 13, wherein the authentication key creating means uses the group information as the client information.

(Supplementary note 20) A management server for managing the use of the simple medium in a client having a simple medium mounting portion which is a removable portable data storage medium,
Client information storage means for storing client information for identifying a client;
Simple medium information collecting means for collecting simple medium information for identifying the simple medium from the simple medium attached to the attachment unit of the management server;
An authentication key creating means for creating an authentication key using the simple medium information according to a predetermined rule;
Management data writing means for storing management data including the authentication key in a predetermined area of the simple medium.

(Supplementary note 21) A management server for managing the use of the simple medium in a client having a simple medium mounting portion which is a removable portable data storage medium,
A management server comprising: a use-permitted simple medium information transmitting unit that transmits use-permitted simple medium information that identifies a type of a simple medium that is permitted to be used to a client.

(Supplementary note 22) A computer including a mounting portion of a simple medium which is a removable portable data storage medium,
Simple medium information collecting means for collecting simple medium information for identifying the simple medium from the simple medium attached to the attachment unit;
Management data collecting means for collecting management data including an authentication key created according to a predetermined rule using simple medium information and client information for identifying a computer from the simple medium;
Client information collecting means for collecting client information of the computer;
An authentication key creating means for creating a client authentication key using the simple medium information and the client information according to the rules;
Authentication for permitting write processing, read processing, or read / write processing to the simple medium when the client authentication key and the authentication key included in the management data are collated and the client authentication key matches the authentication key A computer comprising key collating means.

(Supplementary Note 23) A computer including a mounting portion for a simple medium that is a removable portable data storage medium,
Simple medium information collecting means for collecting simple medium information for identifying the simple medium from the simple medium attached to the attachment unit;
Management data collection means for collecting management data including an authentication key created according to a predetermined rule using simple medium information from the simple medium;
An authentication key creating means for creating a client authentication key using the simple medium information according to the rules;
Authentication for permitting write processing, read processing, or read / write processing to the simple medium when the client authentication key and the authentication key included in the management data are collated and the client authentication key matches the authentication key A computer comprising key collating means.

(Supplementary Note 24) A computer including a mounting portion for a simple medium which is a removable portable data storage medium,
It is determined whether the simple medium is provided with an encryption function or a security lock function, and when it is determined that the simple medium is provided with the encryption function or a security lock function, A computer comprising security function determination means for permitting write processing, read processing, or read / write processing.

(Supplementary Note 25) A computer including a mounting portion for a simple medium that is a removable portable data storage medium,
Use-permitted simple medium information storage means for storing use-permitted simple medium information for specifying the type of simple medium permitted to be used;
Simple medium information collecting means for collecting simple medium information for identifying at least the type of the simple medium from the simple medium attached to the attachment unit;
Information indicating the type of the simple medium information is searched with reference to the use-permitted simple medium information storage means, and the simple medium information is included in the use-permitted simple medium information, the information is written to the simple medium. A computer comprising: a simple medium verification unit that permits processing, reading processing, or reading / writing processing.

(Supplementary note 26) Use of a simple medium for managing the use of the simple medium of the client by using a management system including a management server and a client including a simple medium mounting unit which is a removable portable data storage medium A management method,
In a management server comprising client information storage means for storing client information for identifying the client,
Using simple medium information for identifying the simple medium collected from the simple medium attached to the attachment part of the management server, and client information of the client permitting use of the simple medium collected from the client information storage means , Create an authentication key according to the prescribed rules,
Processing for storing management data including the authentication key in a predetermined area of the simple medium;
In the client,
When a simple medium is attached to the attachment part of the client, the simple medium information collected from the simple medium and the client information collected from the client are used according to the rules used in the authentication key creation process of the management server. Create a client authentication key,
The client authentication key is compared with the authentication key included in the management data collected from the simple medium, and when the client authentication key and the authentication key match, the write process or the read process to the simple medium Alternatively, a simple medium usage management method characterized by permitting read / write processing.

