JP5584435B2 - Information protection apparatus, computer system, and information protection method - Google Patents

Description

  The present invention relates to an information protection device, a computer system, and an information protection method for restricting access to a storage device with a password.

  With the spread of computers in recent years, the information managed by computers has increased dramatically, and security measures for information are also regarded as important. One security measure for information managed by a computer is a method of protecting a storage device such as a hard disk connected to the computer with a password.

  For example, the technique disclosed in Patent Document 1 discloses a technique for preventing information from being read even when a removable hard disk or the like is taken out even if the hard disk is connected to another computer. In this technique, a password is set for a hard disk by a user operation via a computer. The hard disk is allowed to access (write and read) when the set password matches the input password, and when it does not match, the access to itself is rejected.

Japanese Patent Laid-Open No. 11-353049

  However, in the conventional technique, a password for the hard disk is set by a user operation. Therefore, there is a problem that convenience for the user is lowered. In addition, when the password set by the user is known by some method, there is a problem that the hard disk is accessed.

  The present invention has been made in view of the above, and obtains an information protection device, a computer system, and an information protection method capable of protecting a storage device with a password without the user being aware of the password for the storage device. For the purpose.

  In order to solve the above-described problems and achieve the object, an information protection device according to the present invention is a storage device capable of setting a locked state in which reading / writing to itself is prohibited and an unlocking state in which reading / writing to itself is allowed An information protection device comprising: an inquiry to the storage device whether the storage device is locked or unlocked; and whether the storage device is locked or unlocked based on a response to the inquiry A lock / unlock detection means for detecting whether the information is a key code storage means for storing a key code that is a unique value for each information protection device, and a password based on the key code and a predetermined calculation formula. If the detection result of the generated password generation means and the lock / unlock detection means is unlocked, the password is set to A lock / unlock control means for notifying the storage device of the password as an authentication password when the detection result of the lock / unlock detection means is locked. The storage device is in a locked state when an inquiry is made from the password storage means for storing the set password and whether the lock / unlock detection means is in a locked state. A response including the above information, and when the set password read from the password storage unit matches the authentication password notified from the lock / unlock control unit, management to release the lock state of itself Means.

  The information protection apparatus according to the next invention is characterized in that the key code storage means is a nonvolatile memory.

  The information protection device according to the next invention is characterized in that the storage device is a storage device compliant with the ATA standard.

  The information protection apparatus according to the next invention is characterized in that the lock / unlock detection means makes the inquiry using an IDENTIFY DEVICE command.

  The information protection apparatus according to the next invention is characterized in that the predetermined calculation formula is a calculation formula for bit-inverting the key code.

  The information protection apparatus according to the next invention is characterized in that the predetermined calculation formula is a hash function.

  The information protection apparatus according to the next invention is characterized in that the key code is a serial number of a computer system in which the information protection apparatus is mounted.

  A computer system according to the next invention includes the information protection device according to any one of claims 1 to 7.

  An information protection method according to the next invention is an information protection method in a computer system including a storage device capable of setting a locked state that prohibits reading and writing to itself and an unlocked state that allows reading and writing to itself. Lock / unlock detection that inquires to the storage device whether the storage device is locked or unlocked, and detects whether the storage device is locked or unlocked based on a response to the inquiry A key code storage step for storing a key code that is a unique value for each information protection device, a password generation step for generating a password based on the key code and a predetermined calculation formula, and a lock unlock detection step If the detected result is unlocked, the password is set as the set password. A setting password notification step for notifying the storage device as a password, and an authentication password notification step for notifying the storage device of the password as an authentication password if the detection result of the lock / unlock detection step is locked. The storage device stores the set password, and when the storage device is in the locked state in the lock / unlock detection step, an inquiry is made whether the storage device is in the locked state. The lock state return step for returning a response including information on whether or not there is a match, and the set password stored in the password storage step by the storage device matches the authentication password notified in the authentication password notification step. Unlock step to release its own locked state in case Including, characterized in that.

  In the information protection device, the computer system, and the information protection method according to the present invention, the key code is stored in advance in the key code storage means, and the password generation means is based on the stored key code when the storage device is locked. A password is generated according to a predetermined calculation formula, stored in the password storage means of the storage device, and when accessing the storage device, the password generation means is in accordance with the predetermined calculation formula based on the stored key code. A password is generated and passed to the storage device, and the password comparison means of the storage device compares the password stored in the password storage unit with the received password, and if the password matches, the storage device is unlocked. Therefore, the user can password the storage device without being aware of the password for the peripheral device. It can be more protection, an effect that.

