JP2013073418A - Extension device, information processor, information processing system and security processing method for information processing system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an extension device in which a security module can be mounted so as to be attached and detached.SOLUTION: A port replicator 2 includes: one or more types of port replicator side ports 26 to 29; a connector 21; and a port replicator side mounting part 20. The connector 21 configured as a connector which can be connected to one or more types of computer side ports installed in a personal computer 1 connects the computer side port with the port replicator side ports 26 to 29. A security module 3 can be mounted so as to be attached and detached by the port replicator side mounting part 20.

Description

  The present invention relates to an expansion device, an information processing device, an information processing system, and a security processing method for the information processing system.

  A notebook personal computer may be used connected to a port replicator. The port replicator extends the connection function of the notebook personal computer by including various connection ports that are included or not included in the notebook personal computer. As a result, it is possible to use the notebook personal computer as if it is a stationary computer, and it is possible to improve portability by omitting connection ports that are not frequently used from the notebook personal computer.

  A housing portion that can slide into and out of the cradle portion, includes the storage device, and has a hollow space for providing an electrical signal connection of the storage device; and within the housing portion A bridge portion capable of converting a first interface into a second interface and capable of performing a data encryption / decryption function, wherein the first interface is connected to the second interface and a signal. Encrypted removable storage systems have been proposed that differ by type or physical connection type.

  In addition, the billing data, which is information necessary for calculating the billing amount related to the use of the service, is measured at the user terminal, and the billing data measured at the user terminal is transmitted to the service provider server using the Internet. It has been proposed that the server collects the billing data transmitted by the user terminal, and updates the data of the corresponding user terminal in the billing database of the server based on the billing data received by the server from the user terminal.

Utility Model Registration No. 114799 JP-A-10-190737

  The notebook personal computer is equipped with a security module such as TPM (Trusted Platform Module) as a security measure. In this case, the data downloaded from the server by the notebook personal computer is encrypted and protected.

  However, the security module is fixedly mounted on the notebook personal computer. In this case, the port replicator is completely independent of the security module implementation. Thus, for example, the security module cannot be removed from the notebook personal computer and stored separately. In other words, the encryption key for reading the encrypted data exists together with the encrypted data.

  For this reason, when a malicious third party steals a laptop personal computer, the security module is also stolen even if the third party has no knowledge of the necessity of the security module. As a result, since the encryption key exists together with the encrypted data, a third party can read the encrypted data.

  An object of this invention is to provide the expansion apparatus which can mount a security module so that attachment or detachment is possible.

  The disclosed expansion device includes one or more types of expansion device side ports, a connector, and an expansion device side mounting unit. The connector is a connector that can be connected to one or more types of information processing apparatus side ports provided in the information processing apparatus, and connects between the information processing apparatus side port and the expansion apparatus side port. The expansion device side mounting unit can detachably mount the security module. When the security module is mounted on the expansion device side mounting part, the connector is between the port that can connect the security module in the expansion device side port and the connection port of the security module in the information processing device side port. Connect.

  According to the disclosed expansion device, it is possible to detachably mount a security module on which a security chip is mounted.

It is a figure which shows an example of the outline of an information processing system. It is a figure which shows an example of a personal computer. It is a figure which shows an example of a personal computer. It is explanatory drawing which shows an example of a port replicator. It is explanatory drawing of a port replicator and a personal computer. It is a figure which shows an example of a security module. It is explanatory drawing of a port replicator and a security module. It is explanatory drawing of a port replicator and a security module. It is explanatory drawing of a security module and a personal computer. It is a security processing flow. It is explanatory drawing of a security process. It is a figure which shows another example of a port replicator. And FIG. 16 is a diagram illustrating another example of a personal computer. It is explanatory drawing of the port replicator of FIG. 12, and the personal computer of FIG.

  The inventor considered implementing a security module in the port replicator in order to avoid the presence of an encryption key for reading encrypted data together with the encrypted data.

  If the security module is mounted on the port replicator, it is possible to prevent the security module from being stolen together even if a third party steals the notebook personal computer. Therefore, it can be avoided that the encryption key exists together with the encrypted data, and reading of the data encrypted by a third party can be prevented.

  On the other hand, if the security module is fixedly mounted on the port replicator, even a legitimate user can effectively remove the notebook personal computer from the port replicator and use it. In other words, the notebook personal computer removed from the port replicator does not have a security module and therefore cannot decrypt the encrypted data. This loses the original meaning of using a notebook personal computer connected to a port replicator. Therefore, it is conceivable to remove the security module from the port replicator and mount it on a notebook personal computer.

  The disclosed expansion device makes it possible to detachably mount a security module on which a security chip is mounted.

  FIG. 1 is a diagram illustrating an example of an outline of an information processing system.

  The information processing system includes a personal computer (PC) 1 and a port replicator (PR) 2 as shown in FIG. This is, for example, a case where the portable type, in other words, the notebook type personal computer 1 is used as a stationary computer by connecting to the port replicator 2.

  In the case of FIG. 1A, the security module 3 is mounted on the port replicator 2. The security module 3 is fixed at a predetermined position by the security wire 4 together with the port replicator 2. The predetermined position is, for example, a desk on which the port replicator 2 is installed. Thereby, the port replicator 2 and the security module 3 can be prevented from being stolen.

  The port replicator 2 includes a connector 21. The connector 21 may be any connector that connects the personal computer 1 and the port replicator 2. For example, the connector 21 may be provided in the personal computer 1.

