JP5332751B2 - Storage device, access restriction method and program - Google Patents

Description

  The present invention relates to a storage device, an access restriction method, and a program.

  In recent years, a system in which an information processing apparatus that processes arbitrary information accesses a storage device that stores the information to perform processing has become widespread.

  However, an information processing apparatus connected to a storage device can access the storage device, which is not preferable from the viewpoint of information security.

  Therefore, only when the host ID managed by the host unit, which is an information processing apparatus that processes information, matches the host ID written in the hard disk device, which is a storage device connected to the host unit, the host unit is the hard disk device. A technique capable of accessing the network is considered (for example, see Patent Document 1).

JP 2001-229613 A

  However, the host ID described in Patent Document 1 is unique to the information processing apparatus. Therefore, only the information processing device that has written the host ID in the storage device can access the storage device. That is, there is a problem that this information processing apparatus cannot be accessed if it fails or a user who has the authority to access the storage apparatus tries to access the storage apparatus using another information processing apparatus.

  It is an object of the present invention to provide a storage device, an access restriction method, and a program that solve the above-described problems.

  In order to solve the above problems, a storage device of the present invention is a storage device that stores information, and is uniquely assigned to a storage unit that stores the information and an information processing device that can access the storage device A unique information storage unit for storing the license specific information, a password storage unit for storing a license password for permitting access to the storage device, and an information processing device connected to the storage device. The trial unique information given to the information processing apparatus, and if the permission unique information and the trial unique information do not match, an acquisition unit that requests a trial password from the information processing apparatus to which the trial unique information is given, and On the other hand, when the trial password transmitted from the information processing apparatus matches the license password, or the license-specific information matches the trial-specific information. If, and an access control unit which permits access to the storage unit of the information processing apparatus.

  In order to solve the above problem, an access restriction method of the present invention is an access restriction method for restricting access to a storage device having a storage unit for storing information from an information processing device, and is connected to the storage device. Processing for acquiring trial-specific information uniquely assigned to the information processing device from the information processing device, and permission-specific information uniquely assigned to the information processing device that can access the storage device stored in the storage device And a process for requesting a trial password from the information processing apparatus to which the trial specific information is assigned if the permission specific information and the trial specific information do not match as a result of the comparison A trial password transmitted from the information processing device in response to the request, and a permission for permitting access to the storage device stored in the storage device. When the trial password and the license password match as a result of the process of comparing the password and the comparison, or when the license-specific information matches the trial-specific information, the information processing apparatus stores the memory A process for permitting access to the part.

  In addition, a program to be executed by a computer, which acquires trial-specific information uniquely assigned to the information processing apparatus from the information processing apparatus connected to the storage apparatus to a storage apparatus having a storage unit for storing information A procedure for comparing the trial-specific information with the license-specific information uniquely assigned to the information processing apparatus accessible to the storage device stored in the storage device, and as a result of the comparison, the license-specific information If the information and the trial specific information do not match, a procedure for requesting a trial password to the information processing apparatus provided with the trial specific information, a trial password transmitted from the information processing apparatus in response to the request, A process of comparing the storage device with a permission password for permitting access to the storage device, and as a result of the comparison, the trial password When said permission password and coincides with, or, if the license-specific information and the trial-specific information match, to execute a procedure to allow access to the storage unit from the information processing apparatus.

  According to the present invention, a storage device having a storage unit that stores information acquires trial-specific information uniquely assigned to the information processing device from the information processing device connected to the storage device. Then, the storage device compares the license-specific information uniquely assigned to the information processing device that can access the storage device stored in the storage device with the trial-specific information. As a result of the comparison, if the license-specific information does not match the trial-specific information, the storage device requests a trial password from the information processing apparatus to which the trial-specific information is assigned. Then, the storage device compares the trial password transmitted from the information processing device in response to the request with the permission password for permitting access to the storage device stored in the storage device. As a result of the comparison, if the trial password and the license password match, or if the license-specific information matches the trial-specific information, the storage device permits access from the information processing device to the storage unit.

