Patent Application
20080281962
This application claims priority based on Japanese patent applications, No. 2007-099450 filed on Apr. 5, 2007 and No. 2007-156371 filed on Jun. 13, 2007, the entire contents of which are incorporated herein by reference.
The present invention relates to an information asset management reporting technology for visualizing and reporting the whereabouts of information assets under management of an organization.
Information such as personal information or trade secrets in an organization has recently been increasingly computerized. The computerized information is provided as files on a computer or as data in a memory. Leakage of files containing such information frequently occurs, causing significant damage. In the following description, a file containing confidential information such as personal information or trade secrets will be referred to as an “information asset”. Since such information assets are files, they are easily duplicated, transferred, and processed and it is difficult to manage and determine their whereabouts (or locations). It is nearly impossible to determine usage of information assets such as how and by whom they are used. For example, it is very difficult to cope with accidental leaks such as leakage of information assets that were duplicated without the user's knowledge or leakage of information assets due to forgetting to delete them although they should be deleted according to the rules of the organization.
Outsourcing companies mostly conduct work using information assets received from customers. Outsourcing companies should delete information assets received from customers after the term of the outsourcing contract expires. Thus, it can be easily expected that outsourcing companies need to prove to customers that they have properly handled the information assets and also to delete the information assets without leakage after the term of the contract expires.
To deal with the risk of authorized users easily taking (or exporting) information assets or copies of information assets outside a network environment under management or a file management system (hereinafter referred to as a “network environment”), Japanese Unexamined Patent Application Publication No. 2006-518893 (Document 1) suggested a system that monitors and reports usage of information assets in the network environment to a manager, thereby easily detecting unexpected behavior patterns. With knowledge of where information assets under management of an organization are present, this system can detect, for example, whether or not any file has been sent as an email attachment, whether or not any file has been uploaded to a common storage region on the Internet, and whether or not any file has been written to a Universal Serial Bus (USB) flash memory or CD-Recordable (CD-R)/Digital Versatile Disk Recordable (DVD-R).
Google has introduced “Enterprise Solution” (URL:http://www.google.co.jp/enterprise/) (Document 2). To determine where information assets are present in a network environment, this system crawls files and indexes the contents of the files to find information assets at high speed. This system permits a user who desires to find an information asset to quickly locate the information asset simply by specifying a keyword.
According to a system disclosed in Japanese Patent Application Publication (JP-A) No. 2005-109779 (Document 3), to prevent an encrypted file from being decrypted at an arbitrary Personal Computer (PC), a dependent file for generating a decryption key is stored in specific PCs so that the decoding key can be generated only at the specific PCs which contain the dependent file. Even if information assets are exported to an arbitrary PC, this system prevents leakage of the information assets by preventing decryption of the information assets at the PC.
To determine the whereabouts of information assets that are easily duplicated, transferred, and processed, it is necessary to keep tack of the information assets. For example, when information assets are exported to a USB flash memory, CD-R/DVD-R, paper, an email, or the like not under management of the network environment of an organization and are then returned to be under management of the network environment, it is necessary to keep tack of the information assets. According to the conventional technology described in Document 1, when a pair of events of an information asset (or file) has occurred, for example when the information asset is imported to again be under management of the network environment after being exported out of management, it is not possible to determine whether the imported information asset is a new file or the same as has been under management of the network environment.
It is also necessary to keep tack of information assets when the information assets are kept under management of the network environment of an organization. For example, when an event of file format conversion such as compression or encryption of a file has occurred, it is also necessary to determine whether or not the converted file is an information asset. According to the conventional technology described in Document 2, when the format of a file has been converted, it is difficult to index the contents of the converted file and is not possible to determine if the converted file is an information asset.
In addition, it is necessary to keep tack of an information asset stored in a portable medium such as a USB flash memory or a compact flash memory card and also to keep track of the information asset when the portable medium containing the information asset is coupled, for example, to a PC at home not under management of the network environment and the information asset is then copied from the portable medium to the PC. Further, it is necessary to prevent unauthorized use of an information asset such as copying of the information asset to a PC at home via a portable medium and also to prevent leakage of information assets from a lost or stolen portable medium.
