JP5515905B2 - Portable storage medium, data authentication program, and data authentication method - Google Patents

Description

  The present case relates to a portable storage medium, a data authentication program, and a data authentication method.

  Viruses that infect PCs (Personal Computers) using the auto-run function of portable storage media such as USB memories have emerged. In order to cope with this, recently, techniques such as Patent Documents 1 to 4 have been proposed. Patent Document 1 discloses a technique for loading a program for controlling writing and reading from a USB memory to the PC when the USB memory is connected to the PC. Patent Document 2 discloses a technique related to a filtering function by a device driver of an input / output interface. Patent Document 3 discloses a technique for managing contents and media in association with each other and preventing writing to other media. Furthermore, Patent Document 4 discloses a technique in which unique data is shared between an information processing apparatus and a storage medium, and the data is checked and processed during writing / reading.

Japanese Patent Laid-Open No. 2006-24397 JP 2004-318720 A JP 2009-87497 A JP 2006-31540 A

  However, in Patent Documents 1 to 4, an unauthorized user who intends to infect a virus via a USB memory may be able to write a virus in the USB memory by an unauthorized process by removing the filter.

  Further, in Patent Document 3, since a dedicated application (driver) is essential on the PC side, the usability may be worse than a normal USB memory (general versatility may be reduced).

  Accordingly, the present invention has been made in view of the above problems, and an object thereof is to provide a portable storage medium that can suppress virus infection while maintaining versatility. Another object of the present invention is to provide a data authentication program and a data authentication method capable of suppressing virus infection.

Portable storage medium described herein, a data storage area for storing the first control program for holding storage target data and the first authentication information generated ID sent from the external information processing apparatus, the second A second control program that holds the authentication information generation ID, an authentication information generation unit that generates authentication information when the first authentication information generation ID and the second authentication information generation ID match , Calculate information by data from storage target data stored in the data storage area, and cause the information processing apparatus to execute processing for adding additional information obtained by predetermined conversion of the data specific information with the authentication information to the storage target data a transmission unit that transmits the first control program to the information processing apparatus together with the authentication information, a storage unit for storing the authentication information, from the information processing apparatus, the data storage Storage target data stored in the area is received, and the validity of the additional information is confirmed using the data-specific information of the storage target data and the authentication information stored in the storage unit. In some cases, the portable storage medium includes a permission unit that permits storage of the storage target data in the data storage area.

Data authentication program described herein is a data authentication program used in a portable storage medium having a data storage area, the computer, the first control program stored in the data storage area holding An authentication information generation unit that generates authentication information when the first authentication information generation ID to be executed matches the second authentication information generation ID held by the second control program, and a storage object to be stored in the data storage area The first control program for causing the information processing apparatus to execute a process of calculating the data-specific information from the data and adding the additional information obtained by predetermined conversion of the data-specific information with the authentication information to the storage target data; transmission unit that transmits to the information processing apparatus together with the authentication information, and from the information processing apparatus, receiving the storage target data stored in the data storage area Then, the validity of the additional information is confirmed using the data-specific information of the storage object data and the authentication information generated by the authentication information generation unit. A data authentication program that functions as a permission unit that permits storage in the data storage area.

The data authentication method described in this specification is a data authentication method performed by a portable storage medium having a data storage area, and includes first authentication information held by a first control program stored in the data storage area. An authentication information generation step for generating authentication information when the generation ID matches the second authentication information generation ID held by the second control program, and data-specific information from the storage target data stored in the data storage area The first control program for causing the information processing apparatus to execute processing for adding additional information obtained by predetermined conversion of the data-specific information with the authentication information to the storage target data, together with the authentication information. A transmission step of transmitting to the information processing device; receiving storage target data to be stored in the data storage area from the information processing device; The additional information and the authentication information generated in the authentication information generation step are used to check the validity of the additional information, and if it is valid, the storage of the storage target data in the data storage area is permitted. A data authentication method including a permission step.

  The portable storage medium described in this specification has an effect that virus infection can be suppressed while maintaining versatility. Further, the data authentication program and the data authentication method described in the present specification have an effect that virus infection can be suppressed.

It is a figure which shows schematically the structure of PC which can connect USB memory. It is a block diagram which shows PC and USB memory. It is a flowchart which shows the process in USB memory when USB memory is connected to the USB connection interface of PC. It is a flowchart which shows the process of OS at the time of memorize | storing data in the storage area of USB memory from the application of PC. It is a flowchart which shows the process by the side of USB memory when the data block to which the signature was added is received. It is a figure which shows the state of PC and USB memory at the time of complete | finishing the process of FIG. It is a figure which shows the state of PC and USB memory corresponding to the process of FIG. 4, FIG.

  Hereinafter, an embodiment of a portable storage medium, a data authentication program, and a data authentication method will be described in detail with reference to FIGS.

