JP5806187B2 - Secret information exchange method and computer - Google Patents

Description

  The present invention relates to a technique for securely exchanging secret information between a plurality of computer systems.

  Since portable computers are prone to theft, guidance to obligate encryption of data stored in disk drives such as magnetic disk drives (HDD) or solid state drives (SSD) from the viewpoint of protecting personal information in recent years. There are countries that are considering the legislation in the future. There are also companies that require encryption of data stored on portable computers that may be taken outside the company. Windows (registered trademark) has a function called BitLocker (registered trademark) that encrypts files stored in a disk drive in units of volumes divided by partitions, and EFS (Encrypting File System) that encrypts files in units of individual files. Provide the function.

  As a premise that data can be protected by encrypting data in volume units or individual file units, it is necessary to store the encryption key securely and make it available only to the encrypted user. By the way, in a computer system, a plurality of systems having different operating environments may share one disk drive (hereinafter referred to as a shared disk drive). As a typical computer system, there is a hybrid PC in which two operating environments having different functions and power consumption are realized in a portable computer.

  In a shared disk drive, in order to use data encrypted in one operating environment in the other operating environment, it is necessary to securely pass the encryption key to the correct partner. Even if the encryption key is stored safely in each operating environment, the risk of being attacked increases by transferring it to the other operating environment. For example, there is a risk that the encryption key is wiretapped in such a way that an eavesdropping device is incorporated between the primary operation environment and the secondary operation environment of the stolen hybrid PC or the operation environment for receiving the encryption key is tampered with. Will increase.

  When the operating environments are connected to each other via a network, there is a method for securely exchanging encryption keys by a public key infrastructure (PKI) method using an external certificate authority. There is also a method in which a user uses a token storing an encryption key without transferring between operating environments. Patent Document 1 discloses a hybrid computer configured by two computer systems each including a processor. One system is equipped with highly functional hardware and software and consumes a large amount of power, and the other system is configured to be the opposite.

  Patent Document 2 discloses a hybrid computer that reduces power consumption of an idle computer. It is described that the primary operating environment EC and the secondary operating environment embedded system are connected, and the primary operating environment and the secondary operating environment boot in cooperation with each other. Patent Document 3 describes a technique for encrypting shared data. The data creator's RMS application encrypts the business data and registers the encryption key in the RMS server. When the data user accesses the RMS server and is authenticated, the data user can acquire the encryption key and decrypt the encrypted data.

US Patent Application Publication No. 2010/0088531 JP 2012-118891 A International Publication No. WO 2008/14639

  When transferring an encryption key for sharing an encrypted file stored in a shared disk drive, the transfer source must authenticate that the transfer destination is an authentic sharer. Also, it is necessary to authenticate that the transfer destination is a genuine sharer so that the encrypted file decrypted by the illegal command received from the unauthorized transfer source cannot be read by the unauthorized transfer source. In the method using the certificate authority via the network, the encryption key cannot be transferred when the hybrid computer cannot be connected to the network.

  In addition, an extra burden is required to use the certificate authority. Furthermore, even if the encryption key can be stored safely, the risk of eavesdropping increases because malware may operate in the operating environment connected to the network. In the method using tokens, the management and operation of tokens are complicated. It is a heavy burden on the user to ask the user to input the encryption key every time. Further, when the shared disk drive is a boot disk, it is necessary to receive an encryption key before starting to load an encrypted boot file from the shared disk drive at the time of booting. In order to exchange encryption keys between different operating environments such as hybrid computers, it is necessary to solve these various problems.

  Accordingly, an object of the present invention is to provide a method for securely exchanging secret information between different operating environments installed in a hybrid computer. It is a further object of the present invention to provide a method for exchanging secret information in a simple manner. It is a further object of the present invention to provide a method for exchanging secret information in an environment where connection to a network is not possible. A further object of the present invention is to provide a method for exchanging secret information without requiring the user to input a new password.

  A further object of the present invention is to provide a method for securely exchanging encryption keys for decrypting encrypted files. It is a further object of the present invention to provide a method for exchanging an encryption key for decrypting an encrypted file stored on a boot disk. A further object of the present invention is to provide a computer and a computer program for realizing such a method.