The invention provides an information asset management system, an information asset analysis server, an information asset analysis program and portable medium which can manage and report information assets that are under management of a network environment even when various events have occurred in association with the information assets.
One embodiment of the invention provides an information asset management system in a network environment coupled to both a terminal that is operated by a user and a log analyzer including a log analysis program, wherein the terminal includes a monitoring unit that monitors operations performed by the user and outputs a terminal log including respective feature values of an information asset before and after a pair of events of the information asset occurs, and the log analyzer includes a correlation analyzer that determines whereabouts of the information asset by analyzing an integrated log, which is created by integrating terminal logs collected over a network, based on feature values in the integrated log and reports analysis results obtained through the correlation analyzer.
In this embodiment, in the network environment under management of an organization, files (or operation events performed by the user for files) are monitored together with their feature values when a pair of export and import events of each file (for example, a pair of an event of exporting the file from the network environment to a USB flash memory, a CD-R/DVD-R, paper, an email, or the like and an event of importing the file back into the network environment) occurs. Here, the log analyzer compares a post-import feature value of each information asset (i.e., each file) with a pre-export feature value of each information asset to determine whether or not the information assets are identical and reports a list of information assets in the organization.
In addition, in the network environment under management of an organization, files are monitored together with their feature values generated when file format conversion such as compression or encryption is performed and files are monitored together with their new feature values generated when inverse file format conversion such as decompression or decryption is performed. Here, the log analyzer compares a post-inverse-conversion feature value of each information asset with a pre-conversion feature value of each information asset to determine whether or not the information assets are identical and reports a list of information assets in the organization.
In another embodiment of the invention, when writing is performed to a portable medium such as a USB flash memory or a compact flash memory card, only a file in a conditional self-decodable format (conditional self-decryption file) having conditions for decryption is permitted to be written to the portable medium. The conditions for decryption include a condition for determining whether or not a portable medium coupled to a PC to decrypt a file is a specified one and a condition for determining whether or not a PC coupled to the portable medium is a specified one. Accordingly, when a file is decrypted, a log indicating success or failure of the decryption and the PC to which the portable medium is coupled (also referred to as a “coupling destination PC”) is left in the portable medium, and leakage of information assets to unspecified PCs is prevented.
The information asset management system according to the invention has a variety of advantages. One advantage is that it is possible to keep tack of files that are specified as information assets in an organization. For example, it is possible to correctly and easily identify information assets which are present in a location with a high risk of leakage such as a portable medium. It is also possible to correctly and easily determine where information assets, which should be deleted since the term of the contract expires, are in an outsourcing company even when they have been encrypted.
These and other benefits are described throughout the present specification. A further understanding of the nature and advantages of the invention may be realized by reference to the remaining portions of the specification and the attached drawings.
Preferred embodiments of an information asset management system according to the invention will now be described with reference to the accompanying drawings.
The Internet server 41 is an email server, a proxy server, or the like. The email server 41 relays and stores emails 43 transmitted and received (exchanged) within the network 40 or over the Internet 42. The proxy server relays web data that are communicated over the Internet 42. The multifunction printer 60 is a device that prints information on paper 61 in response to a printing request from the client 10a or 10b (hereinafter also referred to as “client 10”) and scans and saves information printed on the paper 61 as a file. The index server 70 is an apparatus that crawls files stored in the clients 10a and 10b or files or emails stored in the Internet server 41 at regular intervals and indexes the crawled files or emails, thereby allowing users 1a and 1b to quickly search for desired information simply by specifying a search keyword or the like.
In addition, in the information asset management reporting system 100, a portable medium 50 such as a CD-R/DVD-R, a USB flash memory, or a floppy disk can be coupled to the client 10 and the client 10 can exchange files with the portable medium 50.
