JP2009042929A - Information processor and authentication control method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an information processor for achieving authentication based on password input by a remote controller without deteriorating the reliability of security protection. <P>SOLUTION: When password input using a remote controller 2 is performed, a log-on control utility 103 acquires KSV from an HSDP device 3 under connection, and generates a private key from the KSV and the input password. Then, the log-on utility 103 decodes an encrypted password stored in a password database 105 by using the private key, and supplies it to an OS101. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an authentication control technique suitable for application to a personal computer connectable to, for example, a television broadcast receiver having a copyright protection function.

  In recent years, personal computers having functions for receiving and viewing television broadcast program data and playing back AV (Audio and Visual) content stored on a DVD (Digital Versatile Disc) have become widespread. This makes it possible to use video data (including audio) while traveling or on the go, for example, by carrying a notebook-type personal computer that can be driven by a battery.

  Recently, the definition of video has been increased, and personal computers capable of reproducing high-definition image data stored in a recording medium of the HD (High Definition) DVD standard have begun to spread. Since this type of personal computer is generally equipped with a mechanism for outputting high-definition image data externally, for example, at home, it can be played back on the personal computer by connecting to a large-screen high-definition television broadcast receiver. It is also possible to enjoy the high-definition video that has been made with a large-screen high-definition television broadcast receiver.

For example, Patent Document 1 describes that a personal computer connected to a television broadcast receiver is activated using a remote controller for the television broadcast receiver.
JP 2006-333101 A

  By the way, from the viewpoint of security protection, a personal computer generally performs user authentication by inputting a preset password at the time of activation. This password is usually set and entered using a keyboard. Since the keyboard can input various characters such as English letters, symbols, and numbers as user data, a complicated password can be set and input.

  On the other hand, since many remote controllers can input only numbers as user data, compared to a keyboard, only a very simple password can be set and input. Therefore, if a password is set taking into account that the personal computer can be activated using a remote controller (whether it is for a personal computer or another device connected to the personal computer), the security can be protected. Reliability will be significantly reduced.

  The present invention has been made in consideration of such circumstances, and an information processing apparatus and an authentication control method for realizing authentication based on a password input by a remote controller without lowering the reliability of security protection The purpose is to provide.

In order to achieve the above object, an information processing apparatus according to the present invention includes a first key input unit and a second key input unit in which the types of keys that can be input are more limited than those of the first key input unit. And an authentication unit that performs authentication using a password, and when the password is input by the first key input unit, the authentication unit supplies the input password as it is to request authentication. Specific control means, unique information acquisition means for acquiring information unique to the other equipment from other equipment connected via a connector, and unique to the other equipment acquired by the individual information acquisition means The device-specific information encrypted with the first encryption key and the password to be input by the first key input means, the key code to be input by the second input key input means Encrypted password management means for managing a pair of encrypted passwords encrypted with a second encryption key generated from information unique to the other device, and a password input by the second key input means If so, the unique information acquisition means performs acquisition of information unique to the other device connected from the other device via the connector, and the input password and the acquired other device. The second encryption key generated from the information unique to the device is used to pair the encrypted device unique information obtained by encrypting the information unique to the other device with the first encryption key. And a second authentication control unit that decrypts the encrypted password managed by the encrypted password management unit and supplies the decrypted password to the authentication unit to request authentication. The authentication control method according to the present invention performs authentication using a first key input means, a second key input means in which the types of keys that can be input are more limited than those of the first key input means, and a password. An authentication control method for an information processing apparatus having authentication means, wherein a password to be input by the first key input means is externally connected to a key code to be input by the second input key input means. When an encrypted password encrypted with an encryption key generated from information unique to another device is managed and the password is input by the second key input means, the input password is externally connected. The encrypted password to be managed is decrypted with the encryption key generated from the information unique to the other device acquired from the other device, and the decrypted password is sent to the authentication means. To supply a request for authenticating, characterized in that.

  According to the present invention, it is possible to provide an information processing apparatus and an authentication control method that realize authentication based on password input by a remote controller without degrading the reliability of security protection.

  Hereinafter, an embodiment of the present invention will be described with reference to the drawings. FIG. 1 shows one usage mode of the information processing apparatus according to the present embodiment. The information processing apparatus 1 is realized as a notebook personal computer (PC), for example.

