File exchange device, system, method, and program

Abstract

Provided is a file exchanging device and the like that can contribute to preventing problems from occurring in file management, even when dividing into a plurality of private storage devices with respect to one shared storage device. The present invention comprises: an air gap unit that acquires a post-label-application file stored in a shared storage device and, after putting said file in a state of being isolated from the shared storage device and a plurality of private storage devices, transmits the acquired post-label-application file to one among the plurality of private storage devices ; and a label identification unit that reads and identifies the label of the post-label-application file acquired by the air gap unit. The air gap unit transmits the acquired post-label-application file to the private storage device corresponding to the label identified by the label identification unit.

Description

[Technical Field]

[0001] The present invention relates to a file exchange device, system, method, and program. [Background technology]

[0002] In recent years, air gaps have been introduced in systems to protect important information. Air gaps are a technology that physically isolates (disconnects or blocks) the shared storage device from the dedicated storage device by using a file exchange device to retrieve files stored in a shared storage device accessible from the outside and then storing the retrieved files in a dedicated storage device that is not accessible from the outside. Air gaps enable file transfers from the shared storage device to the dedicated storage device without using storage media. They also block targeted attacks on the dedicated storage device even if an attacker accesses it from the outside. Even if malware infiltrates the dedicated storage device, they can block communication between the dedicated storage device and the external attacker. Furthermore, air gaps can avoid the risk of losing storage media, prevent data leaks from the dedicated storage device by achieving physical isolation, provide files to the dedicated storage device without human intervention, and enable time synchronization between physically separated networks.

[0003] An example of such a technology that utilizes an air gap is the cyber retroreflector technology described in Patent Document 1. In the cyber retroreflector technology of Patent Document 1, an air gap within the device is used to physically and logically isolate two electronic components in a computing system. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Special table number 2020-510901 Summary of the Invention [Problem to be solved by the invention]

[0005] The following analysis is provided by the present inventors.

[0006] Air-gap technology is primarily used in government, military, and finance sectors to prevent data leaks, but each sector has its own unique needs. A typical example is the need to manage information separately for each department within the same organization, such as the need to manage files in a one-to-multiple configuration where multiple dedicated storage devices are used for one shared storage device.

[0007] However, the technology described in Patent Document 1 is configured to exchange files between two electronic components (one-to-one configuration), which does not meet customer needs. Also, in a configuration where one shared storage device is simply divided into multiple dedicated storage devices, it is not possible to know in which of the multiple dedicated storage devices a file stored in the shared storage device is stored, which may cause problems in managing files between the shared storage device and the multiple dedicated storage devices.

[0008] The main objective of the present invention is to provide a file exchange device, system, method, and program that can contribute to preventing problems with file management even when multiple dedicated storage devices are used for one shared storage device. [Means for solving the problem]

[0009] A file exchange device according to a first aspect includes an air gap unit configured to acquire a labeled file stored in a shared storage device, isolate the acquired labeled file from the shared storage device and a plurality of dedicated storage devices, and then transmit the acquired labeled file to one of the plurality of dedicated storage devices, and a label identification unit configured to read and identify the label of the labeled file acquired by the air gap unit, wherein the air gap unit is configured to transmit the acquired labeled file to the dedicated storage device corresponding to the label identified by the label identification unit.

[0010] A file exchange system according to a second aspect includes a shared storage device configured to be accessible from a shared network, a plurality of dedicated storage devices configured to be inaccessible from the shared network, and a file exchange device according to the first aspect.

[0011] A file exchange method according to a third aspect is a file exchange method for exchanging files using hardware resources, and includes the steps of acquiring a labeled file stored in a shared storage device, isolating the acquired labeled file from the shared storage device and a plurality of dedicated storage devices, reading and identifying the label of the acquired labeled file, and transmitting the acquired labeled file to the dedicated storage device corresponding to the identified label.

[0012] A program according to a fourth aspect is a program that causes hardware resources to execute a process for exchanging files, and causes the hardware resources to execute the following processes: a process for acquiring a labeled file stored in a shared storage device; a process for isolating the acquired labeled file from the shared storage device and a plurality of dedicated storage devices; a process for reading and identifying the label of the acquired labeled file; and a process for sending the acquired labeled file to the dedicated storage device corresponding to the identified label.

