JP2020043493A - Network device and program - Google Patents

Abstract

To make it possible to start up a key management server even when the key management server is not accessible in a case of starting up by decrypting a disc which is encrypted by obtaining a decryption key by connecting to the key management server on a network.SOLUTION: A virtual device 10 obtains a decryption key by connecting to a license management server 12 via a network 18 and decrypts an encrypted image unit 10b to achieve a function of the virtual device 10. If an ISP is changed from an old ISP 14 to a new ISP 16 and cannot connect to the license management server 12, an activation control unit 10c activates a connection information change unit 10e to enable a change of the ISP connection information 10d1 stored in a connection information storage unit 10d.SELECTED DRAWING: Figure 4

Description

  The present invention relates to a network device and a program.

  Patent Literature 1 describes a technique for preventing a risk of breaking security of a virtual machine such that a copy of the entire virtual machine is lost or stolen. A virtual machine is arranged in the form of an encrypted virtual disk on the cloud, a disk wrapping key is obtained from a key management server, and the encrypted disk is decrypted and operated. The virtual disk includes an unencrypted pre-boot environment and acquires a disk wrapping key from the key management server in the pre-boot environment.

  Patent Literature 2 discloses a technique for ensuring stable operation and security of a thin client system. Different OSs are stored in the non-encrypted area (OS1) and the encrypted area (OS2), respectively, and the management server switches which OS to start. In the case of OS2, the decryption key of OS2 is obtained from the management server, decrypted, and expanded in the memory.

  Patent Document 3 describes that when a processor receives a virtual image, the processor writes a decryption master boot record and a decryption program on a virtual disk and encrypts at least a part of the virtual image.

JP 2012-190441 A Patent No. 6024821 Patent No. 5904505

  When a virtual machine (VM) is arranged as an encrypted virtual disk on the cloud, a virtual machine (VM) is connected to a key management server on a network, a decryption key is obtained, and the encrypted disk is decrypted and activated. If the server cannot be connected, the decryption key cannot be obtained, and the encrypted disk cannot be decrypted. In particular, when connecting to a key management server via an Internet service provider (ISP), if the ISP is changed for any reason, it is necessary to change the connection information for connecting to a new ISP following the change of the ISP. However, if the connection information is not changed, it is impossible to connect to the key management server, and the encrypted disk cannot be decrypted.

  The present invention provides a technology that enables, even when connection to a key management server is not possible, connection to a key management server on a network to acquire a decryption key, decrypt an encrypted disk, and start the disk. The purpose is to do.

  The invention according to claim 1 is a storage unit that stores connection information for connecting to a key management server on a network, and a decoding unit that connects to the key management server using the connection information to obtain a decryption key. And a change unit that is started without being decrypted with the decryption key when the decryption unit cannot connect to the key management server, and that changes the connection information and stores it in the storage unit. .

  The invention according to claim 2 starts the decryption unit, activates the change unit when the decryption unit cannot connect to the key management server, and changes the connection information after the change unit changes the connection information. The network device according to claim 1, further comprising: a start control unit configured to restart the device.

  The invention according to claim 3 is the network device according to claim 1, wherein the change unit is not encrypted, and when activated, accepts a user operation to change the connection information.

  In the invention according to claim 4, the storage unit stores the connection information before the change and the connection information after the change, and the decryption unit connects to the key management server using the connection information after the change. The network device according to claim 1, wherein when the decryption key cannot be obtained, the network device connects to the key management server using the connection information before the change.

  According to a fifth aspect of the present invention, a storage unit for storing connection information for connecting a computer to a key management server on a network, and a decryption key is obtained by connecting to the key management server using the connection information. A decryption unit that is activated without being decrypted with the decryption key when the decryption unit cannot connect to the key management server, and functions as a change unit that changes the connection information and stores the connection information in the storage unit. Program.