  Further, the information processing system includes a personal computer 1 and does not include a port replicator 2 as shown in FIG. This is the case where, for example, the portable type, in other words, the notebook type personal computer 1 is carried and used at the destination.

  In the case of FIG. 1B, the security module 3 is mounted on the personal computer 1. Even in this case, the security module 3 may be fixed at a predetermined position by the security wire 4 together with the personal computer 1. The predetermined position is, for example, a desk on which the personal computer 1 is installed. Thereby, the personal computer 1 and the security module 3 can be prevented from being stolen.

  Alternatively, the security module 3 may be fixed to the personal computer 1 by the security wire 4. Thereby, it is possible to prevent the security module 3 from being separated from the personal computer 1 and meeting theft.

  2 and 3 are diagrams illustrating an example of a personal computer.

  As described above, the personal computer 1 is a portable type, for example, a notebook type personal computer. The personal computer 1 is used by being connected to a port replicator 2 as shown in FIG. Alternatively, as shown in FIG. 1B, the personal computer 1 is detached from the port replicator 2 and used alone.

  FIG. 2 shows a state where the personal computer 1 is not connected to the port replicator 2 and the security module 3 is not connected. FIG. 3 shows a state where the personal computer 1 is detached from the port replicator 2, is connected to the security module 3, and is used alone, in other words, the state of FIG.

  The personal computer 1 is not limited to a portable or notebook computer. The personal computer 1 may be any computer that can be connected to the port replicator 2 and used.

  The personal computer 1 includes a computer side mounting unit 10, a CPU (Central Processing Unit) 11, a PCH (Platform Controller Hub) 12, a super I / O 13, a LAN control unit (LAN) 14, and a VGA (Video Graphics Array). 15, a serial port 16, a parallel port 17, a LAN port 18, and a CRT port 19.

  The personal computer 1 includes a port 116 to a port 119. The ports 116 to 119 are used for connection with the port replicator 2. The ports 116 to 119 are referred to as computer side ports.

  Specifically, the port 116 is a port corresponding to the serial port 16, is connected to the port 226 of the port replicator 2, and is connected to the serial port 26 of the port replicator 2 via the port 226. The port 117 corresponds to the parallel port 17 and is connected to the parallel port 27 of the port replicator 2 via the port 227 of the port replicator 2. The port 118 corresponds to the LAN port 18 and is connected to the LAN port 28 of the port replicator 2 via the port 228 of the port replicator 2. The port 119 corresponds to the CRT port 19 and is connected to the CRT port 29 of the port replicator 2 via the port 229 of the port replicator 2.

  The personal computer 1 includes security ports 111 and 111A. The security port 111 is used for connection with the port replicator 2. Specifically, the security port 111 is connected to the port replicator port 221, and is connected to the port replicator 2 security port 221 </ b> A via the port 221. The security port 111 is also called a computer side port. The security port is a port to which the security module 3 can be connected.

  The security port 111 </ b> A is used for connection with the security module 3 when the security module 3 is directly connected to the personal computer 1. Therefore, the security port 111 </ b> A is provided inside the computer side mounting unit 10.

  The computer side mounting unit 10 can detachably mount the security module 3. As will be described later with reference to FIG. 9, the computer-side mounting unit 10 is a depressed part in which the security module 3 can be fitted.

  In FIG. 2, the security module 3 is not fitted into the computer-side mounting unit 10 and is not connected. In FIG. 3, the security module 3 is fitted and connected to the computer side mounting unit 10.

  The personal computer 1 includes one or more types of computer-side ports 111 and 116 to 119 that can be connected to the port replicator 2. The computer-side ports 111 and 116 to 119 are connection ports provided at positions different from the computer-side mounting unit 10. The computer-side ports 111 and 116 to 119 are provided on one side of the casing of the personal computer 1 for connection with the connector 21 of the port replicator 2.

  The computer-side port 111 is a connection port connected to the security module 3 via the port replicator 2 when the security module 3 is mounted on the port replicator 2. Thereby, the personal computer 1 can be connected to the security module 3. When the personal computer 1 is connected to the port replicator 2, the computer-side ports 116 to 119 connect the personal computer 1 via the port replicator 2 to the serial port 26, the parallel port 27, the LAN port 28, and the port replicator 2. Connect to CRT port 29. The personal computer 1 may not include the serial port 16, the parallel port 17, the LAN port 18, and the CRT port 19. Thereby, the function of the personal computer 1 can be expanded.

  In FIG. 3, since the security module 3 is fitted in the personal computer 1, the computer-side ports 111 and 116 to 119 are not used. Therefore, in FIG. 3, the wires connected to the ports 111 </ b> A and 16 to 19 are indicated by solid lines, and the wires connected to the computer-side ports 111 and 116 to 119 are indicated by dotted lines. FIG. 2 is displayed in conformity with FIG. 3 for convenience.

  The CPU 11 is connected to the PCH 12, requests the PCH 12 to control processing by the security module 3, requests control of processing by the super I / O 13, and requests control of communication processing by the LAN control unit 14. The CPU 11 connects to the VGA 15 and requests control of processing by the VGA 15.

