Port lock management system

Abstract

To provide a port lock management system capable of more efficiently managing port locks connected to a communication port of an information processing device.SOLUTION: A port lock management system S manages a port lock 20 that is inserted to disable a communication port 104a provided in an operator terminal 10, and includes a port measurement unit 104b that acquires connection information of the port lock 20 connected to the communication port 104a, and a port lock connection determination unit 126 that determines whether or not the port lock 20 is connected to the communication port 104a on the basis of the acquired connection information, and outputs determination result information on the basis of the determination result.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a port lock management system. [Background technology]

[0002] Conventionally, there are known technologies for preventing the introduction of malware or information leakage due to unauthorized access to a computer network. Patent Document 1 is an example of this type of technology. Patent Document 1 describes a port monitoring device and a port monitoring method in which a dummy connector is inserted into a connector that is not used for connecting to a user terminal, each lock detection unit detects the lock state of the connector, each port monitoring unit detects the port state, and the detected information is periodically collected to recognize unauthorized use of the port. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2007-201932 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, in the above technology, since there is a risk that a port lock (dummy connector) connected to a communication port may be pulled out and used illegally, it is necessary to manage the connection status of the port lock. However, in the port monitoring device and port monitoring method described in Patent Document 1, although the communication ports (ports) of the switches for constructing the network are monitored, the port locks connected to the communication ports of the information processing devices themselves on the network are not monitored and can only be confirmed visually, leaving room for improvement in terms of efficiency.

[0005] An object of the present invention is to provide a port lock management system capable of more efficiently managing port locks connected to communication ports of an information processing device. [Means for solving the problem]

[0006] (1) The port lock management system of the present invention is a system for managing a port lock that is inserted to disable a communication port provided in an information processing device, and includes a connection information acquisition unit that acquires connection information of the port lock connected to the communication port, a port lock connection determination unit that determines whether or not the port lock is connected to the communication port based on the acquired connection information, and a determination result output unit that outputs determination result information based on the determination result by the port lock connection determination unit.

[0007] The port lock management system according to the present invention (1) can more efficiently manage the port locks connected to the communication ports of the information processing device.

[0008] (2) The portlock management system described in (1) includes an information processing device having the communication port, a first communication unit capable of transmitting information to the outside, and the connection information acquisition unit, the portlock having a terminal unit that can be inserted and removed from the communication port, a second communication unit capable of receiving information from the outside, the portlock connection determination unit, the determination result output unit, and an alert issuing device capable of issuing an alert, wherein the connection information acquisition unit acquires the connection information of the portlock connected to the communication port, the first communication unit transmits the acquired connection information to the portlock management device, the second communication unit receives the connection information sent from the information processing device, the portlock connection determination unit determines whether or not the portlock is connected to the communication port based on the received connection information, the determination result output unit outputs the determination result information based on the determination result by the portlock connection determination unit to the alert issuing device, and the alert issuing device issues an alert based on the determination result information.

[0009] The port lock management system of (2) can more efficiently manage port locks connected to communication ports of information processing devices on a network.

[0010] (3) The portlock management system described in (1) comprises: an information processing device having the communication port, the connection information acquisition unit, the portlock connection determination unit, and the determination result output unit; a portlock management device having the portlock having a terminal unit that can be inserted and removed from the communication port, a communication unit capable of receiving information from the outside, and an alert issuing device capable of issuing an alert, wherein the connection information acquisition unit acquires the connection information of the portlock connected to the communication port, the portlock connection determination unit determines whether or not the portlock is connected to the communication port based on the acquired connection information, the determination result output unit transmits the determination result information based on the determination result by the portlock connection determination unit to the portlock management device, the communication unit receives the determination result information transmitted from the information processing device, and the alert issuing device issues the determination result information based on the determination result by the portlock connection determination unit to the outside.

[0011] The port lock management system (3) can more efficiently manage port locks connected to communication ports of information processing devices on a network.

[0012] (4) In the port lock management system described in (2) or (3), the connection information is data transmission / reception information indicating the voltage state of the data terminal of the communication port at the connection portion where the communication port and the terminal portion are connected.

[0013] (4) The port lock management system makes it easy to obtain connection information as data transmission / reception information, since data transmission / reception information can be easily obtained.

[0014] (5) In the port lock management system described in (4), the port lock connection determination unit determines whether or not the port lock is connected to the communication port based on the data transmission / reception information.

[0015] The port lock management system of (5) can more efficiently manage port locks connected to communication ports of information processing devices on a network by utilizing easily obtainable data transmission and reception information.

[0016] (6) In the port lock management system described in (5), the port lock connection determination unit determines that the port lock has been removed when the value indicated by the acquired data transmission / reception information becomes less than a predetermined value.

[0017] The port lock management system (6) can manage the connection status of the port lock using a simpler method of determination.

[0018] (7) In the portlock management system of the present invention described in any one of (1) to (6), the information processing device further has a memory unit capable of storing information and a system log memory unit that stores the acquired connection information in the memory unit as system log information, and the first communication unit acquires the system log information including the connection information from the memory unit at the timing of transmitting the connection information to the portlock management device, and transmits the acquired system log information to the portlock management device as the connection information.

[0019] The port lock management system of (7) stores connection information as a system log, and can utilize a process for referencing the system log of an information processing device on an existing network, making it easier to obtain connection information of the information processing device on the network. This makes it easier to manage port locks connected to communication ports of information processing devices on the network.

[0020] (8) In the port lock management system described in (2) or (3), the port lock has an information transmission unit capable of transmitting information via the terminal unit, and the connection information is device description information transmitted from the information transmission unit to the information processing device when the terminal unit of the port lock is connected to the communication port of the information processing device.

[0021] The port lock management system (8) can easily obtain connection information as device description information because device description information is easily obtainable.

[0022] In the port lock management system described in (9)(8), the port lock connection determination unit determines whether or not the port lock is connected to the communication port based on the device description information included in the connection information.

