JP2009223787A - Information processor and processing method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a function of completely erasing data cached on a secondary storage device when shut down, and completely preventing remaining data from being used illegally, and information from spreading. <P>SOLUTION: An access to the secondary storage device by an application on an OS used by a user is redirected to a specified cache area, and the specified cache area is erased from the OS operating in an environment isolated from the OS used by the user, and securing a legitimate operation inoperable directly by the user, just after shutting down the OS used by the user. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an information processing apparatus and method, and a program, which have a volatile main storage device and a nonvolatile secondary storage device, and control access to the secondary storage device.

  A thin client system has been devised as a system for preventing important data stored in a file server from spreading from user terminals. A thin client system generally uses a terminal (diskless PC) that is not equipped with a non-volatile secondary storage device in the terminal. However, the thin client system uses a thin PC with a non-volatile secondary storage device that controls writing. Some systems are used as client terminals.

  However, a thin client system using a terminal without a secondary storage device is premised on the existence of dedicated servers, blades, and a high-speed network. There is a problem that takes.

  In order to solve such a problem of the thin client, for example, in Patent Document 1, in a terminal having a secondary storage device (nonvolatile memory), when a write occurs from an application to the secondary storage device, the write is performed. By redirecting to the main storage device (volatile memory), writing to the secondary storage device is limited, and a terminal that does not have a pseudo secondary storage is realized. According to these systems, in addition to preventing the important data stored in the file server from spreading, it is also possible to prevent an inappropriate OS setting change and application installation by the user.

  Further, the system of Patent Document 1 restricts writing to the secondary storage device by redirecting writing to the nonvolatile secondary storage device into the volatile main storage device. If the capacity on the main storage device is insufficient, the data is swapped to the encryption swap area on the secondary storage device. Then, the encryption key is stored on the volatile main storage device, and it is assumed that the encryption key is automatically deleted at the same time as the shutdown and the cache data in the encryption swap area becomes unusable. Information diffusion is prevented.

JP 2007-172063 A

  However, in the system disclosed in Patent Document 1, it is a problem that data remains on the non-volatile secondary storage device although it is encrypted. This is because the encryption may be broken, and if it is difficult to break, the performance is significantly reduced. As a simple solution, it is conceivable to incorporate a module for erasing swap data, but if the OS crashes, erasure cannot be guaranteed. Therefore, a means for completely erasing the cache data on the nonvolatile secondary storage device at the time of shutdown is required.

  The present invention has been made in view of such a situation, and the function of completely erasing data cached on the secondary storage device at the time of shutdown and completely preventing misuse of residual data and information diffusion. Is disclosed.

  In order to solve the above-described problems, the present invention discloses a function for reliably erasing data cached on a terminal at the time of shutdown in an information terminal including a non-volatile secondary storage device.

  The configuration of the information terminal according to the present invention includes a CPU, a main storage device, an input / output device, a network device, and a secondary storage device provided in a general information terminal, as well as an OS used by a user (hereinafter referred to as a guest OS). ) And an operating system operating in the background of the guest OS (hereinafter referred to as a management OS), and the management OS and the application operating on the management OS have been tampered with. It is equipped with a security chip that ensures that it is not. The CPU may be designed to support virtualization. A write control module is provided in the guest OS, and the write to the secondary storage device by the guest OS is redirected to a specific cache area. In addition, the management OS includes an erasure module, which erases the specific cache area when the terminal is shut down.

  At this time, since the guest OS and the management OS are separated by different partitions and their operations are not affected, even if a problem occurs on the guest OS, the specific cache area is deleted by the deletion module on the management OS. Is guaranteed.

  That is, the present invention relates to an information processing apparatus that manages access to a non-volatile secondary storage device. In the secondary storage device, a write prohibited area in which data writing is prohibited and a write permitted area in which data writing is allowed. An area management means for managing each area separately, a write control means for writing data instructed to be written to the secondary storage device only to the write-permitted area, and a write-permitted area when the information processing apparatus is shut down And data erasing means for erasing the data written in. The information processing apparatus further includes monitoring means for monitoring whether the information processing apparatus has shut down and notifying the data erasing means of the occurrence of the shutdown. Then, the data erasing unit erases the data written in the write permission area in response to the shutdown notification from the monitoring unit. The information processing apparatus further includes a volatile main storage device, and the write control unit redirects the data instructed to be written to the secondary storage device, stores the redirected data in the main storage device, and stores the data in the main storage device. If it is not possible, write the data instructed to write to the write-permitted area.