Here, it is assumed unless otherwise stated that one client 10 is allocated to each user. The client 10 may also be allocated to two or more users. In this case, the client 10 identifies and authenticates each user to determine which user has used the client 10. In the following description, it is assumed for ease of explanation that a user 1a uses the client 10a and a user 1b uses the client 10b to conduct tasks in an organization. It is also assumed that a manager 2 operates the log analysis server 30.
The software architectures of the client (terminal) 10, the log collection server 20, and the log analysis server 30 will now be described with reference to
There is no need to install the same operating system (OS) on the clients 10a and 10b, and different monitoring programs 11a and 11b may run on different OSs in the clients 10a and 10b. The integrated log 22 created by collecting the terminal logs 12a and 12b needs to have a unified format when different OSs have been installed on the clients 10a and 10b.
The following is a description of the configuration of the client 10 with reference to
Each of the log collection server 20 and the log analysis server 30 has the same hardware configuration as that of the client 10 shown in the block diagram of
The following is a description of data formats of the terminal log 12, the integrated log 22, and the information asset list 32 with reference to
The feature value 1 (304) and the feature value 2 (308) are, for example, outputs of a hash function, such as Message Digest Algorithm 5 (MD5) or Secure Hash Algorithm 1 (SHA1), which outputs fixed-length data for input data to make it difficult to find different input data providing the same output.
The terminal log 12 is recorded for each client. That is, the terminal log 12a is recorded for the client 10a and terminal log 12b is recorded for the client 10b. The terminal log collection program 21 collects the terminal logs 12a and 12b into the integrated log 22. The data format of the integrated log 22 is similar to that of the terminal log 12.
The configuration of the information asset management reporting system 100 and the data formats used in the system have been described above. Now, a flow of operations and example operations of the information asset management reporting system 100 will be described with reference to
Each pair of events shown in
If an entry matching the feature value 2 is found in the information asset list 32 (YES at step 606), the correlation analysis program 31 updates a sheet 410 including the found entry in the information asset list 32 in the same manner as at step 605. If no entry matching the feature value 2 is found (NO at step 606), the correlation analysis program 31 adds a new sheet 410 including the path 2 (306), the file name 2 (307), and the feature value 2 (308) which are post-event file attributes, as a new information asset, to the information asset list 32 (step 607). When the processing of the entry extracted from the integrated log 22 is completed as described above, the correlation analysis program 31 returns to step 603 to perform processing of the next entry until processing of all entries of the integrated log 22 is completed (step 608). Through these operations of the correlation analysis program 31, it is possible to determine the whereabouts of information assets in the information asset management reporting system 100 or to determine whether or not information assets have been widely distributed, exposing them to risk.
Although, if no entry matching the feature value 2 is found in the information asset list 32, the correlation analysis program 31 adds a new sheet 410 including the path 2 (306), the file name 2 (307), and the feature value 2 (308), as a new information asset, to the information asset list 32 at step 607 in this example, the new information asset may be stored and managed in a database different from the information asset list 32. Alternatively, the new information asset may not be stored in any database.
Specific events, and specific operations of the monitoring program 11 and the correlation analysis program 31 according to the events will now be described with reference to
At the receiving side of the email 43, a file 703 having a path 3 and a file name 3 and a file 704 having a path 4 and a file name 4 are generated when the user 1b has saved the files 701 and 702 attached to the email 43. Here, the monitoring program 11b calculates a feature value 3 of the file 703 and records an entry 713, indicating that the file 703 having the feature value 3 has been saved, in a terminal log 12b and calculates a feature value 4 of the file 704 and records an entry 714, indicating that the file 704 having the feature value 4 has been saved, in the terminal log 12b. The terminal log collection program 21 collects the terminal log 12a and the terminal log 12b and aggregates them into an integrated log 22.
