JP7241939B1 - Information processing system, information processing device, server, and control method - Google Patents

Abstract

An object of the present invention is to provide an information processing apparatus with enhanced security against unauthorized access. An information processing system includes an information processing device and a server. The information processing apparatus acquires first key information indicating a key operated by a user's operation on an operation unit in which a plurality of keys are arranged and a processor that executes an OS program, from the operation unit. an EC that generates second key information different from the first key information based on the key information and encryption rules that change according to time, and transmits the generated second key information to the processor; The processor transmits to the server data based on the second key information generated by the EC without obtaining the first key information. The server acquires the data based on the second key information transmitted from the information processing device, and the acquired data and the common encryption that performs the same encryption at the same time as the encryption rule used in the information processing device. First key information is obtained based on the conversion rule. [Selection drawing] Fig. 1

Description

The present invention relates to an information processing system, an information processing device, a server, and a control method.

When using information processing devices such as PCs (personal computers) and smartphones online at banks, insurance companies, online shops (electronic commerce), etc., IDs and passwords are used for important processes such as login and payment. In addition to authentication using , there is known a technique of performing two-factor authentication by having a character string of a hardware token or a security card (random number table card) answered (for example, Patent Document 1).

JP 2018-056928 A

However, hardware tokens and security cards have visible character strings used for one-time authentication.

SUMMARY OF THE INVENTION It is an object of the present invention to provide an information processing system, an information processing apparatus, a server, and a control method with enhanced security against unauthorized access.

The present invention has been made to solve the above problems, and an information processing system according to a first aspect of the present invention includes an information processing device and a server connected for communication with the information processing device. In the system, the information processing device includes a memory that temporarily stores an OS (Operating System) program, a processor that executes the OS program, and a user's input to an operation unit in which a plurality of keys are arranged. First key information indicating a key operated by an operation is obtained from the operation unit, and a second key different from the first key information is obtained based on the obtained first key information and an encryption rule that changes according to time. an EC (Embedded Controller) that generates 2-key information and transmits it to the processor, wherein the processor generates data based on the second key information generated by the EC without obtaining the first key information. to the server, and the server acquires the data based on the second key information transmitted from the information processing device, and the data based on the acquired second key information and the data used by the information processing device The first key information is obtained on the basis of the encryption rule in which the same encryption is performed at the same time and the common encryption rule in which the same encryption is performed at the same time.

In the above information processing system, the encryption rule is a change rule according to the time of the scan code corresponding to each of the plurality of keys arranged in the operation unit, and the EC is acquired from the operation unit. Based on the first key information and the time when the first key information was acquired, the first key information is converted into a scan code according to the encryption rule at the time to generate the second key information. may

In the above information processing system, the server combines the data based on the second key information based on the time when the data based on the second key information is obtained and the common encryption rule, and executes authentication processing. may

In the above information processing system, the server generates authentication data by encrypting a pre-registered character string based on the time when the data based on the second key information is acquired and the common encryption rule. , the authentication process may be executed based on the authentication data and the data based on the second key information.

In the above information processing system, the information indicating the encryption rule and the identification information of the user may be associated with each other and stored in the respective storage units of the information processing device and the server.

In the above information processing system, the information indicating the common encryption rule may be associated with the identification information of each of the plurality of users, and stored in the respective storage units of the information processing device and the server.

In the above information processing system, identification information of one user may be associated with a plurality of pieces of information indicating the encryption rule, and stored in respective storage units of the information processing device and the server.

In the above information processing system, the information indicating the encryption rule may be shipped from the factory in a state in which the information indicating the encryption rule is stored in the storage unit of the information processing device.

In the above information processing system, the information indicating the encryption rule in the information processing device may be stored in a storage unit within the EC.

In the above information processing system, the EC requests time information from a BIOS (Basic Input Output System) running on the processor, and the processor responds to the request for time information from the EC. Information on the current time may be transmitted to the EC by processing of the BIOS.

In the information processing system, the EC encrypts the first key information based on the encryption rule in response to a user's operation of a specific key among the keys arranged on the operation unit. You can switch to mode.