  The PCH 12 is a system controller, for example. The PCH 12 is connected to the security module 3 and controls processing by the security module 3 in accordance with a request from the CPU 11. The PCH 12 is connected to the super I / O 13 and controls processing by the super I / O 13 in accordance with a request from the CPU 11. The PCH 12 is connected to the LAN control unit 14 and controls communication processing by the LAN control unit 14 in accordance with a request from the CPU 11.

  The super I / O 13 is, for example, a peripheral device controller. The super I / O 13 transmits / receives a serial signal via the serial port 16 or the port 116 under the control of the PCH 12. The super I / O 13 transmits and receives parallel signals via the parallel port 17 or the port 117 according to the control of the PCH 12.

  The LAN control unit 14 is a network controller, for example. The LAN control unit 14 is connected to the LAN via the LAN port 18 or the port 118 according to the control of the PCH 12, and performs communication via the LAN.

  The VGA 15 is a graphic controller, for example. The VGA 15 outputs a video signal via the CRT port 19 or the port 119 in accordance with a request from the CPU 11.

  Here, the security module 3 will be described.

  The security module 3 is a security module such as a TPM (Trusted Platform Module). The security module 3 executes, for example, configuration information collection processing, falsification monitoring processing, encryption processing, and encryption key protection processing. The configuration information collection process is a process of collecting hardware configuration information and software configuration information of the personal computer 1. The tampering monitoring process is a process for monitoring whether the hardware or software of the information processing system has been tampered with. The encryption processing is data encryption and decryption processing. The encryption key protection process is a process for protecting the encryption key.

  The security module 3 acquires the configuration information of the personal computer 1 from the BIOS of the personal computer 1 at the first startup of the personal computer 1 in the configuration information collection process, and stores the acquired configuration information in the internal nonvolatile memory. To do. The configuration information includes hardware configuration information and software configuration information.

  In the falsification monitoring process, the security module 3 collects the configuration information of the personal computer 1 each time the personal computer 1 is activated, and compares the collected configuration information with the configuration information stored in the nonvolatile memory. If there is a difference between the two, the security module 3 determines that the configuration of the personal computer 1 has been illegally changed, and stops the activation of the personal computer 1.

  In the encryption process, the security module 3 stores the encrypted data in the hard disk by encrypting the data when the data is downloaded from the server, for example.

  The port replicator 2 includes only a connection port and a connection line connected to the connection port, and does not include an active circuit. Therefore, the port replicator 2 is an apparatus that has nothing to do with the security module 3 that executes configuration information collection processing, falsification monitoring processing, encryption processing, and encryption key protection processing. By connecting the security module 3 to such a port replicator 2, it is possible to prevent the security module 3 from being stolen together with the personal computer 2.

  Even if the security module 3 is detached from the personal computer 1 and connected to the port replicator 2, the hardware configuration information of the personal computer 1 is not changed. Even if the security module 3 is detached from the port replicator 2 and connected to the personal computer 1, the hardware configuration information of the personal computer 1 is not changed. This is because the port replicator 2 does not include an active circuit, so that even if the security module 3 is attached or detached, the hardware mounted on the board 110, in other words, the configuration of the active circuit of the personal computer 1 is not changed. . In other words, since the security module 3 is separated from the board 110 that is the motherboard of the personal computer 1, the hardware configuration information of the personal computer 1 is not changed. The substrate 110 will be described later.

  As will be described later, when the port replicator 2 is mounted with various drives such as a CD-ROM drive or an active circuit such as an expansion slot, the security module 3 is provided in the port replicator 2. The configuration information of the active circuit is invalidated. For example, the security module 3 does not collect the configuration information of the active circuit of the port replicator 2 or discards it after collecting the configuration information of the active circuit of the port replicator 2. Thereby, it is possible to prevent the configuration information from being changed even when the security module 3 is attached or detached.

  FIG. 4 is an explanatory diagram illustrating an example of a port replicator.

  As shown in FIG. 4A, the port replicator 2 is an expansion device that is used by being connected to the personal computer 1 and expands the interface of the personal computer. The port replicator 2 is usually placed on a desk. As will be described later, the port replicator 2 includes various types of connection ports, but cannot operate as an I / O device by itself. The personal computer 1 can be detached from the port replicator 2.

  The port replicator 2 includes a port replicator side mounting unit 20, a connector 21, a serial port 26, a parallel port 27, a LAN port 28, and a CRT port 29.

  The port replicator 2 includes a port 226 to a port 229. Ports 226 to 229 are used for connection with the personal computer 1. Ports 226 to 229 are referred to as port replicator side ports.

  Specifically, the port 226 is a port connected to the serial port 26 and is connected to the port 116 of the personal computer 1 as described above. The port 227 is a port connected to the parallel port 27 and is connected to the port 117 of the personal computer 1 as described above. The port 228 is a port connected to the LAN port 28 and is connected to the port 118 of the personal computer 1 as described above. The port 229 is a port connected to the CRT port 29 and is connected to the port 119 of the personal computer 1 as described above.

  The port replicator 2 includes security ports 221 and 221A. The security port 221 is used for connection with the personal computer 1. Specifically, the security port 221 is connected to the port 111 of the personal computer 1 as described above. The security port 221 is also referred to as a port replicator side port.

  The security port 221 </ b> A is used for connection with the security module 3 when the security module 3 is connected to the port replicator 2. Accordingly, the security port 221A is provided inside the port replicator side mounting unit 20.