The correlation analysis program 31 reads the integrated log 22 and analyzes the whereabouts of information assets. Prior to this analysis, it is assumed that a sheet 721 indicating the whereabouts of the file 701 and a sheet 722 indicating the whereabouts of the file 702 have already been stored in the information asset list 32. When the correlation analysis program 31 reads the entry 711, the correlation analysis program 31 finds an entry in the sheet 721 which matches pre-event file attributes (path 1 and file name 1) in the entry 711, since the type of the event 305 is an export “attachment to email”. The correlation analysis program 31 then adds post-event file attributes to the sheet 721 to update the sheet 721 with a sheet 723 indicating that the information asset having the feature value 1 is also present in an email as shown in
In addition, when the correlation analysis program 31 reads the entry 713, the correlation analysis program 31 finds an entry in the sheet 723 which includes an element identical to a post-event file attribute (feature value 3) in the entry 713, since the type of the event 305 is an import “saving of attachment”. The correlation analysis program 31 then adds post-event file attributes (path 3 and file name 3), which are generated as the file attached to the mail is saved, to the sheet 723 to update the sheet 723 with a sheet 725 indicating that the identical information assets are stored in the same sheet as shown in
As is apparent from the above description, through the event monitoring and recording of the monitoring program 11 and the analysis of the correlation analysis program 31 for attachment of a file to an email and saving of the attached file, it is possible to easily determine where and how many information assets (files) of the information asset management reporting system 100 including attachments to emails are present. Although the example of
A file 803 having a path 3 and a file name 3 and a file 804 having a path 4 and a file name 4 are generated at the client 10b when the user 1b has copied the files from the USB flash memory 50 to the client 10b. Here, the monitoring program 11b calculates a feature value 3 of the file 803 and records an entry 813, indicating that the file 803 having the feature value 3 has been copied to the client 10b, in a terminal log 12b and calculates a feature value 4 of the file 804 and records an entry 814, indicating that the file 804 having the feature value 4 has been copied to the client 10b, in the terminal log 12b. The terminal log collection program 21 collects the terminal log 12a and the terminal log 12b and aggregates them into an integrated log 22.
The correlation analysis program 31 reads the integrated log 22 and analyzes the whereabouts of information assets. Prior to this analysis, it is assumed that a sheet 821 indicating the whereabouts of the file 801 and a sheet 822 indicating the whereabouts of the file 802 have already been stored in the information asset list 32. When the correlation analysis program 31 reads the entry 811, the correlation analysis program 31 finds an entry in the sheet 821 which matches pre-event file attributes (path 1 and file name 1) in the entry 811, since the type of the event 305 is an export “writing to USB flash memory”. The correlation analysis program 31 then adds post-event file attributes to the sheet 821 to update the sheet 821 with a sheet 823 indicating that the information asset having the feature value 1 is also included in the USB flash memory having the unique device ID as shown in
In addition, when the correlation analysis program 31 reads the entry 813, the correlation analysis program 31 finds an entry in the sheet 823 which includes an element identical to a post-event file attribute (feature value 3) in the entry 813, since the type of the event 305 is an import “copying from USB flash memory”. The correlation analysis program 31 then adds post-event file attributes (path 3 and file name 3), which are new file attributes generated as the file is copied to the client 10b, to the sheet 823 to update the sheet 823 with a sheet 825 indicating that the identical information assets are stored in the same sheet as shown in
As is apparent from the above description, through the event monitoring and recording of the monitoring program 11 and the analysis of the correlation analysis program 31 for writing of a file to a USB flash memory and copying of the file from the USB flash memory, it is possible to easily determine where and how many information assets (files) of the information asset management reporting system 100 including USB flash memories are present. Although the example of
The correlation analysis program 31 reads the integrated log 22 and analyzes the whereabouts of information assets. Prior to this analysis, it is assumed that a sheet 921 indicating the whereabouts of the file 901 has already been stored in the information asset list 32. When the correlation analysis program 31 reads the entry 911, the correlation analysis program 31 finds an entry in the sheet 921 which matches pre-event file attributes (path 1 and file name 1) in the entry 911, since the type of the event 305 is an export “printing”. The correlation analysis program 31 then adds post-event file attributes to the sheet 921 to update the sheet 921 with a sheet 922 indicating that the information asset having both the feature value 1 and the number of copies is included in the paper as shown in
As is apparent from the above description, through the event monitoring and recording of the monitoring program 11 and the analysis of the correlation analysis program 31 for printing and scanning of a file, it is possible to easily determine where and how many information assets (files) of the information asset management reporting system 100 including those printed on paper are present. Accordingly, it is also possible to track information assets when the information assets have been printed or scanned.
