JP6940181B2 - Information processing device, control method and control program of information processing device - Google Patents

Description

The present invention relates to an information processing device, a control method and a control program of the information processing device.

A security chip called TPM (Trusted Platform Module) is used to protect computer data from theft and information leakage. The TPM function of the security chip is independent of the operating system and other hardware. Therefore, it is resistant to attacks from the outside, and it is possible to securely store and manage information such as an encryption key for encrypting / decrypting (authentication) data stored in the storage so far.

As related techniques, for example, Patent Documents 1 and 2 are known. Patent Document 1 describes that in an electronic device having a security chip, in order to improve user convenience, the presence or absence of authentication by an activation password is automatically switched according to the environment. Patent Document 2 describes that the anti-theft firmware disables a part of a processor or a chipset in a computer platform.

JP-A-2019-160210 JP-A-2010-191946

By installing a security chip that holds the encryption key of the storage in the computer, it is possible to protect the data in the storage even if only the storage is extracted from the computer and connected to another computer.

However, if the computer is taken away, that is, if the security chip and storage are taken away as a set, the encryption may be decrypted. For example, even if password authentication is used as in Patent Document 1, damage due to password leakage or the like is assumed. Therefore, in the related technology, there is a problem that it is difficult to ensure security even if a security chip is used.

The present disclosure has been made to solve such a problem, and an object of the present disclosure is to provide an information processing device, a control method of the information processing device, and a control program capable of ensuring security.

The information processing device according to the present disclosure includes a security chip that holds an encryption key for encrypting and decrypting data in the storage device, a position information acquisition unit that acquires the position information of the storage device, and the acquired position. It includes a control unit that controls activation or invalidation of the security chip based on information.

The control method of the information processing device according to the present disclosure is a security that acquires the position information of the storage device and holds an encryption key for encrypting and decrypting the data of the storage device based on the acquired position information. It controls the activation or invalidation of the chip.

The control program according to the present disclosure acquires the position information of the storage device, and based on the acquired position information, enables the security chip that holds the encryption key for encrypting and decrypting the data of the storage device. Alternatively, it is a control program for causing an information processing apparatus to execute a process that controls invalidation.

According to the present disclosure, it is possible to provide an information processing device capable of ensuring security, a control method and a control program of the information processing device.

It is a block diagram which shows the outline of the information processing apparatus which concerns on embodiment. It is a block diagram which shows the structural example of the information processing apparatus which concerns on Embodiment 1. FIG. It is a flowchart which shows the process of the information processing apparatus which concerns on Embodiment 1. FIG.

Hereinafter, specific embodiments to which the present disclosure is applied will be described in detail with reference to the drawings. In each drawing, the same elements are designated by the same reference numerals, and duplicate description will be omitted as necessary for the sake of clarity of description.

(Outline of Embodiment)
FIG. 1 shows an outline of the information processing apparatus according to the embodiment. As shown in FIG. 1, the information processing apparatus 100 according to the embodiment includes a security chip 110, a position information acquisition unit 120, and a control unit 130.

The security chip 110 holds, for example, an encryption key for encrypting and decrypting data in a storage device provided in the information processing device 100. The position information acquisition unit 120 acquires the position information of the storage device. The control unit 130 controls the activation or invalidation of the security chip 1 based on the position information acquired by the position information acquisition unit 120.

As described above, in the embodiment, the position information of the storage device is acquired, and the activation or invalidation of the security chip is controlled based on the acquired position information, so that the storage device can be configured according to the position of the storage device. It is possible to prevent the data from being decrypted. Therefore, security can be ensured.

(Embodiment 1)
Next, a specific configuration and operation of the information processing apparatus 10 according to the first embodiment will be described. FIG. 2 shows a configuration example of the information processing device 10 according to the present embodiment.

The information processing device 10 is, for example, a computer such as a personal computer or a server. The information processing device 10 may be a stationary computer such as a desktop computer, a mobile computer such as a tablet computer or a notebook computer, or a portable electronic device such as a smartphone.

