Information processing device, information processing program, and information processing method

Abstract

The present invention provides an information processing device and information processing program that facilitate the use of any external device for display while preventing information leakage. [Solution] This information processing device comprises an external device information acquisition unit that acquires identification information of an external device that acquires or displays display information, an authorization information holding unit that holds authorization information relating to an external device that is authorized to acquire or display display information among the external devices, and a display information control unit that controls the acquisition or display of display information on the external device based on the identification information and the authorization information.

Description

Technical Field

[0001] The present disclosure relates to an information processing apparatus, an information processing program, and an information processing method. relates to.

Background Art

[0002] In computer terminals, as a countermeasure against information leakage, for example, devices or programs for prohibiting connection of unauthorized external devices may be installed. For example, a technique of physically locking a USB port to prevent connection of an external device, a connection control program for identifying connection of an unauthorized external device to a USB port, and the like are known.

Prior Art Literature

Patent Literature

[0003]

Patent Literature 1

Summary of the Invention

Problem to be Solved by the Invention

[0004] Even for an external device (for example, a display device) that can acquire or display display information output from a computer terminal, and further can, for example, record the acquired display information, it is required to execute control that prohibits acquisition or display of display information for devices other than specific devices. In this case, it has been common to physically lock the port of the external device.

[0005] However, physically locking the ports of external devices is inconvenient and cumbersome, as it would require unlocking and locking the physical lock each time you wanted to connect, for example, an external monitor or projector installed in a specific location (e.g., a secure conference room) where connection is permitted. Furthermore, if the computer terminal in question is portable (e.g., a laptop PC), attaching a physical lock could be cumbersome during transport or even cause damage during transit.

[0006] Furthermore, a method is known that uses the firmware functions of a computer terminal to control the display on external devices. However, even with such a display control method, if an authorized external monitor device is to be connected, an administrator who knows the firmware password must enter the password each time, which is still inconvenient.

[0007] In view of the above-mentioned problems, the present invention aims to provide an information processing device and an information processing program that facilitate the use of any external device for display while preventing information leakage. [Means for solving the problem]

[0008] The information processing apparatus of the first embodiment of the present disclosure comprises: an external device information acquisition unit that acquires identification information of an external device that acquires or displays display information; an authorization information holding unit that holds authorization information relating to an external device that is authorized to acquire or display display information among the external devices; and a display information control unit that controls the acquisition or display of display information on the external device based on the identification information and the authorization information. According to the information processing apparatus of the first embodiment, when the identification information of an external device is acquired, authorization information held in the authorization information holding unit is obtained, and the acquisition or display of display information on the external device is controlled based on this identification information and authorization information. If the external device to be used is already held in the authorization information holding unit, the external device information acquisition unit can acquire the identification information, and the display information can be acquired or displayed on the external device.

[0009] In the information processing apparatus of the first embodiment, the display information control unit can restrict the transmission of display information on external devices if the identification information and the authorization information do not match. As a result, display information is acquired or displayed on external devices where the identification information and authorization information match, and the display of display information is restricted on external devices where they do not match, thereby effectively preventing information leakage.

[0010] In the information processing apparatus of the first embodiment, the display information control unit can permit the acquisition or display of display information on the multiple external devices if a match is obtained between the identification information and the permission information for all of the multiple external devices from which the identification information has been acquired, and can restrict the transmission of display information to all of the multiple external devices if a match is not obtained between the identification information and the permission information for at least some of the multiple external devices from which the identification information has been acquired. This allows for more effective prevention of information leakage.

[0011] The above identification information may be information from the VESA (Video Electronics Standards Association) Display Data Channel of the external device. This allows the identification information of the external device to be automatically read via plug-and-play.

[0012] The information processing program of the present disclosure causes a computer to perform the following steps: acquire identification information of an external device that acquires or displays display information; maintain permission information relating to an external device among the external devices that is permitted to acquire or display display information; and control the acquisition or display of display information on the external device based on the identification information and the permission information. The information processing method of the present disclosure also includes the steps of acquiring identification information of an external device that acquires or displays display information; maintaining permission information relating to an external device among the external devices that is permitted to acquire or display display information; and controlling the acquisition or display of display information on the external device based on the identification information and the permission information. [Brief explanation of the drawing]

