Information processing device, file management program, and file management method

Abstract

This prevents corruption of distributed files. [Solution] The information processing device 10 is capable of communicating with an external storage device 3. The information processing device 10 includes a storage device 11 and a processing unit 12. The information processing device 10 acquires environmental information indicating the protection environment of the original file 1. The processing unit 12 divides the original file 1 into a first distributed fragment file 2a and a second distributed fragment file 2b in a reconstructible manner. The processing unit 12 stores the first distributed fragment file 2a in the storage device 11. Based on the environmental information, the information processing device 10 determines whether the storage device 11 or the external storage device 3 will be the storage location for the second distributed fragment file 2b. The information processing device 10 then stores the second distributed fragment file 2b in the storage device 11 or the external storage device 3 that has been determined as the storage location.

Description

Technical Field

[0001] The present invention relates to an information processing apparatus, a file management program, and a file management method.

Background Art

[0002] As one of the technologies for suppressing information leakage of data handled by an information processing apparatus such as a computer, there is a technique called a secret sharing method. In the secret sharing method, the original file to be stored is divided into a plurality of split file pieces that do not have meaning by themselves. In a complete secret sharing method, the original file cannot be restored unless all the split file pieces are collected. At least a part of the plurality of split file pieces generated by the division is stored in a device different from the information processing apparatus that created the split file piece, for example. Thereby, even if the information processing apparatus is stolen or lost, the original file cannot be restored only by the split file pieces remaining in the information processing apparatus, and information leakage is suppressed.

[0003] As a technique related to file protection using the secret sharing method, for example, a technique of ending the information processing apparatus after uploading a file to be distributed to an external storage device has been proposed.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] When saving files using secret sharing, the process of splitting the file and transferring it to an external device takes longer than saving the original file directly. Furthermore, if an unexpected event, such as a power outage in the information processing device occurs between the time the user instructs the file to be saved and the completion of saving the distributed files via secret sharing, the distributed files may become corrupted. If the distributed files become corrupted, it becomes impossible to recover the original file.

[0006] In one aspect, this aims to prevent corruption of distributed fragment files. [Means for solving the problem]

[0007] One proposal provides an information processing device capable of communicating with an external storage device. The information processing device comprises a storage device and a processing unit. The processing unit acquires environmental information indicating the protection environment of the original file. The processing unit divides the original file into a first distributed fragment file and a second distributed fragment file in a reconstructible manner. The processing unit stores the first distributed fragment file in the storage device. Based on the environmental information, the processing unit determines whether the storage device or the external storage device will be the storage location for the second distributed fragment file. The processing unit then stores the second distributed fragment file in the storage device or external storage device determined as the storage location. [Effects of the Invention]

[0008] According to one embodiment, corruption of the distributed fragment files can be suppressed. [Brief explanation of the drawing]

[0009] [Figure 1] This figure shows an example of an information processing device to which the file management method according to the first embodiment is applied. [Figure 2] This figure shows an example of the system configuration of the second embodiment. [Figure 3] This figure shows an example of terminal device hardware. [Figure 4]This figure shows an example of storing distributed files using the secret sharing method. [Figure 5] This block diagram shows an example of a file management function using secret sharing. [Figure 6] This figure shows an example of control information used to determine the control method based on the operating environment. [Figure 7] This figure shows an example of control information used to determine the control method based on the operating environment and usage environment. [Figure 8] This figure shows an example of storage location information. [Figure 9] This is a flowchart showing an example of a control method switching process. [Figure 10] This flowchart shows an example of the procedure for distributed storage. [Figure 11] This flowchart shows an example of the startup process when powering on after a sudden power outage. [Figure 12] This figure shows an example of how distributed files are stored in response to changes in the likelihood of sudden power outages. [Modes for carrying out the invention]

[0010] The following description of this embodiment will be made with reference to the drawings. Note that each embodiment can be implemented by combining multiple embodiments within a reasonable scope.

[0011] [First Embodiment] The first embodiment is an information processing device that applies a file management method to suppress corruption of distributed fragment files obtained by partitioning using a secret sharing scheme.

[0012] Figure 1 shows an example of an information processing device to which the file management method according to the first embodiment is applied. The information processing device 10 can implement a file management method to suppress corruption of distributed fragment files, for example, by executing a file management program.

[0013] The information processing apparatus 10 includes a storage device 11 and a processing unit 12. The processing unit 12 is, for example, a processor included in the information processing apparatus 10. The information processing apparatus 10 is, for example, a mobile computer with excellent portability. The information processing apparatus 10 is also capable of communicating with an external storage device 3. The external storage device 3 is, for example, a server computer capable of communicating via a network, a mobile communication terminal capable of communicating via a short-range wireless communication interface, or a memory device that can be connected to and used with the information processing apparatus 10.

[0014] The processing unit 12 performs the following processing to prevent damage to the split file.

[0015] The processing unit 12 acquires environment information indicating the protection environment of the original file 1 to be protected by the secret sharing method. For example, the processing unit 12 acquires the monitoring result of the operating environment such as software in the information processing apparatus 10. The processing unit 12 also acquires the monitoring result of the usage environment indicating the location where the information processing apparatus 10 is used.

[0016] The processing unit 12 divides the original file 1 into a first split file 2a and a second split file 2b so that the original file 1 can be restored. If both the first split file 2a and the second split file 2b are not available, even a part of the original file 1 cannot be restored.

