Provided is a computer system configured so that security compliance problems can be avoided and an access control model which can be uniquely customized can be implemented by extending the storage capacity to an external storage service by means of integrated management of an existing NAS(s) and the external storage service, and controlling the optimum data placement according to the confidentiality and importance level of data. In a computer system according to this invention, a local storage system includes an extended server for integrating a NAS(s) existing in the local storage system with an external storage service and thereby providing a client with a storage area as a single virtual NAS.
Provided are a storage management media server capable of making it possible to backup and restore even data in a storage under a heterogeneous file format environment by using an existing backup tool and a method of controlling the storage management media server. The storage management media server comprises a BK tool cooperation module (11) for mediating a backup instruction or other instructions received from a master server (2), a data operation module (12) capable of performing backup, restoration, or other operations in response to the instruction or the like, a format analysis module (13) capable of recognizing the file formats of files stored in sub-volumes (32), and a plurality of FS drivers (1 to N) (14) required on a per file system basis. The data operation module (12) responds to an inputted instruction and the like and mounts the sub-volumes (32) via the FS drivers (1 to N) (14) suitable for the file format of a specified file, so that the storage management media server has a structure with which backup, restoration, and other operations are possible.
An electronic-data distribution system includes a distribution server transmitting a distributed article of electronic data to a distribution client. The distribution client includes a distribution-information requesting means and a distribution requesting means. The distribution server includes a distributed-article creating means, a distribution-information transmitting means transmitting to the distribution client, at least a part of distribution information as a distribution plan stored in a distribution-information DB provided in the distribution server, and a distributing means for transmitting a distributed article for which a transmission request is made to the distribution client.
G06F 15/16 - Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs
G06F 15/177 - Initialisation or configuration control
G06F 9/44 - Arrangements for executing specific programs
Upon providing services such as health management and the like, an information management system makes it possible to register, additionally to already registered personal service contents, another service content without newly inputting personal information. The information management system comprises a first device, a second device, and a third device. The third device is provided with a means which, when registering in a second database the data describing service contents provided for the user, receives the data from the first device and registers the data in correspondence with service content identification information, and also registers user identification information and service content identification information in correspondence with each other. When registering in the second database another service content data of an identical user, other than the one already registered in the second database, the means registers the another service content data in the second database in correspondence with the service content identification information and, at the same time, additionally registers the service content identification information to a group of the service content identification information corresponding to the user identification information of the identical user.
A license authentication system and method enabling authentication of an application to be installed in a client PC which is being incapable of communicating with the server which authenticates the application. A portable terminal performs license authentication of an application to be installed in a client PC in place of the server and gives the client PC a temporary right of use (step 1101 to step 1108). During the temporary use, the portable terminal performs regular license authentication in place of the client PC to obtain the regular right of use and gives the information relating to the right of use to the client PC (step 1109 to step 1116).
The watermark in accordance with the content of a file can be inserted during the printing of the file. The importance and confidentiality are defined for each keyword in advance and the watermark to be inserted is defined on the basis of the defined importance and confidentiality. A keyword search in the file is performed during the file printing and the watermark to be inserted is automatically selected from the results of the search (refer to Fig. 5).
Even a plurality of hosts can be searched and the proper result matched to a search condition can be displayed. A host and external storage device to be searched are searched from a search server on the basis of the search condition inputted from an input section. The weights are assigned and the results of the search are displayed on a screen display section in the order in which the degree of importance is considered to be high for the searcher by a data processing section for obtaining the search results, a search information display processing section for displaying the search results, and a related-information display processing section for performing a processing for the accompanying information of the searched file.
It is detected by a simple constitution whether or not a photograph object is motionless in a photographed image to be used for biometric authentication or the like. In the image data of two photographs taken in time series, the absolute value of the difference between the brightnesses of pixels at an identical position is determined, and the number of pixels exceeding a threshold value indicating the limit of a brightness change is counted. The result is compared with the movement decision threshold value, thereby to decide whether or not the photograph object is motionless (as referred to Fig. 1).
An authentication process is provided which is rigid in terms of security and provides excellent usability to users. When an encrypted file is read from a secret folder or when a file is written into a secret folder, a file I/O is detected and blocked and an authentication is then performed. If the authentication is successful, the blocking of the file I/O is canceled and a common key established in the secret folder is used to decrypt the encrypted file to be read, or to encrypt the file to be written. The decrypted file is then provided to a user via an application or the encrypted file is then written into the secret folder. This series of processings is executed at every user login even in the case of the same secret folder used. That is, even after an authentication process was successful at the preceding login and a file I/O was permitted for a certain secret folder, once a logout is done, then a re-authentication process is executed at the next login.