[0013] [Figure 1] Figure 1 is a schematic diagram illustrating a display control program (monitoring program) according to the first embodiment and a computer 10 (information processing device) on which the display control program is installed. [Figure 2] Figure 2 shows an example of the data structure of the identification information of the monitoring device acquired by the monitoring device information acquisition unit 21. [Figure 3] Figure 3 shows an example of the data structure of the authorization information held in the authorization monitoring device information holding unit 22. [Figure 4] Figure 4 is a flowchart illustrating the monitoring and display control operations of the monitoring device by the computer 10 and display control program according to the first embodiment. [Figure 5] Figure 5 is a schematic diagram illustrating the configuration of the computer 10 and the display control program according to the second embodiment. [Figure 6] This is a flowchart illustrating the monitoring and display control operations of the monitoring device by the computer 10 and the display control program according to the second embodiment. [Figure 7] Figure 7 shows an example of the display screen displayed on each monitor device when display restrictions are imposed on all monitor devices in step S20. [Modes for carrying out the invention]

[0014] This embodiment will be described below with reference to the attached drawings. In the attached drawings, functionally identical elements may be indicated by the same number. The attached drawings show embodiments and implementation examples in accordance with the principles of this disclosure, but they are for the purpose of understanding this disclosure and are not to be used in any way to restrict the interpretation of this disclosure. The descriptions in this specification are merely typical examples and do not limit the claims or applications of this disclosure in any way.

[0015] While this embodiment is described in sufficient detail for those skilled in the art to implement the disclosure, it is important to understand that other implementations and forms are possible, and that the configuration and structure can be modified and various elements replaced without departing from the scope and spirit of the technical idea of ​​this disclosure. Therefore, the following description should not be construed as limiting to this.

[0016] [First Embodiment] Referring to Figure 1, the display control program (monitoring program) and the computer 10 (information processing device) on which the display control program is installed will be described. A monitor device, which is an example of an external device having a display function, is connected to this computer 10, and the display control program (monitoring program) monitors whether the connected monitor device is authorized or unauthorized. If the monitoring determines that the monitor device is authorized (authorized monitor device), display information is output from the computer 10 to that monitor device, and the monitor device becomes capable of acquiring or displaying the display information, and furthermore, depending on the functions of the monitor device, it can record, edit, combine, etc., the acquired display information. On the other hand, in the case of a monitor device that is not authorized (unauthorized monitor device), the computer 10 executes restrictions on the acquisition or display of display information (transmission stop, disable, mask processing, resolution reduction, etc.). Note that a monitor device is a form of external device. External devices may include not only devices that display display information, but also devices that acquire display information but do not display it, only recording, etc. In the following, a monitor device will be used as an example of an external device.

[0017] This computer 10 has a hardware configuration that includes a CPU (Central Processing Unit) 11, an input / output interface (I / F) 12, RAM (Random Access Memory) 13, ROM 14 (Read Only Memory) storage 15, a communication I / F 17, and a display control unit 18. The CPU 11, I / O I / F 12, RAM 13, ROM 14, storage 15, and communication I / F 17 are each connected to each other via a bus (not shown) so that they can communicate with one another.

[0018] The CPU 11 is a central processing unit that executes various programs and controls each unit. The CPU 11 is an example of a processor. The input / output I / F 12 acquires input signals from unillustrated input devices (such as a mouse, a keyboard, a microphone, etc.) and outputs output signals to various output devices (such as a speaker, a display, etc.).

[0019] The RAM 13 temporarily stores programs or data as a working area. The ROM 14 stores firmware, a BIOS, and the like. The storage 15 is configured of a storage device such as a hard disk drive (HDD), a solid state drive (SSD), or a flash memory, and stores various programs (an operating system, middleware, application programs, etc.) and various types of data.

[0020] The CPU 11 reads out the application program and the display control program according to the present embodiment from the storage 15, and executes the application program and the display control program using the RAM 13 as a working area. Note that the application program and the display control program are not limited to being stored in the storage 15, and may be stored in a recording medium such as an optical disc, a USB (Universal Serial Bus) memory, or an SD memory card.

[0021] Furthermore, the application program and the display control program may be downloadable to the information processing device 10 via a communication I / F. The application program and the display control program can be provided as a program product. A program product includes any form of product for providing a program. For example, a program product includes programs provided via a network such as the Internet, and non-transitory computer-readable recording media such as an optical disc storing the program therein.

[0022] The communication interface 17 is an interface for connecting the information processing device 10 to a network. The communication interface 17 can use, for example, wired communication standards such as Ethernet (registered trademark) or FDDI (Fiber Distributed Data Interface), or wireless communication standards such as 4G, 5G, or Wi-Fi (registered trademark). The display control unit 18 controls the acquisition or display of display information on the connected monitoring device according to the application program and the display control program.