[0017] When the first split file 2a and the second split file 2b are generated by the division, the processing unit 12 stores the first split file 2a in the storage device 11. Also, based on the environment information, the processing unit 12 stores the second split file 2b in the storage device 11 or the external storage device 3. For example, based on the environment information, the processing unit 12 determines whether to perform information leakage countermeasure priority control or file damage countermeasure priority control. When performing information leakage countermeasure priority control, the processing unit 12 stores the second split file 2b in the external storage device 3. When performing file damage countermeasure priority control, the processing unit 12 stores the second split file 2b in the storage device 11.

[0018] By determining the storage location of the second distributed fragment file 2b based on environmental information in this way, it becomes possible to suppress corruption of the second distributed fragment file 2b. For example, if the processing unit 12 determines, based on the environmental information, that the environment is highly likely to cause corruption of the second distributed fragment file 2b, it can store the second distributed fragment file 2b in the storage device 11 by prioritizing file corruption prevention control. If the storage device 11 is the storage location for the second distributed fragment file 2b, the storage time for the first distributed fragment file 2a and the second distributed fragment file 2b using the secret sharing method is shortened, and the possibility of the second distributed fragment file 2b being corrupted due to environmental changes during the storage process is reduced. In addition, if the storage device 11 is the storage location for both the first distributed fragment file 2a and the second distributed fragment file 2b, data corruption due to communication errors and the like is also suppressed.

[0019] Furthermore, if the processing unit 12 determines, based on environmental information, that the environment is unlikely to cause damage to the second distributed fragment file 2b, it can store the second distributed fragment file 2b in the external storage device 3 through information leakage prevention priority control. This ensures that even if the information processing device 10 falls into the hands of a third party due to theft or loss, the second distributed fragment file 2b will not fall into the hands of that third party. As a result, a third party who obtains the information processing device 10 will not be able to restore the original file 1, and the leakage of information within the original file 1 will be suppressed.

[0020] One environment in which the second distributed file 2b is highly likely to be corrupted is, for example, a sudden power outage of the information processing device 10. Therefore, the processing unit 12 may determine whether or not there is a possibility of a sudden power outage based on environmental information. In this case, the processing unit 12 determines the storage location of the second distributed file 2b depending on whether or not there is a possibility of a sudden power outage. For example, if there is a possibility of a sudden power outage, the processing unit 12 stores the second distributed file 2b in the storage device 11. If there is no possibility of a sudden power outage, the processing unit 12 stores the second distributed file 2b in the external storage device 3. This reduces the possibility that the first distributed file 2a or the second distributed file 2b may be corrupted due to a power outage during distributed storage.

[0021] Sudden power outages can occur, for example, due to a forced restart of the operating system (OS). Therefore, the processing unit 12 determines that there is a possibility of a sudden power outage if the environmental information indicates that a process that may restart the OS is currently being executed. Processes that may restart the OS include OS updates and software installations. If there is a possibility of a sudden power outage, the second distributed fragment file 2b is stored in the storage device 11, thereby preventing the second distributed fragment file 2b from being corrupted by a sudden OS restart.

[0022] Furthermore, if the information processing device 10 is operating using a battery as its power source, a sudden power outage can also occur due to a drop in battery voltage. Therefore, the processing unit 12 determines that there is a possibility of a sudden power outage if the environmental information indicates that the battery level is below a predetermined value. This prevents the second distributed fragment file 2b from being corrupted due to a sudden power outage caused by a drop in battery voltage.

[0023] Furthermore, the processing unit 12 can also decide whether to prioritize information leakage prevention control or file corruption prevention control based on the possibility of sudden power outages and the security of the location where the information processing device 10 is being used. For example, the processing unit 12 acquires environmental information such as the results of monitoring the operating environment of the software within the information processing device 10 and the results of monitoring the usage environment indicating the location where the information processing device 10 is being used. Based on the environmental information, the processing unit 12 determines the possibility of sudden power outages and the security of the location where the information processing device 10 is being used, and determines the storage location of the second distributed fragment file 2b according to the possibility of sudden power outages and the security.

[0024] For example, the processing unit 12 has control information 4 pre-set. The control information 4 indicates the control method for saving the second distributed fragment file 2b, which is based on the usage environment indicating the location where the information processing device 10 is being used and the operating environment of the information processing device 10. The location of the information processing device 10 is divided into safe locations and dangerous locations. Safe locations are places such as the company premises, offices, and homes. Dangerous locations are places other than safe locations, such as outside the company premises.

[0025] The operating environment of the information processing device 10 is divided into two states: normal use and a state where there is a possibility of sudden power failure. Normal use is a situation where no possibility of sudden power failure has been detected. Situations where there is a possibility of sudden power failure include, for example, during an OS update, during software installation, or when the battery level falls below a predetermined level.

[0026] According to control information 4, if the information processing device 10 is in normal use, it is determined to prioritize information leakage prevention control, regardless of the location of the information processing device 10. If the information processing device 10 is in a state where there is a possibility of sudden power outage and the location of the information processing device 10 is a safe place, it is determined to prioritize file corruption prevention control. If the information processing device 10 is in a state where there is a possibility of sudden power outage and the location of the information processing device 10 is a dangerous place, it is determined to prioritize information leakage prevention control.

[0027] Based on the control information 4, the processing unit 12 determines the storage location of the second distributed fragment file 2b. If there is a possibility of a sudden power outage and the device is being used in a safe location, the processing unit 12 stores the second distributed fragment file 2b in the storage device 11. If there is no possibility of a sudden power outage or the device is being used in a dangerous location, the processing unit 12 stores the second distributed fragment file 2b in the external storage device 3. This prevents damage to the second distributed fragment file 2b due to a sudden power outage, provided that the risk of the information processing device 10 being stolen is low. Furthermore, even if there is a possibility of a sudden power outage when the device is being used in a dangerous location, the priority control for preventing information leakage is applied, minimizing the increased risk of information leakage.