  Due to such a configuration, when the information processing device in which the license-specific information is written fails, or other information processing other than the information processing device in which the user having the authority to access the storage device has written the license-specific information The storage device can be accessed using the device.

It is a figure which shows the connection form of the memory | storage device and information processing apparatus according to embodiment of this invention. It is a figure which shows the structure of the memory | storage device according to embodiment of this invention. It is a figure which shows an example of a screen structure of a password operation screen. It is a figure which shows an example of a screen structure of an initialization operation screen. 4 is a flowchart illustrating an operation in which a storage device controls access from an information processing device to a storage unit.

  Hereinafter, a storage device (including an access restriction method and a program) according to an embodiment of the present invention will be described.

  As shown in FIG. 1, the storage device 1 of the present embodiment is connected to an information processing device 2 that processes arbitrary information. The storage device 1 stores arbitrary information written from the information processing device 2 or outputs information in the storage device 1 in response to a read request from the information processing device 2.

  Note that examples of the storage device 1 include a hard disk device and an arbitrary memory. An example of the information processing apparatus 2 is a general PC (Personal Computer).

  Next, the configuration of the storage device 1 shown in FIG. 1 will be described with reference to FIG. As illustrated in FIG. 2, the storage device 1 includes a connection unit 11, an acquisition unit 121, a comparison unit 122, an access control unit 123, an initialization unit 124, a unique information storage unit 13, and a password storage unit 14. And the storage unit 15.

  The connection unit 11 is a connection interface for connecting the information processing device 2 and the storage device 1. When the connection unit 11 is connected to the information processing apparatus 2, the connection unit 11 notifies the acquisition unit 121 of that fact.

  In addition, the connection unit 11 transmits the unique information request output from the acquisition unit 121 to the information processing apparatus 2. The unique information request is a signal for requesting a serial number.

  The connection unit 11 also acquires the serial number (hereinafter referred to as “S / N”) of the information processing device 2 transmitted from the information processing device 2 connected to the storage device 1, the acquisition unit 121 and the comparison unit. To 122.

  Here, the S / N of the information processing device 2 connected to the storage device 1 is “trial specific information” uniquely assigned to the information processing device 2. The S / N stored in the unique information storage unit 13 is “licensed unique information” uniquely given to the information processing apparatus that can access the storage device 1. The license-specific information and the trial-specific information are not limited to S / N, but may be a general WWN (World Wide Name) fixedly assigned to a fiber channel switch, an HBA (host bus adapter), or the like.

  In addition, the connection unit 11 transmits a password request for requesting the trial password output from the acquisition unit 121 to the information processing apparatus 2 to which the trial specific information is assigned. The password stored in the password storage unit 14 is a “permission password” for permitting access to the storage device 1 of the information processing device 2.

  Note that when the password request transmitted from the storage device 1 is received, the information processing device 2 displays a password operation screen. Here, as shown in FIG. 3, the password operation screen is a screen for the information processing apparatus 2 to accept the input of the password from the user. Then, the information processing device 2 receives the password input from the user via the password operation screen and transmits the password to the storage device 1. Then, the connection unit 11 outputs the password transmitted from the information processing device 2 to the comparison unit 122. Note that the password transmitted from the information processing apparatus 2 is a “trial password”.

  In addition, the connection unit 11 transmits to the information processing apparatus 2 a request for determining whether or not the storage unit 15 output from the acquisition unit 121 is to be initialized and requests initialization information.

  Note that when the availability information request transmitted from the storage device 1 is received, the information processing device 2 displays an initialization operation screen. As illustrated in FIG. 4, the initialization operation screen is a screen for the information processing apparatus 2 to accept input of information indicating whether to initialize the storage unit 15 from the user. When the information processing apparatus 2 receives an input of information indicating that the storage unit 15 is to be initialized via the initialization operation screen (in the example of FIG. 4, when “Yes” is selected), Initialization availability information indicating this is transmitted to the storage device 1. In this case, the connection unit 11 outputs initialization availability information indicating that the storage unit 15 transmitted from the information processing device 2 is initialized to the initialization unit 124.