  The port replicator-side mounting unit 20 can detachably mount the security module 3 that can be detachably mounted on the personal computer 1 connected to the port replicator 2. The port replicator side mounting part 20 is a depressed part into which the security module 3 can be fitted, as will be described later with reference to FIG.

  In FIG. 4A, the security module 3 is not fitted into the port replicator side mounting unit 20 and is not connected. In FIG. 4B, the security module 3 is fitted and connected to the port replicator side mounting unit 20.

  The port replicator 2 includes one or more types of port replicator side ports 221 and 226 to 229 that can be connected to the personal computer 1. The port replicator side ports 221 and 226 to 229 are connection ports provided at positions different from the port replicator side mounting unit 20.

  The port replicator side port 221 is a connection port for connecting the personal computer 1 to the security module 3 when the security module 3 is mounted on the port replicator 2. The port replicator side ports 226 to 229 connect the personal computer 1 to the serial port 26, parallel port 27, LAN port 28, and CRT port 29 of the port replicator 2 when the personal computer 1 is connected to the port replicator 2. .

  As described above, the connector 21 can be connected to one or more types of computer-side ports 111 and 116 to 119 provided in the personal computer 1, and the computer-side ports 111 and 116 to 119 and the port replicator-side port are connected. 221 and 226 to 229 are connected. The connector 21 connects between the security port 221 of the port replicator 2 and the security port 111 of the personal computer 1 as described above when the security module 3 is mounted on the port replicator-side mounting unit 20.

  The port replicator 2 may include a USB port, a PS / 2 port, and the like. Further, the port replicator 2 may include a type of port that the personal computer 1 does not include. Further, instead of the port replicator 2, a docking station including various drives such as a CD-ROM drive or an expansion slot may be used.

  In the case where the security module 3 is fixedly provided on the board of the port replicator 2, when the personal computer 1 is removed from the port replicator 2, the personal computer 1 does not have the security module 3. For this reason, when the personal computer 1 is detached from the port replicator 2 and used outside, the encrypted data cannot be decrypted. Therefore, even a legitimate user is inconvenient because the personal computer 1 cannot be removed from the port replicator 2 and used outside.

  FIG. 5 is an explanatory diagram of a port replicator and a personal computer.

  As shown in FIG. 5, the personal computer 1 is used by being connected to a port replicator 2 to which a security module 3 is connected. The state of FIG. 5 is equal to the state of FIG. 5 includes the port replicator 2, the personal computer 1 connected to the port replicator 2, and the security module 3 detachably mounted on the port replicator 2.

  In FIG. 5, the security module 3 is mounted on the port replicator side mounting unit 20 of the port replicator 2. On the other hand, the security module 3 is not mounted on the computer side mounting unit 10 of the personal computer 1.

  In FIG. 5, since the security module 3 is fitted in the port replicator 2, the ports 111A and 16 to 19 are not used. Therefore, in FIG. 5, the wirings connected to the computer-side ports 111 and 116 to 119 in FIG.

  For example, the personal computer 1 transmits data to the security module 3 via the port replicator 2. The security module 3 generates encrypted data by encrypting the received data, and transmits the generated encrypted data to the personal computer 1 via the port replicator 2. The personal computer 1 stores the received encrypted data in a storage device. Thereby, even when the personal computer 1 is stolen, the security module 3 is left in the port replicator 2, so that security can be maintained.

  As shown in FIG. 3, when the personal computer 1 is detached from the port replicator 2 and the security module 3 is connected, the personal computer 1 transmits data to the security module 3. The security module 3 generates encrypted data by encrypting the received data, and transmits the generated encrypted data to the personal computer 1. The personal computer 1 stores the received encrypted data in a storage device.

  FIG. 6 is a diagram illustrating an example of a security module.

  The security module 3 includes one or a plurality of security chips and is an independent portable module. The security chip is mounted on a substrate different from the substrate 110 on which at least the CPU 11 of the personal computer 1 is mounted, in other words, a substrate separated from the substrate 110. The substrate 110 is a PCB, for example, and is a motherboard of the personal computer 1. The board on which the security chip is mounted is, for example, a PCB, which is a security board.

  The security module 3 includes a housing 301, a connector 302, and a reinforcing plate 303. The reinforcing plate 303 is provided with a through hole 304 for allowing the security wire 4 to pass therethrough. When focusing on the physical shape of the security module 3, the security module 3 is also referred to as a security module 300.

  The housing 301 includes a security board and one or a plurality of security chips. The security chip is connected to the connector 302. The housing 301 has, for example, a rectangular parallelepiped shape. The shape of the housing 301 is not limited to a rectangular parallelepiped, and may be various shapes such as a cube.

  The connector 302 is connected to the security port 111 </ b> A of the personal computer 1 when the security module 300 is mounted on the computer side mounting unit 10. The connector 302 is connected to the security port 221 </ b> A of the port replicator 2 when the security module 300 is mounted on the port replicator side mounting unit 20.

  The reinforcing plate 303 is, for example, a plate-like metal. Thereby, the security module 3 can be securely fixed to the personal computer 1 or the port replicator 2.

  FIG. 7 is an explanatory diagram of the port replicator and the security module.

  In the port replicator 2, the port replicator side mounting portion 20 is formed on the back surface of the casing 200 of the port replicator 2, for example, as shown in FIG. When focusing on the physical shape of the port replicator-side mounting unit 20, the port replicator-side mounting unit 20 is also referred to as a port replicator-side mounting unit 203. The back surface of the port replicator 2 is a surface that cannot be seen by the user when the personal computer 1 is connected to the port replicator 2, in other words, a surface that is the back surface of the personal computer 1.

