Information processing device

Abstract

To provide an information processing device capable of properly managing an object file to be distributed.SOLUTION: An information processing device executes file management processing. The information processing device includes an acquisition part for acquiring a file to be stored in a storage part, a determination part for allowing a creator of the file to determine whether reliability information showing a reliability degree of the file is attached to the file acquired by the acquisition part on the basis of whether to be an OS (Operating System), or whether to have a digital signature having certificates issued by two or more organizations, and a processing part for dividing the file into a first distribution file and a second distribution file in a restorable manner on the basis of a result determined by the determination part, storing the first distribution file in the storage part, and storing the file and the second distribution file in an external storage device.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] An embodiment of the present invention relates to an information processing device. [Background technology]

[0002] In recent years, companies have been taking measures to prevent information leakage of confidential information such as company secret information and customer information from information processing devices owned by the company. One measure to prevent information leakage is, for example, a file management system that manages files by linking information processing devices used by employees with an external storage device and distributing the files to each of the information processing devices and the external storage device (for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 6705999 Summary of the Invention [Problem to be solved by the invention]

[0004] When using a file management system such as the one described above, for example, the storage destination and file type (for example, file extension) of the files to be managed may be limited. The reason for the limitation is that, for example, if a file such as an OS (Operating System) is set as a distribution target, it is assumed that the information processing device itself may not operate.

[0005] In such cases, as a measure to prevent information leaks, the administrator is notified of log information indicating that the files, etc. that are not subject to distribution are notified. Also, since the amount of log information to be notified to the administrator can be enormous, the logs to be notified to the administrator may be set to monitor only files of specific types or extensions.

[0006] However, for example, if a malicious user creates a file with a forged file extension, even if the file is actually to be distributed, it may not be possible to detect it by its extension, and the file may not be distributed, leaving room for further improvement.

[0007] Therefore, one example of a problem to be solved by the present invention is to provide an information processing device capable of appropriately managing files to be distributed. [Means for solving the problem]

[0008] A first aspect of the present invention is an information processing device that executes file management processing, comprising: an acquisition unit that acquires a file stored in a memory unit; a judgment unit that judges whether the file acquired by the acquisition unit has trust information indicating the trustworthiness of the file based on whether the creator of the file is an OS (Operating System) or whether the file has a digital signature having a certificate issued by two or more institutions; and a processing unit that divides the file into a first distributed file and a second distributed file so as to be able to be restored based on the result judged by the judgment unit, stores the first distributed file in a memory unit, and stores the file and the second distributed file in an external storage device.

[0010] In addition, the second aspect of the present invention is An information processing device that executes file management processing comprises an acquisition unit that acquires a file stored in a memory unit, a judgment unit that determines whether the file acquired by the acquisition unit is assigned trust information indicating the trust level of the file, and a processing unit that divides the file into a first distributed file and a second distributed file in a manner that allows the file to be restored based on the result determined by the judgment unit, stores the first distributed file in a memory unit, and stores the file and the second distributed file in an external storage device.

[0011] Furthermore, when the determination unit determines that the trust information is added to the file acquired by the acquisition unit, the determination unit may prevent the file management process from being executed for the file.

[0012] The trust information may also include at least one of a digital signature created by the OS or having a certificate issued by two or more authorities. Effect of the Invention

[0013] According to the present invention, it becomes possible to appropriately manage files to be distributed. [Brief description of the drawings]

[0014] [Figure 1] FIG. 1 is a diagram illustrating an example of a schematic configuration of an information processing system according to an embodiment. [Diagram 2] FIG. 2 is a block diagram illustrating an example of a hardware configuration of the information processing device according to the embodiment. [Diagram 3] FIG. 3 is a block diagram illustrating an example of a functional configuration of the information processing device according to the embodiment. [Figure 4] FIG. 4 is a flowchart showing an example of processing executed by the information processing device according to the embodiment. [Diagram 5] FIG. 5 is a flowchart illustrating an example of processing executed by the information processing device according to the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. The configuration of the embodiment described below and the actions and effects brought about by the configuration are merely examples and are not limited to the following description.

[0016] 1 is a diagram showing an example of a schematic configuration of an information processing system 1 according to an embodiment. The information processing system 1 according to this embodiment is a system that processes files under management by file management processing. The information processing system 1 processes the files under management in a state in which the original files cannot be obtained by the information processing device 2 alone, while allowing the files under management to be operated by the information processing device 2 by linking the information processing device 2 with an external storage device 3.