The operation of the information asset management reporting system 100 has been described above with reference to specific examples.
The sheets 410a, 410b, and 410c shown in
The screen interface for displaying the information asset list 32 may also be implemented as shown in
The screen interface 1100 includes a left region where search conditions are entered and a right region where search results are displayed. A keyword 1101, an information creation date and time 1102, or a path 1103 can be specified as a search condition. When a search button 1104 is pressed, the log server 70 searches indexed information and displays paths 1105 and file names 1106 as a search result in the right region and also displays a button 1107 for viewing identical files. Other search conditions may also be provided. For example, a file hash value or a USB flash memory device ID can be specified as a search condition.
When the view-identical-files button 1107 is pressed, the log server 30 retrieves files, which are identical to a file identified by both the path 1105 and the file name 1106, from the information asset list 32 and displays the retrieved files in an information asset list dialog box 1110. A “close” button for closing the dialog box 1110 is also displayed in the dialog box 1110.
Using the screen interface 1001 shown in
Reference will now be made to an information asset management reporting system according to the second embodiment which has the same configuration as the information asset management reporting system 100 according to the first embodiment described above while it can track information assets even when they have undergone file format changes such as file decompression or encryption.
A normal file 1204 having a path 4 and a file name 4 and a normal file 1205 having a path 5 and a file name 5 are generated when the user 1b has decompressed the compressed file 1203. Here, the monitoring program 11b calculates a feature value 4 of the normal file 1204 and records an entry 1213, indicating that the normal file 1204 having the feature value 4 has been decompressed, in a terminal log 12b and calculates a feature value 5 of the normal file 1205 and records an entry 1214, indicating that the normal file 1205 having the feature value 5 has been decompressed, in the terminal log 12b. The terminal log collection program 21 collects the terminal log 12a and the terminal log 12b and aggregates them into an integrated log 22.
The correlation analysis program 31 reads the integrated log 22 and analyzes the whereabouts of information assets. Prior to this analysis, it is assumed that a sheet 1221 indicating the whereabouts of the normal file 1201 and a sheet 1222 indicating the whereabouts of the normal file 1202 have already been stored in the information asset list 32. When the correlation analysis program 31 reads the entry 1211, the correlation analysis program 31 finds an entry in the sheet 1221 which matches pre-event file attributes (path 1 and file name 1) in the entry 1211, since the type of the event 305 is a conversion operation “file compression”. The correlation analysis program 31 then adds post-event file attributes to the sheet 1221 to update the sheet 1221 with a sheet 1223 indicating that the information asset having the feature value 1 is also included in the compressed file as shown in
In addition, when the correlation analysis program 31 reads the entry 1213, the correlation analysis program 31 finds an entry in the sheet 1223 matching a post-event file attribute (feature value 4) in the entry 1213, since the type of the event 305 is an inverse conversion operation “file decompression.” The correlation analysis program 31 then adds post-event file attributes (path 4 and file name 4), which are generated as the file is decompressed, to the sheet 1223 to update the sheet 1223 with a sheet 1225 indicating that the identical information assets are stored in the same sheet as shown in
As is apparent from the above description, through the event monitoring and recording of the monitoring program 11 and the analysis of the correlation analysis program 31 for compression of a file and decompression of the file, it is possible to easily determine where and how many information assets (files) of the information asset management reporting system 100 including compressed files are present. Although the example of
Reference will now be made to an information asset management reporting system according to the third embodiment which can prevent any unauthorized use of files and protect lost or stolen files even if a portable medium is coupled to a private PC and files are then improperly copied from the portable medium to the PC or if a portable medium is lost or stolen or if a portable medium is coupled to a PC not under management of the network environment for improperly using files in the portable medium.
