JPH11345286A - Access control device, authentication system and recording medium - Google Patents

Abstract

(57) [Problem] To provide a simple authentication system for concealing data stored in a storage device while ensuring ease of transfer. When a memory card is inserted into a computer, the computer supplies an enable command and a password to a controller. Controller 1
2 accepts an access command if the supplied enable command and password are the same as those stored in the flash memory 11, and rejects the access command if they are different. When the computer 2 supplies the set password command, the new enable command, and the new password to the controller 12 while receiving the access command, the controller 12 updates the enable command and the password. When the computer 2 supplies a correct enable command and an incorrect password to the controller 12 while receiving the access command, the controller 12 rejects the access command.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an authentication system and an access control device, and more particularly to an authentication system and an access control device for confidentially storing contents of a storage device.

[0002]

2. Description of the Related Art In recent years, a memory card equipped with a flash memory has been used as a portable non-volatile storage medium, particularly as a storage medium for a portable information terminal. The memory card is generally connected to a computer or the like via, for example, a PCMCIA bus, and stores data supplied from the computer or the like in response to access from the computer or the like, or stores stored data in the computer or the like. Or to supply.

[0003]

However, the data stored in the above-mentioned memory card can be easily stored by a person other than the owner of the memory card, for example, by being connected to another computer. Risk of leakage. This danger is particularly great in a memory card excellent in portability.

As a method of solving this problem, a method of encrypting data stored in a memory card can be considered. However, software for encrypting and decrypting data requires a large amount of mathematical processing to perform encryption and decryption, which increases execution time, and as a result, it is difficult to use a memory card comfortably. become. Also, software for encrypting and decrypting data is difficult to develop because of the complicated mathematical processing described above.

When the owner of a memory card or the like wants to give data to another person, all the encrypted data must be once decrypted by a computer or the like.
Only meaningless data is given to the other party. For this reason, transfer and exchange of data become complicated.

The present invention has been made in view of the above circumstances, and has as its object to provide a simple authentication system for concealing data stored in a storage device while ensuring ease of transfer.

[0007]

In order to achieve the above object, an access control apparatus (1) according to a first aspect of the present invention is provided.
2) a storage device (11) that stores and supplies data in response to access and has a storage area for rewritably storing authentication data, and a unit that obtains input data according to an instruction of an operator; Means for outputting a command for accessing the storage device (11) and obtaining read data supplied in response to the command, the access control device being connected to the access control device (2). (12) Command execution means (121)
And permission means (121).
21) determines whether or not the input data obtained by the access device (2) substantially matches predetermined authentication data. When it is determined that the input data matches, the command execution means (121) determines whether Means for permitting reception of the command from the access device (2), wherein the command execution means (121) receives the command output by the access device (2) when the permission means permits. Then, when the received command represents a predetermined access command, the storage device (11) is accessed in response to the received command, and the read data acquired from the storage device (11) by the access is written to the storage device (11). Means for supplying to the access device (2), wherein the command execution means (121) comprises:
When the received command indicates a predetermined setting change command, new authentication data is obtained from the access device (2), and the obtained authentication data is stored in the storage area of the storage device (11). Update means (1
21).

[0008] A storage device connected to such an access control device is accessed by the command execution means when correct authentication data is supplied from the access device. Therefore, the data stored in the storage device is kept secret. In addition, software that issues authentication data has simpler processing contents than software that performs encryption and decryption, is easier to develop, and hinders comfortable use of storage devices such as memories. Absent.

The operation of accessing the storage device includes:
It is not limited to reading data stored in the storage device, but also includes writing data to the storage device. Therefore, the access device (2) is provided in the storage device (11).
Means for outputting write data to be stored in the access device, wherein the permission means (121) determines whether the input data acquired by the access device (2) substantially matches the authentication data. Means for permitting the command execution means (121) to receive the write data,
Means for receiving the write data when the permission means permits the command execution means;
Means for writing the write data to the storage area of the storage device (11) in response to the received command when the received command indicates the access command instructing writing of the write data. It may be.

The authentication data comprises, for example, an enable command and a password.
1) when the command executing means (121) does not permit receiving the command from the access device (2), the input data acquired by the access device (2) is the enable command and the It may be provided with a means (121) for judging whether or not the password is substantially included and, when judging that both are included, permitting the command execution means (121) to receive the command. .