  According to the first, second, and fifth aspects of the present invention, when connecting to a key management server on a network to obtain a decryption key, decrypt an encrypted disk, and start the disk, the connection to the key management server is made. It can start even when it cannot.

  According to the third aspect of the present invention, it can be further activated by a user operation.

  According to the fourth aspect of the present invention, it is possible to further attempt activation using the connection information before the change.

It is a premise system configuration figure of an embodiment. FIG. 3 is an explanatory diagram (part 1) illustrating a processing flow in the premise system of the embodiment. It is explanatory drawing (the 2) which shows the flow of a process in the premise system of embodiment. FIG. 1 is a system configuration diagram of an embodiment. FIG. 3 is an explanatory diagram illustrating a flow of processing in the system according to the embodiment; It is a processing flowchart (the 1) of an embodiment. It is a processing flowchart (the 2) of an embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 shows a system configuration which is a premise in the present embodiment. A virtual machine (VM) is arranged as an encrypted virtual disk on the cloud, connected to a key management server on the network to obtain a decryption key (hereinafter referred to as a “decryption key” as appropriate) and encrypted. This is a system that decrypts and starts a disk. However, the present invention is not necessarily limited to a cloud, and can be applied to a general virtual machine.

  To protect computer systems from unauthorized copying of programs or data, "full disk encryption" technology is known. When the computer is not active, non-volatile storage (eg, HDD (hard disk)) is encrypted except for a small pre-boot environment. The pre-boot environment has a boot loader that executes to obtain one or more data decryption keys and decrypts the rest of the hard disk.

  Note that a “virtual machine” is an environment that operates within a part of a host computer, as described in Patent Document 1. The virtual machine is realized by a virtualized OS or a hypervisor that is a virtualization control program, and the hypervisor provides and manages access to the hardware resources of the host computer from the virtual machine. The virtual machine may separate processes running in the virtual machine from processes running in the host computer. Further, the virtual machine can be realized on a cloud. In the cloud, a service provider manages a server accessible via the Internet or the like, and allocates resources on the server to clients. The provided resources include storage and processing of client data and execution control of the entire virtual machine.

  The system of the present embodiment includes a virtual device 10 and a license management server 12. The virtual device 10 and the license management server 12 are connected to a network 18 such as the Internet. The virtual device 10 is realized by a hypervisor on a host computer, and is connected to a network 18 via an ISP. In the figure, the old ISP 14 and the new ISP 16 are shown as ISPs, but this indicates that the ISP for connecting the virtual device 10 to the license management server 12 is changed. That is, the virtual device 10 changes the ISP from the old ISP 14 to the new ISP 16 at a certain timing and connects to the license management server 12.

  The virtual device 10 includes, as functional blocks, an encrypted image decryption unit 10a, an encrypted image unit 10b, an activation control unit 10c, and a connection information holding unit 10d.

  The encrypted image decryption unit 10a functions as a decryption unit, acquires a decryption key for decrypting the encrypted image unit 10b from the license management server 12, and decrypts the encrypted image unit 10b. The encrypted image decryption unit 10a includes a line connection / decryption key acquisition unit 10a1 and an encrypted image decryption unit 10a2. The line connection / decryption key acquisition unit 10a1 connects to the license management server 12 via the ISP and the network 18, and acquires a decryption key from the license management server 12. The line connection / decryption key acquisition unit 10a1 connects to the license management server 12 by connecting to the ISP using the ISP connection information held in the connection information holding unit 10d. The encrypted image decryption unit 10a2 decrypts the encrypted image unit 10b using the decryption key acquired by the line connection / decryption key acquisition unit 10a1. The encrypted image decryption unit 10a is not encrypted.

  The cryptographic image unit 10b is a block for providing the function of the virtual device 10. The encrypted image unit 10b is encrypted to suppress technical leakage and attacks from third parties. In the figure, the fact that a key graphic is attached to the encryption image portion 10b indicates that this block is encrypted. The encryption image unit 10b includes a line connection unit 10b1 and a connection information change unit 10b2. The line connection unit 10b1 connects to the network 18 in order to provide a service with the virtual device 10 when it is decrypted and in the operating state. The connection information changing unit 10b2 changes the connection information held in the connection information holding unit 10d due to an ISP change or the like when decrypted and in the operating state.