  In addition, when the information processing apparatus 2 receives input of information indicating that the storage unit 15 is not initialized via the initialization operation screen (in the example of FIG. 4, when “No” is selected), Initialization availability information indicating this is transmitted to the storage device 1. In this case, the connection unit 11 outputs initialization availability information indicating that the storage unit 15 transmitted from the information processing device 2 is not initialized to the initialization unit 124.

  When the connection unit 11 is notified that the acquisition unit 121 is connected to the information processing device 2, the S / N uniquely assigned to the information processing device that can access the storage device 1 is stored in the specific information storage unit 13. Determine if it is remembered. As a result of the determination, when the S / N is stored in the unique information storage unit 13, the acquisition unit 121 outputs a unique information request for requesting S / N (trial unique information) to the connection unit 11. If the S / N is not stored in the unique information storage unit 13 as a result of determination, the acquisition unit 121 inquires of the information processing device 2 via the connection unit 11 whether to initialize the storage unit 15. . In order to make this inquiry, in the present embodiment, the acquisition unit 121 outputs to the connection unit 11 an availability information request for requesting initialization availability information indicating whether the storage unit 15 can be initialized. In response to an inquiry from the acquisition unit 121, when the information processing apparatus 2 instructs to initialize the storage unit 15, the initialization unit 124 initializes the storage unit 15.

  Further, when the initialization unit 124 is notified that the initialization of the storage unit 15 has been completed, the acquisition unit 121 outputs a unique information request to the connection unit 11. In this case, the acquisition unit 121 writes the S / N (trial specific information) of the information processing apparatus 2 output from the connection unit 11 into the specific information storage unit 13.

  When the acquisition unit 121 is notified from the initialization unit 124 that the storage unit 15 is not initialized, or when the S / N of the information processing apparatus 2 does not match the S / N in the specific information storage unit 13 The password request for requesting the trial password is output to the connection unit 11.

  The comparison unit 122 compares the S / N of the information processing apparatus 2 output from the connection unit 11 with the S / N stored in the unique information storage unit 13.

  The comparison unit 122 compares the password of the information processing device 2 output from the connection unit 11 with the password in the password storage unit 14.

  When the S / N (trial unique information) of the information processing device 2 and the S / N (licensed unique information) in the unique information storage unit 13 match, the access control unit 123 or the password ( When the (trial password) matches the password in the password storage unit 14 (permission password), access from the information processing apparatus 2 to the storage unit 15 is permitted.

  Note that, by default, the access control unit 123 is in a state where access from the information processing apparatus 2 to the storage unit 15 is prohibited.

  The initialization unit 124 determines whether the initialization availability information output from the connection unit 11 indicates that the storage unit 15 is initialized or the storage unit 15 is not initialized.

  As a result of this determination, the initialization unit 124 executes initialization of the storage unit 15 when the initialization availability information output from the connection unit 11 indicates that the storage unit 15 is to be initialized. Thereafter, the initialization unit 124 notifies the acquisition unit 121 that the initialization of the storage unit 15 has been completed. As a result of the determination, if the initialization unit 124 indicates that the initialization availability information output from the connection unit 11 indicates that the storage unit 15 is not initialized, the initialization unit 124 notifies the acquisition unit 121 accordingly.

  Note that the initialization unit 124 receives an initialization request for requesting initialization of the storage unit 15 from the information processing device 2 when access from the information processing device 2 to the storage unit 15 is permitted. Also, the storage unit 15 is initialized.

  The unique information storage unit 13 stores S / N (licensed unique information) that is uniquely assigned to the information processing apparatus that can access the storage device 1.