  In one aspect of the present invention, a primary operation in a computer including a primary operating environment and a secondary operating environment each including a processor and software, and a shared disk drive shared by the primary operating environment and the secondary operating environment. A method for transferring an encryption key from an environment to a secondary operating environment is provided. The primary operating environment stores the encryption key. The primary operating environment stores the encrypted file generated by encrypting the shared file using the encryption key in the shared disk drive. Each firmware is executed at the time of booting to construct a primary operating environment and a secondary operating environment. The encryption key is transferred from the primary operating environment to the secondary operating environment before each operating system is loaded.

  Since the encryption key is transferred in the execution environment of the firmware before the operating system is loaded, it is possible to improve resistance to attacks from malware operating using the operating system. The encryption key is also transferred before the operating system is loaded, so even if the shared disk drive is the boot disk and the boot file is encrypted or the volume is encrypted, -The system can start to boot. Even when the encryption key is used for wireless communication, the encryption key can be used when the boot is completed.

  Prior to transferring the encryption key, the primary operating environment may authenticate the secondary operating environment using an identifier that proves the authenticity of the secondary operating environment. As a result, it is possible to prevent the encryption key from being transferred to the replaced illegal secondary operating environment. Furthermore, even in an environment where the certificate authority cannot be used, an encryption key can be passed to a genuine party. As an identifier used for authentication, an identifier of a security chip for ensuring the safety of the secondary operating environment can be used. Furthermore, the primary operating environment may be authenticated using an identifier that proves the authenticity of the primary operating environment before transferring the encryption key.

  Before transferring the encryption key, the primary operating environment may verify whether or not the firmware for transferring the encryption key has been tampered with. As a result, it is possible to prevent the falsified firmware from acquiring an encryption key that is securely stored in the primary operating environment. The firmware for transferring the encryption key may be firmware such as BIOS for constructing the primary operating environment, or may be firmware dedicated for the microprocessor. If the encryption key to be transferred is encrypted with a one-time password, the risk of eavesdropping on the encryption key being transferred can be reduced.

  If the encryption key received by the secondary operating environment is erased when the power is stopped, the risk of the eavesdropping of the encryption key through the secondary operating environment can be eliminated. If the encryption key is encrypted so that it can be decrypted with the login password for the operating system and stored in the primary operating environment, the user can encrypt the shared file without entering an additional password.

  In order to store the encrypted file, a common key for encrypting the shared file may be generated, and the common key may be encrypted with the public key. The encryption key to be transferred can be a private / public key pair. The secondary operating environment can edit the shared file obtained by decrypting the encrypted file with the private key, and store the encrypted file generated by encrypting the edited shared file with the public key in the shared disk drive. . As a result, the encrypted file edited by the secondary operating environment can also be accessed from the primary operating environment.

  Another aspect of the present invention provides a method for transferring secret information from a primary operating environment to a secondary operating environment in a computer including a primary operating environment and a secondary operating environment each comprising a processor and software. The primary operating environment stores confidential information. Each firmware is executed at the time of booting to construct a primary operating environment and a secondary operating environment. The secret information is transferred from the primary operating environment to the secondary operating environment before each operating system is loaded. The secret information may be a file encryption key or an encryption key used for communication with the wireless base station.

  According to the present invention, a method for securely exchanging secret information between different operating environments installed in a hybrid computer can be provided. Furthermore, according to the present invention, a method for exchanging secret information by a simple method can be provided. Furthermore, according to the present invention, it is possible to provide a method for exchanging secret information in an environment where connection to a network is not possible. Furthermore, according to the present invention, it is possible to provide a method for exchanging secret information without requiring a user to input a new password.

  Furthermore, according to the present invention, it is possible to provide a method for securely exchanging an encryption key for decrypting an encrypted file. Furthermore, according to the present invention, it is possible to provide a method for exchanging an encryption key for decrypting an encrypted file stored in a boot disk. Further, according to the present invention, a computer and a computer program for realizing such a method can be provided.

It is a functional block diagram which shows the structure of the main hardware of a hybrid PC. It is a functional block diagram which shows the structure of the main software of a hybrid PC. It is a flowchart which shows the procedure which transfers an encryption key. It is a figure explaining the procedure which encrypts a file by EFS. It is a figure explaining the procedure which encrypts a file.