  A fitting region 204 for fitting a part of the plate-shaped reinforcing plate 303 is formed in a region adjacent to the port replicator side mounting portion 203 on the back surface of the port replicator 2. The fitting region 204 is provided with a through hole 205 for allowing the security wire 4 to pass therethrough.

  As shown in FIG. 7B, the security module 300 is fitted into the port replicator side mounting unit 203. As a result, the connector 302 of the security module 300 is connected to the security port 221A of the port replicator 2. In FIG. 7B, illustration of the security wire 4 is omitted.

  FIG. 8 is an explanatory diagram of the port replicator and the security module.

  FIG. 8A shows the port replicator 2 in the state of FIG. 7B in a plane parallel to the upper and lower surfaces of the port replicator 2 in the center of the security module 300, in other words, the cutting line 8A-8A. The outline of the cross section cut | disconnected by the surface to include is shown. As shown in FIG. 8A, the security module 300 is fitted into the port replicator-side mounting unit 203. At this time, the security module 300 is fixed to a predetermined position, for example, a desk by the security wire 4 together with the port replicator 2.

  FIG. 8B shows an outline of a cross section of the port replicator 2 in the state of FIG. 7A taken along a plane perpendicular to the back surface of the port replicator 2 at the center of the port replicator side mounting portion 203. FIG. 8B is a schematic cross-sectional view of the port replicator 2 in a state where the security module 300 is removed from FIG. 8A, taken along a plane including the cutting line 8B-8B. On the back surface of the port replicator 2, an operation area 206 for operation is provided in an area adjacent to the port replicator side mounting unit 203. The operation area 206 is an area where the user inserts a finger to facilitate attachment / detachment when attaching / detaching the security module 300 to / from the port replicator-side mounting unit 203. The operation area 206 is not shown in FIGS. 7A, 7B, and 8.

  FIG. 9 is an explanatory diagram of a security module and a personal computer.

  In the personal computer 1, the computer side mounting unit 10 is formed on the side surface of the lower housing 101 of the personal computer 1, for example, as shown in FIG. 9. The lower housing 101 constitutes the housing 100 together with the upper housing 102. The lower housing 101 is a housing provided with a keyboard, for example, and the upper housing 102 is a housing provided with a liquid crystal display device, for example. When paying attention to the physical shape of the computer side mounting unit 10, the computer side mounting unit 10 is also referred to as a computer side mounting unit 103. The side surface of the personal computer 1 is a surface that becomes the left surface or the right surface when viewed from the user when the user operates the personal computer 1.

  A fitting region 104 for fitting a part of the plate-shaped reinforcing plate 303 is formed in a region adjacent to the computer-side mounting portion 103 on the back surface of the personal computer 1. The fitting region 104 is provided with a through hole 105 for allowing the security wire 4 to pass therethrough.

  The security module 300 is fitted into the computer side mounting unit 103. As a result, the connector 302 of the security module 300 is connected to the security port 111A of the personal computer 1. At this time, the security module 300 is fixed together with the personal computer 1 by a security wire 4 at a predetermined position, for example, a desk.

  FIG. 10 is a security processing flow. FIG. 11 is an explanatory diagram of security processing.

  When the user turns on the personal computer 1 (step S11), the BIOS is executed on the CPU 11 of the personal computer 1. In the startup process of the personal computer 1, the BIOS determines whether the security module 3 such as TPM is connected, in other words, whether or not the security module 3 such as TPM is present in the information processing system (Step S1). S12).

  Note that the BIOS may authenticate with the BIOS password prior to determining whether or not the security module 3 is present in step S12.

  If the security module 3 is connected, in other words, if the security module 3 is present in the information processing system, the security module 3 checks the hardware configuration of the information processing system in accordance with a request from the BIOS (step S13). ). For example, the security module 3 compares the configuration information indicating the hardware configuration of the security module 3 with the hardware configuration information collected from the personal computer 1 by the security module 3. At this time, since the security module 3 ignores the hardware configuration of the port replicator 2, only the hardware configuration of the personal computer 1 is actually checked.

  If there is no problem in the hardware configuration, the security module 3 notifies the BIOS that there is no problem in the hardware configuration. When the BIOS receives a notification that there is no problem in the hardware configuration, the BIOS accesses the hard disk (step S14), reads out and executes a necessary control program, and starts the personal computer 1 (step S15). . The case where there is no problem in the hardware configuration is, for example, a case where the hardware configuration is not changed.

  In step S12, if the security module 3 is not connected, in other words, if there is no security module 3 in the information processing system, the BIOS stops the startup process of the personal computer 1 (step S16), and the personal computer 1 Is turned off (step S17).

  If there is a problem with the hardware configuration in step S13, steps S16 and S17 are executed. The case where there is a problem in the hardware configuration is, for example, a case where the hardware configuration has been changed, for example, when the hard disk has been replaced, or a security module 3 not belonging to the personal computer 1 is connected. This is the case. In these cases, there is a problem in the hardware configuration because the configuration information indicating the hardware configuration of the security module 3 is different from the hardware configuration information collected from the personal computer 1 by the security module 3.