  An information processing apparatus according to the present invention relates to an information processing apparatus that has a volatile main storage device and a nonvolatile secondary storage device, and controls access to the secondary storage device. Operating guest OS means, management OS means operating as an OS in the background of the guest OS means, virtual machine monitor means for managing the guest OS means and management OS means, and operating both simultaneously, and guest OS means Write control means operating above, and data erasing means operating on the management OS means. In the secondary storage device, the write control means manages each area separately into a write prohibited area where data writing is prohibited and a write permitted area where data writing is allowed. The data instructed to be written is written only in the write-permitted area, and the data erasing unit erases the data written in the write-permitted area when the guest OS unit (information processing apparatus) is shut down. The virtual machine monitor means monitors whether the guest OS means has shut down, notifies the management OS means of the occurrence of the shutdown, and the management OS means responds to the shutdown notification by the virtual machine monitor means. The data erasing unit is instructed to erase data. Then, the data erasing unit erases the data written in the write permission area in response to the data erasing instruction from the management OS unit. The information processing apparatus further includes security check means for confirming whether the management OS means and the virtual machine monitor means have been tampered with when the information processing apparatus (guest OS means) is activated. Only when the management OS means and the virtual machine monitor means have not been tampered with, the user can log in to the guest OS means.

  The present invention further provides a method and a program corresponding to the information processing apparatus described above.

  Further features of the present invention will become apparent from the best mode for carrying out the present invention and the accompanying drawings.

  According to the present invention, it is possible to completely prevent data abuse and information diffusion in the information processing apparatus.

  The present invention prevents an inappropriate setting change, data storage, and application installation by a user in an information terminal including a secondary storage device, and securely erases data cached on the terminal at the time of shutdown. The present invention relates to a function that makes it possible to quickly return an information terminal to a startup state while preventing misuse of residual data.

  Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. However, it should be noted that this embodiment is merely an example for realizing the present invention, and does not limit the technical scope of the present invention. In each drawing, the same reference numerals are assigned to common components.

<Device configuration>
FIG. 1 is a diagram showing a schematic configuration of an information leakage prevention apparatus (information terminal apparatus 100) according to an embodiment of the present invention.

  The information terminal device 100 includes a CPU 101 provided in a general information terminal, a main storage device 102 that is a volatile memory, a network device 103, an input / output device 104 that includes a keyboard, a mouse, a printer, a display, and the like. And a secondary storage device 105 which is a nonvolatile memory. In addition, the information terminal device 100 includes an OS (hereinafter referred to as a guest OS) 108 used by a user, an OS (hereinafter referred to as a management OS) 110 that operates in the background of the guest OS, and those 2 Security that includes a virtual machine monitor (hereinafter referred to as VMM: Virtual Machine Monitor) 106 that allows two OSs to operate simultaneously, and that ensures that the management OS and applications running on the management OS have not been tampered with A chip 107 is provided.

  A security chip (for example, equivalent to the current TPM (Trusted Platform Module)) 107 is a security chip having hardware tamper resistance. The security chip 107 has a calculation function such as a cryptographic calculation and a hash calculation, and a function of storing a cryptographic key and a hash value, and can perform encryption / decryption / signature generation / verification independently of the CPU 101. . The main operation of the security chip 107 in the information terminal apparatus 100 is to verify the signature of binary data of a management OS (described later) and an application running on the management OS 110 when the terminal is started, and to ensure that they operate normally. That is. That is, the security chip 107 performs integrity verification when the information terminal device 100 is activated.

  The management OS 110 is basically an OS that cannot be operated by the user, and operates on a partition separated from the guest OS 108 (described later). Further, since the integrity of the binary image is verified by the security chip 107 when the terminal is activated, it is ensured that the management OS 110 operates safely from the terminal activation to the shutdown. Furthermore, the management OS 110 operates in the background of the guest OS 108 from the time when the terminal is activated until the shutdown. An erasure module 111 is installed on the management OS 110 (details will be described later).

  The guest OS 108 is an OS that can be actually operated by the user. That is, the user creates the Internet and documents on the guest OS 108. When the user turns on the information terminal device 100, only the guest OS 108 appears to the user. A write control module 109 is installed on the guest OS 108 (details will be described later).

  The VMM 106 is a module that manages the allocation of resources such as the CPU 101 and the main storage device 102 in order to operate the management OS 110 and the guest OS 108 at the same time. The guest OS 108 and the management OS 110 are operating on the VMM, and the VMM 106 and the management OS 110 are activated in the background before the guest OS 108 is activated. The start, stop, shutdown, etc. of the guest OS 108 are managed (monitored) by the VMM 106.