[0028] As described above, the processing unit 12 stores the second distributed fragment file 2b in the storage device 11 when the environmental information meets predetermined conditions. At this time, if the environmental information no longer meets the predetermined conditions after the second distributed fragment file 2b has been stored in the storage device 11, the processing unit 12 may move the second distributed fragment file 2b from the storage device 11 to the external storage device 3. This shortens the period during which both the first distributed fragment file 2a and the second distributed fragment file 2b are stored in the storage device 11. As a result, the increased risk of information leakage due to implementing control to prevent corruption of the second distributed fragment file 2b is minimized.

[0029] [Second Embodiment] The second embodiment is a computer system that prevents corruption of distributed fragment files by changing the storage location of the distributed fragment files generated by the secret sharing scheme according to the environment of the terminal device being used by the user.

[0030] Figure 2 shows an example of the system configuration of the second embodiment. The terminal device 100 is a computer used by the user to view and edit files. The files viewed and edited by the terminal device 100 are sometimes called original files. The terminal device 100 is a portable, battery-powered computer, such as a notebook personal computer (notebook computer). Alternatively, the terminal device 100 may be a tablet computer.

[0031] Terminal device 100 is connected to server 200 via network 20. Server 200 is a computer for storing files. A memory device 25 can also be connected to terminal device 100. The memory device 25 is a portable recording medium, for example, using flash memory. Terminal device 100 can also communicate data with mobile communication terminal 300 via wired or wireless communication. Mobile communication terminal 300 is an information device such as a smartphone or tablet. Terminal device 100 divides the generated or edited files using secret sharing and stores them on server 200, memory device 25, mobile communication terminal 300, etc.

[0032] Note that the terminal device 100 shown in Figure 2 is an example of the information processing device 10 shown in the first embodiment.

[0033] Figure 3 shows an example of terminal device hardware. The terminal device 100 is controlled as a whole by a processor 101. The processor 101 is connected to a memory 102 and several peripheral devices via a bus 100a.

[0034] The terminal device 100 may be a multiprocessor system having multiple processors. The set of multiple processors in a multiprocessor system can be called a processor 101. The processor 101 may also be called a processor circuitry. Each of the multiple processors can execute some or all of the processes among the multiple processes executed by the terminal device 100. When there are multiple related processes, the processor that executes one process may be different from the processor that executes a different process.

[0035] The processor 101 is, for example, a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or a DSP (Digital Signal Processor). At least some of the functions that the processor 101 implements by executing a program may be implemented by electronic circuits such as an ASIC (Application Specific Integrated Circuit) or a PLD (Programmable Logic Device).

[0036] Memory 102 is used as the main memory of the terminal device 100. At least a portion of the OS program and application programs to be executed by the processor 101 are temporarily stored in memory 102. Various data used for processing by the processor 101 are also stored in memory 102. A volatile semiconductor memory device such as RAM (Random Access Memory) is used as memory 102.

[0037] Peripheral devices connected to bus 100a include a storage device 103, a graphics controller 104, an input interface 105, an optical drive device 106, a device connection interface 107, a network interface 108, and a wireless interface 109.

[0038] The storage device 103 electrically or magnetically writes and reads data from its built-in recording medium. The storage device 103 is used as an auxiliary storage device for the terminal device 100. The storage device 103 stores the OS program, application programs, and various data. For example, the storage device 103 can be an HDD (Hard Disk Drive) or an SSD (Solid State Drive).

[0039] The graphics controller 104 is an arithmetic unit that performs image processing. The graphics controller 104 is, for example, a GPU (Graphics Processing Unit). A monitor 21 is connected to the graphics controller 104. The graphics controller 104 displays images on the screen of the monitor 21 according to instructions from the processor 101. The monitor 21 can be an OLED (Electroluminescence) display device or a liquid crystal display device. If a GPU is used as the graphics controller 104, the graphics controller 104 can also perform complex numerical calculations such as matrix calculations.

[0040] The input interface 105 is connected to a keyboard 22 and a mouse 23. The input interface 105 transmits signals from the keyboard 22 and mouse 23 to the processor 101. Note that the mouse 23 is just one example of a pointing device; other pointing devices can also be used. Other pointing devices include touch panels, tablets, touchpads, and trackballs.

[0041] The optical drive device 106 uses laser light or the like to read data recorded on the optical disc 24 or write data to the optical disc 24. The optical disc 24 is a portable recording medium on which data is recorded in a way that makes it readable by the reflection of light. Examples of optical discs 24 include DVD (Digital Versatile Disc), DVD-RAM, CD-ROM (Compact Disc Read Only Memory), and CD-R (Recordable) / RW (ReWritable).

[0042] The device connection interface 107 is a communication interface for connecting peripheral devices to the terminal device 100. For example, a memory device 25 and a memory reader / writer 26 can be connected to the device connection interface 107. The memory device 25 is a recording medium equipped with a communication function with the device connection interface 107. The memory reader / writer 26 is a device that writes data to or reads data from the memory card 27. The memory card 27 is a card-type recording medium.

[0043] The network interface 108 is connected to the network 20. The network interface 108 transmits and receives data to and from other computers or communication devices via the network 20. The network interface 108 is a wired communication interface, for example, connected by cable to a wired communication device such as a switch or router. Alternatively, the network interface 108 may be a wireless communication interface, connected by radio waves to a wireless communication device such as a base station or access point.

[0044] The wireless interface 109 is a communication interface for short-range wireless communication. The wireless interface 109 can, for example, communicate data with a mobile communication terminal 300.

