WO2007081007A1

WO2007081007A1 - Computer system, access limit method, and program

Info

Publication number: WO2007081007A1
Application number: PCT/JP2007/050422
Authority: WO
Inventors: Osamu Saisho
Original assignee: Nec Soft, Ltd.
Priority date: 2006-01-13
Filing date: 2007-01-15
Publication date: 2007-07-19
Also published as: JP2009086695A; TW200745903A

Abstract

When a peripheral device (5) is connected to a computer (10), peripheral device control means (3) acquires the existence information and reports it to communication control means (2). The communication control means (2) references a peripheral device use limit information database (4) containing information on the use limit of peripheral devices. Only when a peripheral device whose use is allowed is connected, the communication control device (2) returns the existence information on the peripheral device to an operating system (1) of the computer (10). When a peripheral device whose use is not allowed is connected, no existence information on the peripheral device is reported to the OS.

Description

Specification

Computer system, access restriction method, and program

Technical field

TECHNICAL FIELD [0001] The present invention relates to a computer system, an access restriction method, and a program.

, Concerning access restrictions (use restrictions) for peripheral devices connected to a computer system.

Background art

[0002] Personal computers have become increasingly popular in organizations such as corporations, and the leakage of computerized confidential information and personal information has become a major problem. In particular, with the widespread use of large-capacity small electronic recording media, this problem has been exacerbated by the ability to easily bring large amounts of information outside the organization. In addition, system stoppage due to the invasion of computer viruses into computer systems has become a major threat to companies and the like, and the infection path of disk devices using small electronic recording media is known as the infection path of computer viruses. RU

[0003] In a computer system, a method is known in which access to a peripheral device such as a disk device is individually restricted, and file take-out and carry-in are restricted by this access restriction. By restricting file export, leakage of corporate information and personal information can be prevented, and by restricting file import, infection by computer viruses from small electronic recording media is prevented.

[0004] An administrator of an organization such as a company records information on the access restriction in a recording device in the computer system. When the user connects the peripheral device to the computer, it is determined whether or not the peripheral device is permitted to be accessed. Thereafter, when the user selects access to the peripheral device, only the permitted peripheral device can be accessed, and access to the peripheral device to be restricted is not permitted. For example, Japanese Patent Application Laid-Open No. 7-104882 discloses an access restriction technique in a computer system.

[0005] In conventional access restrictions in computer systems, when a user chooses to access a restricted peripheral device, the operating system (OS) Error log is output. Since the output of this error log gives great concern to the user about the handling of the computer system, there is a problem that the user must always be aware of the limitation of access to his / her peripheral devices. .

Disclosure of the invention

[0006] In view of the above-described problems of the prior art, the object of the present invention is that when an access is restricted to a peripheral device, an error log generated by the OS is generated when the user accesses the peripheral device with the access restriction. It is to provide an improved computer system, such a method and program that can be prevented.

[0007] The present invention is a computer system controlled by an operating system (OS),

A storage device for storing restriction information related to access restriction of peripheral devices; peripheral device control means for acquiring presence information of the peripheral devices such as peripheral device power; and acquiring presence information of peripheral devices from the peripheral device control means; There is provided a computer system comprising communication control means for referring to the restriction information and excluding the presence information of the peripheral device whose access is restricted, and issuing the presence information of the peripheral device to the OS.

[0008] The present invention is also a method of controlling a computer system using an operating system (OS),

Using peripheral device control means to obtain presence information of the peripheral device from the peripheral device force;

When the presence information on the peripheral device is acquired, the presence information on the peripheral device is stored in the OS by referring to the database storing the access restriction information on the peripheral device and excluding the presence information on the peripheral device whose access is restricted. And obtaining a method characterized by comprising:

[0009] The present invention is also a program for assisting an operating system (OS) for controlling a computer system,

Using the peripheral device control means, the peripheral device presence information of the peripheral device is obtained. A step to obtain,

When the presence information on the peripheral device is acquired, the presence information on the peripheral device is stored in the OS by referring to the database storing the access restriction information on the peripheral device and excluding the presence information on the peripheral device whose access is restricted. A program characterized by causing a computer to execute the obtaining step is provided.