[0023] The port lock management system of (9) can more efficiently manage port locks connected to communication ports of information processing devices on a network by utilizing easily obtainable device description information. [Brief description of the drawings]

[0024] [Figure 1] 1 is a schematic diagram showing a port lock management system according to an embodiment of the present invention; [Diagram 2] FIG. 2 is a schematic diagram showing a functional configuration of a carrier terminal according to an embodiment of the present invention; [Diagram 3] FIG. 2 is a schematic diagram showing a functional configuration of a port lock according to an embodiment of the present invention. [Figure 4] FIG. 2 is a schematic diagram showing a hardware configuration of a port lock according to an embodiment of the present invention. [Diagram 5] 2 is a schematic diagram showing a functional configuration of a port lock management server according to an embodiment of the present invention; FIG. [Figure 6] 2 is a schematic diagram showing a hardware configuration of a port lock management server according to an embodiment of the present invention; FIG. [Figure 7] 11 is a schematic diagram illustrating an example of a connection information log storage process by a business operator terminal according to an embodiment of the present invention; FIG. [Figure 8] FIG. 11 is a schematic diagram showing an example of a portlock connection management process performed by a portlock management server according to an embodiment of the present invention. [Figure 9] FIG. 13 is a schematic diagram showing a functional configuration of a carrier terminal according to a modified example. [Figure 10]FIG. 13 is a schematic diagram showing a functional configuration of a port lock management server according to a modified example. [Figure 11] FIG. 13 is a schematic diagram showing an example of a port lock connection management process by a business operator terminal according to a modified example. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0025] A port lock management system S according to an embodiment of the present invention will be described below with reference to FIG. 1. The port lock management system S is a system for managing the connection of a port lock inserted into a communication port of an information processing device. The port lock is a configuration for physically restricting connection to a communication port in order to prevent unauthorized access to confidential information held by the information processing device. The port lock will be described in detail later. An example of a communication port is a port conforming to the USB (Universal Serial Bus, registered trademark) standard, but is not limited to this. For example, an example of a communication port is a LAN (Local Area Network) cable port, an SD (registered trademark) card slot, a SIM card (Subscriber Identity Module Card) slot, etc.

[0026] 1, the portlock management system S includes a business operator terminal 10 as an information processing device, a portlock 20, a portlock management server 30 as a portlock management device, and a network N. In the portlock management system S, the portlock management server 30 determines whether the portlock 20 is normally connected to the communication port 104a based on the connection information of the portlock 20, and issues an alert, thereby preventing unauthorized access to confidential information of the business operator terminal 10.

[0027] Here, the connection information is information that can determine whether or not the port lock is connected to the communication port. The connection information may be, for example, data transmission / reception information, which will be described later, device description information, which will be described later, or power supply information.

[0028] Furthermore, when the communication port is a USB port, the data transmission / reception information is information indicating the state of data transmission / reception for data communication at a connection portion where the communication port is connected to a terminal portion of a connection device connected to the communication port. The data transmission / reception information is information indicating the voltage state of the data terminal of the communication port. The data transmission / reception information is the measurement result of the voltage between the GND (ground) terminal and the data terminal of the USB port. At this time, the presence or absence of a connection to the communication port due to the port lock can be determined as being unplugged when, for example, the USB data terminal is pulled down to GND and the voltages of the two data terminals are both at the GND level.

[0029] The device description information is information for identifying a connected device connected to the communication port, and the power supply information is information indicating a voltage value or a current value supplied to the connected device of the communication port 104a via the communication port 104a.

[0030] The business operator terminal 10 is an information processing device used by a business operator in the course of business. The business operator terminal 10 may be, for example, a desktop or laptop personal computer, or a portable computer such as a smartphone or tablet. The business operator terminal 10 is connected to the portlock management server 30 via a network N so as to be able to communicate with each other. Although only one business operator terminal 10 is shown in FIG. 1 for the sake of convenience, the portlock management system S according to this embodiment will be described as including multiple business operator terminals 10. However, this configuration is not limited, and even a system including only one business operator terminal 10 has the same effects as this embodiment. Details of the business operator terminal 10 will be described later.

[0031] The portlock 20 is configured to physically restrict connection to a communication port in order to prevent unauthorized access to confidential information held by the business terminal 10, as described above. In other words, the portlock 20 is inserted into a communication port in order to disable the communication port. Note that, although the portlock 20 according to this embodiment is configured to be freely inserted and removed, the portlock may have a shape or function that restricts insertion and removal. Details of the portlock 20 will be described later.

[0032] The portlock management server 30 is configured to manage portlocks connected to information processing devices that are subject to management and are connected to the network N. The portlock management server 30 may be, for example, a desktop or laptop personal computer. The portlock management server 30 will be described in detail later.

[0033] The network N is a wireless or wired network, and is realized by, for example, the Internet, a LAN, or a mobile phone network, or a combination of these.

[0034] <Business operator terminal> First, the functional configuration of the operator terminal 10 will be described with reference to Fig. 2. A control unit 120 (to be described later) which controls various aspects of the operator terminal 10 is realized by a processor 100 (to be described later) which executes arithmetic processing and executes programs stored in a ROM 101, a RAM 102, an auxiliary storage unit 107, etc. (to be described later). In the port lock management system S according to this embodiment, the control unit 120 is configured to execute a program stored in a storage unit 201 (to be described later) of a port lock 20 connected to a communication port 104a (to be described later).

[0035] The control unit 120 of this embodiment has a communication processing unit (communication processing function) 121, an output processing unit (output processing function) 122, an input processing unit (input processing function) 123, a port connection management unit (port connection management function) 124, and a system log management unit (system log management function) 125 as a system log storage unit. The control unit 120 realized by the processor 100 functions as a first control unit.

[0036] The communication processing unit 121 executes a process for communicating with an external device via the communication unit 108 serving as a first communication unit described later. For example, the communication processing unit 121 executes a process for transmitting system log information described later to the port lock management server 30 via the network N to the communication unit 108.

[0037] The output processing unit 122 executes a process for displaying an image on the screen of the output unit 106, which will be described later. For example, the output processing unit 122 executes a process for displaying system log information, which will be described later, on the screen of the output unit 106.

[0038] The input processing unit 123 executes a process of accepting an operation of the input unit 105 by a user, which will be described later. The input processing unit 123 executes a process of accepting an input operation of an unmount process execution command to unmount the port lock 20 mounted on the operator terminal 10, for example, by the user to the input unit 105.