[0045] The terminal device 100 may also have a receiver for a satellite positioning system such as GPS (Global Positioning System). The terminal device 100 can obtain location information (latitude and longitude) of the place being used based on the data received by the satellite positioning system receiver. If the mobile communication terminal 300 has a satellite positioning system receiver, the terminal device 100 can obtain location information from the mobile communication terminal 300.

[0046] The terminal device 100 can implement the processing functions of the second embodiment using the hardware described above. The information processing device 10 shown in the first embodiment can also be implemented using the same hardware as the terminal device 100 shown in Figure 3.

[0047] The terminal device 100 implements the processing functions of the second embodiment by executing a program recorded on, for example, a computer-readable recording medium. The program describing the processing content to be executed by the terminal device 100 can be recorded on various recording media. For example, the program to be executed by the terminal device 100 can be stored in the storage device 103. The processor 101 loads at least a portion of the program in the storage device 103 into the memory 102 and executes the program. Alternatively, the program to be executed by the terminal device 100 can be recorded on a portable recording medium such as an optical disc 24, a memory device 25, or a memory card 27. The program stored on the portable recording medium becomes executable after being installed in the storage device 103, for example, under control from the processor 101. The processor 101 can also directly read and execute the program from the portable recording medium.

[0048] The terminal device 100 stores a portion of the distributed files, which have been divided using the secret sharing method, in external devices such as the server 200, mobile communication terminal 300, and memory device 25. This ensures that even if the terminal device 100 is stolen, the original file can be restored by a third party, preventing the leakage of information contained in the original file. The storage location of the distributed files changes depending, for example, whether the terminal device 100 is located inside or outside the company.

[0049] Figure 4 shows an example of storing distributed fragment files using the secret sharing method. The storage location of the distributed fragment files is determined depending on whether the user is using the terminal device 100 inside the company 41 or outside the company 42.

[0050] For example, suppose a user runs arbitrary application software on a terminal device 100 within the company 41 and generates or edits the original file 30. Hereinafter, the function realized by running the application software will be referred to as the application.

[0051] The original file 30 is expanded into memory 102, but it is not stored in the storage device 103 in its original format. When an application performs a save process on the original file 30 due to user operation or other reasons, the file management function of the terminal device 100 distributes and saves the original file 30.

[0052] For example, terminal device 100 splits the original file 30 into two using a secret sharing scheme. In the secret sharing scheme, for example, the original file 30 is encrypted, and based on the encrypted data generated by the encryption, two distributed files 31 and 32 are generated. The sizes of the two distributed files 31 and 32 generated by the split are, for example, that distributed file 31 is larger and distributed file 32 is smaller. Terminal device 100 stores the larger distributed file 31 in its storage device 103. Terminal device 100 also stores the smaller distributed file 32 on server 200.

[0053] When the application executes the process of reading the latest original file 30, the terminal device 100 retrieves the distributed fragment file 32 from the server 200. The terminal device 100 then combines the distributed fragment file 32 retrieved from the server 200 with the distributed fragment file 31 stored in the storage device 103 to restore the original file 30.

[0054] In this way, the original file 30 is divided into multiple distributed fragment files 31 and 32 and stored separately. The distributed fragment files 31 remaining on the terminal device 100 alone cannot restore the original file 30 even partially. Therefore, leakage of information contained in the original file 30 due to the theft or loss of the terminal device 100 is prevented.

[0055] Furthermore, when the terminal device 100 is taken outside the company 42, the terminal device 100 copies the distributed fragment file 32 stored in the server 200 to the mobile communication terminal 300 or the memory device 25. In the example in Figure 4, the distributed fragment file 32 is copied to the mobile communication terminal 300. As a result, if the terminal device 100 cannot connect to the company network 20 41, it can obtain the distributed fragment file 32 from the mobile communication terminal 300 via wireless communication and generate the original file 30.

[0056] When a user uses terminal device 100 outside the company 42, edits the original file 30, and performs a save process using an application, terminal device 100 splits the original file 30 into two parts using a secret sharing scheme. Terminal device 100 then saves the larger of the two distributed files 31 in its storage device 103 and saves the smaller of the two distributed files 32 to the mobile communication terminal 300.

[0057] If a user uses the terminal device 100 outside the company 42, for example, if the mobile communication terminal 300 is stored securely, the leakage of information shown in the original file 30 can be prevented even if the terminal device 100 is stolen or lost.

[0058] Furthermore, the distributed fragment files 32 stored on the server 200 or mobile communication terminal 300 are smaller in size than the distributed fragment files 31. This reduces the amount of data that needs to be transmitted via the network 20 or wireless communication, thereby shortening the time required for the distributed storage of the original file 30.

[0059] To ensure the distributed storage of the original file 30 using the secret sharing method shown in Figure 4, the terminal device 100 performs verification processes such as confirming that no errors have occurred in the distributed fragment files 31 and 32. Therefore, distributed storage of the original file 30 using the secret sharing method takes longer than storing the original file 30 in plain text without applying the secret sharing method. For example, distributed storage of the original file 30 may take several minutes.

[0060] On the other hand, terminal device 100 may lose power for reasons other than user operation. Causes of power loss of terminal device 100 include OS updates, software installations, and battery depletion. If terminal device 100 loses power during the process of distributing and saving the original file 30, the distributed fragment files 31 and 32 may become corrupted, making it impossible to recover the original file 30.

[0061] Therefore, if there is a possibility of a sudden power outage, the terminal device 100 applies file corruption countermeasures and distributes the original file 30 for storage. When file corruption countermeasures are applied, for example, the storage location of the distributed fragment file 32 is changed from the server 200 or the mobile communication terminal 300 to the storage device 103 built into the terminal device 100, similar to the distributed fragment file 31.