[Configuration of hybrid PC]
FIG. 1 is a functional block diagram showing a main hardware configuration of a notebook PC (hereinafter referred to as a hybrid PC) 10 equipped with a hybrid system. The hybrid system implements two operating environments, a primary operating environment and a secondary operating environment. Here, the operating environment is a concept composed of hardware and software that perform cooperative operation, and hardware such as a processor, peripheral devices, and a chip set, an operating system (OS), an application program (application), It can be defined by the concept of a computer system that performs a coherent process composed of software such as a device driver and firmware such as BIOS. It should be noted that the hardware and software elements constituting the hybrid system may belong to only one of the operating environments or both.

  The primary operating environment and the secondary operating environment are a stage in which the firmware such as BIOS initializes and inspects the device at the time of booting, the stage in which the OS is loaded into the main memory, and the boot is completed. Includes a step in which The hybrid PC 10 can individually control the power states of the primary operating environment and the secondary operating environment, and only the CPU included in one of the operating environments acquires the control right of the entire hybrid system.

  The operating environment can be dynamically switched bidirectionally under the control of the computer itself or through the user interface. The primary operating environment can exhibit the maximum function when operating in this operating environment in the main operating environment of the hybrid PC 10. The secondary operating environment can be configured with hardware and software having lower functions than the primary operating environment.

  For example, the hardware in the secondary operating environment can be configured to have a lower operating frequency, a narrower bus bandwidth, and a smaller memory storage capacity than the hardware in the primary operating environment. In the secondary operating environment, it is possible to execute an application that is configured more simply while having substantially the same function as the application executed in the primary operating environment. Alternatively, in the secondary operating environment, only processing that places a low burden on the processor such as a Web browser and music playback software can be executed. Therefore, when the hybrid PC 10 operates in the secondary operation environment, the power consumption can be significantly reduced compared to when the hybrid PC 10 operates in the primary operation environment.

  The device of the hybrid PC 10 includes a primary dedicated device group 100, a secondary dedicated device group 200, a shared device group 20, and a basic device group 50. Since the hardware configuration of the hybrid PC 10 is well known, it will be described to the extent necessary for understanding the present invention. The primary dedicated device group 100 includes a CPU 101, a main memory 103, a video card 105, a PCH (Platform Controller Hub) 107, a TPM (Trusted Platform Module) 109, a BIOS_ROM 111 that stores a system BIOS, an HDD 113, and wireless communication. Network interface card (NIC) 115 and operates only in the primary operating environment.

  As an example, the CPU 101 can be an X86 processor. The specification of the TPM 109 is defined by TCG (Trusted Computing Group). The TPM 109 has a function of verifying the legitimacy of the platform with a security chip attached to the motherboard of the primary operating environment and a function of verifying the consistency of the program of the primary operating environment. When the TPM is removed from the motherboard, at least the primary operating environment will not function, so the presence of the TPM can prove a reliable primary operating environment.

  The BIOS_ROM 111 stores a system BIOS that is firmware that is executed first at the time of startup and includes firmware that performs POST such as initialization and setting of a device and code that performs processing corresponding to the ACPI standard. The system BIOS includes a code called CRTM (Core. Root of Trust for Measurement) that checks whether all programs in the primary operating environment are falsified. The CRTM is stored in an area (boot block) that cannot be rewritten without the special authority of the BIOS_ROM.

  The system BIOS performs initialization processing of the primary dedicated device group 100 and the shared device group 20, loading of a boot file from the HDD 113 to the main memory 103, and the like. The system BIOS may be configured to perform processing for sending an encryption key from the primary operating environment to the secondary operating environment. The HDD 113 is a boot disk for a primary operating environment that stores a boot file that is read into the main memory 103 and executed by the CPU 101 in order to realize the primary operating environment.

  The secondary dedicated device group 200 includes an SOC (System on a chip) type embedded system 201, a main memory 203, and a NIC 215 for wireless communication, and operates only in the secondary operating environment. To do. In the embedded system 201, in addition to the function of the CPU 201a, the function of the chip set and the function corresponding to the system BIOS are incorporated in one semiconductor device. The chip set functions include the video controller 201b, the memory controller 201c, and all or main interface 201d functions supported by the PCH 107. As an example, the CPU 201a may be an ARM (Advanced RISC Machine) processor developed by Acorn, UK. The CPU 201a is a type used for mobile phones and smartphones, and consumes much less power than the CPU 101.