When the authentication data is composed of an enable command and a password, the permitting means, when permitting the command executing means (121) to receive the command from the access device (2), Determining whether the input data acquired by the access device (2) substantially includes the enable command and the password, and determining that the input data includes the enable command and does not include the password; Means (121) for prohibiting the execution means (121) from receiving the command.

As a result, the data stored in the storage device is changed to a state in which the data cannot be read by another person even while the storage device is being used. Therefore, for example, even when the user of the storage device temporarily leaves the location of the storage device, the data stored in the storage device is securely concealed.

[0013] The enable command and the password are associated with each other to form a pair, and the permission means (121) determines that the command execution means (121) receives the command from the access device (2). And determining whether the input data obtained by the access device (2) substantially includes the pair of the enable command and the password,
A means (121) for permitting the command execution means (121) to receive the command when it is determined that the command execution means includes the pair, and a command execution means (121)
Is permitted to receive the command from the access device (2), the input data obtained by the access device (2) substantially converts the enable command and the password that forms a pair with the enable command. If the command execution means (121) receives the enable command and determines that the password does not include the password corresponding to the enable command, the command execution means (121) receives the command. Prohibition means (121).
In this case, a plurality of enable commands and passwords can be set.

When the password includes predetermined data, the permitting means (121) sets the access device (2)
Irrespective of whether or not the input data obtained by the command execution means includes the enable command and the password, comprises means (121) for permitting the command execution means (121) to receive the command. Is also good.
Thus, the data stored in the storage device can be read out without requiring authentication. For this reason, the data stored in the storage device is transferred to another person without being subjected to decryption or the like.

The permitting means (121) determines whether or not the input data obtained by the access device (2) substantially includes a predetermined maintenance command. The means (121) may include means (121) for permitting reception of the command from the access device (2). Thus, even if a situation such as the user forgetting the authentication data occurs, the data in the storage device can be obtained. If only a limited person such as the manufacturer of the access control device knows the maintenance command, the confidentiality of the data stored in the storage device does not substantially decrease.

An authentication system (1, 2) according to a second aspect of the present invention comprises a storage unit (11), an access unit (2), a permission unit (121), and a command execution unit (121). Wherein the storage means (11) stores and supplies data in response to access, and has a storage area for storing rewritable authentication data.
The access means (2) outputs an input means for acquiring input data in accordance with an instruction of an operator, and a command for accessing the storage means (11), and reads out read data supplied in response to the command. And a command supply unit for acquiring the authentication data. The permission unit (121) determines whether or not the input data acquired by the access unit (2) substantially matches predetermined authentication data. ,
If it is determined that they match, the command execution means (12
1) is permitted to receive the command from the access means (2), and the command execution means (121)
Receiving the command output by the access means (2) when the permission means permits, and when the received command represents a predetermined access command, responding to the received command, the storage means Means (11) for accessing said storage means (11).
The command execution means (121) further supplies the read data acquired from the access means (2) to the access means (2). When the command received from the access means (2) represents a predetermined setting change command, (2) An update unit (121) that acquires newer authentication data and stores the acquired authentication data in the storage area of the storage unit (11).

According to such an authentication system, the storage area of the storage means is accessed when correct authentication data is supplied from the input means. For this reason, the data stored in the storage area of the storage unit is kept secret. In addition, software that issues authentication data has simpler processing contents than software that performs encryption and decryption, is easier to develop, and hinders comfortable use of storage devices such as memories. Absent.

A computer-readable recording medium according to a third aspect of the present invention includes a computer (1,
2) as storage means (11), access means (2),
A storage area that functions as a permission unit (121) and a command execution unit (121), stores and supplies data in response to an access, and stores the authentication data in a rewritable manner. The access means (2) to obtain input data in accordance with an instruction of an operator; and the storage means (1).
1) to output a command to access the data, and to function as command supply means for acquiring read data supplied in response to the command;
It is determined whether or not the input data acquired by the access means (2) substantially matches predetermined authentication data. The command output means (121) outputs the command output by the access means (2) when the permission means permits the command execution means (121) to function as a means for permitting reception of the command from the access means (2). When the received command represents a predetermined access command, the storage unit (11) is accessed in response to the received command, and the read obtained from the storage unit (11) by the access is performed. Functioning as a means for supplying data to the access means (2); and further comprising the command execution means (121).
When the command received from the access means (2) represents a predetermined setting change command, the access means (2)
A program for acquiring newer authentication data and causing the acquired authentication data to function as an updating unit (121) for storing the acquired authentication data in the storage area of the storage unit (11). Features.