  The boot control unit 10c is a boot loader, and controls a partition to be booted. The activation control unit 10c includes activation control information 10c1, and activates the virtual device 10 according to the activation control information 10c1. The boot control information 10c1 holds boot partition information. The activation control unit 10c is not encrypted.

  The connection information holding unit 10d functions as a storage unit, and holds connection information 10d1 for connecting to the ISP. The connection information 10d1 is an ISP IP address, ID, password, and the like. The connection information holding unit 10d is not encrypted.

  The license management server 12 is a key management server, and includes a decryption key issuing unit 12a and a device authentication unit 12b. The decryption key issuing unit 12a issues a decryption key in response to a request from the virtual device 10. The device authentication unit 12b authenticates the accessed virtual device 10 and permits the authenticated virtual device 10 to issue a decryption key in the decryption key issuing unit 12a.

  The virtual device 10 is implemented on a host computer. The host computer includes one or more processors, ROM, RAM, input / output interface, input device, output device, communication interface, and HDD (hard disk drive) or SSD (SSD). A storage device such as a solid state drive). The one or more processors implement the cryptographic image decryption unit 10a and the activation control unit 10c of the virtual device 10 by executing a control program (hypervisor) stored in the ROM or the storage device, and the cryptographic image is stored in the storage device. And a connection information holding unit 10d.

  FIG. 2 shows a flow of processing from the time when the virtual device 10 connects to the license management server 12 using the old ISP 14 before the change, acquires the decryption key, and decrypts the encrypted image unit 10b.

First step:
The activation control unit 10c activates the encrypted image decryption unit 10a according to the activation control information 10c1.

Second step:
The line connection / decryption key acquisition unit 10a1 of the encrypted image decryption unit 10a accesses the connection information holding unit 10d to acquire the connection information 10d1 of the old ISP 14.

Third step:
The line connection / decryption key acquisition unit 10a1 of the encryption image decryption unit 10a connects to the license management server 12 by connecting to the old ISP 14 using the connection information, and acquires a decryption key.

Fourth step:
The encrypted image decryption unit 10a2 of the encrypted image decryption unit 10a decrypts the encrypted image unit 10b using the obtained decryption key.

  On the other hand, FIG. 3 shows the flow of processing after the ISP has been changed from the old ISP 14 to the new ISP 16. It is assumed that the ISP has been changed from the old ISP 14 to the new ISP 16, but the connection information held in the connection information holding unit 10d remains the connection information of the old ISP 14.

The first step and the second step are the same as in FIG. That is,
First step:
The activation control unit 10c activates the encrypted image decryption unit 10a according to the activation control information 10c1.

Second step:
The line connection / decryption key acquisition unit 10a1 of the encryption image decryption unit 10a accesses the connection information holding unit 10d to acquire the connection information 10d1 of the old ISP 14.

  However, since the connection information 10d1 acquired in the first step is the connection information of the old ISP 14, the connection information 10d1 cannot connect to the new ISP 16 using this connection information, and cannot connect to the license management server 12. Therefore, the line connection / decryption key acquisition unit 10a1 cannot acquire the decryption key from the license management server 12, and cannot decrypt the encrypted image unit 10b. In this case, the function of the virtual device 10 cannot be activated, and a necessary service cannot be provided. In the figure, the fact that neither the third step nor the fourth step is performed is indicated by a cross.

  Therefore, in the present embodiment, even if the ISP is changed from the old ISP 14 to the new ISP 16 and the connection information held in the connection information holding unit 10d is still the connection information of the old ISP 14, the connection to the new ISP 16 is established. A configuration is adopted in which connection to the license management server 12 is made as possible and a decryption key is obtained.