[0023] The display control program includes a monitor device information acquisition unit 21 that collects and acquires information from various monitor devices connected to the computer 10 as identification information, an authorized monitor device information holding unit 22 which serves as a database that holds authorization information regarding device information that is permitted to connect among the connected monitor devices, and a display information control unit 23 which controls the acquisition or display of display information on the monitor device based on the identification information and authorization information.

[0024] Generally, monitor devices connected to a computer support communication using the VESA Display Data Channel standard. Version 1.4 of the Extended Display Identification Data exchanged between the computer 10 and the monitor devices (M1, M2) under this standard includes information such as Manufacturer ID, Manufacturer product code, Serial number, and Week / Year of manufacture. Additionally, the EDID Monitor Descriptors contain information that individually identifies the monitor device, such as Monitor serial number and Monitor name (hereinafter referred to as identification information). The monitor device information acquisition unit 21 acquires this identification information from the monitor device to individually identify the connected monitor device. In accordance with the VESA Display Data Channel, the identification information can be automatically acquired by the computer 10 without any input operations, through the plug-and-play operation of the target monitor device. Note that the identification information is not limited to that derived from the VESA standard; it may also be information that can identify other monitor devices. For example, personal information of the monitor device owner, information about the monitor device's installation location, IP address, MAC address, etc., may constitute part of the identification information.

[0025] The authorized monitor device information holding unit 22 holds authorization information for authorized monitor devices in the form of an authorized monitor list. The authorization information, like the identification information, may be information obtained from the VESA Display Data Channel.

[0026] Figure 2 shows an example of the data structure of the identification information of a monitor device acquired by the monitor device information acquisition unit 21. As an example, the monitor device information acquisition unit 21 acquires the serial number assigned to the monitor device whose identification information has been acquired, and the identification information (VESA-related information) in list format, and stores it in a predetermined storage device (for example, RAM 13).

[0027] Figure 3 shows an example of the data structure of the authorization information held by the authorization monitor device information holding unit 22. As an example, the authorization monitor device information holding unit 22 holds the serial number, VESA-related information, and authorization information indicating whether or not an authorization is granted (authorized = "1", unauthorized = "0"). In the example in Figure 3, information on unauthorized monitor devices is also shown to be held in the authorization monitor device information holding unit 22, but it is also possible to hold information only on authorized monitor devices and delete information on unauthorized monitor devices from the list as appropriate.

[0028] The display information control unit 23 compares the identification information (VESA-related information) acquired by the monitor device information acquisition unit 21 with the authorization information held in the authorization monitor device information holding unit 22. If the comparison determines that the monitor device connected to the computer 10 is an authorization monitor device, the display information is transmitted to the monitor device, enabling the display of information on that monitor device. On the other hand, if the comparison determines that the monitor device connected to the computer 10 is an unauthorized monitor device, the acquisition or display of information on that monitor device is restricted.

[0029] One possible method for acquiring or restricting the display of information is to stop the transmission of the displayed information itself. Alternatively, the display on the monitoring device can be changed to a black screen or a warning screen displaying a message to that effect, informing the user of the monitoring device that the display is not permitted. Furthermore, display restrictions may be implemented by masking only a portion of the display screen or by reducing the resolution to a predetermined value or lower. Such display control and monitoring by the display information control unit 23 may be performed continuously or at predetermined time intervals.

[0030] Next, referring to the flowchart in Figure 4, the monitoring and display control operations of the computer 10 and display control program according to the first embodiment will be described.

[0031] When monitoring devices are connected to the computer 10 (for example, when an authorized monitoring device M1 and an unauthorized monitoring device M2 are connected, as shown in Figure 1), the monitor device information acquisition unit 21 of the display control program first acquires a list of the connected monitoring devices (step S11).

[0032] Subsequently, if information from multiple monitoring devices (e.g., VESA-related information) is obtained, processing proceeds sequentially for each of the multiple monitoring devices (step S12). First, VESA-related information is obtained from one of the monitoring devices connected to the computer 10 (step S13). The obtained VESA-related information is acquired and stored in the monitoring device information acquisition unit 21.