[0017] The information processing system 1 includes an information processing device 2 and an external storage device 3 connected to the information processing device 2 via an in-house network (not shown). The in-house network includes a wireless network (also called wireless) and a wired network (also called wired).

[0018] The information processing device 2 is a device where an operator (specifically, an employee of a company) performs file operations on the original files of files under management. The information processing device 2 is a portable device that can be taken outside the company (i.e., an environment where connection to the internal network is not possible). The information processing device 2 is, for example, a personal computer. Note that the information processing device 2 may be, for example, a smartphone, a tablet-type personal computer, etc., as long as it is capable of file operations.

[0019] The external storage device 3 is a non-volatile storage device that is accessible from within the company (specifically, the company network) (in other words, accessible only under limited circumstances). The external storage device 3 is managed in an environment where strict crime prevention and security measures are implemented, such as within the company or in a data center.

[0020] 2 is a block diagram showing an example of a hardware configuration of an information processing device 2 according to an embodiment. The information processing device 2 illustrated here has a configuration similar to that of a general-purpose computer, and includes a CPU (Central Processing Unit) 21, a RAM (Random Access Memory) 22, a ROM (Read Only Memory) 23, an auxiliary storage device 24, a user I / F (Interface) 25, and an external I / F 26.

[0021] The CPU 21 performs a predetermined arithmetic processing using the RAM 22 as a working area according to a program stored in the ROM 23 or the auxiliary storage device 24. The auxiliary storage device 24 is a non-volatile memory, and stores various data necessary for the processing of the CPU 21. The auxiliary storage device 24 is, for example, configured with a hard disk drive (HDD) or a solid state drive (SSD). The user I / F 25 is a device that enables the transmission and reception of information between a user (a company employee) and the information processing device 2, and may be a liquid crystal display, a keyboard, or the like. The external I / F 26 is, for example, a device for establishing communication with another information processing device 2 via a network in accordance with a predetermined standard. Note that the configuration of the information processing device 2 is not limited to the above.

[0022] Fig. 3 is a block diagram showing an example of a functional configuration of the information processing device 2 according to the embodiment. The information processing device 2 according to the present embodiment includes a storage unit 201, a reception unit 202, a generation unit 203, a setting unit 204, an acquisition unit 205, a determination unit 206, and a processing unit 207. These functional components 201 to 207 can be configured, for example, by cooperation between hardware elements and software elements (such as programs stored in the ROM 23 or the auxiliary storage device 24) of the information processing device 2 as exemplified in Fig. 2. Note that the functional configuration of the information processing device 2 is not limited to the above.

[0023] The memory unit 201 stores the contents received by the receiving unit 202. The memory unit 201 also stores the contents generated by the generating unit 203. The memory unit 201 also stores the contents set by the setting unit 204. The memory unit 201 stores the contents acquired by the acquiring unit 205. The memory unit 201 also stores the contents determined by the determining unit 206. The memory unit 201 also stores the contents stored by the processing unit 207. The memory unit 201 is realized, for example, by an auxiliary storage device 24 provided in the information processing device 2.

[0024] The reception unit 202 receives information for executing a file management process. Specifically, the reception unit 202 receives information for the information processing device 2 to connect to the external storage device 3. For example, the reception unit 202 cooperates with the user I / F 25 to receive the name of the external storage device 3 (as an example, a server name) input by the user, an IP address indicating an external connection destination, and the like. The name, IP address, and the like of the external storage device 3 received by the reception unit 202 are stored in the storage unit 201. Note that the information for executing a file management process received by the reception unit 202 is not limited to this.

[0025] The generating unit 203 generates file list information based on files stored in the storage unit 201 before the setting unit 204 described later sets information for executing the file management process accepted by the accepting unit 202. Specifically, the generating unit 203 generates file list information based on files stored in the storage unit 201 before the setting unit 204 described later sets information for executing the file management process accepted by the accepting unit 202. The file list information includes information such as the file name and the storage destination (directory, as an example) in the storage unit 201. The file list information generated by the generating unit 203 is stored in the storage unit 201. Note that the information included in the file list information is not limited to this.