  FIG. 4 shows a system configuration in the present embodiment. In addition to the configuration shown in FIG. 1, the virtual device 10 includes an encrypted image decryption unit 10a, an encrypted image unit 10b, an activation control unit 10c, and a connection information holding unit 10d, and further includes a connection information change unit 10e. Prepare.

  The connection information changing unit 10e functions as a changing unit, and provides a fail-safe partition that is a line failure handling block and is not encrypted. If the decryption key cannot be obtained by the encrypted image decryption unit 10a, the activation control unit 10c activates the connection information change unit 10e as a fail-safe partition, and can change the connection information 10d1 stored in the connection information storage unit 10d. And

  The user changes (updates) the connection information 10d1 from the information of the old ISP 14 to the information of the new ISP 16 using the input device (keyboard or mouse) and the display device of the virtual device 10. After that, the activation control unit 10c activates the encrypted image decryption unit 10a again, and acquires the decryption key in the procedure shown in FIG.

  When the cryptographic image part 10b is decrypted, the connection information change part 10b2 of the decrypted cryptographic image part 10b is in an operating state. It is possible to change the held connection information 10d1, but if the decryption key cannot be obtained and the encrypted image unit 10b cannot be decrypted in the first place, the connection information change unit 10b2 is also in a stopped state, so the connection information 10d1 is changed. It can not be changed. In this sense, the connection information changing unit 10e is a block that replaces the connection information changing unit 10b2 and changes the connection information when the encryption image unit 10b is in a stopped state without being decrypted.

  FIG. 5 shows a flow of processing from the time when the virtual device 10 connects to the license management server 12 using the new ISP 16 after the change, acquires the decryption key, and decrypts the encrypted image part 10b.

  As shown in FIG. 4, it is a process flow from a state where the connection to the license management server 12 cannot be made and the decryption key cannot be obtained.

First step:
The activation control unit 10c activates the encrypted image decryption unit 10a according to the activation control information 10c1.

Second step:
The line connection / decryption key acquisition unit 10a1 of the encryption image decryption unit 10a accesses the connection information holding unit 10d to acquire the connection information 10d1 of the old ISP 14.

Third step:
The line connection / decryption key acquisition unit 10a1 of the encryption image decryption unit 10a tries to connect to the old ISP 14 using the connection information. Unable to get decryption key.

Fourth step:
The encrypted image decryption unit 10a2 of the encrypted image decryption unit 10a cannot decrypt the encrypted image unit 10b.

Fifth step:
As shown in the drawing, when detecting that the line cannot be connected, the activation control unit 10c changes the activation control information 10c1 from the normal encrypted image decryption unit 10a to a fail-safe partition and reboots. As a result, the connection information changing unit 10e is activated instead of the encrypted image decrypting unit 10a.

Sixth step:
The user changes the connection information of the old ISP 14 to the connection information of the new ISP 16 using the started connection information change unit 10e. That is, as the connection information, the ID and password of the new ISP 16 are input and held as new connection information 10d1 in the connection information holding unit 10d.

Seventh step:
The activation control unit 10c performs an activation process on the encrypted image decryption unit 10a according to the activation control information 10c1.

Eighth step:
The line connection / decryption key acquisition unit 10a1 of the encryption image decryption unit 10a accesses the connection information holding unit 10d to acquire the connection information 10d1 of the new ISP 16.

Ninth step:
The line connection / decryption key acquisition unit 10a1 of the encryption image decryption unit 10a connects to the license management server 12 by connecting to the new ISP 16 using the connection information, and acquires a decryption key.

Tenth step:
The encrypted image decryption unit 10a2 of the encrypted image decryption unit 10a decrypts the encrypted image unit 10b with the obtained decryption key.