[0033] Computer 10 stores information about monitor devices that have been pre-authorized to connect as an authorized monitor list in the authorized monitor device information storage unit 22, including, for example, VESA-related information, as described above. In step S14, the identification information of the connected monitor device (M1 or M2) acquired by the monitor device information acquisition unit 21 is compared with the authorized monitor list stored in the authorized monitor device information storage unit 22. If the comparison results in a determination that the identification information matches one of the authorized monitor lists (Yes in step S15), the process proceeds to step S17. On the other hand, if no matching identification information is found in the authorized monitor list (No in step S15), the process proceeds to step S16 to restrict the display operation of the monitor device. If a Yes determination is made in step S15, and a display restriction has already been applied to the monitor device, that display restriction may be removed.

[0034] The above judgment process is repeated in steps S12 to S16 until it is completed for all connected monitoring devices (step S17).

[0035] As explained above, according to the computer 10 and display control program of the first embodiment, if an unauthorized monitoring device is connected to the computer 10, the display for that monitoring device will be restricted. On the other hand, for monitoring devices for which permission information is registered in the authorized monitoring device information holding unit 22 of the computer 10, permission to display is granted, and the monitoring device can receive display information from the computer 10 and perform the display. In other words, according to the computer 10 and display control program of the first embodiment, it is possible to prevent the leakage of information from the computer 10 while making it easy to use any monitoring device for display and reducing the burden on the user of the monitoring device.

[0036] Such a computer 10 and display control program are designed for use in environments where information leakage prevention is crucial. They are effective in environments requiring high security, such as SOCs (Security Operations Centers), and remote work environments, including teleworking, where protecting against information leakage to others is essential. In particular, in security rooms where cameras and other recording devices are prohibited, it can be difficult to prevent the introduction of cable-type screen capture devices, which are easier to disguise and bring in than recording devices. In such environments, the ability of computer 10 to select monitor devices can improve security.

[0037] [Second Embodiment] Next, the computer 10 (information processing device) and display control program according to the second embodiment will be described. Figure 5 is a block diagram illustrating the configuration of the computer 10 and display control program according to the second embodiment. As shown in Figure 5, the hardware configuration is the same as that of the first embodiment, so redundant explanations will be omitted. However, in this second embodiment, the operation when an unauthorized monitoring device is connected differs from that of the first embodiment. This point will be explained below.

[0038] In the second embodiment, if the computer 10 determines, as a result of monitoring the monitoring devices, that all of the multiple monitoring devices are authorized monitoring devices, it permits the acquisition or display of display information for all of those monitoring devices. On the other hand, if it is determined that at least one of the multiple monitoring devices is an unauthorized monitoring device, the acquisition or display of display information is restricted not only for the unauthorized monitoring device but also for all monitoring devices, including the authorized monitoring devices (see Figure 5). This differs from the first embodiment, in which the acquisition or display of display information is restricted only for unauthorized monitoring devices. By restricting the acquisition or display of display information for all monitoring devices, including authorized monitoring devices, the use of unauthorized monitoring devices becomes apparent to multiple users using the computer 10, thus improving security.

[0039] Next, referring to the flowchart in Figure 6, the monitoring and display control operations of the computer 10 and display control program for the monitoring equipment according to the second embodiment will be explained. The processing in steps S11 to S14 is the same as in the first embodiment (Figure 4), so redundant explanations will be omitted.

[0040] In step S14, the identification information of one of the connected monitor devices (M1 or M2) acquired by the monitor device information acquisition unit 21 is compared with the authorized monitor list held in the authorized monitor device information holding unit 22. If the comparison results in a determination that the identification information matches one of the authorized monitor lists (Yes in step S15), the process proceeds to step S17. On the other hand, if no matching identification information is found in the authorized monitor list (No in step S15), the process proceeds to step S18, where display restriction information is registered for the monitor device in question to restrict its display operation. The above operations from steps S12 to S15 are repeated until the operations have been completed for all connected monitor devices (step S17).

[0041] In step S19, based on the operations in steps S12 to S17, it is determined whether there are any monitor devices among the multiple monitor devices connected to the computer 10 that have identification information that does not match the authorized monitor list. Specifically, it is determined whether there are any monitor devices for which display restriction information has been registered in step S18. If yes, in step S20, the acquisition or display of display information is restricted for all monitor devices, including authorized monitor devices (step S20). On the other hand, if a match with the authorized monitor list is determined for all connected monitor devices, the display operation is performed for all such monitor devices without any display restrictions being implemented.

[0042] Figures 7(a) and 7(b) show examples of display screens that appear on each monitoring device when display restrictions are applied to all monitoring devices in step S20. When display restrictions are applied to all monitoring devices, the display may simply be restricted on each of the multiple monitoring devices, but by displaying messages like those shown in Figures 7(a) and 7(b), it becomes possible to inform each user of the current status.