  The embedded system 201 includes a BSP_ROM 201 f that stores firmware called BSP (Board Support Package) corresponding to the system BIOS. The BSP is a software library necessary for the CPU 201a to execute the OS. The BSP is an initialization process code of the secondary dedicated device group 200 and the shared device group 20 operating in the secondary operation environment, a memory mapping process code, and It consists of device drivers and so on.

  The BSP performs a process of transferring the encryption key of the encrypted file stored in the FSD 213 from the primary operation environment to the secondary operation environment in cooperation with the EC 57. An MTM (Mobile Trusted Module) 201f is a security chip that is attached to the board of the embedded system 201 and corresponds to the TPM 109 for constructing a reliable secondary operating environment. The PCH 107 and the embedded system 201 are configured to exchange data with each other by connecting a USB port and other interfaces with the data / command line 31. The CPUs 101 and 201 a can use the data / command line 31 after the respective OSs are loaded into the main memories 103 and 203.

  As an example, the shared device group 20 includes an LCD 11, a USB terminal 21, an audio device 23, an input device 27, and a flash storage device (FSD) 213. The switch 13 connects the LCD 11 to either the video card 105 or the video controller 201b. The switches 15 and 17 connect the USB terminal 21 and the audio device 23 to either the PCH 107 or the corresponding interface port of the embedded system 201. The switches 13 to 17 are switched by an embedded controller (EC) 57. The shared device group 20 belongs to one of the operating environments depending on the operation of the switches 13, 15, and 17.

  The FSD 213 is a shared disk drive that operates in either the primary operating environment or the secondary operating environment, but the operating environment may be switched by a switch like other devices. The primary operating environment accesses FSD 213 via data / command line 31 and embedded system 201. The FSD 213 can mount a NAND flash device directly on the embedded system 201 or can be mounted as an SD card. In the application of the present invention, the type of the FSD 213 is not particularly limited, and may be a disk drive such as an HDD. The FSD 213 is a boot disk for a secondary operating environment that stores a boot file that is read into the main memory 203 and executed by the CPU 201a in order to realize the secondary operating environment.

  The basic device group 50 includes devices related to basic operations such as power management and temperature management of the hybrid PC 10, and operates in any operating environment. The basic device group 50 includes an EC 57 and a power source 59. The power source 59 includes an AC / DC adapter, a charger, a battery pack, a power supply control circuit, a DC / DC converter, a heat exhaust fan, and the like. The EC 57 is a microcomputer composed of a CPU, a ROM, an EEPROM, a DMA controller, an interrupt controller, a timer, and the like, and includes an SM bus (System Management Bus) port, an SPI (Serial Peripheral Interface) bus port, and a UART. (Universal Asynchronous Receiver Transmitter) port.

  The EC 57 operates independently from the CPU 101 and the CPU 201a, and controls the power supplied to the device mounted on the hybrid PC 10 according to the power state and manages the temperature inside the system housing. The EC 57 performs processing for switching between the primary operating environment and the secondary operating environment. Firmware that is executed by the CPU of the EC 57 is stored in the ROM of the EC 57.

  The EC 57 is connected to the embedded system 201 through the side band 33 and can send input from the input device 27 to either the PCH 107 or the embedded system 201. As an example, the interface of the side band 33 can employ UART or SPI. The EC 57 transfers a signal for detecting the presence of the embedded system 201 or notifying the embedded system 201 of the activation of the power supply through the side band 33.

  The embedded system 201 transmits a signal for detecting the presence of the primary operating environment or requesting the EC 57 to change the power state through the side band 33. When booting, the system BIOS or EC57 and BSP decrypt the files stored in the FSD 213 from the primary operating environment to the secondary operating environment through the side band 33 before each OS is loaded into the main memory 103, 203. Transfer the encryption key for

  Note that FIG. 1 is only a simplified description of the main hardware configuration and connection relations related to the present embodiment in order to describe the present embodiment. In addition to those mentioned in the above description, many devices are used to configure the hybrid PC 10. However, they are well known to those skilled in the art and will not be described in detail here. A person skilled in the art arbitrarily selects a plurality of blocks described in FIG. 1 as one integrated circuit or device or conversely divides one block into a plurality of integrated circuits or devices. To the extent possible, it is included in the scope of the present invention.