As shown in FIG. 2, the information processing apparatus 10 includes a security chip 1, a storage 2, a non-volatile memory 3, a processor 4, a main memory 5, a position information acquisition device 6, a user interface 7, and a chipset 8.

For example, a motherboard (not shown) and a storage 2 are fixed inside the housing of the information processing device 10. Further, a security chip 1, a non-volatile memory 3, a processor 4, a main memory 5, a position information acquisition device 6, and a chipset 8 are mounted on the motherboard of the information processing device 10. Further, the storage 2 and the user interface 7 are connected via a connector or the like of the motherboard. The user interface 7 may be provided inside the information processing device 10 or may be provided outside the information processing device 10.

The security chip 1 is, for example, a TPM, which is a semiconductor device that realizes a TPM function. The security chip 1 is, for example, a discrete semiconductor chip dedicated to TPM, but may be provided inside another semiconductor device such as a processor 4. The TPM function includes a function of storing an encryption key for encrypting and decrypting data, a function of encrypting and decrypting data, and the like. The TPM function has tamper resistance and cannot illegally read information such as an encryption key from the outside. In the present embodiment, the security chip 1 holds an encryption key for encrypting and decrypting the data in the storage 2 as a TPM function, and encrypts and decrypts the data in the storage 2 as needed. do.

In the present embodiment, activation / invalidation of the security chip 1 is controlled. Enabling / disabling the security chip 1 means enabling / disabling the TPM function by the security chip 1.

Specifically, enabling / disabling the security chip 1 means making the encryption key held in the security chip 1 available / unusable. That is, when the security chip 1 is enabled, the encryption key held in the security chip 1 becomes available, so that the data in the storage 2 can be encrypted and decrypted. Further, when the security chip 1 is invalidated, the encryption key held in the security chip 1 becomes unusable, so that the data in the storage 2 cannot be encrypted and decrypted.

The storage 2 is a storage device (auxiliary storage device) that stores various software and data including an OS (operating system). For example, the storage 2 is an HDD (Hard Disk Drive), an SSD (Solid State Drive), a flash memory, or the like. The storage 2 is a device to be encrypted / decrypted by the TPM function. For example, the data stored in the storage 2 is encrypted by the security chip 1. The storage 2 may have a means for encrypting or decrypting the stored data by using the encryption key held in the security chip 1. Further, the data stored in the storage 2 may be encrypted or decrypted by the OS or other program using the encryption key held in the security chip 1.

The non-volatile memory 3 is a non-volatile storage device such as a ROM (Read Only Memory) or a flash memory, and is, for example, an SPI (Serial Peripheral Interface) flash memory. The non-volatile memory 3 may be a storage device that retains internal data even when the power of the information processing device 10 is turned off. The non-volatile memory 3 stores programs and data necessary for starting the information processing device 10 (when the power is turned on) and the like.

For example, the non-volatile memory 3 has a BIOS storage unit 31 and a position information registration unit 32. The BIOS storage unit 31 stores the BIOS (Basic Input / Output System) in advance. The BIOS is firmware executed by the processor 4 when the information processing apparatus 10 is started. The BIOS performs initial hardware settings, input / output control, OS reading (loading), and the like. In the present embodiment, the BIOS has a function of comparing the specific position information registered in the position information registration unit 32 in advance with the position information acquired by the position information acquisition device 6, and further, depending on the comparison result. Therefore, it has a function of controlling the activation or invalidation of the security chip 1.

The position information registration unit 32 registers (stores) specific position information indicating a position where the security chip 1 is valid in advance. The user registers specific position information indicating the position where the encryption of the storage 2 is desired to be decrypted in the position information registration unit 32. The specific position information to be registered is information corresponding to the position information that can be acquired by the position information acquisition device 6, and includes, for example, latitude and longitude information. The position information registration unit 32 may register one position information or may register a plurality of position information. For example, area information including a plurality of positions (a predetermined building, a predetermined floor, etc.) may be used.