  The write control module 109 is a module that operates on the guest OS 108. The write control module 109 has a function of dividing and managing the area of the secondary storage device 105 occupied by the guest OS 108 into two areas: an erase reservation area 303 and a write control area 302 (see FIG. 3). Further, the write control module 109 stores all data to be written in the write control area 302 in the erase reservation area 303 when an application 304 (see FIG. 3) on the guest OS 108 is instructed to write to the secondary storage device 105. It has a function to redirect and cache.

  Here, the write control area 302 is an area in which data necessary for operating the OS and applications is stored. The writing area 302 is protected from writing to the secondary storage device 302 that occurs when the user operates. The erasure reservation area 303 is an area that is redirected and cached by the write control module 109, and is a storage area that is completely erased by an erasure module 111 (described later) on the management OS 110 when the information terminal apparatus 100 is shut down. It is.

  The erasure module 111 is a module that operates on the management OS 110 and has a function of erasing the erasure reserved area data in the secondary storage device 105 managed by the guest OS 108 when the information terminal apparatus 100 is shut down. Actually, after the management OS 110 receives a shutdown notification of the guest OS 108 from the VMM 106, the volume area on the secondary storage device 105 managed by the guest OS 108 is mounted, and the erase reservation area 303 is cleared to zero.

<Activation of information terminal device>
FIG. 2 is a flowchart for explaining a process of starting the information terminal device. Note that the installation images of the VMM 106 and the management OS 110 may be stored not in the secondary storage device 105 but in a dedicated nonvolatile main storage device or the like. Here, it is assumed that the hash value of the binary image when the correct operation is performed is stored in the security chip 107 in advance.

  First, when the information terminal device 100 is activated (for example, powered on by the user) (step S200), the security chip 107 executes integrity verification of the VMM 106 using its own signature verification function (step S200). S201). For example, the security chip 107 stores the hash value of the binary image of the VMM 106 stored in itself (this is the hash value of the image for which normal operation is guaranteed in advance) and the hash value of the binary image of the current VMM 106. Compare After confirming that the VMM 106 has not been tampered with, the process proceeds to step S202.

  Next, the security chip 107 executes integrity verification of the management OS 110 (step S202). This verification is also performed by comparing hash values as in the case of the VMM 106, for example.

  Only when it is confirmed that neither the VMM 106 nor the management OS 110 has been tampered with, the CPU 101 activates the VMM 106 and the management OS 110 from the security chip 107 (step S203). When tampering is detected, the activation process of the information terminal device 100 ends. In this case, it is necessary to install a normal VMM 106 and management OS 110.

  When the management OS 110 is activated, the VMM 106 sends an activation signal to the guest OS 108, and the CPU 101 activates the guest OS 108 (step S204). After the guest OS 108 is activated, the management OS 110 monitors the activation and shutdown of the guest OS 108 based on the notification from the VMM 106 (step S205).

  Then, after the guest OS 108 is activated, the user logs in to the guest OS 108 and can use the PC (step S206). At this time, the management OS 110 is operating in the background of the guest OS 108, but since both are isolated by the VMM 106, the operation of the management OS 110 does not stop even when the guest OS 108 stops.

<Operation of writing module>
FIG. 3 is a diagram for explaining the outline of the operation of the write control module. As a premise of the operation, it is assumed that a guest OS partition 301 area on the secondary storage device 105 is allocated to the guest OS 108. This allocation is performed by the resource management function of the VMM 106.

  As shown in FIG. 3, the write control module 109 installed on the guest OS 108 manages the guest OS partition 301 by dividing it into a write control area 302 and an erase reservation area 303. When the application 304 tries to write to the write control area 302 by a user operation on the guest OS 108, the application 304 is redirected to the erasure reservation area 303, and the data to be written is cached. With the above operation, the data in the write control area 302 is completely protected, and it is possible to limit inappropriate setting changes and installation of the application 304 by the user.

  Regarding write processing, when a write instruction to the secondary storage device is given, the data write is first redirected to the main storage device 102, and when the main storage device becomes full and data cannot be stored, an erasure reservation is made. A writing process may be executed in the area 303. Since the main storage device 102 is a volatile memory, all stored data is erased at the time of shutdown, so that data security can be maintained. Even if the main storage device 102 becomes full, the data stored in the erasure reservation area 303 is also securely erased at the time of shutdown, so that the security of the data can be ensured. Thus, even when data cannot be stored in the main storage area 102, data leakage can be reliably prevented.