According to the computer that executes the program stored in such a recording medium, the storage area of the storage unit is accessed when correct authentication data is supplied from the input unit. For this reason, the data stored in the storage area of the storage unit is kept secret. In addition, software that issues authentication data has simpler processing contents than software that performs encryption and decryption, is easier to develop, and hinders comfortable use of storage devices such as memories. Absent.

The numbers in parentheses are the reference numbers of the corresponding components in the embodiment, and should be used for reference only, and do not limit the present invention.

[0021]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described.
An authentication system including a memory card and a computer will be described as an example with reference to the drawings.

FIG. 1 is a block diagram showing a physical configuration of an authentication system according to an embodiment of the present invention. As shown, the authentication system includes a memory card 1 and
And a computer 2. Memory card 1
Is detachably mounted on the computer 2 via a slot provided in the computer 2. Computer 2
Comprises a PCMCIA slot for relaying a PCMCIA bus, for example.

The memory card 1 has a flash memory 11
And the controller 12.

The flash memory 11 constitutes a storage device or storage means.
1 is an EEPROM (Electrically Erasable / Programmable
bleRead Only Memory). The flash memory 11 responds to an access made by the controller 12, stores the data supplied from the computer 2, supplies the stored data to the computer 2, and erases the stored data.

An address is assigned to a storage area of the flash memory 11, and a storage area of 512 bytes from the first address forms an authentication information storage area as shown in FIG. As shown in FIG. 2, the first 510-byte storage area in the authentication information storage area is:
A password area for storing a password described later is formed, and the remaining two-byte storage area forms a command code area for storing a code indicating an enable command described later. Also, the flash memory 11
Stores a FAT (File Allocation Table) composed of data indicating the data structure of its own storage area.

The controller 12 constitutes an access control device, and as shown in FIG.
ral processing unit (121) and a ROM (Read Only Memory) for storing an operation program executed by the CPU 121.
ry) 122. The CPU 121 has a ROM 1
22 and the flash memory 11, and is detachably connected to the computer 2 via a PCMCIA slot provided in the computer 2. Also, the CPU 121
Has a status register.

The CPU 121 executes the above-described operation program stored in the ROM 122 to perform the functions of a command execution unit, a permission unit, and an update unit, which will be described later.

The CPU 121 acquires command data supplied from the computer 2 constituting the access device, and if the command data represents a predetermined command, performs an operation according to the command. The instructions to be followed by the CPU 121 include four types of enable command, manufacturer identification command, set password command, and access command.

The enable command is a command for instructing the computer 2 to grant access to the flash memory 11. The code indicating the enable command is stored in the command code area of the flash memory 11 as described above.

Upon receiving the enable command from the computer 2, the CPU 121 determines whether or not to receive an access command, which will be described later, supplied from the computer 2 according to a process described later.
Accepts and rejects access commands.

That is, when the command data supplied from the computer 2 is an enable command, the CPU 121 permits the CPU 121 itself to receive the access command supplied from the computer 2. Therefore, the CPU 121 performs a function as a permission unit.

However, when the content of the data stored in the password area of the flash memory 11 meets a predetermined condition (for example, when all the bits in the password area are "1"), , The access command supplied from the computer 2 is unconditionally accepted.

Further, even when a predetermined manufacturer identification command is supplied from the computer 2, the CPU 121 determines that the access command supplied from the computer 2 is unconditionally accepted. The manufacturer identification command is a maintenance command for the manufacturer or the like to read data stored in the flash memory 11 in an emergency such as when the user forgets the enable command or the password. The code indicating the command is
1 is specified in advance by the manufacturer or the like.

When the CPU 121 determines to accept the access command supplied from the computer 2, for example, it sets the above-mentioned status register provided by itself, and notifies the computer 2 of the status of this status register, thereby providing access to the computer 2. Notifies that command is accepted. If it is determined that access is rejected, the status register is reset to notify the computer 2 of the rejection.

The set password command is an enable command and a command for changing a password.
The code indicating the set password command is specified in advance by the manufacturer of the controller 12 or the like. CPU1
When the set password command is supplied from the computer 2 in a state where the access command is received, the code 21 and the password of the enable command stored in the authentication information storage area of the flash memory 11 are updated in accordance with the processing described later. . That is, CPU
Reference numeral 121 performs a function of an updating unit.