  The password storage unit 14 stores a password (permission password) for permitting access to the storage unit 15 of the information processing apparatus 2. An example of the unique information storage unit 13 and the password storage unit 14 is a ROM (Read Only Memory).

  The storage unit 15 stores arbitrary information written from the information processing apparatus 2 connected to the connection unit 11. In addition, information in the storage unit 15 is output in response to a read request from the information processing apparatus 2. Examples of the storage unit 15 include a hard disk and a memory that can store a large amount of information.

  The storage unit 15 stores a predetermined dummy image.

  The storage unit 15 stores data indicating a password operation screen and data indicating an initialization operation screen.

  Next, an operation in which the storage device 1 controls access from the information processing device 2 to the storage unit 15 will be described in detail with reference to FIG.

  As shown in FIG. 5, first, in step 301, when the connection unit 11 is connected to the information processing apparatus 2, the connection unit 11 notifies the acquisition unit 121 to that effect.

  In step 302, the acquisition unit 121 determines whether or not the S / N uniquely assigned to the information processing apparatus that can access the storage device 1 is stored in the unique information storage unit 13. As a result of the determination, when the S / N is stored in the unique information storage unit 13, the acquisition unit 121 outputs a unique information request for requesting S / N (trial unique information) to the connection unit 11.

  In step 303, the connection unit 11 transmits the unique information request output from the acquisition unit 121 to the information processing apparatus 2. Thereafter, the connection unit 11 receives from the information processing device 2 an S / N (trial specific information) that is uniquely assigned to the information processing device 2 connected to the storage device 1, and sends the S / N to the comparison unit 122. Output.

  In step 304, the comparison unit 122 then outputs the S / N (trial specific information) of the information processing apparatus 2 output from the connection unit 11 and the S / N (license) stored in the specific information storage unit 13. (Proprietary information).

  If the S / N of the information processing device 2 matches the S / N in the unique information storage unit 13 as a result of the comparison, the access control unit 123 transfers the information from the information processing device 2 to the storage unit 15 in step 305. Allow access.

  On the other hand, if the result of determination in step 302 is that S / N is not stored in the unique information storage unit 13, the acquisition unit 121 determines whether to initialize the storage unit 15 via the connection unit 11. Contact In order to make this inquiry, in the present embodiment, the acquisition unit 121 outputs to the connection unit 11 a request for determining whether or not the storage unit 15 can be initialized.

  In step 306, the connection unit 11 transmits the availability information request output from the acquisition unit 121 to the information processing apparatus 2.

  Note that when the availability information request transmitted from the storage device 1 is received, the information processing device 2 displays an initialization operation screen. When the information processing apparatus 2 receives an input of information indicating that the storage unit 15 is to be initialized via the initialization operation screen (in the example of FIG. 4, when “Yes” is selected), Initialization availability information indicating this is transmitted to the storage device 1. In this case, the connection unit 11 outputs initialization availability information indicating that the storage unit 15 transmitted from the information processing device 2 is initialized to the initialization unit 124. In addition, when the information processing apparatus 2 receives input of information indicating that the storage unit 15 is not initialized via the initialization operation screen (in the example of FIG. 4, when “No” is selected), Initialization availability information indicating this is transmitted to the storage device 1. In this case, the connection unit 11 outputs initialization availability information indicating that the storage unit 15 transmitted from the information processing device 2 is not initialized to the initialization unit 124.

  Thereafter, in step 307, the initialization unit 124 indicates whether the initialization availability information output from the connection unit 11 indicates that the storage unit 15 is initialized or the storage unit 15 is not initialized. Is determined.

  When the initialization unit 124 determines that the initialization availability information output from the connection unit 11 indicates that the storage unit 15 is to be initialized, the initialization unit 124 initializes the storage unit 15. Then, when the initialization of the storage unit 15 is completed, the initialization unit 124 notifies the acquisition unit 121 to that effect.

  Then, the acquisition unit 121 outputs a unique information request for requesting S / N to the connection unit 11. Subsequently, in step 308, the connection unit 11 transmits the unique information request output from the acquisition unit 121 to the information processing apparatus 2.