  The information processing apparatus 1 can be remotely operated by the remote controller 2. Further, as shown in FIG. 1, here, the information processing apparatus 1 is connected to a high-bandwidth digital content protection system (HDMIP) device 3 such as a television broadcast receiver having a copyright protection function and a high-definition (HDMI). (Multimedia Interface) Assume a case of connecting with cable A. The HDCP device 3 receives a video that requires copyright protection as a high-definition digital signal, that is, the connection partner authenticates its own device so that the connection partner can transmit the digital signal. It has the necessary unique information (KSV: Key Selection Vector). On the other hand, various software (application programs) for reproducing high-definition video is installed in the information processing apparatus 1. Therefore, by connecting the information processing apparatus 1 with the HDMI cable A, it is possible to enjoy high-definition video reproduced by these application programs with the HDCP device 3 having a large screen.

  Now, a user is about to turn on the information processing apparatus 1 using the remote controller 2 in order to view the AV content stored in the recording medium of the information processing apparatus 1 using the HDCP device 3. In the information processing apparatus 1, resource management is performed centrally by an operating system (OS), and a password for logging on to the OS is set.

  FIG. 2 is a diagram illustrating an example of key buttons provided in the remote controller 2. As shown in the figure, the remote controller 2 includes a power button for powering on / off the information processing apparatus 1, a key button for inputting a number, and selecting a desired option due to area limitations, etc. There are only the minimum necessary buttons. Therefore, when logging on to the OS using the remote controller 2, only a very simple password consisting of a combination of numbers can be entered. The information processing apparatus 1 according to the present embodiment provides a mechanism that does not reduce the reliability of security protection even by such a password input by the remote controller 2, and this point will be described in detail below.

  FIG. 3 is a diagram illustrating a configuration of the information processing apparatus 1. As shown in FIG. 3, the information processing apparatus 1 includes a CPU 11, a north bridge 12, a main memory 13, a graphics controller 14, a VRAM 14A, a display 15, a south bridge 16, a BIOS-ROM 17, an HDD 18, a magneto-optical disk drive ( ODD) 19, sound controller 20, speaker 21, embedded controller / keyboard controller (EC / KBC) 22, keyboard 23, touch pad 24, remote control IC 25, network controller 26, HDMI connector 27 and CEC (bidirectional control between devices) A controller 28 and the like are provided.

  The CPU 11 is a processor that controls the operation of each unit in the information processing apparatus 1. The CPU 11 executes an operating system (OS) 101 loaded from the HDD 18 to the main memory 13 and various programs such as utilities and applications that operate under the control of the OS 101. Among the utilities, there are a password registration utility 102 and a logon control utility 103 which will be described later.

  The OS 101 has a function of setting and managing a logon password as a logon permission condition. The same registration key (first encryption key) is given in advance to the password registration utility 102 and the logon control utility 103. The CPU 11 also executes a basic input / output system (BIOS) stored in the BIOS-ROM 17. Hereinafter, the basic input / output system itself stored in the BIOS-ROM 17 may be referred to as the BIOS 17.

  The north bridge 12 is a bridge device that connects the local bus of the CPU 11 and the south bridge 16. The north bridge 12 has a function of executing communication with the graphics controller 14 via a bus, and also includes a memory controller that controls access to the main memory 13. The graphics controller 14 is a display controller that controls the display 15 on the information processing apparatus 1 side. The graphics controller 14 generates a display signal to be sent to the display 15 from the image data written in the VRAM 14A. The graphics controller 14 also has a function of outputting a display signal from the HDMI connector 27 to the outside.

  The south bridge 16 is a controller that controls various devices on the PCI bus and the LPC bus. The south bridge 16 is directly connected to the BIOS-ROM 17, the HDD 18, the ODD 19, and the sound controller 20, and has a function of controlling them. The HDD 18 stores, for example, television broadcast program data and AV content downloaded via the Internet, and the ODD 19 stores, for example, an HD DVD storing AV content. A password database 150 (to be described later) is also built in the HDD 18. The sound controller 20 is a sound source controller that controls the speaker 21. The sound controller 20 also has a function of outputting an audio signal from the HDMI connector 27 to the outside.

  The EC / KBC 22 is a one-chip microcomputer in which an embedded controller for power management and a keyboard controller for controlling the keyboard 23 and the touch pad 24 are integrated. The remote control IC 25 receives infrared rays transmitted from the remote controller 2, encodes them, and transmits them to the EC / KBC 22. The network controller 26 is a communication device that executes communication with an external network such as the Internet.

  The HDMI connector 27 is a terminal provided for detachably connecting the HDMI cable A. The CEC controller 28 executes data transfer control for transmitting and receiving various commands for operation control via the HDMI connector 27 under the control of the EC / KBC 22.

  4 and 5 are diagrams showing functional blocks related to authentication control realized in the information processing apparatus 1 having such a configuration. First, the operation principle at the time of logon of the OS 101 will be described with reference to FIG.