Further, an information processing apparatus according to a second aspect of the present invention includes a memory that temporarily stores an OS (Operating System) program, a processor that executes the OS program, and a plurality of keys arranged for operation. First key information indicating a key operated by a user's operation on the unit is acquired from the operation unit, and the first key information is based on the acquired first key information and an encryption rule that changes according to time. and an EC (Embedded Controller) that generates second key information different from the second key information and transmits it to the processor, and the processor receives the second key information generated by the EC without acquiring the first key information Send data based on

Further, according to the third aspect of the present invention, first key information indicating a key operated by a user's operation on an operation unit in which a plurality of keys are arranged is acquired from the operation unit, and the acquired first key information and an encryption rule that changes according to the time, and is connected for communication with an information processing device that generates second key information different from the first key information and transmits data based on the generated second key information. The server obtains the data based on the second key information transmitted from the information processing device, and the data based on the obtained second key information is the same as the encryption rule used in the information processing device. The first key information is obtained based on the common encryption rule in which the same encryption is performed at the time.

Further, according to a fourth aspect of the present invention, an information processing apparatus comprising a memory that temporarily stores an OS (Operating System) program, a processor that executes the OS program, and an EC (Embedded Controller); A control method in an information processing system comprising a server that is communicatively connected to a processing device, wherein, in the information processing device, the EC indicates a key operated by a user on an operation unit in which a plurality of keys are arranged. a step of acquiring first key information from the operation unit; and second key information different from the first key information by the EC based on the acquired first key information and an encryption rule that changes according to time. and transmitting to the processor, and the processor transmitting to the server data based on the second key information generated by the EC without obtaining the first key information. a step of obtaining, in the server, data based on the second key information transmitted from the information processing device; data based on the obtained second key information; and the encryption used in the information processing device. and obtaining the first key information based on an encryption rule and a common encryption rule in which the same encryption is performed at the same time.

According to the above aspect of the present invention, it is possible to provide an information processing apparatus with enhanced security against unauthorized access.

1 is a diagram showing a configuration example of an information processing system according to a first embodiment; FIG. FIG. 5 is a diagram showing a modification example of scan codes according to the first embodiment; 1 is a perspective view showing the appearance of an information processing apparatus according to a first embodiment; FIG. 1 is a block diagram showing an example of the hardware configuration of an information processing apparatus according to the first embodiment; FIG. 4 is a flowchart showing an example of authentication processing according to the first embodiment; FIG. 4 is an explanatory diagram of another example of the mechanism of password authentication according to the first embodiment; The figure which shows the structural example of the information processing system which concerns on 2nd Embodiment. The figure which shows the structural example of the information processing system which concerns on 3rd Embodiment. The figure which shows the structural example of the information processing system which concerns on 4th Embodiment.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
<First embodiment>
First, the first embodiment will be described.

FIG. 1 is a diagram showing a configuration example of an information processing system 1 according to this embodiment, and shows an example of a password authentication mechanism according to this embodiment. The illustrated information processing system 1 includes an information processing device 10 and an authentication server 80 that are communicatively connected via a network NT. The network NT is a communication network configured by one or a combination of LAN (Local Area Network), WAN (Wide Area Network), Internet, and the like. The information processing device 10 and the authentication server 80 are computer devices each having a processor, a memory, a storage device, a power supply circuit, and the like.

The information processing device 10 is, for example, a terminal device such as a PC (personal computer) or a smart phone used by a user. Here, the information processing apparatus 10 will be described as a clamshell type (notebook type) PC.

The authentication server 80 is a server device that performs user authentication when a user uses the information processing device 10 to use the system or connect (access) to a network. For example, the authentication server 80 performs user authentication when logging into online systems such as banks, insurance companies, and electronic commerce, making transactions, making payments, etc., and connects (accesses) to networks such as VPNs (Virtual Private Networks). ), performs authentication processing such as user authentication.

For the authentication processing, for example, processing such as password authentication is used, but two-factor authentication processing may be used for important processing. In conventional two-factor authentication, in addition to authentication using an ID and a password, there is a technique using a hardware token or a character string of a security card (random number table card). However, hardware tokens and security cards have visible character strings, so if they are dropped or lost, there is a risk of unauthorized access by others.

Therefore, in the information processing system 1 of the present embodiment, one-time authentication is performed using encrypted data obtained by encrypting a character string of a password key-inputted on the keyboard 32 based on an encryption rule that changes according to time. process. The encryption rule is a change rule for changing the scan code corresponding to each of the multiple keys arranged on the keyboard 32 according to time.

FIG. 2 is a diagram showing a modification of the scan code according to this embodiment. (A) at the top shows an example of a scan code map showing the correspondence relationship between the specified key layout and the scan codes. On the other hand, (B) at the bottom shows an example of a scan code map in which the correspondence relationship between the keyboard layout and the scan code is changed according to time. If the scancode map is changed, different scancodes will be sent even if the same key is operated. For example, when the character string "ABC" is entered as a password, the scan code corresponding to each key of "ABC" is sent in the standard scan code map, but if the scan code map is changed, the changed A scan code corresponding to each key of "ABC" in the scan code map will be sent.