  Thereafter, the connection unit 11 outputs the S / N of the information processing device 2 transmitted from the information processing device 2 to the acquisition unit 121. Then, in step 309, the acquisition unit 121 writes the S / N (trial specific information) of the information processing apparatus 2 output from the connection unit 11 to the specific information storage unit 13. Subsequently, in step 305, the access control unit 123 permits access from the information processing apparatus 2 to the storage unit 15.

  On the other hand, if it is determined in step 307 that the initialization availability information output from the connection unit 11 indicates that the storage unit 15 is not initialized, the initialization unit 124 notifies the acquisition unit 121 of that fact. To do. Then, the acquisition unit 121 outputs a password request for requesting a trial password to the connection unit 11. Further, as a result of the comparison in step 304, even when the S / N of the information processing device 2 does not match the S / N in the unique information storage unit 13, the acquisition unit 121 outputs a password request to the connection unit 11. .

  In step 310, the connection unit 11 transmits the password request output from the acquisition unit 121 to the information processing apparatus 2. Note that when the password request transmitted from the storage device 1 is received, the information processing device 2 displays a password operation screen. Then, the information processing device 2 receives the password input from the user via the password operation screen and transmits the password to the storage device 1.

  Then, the connection unit 11 outputs the password transmitted from the information processing device 2 to the comparison unit 122. Subsequently, in step 311, the comparison unit 122 compares the password output from the connection unit 11 with the password in the password storage unit 14.

  As a result of the comparison, when the password transmitted from the information processing device 2 matches the password in the password storage unit 14, the access control unit 123 accesses the storage unit 15 from the information processing device 2 in step 305. To give permission.

  When the password transmitted from the information processing device 2 does not match the password in the password storage unit 14, the access state from the information processing device 2 to the storage unit 15 is kept prohibited. Thus, a series of operations in which the storage device 1 controls access from the information processing device 2 to the storage unit 15 ends.

  As described above, according to the storage device 1 of the present invention, the storage device 1 can be used from the information processing device 2 other than the information processing device in which the host ID is written.

  For this reason, when an information processing apparatus connected to the storage device 1 fails or when a user who has authority to access the storage device 1 tries to access the storage device 1 using another information processing device 2. In addition, the information processing device 2 can access the storage device 1.

  In the present invention, the processing in the storage device 1 is recorded on a recording medium that can be read by the storage device 1 in addition to the above-described dedicated hardware. The program recorded on the recording medium may be read into the storage device 1 and executed. The recording medium readable by the storage device 1 refers to a transfer medium such as a floppy disk (registered trademark), a magneto-optical disk, a DVD, and a CD, as well as an HDD built in the storage device 1. For example, the program recorded in the recording medium is read by the comparison unit 122 and the access control unit 123 included in the storage device 1, and the same processing as described above is performed under the control of the comparison unit 122 and the access control unit 123. Done.

  Here, the comparison unit 122 and the access control unit 123 included in the storage device 1 operate as a computer that executes a program read from a recording medium on which the program is recorded.

  The present invention has been described above with reference to the embodiments, but the present invention is not limited to the above embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention without departing from the gist of the present invention.

DESCRIPTION OF SYMBOLS 1 Storage device 11 Connection part 121 Acquisition part 122 Comparison part 123 Access control part 124 Initialization part 13 Unique information storage part 14 Password storage part 15 Storage part 2 Information processing apparatus

Claims (3)