[0062] Furthermore, even if there is a possibility of a sudden power outage, if the terminal device 100 is being used in a situation where there is a high risk of information leakage, such as outside the company 42, file corruption countermeasures will not be applied, and normal distributed storage will be performed. This will prevent the increased risk of information leakage that would result from applying file corruption countermeasures.

[0063] Figure 5 is a block diagram illustrating an example of a file management function using secret sharing. The terminal device 100 includes an application 110 and a file management unit 120. The application 110 generates or edits source files based on user input. The application 110 performs a save process for source files based on user instructions, for example. The application 110 can also periodically perform a save process for source files being edited. Furthermore, the application 110 outputs an instruction to read a saved source file based on user instructions.

[0064] The file management unit 120 retrieves the original file output by the application 110 for saving and performs distributed storage of the original file using secret sharing. The file management unit 120 also retrieves the distributed fragment file corresponding to the original file based on the application 110's instruction to read the original file and restores the original file. Finally, the file management unit 120 sends the restored original file to the application 110.

[0065] The file management unit 120 includes a storage unit 121, an operating environment monitoring unit 122, a usage environment monitoring unit 123, a control method switching unit 124, and a distributed processing unit 125 for managing the source files using the secret sharing method.

[0066] The storage unit 121 stores information used for distributed storage using the secret sharing method and for restoring the original file based on the distributed fragment files. The storage unit 121 is, for example, part of the storage area within the storage device 103. The storage unit 121 stores control information 121a, applicable control method information 121b, and storage destination information 121c.

[0067] Control information 121a is information indicating the file management control method to be applied based on the status of the terminal device 100. For example, based on the usage status and location of the terminal device 100, control information 121a indicates whether to prioritize information leakage prevention control or file corruption prevention control.

[0068] The applied control method information 121b indicates the currently applied control method. For example, the applied control method information 121b indicates whether the current control method is information leakage prevention priority control or file corruption prevention priority control.

[0069] The storage location information 121c indicates the storage location when saving the distributed fragment files. For example, the storage location information 121c indicates that the storage location for the larger distributed fragment file is a predetermined folder within the storage device 103. The storage location information 121c also indicates that, in the case of information leakage prevention priority control, the storage location for the smaller distributed fragment file is a folder within the server 200, a folder within the mobile communication terminal 300, etc. Furthermore, the storage location information 121c indicates that, in the case of file corruption prevention priority control, the storage location for the smaller distributed fragment file is a folder within the storage device 103.

[0070] The operating environment monitoring unit 122 monitors the operating environment of the terminal device 100 and detects the occurrence of events that could lead to a sudden power outage. For example, the operating environment monitoring unit 122 obtains information on running processes from the OS and monitors whether a process for updating the OS is running. The operating environment monitoring unit 122 also monitors whether a process for installing software such as applications is running. Furthermore, the operating environment monitoring unit 122 monitors the battery level of the terminal device 100. If the operating environment monitoring unit 122 detects an OS update, software installation, or a drop in the battery level below a predetermined value, it transmits information indicating an event that could lead to a sudden power outage to the control method switching unit 124.

[0071] The usage environment monitoring unit 123 monitors the environment in which the terminal device 100 is being used and determines whether it is being used in a location that is safe from information leakage or in a location where there is a risk of information leakage. For example, the usage environment monitoring unit 123 determines that it is a safe location if it can connect to the company's network 20. The usage environment monitoring unit 123 also determines that it is a safe location if the location of the terminal device 100 is within a designated safe facility (office, home, etc.) based on location information such as GPS. If the usage environment monitoring unit 123 cannot determine that it is a safe location, it determines that it is a dangerous location. The usage environment monitoring unit 123 transmits information to the control method switching unit 124 indicating whether the current usage environment is a safe or dangerous location.

[0072] The control method switching unit 124 switches the control method for saving distributed fragment files using the secret sharing method based on the operating environment or usage environment of the terminal device 100. For example, the control method switching unit 124 refers to the control information 121a and determines the control method according to the current operating environment or usage environment. The control method switching unit 124 stores the information indicating the determined control method as applicable control method information 121b in the storage unit 121.

[0073] The distributed processing unit 125 divides the source file generated or edited by the application 110 into distributed fragment files and saves the distributed fragment files according to the control method indicated in the applicable control method information 121b. For example, if the control method is information leakage prevention priority control, the distributed processing unit 125 saves the smaller distributed fragment file to an external device such as the server 200 or mobile communication terminal 300. If the control method is file corruption prevention priority control, the distributed processing unit 125 saves the smaller distributed fragment file to the storage device 103. The distributed processing unit 125 saves the larger distributed fragment file to the storage device 103 regardless of the control method.

[0074] Furthermore, if the control method is changed from file corruption prevention priority control to information leakage prevention priority control, the distributed processing unit 125 retrieves the smaller distributed file from the storage device 103 and saves it to an external device such as the server 200 or mobile communication terminal 300. Then, the distributed processing unit 125 deletes the smaller distributed file from the storage device 103.

[0075] When the application 110 executes the process of reading the original file, the distributed processing unit 125 retrieves the latest distributed fragment file from the distributed fragment file storage location. The distributed processing unit 125 then restores the original file based on the retrieved distributed fragment file and sends the restored original file to the application 110.

[0076] The functions of each element shown in Figure 5 can be realized, for example, by having the processor 101 execute the program module corresponding to that element.

[0077] The file management unit 120 with this functionality performs distributed storage of files using the secret sharing method, according to a control method that corresponds to the protection environment of the original file (operating environment and usage environment). The applicable control method is determined based on the control information 121a. In the example in Figure 5, the control method can be determined based on both the operating environment and the usage environment, but the file management unit 120 may determine the control method based on either the operating environment or the usage environment.