  For example, when the port replicator 2 is connected and the security module 3 is included in the information processing system, steps S14 and S15 are executed after the execution of step S13. This is a case where the personal computer 1 is connected to the port replicator 2 and the security module 3 is connected to the port replicator 2. This corresponds to the case of FIG.

  On the other hand, when the port replicator 2 is connected and there is no security module 3 in the information processing system, steps S16 and S17 are executed after the execution of step S12. This is a case where the personal computer 1 is connected to the port replicator 2 and the security module 3 is not connected to the port replicator 2. This is the case, for example, when the user has not connected the security module 3 to the port replicator 2.

  Further, when the port replicator 2 is not connected and the information processing system has the security module 3, steps S14 and S15 are executed after the execution of step S13. This is a case where the personal computer 1 is removed from the port replicator 2 and not connected, and the security module 3 is connected to the personal computer 1. This corresponds to the case of FIG.

  Further, when the port replicator 2 is not connected and there is no security module 3 in the information processing system, steps S14 and S15 are executed after the execution of step S13. This is the case, for example, when the user has not connected the security module 3 to the personal computer 1.

  Further, when the hardware configuration is changed, steps S16 and S17 are executed after the execution of step S13.

  FIG. 11 is an explanatory diagram of security processing.

  The data 6 existing on the server is downloaded to the personal computer 1 via the LAN as shown in FIG. Since the personal computer 1 is connected to the port replicator 2, the downloaded data 6 is transmitted from the personal computer 1 to the security module 3 of the port replicator 2 and encrypted. The encrypted data 6A is stored in a storage device such as a hard disk of the personal computer 1.

  Thereafter, the personal computer 1 is removed from the port replicator 2. In this state, the personal computer 1 stores the encrypted data 6A, but does not have the security module 3. Therefore, in this state, it is not possible to execute processing such as browsing the encrypted data 6A outside.

  As a result, even if the personal computer 1 is damaged such as theft, the personal computer 1 is not connected to the security module 3, so that the security can be maintained because the personal computer 1 cannot be started. Even if only the storage device such as the hard disk of the personal computer 1 is stolen, since the security module 3 is not provided, the encrypted data 6A is illegally viewed even if the encrypted data 6A is stored. There is no.

  Therefore, a legitimate user removes the security module 3 from the port replicator 2 and connects to the personal computer 1 as shown in FIG. Thereby, since the personal computer 1 has the security module 3, processing such as taking the personal computer 1 outside and browsing the encrypted data 6A outside can be executed.

  Thereafter, the security module 3 is removed from the personal computer 1 and connected to the port replicator 2 as shown in FIG. 11B, and the personal computer 1 is connected to the port replicator 2. Thereby, since the personal computer 1 can use the security module 3 of the port replicator 2, it can process the encrypted data 6A.

  12 to 14 are diagrams illustrating another example of the port replicator and another example of the personal computer.

  As shown in FIG. 1A, when using the personal computer 1 to which the security module 3 is connected, the user may forget to remove the security module 3 from the personal computer 1. Then, there is a possibility that the personal computer 1 to which the security module 3 is connected is connected to the port replicator 2 again. In this case, when the personal computer 1 is stolen together with the security module 3, the internal encrypted data is restored and viewed.

  Therefore, in the example of FIGS. 12 to 14, the personal computer 1 to which the security module 3 is connected cannot be reconnected to the port replicator 2. As a result, the user removes the security module 3 from the personal computer 1 and connects it to the port replicator 2. Thereby, the security module 3 can be fixed to the port replicator 2 by the security wire, in other words, can be locked.

  FIG. 12 is a diagram illustrating another example of the port replicator.

  The port replicator 2 includes a housing 200, a connector 201, and a security protrusion 202.

  For example, as shown in FIG. 12, the housing 200 is provided with a protrusion for positioning the personal computer 1 on the entire upper surface on the back surface side. Thereby, the personal computer 1 can be easily placed at a predetermined position of the port replicator 2. In other words, the connection portion of the personal computer 1 can be easily connected to the connector 201 of the port replicator 2.

  As shown in FIG. 12, the connector 201 is provided on the upper surface of the port replicator 2, substantially at the center on the surface to which the personal computer 1 is connected. Thus, if the personal computer 1 is mounted on the upper surface of the port replicator 2, the two can be connected to each other.

  The connector 201 may be provided on the surface to which the personal computer 1 is connected. For example, the connector 201 may be provided on a surface other than the upper surface of the port replicator 2. Further, the connector 201 may be provided in a portion other than the center on the surface to which the personal computer 1 is connected.

  The security protruding portion 202 has a shape that can be fitted into the computer-side mounting portion 10 where the security module 3 can be detachably mounted. For example, as shown in FIG. 6, since the security module 3 has a substantially rectangular parallelepiped shape, the security protrusion 202 also has a substantially rectangular parallelepiped shape. Accordingly, the security protrusion 202 is, for example, a protrusion having a substantially rectangular parallelepiped shape.

  The security protrusion 202 is provided on a facing surface that is a surface facing any surface of the housing of the personal computer 1. As shown in FIG. 12, the facing surface is an upper surface of the port replicator 2 and is a surface to which the personal computer 1 is connected. As shown in FIG. 12, the security protrusion 202 is provided on the opposite surface so as to be in contact with the right side of the opposite surface. The security protrusion 202 may be provided on the facing surface so as to be in contact with the left side of the facing surface.