The processor 4 is a control unit that controls the operation of the information processing device 10. For example, the processor 4 is a CPU (Central Processing Unit), an MPU (Micro Processor Unit), a DSP (Digital Signal Processing), or the like. The main memory 5 is a volatile memory (main storage device) that temporarily holds programs and data necessary for the operation of the processor 4. The main memory 5 is, for example, a DRAM (Dynamic Random Access Memory) or a SRAM (Static Random Access Memory).

The processor 4 realizes the functions of the program including the BIOS and the OS by reading the program stored in the storage 2 and the non-volatile memory 3 into the main memory 5 and executing the read program. The processor 4 has a BIOS execution unit 41 as one of the functions realized by the program.

The BIOS execution unit 41 realizes the function of the BIOS by reading the BIOS from the BIOS storage unit 31 of the non-volatile memory 3 and executing the read BIOS when the information processing device 10 is started. As described above, the BIOS execution unit 41 compares the specific position information registered in the position information registration unit 32 in advance with the position information acquired by the position information acquisition device 6 as a function of the BIOS, and responds to the comparison result. Controls the activation or invalidation of the security chip 1. The BIOS execution unit 41 may switch the enable / disable setting of the security chip 1 in the chipset 8 as the enable / disable of the security chip 1. Further, the BIOS execution unit 41 may switch between enabling / disabling the port of the security chip 1 connected to the chipset 8.

The position information acquisition device 6 is a position information acquisition unit that acquires position information indicating the position where the information processing device 10 currently exists. The position information acquired by the position information acquisition device 6 is the position information of the information processing device 10 including the storage 2, and in particular, the position information of the storage 2 to be encrypted / decrypted by the TPM function. For example, the position information acquisition device 6 is a GPS device that acquires the current position information (latitude, longitude, etc.) by GPS. The position information acquisition device 6 may acquire the position information at the timing (such as when the information processing device 10 is started) instructed by the processor 4 (BIOS execution unit 41), or periodically acquires the position information. May be good. The position information acquisition device 6 may store the acquired position information in the non-volatile memory 3 or the like.

The user interface 7 is an input / output interface between the information processing device 10 and the user. The user interface 7 includes, for example, a display, a microphone, a speaker, a keyboard, a mouse, various buttons, a GUI (Graphical User Interface), and the like. The user interface 7 receives an input from the user and outputs a signal indicating the content of the input to the processor 4. For example, when the BIOS execution unit 41 displays the BIOS setup screen, the user inputs the hardware settings via the setup screen, and the BIOS execution unit 41 sets the hardware according to the user's input. The BIOS execution unit 41 may switch between enabling / disabling the security chip 1 according to the input of the user.

The chipset 8 connects between the processor 4 and peripheral devices, and controls data input / output and the like between the devices. The chipset 8 may be one semiconductor chip or a plurality of semiconductor chips (north bridge, south bridge, etc.). In this example, the chipset 8 is connected to the processor 4. The chipset 8 is also connected to the security chip 1, the storage 2, the non-volatile memory 3, the main memory 5, the position information acquisition device 6, and the user interface 7. Then, the chipset 8 controls the input / output between the processor 4 and the security chip 1 and the like.

Subsequently, the operation of the information processing device 10 according to the present embodiment will be described. FIG. 3 is a flowchart showing the operation flow of the information processing device 10, and shows the operation of the information processing device 10 when the power is turned on.

The user has previously registered specific position information in the position information registration unit 32 of the non-volatile memory 3 in the information processing device 10. The specific position information registered in the position information registration unit 32 is the position information of the position where the security chip 1 is valid as described above, and is the information of the place where the user uses the information processing device 10. For example, the position information input from the user may be registered, or the position information acquired by the position information acquisition device 6 may be registered. In the case of the mobile type mobile information processing device 10, it is possible to change the place of use while ensuring security by registering a plurality of position information that are expected to be used as specific position information. can.

As shown in FIG. 3, first, the user turns on the power of the information processing apparatus 10 (S101). When the information processing device 10 is activated by turning on the power, the processor 4 reads the BIOS from the BIOS storage unit 31 of the non-volatile memory 3, executes the read BIOS, and starts the operation of the BIOS execution unit 41.