  Further, the division between the primary exclusive device group 100 or the secondary exclusive device group 200 and the shared device group 20 is not necessarily limited to that illustrated in FIG. For example, the encryption file to be shared by storing the HDD 113 in the shared device group 20 can also be stored. In addition, the types of buses and interfaces connecting the devices are not particularly limited to the present invention, and the present invention is within the scope that can be arbitrarily selected by those skilled in the art even for other connections. Included in the range. The hybrid PC 100 may physically include the shared device group 20 and the basic device group 50 in one operating environment so that the primary operating environment and the secondary operating environment can be separated.

Software configuration
FIG. 2 is a functional block diagram showing a main software configuration of the hybrid PC 10. Software executed in the primary operating environment includes a document application 151, a synchronization application 153, an OS 155, device drivers 157 and 161, and a system BIOS 158. Software executed in the secondary operation environment includes a document application 251, a synchronization application 253, an OS 255, device drivers 257 and 261, and a BSP 258. The document applications 151 and 251 are examples of application programs that operate using the services of the OSs 155 and 255. The document application 251 is configured more simply than the document application 151, and the burden on the CPU 201a to be executed becomes light.

  The synchronization applications 153 and 253 perform switching processing between the primary operating environment and the secondary operating environment while exchanging messages with each other through the data / command line 31. The OS 155 can be Windows (registered trademark) as an example, and the OS 255 can be Android (registered trademark) or Linux (registered trademark) as an example. However, the present invention can be applied to the case where the OS 155 and the OS 255 are the same or other than those exemplified here. The OS 155 includes an encryption function called EFS provided by NTFS. EFS consists of a kernel mode component, a local security authentication subsystem (LSASS), and a user mode DLL that communicates with an encryption DLL.

  The cryptographic module 256 decrypts the common key using the secret key used by the EFS, and further decrypts the encrypted file stored in the FSD 213 using the common key. The encryption module 256 generates a common key that is a random numerical value after editing the decrypted encrypted file, and encrypts the edited file using the common key. Further, the encryption module 256 encrypts the common key using the public key used by EFS.

  The device driver 157 is a program for controlling the operation and data communication of the controller 159 of the primary exclusive device group, and the device driver 257 is for controlling the operation of the controller 259 of the secondary exclusive device group and the data communication. It is a program to do. The device drivers 161 and 261 are programs for controlling the operation of the controller 51 of the shared device group 20 and data communication. The device drivers 161 and 261 each set a controller of the shared device group 50 and an input / output device connected to the shared device group 50 each time an operating environment is acquired without considering the control right of the hybrid PC 10.

[Encryption key transfer procedure]
FIG. 3 is a flowchart showing a procedure for transferring the encryption key for decrypting the encrypted file stored in the FSD 213 by the CPU 101 to the embedded system 201. 4 and 5 are diagrams for explaining a procedure for encrypting a file. In block 301, the hybrid PC 100 encrypts the file created by the document application 151 operating in the primary operating environment and stores the encrypted file in the FSD 213. The present invention can be applied to the case where the file stored in the FSD 213 is encrypted by either the volume unit or the file unit. Here, as an example, a method of encrypting the file unit with reference to FIG. 4 and FIG. I will explain.

First, the user performs an operation of encrypting a file created by the document application 151 using an interface provided by Windows. Next, the EFS 156 assigns the private / public key pair 185 and 187 to the user account to be encrypted. In the subsequent encryption, the EFS 156 continues to use the first assigned private / public key pair 185, 187 for the same account.

  Next, the EFS 156 generates a random numerical value for the shared file 181 to be encrypted to generate a file encryption key (FEK) 183. The FEK 183 is a common key used when encrypting with a symmetric encryption method. Next, the EFS 156 uses the FEK 183 to encrypt the shared file 181 and generate an encrypted file 184. Next, the EFS 156 encrypts the FEK 183 with the public key 187 to generate an encrypted FEK 189.

  Next, the EFS 156 adds the data decryption field (DDF) 191 including the encrypted FEK 189 to the encrypted file 184 to create an encrypted file structure 190 and stores it in the FSD 213. The DDF 191 stores a user security ID, an EFS hash certificate, and the like in addition to the encrypted FEK 189 encrypted with the public key 187.