  On the other hand, as described above, the port replicator-side mounting unit 20 is provided on the back surface of the port replicator 2. In other words, the port replicator side mounting portion 20 is provided on a surface other than the facing surface on which the security protruding portion 202 is provided.

  FIG. 13 is a diagram illustrating another example of a personal computer.

  As shown in FIG. 13A, the personal computer 1 includes a housing 100 and a computer-side mounting unit 10. When the personal computer 1 is removed from the port replicator 2, the security module 300 is fitted into the computer side mounting unit 10 as shown in FIG.

  The computer-side mounting unit 10 has a shape capable of fitting the security protrusion 202 provided on the port replicator 2. For example, as shown in FIG. 6, since the security module 3 has a substantially rectangular parallelepiped shape, the computer-side mounting unit 10 also has a substantially rectangular parallelepiped shape. Accordingly, the computer-side mounting unit 10 is, for example, a depressed portion having a substantially rectangular parallelepiped shape.

  The computer-side mounting unit 10 is provided on a facing surface that is a surface facing any surface of the casing of the port replicator 2. As shown in FIG. 13, the facing surface is a lower surface of the personal computer 1 and is a surface mounted on the port replicator 2. As shown in FIG. 13, the computer-side mounting unit 10 is provided on the facing surface so as to be in contact with the right side of the facing surface. The computer-side mounting unit 10 may be provided on the facing surface so as to be in contact with the left side of the facing surface.

  FIG. 14 is an explanatory diagram of the port replicator and personal computer of FIG.

  The personal computers 1 are connected to each other by being superimposed on the port replicator 2. Specifically, when the security module 300 is not inserted into the computer-side mounting unit 10 as shown in FIG. 13A, the personal computer 1 uses the port as shown in FIG. It can be connected to the replicator 2. This is a case where the security module 3 is removed from the computer side mounting unit 10 when the personal computer 1 is reconnected to the port replicator 2.

  On the other hand, as shown in FIG. 13B, when the security module 300 is fitted into the computer-side mounting unit 10, the security protrusion 202 cannot be fitted into the computer-side mounting unit 10. For this reason, the personal computer 1 cannot be connected to the port replicator 2 as shown in FIG. This is a case where the user forgets to remove the security module 3 from the computer side mounting unit 10 when the personal computer 1 is reconnected to the port replicator 2. Thereby, it is possible to prevent the user from forgetting to remove the security module 3 from the personal computer 1.

  The structure that prevents the personal computer 1 to which the security module 3 is connected from being connected to the port replicator 2 is not limited to the security protrusion 202. For example, when the security module 3 is mounted on the computer-side mounting unit 10, the security module 3 itself may protrude from the housing 100 of the personal computer 1. In other words, the personal computer 1 may not be connected to the port replicator 2 by the security module 3 itself connected to the personal computer 1.

  As will be understood from the above description, the following embodiments are grasped.

(Appendix 1) One or more types of expansion device side ports;
A connector connectable to one or a plurality of types of information processing device side ports provided in the information processing device, the connector connecting between the information processing device side port and the expansion device side port;
Including an expansion device side mounting section capable of detachably mounting the security module,
The connector includes a port to which the security module in the expansion device side port can be connected when the security module is mounted on the expansion device side mounting unit, and the security in the information processing device side port. An expansion device characterized in that it is connected to the connection port of the module.

(Supplementary Note 2) The expansion device further includes:
Supplementary note 1 including a security protruding portion having a shape that can be fitted into an information processing device side mounting portion capable of detachably mounting the security module provided in the information processing device. The expansion device described in 1.

(Additional remark 3) The said protrusion part for security is provided in the opposing surface which is a surface facing either surface of the housing | casing of the said information processing apparatus. The expansion apparatus of Additional remark 2 characterized by the above-mentioned.

(Additional remark 4) The said opposing surface is an upper surface of the said expansion apparatus, Comprising: The said information processing apparatus is a surface connected,
The expansion device according to appendix 3, wherein the security protrusion is provided on the facing surface so as to be in contact with a left side or a right side of the facing surface.

(Additional remark 5) The said expansion apparatus side mounting part is provided in surfaces other than the said opposing surface in which the said protrusion part for security is provided. The expansion apparatus of Additional remark 3 characterized by the above-mentioned.

(Additional remark 6) The said security module is fixed to a predetermined position with a security wire with the said expansion apparatus. The expansion apparatus of Additional remark 1 characterized by the above-mentioned.

(Appendix 7) One or more types of information processing device side ports connectable to the expansion device;
Including an information processing apparatus-side mounting unit capable of detachably mounting a security module,
The information processing device side port is a connection port connected to the security module via the expansion device when the security module is mounted on the expansion device, and the information processing device side mounting unit Includes a connection port provided at a different position.

(Supplementary Note 8) The security module includes one or a plurality of security chips mounted on a board different from the board on which the CPU of the information processing apparatus is mounted, and is an independent portable module. The information processing apparatus according to appendix 7, which is characterized.

(Additional remark 9) The said information processing apparatus side mounting part has a shape which can engage | insert the protrusion part for security provided in the said expansion apparatus. The information processing apparatus of Additional remark 7 characterized by the above-mentioned.

(Additional remark 10) The said information processing apparatus side mounting part is provided in the opposing surface which is a surface which opposes any surface of the housing | casing of the said expansion apparatus. The information processing apparatus of Additional remark 9 characterized by the above-mentioned.