It is possible to realize safe use/storage method of confidential data so that a electric copy of the confidential data will not flow out of a particular external storage medium. A special format region which cannot be recognized from a normal PC is created in an external storage medium so as to store confidential data. An information processing device has a function for mounting the special format region and the device is configured so that the confidential data in the special format region is edited/used by a work OS inhibited to perform network access and write in a secondary storage device, thereby limiting the storage destination of the confidential data after the use to the special format region in the external storage medium and preventing flow-out of the confidential data from the external storage medium.
[PROBLEMS] To achieve encryption and decryption, when creating, renaming and removing shared encrypted files, without performing troublesome processes such as updating of encryption keys, re-encrypting of encrypted files, and the like. [MEANS FOR SOLVING PROBLEMS] A filter driver (12) of a client computer (1) temporarily captures a request for reading or storing a shared encrypted file from any one of applications; receives a client authentication from a key management server (2); acquires, from the key management server (2), a key list comprising pairs of encryption keys and UNC path names associated with respective shared encrypted folders the accesses to which are permitted; accesses one of the shared encrypted folders that is to be read or stored in accordance with the request; and, if the key list includes a UNC path name related to a UNC path name to be accessed, then uses the encryption key associated with the related UNC path name in the key list to encrypt or decrypt the shared encrypted folder.
G09C 1/00 - Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system
Provided is an encryption processing system which enables file access while keeping consistency without making a user aware of coexistence of an encrypted file and a plaintext file in a folder when the user accesses to a file in the folder. When the encrypted file and the plaintext file are stored coexisting in the folder, this system adds identification information (preferably, footer information) which identifies a file as an encrypted file to the encrypted file to distinguish the plaintext file and the encrypted file from each other when reading the file. In the case of delivering the encrypted file to a host application, the encrypted file is decrypted after removing the identification information, and the decrypted file is delivered. When a read file is a plaintext file, the plaintext file is delivered to the host application program without decryption.
A security measure situation self-test system for uniformly managing the PC security measure situation and the situation of operation for bringing out data by the user by specially limiting the security measure to information leak measure to provide a security policy sample and thereby more simply and effectively judging the measure situation. A client computer collects security inventory information and operation log information and sends them to a server computer. The server computer stores the sent security inventory information and the sent operation log information and judges whether or not they comply with a preset security policy. The server computer displays the check results and sends a message to the effect that they do not comply with the security policy to a manager or the client if a policy violation is detected.
In a system in which writing into a secondary storage or writing into an external storage medium is inhibited to prevent the leak and loss of confidential information, created confidential data is stored in a safe manner with no fear of loss of the data when the data cannot be stored in a file server since communication is not available. For this purpose, first, a specified folder is created on a nonvolatile memory for storage built in a mobile terminal to store created confidential data. Then, access control is performed over the specified folder by a filter driver to prevent information leak by a malicious user using an application in a mobile phone. Further, a function of deleting data in the specified folder in the mobile terminal from a mobile terminal management server via a telephone line network prevents the loss of the stored confidential data due to the loss of the mobile terminal.
A client (1) has a filtering means (7). The filtering means (7) judges whether or not to allow an e-mail to be transmitted by a mail transmitting and receiving means (5) and, if it is judged that the transmission is not allowed, displays a predetermined message about this determination on a display device (13). When a confirmation check reply on whether the operation is continued or not is input from an input device (12), the filtering means (7) decides based on the reply whether or not to transmit the e-mail from the transmitting and receiving means (5) or decides to forcibly reject the transmission independently of the reply. The client (1) also has a filtering means (8). The filtering means (8) judges whether or not to accept a reference request to an e-mail received by the mail transmitting and receiving means (5) and, if it is judged that the reference is not accepted, displays a predetermined message about this determination on the display device (13). When a confirmation check reply on whether the reference is accepted or not is input from the input device (12), the filtering means (8) decides based on the reply whether or not to refer to the received e-mail or decides to forcibly reject the reference independently of the reply.
In a system in which the leakage/loss prevention of confidential information is realized by inhibiting write in a secondary storage or write to an external storage medium, the automatic aggregation of the confidential data to a server is promoted and the update of an OS or an application is performed without losing a conventional usage pattern of a PC. A secondary storage write control driver is located under a file system and the write is redirected to the write in the secondary storage with memory as a primary cache and with a cache data file on a cache server to be networked as a secondary cache. With this, the write in the secondary storage is prevented and differential data is stored on the cache server, providing the realization of the automatic aggregation of the confidential data to the server.
patents