The configuration of the portable medium 50 will now be described with reference to
Alternatively, the invisible region 1450 may be a tamper-resistant region of the portable medium 50. All of the date and time 1431, the message 1432, and the checksum 1433 or only the checksum 1433 may be arranged in the tamper-resistant region. Whether all of the date and time 1431, the message 1432, and the checksum 1433 or only the checksum 1433 is arranged in the tamper-resistant region may be determined according to the size of the tamper-resistant size. For example, verification of secret information called a “Personal Identification Number (PIN)” may be required as a condition for granting access to the tamper-resistant region or alternatively the tamper-resistant region may be accessed exclusively from a dedicated driver.
In addition, the date and time 1431, the message 1432, and the checksum 1433 may be written to the normal accessible region 1440 as a file which can be encrypted and decrypted only by a log recording program 1410. The log recording program 1410 opens a file handle in exclusive mode when the log file is opened, thereby preventing other programs from altering or deleting the log while the log recording program 1410 is running.
Generally, the portable medium 50 is assigned a serial number or the like by a manufacturer. Specifically, the portable medium 50 is assigned a manufacturer ID 1460 and a serial ID 1461 which cannot be changed. The portable medium 50 is uniquely identified using the manufacturer ID and all portable media 50 present in the organization are managed in the portable medium list 1323.
Alternatively, an identification number 1421 and a digital signature 1422 may be written to the invisible region 1450 so that the portable medium 50 is uniquely identified in the case where the portable medium 50 does not have the manufacturer ID 1460 and the serial ID 1461 or where the portable medium 50 has the manufacturer ID 1460 and the serial ID 1461 which cannot be read by a PC. The manager collectively assigns the identification number 1421 and the digital signature 1422 to each portable medium 50 purchased in an organization before distributing the portable media 50 to users. This makes it possible to distinguish between the portable media 50 lent by the organization and media individually purchased by users.
The log recording program 1410 is stored in the normal accessible region 1440. The log recording program 1410 is a program for writing a log in the invisible region 1450. The log recording program 1410 may be copied to the portable medium 50 when the portable medium 50 is registered in the portable medium list 1323 of the WF server 1320. Alternatively, the log recording program 1410 may be stored in a read-only region on the portable medium which has properties similar to those of a CD-ROM.
A file in a conditional self-decodable format (conditional self-decryption file) 1400 stored in the normal accessible region 1440 will now be described with reference to
Data contained in and associated with the export management database 1322 used in the information asset management reporting system 1300 will now be described with reference to
The export file table 1801 is constructed by storing results of retrieving, using portable medium device IDs managed in the portable medium list 1323, files that are stored in portable media having the same device IDs as those managed in the portable medium list 1323 from the information asset list 32 of the information asset management reporting system 100 according to the first embodiment described above.
The export destination usage history table 1802 is constructed by collecting the contents of a log in the invisible region 1450 of each portable medium 50. When the portable medium 50 is coupled to the client 10, the monitoring program 1311 running on the client 10 reads the invisible region 1450 and collects the contents of the log in the invisible region 1450 and then stores the collected contents of the log in the terminal log 1313. Then, the terminal log collection and correlation analysis programs 21 and 31 sequentially collect the log information to construct a sheet of the export destination usage history table 1802 as shown in
A flow of operations and example screens of the information asset management reporting system 1300 according to the third embodiment shown in
An example of an application screen displayed on the display unit of the client 10 at step 1501 will now be described with reference to
After logging into the WF agent 1312, the user 1 presses the reference button 1603 to select a file which they desire to export from the client to the portable medium 50. Then, the user 1 presses the reference button 1605 to select a destination client, to which the file is to be exported, from among clients managed in the client list 1324. The client 10, from which the file is written to the portable medium, is set as a default destination client, and the user 1 specifies another export destination. The user 1 then presses the reference button 1608 to select a portable medium for use in export from among portable media managed in the portable medium list 1323. The user 1 then enters the reason for export to the export reason field 1606 and selects a period in the period field 1609, and enters a password in the password field 1610. The user 1 presses the apply button 1611 after completing input of these fields.