  The logon password managed by the OS 101 is composed of a combination of various characters such as alphabetic characters, symbols, and numerals that can be input with the keyboard 23. When the information processing apparatus 1 is turned on and the OS 101 is activated, the OS 101 requests the user to input the logon password. At this point, the activation of the OS 101 itself has been completed, and the logon control utility 103 that operates under the OS 101 is also activated.

  In response to this request, when the user inputs a password using the keyboard 23, the password is supplied to the OS 101, and the OS 101 verifies its suitability, that is, authenticates the user. On the other hand, when a password is input using the remote controller 2, the password is passed to the logon control utility 103. As described above, the remote controller 2 cannot input alphabetic characters or symbols. Therefore, a simplified password consisting of only numbers (simplified logon password) is input.

  In the password database 150, a logon password encrypted with a private key (second encryption key) is stored in a pair with a KSV encrypted with a fixed key (which serves as a search key). The private key is a key generated from the password to be input from the remote controller 2 and the KSV to be acquired from the HDCP device 3 connected by the HDMI cable A. Any method can be applied to this private key generation rule as long as it can be shared by both the password registration utility 102 and the logon control utility 103. Therefore, the logon control utility 103 first acquires a KSV from the HDCP device 3 connected by the HDMI cable A, and acquires an encrypted logon password from the password database 150 using this KSV and a fixed key.

  If the encrypted logon password can be obtained, the logon control utility 103 then generates a private key using the passed password and KSV, and obtains it from the password database 150 using this private key. Decrypt encrypted password. Then, the logon control utility 103 supplies the decrypted password to the OS 101. If the input password is valid, a correct private key is generated, and the logon password is correctly decrypted and supplied to the OS 101. Further, if an unexpected HDCP device 3 is connected, the process ends in failure when an encrypted logon password is obtained.

  In other words, on the condition that the HDCP device 3 holding device-specific information prepared for copyright protection, called KSV, is connected, and the back for improving the reliability of security protection using this KSV. By performing the ground processing, the information processing apparatus 1 prevents the reliability of the security protection from being lowered with respect to enabling the password input by the remote controller 2 to be accepted. For example, even if the information processing apparatus 1 is taken away by a suspicious person, the suspicious person does not have the predetermined HDCP device 3, so that the (simplified) password input using the remote controller 2 cannot be made successful. .

  Next, the operation principle at the time of registering the password for the remote controller 2 will be described with reference to FIG.

  When registering the password for the remote controller, the user connects the HDCP device 3 to the information processing apparatus 1 via the HDMI cable A, and activates the password registration utility 102 in this state. This operation is performed using the keyboard 23. When activated, the password registration utility 102 obtains KSV from the HDCP device 3 connected by the HDMI cable A, and requests the remote controller 2 to input a password to be registered.

  In addition, since the password registration utility 102 is logged on to the OS 101 with any user name when the password registration utility 102 is activated, the password registration utility 102 acquires the logon password of the user from the OS 101. Then, the password registration utility 102 generates a private key from the password input by the remote controller 2 and the KSV, encrypts the logon password using this private key, and uses this encrypted logon password as the (search key). It is stored in the password database 150 in a pair with the KSV encrypted with the fixed key.

  FIG. 6 is a diagram illustrating a configuration example of the password database 150. In the figure, the encrypted KSV is a KSV acquired from a predetermined HDCP device 3 and encrypted with a fixed key, and the encrypted password is registered with the KSV acquired from the predetermined HDCP device 3 (simplification). Logon password encrypted with a private key generated from the password. The same “UserA” exists in the user name field because “UserA” uses two HDCP devices 3 exclusively and selectively. In such a case, the password registered for the remote controller 2 may be the same or different. In addition, the first level “UserA” and the third level “UserB” have the same encrypted KSV value, but different encrypted passwords. This is because, although the same HDCP device 3 is used, the logon password is different in the first place, or the logon password is the same value, but the password for the remote controller 2 is different.

  Thus, since the KSV and the logon password are encrypted with the fixed key and the private key and stored in the password database 150, the reliability of the security protection is ensured also in this respect.

  Next, an operation procedure of authentication control unique to the information processing apparatus 1 of the present embodiment will be described with reference to FIGS. FIG. 7 is a flowchart showing an operation procedure of the password registration utility 102.

  The password registration utility 102 receives a password input from the remote controller 2 (step A1), and acquires a KSV from the connected HDCP device 3 (step A2). Further, the password registration utility 102 acquires a logon password from the OS 101 (step A3).

  Next, the password registration utility 102 generates a private key from the input password and the KSV (step A4), and encrypts the logon password using this private key (step A5). The password registration utility 102 also encrypts KSV using a fixed key (step A6).