[0010] In the computer system, access restriction method, and program of the present invention, the presence information of the peripheral device for which access is restricted is not notified to the OS, so the user tries to access the peripheral device for which access is restricted. Since the OS error log associated with accessing such peripheral devices is not output, there is no concern for the user. As a result, users can handle computers without being aware of whether access is restricted. In addition, since the OS does not notify the presence information of the peripheral devices, there is an advantage that the device driver automatic installation processing by o S is not started and processing unnecessary for the user is not executed.

Brief Description of Drawings

FIG. 1 is a block diagram showing a configuration of a computer system of the present invention.

BEST MODE FOR CARRYING OUT THE INVENTION

Next, embodiments of the present invention will be described in detail with reference to the drawings. Referring to FIG. 1, a computer system according to an embodiment of the present invention includes a computer 10 having an OSl, a communication control means 2, and a peripheral device control means 3, and a storage device for storing programs and files. It comprises a plurality of peripheral devices 5 and a peripheral device use restriction information database (storage device) 4.

[0013] The OS1 performs control related to the start and termination of a computer, and access to various programs and peripheral devices. The communication control unit 2 mediates communication related to the peripheral device presence information acquisition request issued from the OS 1 for a part of the communication between the OS 1 and the peripheral device control unit 3.

[0014] Peripheral device control means 3 is a function that transmits a processing request between the application and the peripheral device in response to a control request from OS1, and a function that returns presence information of the peripheral device to OS 1. Have The peripheral device 5 is a variety of resources connected to the computer, including peripheral devices subject to usage restrictions, and is a peripheral device connected to the computer main body 10.

[0016] The peripheral device restriction information database 4 is connected to all computers in the organization by a LAN or the like, and information on access restriction to peripheral devices in each computer is registered by an administrator. In the access restriction information to be registered, for example, a program, a file, or a peripheral device subject to access restriction and a condition for releasing the access restriction are registered correspondingly. The restriction information database 4 can be managed locally, in addition to management on the LAN. In the access restriction release condition, for example, PIN (personal identification number) information of a specific user permitted to access is registered for each peripheral device.

Next, the flow of processing in the embodiment of the present invention will be described. When a new peripheral device is connected to the computer system while the computer system is operating, the peripheral device control means 3 issues a connection notification for notifying the connection to the communication control means 2. In a computer to which the peripheral device 5 is already connected, when the OS 1 is started, the peripheral device control means 3 issues a connection notification for the peripheral device 5 to the OS 1 immediately after the start. Hereinafter, the operation of the computer system of the above embodiment will be described by taking as an example a case where a plurality of peripheral devices are already connected to the computer and the OS 1 is subsequently started.

When the OS 1 receives a peripheral device connection notification from the peripheral device control unit 3 via the communication unit 2, the OS 1 issues a request for acquiring peripheral device presence information to the communication control unit 2. The peripheral device presence information is information that can individually identify peripheral devices connected to the computer, for example, ID numbers of the peripheral devices. When the communication control means 2 receives the presence information acquisition request from the OS 1, it issues the acquisition request to the peripheral device control means 3. When the peripheral device control unit 3 receives the peripheral device presence information acquisition request from the communication control unit 2, the peripheral device control unit 3 responds to the request and returns a list of the currently connected peripheral device presence information to the communication control unit 2. The communication control means 2 refers to the peripheral device use restriction information database 4 and acquires the use restriction information for each connected peripheral device. The communication control means 2 receives the presence information of the plurality of peripheral devices received. To the OS1 except for the presence information of the peripheral devices for which access is restricted. OS1 controls various applications according to the received peripheral device presence information.