[0013] The program can be recorded on a computer-readable storage medium. The storage medium can be a non-transient medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. The present disclosure can also be embodied as a computer program product. The program is input to a computer device from an input device or an external device via a communication interface, stored in a storage device, and drives a processor according to predetermined steps or processes. The processing results, including intermediate states as needed, can be displayed at each stage on a display device, or the computer device can communicate with the outside world via the communication interface. For example, a computer device for this purpose typically includes a processor, a storage device, an input device, a communication interface, and, if necessary, a display device, all of which can be connected to each other via a bus. [Effects of the Invention]

[0014] The first to fourth aspects can contribute to preventing problems in file management even when a single shared storage device is divided into a plurality of dedicated storage devices. [Brief explanation of the drawings]

[0015] [Figure 1] 1 is a block diagram showing a schematic configuration of a file exchange system according to a first embodiment. [Figure 2]FIG. 2 is a schematic diagram showing an example of the structure of a labeled file used in the file exchange system according to the first embodiment. [Figure 3] 4 is a flowchart schematically showing the operation of a file exchange device in the file exchange system according to the first embodiment. [Figure 4] FIG. 1 is a block diagram schematically illustrating the configuration of a file exchange system according to a comparative example. [Figure 5] FIG. 10 is a block diagram schematically illustrating the configuration of a file exchange system according to a second embodiment. [Figure 6] FIG. 10 is a block diagram schematically illustrating the configuration of a file exchange system according to a third embodiment. [Figure 7] FIG. 10 is a block diagram showing a schematic configuration of a file exchange system including a file exchange device according to a fourth embodiment. [Figure 8] FIG. 2 is a block diagram illustrating a configuration of hardware resources. DETAILED DESCRIPTION OF THE INVENTION

[0016] Hereinafter, embodiments will be described with reference to the drawings. Note that, where reference numerals are used in this application, they are intended solely to facilitate understanding and are not intended to limit the present invention to the illustrated embodiments. Furthermore, the following embodiments are merely illustrative and do not limit the present invention. Furthermore, connecting lines between blocks in the drawings, etc., referred to in the following description, include both bidirectional and unidirectional lines. Unidirectional arrows are used to schematically indicate the flow of main signals (data) and do not exclude bidirectionality. Furthermore, although not explicitly shown, input and output ports exist at the input and output ends of each connecting line in the circuit diagrams, block diagrams, internal configuration diagrams, connection diagrams, etc., shown in this disclosure. The same applies to input and output interfaces. A program is executed via a computer device, which includes, for example, a processor, a storage device, an input device, a communication interface, and, if necessary, a display device. The computer device is configured to communicate with internal or external devices (including computers) via the communication interface, whether wired or wireless.

[0017] [Embodiment 1] A file exchange system according to embodiment 1 will be described with reference to the drawings. Fig. 1 is a block diagram showing a schematic configuration of the file exchange system according to embodiment 1. Fig. 2 is a schematic diagram showing an example of the configuration of a labeled file used in the file exchange system according to embodiment 1.

[0018] The file exchange system 1 is a system for exchanging files between a shared storage device 30 and dedicated storage devices 50A to 50N (see FIG. 1). The file exchange system 1 is communicably connected to a shared network 10 and dedicated networks 60A to 60N. The file exchange system 1 includes a management device 20, the shared storage device 30, a file exchange device 40, and the dedicated storage devices 50A to 50N.

[0019] The management device 20 is a device that manages files stored in the shared storage device 30 (see FIG. 1). The management device 20 is connected to the shared network 10 and the shared storage device 30 so that it can communicate (wired communication and wireless communication). The management device 20 has the function of acquiring files from the shared network 10, assigning a label and a hash value to the acquired file (the file before it is stored in the shared storage device 30), and transmitting the labeled file (see FIG. 2) to which the label and hash value have been assigned to the shared storage device 30. The management device 20 can be, for example, a computer including a processor, memory, a network interface, and the like. The management device 20 can be virtually configured to include a label assignment unit 21 and a hash value assignment unit 22 by using the memory and executing a program in the processor.