The access command is transmitted to the flash memory 1
1 is an instruction for instructing the CPU 121 to access 1.
The access command is specified in advance by a manufacturer or the like based on an existing command set such as an ATA command.

When the CPU 121 receives an access command from the computer 2 while receiving the access command, the CPU 121 accesses the flash memory 11 in accordance with the contents indicated by the supplied access command. Specifically, the CPU 121 stores data to be written to the flash memory 11 supplied from the computer 2 in the flash memory 11, reads data stored in the flash memory 11, and supplies the data to the computer 2. I do. That is, the CPU 121
Performs the function of a command execution unit when performing an operation according to the access command supplied from the computer 2.

In response to a request from the computer 2, the CPU 121 supplies the computer 2 with attribute information for identifying the memory card 1 to which the CPU 121 belongs.

The computer 2 constitutes an access device or access means, and includes input means and command supply means. The computer 2 includes a personal computer or the like, has a PCMCIA slot, and stores an operating system (OS), a driver, and an authentication program.

The computer 2 executes the OS, detects that the memory card 1 is inserted in the PCMCIA slot, and starts the driver according to the processing of the OS. On the other hand, the computer 2 starts the authentication program according to the user's operation under the control of the OS, and requests the controller 12 to accept the access command supplied by the controller 12 as described later according to the processing of the authentication program.

In the state where the access command is accepted, the computer 2 supplies the controller 12 with the access command and the data to be written to the flash memory 11 in accordance with the processing of the driver. Have access to. Then, according to the access command supplied by itself, the CPU 121
1 and supplies the data read to itself to the CPU 12
Obtain from 1.

(Operation) Next, the operation of the authentication system will be described with reference to FIGS. FIGS. 4A and 4B are flowcharts showing the initial processing. FIG.
(A) and (b) are flowcharts showing an authentication process. FIGS. 6A and 6B are flowcharts showing a process for setting a password lock.

(Initial Processing) When the power of the computer 2 is turned on, the computer 2 performs the initial processing shown in FIG. 4A, while the memory card 1 executes the initial processing shown in FIG. Do.

That is, when the power of the computer 2 is first turned on, the computer 2 executes the processing of the OS (step S001), and according to the processing of the OS, the memory card 1
Is detected in the PCMCIA slot.

When the memory card 1 is inserted into the PCMCIA slot, the computer 2 detects the insertion of the hardware (step S002), accesses the controller 12 of the memory card 1, and requests the supply of the attribute information. The CPU 121 of the controller 12 supplies the attribute information to the computer 2, and the computer 2 acquires the attribute information (Step S003).

Next, the computer 2 determines whether or not the acquired attribute information indicates the memory card 1 (step S004). Specifically, for example, it is determined whether or not the acquired attribute information matches the attribute information assigned in advance by the manufacturer to a memory card that conforms to a predetermined standard.

If the computer 2 determines that it does not represent the memory card 1, the process returns to step S002. However, if the attribute information indicates another available device, it is recognized that the device is mounted, and a predetermined process to be performed to use the device is performed.

If it is determined in step S004 that the attribute information indicates the memory card 1, the computer 2 activates the driver (step S005).

On the other hand, the controller 12 of the memory card 1
When the memory card 1 is inserted into the PCMCIA slot, the CPU 121 reads the contents of the password area of the flash memory 1 and determines whether or not the contents match a predetermined condition for unconditionally receiving an access command. It is determined (step S011).

If it is determined that they match, the CPU 121 shifts to a state of receiving an access command supplied from the computer 2 (step S012), completes the initial processing on the memory card 1 side, Wait for data to be supplied.
If it is determined that they do not match, the state shifts to a state in which the access command supplied from the computer 2 is rejected (step S013), and the initial processing on the memory card 1 side ends.

In step S012, when the CPU 121 shifts to a state of receiving an access command, the computer 2 supplies the CPU 121 with an access command instructing reading of the contents of the FAT. The CPU 121 reads the contents of the FAT stored in the flash memory 11 in response to the supplied access command, and supplies the read FAT to the computer 2. The computer 2 acquires the contents of the FAT supplied from the CPU 121, and
Grasp the data structure of the first storage area (step S00
6).

Then, the computer 2 displays an icon indicating that the flash memory 11 has been accessed according to the access command supplied from the computer 2 (step S 007). The process ends.

After displaying the icon, the computer 2 supplies an access command or the like to the controller 12 in accordance with a user's operation or processing of an application program executed by the computer 2, so that the controller 12 sends the command to the flash memory 11. Can be accessed.