  In this embodiment, both the secret key 185 and the public key 187 are encrypted by the OS 155 with a master key that is a random numerical value and stored in the HDD 113. The master key is encrypted with a Windows login password. Accordingly, secret / public key pairs 185 and 187 cannot be acquired by a user other than the logged-in user and a user who has been properly received from the user.

  Since the login password is required when logging in to Windows, it is not necessary to input an additional password in order to share the encrypted file 184. In the present invention, instead of the login password, the user may input a dedicated password for sharing the encrypted file 184. At this time, the file system of the OS 255 in the secondary operating environment has not acquired the secret key 185 generated by the OS 155 and cannot access the encrypted file 184 of the FSD 213.

  In block 303, when the power button is pressed, the EC 57 switches the switches 13 to 17 to the primary operating environment side and supplies power to the primary dedicated device group 100 and the shared device group 20. The reset CPU 101 first loads the system BIOS 158 into the main memory 103 and executes CRTM. The CRTM verifies the consistency of the EC57 firmware at block 305 after verifying the consistency of the system BIOS 158. The CRTM stores a hash value of the genuine firmware of the EC 57 and a public key corresponding to a secret key obtained by encrypting the hash value. The CRTM can verify whether the firmware has been tampered with by decrypting the hash value encrypted by the EC57 firmware with the secret key with the public key and comparing it with the stored hash value.

  By verifying the consistency, it is possible to prevent the secret / public key pair 185 and 187 created by the OS 155 from passing over to an illegally attached EC. In block 307, when the EC 57 recognizes that the embedded system 201 exists in the hybrid PC 10 through the side band 33, the EC 57 supplies power to the secondary dedicated device group 200. When power is supplied to the secondary dedicated device group 200 in block 401, the embedded system 201 first executes the BSP 258. The BSP 258 consistency verification code measures the consistency of the BSP 258.

  When EC 57 receives notification through side band 33 that BSP 258 has not been tampered with, block 309 verifies the authenticity of embedded system 201. If the TPM 109 and the MTM 201f are tampered with or removed, the respective operating environments do not function. Therefore, the authenticity of each operating environment can be proved by indicating the existence thereof. The TPM 109 and the MTM 201f securely store each other's identification information when the factory is shipped. The EC 57 authenticates the embedded system 201 by requesting the identification information of the MTM 201f from the CPU 201a.

  With this authentication, the private / public key pair 185 and 187 can be prevented from passing to the secondary operating environment where the primary operating environment is illegal. In step 403, the CPU 201e that has received the notification of successful authentication through the side band 33 requests authentication information of the TPM 109 from the EC 57 and performs authentication. This authentication can prevent a situation where an unauthorized primary operating environment sends an unauthorized command that decrypts the encrypted file 184 and stores it as a plaintext shared file in the secondary operating environment. The identification information used for mutual authentication need not be limited to the identifiers of the TPM 109 and MTM 201f, and may be the identification information stored in the secure storage areas of the BIOS_ROM 111 and the BSP_ROM 201e at the time of factory shipment. The mutual authentication may be performed by the system BIOS 158 and the BSP 258.

  When the mutual authentication is completed, blocks 311 and 405 generate a one-time password (common key) used for encryption when the private / public key pair is transferred through the side band 33. The one-time password can be generated by a time synchronization method using tokens of the same algorithm held by each other, or can be generated by a challenge response method using the same functions held by each other.

  In block 313, the EC 57 encrypts the private / public key pair 185 and 187 with a one-time password, and then transfers the encrypted private / public key pair 185 and 187 to the CPU 201a through the side band 33. Since the OSs 155 and 255 are not loaded at this point, the risk of eavesdropping by malware can be reduced. Since the EC 57 and the CPU 201a execute firmware whose consistency has been verified and transfer the private / public key pairs 185 and 187, unauthorized transfer can be prevented. Even if an eavesdropping device is inserted into the side band 33, the secret / public key pair is encrypted with a one-time password, so that the risk of eavesdropping can be reduced. Since the communication of the side band 33 is secured, the encryption with the one-time password can be omitted.