A storage device for storing information,
A storage unit for storing the information;
A unique information storage unit for storing license-specific information uniquely assigned to the information processing apparatus accessible to the storage device;
A password storage unit for storing a license password for permitting access to the storage device;
If the trial specific information uniquely assigned to the information processing apparatus is acquired from the information processing apparatus connected to the storage device, and the license specific information does not match the trial specific information, the trial specific information is provided. An acquisition unit that requests a trial password from the information processing apparatus;
When the trial password transmitted from the information processing apparatus in response to the request matches the license password, or when the license specific information matches the trial specific information, the storage of the information processing apparatus An access control unit that permits access to the unit ,
An initialization unit for initializing the storage unit,
The acquisition unit inquires whether or not to initialize the storage unit to the information processing apparatus connected to the storage device when the permission specific information is not stored in the specific information storage unit,
When the information processing apparatus connected to the storage device is instructed to initialize the storage unit, the initialization unit initializes the storage unit, and after the initialization is completed, the acquisition A section that acquires the trial specific information from the information processing apparatus, writes the acquired trial specific information as the permission specific information in the specific information storage section, and the access control section To allow access to the storage unit,
When the information processing device connected to the storage device is instructed not to initialize the storage unit, the acquisition unit acquires the trial password from the information processing device, and the acquired trial password is The storage device, wherein the access control unit permits the information processing device to access the storage unit only when it matches the permission password . An access restriction method for restricting access to a storage device having a storage unit for storing information from an information processing device,
Processing for acquiring trial-specific information uniquely given to the information processing device from the information processing device connected to the storage device;
A process of comparing the trial specific information with the license specific information uniquely assigned to the information processing device accessible to the storage device stored in the specific information storage unit of the storage device;
As a result of the comparison, when the license-specific information does not match the trial-specific information, a process of requesting a trial password to the information processing apparatus to which the trial-specific information is given;
A process of comparing a trial password transmitted from the information processing apparatus in response to the request and a permission password for permitting access to the storage device stored in the storage device;
As a result of the comparison, when the trial password and the license password match, or when the license-specific information matches the trial-specific information, a process for permitting access from the information processing apparatus to the storage unit and,
When the licensed unique information is not stored in the unique information storage unit, a process of querying the information processing device connected to the storage device whether to initialize the storage unit;
When the information processing apparatus connected to the storage device is instructed to initialize the storage unit in response to the inquiry, the storage unit is initialized, and after the initialization is completed, Acquiring the trial specific information from the information processing device, writing the acquired trial specific information as the license specific information in the specific information storage unit, and permitting the information processing device to access the storage unit Processing,
When the information processing device connected to the storage device is instructed not to initialize the storage unit in response to the inquiry, the trial password is acquired from the information processing device, and the acquired attempt is made. And a process of permitting the information processing apparatus to access the storage unit only when the password matches the permission password . A procedure for acquiring trial-specific information uniquely assigned to an information processing device from an information processing device connected to the storage device to a storage device having a storage unit for storing information;
A procedure for comparing the trial specific information with the license specific information uniquely assigned to the information processing apparatus accessible to the storage device stored in the specific information storage unit of the storage device;
As a result of the comparison, if the license-specific information and the trial-specific information do not match, a procedure for requesting a trial password to the information processing apparatus to which the trial-specific information is given;
A process of comparing a trial password transmitted from the information processing apparatus in response to the request and a permission password for permitting access to the storage device stored in the storage device;
As a result of the comparison, when the trial password and the license password match, or when the license-specific information matches the trial-specific information, a procedure for permitting access from the information processing apparatus to the storage unit When,
A procedure for inquiring of the information processing apparatus connected to the storage device whether or not to initialize the storage unit when the permission specific information is not stored in the specific information storage unit;
When the information processing apparatus connected to the storage device is instructed to initialize the storage unit in response to the inquiry, the storage unit is initialized, and after the initialization is completed, Acquiring the trial specific information from the information processing device, writing the acquired trial specific information as the license specific information in the specific information storage unit, and permitting the information processing device to access the storage unit Procedure and
When the information processing device connected to the storage device is instructed not to initialize the storage unit in response to the inquiry, the trial password is acquired from the information processing device, and the acquired attempt is made. A program for causing the information processing apparatus to execute a procedure for permitting access to the storage unit only when a password matches the permission password .

Images