[0078] Figure 6 shows an example of control information for determining the control method based on the operating environment. Control information 121a-1 sets the control method to be applied in accordance with the operating environment of the terminal device 100. According to control information 121a-1, file corruption prevention priority control is applied during OS update execution. File corruption prevention priority control is also applied during software installation. File corruption prevention priority control is also applied when the battery level is low (below a predetermined value). In all other operating environments, information leakage prevention priority control is applied.

[0079] By using this control information 121a-1 to determine the control method for the secret sharing scheme, priority control for preventing file corruption can be applied in the event of a sudden power outage.

[0080] Figure 7 shows an example of control information for determining the control method based on the operating environment and usage environment. Control information 121a-2 sets the control method to be applied in association with the combination of the operating environment and usage environment of the terminal device 100. According to control information 121a-2, if the operating environment is performing an OS update and the usage environment is on the company network or within the office, file corruption prevention priority control is applied. If the operating environment is performing an OS update and the usage environment is neither on the company network nor within the office, information leakage prevention priority control is applied. If the operating environment is performing software installation and the usage environment is on the company network or within the office, file corruption prevention priority control is applied. If the operating environment is performing software installation and the usage environment is neither on the company network nor within the office, information leakage prevention priority control is applied. If the operating environment has a low battery level and the usage environment is on the company network or within the office, file corruption prevention priority control is applied. If the operating environment has a low battery level and the usage environment is neither on the company network nor within the office, information leakage prevention priority control is applied.

[0081] If the operating environment does not fall under any of the above categories, information leakage prevention priority control will be applied regardless of the usage environment (any location).

[0082] The storage location for the distributed fragment files, depending on the control method, is determined based on the storage location information 121c.

[0083] Figure 8 shows an example of storage location information. The storage location information 121c contains information indicating the storage location of the distributed fragment files, associated with the filename of the original file. For example, as information indicating the storage location of the larger distributed fragment file (distributed fragment file (large)), the storage device and the path to the storage folder are set, associated with the filename of that distributed fragment file.

[0084] The storage location for the smaller data fragment file (small fragment file) is set according to the control method. For example, in the case of information leakage prevention priority control, information indicating the storage location for small fragment files is set, associated with the file name of the small fragment file, indicating the storage location for both cases where the small fragment file is not being taken out and where it is being taken out. If the small fragment file is not being taken out, for example, the storage destination device is server 200, and a path indicating a folder within server 200 is set. If the small fragment file is being taken out, for example, the storage destination device is mobile communication terminal 300, and a path indicating a folder within mobile communication terminal 300 is set. In the case of file corruption prevention priority control, the storage destination device for small fragment files is terminal device 100, and a path indicating a folder within the storage device 103 of terminal device 100 is set.

[0085] The control scheme for the secret sharing algorithm to be applied is periodically determined by the control scheme switching unit 124, and the system switches to the appropriate control scheme. In the following description, it is assumed that the control scheme is switched based on the control information 121a-2 shown in Figure 7.

[0086] Figure 9 is a flowchart showing an example of the control method switching process. The process shown in Figure 9 will be explained below according to the step numbers.

[0087] [Step S101] The control method switching unit 124 checks the operating environment of the terminal device 100. For example, the control method switching unit 124 obtains information indicating the current operating environment from the operating environment monitoring unit 122.

[0088] [Step S102] The control method switching unit 124 determines whether there is a possibility of a sudden power outage based on information indicating the operating environment. For example, the control method switching unit 124 determines that there is a possibility of a sudden power outage if the operating environment is in the process of an OS update, software installation, or low battery level. If there is a possibility of a sudden power outage, the control method switching unit 124 proceeds to step S103. If there is no possibility of a sudden power outage, the control method switching unit 124 proceeds to step S106.

[0089] [Step S103] The control method switching unit 124 checks the operating environment of the terminal device 100. For example, the control method switching unit 124 obtains information indicating the current operating environment from the operating environment monitoring unit 123.

[0090] [Step S104] The control method switching unit 124 determines whether the current operating environment is a safe place. For example, the control method switching unit 124 determines that the operating environment is a safe place if it is on the company network or within the office. The control method switching unit 124 determines that the operating environment is not a safe place if it is neither on the company network nor within the office. If the control method switching unit 124 determines that the operating environment is a safe place, it proceeds to step S105. If the control method switching unit 124 determines that the operating environment is not a safe place, it proceeds to step S106.

[0091] [Step S105] The control method switching unit 124 sets the control method to be applied to file corruption prevention priority control. For example, the control method switching unit 124 stores information indicating file corruption prevention priority control as applied control method information 121b in the storage unit 121. After that, the control method switching process ends.

[0092] [Step S106] The control method switching unit 124 sets the control method to be applied to information leakage prevention priority control. For example, the control method switching unit 124 stores information indicating information leakage prevention priority control as applied control method information 121b in the storage unit 121.

[0093] [Step S107] The distributed processing unit 125 determines whether the previous control method was file corruption prevention priority control. For example, each time the original file is distributed and saved, the distributed processing unit 125 saves the current control method in memory 102. Then, each time a control method is set in the applicable control method information 121b, the distributed processing unit 125 compares the previous control method with the newly set control method. If the previous control method was file corruption priority control, the distributed processing unit 125 proceeds to step S108. If the previous control method was information leakage prevention priority control, the control method switching unit 124 terminates the control method switching process.