[0020] The labeling unit 21 is a functional unit that assigns a label to each file (unlabeled file) stored in the shared storage device 30 from the shared network 10 to create a labeled file (see FIG. 1). In the example of FIG. 1, the labeling unit 21 assigns labels A to N. The labels A to N are used to identify the corresponding dedicated storage devices 50A to 50N. The labeling unit 21 may assign the labels A to N based on predetermined criteria (for example, keywords included in the file, data amount, time, etc.).

[0021] The hash value assigning unit 22 is a functional unit that assigns a hash value to each file stored in the shared storage device 30 from the shared network 10 (FIG. 1). The hash value assigning unit 22 calculates a hash value based on the data contained in the file (unlabeled file or labeled file) using a predetermined function (e.g., hash function, digest function, message digest function, etc.), and assigns the calculated hash value to the corresponding file. Examples of hash values ​​include qazwsxedc, 1q2w3e4r, and plokijuh. Hash values ​​are used to determine the identity of files; the same hash value is always obtained from the same data; if the data is changed, the hash value also changes, making it impossible to restore the original data from the hash value.

[0022] The shared storage device 30 is a shared storage device accessible from the shared network 10 (see FIG. 1). The shared storage device 30 stores labeled files (see FIG. 2) to which labels and hash values ​​have been assigned by the management device 20. The shared storage device 30 is communicably connected to the management device 20 and the file exchange device 40. In response to a request from the file exchange device 40, the shared storage device 30 transmits the labeled files to the file exchange device 40.

[0023] The file exchange device 40 is a device that exchanges files between the shared storage device 30 and the dedicated storage devices 50A-50N (see FIG. 1). The file exchange device 40 is communicably connected to the shared storage device 30 and the dedicated storage devices 50A-50N. The file exchange device 40 has a function of acquiring a labeled file (see FIG. 2) stored in the shared storage device 30 that is accessible from the shared network 10, and storing the acquired labeled file in one of the dedicated storage devices 50A-50N that is inaccessible from the shared network 10, thereby physically isolating (disconnecting, blocking) between the shared storage device 30 and the dedicated storage devices 50A-50N and between the dedicated storage devices 50A-50N. The file exchange device 40 can be, for example, a computer including a processor, memory, a network interface, etc. The file exchange device 40 can be virtually configured to include an air gap unit 41 and a label identification unit 42 by using the memory and executing a program in the processor.

[0024] The air gap unit 41 is a functional unit that acquires a labeled file (see FIG. 2; one that has not been acquired previously) stored in the shared storage device 30, isolates (blocks) the acquired labeled file from the shared storage device 30 and the dedicated storage devices 50A-50N, and then transmits the labeled file to one of the dedicated storage devices 50A-50N (see FIG. 1). Whether a labeled file has been acquired previously may be determined, for example, by whether a flag is attached to the labeled file. Alternatively, an unflagged labeled file may be acquired by the air gap unit 41, and a flag may be attached to the labeled file in the shared storage device 30 after acquisition by the air gap unit 41. The air gap unit 41 causes the label identification unit 42 to identify the label of the acquired labeled file, and transmits the acquired labeled file to the dedicated storage device 50A-50N corresponding to the identified label. For example, the air gap unit 41 transmits a labeled file to which a label A has been assigned to the A-th dedicated storage device 50A, and transmits a labeled file to which a label N has been assigned to the N-th dedicated storage device 50N.

[0025] The label identification unit 42 is a functional unit (see FIG. 1) that reads and identifies the label of the labeled file (see FIG. 2) acquired by the air gap unit 41. The label identification unit 42 provides the identified label to the air gap unit 41. Note that the label identification unit 42 is shown to clarify the label identification function, and may be incorporated into the air gap unit 41 as an integrated unit.

[0026] The dedicated storage devices 50A to 50N are storage devices that cannot be accessed from the shared network 10 (see FIG. 1). The dedicated storage devices 50A to 50N are communicatively connected to the file exchange device 40, and store labeled files (see FIG. 2) that have been assigned labels and hash values ​​and that have been distributed by the file exchange device 40. The dedicated storage devices 50A to 50N are accessible from the corresponding dedicated networks 60A to 60N. The dedicated storage devices 50A to 50N are isolated from each other.