[0043] Figure 7(a) shows an example of a display for an unauthorized monitor device in which a match between the authorized monitor list and the identification information was not determined. In the case of an unauthorized monitor device, since the device has not been authenticated and cannot be used, a message may be displayed indicating that it will become usable after the authentication process is completed. Upon receiving this message, the user of the unauthorized monitor device can take the necessary actions and perform the authentication process (registration to the authorized monitor device information storage unit 22, etc.) for the unauthorized monitor device, thereby enabling the unauthorized monitor device to be used as an authorized monitor device.

[0044] Figure 7(b) shows an example of the display on an authorized monitoring device. An authorized monitoring device can display information from computer 10 if all other monitoring devices connected to computer 10 are authorized monitoring devices. However, if even one unauthorized monitoring device is among the connected monitoring devices, the authorized monitoring device's display will also be restricted. In this case, as shown in Figure 7(b), the presence of other unauthorized monitoring devices is notified by a message. By checking this message, the user of the authorized monitoring device can address the problem by instructing the user of the unauthorized monitoring device to disconnect or to register it in the authorized monitoring list.

[0045] As explained above, according to the computer 10 and display control program of the second embodiment, if an unauthorized monitoring device is connected to the computer 10, the acquisition or display of display information for all monitoring devices, including authorized monitoring devices, is restricted. As a result, information leakage is prevented more effectively than in the first embodiment.

[0046] The present invention is not limited to the embodiments described above, and includes various modifications. For example, the embodiments described above are described in detail to make the present invention easier to understand, and are not necessarily limited to those having all the configurations described. Furthermore, it is possible to replace parts of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add configurations from other embodiments to the configuration of one embodiment. In addition, it is possible to add, delete, or replace parts of the configuration of each embodiment with other configurations. [Explanation of Symbols]

[0047] 10… Computer 11…CPU 12…Input / Output Interface 13…RAM 14…ROM 15…Storage 17…Communication Interface 18 Display Control Unit 21. Monitor Equipment Information Acquisition Unit 22 Authorized monitoring device information holding unit 23 Display Information Control Unit

Claims

1. An external device information acquisition unit acquires identification information of an external device that acquires or displays display information, A permission information holding unit that holds permission information relating to external devices among the aforementioned external devices that are permitted to acquire or display display information, A display information control unit controls the acquisition or display of display information in the external device based on the identification information and the authorization information. An information processing device equipped with the following features.

2. The information processing apparatus according to claim 1, wherein the display information control unit restricts the transmission of display information on the external device for the external device in which the identification information and the permission information do not match.

3. The display information control unit, If a match is obtained between the identification information and the authorization information for all of the multiple external devices from which the identification information has been acquired, the acquisition or display of the display information on the multiple external devices is permitted. The information processing apparatus according to claim 1, wherein if a match cannot be obtained between the identification information and the authorization information for at least some of the multiple external devices from which the identification information has been obtained, the transmission of display information is restricted to all of the multiple external devices.

4. The information processing apparatus according to any one of claims 1 to 3, wherein the identification information is information from the VESA (Video Electronics Standards Association) Display Data Channel of the external device.

5. A step of acquiring the identification information of an external device that acquires or displays the display information, The steps include: holding permission information for external devices among the aforementioned external devices that are permitted to acquire or display display information, A step of controlling the acquisition or display of display information on the external device based on the identification information and the authorization information. An information processing program that causes a computer to execute something.

6. The information processing program according to claim 5, wherein the step of controlling the display on the external device is to restrict the transmission of display information on the external device for external devices in which the identification information and the permission information do not match.

7. The step of acquiring or controlling the display information in the external device is: If a match is obtained between the identification information and the authorization information for all of the multiple external devices from which the identification information has been acquired, the acquisition or display of the display information on the multiple external devices is permitted. The information processing program according to claim 5, which restricts the transmission of display information on all of the multiple external devices if a match cannot be obtained between the identification information and the permission information for at least some of the multiple external devices from which the identification information has been obtained.

8. The information processing program according to any one of claims 5 to 7, wherein the identification information is information from the VESA (Video Electronics Standards Association) Display Data Channel of the external device.

9. Steps to obtain identification information of external devices, The steps include: holding permission information for external devices among the aforementioned external devices that are permitted to display information; A step of controlling the acquisition or display of information on the external device based on the identification information and the authorization information. An information processing method comprising the following:

Images