Subsequently, the information processing device 10 acquires the current position information (S102). That is, the BIOS execution unit 41 requests the position information acquisition device 6 to acquire the position information, and the position information acquisition device 6 acquires the current position information in response to the request of the BIOS execution unit 41.

Subsequently, the information processing device 10 determines whether or not the specific position information and the current position information match (S103). That is, the BIOS execution unit 41 compares the specific position information registered in the position information registration unit 32 with the current position information acquired by the position information acquisition device 6, and combines the specific position information with the current position information. Determine if they match. When the specific position information includes a plurality of positions, it is determined whether or not the specific position information includes the current position information.

When it is determined in S103 that the specific position information and the current position information match, the information processing device 10 activates the security chip 1 (S104). That is, the BIOS execution unit 41 activates the security chip 1 for the chipset 8 when the specific position information and the current position information match (the specific position information includes the current position information). Control.

For example, assume that the chipset 8 supports the TPM function (the chipset 8 has a device enable / disable setting). In that case, the BIOS execution unit 41 requests the chipset 8 to switch the enable / disable setting of the device of the security chip 1 (TPM function) of the chipset 8 to enable. If the chipset 8 does not support the TPM function, the BIOS execution unit 41 requests the chipset 8 to activate the port of the chipset 8 connected to the security chip 1. The TPM function can be reliably enabled by enabling the device setting of the security chip 1 in the chipset 8 or by enabling the port of the security chip 1 in the chipset 8.

On the other hand, when it is determined in S103 that the specific position information and the current position information do not match, the information processing device 10 invalidates the security chip 1 (S105). That is, when the specific position information and the current position information do not match (the specific position information does not include the current position information), the BIOS execution unit 41 invalidates the security chip 1 with respect to the chipset 8. Control to do.

For example, when the chipset 8 supports the TPM function, the BIOS execution unit 41 invalidates the device enable / disable setting of the security chip 1 (TPM function) of the chipset 8 for the chipset 8. Request to switch to the conversion. If the chipset 8 does not support the TPM function, the BIOS execution unit 41 requests the chipset 8 to invalidate the port of the chipset 8 connected to the security chip 1. The TPM function can be reliably disabled by disabling the device setting of the security chip 1 in the chipset 8 or by disabling the port of the security chip 1 in the chipset 8.

After S104 or S105, the processing after S102 may be repeated periodically. That is, not only when the power of the information processing device 10 is turned on, the position information acquisition and the activation / invalidation control of the security chip 1 based on the position information may be performed at regular intervals. For example, it is assumed that the security chip 1 is activated by turning on the power of the information processing device 10 at a specific position, and the information processing device 10 is moved to a position different from the specific position after the OS is started. In that case, the BIOS may forcibly restart the information processing device 10 by the interrupt processing of the processor 4 to invalidate the security chip 1.

As described above, in the present embodiment, by controlling the activation / invalidation of the security chip by using the location information of the information processing device (storage), the location information is associated with the TPM function and the security is strengthened. Can be done. For example, when the BIOS is executed when the information processing device is started, the current position information is acquired, and when the current position information different from the specific position information registered in advance is acquired, the security chip is invalidated. Makes the storage inaccessible while still encrypted. In addition, when the current location information equal to the specific location information is acquired, the storage is decrypted and the data in the storage can be used by activating the security chip. By disabling the security chip when the position is different from the specific position, the storage remains encrypted and the encryption key cannot be decrypted, so that the security by the TPM function is ensured.

Further, in the present embodiment, when the information processing device is used at a position other than the specific position set in advance by the user, the security chip is automatically invalidated. That is, in the present embodiment, since the security chip is invalidated based on the comparison result of the location information without performing password authentication as in the related technology, it is possible to prevent access to the storage other than the specific location. It can be done and security can be strengthened.

The present disclosure is not limited to the above embodiment, and can be appropriately modified without departing from the spirit.

Each configuration in the above-described embodiment is composed of hardware and / or software, and may be composed of one hardware or software, or may be composed of a plurality of hardware or software. The function (processing) of each device may be realized by a computer having a CPU, a memory, or the like. For example, a program for performing the method in the embodiment may be stored in the storage device, and each function may be realized by executing the program stored in the storage device on the CPU.