[0039] The port connection management unit 124 performs various processes for connection with a connected device via the communication port 104a. For example, the port connection management unit 124 receives device description information transmitted from the connected device, recognizes the connected device, and performs a mount process for making the connected device operable and usable, and an unmount process for terminating the connected state and making the connected device removable.

[0040] Furthermore, the port connection management unit 124 according to this embodiment controls the amount of power supplied to a connected device via the communication port 104a, controls data transmission, and acquires and manages data transmission / reception information such as the voltage of a data terminal and power supply information such as the amount of power supplied. The port connection management function of the port connection management unit 124 may be realized by, for example, a BIOS (Basic Input Output System) included in the carrier terminal 10.

[0041] Furthermore, when the port lock 20 is connected to the communication port 104a, the port connection management unit 124 according to this embodiment is configured to read and execute a program for connection information acquisition processing stored in a storage unit 201 (to be described later) of the port lock 20. Such operations performed by the port connection management unit 124 according to this embodiment are realized by known technology.

[0042] The connection information acquisition process is a process for acquiring data transmission / reception information as connection information from the communication port 104a to the port measurement unit 104b described later. In other words, the port connection management unit 124 acquires, as connection information, the data transmission / reception information transmitted from the communication port 104a by the port measurement unit 104b.

[0043] In this embodiment, the connection information is generated and acquired by the business operator terminal 10, such as data transmission / reception information and power supply information, but it may be information sent from the port lock 20, such as device description information, that is acquired.

[0044] System log management unit 125 executes a system log storage process and a system log transmission process. The system log storage process is a process for storing system log information in auxiliary storage unit 107, which will be described later. The system log information is information on the operation history of operator terminal 10. When a predetermined operation is performed in operator terminal 10, system log management unit 125 stores the history of the predetermined operation as system log information in auxiliary storage unit 107.

[0045] Note that the system log management unit 125 according to this embodiment is not set to store the data transmission / reception information acquired by the port measurement unit 104b in the auxiliary storage unit 107 so as to include it in the system log information when the system log storage process is executed. However, by reading and executing the connection information storage process stored in the storage unit 201 of the port lock 20 described below, when the system log management unit 125 acquires the data transmission / reception information, it operates to cause the auxiliary storage unit 107 to store the data transmission / reception information in the system log information so as to include it in the system log information.

[0046] The system log transmission process is a process for reading system log information from the auxiliary storage unit 107 and transmitting it to the port lock management server 30. The system log transmission process is executed when the port lock 20 is connected to the communication port 104a, when the communication processing unit 121 accepts a request to transmit system log information from the port lock management server 30 via the communication unit 108, and when a request for unmounting to release the connection between the communication port 104a and the port lock 20 is received.

[0047] Next, an example of a hardware configuration of the operator terminal 10 according to an embodiment of the present invention will be described with reference to Fig. 1. As shown in Fig. 1, the operator terminal 10 includes a processor 100, a ROM (Read Only Memory) 101, a RAM (Random Access Memory) 102, an input unit 105, an output unit 106, an auxiliary storage unit 107, a communication unit 108, a power supply 109, a bus 103, and an input / output interface 104.

[0048] In other words, the operator terminal 10 has a communication port 104a capable of transmitting information to and from a connected device, a communication unit 108 capable of transmitting information to the outside, and a processor 100, ROM 101, RAM 102, and auxiliary storage unit 107 capable of storing information, which function as a first control unit that controls the communication port 104a and the communication unit 108. The processor 100, ROM 101, RAM 102, and auxiliary storage unit 107 functioning as the first control unit acquire connection information of the connected device connected to the communication port 104a, and perform a process of transmitting the acquired connection information to the port lock management server 30.

[0049] The processor 100 is a central part of a computer that performs various calculations and processes such as calculations and control required for the operation of the carrier terminal 10. The processor 100 is, for example, a central processing unit (CPU), a micro processing unit (MPU), a system on a chip (SoC), a digital signal processor (DSP), a graphics processing unit (GPU), an application specific integrated circuit (ASIC), a programmable logic device (PLD), or a field-programmable gate array (FPGA). Alternatively, the processor 100 is a combination of a plurality of these. The processor 100 may also be a combination of these with a hardware accelerator or the like.

[0050] The processor 100 controls each unit to realize various functions of the operator terminal 10 based on programs such as firmware, system software, and application software stored in the ROM 101 or RAM 102. The processor 100 also executes processes based on the programs. Note that a part or all of the programs may be incorporated in the circuitry of the processor 100.

[0051] The processor 100, the ROM 101, and the RAM 102 are connected to one another via a bus 103. An input / output interface 104 is also connected to this bus 103. An input unit 105, an output unit 106, an auxiliary storage unit 107, a communication unit 108, a communication port 104a, and a power supply 109 are connected to the input / output interface 104. The input / output interface 104 also has the communication port 104a and a port measurement unit 104b as a connection information acquisition unit.

[0052] The communication port 104a is configured to enable information transmission between the communication port 104a and a connected device. The communication port 104a has a socket into which a connection terminal based on a predetermined standard is inserted, for example, a socket based on the USB standard. The socket has a connecting part that can be connected to a connection terminal inserted therein. Examples of the connection terminal include a power terminal, a data terminal, a GND terminal, and an identification terminal. However, the connection terminal is not limited to these. When a connection terminal from an external connected device is inserted into the communication port 104a and connected to the connecting part, information transmission becomes possible.

[0053] The port measurement unit 104b is configured to detect the voltage of the wires of the communication port 104a. For example, when the communication port 104a is a USB port, the port measurement unit 104b has a data terminal voltage detection circuit that detects the voltage of the data terminal of the USB port, and a power terminal voltage detection circuit that detects the voltage of the power terminal of the USB port. The data terminal voltage detection circuit may be capable of detecting the type of pull-up or pull-down. In this case, the port measurement unit 104b can measure the power supply information and data transmission / reception information of the terminals of the communication port 104a. In other words, the port measurement unit 104b acquires the power supply information or the data transmission / reception information as the connection information of the port lock 20 connected to the communication port 104a.