  FIG. 1 schematically shows a configuration of a PC 100 as an information processing apparatus to which a USB memory 200 as a portable storage medium can be connected. The PC 100 includes a CPU 10, a ROM 12, a RAM 14, a hard disk drive (HDD) 18, an input unit 20, an output unit 22, and a USB connection interface 16, which are connected by a bus. The input means 20 includes a keyboard and a mouse, and the output means 22 includes a display such as a CRT and LCD, a printer, and the like. Information is exchanged with the USB memory connected via the USB connection interface 16. Various general-purpose programs are stored in the HDD 18, and the PC 100 can realize various functions by the CPU 10 executing the programs stored in the HDD 18.

  FIG. 2 is a diagram showing an embodiment of the present invention. In the example of FIG. 2, control such as the exchange of information with the USB memory 200 is performed by operating an OS (Operating System) 30 loaded on the PC 100.

  The USB memory 200 stores data (user data) created on the PC 100, a storage area 52 as a data storage area for storing the filter A60 as a control program, and a session key generation as an authentication information generation unit And a session key storage area 56 as a storage unit, and a filter B58. The filter A 60 stored in the storage area 52 is a write / read control program, and has a session key generation ID 62 and a session key area 64 for holding a session key. This filter A 60 is transmitted (loaded) to the OS 30 of the PC 100 via the session key detection module 66 under the instruction of the controller 68 of the filter B 58.

  The session key generator 54 generates a session key (70) as authentication information. This session key 70 is, for example, a one-time password. The session key storage area 56 stores (stores) the session key 70 generated by the session key generator 54.

  The filter B58 includes a session key detection module 66 as a permission unit and a controller 68 as a transmission unit. The session key detection module 66 holds the same session key generation ID 62 as the session key generation ID 62 included in the filter A60. Accordingly, the session key detection module 66 compares the session key generation ID of the filter transmitted from the storage area 52 to the PC 100 side with the session key generation ID held by itself to determine whether the filter is the filter A60. Can be determined. When the session key detection module 66 notifies the controller 68 that both session key generation IDs match, the controller 68 instructs the session key generator 54 to start generating a session key.

  Next, processing in the PC 100 and the USB memory 200 configured as described above will be described along the flowcharts of FIGS. 3 to 5 with reference to other drawings as appropriate.

  FIG. 3 is a flowchart for explaining processing in the USB memory 200 when the USB memory 200 is connected to the USB connection interface 16 of the PC 100. As shown in FIG. 3, in step S <b> 10, the controller 68 waits until the USB memory 200 is connected to the USB connection interface 16 of the PC 100. And if judgment of step S10 is affirmed, it will transfer to step S12. In step S12, the controller 68 starts loading the filter A60 onto the PC100.

  In the next step S14, the session key detection module 66 determines, under the instruction of the controller 68, whether or not the session key generation ID of the filter loaded in the PC 100 matches the session key generation ID held by itself. To do. The determination result here is notified to the controller 68. If the determination in step S14 is affirmative, it means that the filter A60 is loaded in the PC 100. In this case, the process proceeds to step S <b> 16, and under the instruction of the controller 68, the session key generator 54 generates a session key 70 and stores the generated session key 70 in the session key storage area 56. If the determination in step S14 is negative, the process proceeds to step S17, and the controller 68 stops loading the filter.

  In step S18, the controller 68 stores the session key generated in step S16 in the session key area of the filter A60. Next, in step S19, the controller 68 determines whether or not the loading of the filter A60 to the PC 100 is completed. If the determination here is affirmed, all the processes in FIG. 3 are terminated. Note that at the stage where the process of FIG. 3 is completed (the stage where step S14 is affirmed and completed), the PC 100 and the USB memory 200 are in the state shown in FIG. Specifically, in FIG. 6, the filter A 60 in which the session key 70 is stored for the session key area 64 is loaded in the OS 30 of the PC 100. In FIG. 6, the session key storage area 56 stores the same session key 70 as the session key stored in the filter A 60.

  Next, the processing of the OS 30 when storing data in the storage area 52 of the USB memory 200 from the general-purpose program (application) of the PC 100 after entering the state of FIG. 6 will be described with reference to the flowchart of FIG. .

  In step S <b> 20 of FIG. 4, the OS 30 receives an instruction from the application and determines whether to store (save) the data in the storage area 52 of the USB memory 200. When data is sent from the application to the OS 30 (see the thick arrow (1) in FIG. 7) and the determination is affirmed by the OS 30, the process proceeds to step S22.