  Thus, the connection information changing unit 10e activated by the activation control unit 10c is provided, and by rewriting the connection information by the connection information changing unit 10e, the connection to the new ISP 16 by the encryption image decryption unit 10a becomes possible. The connection information change unit 10e is a block that is activated in the fail-safe mode when the virtual device 10 is in the stopped state while the encryption image unit 10b remains encrypted, and is a non-encrypted block that executes change of the connection information. I can say. Since the connection information change unit 10e is an unencrypted block, it is preferable that only the connection information is changed and other functions are not executed from the viewpoint of security.

  6A and 6B show an overall processing flowchart of this embodiment.

  First, in FIG. 6A, when activating the virtual device 10, the activation control unit 10c activates the encrypted image decryption unit 10a according to the activation control information 10c1 (S101). The start control information 10c1 includes normal mode start control information and abnormal mode start control information. The normal mode start control information defines the encryption image decryption unit 10a, and the abnormal mode start control information specifies the connection information change unit. 10e is defined.

  Next, when the encryption image decryption unit 10a is activated, the line connection / decryption key acquisition unit 10a1 accesses the connection information holding unit 10d to acquire the connection information 10d1 (S102), and uses this connection information 10d1 to manage the license. Connect to the server 12 (S103).

  If the information of the ISP that can be used by the virtual device 10 matches the connection information 10d1 acquired in S102, for example, if the available ISP is the old ISP 14 and the connection information 10d1 is the ID and password of the old ISP 14, The connection / decryption key acquisition unit 10a1 can connect to the license management server 12 via the ISP. If the available ISP is the new ISP 16 and the connection information 10d1 is the ID and password of the new ISP 16, the line connection / decryption key acquisition unit 10a1 can connect to the license management server 12 via the ISP. On the other hand, the information of the ISP that can be used by the virtual device 10 does not match the connection information 10d1 acquired in S102. For example, even though the available ISP is the new ISP 16, the connection information 10d1 has the ID of the old ISP 14 and If it is a password, the line connection / decryption key acquisition unit 10a1 cannot connect to the license management server 12 via the ISP.

  Next, the line connection / decryption key acquisition unit 10a1 determines whether the connection to the license management server 12 has been established (S104). If the connection is successful (YES in S104), the device authentication unit 12b of the license management server 12 authenticates the virtual device 10 (S105), and if the authentication is successful, the decryption key issuing unit 12a issues a decryption key. The line connection / decryption key acquisition unit 10a1 acquires the issued decryption key and supplies it to the encrypted image decryption unit 10a2. The encrypted image decryption unit 10a2 decrypts the encrypted image unit 10b using the obtained decryption key (S106). The decrypted encrypted image unit 10b provides various cloud services as functions of the virtual device 10 (S107). That is, the line connection unit 10b1 of the decrypted encrypted image unit 10b connects to the network 18 using the connection information 10d1 held in the connection information holding unit 10d, and provides various cloud services. When the ISP is changed, the connection information changing unit 10b2 changes the connection information 10d1 held in the connection information holding unit 10d.

  On the other hand, if the connection to the license management server 12 cannot be established (NO in S104), the processing shifts to the processing in FIG. 6B.

  In FIG. 6B, when detecting that the connection cannot be established by the notification from the line connection / decryption key acquisition unit 10a1, the activation control unit 10c switches the activation control information 10c1 from the normal mode to the abnormal mode and changes to the fail-safe partition (S108). ), The virtual device 10 is restarted (S109).

  After the restart of the virtual device 10, the activation control unit 10c activates the connection information changing unit 10e instead of the encrypted image decryption unit 10a according to the activation control information 10c1 (S110). When activated, the connection information change unit 10e displays an input screen for changing the connection information on the display unit of the virtual device 10, and urges the user, specifically, the administrator of the virtual device 10 to change the connection information. . The content of the current connection information 10d1 may be displayed on the input screen. The administrator of the virtual device 10 inputs the changed connection information into the input screen using an input device such as a keyboard and a mouse, and stores it in the connection information holding unit 10d (S111). The administrator of the virtual device 10 may change the connection information using an administrator terminal connected to the virtual device 10 via the network 18 and store the changed connection information in the connection information holding unit 10d.