[0094] [Step S108] The control method switching unit 124 moves the smaller distributed fragment file (small distributed fragment file) stored in the storage device 103 to an external device. For example, the control method switching unit 124 refers to the storage location information 121c to determine the storage location of all the source files to be managed and the storage location of the small distributed fragment file when file corruption prevention priority control is enabled. The control method switching unit 124 then checks whether the small distributed fragment file is stored in the terminal device 100 for all source files. If the small distributed fragment file is stored in the terminal device 100, the control method switching unit 124 reads the small distributed fragment file from the storage device 103 and transfers it to the server 200 or mobile communication terminal 300. The control method switching unit 124 then deletes the small distributed fragment file from the terminal device 100.

[0095] In this way, the control method is determined according to the state of the terminal device 100. Then, the original file is distributed and stored according to the determined control method. Furthermore, when the control method switches from file corruption prevention priority control to information leakage prevention priority control, the distributed fragment files (small) in the storage device 103 are transferred to the server 200 or mobile communication terminal 300, and the distributed fragment files (small) are deleted from the storage device 103. This minimizes the reduction in information leakage security caused by prioritizing file corruption prevention control.

[0096] Figure 10 is a flowchart showing an example of the distributed storage procedure. The process shown in Figure 10 will be explained below according to the step numbers.

[0097] [Step S201] The distributed processing unit 125 obtains the original file to be saved from the application 110.

[0098] [Step S202] The distributed processing unit 125 divides the acquired source file into two distributed fragment files. For example, the distributed processing unit 125 encrypts the source file with a predetermined key, divides the encrypted data using a secret sharing scheme, and generates two distributed fragment files. In this case, the distributed processing unit 125 makes the data size of one distributed fragment file larger than the data size of the other distributed fragment file.

[0099] [Step S203] The distributed processing unit 125 saves the larger distributed fragment file (large) to the storage device 103. For example, the distributed processing unit 125 refers to the storage destination information 121c and obtains the file name, device (terminal device), and path information of the distributed fragment file (large) corresponding to the file name of the original file. The distributed processing unit 125 then stores the distributed fragment file with the obtained file name in the folder indicated by the path in the terminal device 100.

[0100] [Step S204] The distributed processing unit 125 determines whether the file saving control method is file corruption prevention priority control or not. For example, the distributed processing unit 125 refers to the applicable control method information 121b and determines the current control method. If the control method is file corruption prevention priority control, the distributed processing unit 125 proceeds to step S205. If the control method is information leakage prevention priority control, the distributed processing unit 125 proceeds to step S206.

[0101] [Step S205] The distributed processing unit 125 saves the smaller distributed fragment file (small) to the storage device 103. For example, the distributed processing unit 125 refers to the storage destination information 121c and obtains the file name, device (terminal device), and path information of the distributed fragment file (small) in the case of file corruption prevention priority control, which corresponds to the file name of the original file. The distributed processing unit 125 then stores the distributed fragment file with the obtained file name in the folder indicated by the path in the terminal device 100. After that, the distributed processing unit 125 terminates the distributed storage process.

[0102] [Step S206] The distributed processing unit 125 determines whether it can connect to the server 200. If it can connect to the server 200, the distributed processing unit 125 proceeds to step S207. If it cannot connect to the server 200, the distributed processing unit 125 proceeds to step S208.

[0103] [Step S207] The distributed processing unit 125 saves the smaller distributed fragment file (small) to the server 200. For example, the distributed processing unit 125 refers to the storage destination information 121c and obtains the file name, device (server), and path information of the distributed fragment file (small) in the case of information leakage prevention priority control, which corresponds to the file name of the original file. The distributed processing unit 125 then stores the distributed fragment file with the obtained file name in the folder indicated by the path on the server 200. After that, the distributed processing unit 125 terminates the distributed storage process.

[0104] [Step S208] The distributed processing unit 125 saves the smaller distributed fragment file (small) to the mobile communication terminal 300. For example, the distributed processing unit 125 refers to the storage destination information 121c and obtains the file name, device (mobile communication terminal), and path information of the distributed fragment file (small) being taken out in the case of information leakage prevention priority control, which corresponds to the file name of the original file. The distributed processing unit 125 then stores the distributed fragment file with the obtained file name in the folder indicated by the path on the mobile communication terminal 300.

[0105] In this way, while the control method is set to file corruption prevention priority control, the distributed fragment files (small) are stored in the storage device 103 of the terminal device 100. Saving the distributed fragment files to the storage device 103 is completed in a shorter time than saving them to the server 200. Therefore, the possibility of the distributed fragment files being corrupted due to a sudden power outage during distributed storage is reduced.

[0106] If a sudden power outage occurs after switching to file corruption prevention priority control, the file management unit 120 will restore the original file based on the two distributed fragment files stored in the server 200 or storage device 103 when the power is next turned on.

[0107] Figure 11 is a flowchart showing an example of the startup process when power is restored after a sudden power outage. The process shown in Figure 11 will be explained below according to the step numbers.

[0108] [Step S301] The distributed processing unit 125 obtains the control method when the power is lost. For example, the distributed processing unit 125 reads the applicable control method information 121b from the storage unit 121 and obtains the control method indicated in the applicable control method information 121b.

[0109] [Step S302] The distributed processing unit 125 determines whether the control method during a power outage is file corruption prevention priority control or not. If the control method is file corruption prevention priority control, the distributed processing unit 125 proceeds to step S304. If the control method is information leakage prevention priority control, the distributed processing unit 125 proceeds to step S303.

[0110] [Step S303] The distributed processing unit 125 obtains a small distributed file from an external device (server 200 or mobile communication terminal 300). The distributed processing unit 125 then uses the obtained small distributed file and the large distributed file in the storage device 103 to restore the original file. The distributed processing unit 125 sends the restored original file to the restarted application 110. After that, the distributed processing unit 125 proceeds to step S305.