(Authentication Processing) On the other hand, after the driver starts, the computer 2 starts the authentication program according to the operation of the user. Hereinafter, the processing of the authentication program (authentication processing) when the CPU 121 of the controller 12 of the memory card 1 rejects the access command supplied from the computer 2 and the processing while the computer 2 executes the processing of the authentication program Will be described with reference to FIGS. 5A and 5B.

When the processing of the authentication program is started, the computer 2 prompts the user to input an enable command and a password by, for example, displaying a text box for writing an enable command and a password (step S101).

When the data indicating the enable command and the password is input, the computer 2 sends the data input as the enable command and the password to the controller 1 of the memory card 1 according to the processing of the driver.
2 (step S102), and the process ends.

The memory card 1 waits for data to be supplied from the computer 2 (step S201).
Then, when the data is supplied, the CPU 121 of the controller 12 of the memory card 1 checks whether the portion representing the enable command in the data matches the code of the enable command stored in the command code area of the flash memory 11. Is determined (step S
202). If it is determined that they do not match, the supplied data is ignored, and the process returns to step S201.

If it is determined in step S202 that the supplied data matches the enable command, the CPU
The control unit 121 determines whether or not the portion representing the password in the data supplied from the computer 2 matches the password stored in the password area of the flash memory 11 (step S203).

If it is determined that the data does not match the password, the CPU 121 ignores the data and returns the process to step S201. As a result, the CPU 121
Refuse the access command supplied from the computer 2.

On the other hand, if it is determined that they match, the CPU 1
The control unit 21 shifts to a state of receiving an access command supplied from the computer 2 (step S204), ends the authentication process, and waits for data such as an access command to be supplied from the computer 2.

When the CPU 121 shifts to the state of receiving the access command in step S204, the computer 2 performs substantially the same processing as in steps S006 and S007. In other words, the contents of the FAT are acquired, the data structure of the storage area of the flash memory 11 is grasped, and an icon indicating that the flash memory 11 has been accessed according to the access command supplied from the computer 2 is displayed. . As described above, the computer 2 is in a state where the CPU 121 can access the flash memory 11.

(Process for Changing Enable Command and Password) The computer 2
While the PU 121 is receiving the access command, the PU 121 supplies a set password command to the controller 12 in accordance with, for example, the processing of an authentication program, thereby instructing an enable command and a password change. The CPU 121 of the controller 12 changes the enable command and the password according to the instruction.

More specifically, the computer 2 executing the processing such as the authentication program displays a new enable command and a new password by displaying a text box for writing a new enable command and a new password. Prompt the user for input. When the user inputs a new enable command and a new password, the computer 2 supplies the controller 12 with a set password command and a new enable command and a new password.

When supplied with the set password command, the new enable command and the new password, the CPU 121 of the controller 12 writes the new enable command into the command code area of the flash memory 11 and writes the new password into the flash memory 1.
Write in the password area of No. 1. Through the processing described above, the enable command and the password are updated.

If the password is updated by the processing described above so that the access command supplied from the computer 2 is unconditionally accepted, the data stored in the flash memory 11 can be used to authenticate the user. Can be read out without the need for. Therefore, even if the memory card 1 is handed over to another person who does not know the enable command, the person can transfer the data stored in the flash memory 11 to the computer 2.
In addition, the information can be read using another computer or the like.

(Password Locking Process) The computer 2 can supply the enable command and the password to the CPU 121 according to the process of the authentication program, even when the CPU 121 of the controller 12 receives the access command. in this case,
By operating the computer 2 and intentionally inputting a correct enable command and an incorrect password, the user can cause the CPU 121 to reject an access command supplied from the computer 2. Therefore, in order to make the CPU 121 accept the access command again, it is necessary to input a correct enable command and a correct password (that is, the password is locked). This prevents data stored in the flash memory 11 from being acquired by another person, for example, when the user temporarily leaves the place where the computer 2 is installed, and the data is kept confidential. In the following, a password lock process for locking the password on the flash memory 11 is described with reference to FIG.
This will be described with reference to FIGS.

First, the computer 2 performs substantially the same processing as the above-described steps S101 and S102, and supplies data including the enable command and the password input by the user to the controller 12 of the memory card 1 (step S301). .