  In step S22, on the OS 30, the filter A 60 obtains a hash value of the data block, encrypts the hash value with the session key 70, and generates a signature. The hash value is also called a message authentication code (MAC). As an encryption method, for example, 3DES (Triple DES), AES (Advanced Encryption Standard), or the like can be used. Then, after the signature is generated, the filter A 60 adds the signature to the data block (see the thick line arrow (2) in FIG. 7). Next, in step S24, the filter A60 transmits the data block with the signature added to the filter B58 (session key detection module 66) of the USB memory 200 (see the thick arrow (3) in FIG. 7). Thus, the process on the PC 100 side ends.

  Next, processing on the USB memory 200 side that has received the data block with the signature added will be described with reference to the flowchart of FIG. In the flowchart of FIG. 5, when the session key detection module 66 determines in step S30 that a data block has been sent, the process proceeds to step S32 and determines whether or not a signature is added to the data block. If the determination here is affirmed, the process proceeds to step S34, and the hash value H1 of the data block is calculated.

  Next, in step S36, the session key detection module 66 decrypts the signature added to the data block with the session key in the session key storage area 56 to obtain the value H2 (see the thick arrow (4) in FIG. 7). ). Here, it is assumed that a decryption method (opposite to encryption) corresponding to the above-described encryption method (3DES, AES, etc.) is used.

  Next, in step S38, the session key detection module 66 determines whether or not the value H1 and the value H2 match. Here, the signature is obtained by encrypting the hash value of the data block with the session key 70 as described in step S22. That is, if the data block passes through the filter A60, the value H2 obtained by decrypting the signature with the session key should be the hash value of the data block itself. Therefore, if the determination here is affirmed, it means that the data block has legitimately passed through the filter A60.

  Therefore, if the determination in step S38 is affirmative, it can be determined that the data block is safe (not a virus). Therefore, in step S40, the session key detection module 66 stores (saves) the data block in the storage area 52 (see the thick arrow (5) in FIG. 7). Thereafter, the entire process of FIG.

  On the other hand, if the determination in step S32 is negative, that is, if the signature is not added to the data block, or if the determination in step S38 is negative, that is, if the values H1 and H2 do not match, the data block This means that it has not been properly sent to the USB memory 200. That is, in such a case, there is a possibility that the data block to be stored in the USB memory 200 is irregular data that does not pass through the filter A60. Alternatively, it is considered that the filter A60 may be modified on the PC 100. Therefore, if the determination in step S32 or step S38 is negative, the session key detection module 66 discards the data block (does not store the data block) in step S42, and ends all the processes in FIG. .

  4 is executed every time a data storage request is issued from the application, and the process in FIG. 5 is executed every time data is sent from the PC 100 side.

  As described above in detail, according to the present embodiment, the USB memory 200 includes the storage area 52 for storing data to be stored transmitted from the PC 100, the session key generator 54 for generating the session key 70, A hash value is calculated from the data (data block) stored in the storage area 52, a filter A60 for adding a signature obtained by encrypting the hash value with the session key to the data block is transmitted to the PC 100, and the session key is The controller 68 that transmits to the PC 100, the session key storage area 56 that stores the session key 70 in the USB memory 200, the hash value of the data block, the signature, the session before the data block is stored in the storage area 52 The cell stored in the key storage area 56 On the basis of the activation key 70, and a session key detection module 66 to allow the storage to the storage area 52 of the data block. In this way, on the PC 100 side, the filter A60 adds a signature to the data block to be stored, and on the USB memory 200 side, whether the signature added to the data block is valid or not is determined as a data block. And the session key stored on the USB memory 200 side are used for confirmation (determination). The data block is stored in the storage area 52 only when it is valid. Therefore, the data is not stored in the storage area 52 when the data is transmitted to the USB memory 200 via an unauthorized route without passing through the filter A60 or when the filter A60 is tampered with. be able to. Thereby, storage of irregular data in the USB memory 200, that is, infection such as a virus can be suppressed. In this embodiment, the PC 100 does not require a dedicated application, a new interface, or the like, so that the versatility of the USB memory can be maintained.

  In this embodiment, the session key detection module 66 calculates a hash value from the data block before the data block is stored in the storage area 52, and the hash value H1 and the signature added to the data block. Is stored in the storage area 52 when the value H2 obtained as a result of decrypting with the session key matches. That is, if the data block does not pass through the filter A60, the possibility that the values H1 and H2 match is close to zero, and therefore, if the values H1 and H2 do not match, data storage is prohibited. Virus infection to the USB memory 200 can be suppressed.

  In the present embodiment, the filter A 60 calculates the signature by encrypting the hash value of the data block with the session key, and the session key detection module 66 decrypts the hash value H 1 of the data block and the signature with the session key. Therefore, it is possible to permit storage of only regular data in the storage area 52 with relatively simple calculation.