[0111] [Step S304] The distributed processing unit 125 retrieves a small distributed file from an internal device (storage device 103). The distributed processing unit 125 then uses the retrieved small distributed file and the large distributed file in the storage device 103 to restore the original file. The distributed processing unit 125 sends the restored original file to the restarted application 110.

[0112] [Step S305] The file management unit 120 executes a control method switching process. Details of the control method switching process are as described with reference to Figure 9.

[0113] In this way, when power is restored after a sudden power outage, the original files are restored through the startup process. Furthermore, by executing a control method switching process within the startup process, if the cause of the sudden power outage has been resolved, the control method is switched from file corruption prevention priority control to information leakage prevention priority control. As a result, the distributed fragment files (small) stored in storage device 103 are moved to server 200 and deleted from storage device 103. Consequently, the continued high risk of information leakage is prevented.

[0114] Figure 12 shows an example of how distributed fragment files are stored in response to changes in the likelihood of a sudden power outage. In the example in Figure 12, it is assumed that the battery level of terminal device 100 used in company 41 becomes low, creating a possibility of a sudden power outage. Terminal device 100 is in a safe state because it is used in company 41. Therefore, the control method is switched to file corruption prevention priority control. When the original file 30 in memory 102 is distributed and stored, both distributed fragment files 31 and 32 are stored in storage device 103.

[0115] Subsequently, the terminal device 100 is assumed to be connected to a power source. When connected to a power source, the terminal device 100 begins charging, reducing the possibility of a sudden power outage. Then, the control method is switched from file corruption prevention priority control to information leakage prevention priority control by a control method switching process that is performed periodically. In response to the control method switch, the smaller of the two distributed fragment files 31 and 32 stored in the storage device 103, the distributed fragment file 32, is moved to the server 200. The moved distributed fragment file 32 is deleted from the storage device 103.

[0116] In this way, the change in the storage location of the distributed fragment files 32 due to the switch in the control method is performed automatically without the user being aware of it. Therefore, it is possible to prevent the corruption of the original file due to a sudden power outage without causing any extra trouble for the user, and the increased risk of information leakage that comes with preventing the corruption of the original file can be kept to a minimum.

[0117] Although embodiments have been illustrated above, the configurations of each part shown in the embodiments can be replaced with others having similar functions. Furthermore, other arbitrary components or processes may be added. Moreover, any two or more configurations (features) from the embodiments described above may be combined. [Explanation of Symbols]

[0118] 1 Original file 2a First Dispersed Fragment File 2b Second Dispersed Fragment File 3 External storage device 4. Control Information 10 Information Processing Devices 11 Storage devices 12 Processing Units

Claims

1. In an information processing device capable of communicating with an external storage device, Storage device and A processing unit that acquires environmental information indicating the protection environment of the original file, divides the original file into a first distributed fragment file and a second distributed fragment file in a reconstructible manner, stores the first distributed fragment file in the storage device, determines either the storage device or the external storage device as the storage destination for the second distributed fragment file based on the environmental information, and stores the second distributed fragment file in the storage device or the external storage device determined as the storage destination, An information processing device having

2. The processing unit determines whether there is a possibility of a sudden power outage based on the environmental information, and determines the storage location of the second distributed fragment file according to whether there is a possibility of a sudden power outage. The information processing apparatus according to claim 1.

3. The processing unit stores the second distributed file in the storage device if there is a possibility of a sudden power outage, and stores the second distributed file in the external storage device if there is no possibility of a sudden power outage. The information processing apparatus according to claim 2.

4. The processing unit determines that there is a possibility of a sudden power outage if the environmental information indicates that a process that may restart the operating system is currently being executed. The information processing apparatus according to claim 2.

5. The processing unit determines, based on the environmental information, that there is a possibility of a sudden power outage if the battery level is below a predetermined value. The information processing apparatus according to claim 2.

6. The processing unit determines, based on the environmental information, whether there is a possibility of a sudden power outage and the safety of the location where the information processing device is being used, and determines the storage location of the second distributed fragment file based on whether there is a possibility of a sudden power outage and the safety of the location where it is being used. The information processing apparatus according to claim 1.

7. The processing unit stores the second distributed fragment file in the storage device if there is a possibility of sudden power outage and the device is being used in a safe location, and stores the second distributed fragment file in the external storage device if there is no possibility of sudden power outage or the device is being used in a dangerous location. The information processing apparatus according to claim 6.

8. The processing unit stores the second distributed fragment file in the storage device if the environmental information satisfies predetermined conditions, and after storing the second distributed fragment file in the storage device, moves the second distributed fragment file from the storage device to the external storage device if the environmental information no longer satisfies the predetermined conditions. The information processing apparatus according to claim 1.

9. On the computer, Obtain environmental information indicating the protection environment of the original file, The original file is divided into a first distributed fragment file and a second distributed fragment file in a way that allows for recovery. The first distributed fragment file is stored in a storage device owned by the computer. Based on the aforementioned environmental information, either the storage device or the external storage device is determined as the storage destination for the second distributed fragment file. The second distributed fragment file is stored in the storage device or external storage device determined as the storage destination. A file management program that executes processing.

10. Computers Obtain environmental information indicating the protection environment of the original file, The original file is divided into a first distributed fragment file and a second distributed fragment file in a way that allows for recovery. The first distributed fragment file is stored in a storage device owned by the computer. Based on the aforementioned environmental information, either the storage device or the external storage device is determined as the storage destination for the second distributed fragment file. The second distributed fragment file is stored in the storage device or external storage device determined as the storage destination. File management methods.

Images