When the data is supplied from the computer 2, the CPU 121 of the controller 12 proceeds to step S20.
2 to determine whether the enable command indicated by the data matches the enable command stored in the flash memory 11 (step S40).
1). If it is determined that they do not match, the CPU 12
1 terminates the processing ignoring the data and waits for another data to be supplied from the computer 2.

If it is determined that they match, the memory card 1
Performs substantially the same processing as in step S203, and determines whether the password indicated by the data supplied from the computer 2 matches the password stored in the flash memory 11 (step S402).

If it is determined that they match, the process is terminated ignoring the data supplied from the computer 2 and the process waits for another data to be supplied from the computer 2. On the other hand, if it is determined that they do not match, the CPU 12
1 determines whether the password stored in the flash memory 11 meets the condition for unconditionally receiving the access command supplied from the computer 2 (step S403).

If it is determined that the condition is met, the CP
U121 ignores the data supplied from the computer 2 and ends the process, and waits for another data to be supplied from the computer 2.

If it is determined that the condition is not met, the CPU
The control unit 121 shifts to a state in which the access command supplied from the computer 2 is rejected (step S404), terminates the process, and waits for another data to be supplied from the computer 2.

By the processing described above, the password lock is applied to the flash memory 11 and the situation where the data stored in the flash memory 11 is obtained by another person is prevented.

The configuration of the authentication system need not be as described above. For example, the flash memory 11 does not need to be an EEPROM, and as long as it can store data in a rewritable manner or output stored contents in response to access from the CPU 121 or any other device. Any storage device may be used. Also,
If the memory card 1 has a so-called tamper-free structure in which data stored in the flash memory 11 is lost when physically destroyed,
Data confidentiality is ensured.

The enable command and the password may be stored at a position corresponding to an arbitrary address in the storage area of the flash memory. In this case, for example, the controller 12 determines whether the enable command and the password are stored at the position where the enable command and the password are stored. May be stored. In addition, the data lengths of the enable command and the password are both arbitrary.

The flash memory 11 need not store only one enable command and one password. For example, a plurality of enable command and password pairs may be stored. In this case, in the above-described authentication processing, only when the enable command and the password that match the enable command and the password input by the user are stored in the flash memory 11 in a pair as described above, the enable command and the password are supplied from the computer 2. May be determined to receive the access command to be performed.

The slots provided in the computer 2 may be detachably mounted on the computer 2.

Although the embodiment of the present invention has been described above, the authentication system of the present invention can be realized by using a general computer system without using a dedicated system. For example, an authentication system that executes the above-described processing is configured by installing the program for executing the above-described operation from a medium (a floppy disk, a CD-ROM, or the like) storing the program in a computer having an external storage device. can do.

The medium for supplying the program to the computer may be a communication medium (a medium that temporarily and fluidly stores the program, such as a communication line, a communication network, or a communication system). For example, the program may be posted on a bulletin board (BBS) of a communication network and distributed via the network. Then, by starting this program and executing it in the same manner as other application programs under the control of the OS, the above-described processing can be executed.

When the OS shares part of the processing,
Alternatively, when the OS constitutes a part of one component of the present invention, a program excluding the part may be stored in the recording medium. Also in this case, in the present invention, it is assumed that the recording medium stores a program for executing each function or step executed by the computer.

[0081]

As described above, according to the present invention, a simple authentication system for concealing data stored in a storage device while ensuring the ease of transfer is realized.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a configuration of an authentication system according to an embodiment of the present invention.

FIG. 2 is a diagram schematically showing a data structure of a flash memory.

FIG. 3 is a block diagram illustrating a configuration of a controller.

FIG. 4A is a flowchart illustrating an initial process on a computer side, and FIG. 4B is a flowchart illustrating an initial process on a memory card side.

FIG. 5A is a flowchart showing an authentication process on the computer side, and FIG. 5B is a flowchart showing an authentication process on the memory card side.