  In the above embodiment, the case where the hash value is used as the data-specific information, the session key is used as the authentication information, the encryption is used as the predetermined conversion, and the decryption is used as the reverse conversion of the predetermined conversion is not limited to this. Values and conversion methods may be used.

  In the above embodiment, the case where the portable storage medium is a USB memory has been described. However, the present invention is not limited to this. As portable storage media, for example, Memory Stick related products such as Memory Stick (registered trademark), Memory Stick Duo (registered trademark), Memory Stick Micro (registered trademark), SD card (registered trademark), MiniSD card (registered trademark), A MicroSD card (registered trademark), an xD card (registered trademark), or the like may be used. Further, a USB-HDD may be adopted instead of the USB memory.

  The above-described embodiment is an example of a preferred embodiment of the present invention. However, the present invention is not limited to this, and various modifications can be made without departing from the scope of the present invention.

52 Storage area (data storage area)
54 Session key generator (authentication information generator)
56 session key storage area (storage)
60 Filter A (control program)
66 Session key detection module (permission section)
68 Controller (Transmitter)
70 Session key (authentication information)
100 PC (information processing equipment)
200 USB memory (portable storage medium)

Claims (6)

A data storage area for storing a first control program that holds storage target data and a first authentication information generation ID transmitted from an external information processing apparatus;
A second control program holding a second authentication information generation ID;
An authentication information generation unit that generates authentication information when the first authentication information generation ID and the second authentication information generation ID match ;
The information processing apparatus executes processing for calculating data-specific information from the storage target data stored in the data storage area and adding the additional information obtained by predetermined conversion of the data-specific information with the authentication information to the storage target data. A transmission unit that transmits the first control program to the information processing apparatus together with the authentication information ;
A storage unit for storing the authentication information;
The additional information is received from the information processing apparatus by using storage target data stored in the data storage area, and using the data-specific information of the storage target data and the authentication information stored in the storage unit. The permission unit for permitting the storage of the data to be stored in the data storage area when it is valid,
A portable storage medium comprising:   The permission unit calculates data-specific information from the storage target data before the storage target data is stored in the data storage area, and the data-specific information and additional information added to the storage target data Is compared with the information obtained as a result of performing the inverse conversion to the predetermined conversion using the authentication information, and when both pieces of information match, the storage of the storage target data in the data storage area is permitted. The portable storage medium according to claim 1. The first control program calculates the additional information by encrypting a hash value of the storage target data with the authentication information,
The portable storage medium according to claim 2, wherein the permission unit compares a hash value of the storage target data with information obtained by decrypting the additional information using the authentication information. . A data authentication program used in a portable storage medium having a data storage area,
Computer
Authentication information is generated when the first authentication information generation ID held by the first control program stored in the data storage area matches the second authentication information generation ID held by the second control program An authentication information generator,
The information processing apparatus executes processing for calculating data-specific information from the storage target data stored in the data storage area and adding the additional information obtained by predetermined conversion of the data-specific information with the authentication information to the storage target data. Transmitting the first control program to be transmitted to the information processing apparatus together with the authentication information ; receiving storage target data stored in the data storage area from the information processing apparatus; and storing data of the storage target data The additional information and the authentication information generated by the authentication information generation unit are used to check the validity of the additional information, and if it is valid, the storage of the storage target data in the data storage area is permitted. Permission section,
A data authentication program characterized by functioning as A data authentication method performed by a portable storage medium having a data storage area,
Authentication information is generated when the first authentication information generation ID held by the first control program stored in the data storage area matches the second authentication information generation ID held by the second control program Authentication information generation step to perform,
The information processing apparatus executes processing for calculating data-specific information from the storage target data stored in the data storage area and adding the additional information obtained by predetermined conversion of the data-specific information with the authentication information to the storage target data. Transmitting the first control program to be transmitted to the information processing apparatus together with the authentication information ;
The additional information is received from the information processing apparatus using storage target data to be stored in the data storage area, and using the data-specific information of the storage target data and the authentication information generated in the authentication information generation step. A permission step for permitting storage of the data to be stored in the data storage area if it is valid;
Data authentication method including   In portable recording media,
  The information corresponding to the storage target data to be transmitted and stored from the information processing apparatus to the portable recording medium is calculated, and the conversion information obtained by converting the calculated information using authentication information is the storage target. A writing / reading control program for performing processing for adding to data and transmitting, and a transmitting unit for transmitting the authentication information to a connected information processing device;
  Based on the storage target data transmitted from the information processing apparatus, the information added to the storage target data, and the same authentication information as the authentication information, the received storage target data is stored in the portable recording medium. Is determined to be through the processing of the writing / reading control program transmitted to the information processing apparatus, and if the result of the determination is through the processing of the writing / reading control program, A permission unit that performs control to allow writing of the storage target data to a predetermined storage area;
A portable recording medium comprising:

Images