FIG. 1 is a diagram showing a configuration example of a computer system in which an information protection apparatus according to the present invention is installed. FIG. 2 is a diagram illustrating a functional configuration example of the information protection apparatus. FIG. 3 is a flowchart illustrating an example of a password setting processing procedure. FIG. 4 is a flowchart illustrating an example of a lock processing procedure of the storage device. FIG. 5 is a flowchart illustrating an example of an unlock processing procedure of the storage device.

  Embodiments of an information protection apparatus, a computer system, and an information protection method according to the present invention will be described below in detail with reference to the drawings. Note that the present invention is not limited to the embodiments.

  FIG. 1 is a diagram showing a configuration example of a computer system in which an information protection apparatus according to the present invention is installed. As shown in FIG. 1, the computer system of the present embodiment includes a control device (CPU: Central Processing Unit) 1, a display device 2, a chip set 3, a system memory 4, a storage device 5, and an I / O. An (Input / Output) controller HUB 6, a nonvolatile memory 7, a keyboard controller 8, and a keyboard 9 are included.

  The control device 1 is a calculation means that is the center of a computer system that performs various calculations and controls. The display device 2 is a device for displaying information notified to the user of the computer system by screen display or the like. The chip set 3 is a control circuit on which a circuit such as a memory interface around the control device 1 is mounted. The system memory 4 is a memory for storing information necessary for the operation of the control device 1, and the control device 1 accesses the system memory 4 via the chipset 3.

  The storage device 5 is a storage device that conforms to the ATA (Advanced Technology Attachment) standard, such as a hard disk drive (HDD) or a solid state drive (SSD). In the present embodiment, a storage device that conforms to the ATA standard is assumed. However, the present invention is not limited to this, and the present embodiment is also realized by realizing the same operation as in the present embodiment even in the case of a storage device that does not conform to the ATA standard. The same effect can be obtained. The I / O controller HUB 6 is a circuit for connecting peripheral devices such as the storage device 5, the nonvolatile memory 7, and the keyboard controller 8. The non-volatile memory 7 is a memory that retains memory even when power is not supplied. The keyboard is a keyboard for accepting input from the user, and the keyboard controller 8 is a control means for controlling the keyboard 9. Information input from the keyboard 9 is input to the I / O controller HUB 6 and the chipset. 3 to the control device 1 via 3.

  FIG. 1 is an example of the configuration of the computer system. The configuration is not limited to this, and the configuration may include a calculation unit such as the control device 1, a system memory 4, a storage device 5, and a nonvolatile memory 7. Any configuration may be used.

  FIG. 2 is a diagram illustrating a functional configuration example of the information protection apparatus according to the present embodiment. As shown in FIG. 1, the information protection device of this embodiment includes a key code setting unit 11, a lock / unlock detection unit 12, a password generation unit 13, a lock / unlock control unit 14, and an activation process in the control device 1. Unit 15, key code storage unit 71 in nonvolatile memory 7, password storage unit 51, password comparison unit 52 and data storage unit 53, and management unit 54 in storage device 5.

  FIG. 3 is a flowchart illustrating an example of the password setting processing procedure of the present embodiment. FIG. 4 is a flowchart illustrating an example of a lock processing procedure of the storage device 5 according to the present embodiment. FIG. 5 is a flowchart illustrating an example of the unlock processing procedure of the storage device 5 according to the present embodiment. Hereinafter, the operation of this embodiment will be described with reference to FIGS.

  First, the password setting process will be described with reference to FIG. In the password setting process, the key code setting unit 11 assigns a unique key code to the key code storage unit 71 of the nonvolatile memory 7 based on an instruction from an operator such as a developer / manufacturer or user of the computer system of the present embodiment. Set (step S11). Specifically, the keyboard controller 8 passes the key code input by the operator operating the keyboard 9 to the key code setting unit 11 of the control device 1 via the I / O controller HUB 6 and the chip set 3. The key code setting unit 11 stores the key code in the key code storage unit 71 of the volatile memory 7 via the chipset 3 and the I / O controller HUB 6.

  The key code set in step S11 is a unique value for each computer system. For example, the serial number for each computer for managing manufacturing is set. (Number) is used. The key code is the serial number. Any value may be used as long as it is a unique value for each computer system. In the above description, the password setting process of FIG. 3 is performed and the key code is set based on a predetermined input operation at the manufacturing stage or at the start of use by the user. Information (device-specific register setting values, etc.) set for another purpose (initial setting, etc.) may be used as a key code at the manufacturing stage or system startup without performing the processing. Alternatively, “setting information recorded in advance on a mounted component” or the like can be used as a key code.