  In block 407, the CPU 201a stores the received private / public key pair only in the main memory 203 or other volatile memory and not in the non-volatile memory of the secondary operating environment. Since the secret / public key pair 185 and 187 disappears when the power supply of the secondary operating environment is stopped, the risk of eavesdropping can be reduced. At block 315, POST of the system BIOS 158 ends, and the boot loader is read from the head sector of the HDD 113 to the main memory 103. Thereafter, the boot file is loaded in order, and the boot of the OS 155 is completed. In block 409, when the POST by the BSP 258 is completed, the OS 255 is loaded into the main memory 203 and the boot is completed.

  Since the private / public key pair 185, 187 is transferred to the secondary operating environment before starting the loading of the OS 255, the encryption module 256 uses the private key even if the boot file stored in the FSD 213 is encrypted. The encrypted FEK 189 can be decrypted and the encrypted file 184 can be decrypted with the FEK 183 to load the boot file. In block 317, the document application 151 creates a new file. The EFS 156 creates a new FEK for the new file and creates an encrypted file. The EFS 156 stores the new encrypted file structure created by encrypting the new FEK with the public key 187 in the FSD 213.

  In block 411, when accessing the encrypted file 184 stored in the FSD 213, the document application 251 calls the encryption module 256 and decrypts the encrypted FEK 189 stored in the DDR 191 with the private key 185 received in block 407. Then, the encrypted file 184 is decrypted with the decrypted FEK 183. When the document application 251 edits the decrypted shared file 181 and stores it in the FSD 251, the document application 251 calls the encryption module 251, encrypts it with the randomly generated FEK, and encrypts the new FEK with the public key 187 received in block 407. To create an encrypted file structure.

  In the above example, the example in which the primary operating environment first generates and stores the encrypted file structure 190 has been described. However, the secondary operating environment uses the secret / encryption key pair received from the primary operating environment. The encrypted file structure may be generated and stored first. Further, although an example in which the FSD 213 is a shared disk drive has been described, the HDD 113 in the primary operating environment may be a shared disk drive, and both the FSD 213 and the HDD 113 may be a shared disk drive.

  When the OSs in the primary operating environment and the secondary operating environment both support multi-users, a secret / public key pair may be created for each account. In this case, authentication information for each user is stored in the BIOS_ROM 111, and the authentication information of the user authenticated at the boot stage by the system BIOS 158 and the private / public key pair are sent to the secondary operating environment, so that only the authenticated user can be authenticated. Encrypted files can be shared. Further, although an example of using EFS that employs a common key and a PKI method for sharing an encrypted file has been described, the present invention is applied to a method for encrypting a shared file using only a common key or PKI. You can also.

  The secret / public key pair 185 and 187 for sharing a file as secret information transferred through the side band 33 has been described as an example. The secret information is accessed by the NIC 115 in the primary operating environment and the NIC 215 in the secondary operating environment. It may be an encryption key such as WEP or WPA used for communication with a common wireless base station. In this case, since the secondary operating environment can acquire the encryption key when the booting of the OS 255 is completed, the start of wireless communication is not delayed.

  Although the present invention has been described with the specific embodiments shown in the drawings, the present invention is not limited to the embodiments shown in the drawings, and is known so far as long as the effects of the present invention are achieved. It goes without saying that any configuration can be adopted.

10 Hybrid PC
20 Shared Device Group 50 Basic Device Group 100 Primary Dedicated Device Group 200 Secondary Dedicated Device Group 201 Embedded System 190 Encrypted File Structure 191 Data Decryption Field (DDF)

Claims (20)