(Supplementary note 27) In order to manage the use of the simple medium in a client having a simple medium mounting portion which is a removable portable data storage medium,
Client information storage means for storing client information for identifying a client;
Simple medium information collecting means for collecting simple medium information for identifying the simple medium from the simple medium attached to the attachment unit;
Client selection means for selecting a client that is permitted to use the simple medium, and collecting client information of the selected client from the client information storage means;
An authentication key creating means for creating an authentication key using the simple medium information and the client information according to a predetermined rule;
A simple medium use management program for causing a management server to function as a management server comprising management data writing means for storing management data including the authentication key in a predetermined area of the simple medium.

(Supplementary Note 28) In order to manage the use of the simple medium in a client having a simple medium mounting portion which is a removable portable data storage medium,
Simple medium information collecting means for collecting simple medium information for identifying the simple medium from the simple medium attached to the attachment unit;
An authentication key creating means for creating an authentication key using the simple medium information according to a predetermined rule;
A simple medium use management program for causing a management server to function as a management server comprising management data writing means for storing management data including the authentication key in a predetermined area of the simple medium.

(Supplementary Note 29) In order to manage the use of the simple medium in a client having a simple medium mounting portion which is a removable portable data storage medium,
A simple medium use management program for causing a management server to function, comprising a use-permitted simple medium information transmitting means for transmitting use-permitted simple medium information specifying a type of a simple medium permitted to be used to a client.

(Supplementary Note 30) In order to use a predetermined simple medium having a simple medium mounting portion which is a removable portable data storage medium,
Simple medium information collecting means for collecting simple medium information for identifying the simple medium from the simple medium attached to the attachment unit;
Management data collection means for collecting management data including an authentication key created by the management server from the simple medium;
Client information collecting means for collecting client information of the computer;
Authentication key creation means for creating a client authentication key using the simple medium information and the client information according to the rules used in the authentication key creation processing of the management server;
Authentication for permitting write processing, read processing, or read / write processing to the simple medium when the client authentication key and the authentication key included in the management data are collated and the client authentication key matches the authentication key A simple medium use program for functioning as a client comprising a key verification means.

(Supplementary Note 31) In order to use a predetermined simple medium with a simple medium mounting portion which is a removable portable data storage medium,
Simple medium information collecting means for collecting simple medium information for identifying the simple medium from the simple medium attached to the attachment unit;
Management data collection means for collecting management data including an authentication key created by the management server from the simple medium;
An authentication key creating means for creating a client authentication key using the simple medium information in accordance with the rules used in the authentication key creating process of the management server;
Authentication for permitting write processing, read processing, or read / write processing to the simple medium when the client authentication key and the authentication key included in the management data are collated and the client authentication key matches the authentication key A simple medium use program for functioning as a client comprising a key verification means.

(Supplementary Note 32) In order to use a predetermined simple medium with a simple medium mounting portion which is a removable portable data storage medium,
Use-permitted simple medium information storage means for storing use-permitted simple medium information for specifying the type of simple medium permitted to be used;
Simple medium information collecting means for collecting simple medium information for identifying at least the type of the simple medium from the simple medium attached to the attachment unit;
Information indicating the type of the simple medium information is searched with reference to the use-permitted simple medium information storage means, and the simple medium information is included in the use-permitted simple medium information, the information is written to the simple medium. A simple medium use program for causing a client to function as a client, comprising: simple medium collation means that permits processing, reading processing, or reading / writing processing.

(Supplementary Note 33) In order to use a predetermined simple medium with a simple medium mounting portion which is a removable portable data storage medium,
It is determined whether the simple medium is provided with an encryption function or a security lock function, and when it is determined that the simple medium is provided with the encryption function or a security lock function, A program for using a simple medium for causing a client to function as a client, comprising security function determination means for permitting write processing, read processing, or read / write processing.