[0027] The shared network 10 is a shared network provided to external terminals (see FIG. 1). The shared network 10 is communicably connected to a management device 20. The shared network 10 may be, for example, a communication network such as a PAN (Personal Area Network), a LAN (Local Area Network), a MAN (Metropolitan Area Network), a WAN (Wide Area Network), or a GAN (Global Area Network).

[0028] The dedicated networks 60A to 60N are dedicated networks provided only to the corresponding internal terminals (see FIG. 1). The dedicated networks 60A to 60N are communicatively connected to the corresponding dedicated storage devices 50A to 50N. For the dedicated networks 60A to 60N, for example, a communication network such as a PAN or LAN that cannot be accessed by outsiders can be used. The dedicated networks 60A to 60N are isolated from each other.

[0029] The operation of the file exchange device in the file exchange system according to the first embodiment will be described with reference to the drawings. Fig. 3 is a flow chart that schematically shows the operation of the file exchange device in the file exchange system according to the first embodiment. Please refer to Fig. 1 for the configuration of the file exchange system.

[0030] Here, it is assumed that the shared storage device 30 stores labeled files (see FIG. 2) to which labels and hash values ​​have been assigned by the management device 20.

[0031] First, the air gap unit 41 of the file exchange device 40 is connected to the shared storage device 30 so that communication is possible (step A1). At this time, the air gap unit 41 cuts off communication with the dedicated storage devices 50A to 50N.

[0032] Next, the air gap unit 41 acquires the labeled file (the file that has not been acquired before; see FIG. 2) from the shared storage device 30 (step A2). At this time, the air gap unit 41 also cuts off communication with the dedicated storage devices 50A to 50N.

[0033] Next, the air gap unit 41 cuts off communication with the shared storage device 30 (step A3). At this time, the air gap unit 41 also cuts off communication with the dedicated storage devices 50A to 50N.

[0034] Next, the label identification unit 42 of the file exchange device 40 reads and identifies the label of the labeled file (see FIG. 2) acquired by the air gap unit 41 (step A4). At this time, the air gap unit 41 also cuts off communication with the shared storage device 30 and the dedicated storage devices 50A to 50N.

[0035] Next, the air gap unit 41 connects to be able to communicate with the dedicated storage device (for example, 50A) corresponding to the label identified by the label identification unit 42 (step A5). At this time, the air gap unit 41 blocks communication with the shared storage device 30 and dedicated storage devices (for example, other than 50A) that do not correspond to the label identified by the label identification unit 42.

[0036] Next, the air gap unit 41 transmits the acquired labeled file to a dedicated storage device (e.g., 50A) corresponding to the label identified by the label identification unit 42 (step A6). At this time, the air gap unit 41 also blocks communication with the shared storage device 30 and dedicated storage devices (e.g., other than 50A) that do not correspond to the label identified by the label identification unit 42.

[0037] Finally, the air gap unit 41 cuts off communication with the dedicated storage device (e.g., 50A) corresponding to the label identified by the label identification unit 42 (step A7), and then ends the process. At this time, the air gap unit 41 also cuts off communication with the shared storage device 30 and dedicated storage devices (e.g., other than 50A) that do not correspond to the label identified by the label identification unit 42.

[0038] According to the first embodiment, the function of identifying the label assigned to a file can contribute to preventing problems in file management even when the dedicated storage devices 50A to 50N are divided into a plurality of dedicated storage devices for one shared storage device 30. As a result, the operability of the system can be improved, and convenience can be improved while ensuring file security.

[0039] Furthermore, according to embodiment 1, by assigning a hash value to a file, the hash value will not change unless the contents of the file are changed, so the authenticity of the file can be proven even in environments where there is no network connection and there is a time difference.

[0040] Furthermore, according to the first embodiment, by having the function of assigning labels to files to identify them, there is no need to use multiple shared storage devices 130A to 130N or multiple file exchange devices 140A to 140N as in FIG. 4 (comparison example), and only one shared storage device 30 and one file exchange device 40 are required, thereby reducing the complexity of the system configuration and reducing costs.

[0041] Furthermore, according to embodiment 1, by using a hash value as a data label, it can serve as a timestamp, making it possible to prove the authenticity of a file even if there is a time difference between the networks involved in the exchange.

[0042] [Embodiment 2] The file exchange system according to the second embodiment will be described with reference to the drawings. Fig. 5 is a block diagram showing a schematic configuration of the file exchange system according to the second embodiment.