  Next, lock processing of the storage device 5 of this embodiment will be described with reference to FIG. It is assumed that the storage device 5 of this embodiment can select and set one of two states, a state where access to the data storage unit 53 is prohibited (lock state) and a state where access is permitted (unlock state). The method for locking and unlocking the data storage unit 53 is not particularly limited and may be performed by a commonly used method.

  The lock process according to the present embodiment is performed when, for example, a process for setting a password for the storage device 5 (such as an auto password) is selected on a setting screen of a BIOS (Basic Input / Output System) installed in a computer system. To be started. Not only the method using the BIOS setting screen, but also an instruction to start the process of locking with the password of the storage device 5 is received from the operator, and the lock process is started when the instruction is received. Any method may be used to start the lock process.

  When the lock process is started, the lock / unlock detection unit 12 first checks whether the storage device 5 is locked to the management unit 54 of the storage device 5 via the I / O controller HUB 6 and the chipset 3 (current state). Is in the locked state or unlocked state) to detect the state of the storage device 5 (step S21). Specifically, for example, the lock / unlock detection unit 12 inquires whether the storage device 5 is locked by issuing an ATA standard IDENTIFY DEVICE command. In response to the IDENTIFY DEVICE command, the management unit 54 returns a response including whether the IDENTIFY DEVICE command is locked or unlocked. Hereinafter, the exchange between the storage device 5 and the control device 1 is performed via the I / O controller HUB 6 and the chip set 3.

  When the lock / unlock detection unit 12 detects that the storage device 5 is not locked (No in step S21), the lock / unlock detection unit 12 reads the key code from the nonvolatile memory 7 via the chipset 3 and the I / O controller HUB6 (step S21). S22). Then, the password generation unit 13 generates a password according to a predetermined calculation formula based on the key code (step S23).

  Any calculation formula may be used as a calculation formula for generating the password. For example, there are a method of bit-inverting the key code, a method using a hash function, and the like. In the method of bit inversion, for example, a 24-bit (3 Byte) key code is used. When the key code is “123456 (h)” (h indicates hexadecimal notation), if the bit is inverted, “EDCBA9 (h) "EDCBA9 (h)" is the password. When using a hash function, the password can be set up to 32 bytes in the ATA standard, so it is conceivable to use MD4 or MD5 as the hash function.

  After step S23, the lock / unlock control unit 14 stores the password generated by the password generation unit 13 in the password storage unit 51 of the storage device 5 as a set password (step S24). When the management unit 54 detects that the setting password is stored in the password storage unit 51, the management unit 54 locks the storage device 5 (sets the state in which access to the data storage unit 53 is not permitted: step S25), and performs the processing. finish.

  On the other hand, if it is detected in step S21 that the storage device 5 is locked (Yes in step S21), the lock / unlock detection unit 12 indicates that the password cannot be set (or that the password has already been set). The display device 2 is instructed to display a message (step S26), and the process ends.

  Next, the unlocking process of this embodiment will be described with reference to FIG. The unlock process is automatically started prior to the access when the storage device 5 is accessed from the control device 1 side. For example, it is started when a program such as an OS stored in the storage device is read, such as when the computer system is turned on. Here, the operation when the power is turned on will be described as an example.

  First, when the computer system is powered on (step S31), the lock / unlock detection unit 12 detects whether the storage device 5 is locked as in step S21 (step S32) and is locked. If yes (step S32 Yes), the password generation unit 13 reads the key code from the key code storage unit 71 of the nonvolatile memory 7 (step S33).

  Then, the password generation unit 13 generates a password according to a predetermined calculation formula based on the key code as in step S23 (step S34), and the lock / unlock control unit 14 uses the generated password as an authentication password. It passes to the password comparison part 52 (step S35).

  The password comparison unit 52 of the storage device 5 compares the password (setting password) at the time of lock from the password storage unit 51 with the authentication password received in step S35, so that the password received in step S35 is correct. It is determined whether or not (step S36). When it is determined that the password is correct (when the set password matches the authentication password: Yes in step S36), the management unit 54 unlocks the storage device 5 (allows access to the data storage unit 53), The lock / unlock detection unit 12 is notified of the unlocking (step S37).