[0026] Here, the purpose of the generation unit 203 will be described. A file before setting information for executing file management processing cannot execute file management processing, for example, because the connection destination of the external storage device 3 that cooperates with file management is not set. Therefore, for example, if a user creates a file before setting information for executing file management processing, the created file may not be properly managed, and information leakage may not be prevented. Therefore, before setting information for executing file management processing, the generation unit 203 generates file list information based on the files stored in the storage unit 201.

[0027] The setting unit 204 sets information for executing the file management process. Specifically, the setting unit 204 sets information for executing the file management process based on information for connecting the information processing device 2 to the external storage device 3 received by the receiving unit 202. For example, the setting unit 204 sets the name, IP address, etc. of the external storage device 3 received by the receiving unit 202 as the connection destination of the external storage device 3. The connection destination of the external storage device 3 set by the setting unit 204 is stored in the storage unit 201. Note that the information for executing the file management process set by the setting unit 204 is not limited to this.

[0028] The acquiring unit 205 acquires the file list information generated by the generating unit 203. Specifically, the acquiring unit 205 acquires the file list information generated by the generating unit 203 from the storage unit 201. After that, the acquiring unit 205 acquires files based on the acquired file list information.

[0029] Furthermore, the acquiring unit 205 acquires a file stored in the storage unit 201. Specifically, the acquiring unit 205 acquires a file stored in the storage unit 201 after the setting unit 204 sets information for executing a file management process. The file acquired by the acquiring unit 205 is assigned with trust information indicating the trust level of the file.

[0030] Here, the trust information will be explained. The trust information is information indicating the reliability of a file and the authenticity of the file. The trust information is, for example, when the creator is an OS (Operating System), or is a standard digital signature, which is one of the technologies for guaranteeing the authenticity of electronic data.

[0031] Specifically, a case will be described in which the creator of the trust information is the OS. For example, when "Session ID=0" is found in the OS event log, it is possible to identify that the creator of the file is the OS. Based on the identified event log, the file is identified as having been created by the OS. Furthermore, the file created by the OS is a file necessary for operating the information processing device 2.

[0032] Next, a case will be described in which a digital signature that is a standard for the creator is affixed as trust information. For example, a standard digital signature is one that has certificates issued by two or more institutions. A digital signature that has certificates issued by two or more institutions is highly authentic and can be said to have been spoofed. Therefore, a file to which a digital signature that has certificates issued by two or more institutions is affixed is identified as having trust information.

[0033] Moreover, files to which digital signatures having certificates issued by two or more authorities are attached include, for example, files created by executable files of programs, all files updated by OS update programs, applications downloaded from external sites that provide OS, etc. The above-mentioned files are necessary for operating the information processing device 2. Note that the trust information attached to files is not limited to this.

[0034] The determination unit 206 determines whether or not trust information indicating the trustworthiness of the file is added to the file acquired by the acquisition unit 205. Specifically, the determination unit 206 checks the creator of the file acquired by the acquisition unit 205, and determines whether or not trust information is added.

[0035] For example, the determination unit 206 determines that trust information has been added if the creator of the file acquired by the acquisition unit 205 is the OS. Also, for example, the determination unit 206 determines that trust information has been added if the creator of the file acquired by the acquisition unit 205 is a creator to which a digital signature having certificates issued by two or more authorities has been added.

[0036] If the file determined by the determination unit 206 has trust information attached to it, the file management process is not executed by the processing unit 207, which will be described later. In other words, if trust information is attached to a file, the file is not subject to file management process.

[0037] Furthermore, a file that has not been assigned trust information as determined by the determination unit 206 is a file that is subject to file management processing, that is, the file management processing is executed by the processing unit 207, which will be described later. In this way, by having the determination unit 206 determine the files that are to be distributed, it is possible to appropriately manage the files to be distributed.

[0038] The processing unit 207 executes file management processing for files to which a reliability determined by the determination unit 206 has not been assigned. In the file management processing, the processing unit 207 distributes (also called splits) the file of the file management processing (also called the original file of the file under management) into a first distributed file and a second distributed file so that the file can be decrypted (also called restored). In this case, the file that is the target of the file management processing is also called the original file, original data, original file, original data, or original.