[0043] The second embodiment is a modification of the first embodiment, in which the connection destination of the shared network 10 is the shared storage device 30. The management device 25 is connected to the shared storage device 30 but is not connected to the shared network 10. The timing at which the management device 25 assigns the label and hash value is not before storing in the shared storage device 30, but at a predetermined or arbitrary timing after storing in the shared storage device 30.

[0044] The management device 25 is a device that manages files stored in the shared storage device 30 (see FIG. 5). The management device 25 is connected to the shared storage device 30 so that it can communicate (wired communication, wireless communication). The management device 25 has a function of assigning labels and hash values ​​to files (files to which labels and hash values ​​have not been assigned) stored in the shared storage device 30. The management device 25 may be, for example, a computer including a processor, memory, a network interface, etc. The management device 25 can be virtually configured to include a label assignment unit 26 and a hash value assignment unit 27 by using the memory and executing a program in the processor.

[0045] The labeling unit 26 is a functional unit that assigns a label to each file (unlabeled file; pre-labeled file) stored in the shared storage device 30 to create a labeled file (see FIG. 5). In the example of FIG. 5, the labeling unit 26 assigns labels A to N. The labels A to N are used to identify the corresponding dedicated storage devices 50A to 50N. The labeling unit 26 may assign the labels A to N based on predetermined criteria (for example, keywords included in the file, data amount, time, etc.).

[0046] The hash value assigning unit 27 is a functional unit that assigns a hash value to each file (file to which a hash value has not been assigned) stored in the shared storage device 30 (FIG. 5). The hash value assigning unit 27 calculates a hash value based on the data contained in the file (unlabeled file or labeled file) using a predetermined function (e.g., hash function, digest function, message digest function, etc.), and assigns the calculated hash value to the corresponding file. Examples of hash values ​​include qazwsxedc, 1q2w3e4r, and plokijuh. Hash values ​​are used to determine the identity of files; the same data always generates the same hash value; if the data is changed, the hash value also changes, making it impossible to restore the original data from the hash value.

[0047] The other configurations and operations are the same as those in the first embodiment.

[0048] According to the second embodiment, as in the first embodiment, by having the function of identifying the label assigned to a file, it is possible to contribute to preventing problems in file management even if the dedicated storage devices 50A to 50N are divided into multiple ones for one shared storage device 30.

[0049] [Embodiment 3] The file exchange system according to the third embodiment will be described with reference to the drawings. Fig. 6 is a block diagram showing a schematic configuration of the file exchange system according to the third embodiment.

[0050] Embodiment 3 is a variation of embodiment 2, in which the file exchange device 40 incorporates a function for assigning labels and hash values ​​to each file (files that do not have labels and hash values ​​assigned) stored in the shared storage device 30.

[0051] The file exchange device 40 is a device that exchanges files between the shared storage device 30 and the dedicated storage devices 50A-50N (see FIG. 6). The file exchange device 40 is communicably connected to the shared storage device 30 and the dedicated storage devices 50A-50N. The file exchange device 40 has a function of assigning labels and hash values ​​to files (files to which no labels or hash values ​​have been assigned) stored in the shared storage device 30. The file exchange device 40 has a function of acquiring labeled files stored in the shared storage device 30 accessible from the shared network 10, storing the acquired labeled files in one of the dedicated storage devices 50A-50N that are inaccessible from the shared network 10, and physically isolating (disconnecting or blocking) between the shared storage device 30 and the dedicated storage devices 50A-50N and between the dedicated storage devices 50A-50N. The file exchange device 40 can be, for example, a computer including a processor, memory, a network interface, etc. By using the memory and executing a program in the processor, the file exchange device 40 can be virtually configured to include an air gap unit 41, a label identification unit 42, a label assignment unit 43, and a hash value assignment unit 44. The air gap unit 41 and the label identification unit 42 are similar to the air gap unit (41 in FIG. 1) and the label identification unit (42 in FIG. 1) of the first embodiment.

[0052] The labeling unit 43 is a functional unit that assigns a label to each file (a file to which no label has been assigned; an unlabeled file) stored in the shared storage device 30 to create a labeled file (see FIG. 6). In the example of FIG. 6, the labeling unit 43 assigns labels A to N. The labels A to N are used to identify the corresponding dedicated storage devices 50A to 50N. The labeling unit 43 may assign the labels A to N based on predetermined criteria (for example, keywords included in the file, data amount, time, etc.).