  When the lock / unlock detection unit 12 receives the notification of the unlocking, the lock / unlock detection unit 12 instructs the activation processing unit 15 to read out the OS program stored in the data storage unit 53 of the storage device 5, and the activation processing unit 15 reads out the OS program stored in the data storage unit 53 and executes the OS startup process (step S39).

  On the other hand, if it is determined in step S36 that the password is not correct (No in step S36), the management unit 54 maintains the locked state of the storage device 5 and notifies the lock / unlock detection unit 12 that the storage device 5 is in the locked state. Notification is made (step S38). When the lock / unlock detection unit 12 receives the notification that the lock state is established, the lock / unlock detection unit 12 determines that the OS activation from the storage device 5 is impossible, and does not perform the OS activation process (step S40).

  In the above description, in steps S37 and S38, the management unit 54 notifies the lock / unlock detection unit 12 whether it is in the locked state or the unlocked state. That is, the part of the function for inquiring whether the management unit 54 is in the locked state or the unlocked state and the lock / unlock detection unit 12 can be considered as one lock / unlock detection means. Not limited to this, the lock / unlock detection unit 12 periodically transmits an IDENTIFY DEVICE command or the like, detects the lock state of the storage device 5 based on the return, and the activation processing unit based on the detection result An instruction to 15 may be performed. Alternatively, the management unit 54 has the function of the lock / unlock detection unit 12, and manages the function of the lock / unlock detection means combined with the function and the function of inquiring whether the state is the lock state or the unlock state. It is good also as providing in the part 54. FIG.

  In this embodiment, the management unit 54 notifies the lock / unlock detection unit 12 whether the storage device 5 is in a locked state or an unlocked state. The determination result of S36 is notified to the lock / unlock control unit 14, and the lock / unlock control unit 14 notifies the activation processing unit 6 when the notified determination result is a result indicating that the password is correct. The OS program stored in the data storage unit 53 of the storage device 5 may be instructed to be read.

  In the above description, the case where the OS is started has been described as an example. However, when other information is stored in the storage device 5 instead of the OS program, step S32 and subsequent steps are performed when reading the information. In step S39, the stored information reading process or the like may be performed instead of the OS activation process.

  Thus, in this embodiment, when the key code is stored in advance in the key code storage unit 71 of the nonvolatile memory 7 and the storage device 5 is locked, the password generation unit 13 stores the key code stored therein. Based on the above, a password is generated according to a predetermined calculation formula and stored in the password storage unit 51 of the storage device 5. When accessing the storage device 5, the password generation unit 13 generates a password according to a predetermined calculation formula based on the stored key code and passes it to the storage device 5. The comparison unit 52 compares the password stored in the password storage unit 51 with the received password. If they match, the storage device 5 is unlocked. Therefore, the storage device can be protected by the password without the user being aware of the password for the peripheral device.

  If the method of storing the authentication password itself in the nonvolatile memory is adopted, the locked state can be released when both the storage device 5 and the nonvolatile memory 7 are taken out. Further, since the authentication password itself is in a raw state (not encrypted), the security level is low. Furthermore, in the case of this method, if the password is forgotten when the nonvolatile memory 7 fails, there is a disadvantage that the locked state of the storage device 5 cannot be released and the system cannot be recovered. This inconvenience is also caused by a conventional method of requiring a sequential user to input a password. On the other hand, in the present embodiment, even when the nonvolatile memory 7 and the storage device 5 are taken out, the lock of the storage device 5 cannot be released only by the key code stored in the nonvolatile memory 7, so that the authentication password Since the device itself can be kept secret, high security can be realized for the storage device 5. Further, by making the calculation formula used when generating the password an individual calculation formula for each predetermined computer system, making the calculation formula difficult to predict, higher security can be realized.

  In addition, if the key code is separately managed as an individual value in the computer system, the key code is reset in another nonvolatile memory even when a failure occurs in the nonvolatile memory 7. Thus, it can be easily restored.