[0054] The input unit 105 and the output unit 106 are user interfaces electrically connected to the input / output interface 104 by wire or wirelessly. The input unit 105 is composed of, for example, a keyboard, a mouse, etc., and inputs various information in response to user instructions. The output unit 106 is composed of a display for displaying images, a speaker for amplifying audio, a printer, etc., and outputs images, audio, and printed matter.

[0055] The auxiliary storage unit 107 is an auxiliary storage device configured with a hard disk drive (HDD), a solid state drive (SSD), etc. The auxiliary storage unit 107 stores various information such as programs related to various processes and setting values. The auxiliary storage unit 107 stores, for example, the above-mentioned system log information, various programs, etc.

[0056] The communication unit 108 is a device for communicating with the port lock management server 30 via the network N.

[0057] The power supply 109 is configured to be connected to an external power supply so as to be able to supply power to each unit of the operator terminal 10. Note that the configuration capable of supplying power to the power supply is not limited to this, and may be, for example, a battery.

[0058] <Port lock> Next, the functional configuration of the portlock 20 will be described with reference to Fig. 3. Configurations common to or similar to those already described will be given the same names and detailed descriptions may be omitted. A control unit 220, which performs various controls on the portlock 20 and is implemented by a processor 202, which executes arithmetic processing and is described later, executing a program stored in a storage unit 201.

[0059] The control unit 220 of this embodiment has a connection processing unit (connection processing function) 221 and an information transmission processing unit (information transmission processing function) 222. Note that the information transmission processing unit 222 by the processor 202 functions as the information transmission unit.

[0060] The connection processing unit 221 performs various processes for connection with the operator terminal 10 via the communication port 104a. For example, the connection processing unit 221 transmits device description information to the operator terminal 10 to cause the operator terminal 10 to recognize the connected device, performs a mount process to make it operable and usable, and an unmount process to end the connected state and make the connected device removable.

[0061] The information transmission processing unit 222 executes a process of transmitting information stored in the storage unit 201 to the outside via the connection terminal 200, and acquiring information transmitted from the outside via the connection terminal 200. For example, the information transmission processing unit 222 executes a process of transmitting device description information stored in the storage unit 201 at the timing of the mounting process to the operator terminal 10 via the connection terminal 200.

[0062] Next, the hardware configuration of the port lock 20 will be described with reference to Fig. 4. Note that components common to or similar to those already described will be given the same names and detailed descriptions thereof may be omitted.

[0063] The port lock 20 has a connection terminal 200 as a terminal unit, a storage unit 201, and a processor 202 as an information transmission unit. The connection terminal 200 is formed to the same specifications as the communication port 104a, is insertable / removable into the communication port 104a, and is connectable to a connection unit inside the communication port 104a.

[0064] The storage unit 201 has a main storage unit configured with a ROM, a RAM, etc., and an auxiliary storage unit configured with an electrically rewritable flash memory or an E2PROM, which stores various information such as programs related to various processes and setting values. Note that the configuration of the storage unit 201 is not limited to this. The storage unit 201 stores, for example, various programs such as a connection information log storage process including a connection information acquisition process and a connection information storage process that are read and executed by the above-mentioned operator terminal 10, a mounting process, an unmounting process, etc., device description information, etc.

[0065] <Port lock management server> Next, the functional configuration of the portlock management server 30 will be described with reference to FIG. 5. Note that configurations common or similar to those already described may be given the same names and detailed descriptions thereof may be omitted. The control unit 320 that controls various aspects of the portlock management server 30 according to this embodiment is realized by the processor 300 that executes arithmetic processing executing programs stored in the ROM 301, the RAM 302, the auxiliary storage unit 307, etc. The control unit 320 of this embodiment has a communication processing unit (communication processing function) 321, an output processing unit (output processing function) 322, an input processing unit (input processing function) 323, a system log information acquisition unit (system log information acquisition function) 324, a portlock connection determination unit (portlock connection determination function) 325, and an alarm processing unit (alarm processing function) 326. Note that the control unit 320 realized by the processor 300 functions as a second control unit.

[0066] The system log information acquisition unit 324 executes a process of acquiring system log information from the operator terminal 10 on the network N. The system log information acquisition unit 324 executes a process of making a transmission request for system log information at a predetermined time interval, and acquiring the system log information transmitted and received from the operator terminal 10 on the network N. The predetermined time is, for example, 30 minutes. The predetermined time is not limited to 30 minutes.

[0067] Furthermore, in this embodiment, when the portlock 20 is connected to the communication port 104a of the operator terminal 10 or when the portlock 20 is unplugged from the communication port 104a of the operator terminal 10, system log information is sent from the operator terminal 10 to the portlock management server 30 without receiving a transmission request.

[0068] For example, when the portlock 20 is connected to the communication port 104a of the operator terminal 10, the port connection management unit 124 of the operator terminal 10 causes the port measurement unit 104b to acquire data transmission and reception information as connection information for the communication port 104a. The system log management unit 125 causes the connection information acquired by the port measurement unit 104b to be stored in the auxiliary storage unit 107 together with the system log information. The system log management unit 125 of the operator terminal 10 reads the system log information stored in the auxiliary storage unit 107 at this timing, and causes the communication unit 108 to transmit it to the portlock management server 30.

[0069] Alternatively, upon receiving a request for unmounting to release the connection between the communication port 104a and the port lock 20, the port connection management unit 124 of the carrier terminal 10 causes the port measurement unit 104b to acquire data transmission / reception information as connection information for the communication port 104a. The system log management unit 125 causes the communication unit 108 to transmit the acquired connection information to the port lock management server 30 while storing the acquired connection information in the auxiliary storage unit 107 as part of the system log information. Even in these cases, the system log information acquisition unit 324 executes a process of acquiring the received system log information.

[0070] Furthermore, when the system log information acquisition unit 324 receives system log information transmitted from the communication unit 108 of the operator terminal 10 , the system log information acquisition unit 324 stores the received system log information in the auxiliary storage unit 307 .