  In this embodiment, the write control module 109 is provided in a lower layer of a file system (not shown) in the information terminal device 100 and in an upper layer of the secondary storage device 105 and the main storage device 102. May be. As described above, by arranging the filter driver between the file system and the secondary storage device 105 and the main storage device 102, data is written to the secondary storage device 105 to the file system. The OS can be executed without contradiction. In this way, the write data is cached in the main storage device 102 at a layer below the file system. As a result, when the storage capacity of the main storage device 102 is not full, the OS actually looks as if the file is stored in the secondary storage device 105, and the physical storage device is actually physically secondary. Writing to the storage device 105 is prohibited. With the above mechanism, it is possible to operate the OS as usual even when writing to the secondary storage device 105 is prohibited without hindering writing of data necessary when the OS is executed. In addition, since the data itself in the secondary recording device 105 cannot be falsified, the confidentiality of the data can be maintained.

  FIG. 4 shows a case where the application 304 accesses the secondary storage device 105 when a normal operation, for example, an operation such as mail or document creation, is performed after the user logs in to the guest OS 108. 4 is a flowchart for explaining a writing / reading operation of a control module 109;

  When the application 304 or the OS (guest OS 108) accesses the secondary storage device 105 (step S400), the write control module 109 determines whether the access is a write process or a read process (step S401).

  If the access is a write process, the write control module 109 caches data to be written to the erase reservation area 303 (step S405). On the other hand, if the access is a read process, the write control module 109 determines whether there is cache data to be read in the erasure reservation area 303 (step S402).

  If it is determined that there is cache data to be read, the writing control module 109 reads the data from the erasure reservation area 303 as it is (step S403). On the other hand, when there is no cache data, the write control module 109 reads data from the write control area 303 of the secondary storage device 105 (step S404).

<Operation at the time of shutdown of the information terminal device>
FIG. 5 is a flowchart for explaining the erase operation of the erase reservation area 304 by the management OS 110 when the information terminal device 100 is shut down.

  When the user shuts down the information terminal device 100 from the guest OS 108 (step S500), the guest OS 108 unmounts the allocation area on the secondary storage device 105, that is, the guest OS partition area 301 (step S501). . That is, the guest OS 108 separates the guest OS partition area 301 from the recognized (managed) state.

  Thereafter, when the VMM 106 receives a shutdown notification from the guest OS 108 (step S502), the VMM 106 notifies the management OS 110 that the guest OS 108 has been shut down (step S503).

  After receiving the notification of shutdown of the guest OS 108, the management OS 110 mounts the guest OS partition area 301 used by the guest OS 108 (step S504). That is, the management OS 110 recognizes the guest OS partition area 301 (the write control area 302 and the erase reservation area 303). After mounting the area, the management OS 110 instructs the erasure module 111 to erase the cache data in the erasure reserved area 303. Then, the erasure module 111 clears the erasure reservation area 303 to zero and completely deletes the newly created local data (step S505). Thereafter, the CPU 101 shuts down the information terminal device 100.

  Note that the operation of the management OS 110 is guaranteed in advance by integrity verification, and the management OS 110 and the guest OS 108 operate in different partition areas in the secondary storage device 105. Even if a crash occurs, no cache data remains in the erasure reservation area 303. As described above, it is possible to completely and safely delete data written in the erasure reserved area, and to prevent misuse of the data and information diffusion.

  The present invention can also be realized by a program code of software that implements the functions of the embodiments. In this case, a storage medium in which the program code is recorded is provided to the system or apparatus, and the computer (or CPU or MPU) of the system or apparatus reads the program code stored in the storage medium. In this case, the program code itself read from the storage medium realizes the functions of the above-described embodiments, and the program code itself and the storage medium storing the program code constitute the present invention. As a storage medium for supplying such program code, for example, a flexible disk, CD-ROM, DVD-ROM, hard disk, optical disk, magneto-optical disk, CD-R, magnetic tape, nonvolatile memory card, ROM Etc. are used.

  Also, based on the instruction of the program code, an OS (operating system) running on the computer performs part or all of the actual processing, and the functions of the above-described embodiments are realized by the processing. May be. Further, after the program code read from the storage medium is written in the memory on the computer, the computer CPU or the like performs part or all of the actual processing based on the instruction of the program code. Thus, the functions of the above-described embodiments may be realized.

  In addition, by distributing the program code of the software that realizes the functions of the embodiment via a network, it is stored in a storage means such as a hard disk or memory of a system or apparatus or a storage medium such as a CD-RW or CD-R. The program code stored in the storage means or the storage medium may be read out and executed by the computer (or CPU or MPU) of the system or apparatus during storage.