  As described above, the information protection device, the computer system, and the information protection method according to the present invention are useful for a computer system that restricts access to a storage device with a password, and in particular, a computer system that requires user convenience. Suitable for

1 Control device (CPU)
2 Display device 3 Chipset 4 System memory 5 Storage device 6 I / O controller HUB
7 Nonvolatile Memory 8 Keyboard Controller 9 Keyboard 11 Key Code Setting Unit 12 Lock / Unlock Detection Unit 13 Password Generation Unit 14 Lock / Unlock Control Unit 15 Startup Processing Unit 51 Password Storage Unit 52 Password Comparison Unit 53 Data Storage Unit 54 Management 71 Key code storage

Claims (8)

A storage device in which protection information is stored together with the OS and can be set to a locked state in which reading / writing to itself is prohibited and an unlocking state in which reading / writing to itself is allowed, and a control to issue a command to the storage device before the OS is started An information protection device having the device therein,
When the power is turned on, before the control device reads the OS from the storage device, the storage device is inquired by the command whether the storage device is in the locked state or unlocked state, and based on the response to the inquiry, Lock / unlock detection means for detecting whether the storage device is locked or unlocked;
Each information protection device is unique and is not shared with other information protection devices, and is set so that it does not match the value stored in other information protection devices, and a failure has occurred. Key code storage means provided in a specific storage area in the information protection device for storing a key code as a fixed value that is separately managed for time and does not require an input by a user operation in advance ,
The control device obtains the key code by accessing the key code storage means provided in a specific storage area in the information protection device, and the information protection device includes the key code storage means In the event of a failure, a key code separately managed for the time of the failure is obtained, reset in the key code storage means of the information protection device recovered from the failure, and the reset key code Password generating means for accessing the storage means, obtaining the key code, and generating a unique password for each information protection device based on the key code and a predetermined calculation formula;
If the detection result of the lock / unlock detection means is in the unlocked state, the password is notified to the storage device as a set password, and if the detection result of the lock / unlock detection means is in the locked state, Lock and unlock control means for notifying the storage device of the password as an authentication password before starting the OS,
The storage device includes password storage means for storing the setting password;
When the lock / unlock detection means makes an inquiry about whether or not it is locked by the command, it returns a response including information on whether or not it is locked, and from the password storage means A management unit that releases its own lock state when the read setting password matches the authentication password notified from the lock / unlock control unit;
When the control device detects release of the lock state of the storage device, the control device reads the OS from the storage device and starts the system.
An information protection device.   2. The information protection apparatus according to claim 1, wherein the key code storage means is a non-volatile memory.   The information protection device according to claim 1, wherein the storage device is a storage device that conforms to the ATA standard.   4. The information protection apparatus according to claim 3, wherein the lock / unlock detection means periodically transmits an IDENTIFY DEVICE command to inquire whether the storage device is in a locked state or an unlocked state.   The information protection apparatus according to claim 1, wherein the predetermined calculation formula is different for each information protection apparatus.   The information protection apparatus according to claim 1, wherein the key code is a serial number of a computer system in which the information protection apparatus is mounted.   A computer system comprising the information protection apparatus according to claim 1. A storage device in which protection information is stored together with the OS and can be set to a locked state in which reading / writing to itself is prohibited and an unlocking state in which reading / writing to itself is allowed, and a control to issue a command to the storage device before the OS is started An information protection method in a computer system having an apparatus therein,
When the power is turned on, before the control device reads the OS from the storage device, the storage device is inquired by the command whether the storage device is in the locked state or unlocked state, and based on the response to the inquiry, A lock / unlock detection step for detecting whether the storage device is locked or unlocked;
Respectively for each information protection system is unique, without shared with other information protection apparatus, a value set so as not to match the value stored in another information protection apparatus, yet failure In a key code storage means provided in a specific storage area in the information protection device for storing a key code as a fixed value that is separately managed for time and does not require input by a user operation in advance , A key code storing step for storing the key code;
The control device obtains the key code by accessing the key code storage means provided in a specific storage area in the information protection device, and the information protection device includes the key code storage means When a failure occurs, a key code separately managed for the time of the failure is obtained and reset in the key code storage means of the information protection device recovered from the failure, and the reset key A password generating step of accessing a code storage means, acquiring the key code, and generating a unique password for each information protection device based on the key code and a predetermined calculation formula;
When the detection result of the lock unlock detection step is unlocked, a setting password notification step of notifying the storage device of the password as a setting password;
An authentication password notifying step for automatically notifying the storage device of the password as an authentication password before starting the OS when the detection result of the lock / unlock detection step is in a locked state;
A password storage step in which the storage device stores the setting password;
A locked state in which the storage device returns a response including information on whether or not it is in a locked state when an inquiry is made as to whether or not it is locked in the lock / unlock detection step by the command A return step;
The storage device, the unlocking step of releasing its own locked state when the set password stored in the password storing step and the authentication password notified in the authentication password notifying step match;
A startup step of starting the system by reading out the OS from the storage device when the control device detects the release of the locked state of the storage device;
including,
An information protection method characterized by the above.

Images