[0071] The portlock connection determination unit 325 determines whether or not the portlock 20 is connected to the communication port 104a based on the acquired connection information. For example, the portlock connection determination unit 325 determines that the portlock has been removed when the value indicated by the connection information included in the system log information received by the communication unit 308 as the second communication unit becomes equal to or less than a predetermined value. More specifically, in this embodiment, the portlock connection determination unit 325 determines that the USB portlock has been removed when, for example, when the data terminal of the USB is pulled down to GND, the values ​​indicated by the data transmission / reception information as the connection information of the two data terminals both become the GND level. In this case, the predetermined value is the GND level. Furthermore, the portlock connection determination unit 325, as a determination result output unit, outputs determination result information based on the determination result to the alarm processing unit.

[0072] The alarm processing unit 326 causes the output unit 306, which serves as an alarm generating device, to generate an alarm based on the above-mentioned determination result information. For example, when the port lock connection determination unit 325 determines that the port lock has been removed, the alarm processing unit 326 executes a process of causing the output unit 306 to generate an alert.

[0073] Next, an example of a hardware configuration of the portlock management server 30 according to an embodiment of the present invention will be described with reference to Fig. 6. The portlock management server 30 according to this embodiment is a computer including a processor 300, a ROM 301, a RAM 302, a bus 303, an input / output interface 304, an input unit 305, an output unit 306, an auxiliary storage unit 307, a communication unit 308 as a second communication unit, and a power supply unit 309.

[0074] In other words, the portlock management server 30 has a communication unit 308 capable of receiving information from the outside, and a processor 300, ROM 301, RAM 302, and auxiliary storage unit 307 serving as a second control unit capable of performing calculations based on the information received by the communication unit 308. The processor 300, ROM 301, RAM 302, and auxiliary storage unit 307 serving as the second control unit receive connection information transmitted from the operator terminal 10, and perform processing to determine whether or not a portlock 20 is connected to the communication port 104a based on data transmission / reception information serving as the received connection information.

[0075] The auxiliary storage unit 307 is an auxiliary storage device configured with an HDD (Hard Disk Drive), an SSD (Solid State Drive), etc. The auxiliary storage unit 307 stores various information such as programs related to various processes and setting values. The auxiliary storage unit 307 stores, for example, information on the operator terminal 10 that is subject to the management of port lock on the network, various programs, etc.

[0076] The output unit 306 is a user interface that is electrically connected to the input / output interface 304 by wire or wirelessly. The output unit 306 is composed of a display that displays images, a speaker that amplifies audio, a buzzer, a printer, etc., and outputs images, audio, and printed matter. The output unit 306 also functions as an alert issuing device that issues an alert in response to a command from the alert issuing processor 326. For example, when the output unit 306 receives a command from the alert issuing processor 326 to issue an alert notifying that the connection of the portlock 20 has been released, the output unit 306 issues an alert of the release of the connection of the portlock 20 by voice via a speaker, on a monitor screen, etc.

[0077] <Port lock management method> Next, a port lock management method by the port lock management system S according to this embodiment will be described with reference to FIGS.

[0078] In the portlock management system S according to this embodiment, portlock management is performed by a connection information log storage process by the carrier terminal and a portlock management process by the portlock management server 30. Each of these processes will be described below.

[0079] The connection information log acquisition process is a process including a connection information acquisition process and a connection information storage process. The connection information acquisition process is executed by the port connection management unit 124 of the control unit 120 of the carrier terminal 10 as described above, and is a process for acquiring data transmission / reception information of the communication port 104a as connection information.

[0080] The connection information storage process is a process for storing the data transmission / reception information serving as the connection information acquired as described above in the auxiliary storage unit 107 of the operator terminal 10 as system log information.

[0081] The port lock management process is a process in which the port lock management server 30 acquires system log information including connection information of the port lock 20 from the operator terminal 10 on the network N, and determines whether the port lock 20 is connected or not, and manages it.

[0082] <Connection information log storage process> 2, when the operator terminal 10 executes the connection information log storage process, the communication processing unit 121, the input processing unit 123, the port connection management unit 124, and the system log management unit 125 function in the processor 100. The connection information log storage process is started when the port lock 20 is connected to the communication port 104a and the control unit 120 reads the program for the connection information log storage process stored in the memory unit 201 of the port lock 20.

[0083] First, the port connection management unit 124 executes a mount process with the connected device (step S10). Next, the port connection management unit 124 acquires data transmission / reception information of the communication port 104a as connection information to the port measurement unit 104b (step S11). Next, the system log management unit 125 stores the acquired data transmission / reception information together with the system log information in the auxiliary storage unit 107, and causes the communication unit 108 to transmit the information to the port lock management server 30 (step S12).

[0084] Next, system log management unit 125 checks whether communication processing unit 121 has received a system log transmission request from the outside via communication unit 108 (step S13). If a system log transmission request has not been received from the outside (step S13: NO), control unit 120 shifts the process to step S16.

[0085] When a system log transmission request is received from the outside (step S13: YES), the port connection management unit 124 causes the port measurement unit 104b to acquire data transmission / reception information of the communication port 104a as connection information (step S14). Next, the system log management unit 125 stores the acquired connection information as system log information in the auxiliary storage unit 107, instructs the communication processing unit 121 to transmit the information to the port lock management server 30 via the communication unit 108, and shifts the process to step S16 (step S15).

[0086] Next, the port connection management unit 124 checks whether the input processing unit 123 has received an unmounting request from the input unit 105 (step S16). If the input unit 105 has not received an unmounting request (step S16: NO), the control unit 120 shifts the process to step S13 and repeats the operation until an unmounting request is received.

[0087] When an unmount processing request operation is received by the input unit 105 (step S16: YES), the port connection management unit 124 acquires data transmission / reception information of the communication port 104a as connection information from the port measurement unit 104b (step S17). Next, the system log management unit 125 stores the acquired connection information as system log information in the auxiliary storage unit 107, and instructs the communication processing unit 121 to transmit the information to the port lock management server 30 via the communication unit 108 (step S18). The port connection management unit 124 executes an unmount processing with the connected device (step S19), and ends the connection information log storage processing.