[0053] The hash value assigning unit 44 is a functional unit that assigns a hash value to each file (file without a hash value) stored in the shared storage device 30 (FIG. 6). The hash value assigning unit 44 calculates a hash value based on the data contained in the file (unlabeled file or labeled file) using a predetermined function (e.g., hash function, digest function, message digest function, etc.), and assigns the calculated hash value to the corresponding file. Examples of hash values ​​include qazwsxedc, 1q2w3e4r, and plokijuh. Hash values ​​are used to determine the identity of files; the same hash value is always obtained from the same data; if the data is changed, the hash value also changes, making it impossible to restore the original data from the hash value.

[0054] The other configurations and operations are the same as those in the second embodiment.

[0055] According to the third embodiment, as in the second embodiment, by having the function of identifying the labels assigned to files, it is possible to contribute to preventing problems in file management even if the dedicated storage devices 50A to 50N are divided into multiple devices for one shared storage device 30, and also to simplify the system configuration.

[0056] [Embodiment 4] The file exchange device according to the fourth embodiment will be described with reference to the drawings. Fig. 7 is a block diagram showing a schematic configuration of a file exchange system including the file exchange device according to the fourth embodiment.

[0057] The file exchange system 1 is a system including a file exchange device 40 that exchanges files between a shared storage device 30 and a plurality of dedicated storage devices 50A to 50N. The file exchange device 40 includes an air gap unit 41 and a label identification unit 42.

[0058] The air gap unit 41 is configured to acquire the labeled file stored in the shared storage device 30, isolate the acquired labeled file from the shared storage device 30 and the plurality of dedicated storage devices 50A to 50N, and then transmit the acquired labeled file to one of the plurality of dedicated storage devices 50A to 50N. The air gap unit 41 is configured to transmit the acquired labeled file to a dedicated storage device (for example, 50A) corresponding to the label identified by the label identification unit 42.

[0059] The label identification unit 42 is configured to read and identify the label of the labeled file acquired by the air gap unit 41.

[0060] According to the fourth embodiment, by having a function for identifying the label of a file after labeling, it is possible to contribute to preventing problems in file management even when a single shared storage device 30 is divided into multiple dedicated storage devices 50A to 50N.

[0061] The file exchange devices according to the first to fourth embodiments and the management devices according to the first and second embodiments can be configured using so-called hardware resources (information processing devices, computers), and may be configured as shown in Fig. 8. For example, the hardware resource 100 includes a processor 101, a memory 102, a network interface 103, and the like, which are interconnected by an internal bus 104.

[0062] 8 is not intended to limit the hardware configuration of the hardware resource 100. The hardware resource 100 may include hardware (e.g., an input / output interface) that is not shown. Furthermore, the number of units such as the processor 101 included in the device is not intended to be limited to the example shown in FIG. 8, and for example, multiple processors 101 may be included in the hardware resource 100. The processor 101 may be, for example, a central processing unit (CPU), a microprocessor unit (MPU), a graphics processing unit (GPU), or the like.

[0063] The memory 102 may be, for example, a random access memory (RAM), a read only memory (ROM), a hard disk drive (HDD), or a solid state drive (SSD).

[0064] The network interface 103 may be, for example, a LAN (Local Area Network) card, a network adapter, a network interface card, or the like.

[0065] The functions of the hardware resource 100 are realized by the processing modules described above. The processing modules are realized, for example, by the processor 101 executing a program stored in the memory 102. The programs can be updated by downloading them over a network or by using a storage medium that stores the programs. Furthermore, the processing modules may be realized by semiconductor chips. In other words, it is sufficient that the functions performed by the processing modules be realized by software being executed on some kind of hardware.

[0066] Some or all of the above embodiments may be described as, but are not limited to, the following supplementary notes.