  The password registration utility 102 stores the encrypted KSV and logon password in the password database 150 as a set of data (step A7).

  On the other hand, FIG. 8 is a flowchart showing an operation procedure of the logon control utility 103.

  The logon control utility 103 accepts user name selection and password input from the remote controller (step B1), and acquires KSV from the connected HDCP device 3 (step B2). Subsequently, the logon control utility 103 generates a private key from the input password and the KSV (step B3), and uses the selected user name and the acquired KSV as a search key and the target encrypted logon password as the password database 150. (Step B4).

  The logon control utility 103 decrypts the logon password using the generated private key (step B5), and supplies the decrypted logon password to the OS 101 (step B6).

  As described above, according to the information processing apparatus 1 of the present embodiment, it is possible to perform authentication based on the password input by the remote controller 2 without reducing the reliability of security protection.

  Note that the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. In addition, various inventions can be formed by appropriately combining a plurality of components disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, constituent elements over different embodiments may be appropriately combined.

The figure which shows one use aspect of the information processing apparatus (personal computer) which concerns on one Embodiment of this invention FIG. 3 is a diagram illustrating an example of a key button provided in a remote controller attached to the information processing apparatus of the embodiment. The figure which shows the structure of the information processing apparatus of the embodiment Functional block diagram for explaining the operating principle at the time of logon of the operating system in the information processing apparatus of the embodiment Functional block diagram for explaining the operating principle when registering a password for a remote controller in the information processing apparatus of the embodiment The figure which shows the example of 1 structure of the password database constructed | assembled in the information processing apparatus of the embodiment The flowchart which shows the operation | movement procedure of the password registration utility performed on the information processing apparatus of the embodiment A flowchart showing an operation procedure of a logon control utility executed on the information processing apparatus of the embodiment

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Information processing apparatus (personal computer), 2 ... Remote controller, 3 ... HDCP device (television broadcast receiver), 11 ... CPU, 12 ... North bridge, 13 ... Main memory, 14 ... Graphics controller, 14A ... VRAM 15 ... Display, 16 ... South Bridge, 17 ... BIOS-ROM, 18 ... HDD, 19 ... Magneto-optical disk drive (ODD), 20 ... Sound controller, 21 ... Speaker, 22 ... Embedded controller / keyboard controller (EC / KBC), 23 ... keyboard, 24 ... touch pad, 25 ... remote control IC, 26 ... network controller, 27 ... HDMI connector, 28 ... CEC controller, 101 ... operating system (OS), 102 ... password De-registration utility, 103 ... log-on control utility, A ... HDMI cable.

Claims (4)

First key input means;
Second key input means in which the types of keys that can be input are more limited than those of the first key input means;
An authentication means for performing authentication using a password;
A first authentication control unit that, when a password is input by the first key input unit, supplies the input password as it is to the authentication unit and requests authentication;
Specific information acquisition means for acquiring information specific to the other device from another device connected via the connector,
Encrypted device unique information obtained by encrypting information unique to the other device obtained by the individual information obtaining unit with a first encryption key, and a password to be input by the first key input unit, An encrypted password for managing a pair of an encrypted password encrypted with a second encryption key generated from a key code to be input by the second input key input means and information unique to the other device Management means;
When the password is input by the second key input unit, the specific information acquisition unit acquires information specific to the other device from another device connected through the connector, and the input A cipher in which information unique to the other device is encrypted with the first encryption key using the second encryption key generated from the acquired password and the information unique to the acquired other device A second authentication control unit that decrypts the encrypted password managed by the encrypted password management unit in a pair with the authentication device unique information, and supplies the decrypted password to the authentication unit to request authentication When,
An information processing apparatus comprising: The first key input means detects a key press on the keyboard,
The second key input means receives infrared rays from a remote controller;
The information processing apparatus according to claim 1, wherein the information processing apparatus is a device.   2. The connector is for detachably connecting an HDMI (High-Definition-Multimedia Interface) cable, and the information unique to the other device is a KSV (Key Selection Vector). The information processing apparatus described. An information processing apparatus comprising: first key input means; second key input means in which types of keys that can be input are more limited than those of the first key input means; and authentication means that performs authentication using a password. Authentication control method,
The password to be input by the first key input means is an encryption key generated from the key code to be input by the second input key input means and information unique to the externally connected device. Manage encrypted passwords,
When a password is input by the second key input means, the management is performed using the encryption key generated from the input password and information unique to the other device acquired from the externally connected device. Decrypting the encrypted password, and requesting authentication by supplying the decrypted password to the authenticating means;
An authentication control method characterized by the above.

Images