[0088] <Port lock management process> 5, when the portlock management server 30 executes a portlock management process, a communication processing unit 321, an output processing unit 322, a system log information acquisition unit 324, a portlock connection determination unit 325, and an alarm processing unit 326 function in the processor 300. The portlock management process starts when the communication processing unit 321 of the portlock management server 30 accepts reception of system log information from the operator terminal 10 on the network N via the communication unit 308.

[0089] First, the control unit 320 checks whether a predetermined time has elapsed (step S20). If the predetermined time has not elapsed (step S20: NO), the control unit 320 shifts the process to step S20 and waits until the predetermined time has elapsed. If the predetermined time has elapsed (step S20: YES), the system log information acquisition unit 324 instructs the communication processing unit 321 to make a request to the operator terminal 10 on the network to transmit system log information via the communication unit 308 (step S21). Next, the system log information acquisition unit 324 executes a process of acquiring the system log information transmitted from the operator terminal 10 that received the request to transmit the system log information (step S22).

[0090] Next, the portlock connection determination unit 325 checks the connection information included in the system log information and checks whether the connection information in the system log has changed by a predetermined amount or more (step S23). If the connection information has not changed by the predetermined amount or more (step S23: NO), the portlock connection determination unit 325 shifts the process to step S20 and repeats the process until the connection information has changed. If the connection information has changed by the predetermined amount or more (step S23: YES), the portlock connection determination unit 325 determines that the portlock 20 is not connected to the communication port 104a, and the alarm processing unit 326 commands the output processing unit 322 to issue an alert on the speaker or screen of the output unit 306 to the effect that the portlock has been removed (step S24), and ends the portlock management process.

[0091] The port lock management system S according to the present embodiment described above provides the following effects. Conventionally, it is necessary to prevent the unauthorized use of USBs in personal computers from introducing malware or leaking information. To improve security for personal computers, a physical port lock that plugs into a USB port has been used. Whether the port lock is correctly inserted has been checked visually, and the more personal computers are operated and the more remote the locations of the personal computers, the greater the amount of management work required. In addition, even if the port lock is removed, the state cannot be immediately grasped, and there is a risk of delayed response to unauthorized access.

[0092] Therefore, in the present invention, the port lock main unit is provided with a function for writing a value indicating the voltage state of the data terminal of the communication port to the system log of the PC's operating system when it is inserted into the communication port.

[0093] More specifically, first, a port lock is inserted into a USB port. A data transmission / reception information log reflection program for inputting data transmission / reception information showing the voltage state of the data terminal into a system log is stored in the memory of the port lock, and when the port lock is inserted into the communication port of the information processing device, the port lock reads and starts the data transmission / reception information log reflection program stored in the port lock, causing the data transmission / reception information to be input into the system log. This operation is performed, for example, by using the automatic start-up technology described in Patent No. 3767818.

[0094] The USB port lock management server monitors the system log stored in the storage unit of the information processing device and detects a change in the value indicating the data transmission / reception state when the port lock to the USB port is removed. The USB port lock management server issues a notification to the administrator using the value of the detected state change as a key.

[0095] This makes it possible to more efficiently manage port locks connected to communication ports of information processing devices on a network.

[0096] <Modification> In the above embodiment, the portlock management server 30 has the portlock connection determination unit 325 as a portlock connection determination unit that determines whether or not the portlock 20 is connected to the communication port 104a based on the connection information acquired by the port connection management unit 124. Also, in the above embodiment, the portlock management server 30 has the portlock connection determination unit 325 as a determination result output unit that outputs determination result information based on the above determination result. However, this is not limited to the above configuration, and for example, at least one of the portlock connection determination unit and the determination result output unit may be included in the operator terminal 10.

[0097] For example, the business operator terminal 10 may have an agent program that determines whether or not the portlock 20 is connected to the communication port 104a based on the acquired data transmission / reception information. When the business operator terminal 10 determines that the portlock 20 has been removed, the business operator terminal 10 may transmit alert command information as determination result information to the portlock management server 30 to issue an alert based on the determination result.

[0098] In this case, the function of determining whether the portlock 20 is connected may be included in the provider terminal 10. In addition, a program executed by the provider terminal 10 for determining whether the portlock is connected and outputting the determination result may be stored in the auxiliary storage unit 307 of the portlock management server 30, or may be stored in the storage unit 201 of the portlock 20.

[0099] A portlock management system S according to a modified example will be described in more detail with reference to Figures 1, 3, 4, 6, 9 to 11. Configurations similar to those in the above-described embodiment will be given the same names and detailed descriptions will be omitted. The portlock management system S includes a business operator terminal 10B, a portlock 20, a portlock management server 30B, and a network N.

[0100] <Business operator terminal> First, the functional configuration of the operator terminal 10B will be described with reference to Fig. 9. A control unit 120B (described later) that performs various controls of the operator terminal 10B is realized by a processor 100 that executes arithmetic processing and executes programs stored in a ROM 101, a RAM 102, an auxiliary storage unit 107, etc. (described later).

[0101] The control unit 120B of this modified example has a communication processing unit (communication processing function) 121, an output processing unit (output processing function) 122, an input processing unit (input processing function) 123, a port connection management unit (port connection management function) 124, a system log management unit (system log management function) 125, and a port lock connection determination unit (port lock connection determination function) 126.

[0102] The portlock connection determining unit 126 reads a program for portlock connection management processing stored in the storage unit 201 of the portlock 20, and thereby executes portlock connection determining processing and determination result output processing.

[0103] More specifically, in the portlock management system S according to this modified example, the control unit 120B is configured to execute a program for a portlock connection management process stored in a storage unit 201 (to be described later) of the portlock 20 connected to a communication port 104a (to be described later). The portlock connection management process includes a connection information acquisition process, a portlock connection determination process, and a determination result output process. The portlock connection management process will be described later.

[0104] The connection information acquisition process is a process for acquiring connection information of the port lock 20 connected to the communication port 104a, and is executed by the port connection management unit 124. For example, the port connection management unit 124 causes the port measurement unit 104b to acquire data transmission / reception information as the connection information of the port lock 20 connected to the communication port 104a.