(Additional remark 11) The said opposing surface is a lower surface of the said information processing apparatus, Comprising: It is a surface mounted in the said expansion apparatus,
The information processing apparatus according to appendix 10, wherein the information processing apparatus side mounting unit is provided on the facing surface so as to be in contact with a left side or a right side of the facing surface.

(Additional remark 12) When the said security module is mounted in the said information processing apparatus side mounting part, it is made to protrude from the housing | casing of the said information processing apparatus. The information processing apparatus of Additional remark 7 characterized by the above-mentioned. .

(Additional remark 13) The said security module is fixed to a predetermined position with a security wire with the said information processing apparatus. The information processing apparatus of Additional remark 7 characterized by the above-mentioned.

(Supplementary note 14) an expansion device;
An information processing device connected to the expansion device;
A security module detachably mounted on the expansion device,
The expansion device is
One or more types of expansion device side ports;
A connector connectable to one or more types of information processing device side ports provided in the information processing device, the connector connecting between the information processing device side port and the expansion device side port;
Including an expansion device side mounting part capable of detachably mounting the security module;
The connector includes a port to which the security module in the expansion device side port can be connected when the security module is mounted on the expansion device side mounting unit, and the security in the information processing device side port. Connect to the module connection port,
The information processing apparatus is
The information processing device side port connectable to the expansion device;
An information processing device side mounting unit capable of detachably mounting the security module;
The information processing device side port is a connection port connected to the security module via the expansion device when the security module is mounted on the expansion device, and the information processing device side mounting unit Includes a connection port provided at a different position.

(Supplementary note 15) The information processing system according to supplementary note 14, wherein the security module invalidates configuration information of an active circuit provided in the expansion device.

(Supplementary Note 16) In an information processing system including an expansion device, an information processing device connected to the expansion device, and a security module detachably mounted on the expansion device,
The information processing device transmits data to the security module via the expansion device,
The security module generates encrypted data by encrypting the received data, and transmits the encrypted data generated to the information processing device via the expansion device,
The information processing apparatus stores the received encrypted data in a storage device. A security processing method for an information processing system, comprising:

1 Personal computer (PC)
2-port replicator (PR)
3, 300 Security module 4 Security wire 10 Computer side mounting part 11 CPU
12 PCH
13 Super I / O
14 LAN controller (LAN)
15 VGA
16, 26 Serial port 17, 27 Parallel port 18, 28 LAN port 19, 29 CRT port 20, 203 Port replicator side mounting part 111, 221 Security port 301 Housing 21, 302 Connector 303 Reinforcement plate 304 Through hole

Claims (10)

One or more types of expansion device side ports;
A connector connectable to one or a plurality of types of information processing device side ports provided in the information processing device, the connector connecting between the information processing device side port and the expansion device side port;
Including an expansion device side mounting section capable of detachably mounting the security module,
The connector includes a port to which the security module in the expansion device side port can be connected when the security module is mounted on the expansion device side mounting unit, and the security in the information processing device side port. An expansion device characterized in that it is connected to the connection port of the module. The expansion device further includes:
The information processing apparatus includes a security protrusion having a shape that can be fitted into an information processing apparatus side mounting section that can be detachably mounted on the security module. The expansion device according to 1. The expansion device according to claim 2, wherein the security protrusion is provided on a facing surface that is a surface facing any surface of the housing of the information processing device. The expansion device according to claim 1, wherein the security module is fixed at a predetermined position together with the expansion device by a security wire. One or more types of information processing device side ports connectable to the expansion device;
Including an information processing apparatus-side mounting unit capable of detachably mounting a security module,
The information processing device side port is a connection port connected to the security module via the expansion device when the security module is mounted on the expansion device, and the information processing device side mounting unit Includes a connection port provided at a different position. The security module includes one or a plurality of security chips mounted on a board different from the board on which the CPU of the information processing apparatus is mounted, and is an independent portable module. Item 6. The information processing device according to Item 5. The information processing apparatus according to claim 5, wherein the information processing apparatus side mounting section has a shape capable of fitting a security protrusion provided in the expansion apparatus. The information processing apparatus according to claim 5, wherein the security module is fixed at a predetermined position together with the information processing apparatus by a security wire. An expansion unit;
An information processing device connected to the expansion device;
A security module detachably mounted on the expansion device,
The expansion device is
One or more types of expansion device side ports;
A connector connectable to one or more types of information processing device side ports provided in the information processing device, the connector connecting between the information processing device side port and the expansion device side port;
Including an expansion device side mounting part capable of detachably mounting the security module;
The connector includes a port to which the security module in the expansion device side port can be connected when the security module is mounted on the expansion device side mounting unit, and the security in the information processing device side port. Connect to the module connection port,
The information processing apparatus is
The information processing device side port connectable to the expansion device;
An information processing device side mounting unit capable of detachably mounting the security module;
The information processing device side port is a connection port connected to the security module via the expansion device when the security module is mounted on the expansion device, and the information processing device side mounting unit Includes a connection port provided at a different position. In an information processing system including an expansion device, an information processing device connected to the expansion device, and a security module detachably mounted on the expansion device,
The information processing device transmits data to the security module via the expansion device,
The security module generates encrypted data by encrypting the received data, and transmits the encrypted data generated to the information processing device via the expansion device,
The information processing apparatus stores the received encrypted data in a storage device. A security processing method for an information processing system, comprising:

Images