Returning to
An example approval screen at step 1502 will now be described with reference to
After logging into the WF manager 1321, the manager 2 presses the display button 1623 confirms that information that should not be exported is not included in the export file and confirms that the export destination field 1624, the export reason field 1626, and the period field 1629 are correct. The manager 2 then presses the coupling history button 1628 to confirm that the portable medium 50 used for export has never been coupled to an unauthorized client or that there is no trace of unauthorized decryption of the export file. After confirming these facts, the manager 2 specifies an action to be taken in the case of violation using the decryption prohibition radio button 1631 or the forced deletion radio button 1632 and then presses the approve button 1633 or the reject button 1634. Alternatively, when the coupling history button 1628 is pressed, the client list 1324 may be checked to highlight a log indicating that the portable medium was coupled to a PC which is not managed in the client list 1324.
Returning to
At step 1504, the WF manager 1321 writes conditions for decryption approved in the approve screen 1602 as a file and assigns a signature to the file approved for export in combination with the file of the conditions for decryption.
At step 1506, the user 1 performs an operation for writing the file from the client 10 to the portable medium 50 upon receiving approval notification from the WF agent 1312. In addition, when the portable medium 50 is coupled to the client 10, it may be determined whether or not the portable medium 50 is included in the portable medium list 1323 and the portable medium 50 may be forced to be decoupled when the portable medium 50 is not included in the portable medium list 1323.
At step 1507, the monitoring program 1311 in the client 10, which monitors writing to the portable medium 50, verifies a signature attached to conditions for decryption and the file to be written. The procedure proceeds to step 1508 if the verification has succeeded and proceeds to step 1509 if the verification has failed or if no signature has been attached. At step 1509, the monitoring program 1311 prohibits writing to the portable medium 50 and terminates the procedure.
At step 1508 after the verification has succeeded, based on the conditions for decryption approved at step 1504, the monitoring program 1311 encrypts the file to be exported into a conditional self-decryption file 1400 with the conditions for decryption embedded in the file 1400.
At step 1510, the monitoring program 1311 of the client 10 performs writing to the normal accessible region 1440 of the portable medium 50. At step 1511, the conditional self-decryption file 1400 is saved in the portable medium 50 and the procedure is then terminated.
When the user 1 couples the portable medium 50 to the client 10 (step 1521), the monitoring program 1311 detects that the portable medium has been coupled (step 1522) and reads log information from the invisible region 1450 and then records the log information in the terminal log 1313 (step 1523). The terminal log 1313 is stored in the export management database 1322 as described above with reference to
The flow of operations of an export destination of the portable medium 50 will now be described with reference to
When the user 1 couples the portable medium 50 to an export destination PC (step 1701), the log recording program 1410 in the portable medium 50 is automatically activated (step 1702). The log recording program 1410 is not necessarily automatically activated and may be manually activated by the user 1. The log recording program 1410 collects information of the destination PC coupled to the portable medium 50 (step 1703), generates a handle for opening the invisible region 1450 in exclusive mode to access the invisible region 1450, and records information of the destination PC coupled to the portable medium 50 in a log (1704). Opening the handle in exclusive mode prevents reading and writing of information from and to the invisible region 1450, for example using a computer forensic tool, while the log recording program 1410 is running.
The user 1 then clicks the conditional self-decryption file 1400 in the portable medium 50 to perform a decryption operation (step 1711), the conditional self-decryption file 1400 checks whether or not the log recording program 1410 is running (step 1712). The self-decryption file 1400 then checks whether or not the running program has been altered using the log recording program identifier 1405 (step 1713). The self-decryption file 1400 stops decryption when it is determined at step 1712 that the log recording program 1410 is not running or when it is determined at step 1713 that the log recording program 1410 has been altered (step 1714).