[0039] The processing unit 207 distributes the original file into a first distributed file and a second distributed file by using, for example, a secret sharing encryption method. Note that since the original file is generated by distributing it, the sizes of the first distributed file and the second distributed file are smaller than the size of the original file.

[0040] The processing unit 207 stores the first distributed file in the storage unit 201, and stores the original file and the second distributed file in the external storage device 3. The processing unit 207 cooperates with the user I / F 25 to acquire (also referred to as downloading) the second distributed file based on a user operation. In this way, the processing unit 207 realizes management of the original file in a state in which the original file cannot be acquired by the information processing device 2 alone.

[0041] Next, the process executed by the information processing device 2 according to the present embodiment will be described with reference to Fig. 4 and Fig. 5. Fig. 4 and Fig. 5 are flowcharts showing an example of the process in the information processing device 2 according to the present embodiment. Here, the information processing device 2 is in a state where the user has started up the information processing device 2.

[0042] First, in FIG. 4, the user is using the information processing device 2, and the information processing device 2 is in a state before setting information for executing a file management process.

[0043] The receiving unit 202 receives information for executing a file management process (step S401). Next, the generating unit 203 generates file list information based on the files stored in the storage unit 201 (step S402).

[0044] Next, the setting unit 204 sets information for executing the file management process based on the information for executing the file management process received by the receiving unit 202 (step S403). When the setting process ends, this process ends.

[0045] Next, in FIG. 5, it is assumed that the information processing device 2 starts from a state in which the initial settings for connecting to the external storage device 3 have been completed and the information processing device 2 is connected to the in-house network.

[0046] The acquiring unit 205 acquires a file stored in the storage unit 201 (step S501).

[0047] Next, the determination unit 206 determines whether the creator of the file acquired by the acquisition unit 205 is the OS (step S502). If the determination unit 206 determines that the file was created by the OS (step S502: Yes), this process ends. On the other hand, if the determination unit 206 determines that the file was not created by the OS (step S502: No), the process proceeds to step S503.

[0048] Next, the determination unit 206 determines whether the creator of the file not created by the OS has a reference digital signature (step S503). If the determination unit 206 determines that the creator has a reference digital signature (step S503: Yes), this process ends. On the other hand, if the determination unit 206 determines that the creator is not a creator with a reference digital signature (step S503: No), the process proceeds to step S504.

[0049] A file that the determination unit 206 determines is not created by a creator with a reference digital signature is a file (original file) that is subject to file management processing. Note that steps S502 and S503 in which the determination unit 206 performs the determination processing may be interchanged.

[0050] Next, the processing unit 207 distributes the original file of the file management process into a first distributed file and a second distributed file so that the original file can be decoded (step S504). Next, the processing unit 207 checks the divided target file (step S505), and if the divided target file is the first distributed file, the process proceeds to step S506. On the other hand, if the divided target file is the second distributed file, the process proceeds to step S507.

[0051] Next, the processing unit 207 stores the first distributed file in the auxiliary storage device 24 (step S506). In addition, the processing unit 207 transmits the second distributed file to the external storage device 3 (step S507). Once the first distributed file and the second distributed file have been distributed, this process ends.

[0052] As described above, the information processing device 2 according to an embodiment of the present invention acquires a file stored in the storage unit 201. The information processing device 2 also determines whether or not trust information indicating the trustworthiness of the file is added based on whether or not the creator of the acquired file is the OS or whether or not the file has a digital signature with a certificate issued by two or more authorities. Furthermore, based on the determination result, the information processing device 2 divides the file into a first distributed file and a second distributed file so as to be able to restore the file, stores the first distributed file in the storage unit 201, and stores the file and the second distributed file in the external storage device 3.

[0053] As a result, according to this embodiment, it is possible to determine the files that are the target of file management processing from all files stored in the memory unit 201, so that the information processing device 2 can appropriately manage the target files to be distributed.

[0054] Furthermore, in the above-described embodiment, before setting information for executing file management processing, file list information indicating a list of files stored in the memory unit 201 is generated, the generated files are divided into a first distributed file and a second distributed file, the first distributed file is stored in the memory unit 201, and the original file and the second distributed file are stored in the external storage device 3.

[0055] As a result, according to this embodiment, file list information corresponding to files created before the file management process is set is generated, so that the information processing device 2 can obtain the file list information after the file management process is set, and appropriately manage the target files to be distributed based on the obtained file list information.