These programs can be stored and supplied to a computer using various types of non-transitory computer readable medium. Non-transient computer-readable media include various types of tangible storage media. Examples of non-temporary computer-readable media include magnetic recording media (eg, flexible disks, magnetic tapes, hard disk drives), magneto-optical recording media (eg, magneto-optical disks), CD-ROMs (Read Only Memory), CD-Rs. It includes a CD-R / W and a semiconductor memory (for example, a mask ROM, a PROM (Programmable ROM), an EPROM (Erasable PROM), a flash ROM, and a RAM (random access memory)). The program may also be supplied to the computer by various types of transient computer readable medium. Examples of temporary computer-readable media include electrical, optical, and electromagnetic waves. The temporary computer-readable medium can supply the program to the computer via a wired communication path such as an electric wire and an optical fiber, or a wireless communication path.

Some or all of the above embodiments may also be described, but not limited to:
(Appendix 1)
A security chip that holds an encryption key for encrypting and decrypting data in the storage device,
A position information acquisition unit that acquires the position information of the storage device, and
A control unit that controls the activation or invalidation of the security chip based on the acquired position information.
Information processing device equipped with.
(Appendix 2)
The control unit enables the security chip when the acquired position information is included in the predetermined position information, and invalidates the security chip when the acquired position information is not included in the predetermined position information. do,
The information processing device according to Appendix 1.
(Appendix 3)
The security chip and the chipset connected to the control unit are provided.
The control unit switches the enable / disable setting of the security chip in the chipset.
The information processing device according to Appendix 1 or 2.
(Appendix 4)
The security chip and the chipset connected to the control unit are provided.
The control unit switches between enabling / disabling the port of the security chip connected to the chipset.
The information processing device according to Appendix 1 or 2.
(Appendix 5)
The control unit controls the activation or invalidation by executing a BIOS (Basic Input / Output System).
The information processing device according to any one of Appendix 1 to 4.
(Appendix 6)
The position information acquisition unit acquires the position information when the information processing apparatus is started.
The information processing device according to any one of Appendix 1 to 5.
(Appendix 7)
The position information acquisition unit periodically acquires the position information.
The information processing device according to any one of Supplementary note 1 to 6.
(Appendix 8)
The security chip is a TPM (Trusted Platform Module).
The control unit controls the activation or invalidation of the TPM function of the security chip.
The information processing device according to any one of Appendix 1 to 7.
(Appendix 9)
Acquires the location information of the storage device and
Based on the acquired location information, it controls the activation or invalidation of the security chip that holds the encryption key for encrypting and decrypting the data in the storage device.
Information processing device control method.
(Appendix 10)
In the control, the security chip is enabled when the acquired position information is included in the predetermined position information, and the security chip is invalidated when the acquired position information is not included in the predetermined position information. ,
The control method of the information processing apparatus according to Appendix 9.
(Appendix 11)
Acquires the location information of the storage device and
Based on the acquired location information, it controls the activation or invalidation of the security chip that holds the encryption key for encrypting and decrypting the data in the storage device.
A control program for causing an information processing device to execute processing.
(Appendix 12)
In the control, the security chip is enabled when the acquired position information is included in the predetermined position information, and the security chip is invalidated when the acquired position information is not included in the predetermined position information. ,
The control program according to Appendix 11.

1 Security chip 2 Storage 3 Non-volatile memory 4 Processor 5 Main memory 6 Location information acquisition device 7 User interface 8 Chipset 10 Information processing device 31 BIOS storage unit 41 BIOS execution unit 32 Location information registration unit 100 Information processing device 110 Security chip 120 Position information acquisition unit 130 Control unit

Claims (13)