The self-decryption file 1400 then transmits conditions for decryption to the log recording program 1410 (step 1715). The log recording program 1410 checks, using the export destination PC identifier 1402, whether or not the PC coupled to the portable medium 50 is a specified coupling destination PC (step 1716). The log recording program 1410 then checks, using the portable medium identifier 1403, whether or not the portable medium 50 being used is a specified portable medium (step 1717). The log recording program 1410 then checks whether or not the time of the coupling destination PC matches the date and time 1431 in the log in the invisible region 1450. For example, the log recording program 1410 checks whether or not the current time of the PC is later than the time when the portable medium 50 was decoupled last or whether or not the current time is later than the date and time when decryption of the conditional self-decryption file 1400 succeeded or failed last. Alternatively, the log recording program 1410 may check, using the encryption date and time 1407, whether or not the current time of the PC is later than the encryption date and time. The log recording program 1410 then checks, using the export period 1404, whether or not the current time is within a predetermined period from the approved date and time (step 1719). Finally, the log recording program 1410 requests that the user 1 enter a password and checks whether or not the entered password is identical to the password 1401 (step 1720).
If the checked result at any of the steps 1716 to 1720 is negative, the log recording program performs an action specified in the action 1406 and logs a message indicating the failed decryption in the invisible region 1450 (step 1722). If the checked results at steps 1716 to 1720 are all positive, the log recording program 1410 outputs a prompt asking the user 1 to specify a decryption target (step 1721) and decrypts the specified decryption target and logs a message indicating successful decryption in the invisible region 1450 (step 1722).
When the user 1 decouples the portable medium 50 from the PC, the log recording program 1410 logs a message indicating the decoupling in the invisible region 1450 when the program is terminated (step 1732).
Alternatively, a program into which the conditional self-decryption file 1400 and the log recording program 1410 are integrated may perform steps 1711 to 1722 in the flow of operations shown in
Although the information asset management reporting system 1300 of this embodiment has been described for the case where an information asset (or file) is written to the portable medium 50, the invention is not limited to the case of writing to the portable medium 50 and the same information asset management can be performed in other cases such as attachment of a file to an email or saving of a file in a portable notebook PC or PDA. The email and the notebook computer or PDA may be referred to as a portable medium in a broad sense. The destination of a file attached to an email, and a notebook computer or PDA may all be managed in the WF server 1320 and conditions for decryption of the conditional self-decryption file may be changed appropriately for the cases of employing email and portable note PC or PDA, so that the same information asset management as in the case where the file is written to the portable medium 50 can be applied to such cases.
According to the information asset management reporting system of the third embodiment described above, when a file is exported by copying it to a portable medium, information indicating a PC to which the portable medium has been coupled is left in the portable medium so that, through a later examination, it is possible to check whether or not any unauthorized use of the file such as copying of the file to a PC at home has occurred. By checking whether or not the conditional self-decryption file satisfies conditions for decryption, it is possible to prevent leakage of the file at an arbitrary PC even when the file has been copied to a PC not under management. In addition, even when the portable medium is found after being lost or stolen, it is possible to determine whether or not any suspicious access was made to the file in a period during which the portable medium was away.
As described above, the information asset management reporting system according to the invention can be applied to the network environment of any information system in a call center which handles personal information, a business field which handles trade secretes, a design development field which handles intellectual property information, and the like. The information asset management reporting system according to the invention can also be applied to the network environment of any information system in an outsourcing company which conducts work with business information or the like received from customers.
Although the preferred embodiments of the present invention have been disclosed for illustrative purposes, those skilled in the art will appreciate that various modifications, additions and substitutions are possible, without departing from the scope and spirit of the invention as disclosed in the accompanying claims.
The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense. It will, however, be evident that various modifications and changes may be made thereto without departing from the spirit and scope of the invention as set forth in the claims.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2007-099450 | Apr 2007 | JP | national |
| 2007-156371 | Jun 2007 | JP | national |