It is a figure which shows schematic structure of the information leakage prevention apparatus (information terminal device) by this invention. It is a flowchart for demonstrating the operation | movement at the time of starting of an information terminal device. It is an operation | movement diagram of a write-control module. It is a flowchart for demonstrating the write / read process of a write control module. It is a flowchart for demonstrating the erase operation | movement of the erase reservation area | region in management OS at the time of shutdown.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 ... Information terminal device, 101 ... CPU, 102 ... Main storage device, 103 ... Network device, 104 ... I / O device, 105 ... Secondary storage device, 106 ... VMM, 107 ... Security chip, 108 ... Guest OS, 109 ... Write control module, 110 ... management OS, 111 ... erase module

Claims (11)

An information processing apparatus that manages access to a non-volatile secondary storage device,
In the secondary storage device, an area management means for managing each area separately into a write prohibited area where data writing is prohibited and a write permitted area where data writing is allowed;
Write control means for writing data instructed to write to the secondary storage device only in the write-permitted area;
Data erasing means for erasing data written in the write-permitted area when the information processing apparatus is shut down;
An information processing apparatus comprising: Further, monitoring whether the shutdown of the information processing apparatus has occurred, comprising monitoring means for notifying the occurrence of the shutdown to the data erasure means,
The information processing apparatus according to claim 1, wherein the data erasing unit erases data written in the write permission area in response to the notification of the shutdown by the monitoring unit. An information processing apparatus that manages access to a non-volatile secondary storage device,
In the secondary storage device, each area is divided into a write prohibited area where data writing is prohibited and an erase reserved area where data writing is allowed but data written when the information processing apparatus is shut down is erased. Area management means for managing
Write control means for writing data instructed to write to the secondary storage device only to the erasure reserved area;
An information processing apparatus comprising: In addition, it has a volatile main memory,
The write control means redirects the data instructed to be written to the secondary storage device to store it in the main storage device, and when it cannot be stored in the main storage device, the write permission area or the erasure reservation area 4. The information processing apparatus according to claim 1, wherein the data instructed to write is written in the information processing apparatus. An information processing apparatus having a volatile main storage device and a non-volatile secondary storage device and controlling access to the secondary storage device,
A guest OS means that operates as an OS used by a user;
Management OS means operating as an OS in the background of the guest OS means;
A virtual machine monitor means for managing the guest OS means and the management OS means and operating them simultaneously;
Write control means operating on the guest OS means;
Data erasing means operating on the management OS means,
In the secondary storage device, the write control unit manages each region separately into a write-inhibited region where data writing is prohibited and a write-permitted region where data writing is allowed, to the secondary storage device Write processing of the data instructed to write only to the write-permitted area,
The data erasing unit erases data written in the write permission area when the guest OS unit is shut down. The virtual machine monitor means monitors whether the guest OS means has shut down, notifies the management OS means of the occurrence of the shutdown,
The management OS means instructs the data erasure means to erase data in response to the shutdown notification by the virtual machine monitor means,
6. The information processing apparatus according to claim 5, wherein the data erasing unit erases data written in the write permission area in accordance with a data erasing instruction from the management OS unit. And security check means for confirming whether the management OS means and the virtual machine monitor means have been tampered with when the information processing apparatus is activated,
7. The information processing apparatus according to claim 5, wherein a user can log in to the guest OS unit only when the management OS unit and the virtual machine monitor unit have not been tampered with. . An information processing method for managing access to a nonvolatile secondary storage device included in an information processing terminal device,
In the secondary storage device, the area management means manages each area separately into a write prohibited area where data writing is prohibited and a write permitted area where data writing is allowed,
Write control means writes the data instructed to write to the secondary storage device only to the write-permitted area,
An information processing method, wherein data erasure means erases data written in the write-permitted area when the information processing terminal device is shut down. Further, the monitoring means monitors whether the shutdown of the information processing terminal device has occurred, notifies the data erasure means of the occurrence of the shutdown,
9. The information processing method according to claim 8, wherein the data erasing unit erases data written in the write permission area in response to the notification of the shutdown by the monitoring unit.   The write control means redirects the data instructed to be written to the secondary storage device to store in the volatile main storage device, and when the data cannot be stored in the main storage device, the write control means writes the write to the write permission area. 10. The information processing method according to claim 8, wherein the instructed data is written.   A program for causing a computer to execute the information processing method according to any one of claims 8 to 10.

Images