[0067] [Appendix 1] an air gap unit configured to acquire a labeled file stored in a shared storage device, isolate the acquired labeled file from the shared storage device and a plurality of dedicated storage devices, and then transmit the acquired labeled file to one of the plurality of dedicated storage devices; a label identification unit configured to read and identify the label of the labeled file acquired by the air gap unit; Equipped with the air gap unit is configured to transmit the acquired labeled file to the dedicated storage device corresponding to the label identified by the label identification unit. File exchange device. [Appendix 2] a labeling unit configured to assign a label to an unlabeled file stored in the shared storage device based on a predetermined criterion, thereby creating the labeled file; 10. The file exchange device according to claim 1. [Appendix 3] a hash value assigning unit configured to calculate a hash value based on data included in the unlabeled file or the labeled file using a predetermined function set in advance, and assign the calculated hash value to the unlabeled file or the labeled file; 3. A file exchange device as defined in claim 2. [Appendix 4] a shared storage device configured to be accessible from a shared network; a plurality of dedicated storage devices configured to be inaccessible from the shared network; a file exchange device according to any one of Supplementary Notes 1 to 3; A file exchange system comprising: [Appendix 5] a management device communicably connected to the shared network and the shared storage device and configured to manage files stored in the shared storage device; the file exchange device is the file exchange device described in Supplementary Note 1; the management device includes a labeling unit that assigns a label to an unlabeled file stored in the shared storage device from the shared network based on a predetermined criterion, to create the labeled file; 4. A file exchange system as described in Appendix 4. [Appendix 6] the management device further includes a hash value assigning unit configured to calculate a hash value based on data included in the un-labeled file or the labeled file stored in the shared storage device from the shared network, using a predetermined function that has been set in advance, and to assign the calculated hash value to the un-labeled file or the labeled file. 6. A file exchange system as described in Appendix 5. [Appendix 7] a management device communicably connected to the shared storage device and configured to manage files stored in the shared storage device; the shared storage device is communicably connected to the shared network; the file exchange device is the file exchange device described in Supplementary Note 1; the management device includes a labeling unit that assigns labels to unlabeled files stored in the shared storage device based on predetermined criteria, to create the labeled files; 4. A file exchange system as described in Appendix 4. [Appendix 8] the management device further includes a hash value assigning unit configured to calculate a hash value based on data included in the un-labeled file or the labeled file stored in the shared storage device using a predetermined function set in advance, and assign the calculated hash value to the un-labeled file or the labeled file; 7. A file exchange system as described in Appendix 7. [Appendix 9] A file exchange method for exchanging files using hardware resources, comprising: obtaining the labeled file stored in the shared storage device; a step of isolating the acquired labeled file from the shared storage device and the plurality of dedicated storage devices; reading and identifying the label of the obtained labeled file; transmitting the acquired labeled file to the dedicated storage device corresponding to the identified label; A file exchange method, including: [Appendix 10] A program that causes a hardware resource to execute a process for exchanging files, A process of acquiring the labeled file stored in the shared storage device; a process of isolating the acquired labeled file from the shared storage device and the plurality of dedicated storage devices; a process of reading and identifying the label of the acquired labeled file; a process of transmitting the acquired labeled file to the dedicated storage device corresponding to the identified label; A program that causes the hardware resource to execute the above.

[0068] The disclosures of the above-mentioned patent documents are incorporated herein by reference and may be used as the basis or part of the present invention, as necessary. Modifications and adjustments of the embodiments and examples are possible within the scope of the entire disclosure of the present invention (including the claims and drawings), and further based on the basic technical concept thereof. Furthermore, various combinations and selections (or non-selections, as necessary) of the various disclosed elements (including each element of each claim, each element of each embodiment or example, each element of each drawing, etc.) are possible within the scope of the entire disclosure of the present invention. In other words, the present invention naturally includes various modifications and alterations that would be possible by a person skilled in the art in accordance with the entire disclosure and technical concept, including the claims and drawings. Furthermore, with regard to the numerical values ​​and numerical ranges described in this application, any intermediate values, lower values, and smaller ranges are deemed to be included, even if not explicitly stated. Furthermore, the disclosures of the above-cited documents, when used in part or in whole in combination with the disclosures herein as part of the disclosure of the present invention, in accordance with the spirit of the present invention, are also deemed to be included in (belong to) the disclosures of this application. [Explanation of symbols]