FIG. 6A is a flowchart showing a process for locking a password on a computer side;
FIG. 4B is a flowchart illustrating a process for locking a password on the memory card side.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Memory card 11 Flash memory 12 Controller 121 CPU 122 ROM 2 Computer

Claims (9)

[Claims] 1. A storage device having a storage area for storing and supplying data in response to an access and storing rewritable authentication data, means for acquiring input data in accordance with an instruction of an operator, and the storage Output a command to access the device,
An access device connected to an access device including: a unit that obtains read data supplied in response to the command; anda command execution unit; and a permission unit. Determining whether or not the input data acquired by the access device substantially matches predetermined authentication data; and when determining that the input data matches, the command execution means receives the command from the access device. The command execution means receives the command output by the access device when the permission means permits, and when the received command represents a predetermined access command, the received command execution means, Accessing the storage device in response to a command, and reading the read data acquired from the storage device by the access. The comprises means for supplying to said access device, said command executing means, when the command received from the access device representing a predetermined setting change command, to obtain a new said authentication data from said access device,
An access control device, comprising: updating means for storing the acquired authentication data in the storage area of the storage device. 2. The access device includes means for outputting write data to be stored in the storage device, wherein the permission means is configured to determine that the input data acquired by the access device is the authentication data. Determining whether or not the command execution means substantially matches, and when determining that the command execution means, the command execution means includes means for permitting the reception of the write data. Means for receiving the write data, and when the received command indicates the access command instructing the writing of the write data, the writing to the storage area of the storage device in response to the received command. The access control device according to claim 1, further comprising: means for writing data. 3. The data for authentication comprises an enable command and a password, and the permission means acquires the command when the access device does not permit the command execution device to receive the command from the access device. Determining whether or not the input data substantially includes the enable command and the password, and determining that the input data includes both the enable command and the password, and permitting the command execution means to receive the command. The access control device according to claim 1 or 2, wherein: 4. The input device according to claim 1, wherein the input data acquired by the access device includes the enable command and the password when the command execution device is permitted to receive the command from the access device. Means for substantially determining whether or not to include the enable command, and when determining that the password does not include the password, means for inhibiting the command execution means from receiving the command. The access control device according to claim 3, characterized in that: 5. The method according to claim 1, wherein the enable command and the password are associated with each other and form a pair. When the permission unit does not permit the command execution unit to receive the command from the access device, It is determined whether or not the input data obtained by the access device substantially includes the pair of the enable command and the password, and when it is determined that the pair includes the pair, the command execution means sets the command to Means for allowing the access device to receive the command from the access device, the input data acquired by the access device is the enable command and its enable command. Determining whether or not the pair substantially includes the password; Means for prohibiting the command execution means from receiving the command when it is determined that the command execution means does not include the password paired with the enable command. 5. The access control device according to 3 or 4. 6. The command execution means when the password includes predetermined data, irrespective of whether or not the input data obtained by the access device includes the enable command and the password. The access control device according to claim 3, further comprising: a unit that permits receiving the command. 7. The permission means determines whether or not the input data acquired by the access device substantially includes a predetermined maintenance command. The access control device according to any one of claims 1 to 6, further comprising: means for permitting reception of the command from the device. 8. A storage unit, an access unit, a permission unit, and a command execution unit, wherein the storage unit stores and supplies data in response to an access, and rewrites authentication data. A storage area for storing, wherein the access means outputs input commands for obtaining input data according to an instruction of an operator, and a command for accessing the storage means, and supplies the command in response to the command Command supply means for obtaining the read data obtained,
The permission means determines whether or not the input data obtained by the access means substantially matches predetermined authentication data. Means for receiving the command from the means, the command execution means receives the command output by the access means when the permission means permits, the received command is a predetermined access command When representing, the storage means is accessed in response to the received command, and the read data acquired from the storage means by the access is supplied to the access means, and the command execution means further receives from the access means. When the given command represents a predetermined setting change command,
An authentication system, comprising: updating means for acquiring new authentication data from the access means and storing the acquired authentication data in the storage area of the storage means. 9. A computer functioning as a storage unit, an access unit, a permission unit, and a command execution unit, wherein the storage unit stores and supplies data in response to access, and rewrites authentication data. Functioning as having a storage area for storing the data, the input means for acquiring input data in accordance with an instruction of an operator, and a command for accessing the storage means, and responding to the command. Functioning as command supply means for acquiring the supplied read data, and determining whether the input data acquired by the access means substantially matches predetermined authentication data. Means for permitting the command execution means to receive the command from the access means when it is determined that they match. The command execution unit receives the command output by the access unit when the permission unit permits, and when the received command represents a predetermined access command, the command execution unit receives the command. In response, the storage unit is accessed, and the read data obtained from the storage unit by the access is made to function as a unit that supplies the access unit. The command execution unit further includes a command received from the access unit. When expressing the setting change command of
A computer-readable recording storing a program for acquiring new authentication data from the access unit and causing the acquired authentication data to function as an updating unit that stores the acquired authentication data in the storage area of the storage unit. Medium.