[0019] Immediately after the activation, OS1 displays a screen that prompts the user to input the PIN information, in addition to the presence information acquisition request described above. The user inputs the user's PIN information from an input device such as a keyboard. When the communication control means 2 receives the PIN information, it stores it in a register, searches the peripheral device use restriction information database 4 for the release condition using the PIN information as a key, and restricts the access by the user. Get the ID numbers of peripheral devices that can be released. If there is a peripheral device whose access restriction is released, the communication control means 2 notifies the OS 1 of the presence information of the peripheral device. OS1 controls the application accordingly. If the access restriction is changed based on the PIN information, the computer is restarted to make it effective. The OS 1 then displays a list of accessible peripheral devices on the display device, for example, according to the program used, and waits for the user's selection before accessing the peripheral devices.

[0020] When peripheral device 5 is newly connected after OS1 is started, peripheral device control means 3 issues a connection notification for the connected peripheral device 5, and OS1 responds to the connection notification. Issue a presence information acquisition request. When the peripheral device control means 3 notifies the presence information acquired from the connected peripheral device 5, the communication control means 2 refers to the peripheral device use restriction information database 4 to restrict access to the connected peripheral device 5. It is determined whether or not the force is applied. The communication control means 2 does not issue the presence information of the connected peripheral device 5 to the OS 1 if the access is restricted, and directs the presence information of the peripheral device to the OS 1 if there is no access restriction. Issued.

[0021] In the conventional computer system, in response to the peripheral device presence information acquisition request issued by the OS, the peripheral device control means 3 restricts the access by the administrator, including all peripheral devices. The presence information of the peripheral device is returned. When a user attempts to access a peripheral device subject to access restrictions, the OS cannot access it. The user will feel uneasy about the handling of the computer. In this embodiment, since the presence information of the peripheral device subject to access restriction is removed from the OS1 presence information list, the access request by the user itself does not occur in the peripheral device to which access is restricted. No error log is issued. This eliminates user anxiety due to the occurrence of error logs. In addition, if the access restriction is released, the peripheral device can be automatically accessed, so the user can handle the computer without being aware of the access restriction and whether or not it is removed. The

[0022] In the computer system of the present invention, the communication control means can be configured by a program incorporated in the OS or by a program that assists the OS. Further, the program storing the method of the present invention can be configured as a program part incorporated in the OS, or can be configured as an independent program that assists the OS.

Although the present invention has been described based on the preferred embodiment, the computer system, the access restriction method, and the program of the present invention are not limited to the configuration of the above embodiment, and are not limited to the configuration of the above embodiment. The structural force that has been variously modified and changed is also included in the scope of the present invention.

Industrial applicability

The present invention can be suitably applied to restrict access to peripheral devices of a personal computer installed in an office of a company or the like.

Claims

The scope of the claims

[1] A computer system controlled by an operating system (OS), a storage device (4) for storing restriction information regarding access restrictions of the peripheral device (5), and a peripheral device (5) Peripheral device control means (3) to obtain the presence information of

When the peripheral device presence information is obtained from the peripheral device control means (3), the restriction information is referred to, and the presence information of the peripheral device is obtained by using the OS (1) except for the presence information of the peripheral device whose access is restricted. A computer system characterized by comprising communication control means (2) for issuing to a computer.

[2] The computer system according to claim 1, wherein the communication control means (2) corrects an access restriction of the peripheral device with reference to the storage device (4) in response to a PIN input by a user.

[3] A method of controlling a computer system using an operating system (OS),

Using the peripheral device control means (3), the peripheral device (5) obtains the presence information of the peripheral device from the force,

When the presence information of the peripheral device is acquired, the presence information of the peripheral device is obtained by referring to the database (4) in which the access restriction information to the peripheral device is stored and excluding the presence information of the peripheral device whose access is restricted. And obtaining in a method.

[4] The method according to claim 3, further comprising the step of modifying access restrictions of the peripheral device by referring to the database (4) in response to a PIN input by a user.

[5] A program that assists an operating system (OS) that controls a computer system.

When the presence information of the peripheral device (5) is obtained, the presence of the peripheral device with the access restriction is referred to by referring to the database (4) storing the access restriction information to the peripheral device. A program that causes a computer to execute the step of acquiring presence information of peripheral devices in the OS, excluding presence information.

6. The program according to claim 5, further comprising a step of causing the computer to execute a step of correcting an access restriction of the peripheral device with reference to the database (4) in response to a PIN input by a user.