[0069] 1, 2 File exchange system 10 Shared Network 20, 25, 120 management device 21, 26, 43 Label assignment section 22, 27, 44 Hash value assignment section 30, 130A~130N Shared storage device 40, 140A~140N file exchange device 41, 141A~141N Air gap section 42 Label Identification Section 50A~50N, 150A~150N Dedicated storage device 60A~60N Dedicated Network 100 Hardware Resources 101 processors 102 memory 103 Network Interface 104 Internal Bus

Claims

1. an air gap unit communicably connected to the shared storage device and the plurality of dedicated storages; a label identification unit configured to read and identify the label of the labeled file acquired by the air gap unit; A file exchange device comprising: The air gap portion is Cut off communication with multiple dedicated storage devices, Communicating with the shared storage device, and retrieving the labeled file stored in the shared storage device; interrupting communication between the shared storage device and the plurality of dedicated storage devices; Communicating with any one of the dedicated storage devices corresponding to the identified label among the plurality of dedicated storage devices; Sending the obtained labeled file to one of the dedicated storage devices with which the device is communicating; Blocking communication with any of the dedicated storage devices corresponding to the identified label. It is configured as follows: File exchange device.

2. a labeling unit configured to assign a label to an unlabeled file stored in the shared storage device based on a predetermined criterion, thereby creating the labeled file; 2. The file exchange device according to claim 1, further comprising:

3. a hash value assigning unit configured to calculate a hash value used to determine the identity of a file based on data included in the labeled file using a predetermined function set in advance, and assign the calculated hash value to the labeled file; 3. The file exchange device according to claim 2, further comprising:

4. a shared storage device configured to be accessible from a shared network; a plurality of dedicated storage devices configured to be inaccessible from the shared network; The file exchange device according to claim 1 A file exchange system comprising:

5. a management device communicably connected to the shared network and the shared storage device and configured to manage files stored in the shared storage device; The file exchange device is a file exchange device according to claim 1, The management device includes a labeling unit that assigns a label to an unlabeled file stored in the shared storage device from the shared network based on a predetermined standard, to create the labeled file.

5. The file exchange system according to claim 4.

6. The management device further includes a hash value assigning unit configured to calculate a hash value used to determine the identity of a file based on data included in the labeled file using a predetermined function set in advance, and to assign the calculated hash value to the labeled file.

6. The file exchange system according to claim 5.

7. a management device communicably connected to the shared storage device and configured to manage files stored in the shared storage device; the shared storage device is communicably connected to the shared network; The file exchange device is a file exchange device according to claim 1, The management device includes a labeling unit that assigns labels to unlabeled files stored in the shared storage device based on predetermined criteria to create the labeled files.

5. The file exchange system according to claim 4.

8. The management device further includes a hash value assigning unit configured to calculate a hash value used to determine the identity of a file based on data included in the labeled file using a predetermined function set in advance, and to assign the calculated hash value to the labeled file.

8. The file exchange system according to claim 7.

9. A file exchange device comprising: an air gap unit communicably connected to a shared storage device and a plurality of dedicated storages; and a label identification unit configured to read and identify labels of labeled files acquired by the air gap unit, The air gap portion cutting off communication with the plurality of dedicated storage devices; communicating with the shared storage device and retrieving the labeled file stored in the shared storage device; interrupting communication between the shared storage device and a plurality of the dedicated storage devices; communicating with one of the dedicated storage devices corresponding to the identified label among the plurality of dedicated storage devices; a step of transmitting the obtained labeled file to one of the dedicated storage devices with which the device is communicating; cutting off communication with any of the dedicated storage devices corresponding to the identified label; A file exchange method including:

10. A program executed in a file exchange device including an air gap unit communicably connected to a shared storage device and a plurality of dedicated storages, and a label identification unit configured to read and identify labels of labeled files acquired by the air gap unit, The air gap portion A process of cutting off communication with a plurality of dedicated storage devices; a process of communicating with the shared storage device and retrieving the labeled file stored in the shared storage device; a process of cutting off communication between the shared storage device and the plurality of dedicated storage devices; A process of communicating with one of the dedicated storage devices corresponding to the identified label among the plurality of dedicated storage devices; a process of transmitting the acquired labeled file to one of the dedicated storage devices with which the device is communicating; A process of cutting off communication with any of the dedicated storage devices corresponding to the identified label; A program that executes the following.

Images