A security chip that holds an encryption key for encrypting and decrypting data in the storage device,
A position information acquisition unit that acquires the position information of the storage device, and
A control unit that controls activation or invalidation of the security chip based on the acquired position information is provided.
When the security chip is invalidated, the control unit makes the encryption key held by the security chip unavailable .
The security chip and the chipset connected to the control unit are provided.
The control unit switches the enable / disable setting of the security chip in the chipset.
Information processing device. A security chip that holds an encryption key for encrypting and decrypting data in the storage device,
A position information acquisition unit that acquires the position information of the storage device, and
A control unit that controls activation or invalidation of the security chip based on the acquired position information is provided.
When the security chip is invalidated, the control unit makes the encryption key held by the security chip unavailable .
The security chip and the chipset connected to the control unit are provided.
The control unit switches between enabling / disabling the port of the security chip connected to the chipset.
Information processing device. A security chip that holds an encryption key for encrypting and decrypting data in the storage device,
A position information acquisition unit that acquires the position information of the storage device, and
A control unit that controls activation or invalidation of the security chip based on the acquired position information is provided.
When the security chip is invalidated, the control unit makes the encryption key held by the security chip unavailable .
The control unit controls the activation or invalidation by executing a BIOS (Basic Input / Output System).
Information processing device. The control unit enables the security chip when the acquired position information is included in the predetermined position information, and invalidates the security chip when the acquired position information is not included in the predetermined position information. do,
The information processing device according to any one of claims 1 to 3. The position information acquisition unit acquires the position information when the information processing apparatus is started.
The information processing device according to any one of claims 1 to 4. The position information acquisition unit periodically acquires the position information.
The information processing device according to any one of claims 1 to 5. The security chip is a TPM (Trusted Platform Module).
The control unit controls the activation or invalidation of the TPM function of the security chip.
The information processing device according to any one of claims 1 to 6. Acquires the location information of the storage device and
Based on the acquired location information, it controls the activation or invalidation of the security chip that holds the encryption key for encrypting and decrypting the data in the storage device.
When the security chip is invalidated, the encryption key held by the security chip is disabled and the security chip is disabled .
Controlling the activation or disabling of the security chip includes switching the activation / disabling setting of the security chip in the chipset connected to the security chip.
Information processing device control method. Acquires the location information of the storage device and
Based on the acquired location information, it controls the activation or invalidation of the security chip that holds the encryption key for encrypting and decrypting the data in the storage device.
When the security chip is invalidated, the encryption key held by the security chip is disabled and the security chip is disabled .
Controlling the activation or disabling of the security chip includes enabling / disabling the port of the security chip connected to the chipset.
Information processing device control method. Acquires the location information of the storage device and
Based on the acquired location information, it controls the activation or invalidation of the security chip that holds the encryption key for encrypting and decrypting the data in the storage device.
When the security chip is invalidated, the encryption key held by the security chip is disabled and the security chip is disabled .
Controlling the activation or invalidation of the security chip includes controlling the activation or invalidation by executing a BIOS (Basic Input / Output System).
Information processing device control method. Acquires the location information of the storage device and
Based on the acquired location information, it controls the activation or invalidation of the security chip that holds the encryption key for encrypting and decrypting the data in the storage device.
When the security chip is invalidated, the encryption key held by the security chip is disabled and the security chip is disabled .
Controlling the activation or disabling of the security chip includes switching the activation / disabling setting of the security chip in the chipset connected to the security chip.
A control program for causing an information processing device to execute processing. Acquires the location information of the storage device and
Based on the acquired location information, it controls the activation or invalidation of the security chip that holds the encryption key for encrypting and decrypting the data in the storage device.
When the security chip is invalidated, the encryption key held by the security chip is disabled and the security chip is disabled .
Controlling the activation or disabling of the security chip includes enabling / disabling the port of the security chip connected to the chipset.
A control program for causing an information processing device to execute processing. Acquires the location information of the storage device and
Based on the acquired location information, it controls the activation or invalidation of the security chip that holds the encryption key for encrypting and decrypting the data in the storage device.
When the security chip is invalidated, the encryption key held by the security chip is disabled and the security chip is disabled .
Controlling the activation or invalidation of the security chip includes controlling the activation or invalidation by executing a BIOS (Basic Input / Output System).
A control program for causing an information processing device to execute processing.

Images