DESCRIPTION OF SYMBOLS 1 Management server 11 Simple medium information collection means 12 Client information collection means 13 Client selection means 14 Authentication key creation means 15 Management data writing means 16 Simple medium management database (DB)
17 Client management database (DB)
18 Medium Usage History Database (DB)
DESCRIPTION OF SYMBOLS 19 Security function discrimination | determination means 120 Use permission simple medium information storage means 121 Use permission simple medium information transmission means 2 Client 21 Simple medium information collection means 22 Management data collection means 23 Client information collection means 24 Authentication key creation means 25 Authentication key collation means 210 Use-permitted simple medium information storage means 211 Simple medium collation means 212 Security function determination means 3 Simple medium N network

Claims (4)

In order to take security measures for a computer system , a simple medium is used that includes a management server and a client having a simple medium mounting unit that is a removable portable data storage medium, and manages the use of the simple medium of the client. A management system,
The management server
Includes a use permission simple medium information transmitting means for transmitting the attributes or use permission simple medium information is Name Simple media to the client is a manufacturer name or model number identifies the type of simple media to allow use,
The client
Use-permitted simple medium information storage means for storing use-permitted simple medium information received from the management server;
From the simple medium mounted to the mounting portion, and a simplified medium information collecting means for collecting simple medium information is an attribute or Name simple medium which is a manufacturer name or model number identifies the type of the previous SL simple medium,
Searching information is an attribute or the name of a simple medium which is a manufacturer name or model number by referring to the usage permission simple medium information memory means for specifying the type of the simple medium of the simple medium information, the use permission simple medium information wherein if it contains information which is the attribute or the name of a simple medium which is a manufacturer name or model number identifies the type of simple media simple medium information, write processing or read processing or write processing to the simple medium A simple medium use management system comprising: a simple medium collation unit that permits In order to take security measures for a computer having a mounting unit for a simple medium, which is a removable portable data storage medium ,
And use permission simple medium information memory means for storing attributes or use permission simple medium information is Name simple medium which is a manufacturer name or model number identifies the type of simple media to allow use,
From the simple medium mounted to the mounting portion, and a simplified medium information collecting means for collecting simple medium information is an attribute or Name simple medium which is a manufacturer name or model number identifies the type of the previous SL simple medium,
By referring to the use-permitted simple medium information storage unit , a simple medium attribute or name that is a manufacturer name or model number for specifying the type of simple medium in the simple medium information is searched, and the use-permitted simple medium information is stored in the use-permitted simple medium information. if the information is an attribute or the name of a simple medium contains a maker name or model number identifies the type of simple media simple medium information, permits writing process or the reading process or read process to the simple medium And a simple medium collating means. As a security measure of a computer system, in order to manage the use of the simple medium in a client having a simple medium mounting portion which is a removable portable data storage medium,
To function as a management server having authorization to use simple medium information transmitting means for transmitting the attributes or use permission simple medium information is Name Simple media to the client is a manufacturer name or model number identifies the type of simple media to allow the use A simple media usage management program. As a security measure for a computer system , a simple medium loading unit, which is a removable portable data storage medium, is provided to manage the use of a predetermined simple medium,
And use permission simple medium information memory means for storing attributes or use permission simple medium information is Name simple medium which is a manufacturer name or model number identifies the type of simple media to allow use,
From the simple medium which is mounted to the mounting portion, and a simplified medium information collecting means for collecting simple medium information is an attribute or Name simple medium which is a manufacturer name or model number identifies the type of the previous SL simple medium,
By referring to the use-permitted simple medium information storage unit , a simple medium attribute or name that is a manufacturer name or model number for specifying the type of simple medium in the simple medium information is searched, and the use-permitted simple medium information is stored in the use-permitted simple medium information. if the information is an attribute or the name of a simple medium contains a maker name or model number identifies the type of simple media simple medium information, permits writing process or the reading process or read process to the simple medium A simple medium use program for causing a client to function as a client.

Images