  When the connection information is changed, the startup control unit 10c returns the startup control information from the abnormal mode to the normal mode, and changes the fail-safe partition to the encryption image decryption unit 10a (S112). Thereafter, the virtual device 10 is restarted (S113). After the restart, the processing after S101 in FIG. 6A is executed.

  That is, the activation control unit 10c activates the encrypted image decryption unit 10a according to the activation control information 10c1 (S101).

  Next, when the encryption image decryption unit 10a is activated, the line connection / decryption key acquisition unit 10a1 accesses the connection information holding unit 10d to acquire the connection information 10d1 (S102), and uses this connection information 10d1 to manage the license. Connect to the server 12 (S103).

  Then, it is determined whether or not the connection has been established (S104). If the connection has been established, the device authentication unit 12b of the license management server 12 authenticates the virtual device 10 (S105). The unit 12a issues a decryption key. The line connection / decryption key acquisition unit 10a1 acquires the issued decryption key and supplies it to the encrypted image decryption unit 10a2. The encrypted image decryption unit 10a2 decrypts the encrypted image unit 10b using the obtained decryption key (S106). The decrypted encrypted image unit 10b provides various cloud services as functions of the virtual device 10 (S107).

  Note that, even though the connection information has been changed in the processing of S108 to S113, if the determination processing in S104 is NO, that is, if the connection information after the change cannot connect to the license management server 12, the processing in FIG. 6B is repeated again. . An upper limit may be set for the number of retries when connection is not possible.

  Although the embodiments of the present invention have been described above, the present invention is not limited to these embodiments, and various modifications are possible. Hereinafter, modified examples will be described.

<Modification 1>
In the embodiment, when the connection to the license management server 12 cannot be established, the connection information changing unit 10e is activated to change the connection information. However, the connection information changing unit 10e holds a past change history. Alternatively, if connection to the license management server 12 is still not possible even after changing the connection information, the configuration may be such that desired connection information can be selected from the past change history. For example, after the connection information of the old ISP 14 is changed to the connection information of the new ISP 16, the connection information is returned to the connection information of the old ISP 14 again.

<Modification 2>
In the embodiment, the connection information change unit 10e is provided separately from the encryption image decryption unit 10a, but the connection information change unit 10e may be provided as one function of the encryption image decryption unit 10a. The cryptographic image decryption unit 10a is a block that is always activated in the normal mode, and has a relatively small capacity. Therefore, from the viewpoint of emphasizing security, the connection information changing unit 10e is separate from the cryptographic image decryption unit 10a. Is preferably provided, but such a configuration is not excluded.

  10 virtual device, 12 license management server, 14 old ISP (Internet service provider), 16 new ISP, 18 network.

Claims (5)

A storage unit for storing connection information for connecting to a key management server on a network;
A decryption unit that connects to the key management server using the connection information to obtain a decryption key,
When the decryption unit cannot connect to the key management server, the decryption key is activated without being decrypted by the decryption key, and a change unit that changes the connection information and stores the information in the storage unit;
A network device comprising: Activating the decryption unit, activates the change unit when the decryption unit can not connect to the key management server, a start control unit that restarts the decryption unit after changing the connection information in the change unit,
The network device according to claim 1, comprising: The network device according to claim 1, wherein the change unit is not encrypted, and when activated, accepts a user operation to change the connection information. The storage unit stores the connection information before the change and the connection information after the change,
The decryption unit connects to the key management server using the connection information before the change when the decryption unit cannot connect to the key management server using the connection information after the change and obtain the decryption key. Network equipment. Computer
A storage unit for storing connection information for connecting to a key management server on a network;
A decryption unit that connects to the key management server using the connection information to obtain a decryption key,
When the decryption unit cannot connect to the key management server, the program is started without being decrypted by the decryption key, and functions as a change unit that changes the connection information and stores the connection information in the storage unit.

Images