[0105] The port lock connection determination process is a process for determining whether or not the port lock 20 is connected to the communication port 104a based on the acquired connection information, and is executed by the port lock connection determination unit 126.

[0106] The determination result output process is a process for outputting determination result information based on the determination result by the port lock connection determination process, and is executed by the port lock connection determiner 126 .

[0107] <Port lock management server> Next, the functional configuration of the portlock management server 30B will be described with reference to FIG. 10. Configurations common or similar to those already described may be given the same names and detailed descriptions thereof may be omitted. The control unit 320B that performs various controls of the portlock management server 30B according to this embodiment is realized by the processor 300 that executes arithmetic processing executing programs stored in the ROM 301, the RAM 302, the auxiliary storage unit 307, etc. The control unit 320B of this embodiment has a communication processing unit (communication processing function) 321, an output processing unit (output processing function) 322, an input processing unit (input processing function) 323, an alarm processing unit (alarm processing function) 326, and a portlock connection management unit (portlock connection management function) 327.

[0108] The port lock connection management unit 327 executes a process of periodically causing the communication unit 308 to send a request to send the determination result information in order to cause the operator terminal 10 to send the determination result information as to whether or not a port lock is connected to the communication port 104a.

[0109] <Port lock connection management process> Next, the portlock connection management process executed by the provider terminal 10B according to the modified example will be described with reference to Fig. 11. When the provider terminal 10B executes the portlock connection management process, the communication processing unit 121, the input processing unit 123, the port connection management unit 124, and the portlock connection determination unit 126 function in the processor 100 as shown in Fig. 5. The portlock connection management process is started when the portlock 20 is connected to the communication port 104a and the control unit 120B reads the program for the portlock connection management process stored in the memory unit 201 of the portlock 20.

[0110] First, the port connection management unit 124 executes a mount process with a connected device (step S30). Next, the port connection management unit 124 causes the port measurement unit 104b to acquire data transmission / reception information of the communication port 104a as connection information (step S31). Next, the port lock connection determination unit 126 checks whether or not there is a change in the connection information that is equal to or greater than a predetermined amount (step S32).

[0111] If the connection information does not change by a predetermined amount or more (step S32: NO), the port connection management unit 124 shifts the process to step S34. If the connection information changes by a predetermined amount or more (step S32: YES), the port connection management unit 124 determines that the port lock 20 is not connected to the communication port 104a, instructs the communication processing unit 121 to transmit determination result information to the port lock management server 30 via the communication unit 108 (step S33), and shifts the process to step S34. Note that the alarm processing unit 326 of the port lock management server 30 is configured to issue an alert to the monitor, speaker, or the like of the output unit 306 when the determination result information is received by the communication unit 308.

[0112] Next, the port connection management unit 124 checks whether the communication processing unit 121 has received a request to transmit the determination result information from the outside via the communication unit 108 (step S34). If the communication processing unit 121 has not received a request to transmit the determination result information from the outside (step S34: NO), the control unit 120B shifts the process to step S38.

[0113] If a request to transmit the determination result information is received from the outside (step S34: YES), the port connection manager 124 then acquires data transmission / reception information of the communication port 104a as connection information from the port measurement unit 104b (step S35). Next, the port lock connection determiner 126 checks whether the connection information has changed by a predetermined amount or more (step S36).

[0114] If the connection information does not change by a predetermined amount or more (step S36: NO), port connection management unit 124 shifts the process to step S38. If the connection information changes by a predetermined amount or more (step S36: YES), port connection management unit 124 determines that port lock 20 is not connected to communication port 104a, instructs communication processing unit 121 to transmit determination result information to port lock management server 30 via communication unit 108 (step S37), and shifts the process to step S34.

[0115] Next, port connection management unit 124 checks whether or not input processing unit 123 has received an unmounting request from input unit 105 (step S38). If an unmounting request has not been received from input unit 105 (step S38: NO), control unit 120B transitions to step S34, and repeats the operation until a request for unmounting is received.

[0116] If a request for unmounting is received by the input unit 105 (step S38: YES), the portlock connection determination unit 126 causes the communication unit 108 to transmit determination result information indicating that the portlock 20 is to be released from the communication port 104a to the portlock management server 30 (step S39). The port connection management unit 124 executes unmounting with the connected device (step S40) and terminates the portlock connection management process.

[0117] <Other Modifications> In the above embodiment, the operator terminal 10 is a desktop personal computer, but is not limited thereto and may be a portable information processing device such as a mobile PC or a tablet PC. For example, the functions of the present invention can be added to a client personal computer as a portable information processing device and a management device such as MDM (Mobile Device Management) that manages the client personal computers.

[0118] In the above embodiment, the connection information is data transmission / reception information indicating the data transmission / reception state at the connection part where the communication port 104a and the connection terminal 200 are connected, but is not limited thereto. The connection information may be device description information transmitted from the portlock 20 to the operator terminal 10 when the connection terminal 200 of the portlock 20 is connected to the communication port 104a of the operator terminal 10. In this case, for example, the connection processing unit 221 of the portlock 20 transmits the device description information to the operator terminal 10 at the timing when the portlock 20 is connected to the communication port 104a, and stores the device description information in the auxiliary storage unit 107 together with the system log information. The portlock management server 30 periodically acquires the system log information. The portlock management server 30 judges whether the portlock 20 is connected to the communication port 104a based on the device description information included in the acquired system log information.

[0119] Even in this case, the port lock management system S can manage the port lock 20 connected to the communication port 104a of the carrier terminal 10 on the network N more efficiently.

[0120] In the above embodiment, the connection information is data transmission / reception information indicating the data transmission / reception state at the connection part where the communication port 104a and the connection terminal 200 are connected, but is not limited to this. The connection information may be power supply information acquired by the port measurement unit 104b. In this case, for example, the business operator terminal 10 acquires the power supply information as the connection information by a program for connection information log storage processing stored in the storage unit 201 of the port lock 20, and stores the power supply information in the auxiliary storage unit 107 together with the system log information. The port lock management server 30 periodically acquires the system log information. The port lock management server 30 determines whether or not the port lock 20 is connected to the communication port 104a based on the power supply information included in the acquired system log information.