[0056] In the above-described embodiment, the information processing device 2 acquires files stored in the storage unit 201, judges whether the acquired files are assigned with trust information indicating the reliability of the files, and executes file management processing based on the judgment result. This allows the information processing device 2 to appropriately manage the target files to be distributed, since it can judge the files to be the target of the file management processing from all files stored in the storage unit 201.

[0057] Furthermore, in the above-described embodiment, when it is determined that trust information is added to the acquired file, the file management process is not executed, so that the information processing device 2 can appropriately manage the target files to be distributed without affecting the operation of the information processing device 2 itself.

[0058] In the above-described embodiment, the trust information includes at least one of the following: the creator is the OS; or a digital signature having a certificate issued by two or more authorities. This allows the information processing device 2 to treat a file as a distribution target even if a malicious user creates a file with a forged file extension.

[0059] Furthermore, in the above-mentioned embodiment, if it is determined that the creator of the acquired file is not the OS or that the file does not have a digital signature with a certificate issued by two or more authorities, the information processing device 2 executes a file management process, thereby enabling the information processing device 2 to appropriately manage the target files to be distributed.

[0060] The program for realizing the above-mentioned functions may be provided, for example, in a state in which it is pre-stored in a storage element mounted on the CPU 21, but is not limited to this. The program may be provided, for example, in a state in which it is stored in an appropriate storage medium such as a CD-ROM, or may be provided via a computer network such as the Internet.

[0061] The above-described embodiment can be modified as appropriate by changing a part of the configuration of the above-described device. Therefore, some modified examples of the above-described embodiment will be described below as other embodiments. Note that the following mainly describes the differences from the above-described embodiment, and a detailed description of the common points with the contents already described will be omitted. The modified examples described below may be implemented individually or in appropriate combination.

[0062] (Variation 1) In the above embodiment, the external storage device 3 connected to the information processing device 2 is described as being connected to the information processing device 2 via an in-house network, but this is not intended to be limiting. For example, the external storage device 3 may be a portable terminal device. The portable terminal device is, for example, a non-volatile storage device accessible outside the company, such as a smartphone.

[0063] In addition, the portable terminal device may be any terminal equipped with a storage device, and may take the form of, for example, a USB (Universal Serial Bus) memory, a tablet-type personal computer, a digital camera, a portable music player, a mouse, a pen, headphones, or a card-type storage medium (for example, an IC (Integrated Circuit) card), etc.

[0064] Although the embodiments and modifications of the present invention have been described above, the embodiments and modifications are presented as examples and are not intended to limit the scope of the invention. These new embodiments and modifications can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the gist of the invention. These embodiments and modifications are included in the scope and gist of the invention, and are included in the scope of the invention and its equivalents described in the claims. [Explanation of symbols]

[0065] 1...information processing system, 2...information processing device, 3...external storage device, 201...storage unit, 202: Reception unit, 203: Generation unit, 204: Setting unit, 205: Acquisition unit, 206: Determination unit, 207: Processing unit

Claims

1. In an information processing device that executes file management processing, an acquisition unit that acquires a file stored in a storage unit; a determination unit that determines whether or not the file acquired by the acquisition unit is provided with trust information indicating the trustworthiness of the file, based on whether or not the creator of the file is an OS (Operating System) or whether or not the file has a digital signature having a certificate issued by two or more authorities; a processing unit that divides the file into a first distributed file and a second distributed file so as to be restorable based on a result determined by the determination unit, stores the first distributed file in a storage unit, and stores the file and the second distributed file in an external storage device; An information processing device comprising:

2. In an information processing device that executes file management processing, an acquisition unit that acquires a file stored in a storage unit; a determination unit that determines whether or not reliability information indicating a reliability of the file is added to the file acquired by the acquisition unit; a processing unit that divides the file into a first distributed file and a second distributed file so as to be restorable based on a result determined by the determination unit, stores the first distributed file in a storage unit, and stores the file and the second distributed file in an external storage device; An information processing device comprising:

3. When the determination unit determines that the trust information is added to the file acquired by the acquisition unit, the file management process is not executed for the file. The information processing device according to claim 2 .

4. The trust information includes at least one of a digital signature that indicates that the OS is the creator or that has a certificate issued by two or more authorities.

4. The information processing device according to claim 2 or 3.

Images