A primary operating environment and secondary operating environment comprising the steps of after loading previous phase and boot completion of the operating system, respectively, in a computer having a shared disk drive in which the primary operating environment and said secondary operating environment shared A method of transferring an encryption key from the primary operating environment to the secondary operating environment, comprising:
The primary operating environment in the stage after the completion of the boot stores an encryption key;
Storing in the shared disk drive an encrypted file generated by the primary operating environment at the stage after completion of the boot encrypting the shared file with the encryption key;
A step of constructing the second operating environment of the load before the step and the primary operating environment of the load prior to step,
Method comprising the step of transferring the encryption key to the second operating environment of the stage before the load from the primary operating environment of the stage before the load.   The method of claim 1, comprising prior to transferring the encryption key, the primary operating environment authenticates the secondary operating environment using an identifier that verifies the authenticity of the secondary operating environment.   The method according to claim 1 or 2, further comprising the step of authenticating the primary operating environment using an identifier that proves the authenticity of the primary operating environment before transferring the encryption key. .   4. The method according to claim 1, further comprising the step of verifying whether or not the primary operating environment firmware that transfers the encryption key has been tampered with before the encryption key is transferred. 5. Method.   5. The method according to claim 1, further comprising the step of encrypting the encryption key to be transferred with a one-time password.   6. The method according to claim 1, further comprising the step of erasing the encryption key received by the secondary operating environment when the power is stopped.   The said storing step includes the step of encrypting the encryption key so that it can be decrypted with a login password for the operating system and storing it in the primary operating environment. Method. Storing the encrypted file comprises:
Generating a common key for encrypting the shared file;
Encrypting the common key with a public key,
Transferring the encryption key comprises:
The method according to any one of claims 1 to 7, further comprising a step of transferring the public key and a private key generated in a pair with the public key. Editing the shared file obtained by the secondary operating environment decrypting the encrypted file with the secret key at a stage after the boot is completed ;
9. The step of storing in the shared disk drive an encrypted file generated by the secondary operating environment encrypting the edited shared file with the public key in a stage after the boot is completed. Method. In each computers with primary operating environment and secondary operating environment comprising the steps of after loading previous phase and boot complete operating system, a method for transferring secret information from said first primary operating environment to said secondary operating environment Because
The primary operating environment in a stage after the boot is completed storing the secret information;
A step of constructing the second operating environment of the load before the step and the primary operating environment of the load prior to step,
Method comprising the steps of transferring the secret information to the secondary operating environment of the stage before the load from the primary operating environment of the stage before the load.   The method according to claim 10, wherein the secret information is authentication information for a radio base station. A first computer system including a first processor executing a first operating system or first firmware;
A second computer system including a second processor executing a second operating system or second firmware;
A shared disk drive for storing an encrypted file that can be shared by the first computer system and the second computer system;
An encryption key for decrypting the encrypted file,
From the first computer system for executing the first firmware through the side bands available before wherein the first operating system the second operating system is loaded into each of the main memory A computer that transfers the encryption key to a second computer system that executes the second firmware.   The first computer system has identification information of the second computer system stored securely, and the first computer system has the second computer system before transferring the encryption key. The computer according to claim 12, wherein the identification information is received from a computer to authenticate the second computer system.   14. The computer according to claim 13, wherein the identification information is an identifier of a security chip that functions so as not to operate the second computer system when it is removed.   The first computer system has a microprocessor that operates independently of the first processor and transfers the encryption key, and before the encryption key is transferred, the first firmware is stored in the microprocessor. 15. A computer according to any one of claims 12 to 14 that causes the computer to function to check the consistency of the firmware to be executed. Computer according to any one of claims 15 claim 12 wherein the shared disk drive is boot disk of the second computer system.   The computer according to any one of claims 12 to 16, wherein the computer is a hybrid portable computer. A primary operating environment including a first processor executing a first operating system or first firmware;
A secondary operating environment including a second processor executing a second operating system or second firmware;
Secret information held by the primary operating environment,
Executing the second firmware from the primary operating environment that executes the first firmware before the first operating system and the second operating system are loaded into respective main memories; A computer that transfers the secret information to a secondary operating environment. A primary operating environment and secondary operating environment comprising the steps of after loading previous phase and boot completion of the operating system, respectively, the computer having a shared disk drive in which the primary operating environment and said secondary operating environment shared ,
A function in which the primary operating environment at the stage after the completion of the boot has an encryption key for decrypting the encrypted file stored in the shared disk drive;
And ability to build the secondary operating environment of the primary operating environment and said load stage before the load stage before,
Computer program for realizing the function of transferring the encryption key to the second operating environment of the stage before the load from the primary operating environment of the stage before the load. A computer having a primary operating environment and secondary operating environment comprising the steps of after loading previous phase and boot completion of the operating system, respectively,
A function in which the primary operating environment in the stage after the completion of the boot holds secret information;
And ability to build the secondary operating environment of the primary operating environment and said load stage before the load stage before,
Computer program for realizing a function to transfer the secret information to the secondary operating environment of the stage before the load from the primary operating environment of the stage before the load.

Images