[0121] Even in this case, the port lock management system S can manage the port lock 20 connected to the communication port 104a of the carrier terminal 10 on the network N more efficiently.

[0122] The series of processes according to the above-mentioned method can be executed by hardware or software. In other words, the functional configurations of Figures 2, 3, 5, 9, and 10 are merely examples and are not particularly limited. In other words, it is sufficient to have a function capable of executing the series of processes described above as a whole, and the type of functional block used to realize this function is not particularly limited to the examples of Figures 2, 3, 5, 9, and 10.

[0123] Moreover, one functional block may be configured as a single piece of hardware, a single piece of software, or a combination of both. The functional configuration in this embodiment is realized by a processor that executes arithmetic processing, and processors that can be used in this embodiment include those configured as single pieces of various processing devices such as single processors, multiprocessors, and multicore processors, as well as those in which these various processing devices are combined with processing circuits such as ASICs (Application Specific Integrated Circuits) and FPGAs (Field-Programmable Gate Arrays).

[0124] When a series of processes is executed by software, the programs constituting the software are installed into a computer or the like from a network or a recording medium. The computer may be a computer incorporated in dedicated hardware. The computer may also be a computer capable of executing various functions by installing various programs, such as a general-purpose personal computer.

[0125] The recording medium including such a program is not only constituted by a removable medium distributed separately from the device main body in order to provide the program to the user, but also constituted by a recording medium provided to the user in a state in which the program is preinstalled in the device main body. The removable medium is, for example, a magnetic disk (including a floppy disk), an optical disk, or a magneto-optical disk. The optical disk is, for example, a CD-ROM (Compact Disk-Read Only Memory), a DVD (Digital Versatile Disk), a Blu-ray (registered trademark) Disc, etc. The magneto-optical disk is, for example, an MD (Mini-Disk), etc. The recording medium provided to the user in a state in which the program is preinstalled in the device main body is, for example, a ROM in FIG. 1 and 6 in which the program is recorded, or a hard disk included in the auxiliary storage unit in FIG. 1 and 6.

[0126] In this specification, the steps of describing a program to be recorded on a recording medium include not only processes that are performed chronologically according to the order, but also processes that are not necessarily performed chronologically but are executed in parallel or individually.

[0127] Although several embodiments of the present invention have been described above, these embodiments are merely illustrative and do not limit the technical scope of the present invention. The present invention can take various other embodiments, and further, various modifications such as omissions and substitutions can be made without departing from the gist of the present invention. These embodiments and their modifications are included in the scope and gist of the invention described in this specification, etc., and are included in the scope of the invention described in the claims and their equivalents. [Explanation of symbols]

[0128] S Port Lock Management System 10. Operator terminal (information processing device) 100 Processor (port lock connection determination unit) 104a Communication port 104b Port measurement unit (connection information acquisition unit) 108 Communication unit (judgment result output unit) 20. Portlock 300 Processor (port lock connection determination unit, determination result output unit)

Claims

1. A system for managing a port lock that is inserted to disable a communication port provided in an information processing device, comprising: a connection information acquisition unit that acquires connection information of the port lock connected to the communication port; a port lock connection determination unit that determines whether or not the port lock is connected to the communication port based on the acquired connection information; a determination result output unit that outputs determination result information based on a determination result by the port lock connection determination unit.

2. an information processing device including the communication port, a first communication unit capable of transmitting information to an outside, and the connection information acquisition unit; the port lock having a terminal portion that can be inserted into and removed from the communication port; a portlock management device including a second communication unit capable of receiving information from an outside, the portlock connection determination unit, the determination result output unit, and an alert issuing unit capable of issuing an alert, The connection information acquisition unit acquires the connection information of the port lock connected to the communication port, The first communication unit transmits the acquired connection information to the port lock management device, The second communication unit receives the connection information transmitted from the information processing device, the port lock connection determination unit determines whether or not the port lock is connected to the communication port based on the received connection information; the determination result output unit outputs the determination result information based on the determination result by the port lock connection determination unit to the alarm issuing device; The port lock management system according to claim 1 , wherein the alarm issuing device issues an alarm based on the determination result information.

3. an information processing device including the communication port, the connection information acquisition unit, the port lock connection determination unit, and the determination result output unit; the port lock having a terminal portion that can be inserted into and removed from the communication port; a port lock management device having a communication unit capable of receiving information from an external source and an alarm device capable of issuing an alert; The connection information acquisition unit acquires the connection information of the port lock connected to the communication port, the port lock connection determination unit determines whether or not the port lock is connected to the communication port based on the acquired connection information; the determination result output unit transmits the determination result information based on the determination result by the portlock connection determination unit to the portlock management device; The communication unit receives the determination result information transmitted from the information processing device, The port lock management system according to claim 1 , wherein the notification device notifies an outside party of the determination result information based on the determination result by the port lock connection determination unit.

4. 4. The port lock management system according to claim 2, wherein the connection information is data transmission / reception information indicating a voltage state of a data terminal of the communication port at a connection portion where the communication port and the terminal portion are connected.

5. The port lock management system according to claim 4 , wherein the port lock connection determination unit determines whether or not the port lock is connected to the communication port based on the data transmission / reception information.

6. The port lock management system according to claim 5 , wherein the port lock connection determination unit determines that the port lock has been removed when a value indicated by the acquired data transmission / reception information becomes less than a predetermined value.

7. The information processing device includes a storage unit capable of storing information; a system log storage unit that stores the acquired connection information in the storage unit as system log information, The portlock management system according to claim 2, wherein the first communication unit acquires the system log information including the connection information from the memory unit at the timing of transmitting the connection information to the portlock management device, and transmits the acquired system log information to the portlock management device as the connection information.

8. The port lock has an information transmission unit capable of transmitting information via the terminal unit, 4. The port lock management system according to claim 2 or 3, wherein the connection information is device description information transmitted from the information transmission unit to the information processing device when the terminal unit of the port lock is connected to the communication port of the information processing device.

9. The port lock management system according to claim 8 , wherein the port lock connection determination unit determines whether or not the port lock is connected to the communication port based on the device description information included in the connection information.

Images