Therefore, when the character string "ABC" entered as a password is converted to a scan code using the changed scan code map, the entered character string is unknown unless the changed scan code map is used. and it is encrypted. Specifically, for example, even if the "A" key is operated, the scan code corresponding to the "E" key in the prescribed scan code map is changed to the "A" key in the changed scan code map. If it is associated, it is encrypted as "E". Unless you know the scancode map that was used to encrypt it, you don't know that this encrypted "E" is an "A".

By changing the scan code map according to time (for example, every 30 seconds), it becomes possible to encrypt a character string input as a password with a one-time scan code. In addition to password-based authentication, the information processing system 1 performs two-factor authentication by encrypting a character string input as a password with a one-time scan code. Hereinafter, the mode in which authentication processing is performed using this one-time scan code is referred to as "one-time scan code mode". Also, in the one-time scan code mode, the scan code map that is changed depending on the time (every 30 seconds, for example) is called a "one-time scan code map".

Returning to FIG. 1, the information processing system 1 stores a "secure key" in an internal storage area. ) to generate a one-time scan code map. A "secure key" is data that stores information defining encryption rules for generating a one-time scan code map that changes according to time. For example, "secure key" generates a random number sequence based on time, and assigns the generated numerical values as scan codes to each key in order according to the order of the key arrangement. Since the one-time scan code map changes depending on the time, the character string entered as the password is encrypted into a different character string for each time.

In the example shown in FIG. 1, in the one-time scan code mode, when the character string "ABC" is input as the password, the character string "EFG" is entered at time "12:45:10" and the time "12:45:40" is entered. is encrypted into different character strings such as the character string "AHK" at time "12:46:10" and the character string "AHK" at time "12:46:10".

The encrypted data of the character string (password) encrypted by the information processing system 1 is transmitted from the information processing system 1 to the authentication server 80 via the network NT. The authentication server 80 has a common “secure key” with the information processing device 10 . A common "secure key" is a "secure key" set with the same encryption rule for generating the one-time scan code map with the same arrangement at the same time. Different "secure keys" generate different sequences of one-time scan code maps at essentially the same time.

When the authentication server 80 acquires the encrypted data from the information processing device 10 , the authentication server 80 authenticates the acquired encrypted data using the “secure key” shared with the information processing device 10 . For example, the authentication server 80 generates a one-time scan code map based on the time when the encrypted data was obtained and the "secure key", and decrypts the encrypted data using the generated one-time scan code map. If the time when the information processing apparatus 10 encrypts the data and the time when the authentication server 80 acquires the encrypted data match, the one-time scan code map used for encryption and the one-time scan code map used for compounding are the same. is an array of scancodes, so it can be decoded correctly. Here, matching of time refers to matching at each time interval (for example, 30 seconds) for generating the one-time scan code map.

For example, in the example shown in FIG. 1, when the authentication server 80 acquires encrypted data "EFG" encrypted at time "12:45:10" from the information processing apparatus 10, the acquired time is changed to time "12:45:10". 45:10" within 30 seconds, use the one-time scan code map generated based on the time "12:45:10" and the common "secure key" to decode the character string "ABC" can be done. Similarly, when the authentication server 80 acquires the encrypted data “AHK” encrypted at the time “12:45:40” from the information processing device 10, the acquired time is 30 minutes after the time “12:45:40”. Within seconds, it can be decoded into the string "ABC" using a one-time scan code map generated based on the time "12:45:40" and the common "secure key". Similarly, when the authentication server 80 acquires the encrypted data “S5T” encrypted at the time “12:46:10” from the information processing device 10, the acquired time is 30 minutes after the time “12:46:10”. Within seconds, it can be decoded into the string "ABC" using a one-time scan code map generated based on the time "12:46:10" and the common "secure key".

[External Configuration of Information Processing Device 10]
FIG. 3 is a perspective view showing the appearance of the information processing apparatus according to this embodiment.
The illustrated information processing apparatus 10 is a clamshell notebook PC (Personal Computer). The information processing apparatus 10 includes a display housing 101 in which a display unit 14 (display) is mounted, a device housing 102 in which a keyboard 32 is mounted, and a hinge mechanism 103 . The display housing 101 and the device housing 102 are substantially rectangular plate-shaped (for example, flat plate-shaped) housings.

One of the side surfaces of the display housing 101 and one of the side surfaces of the device housing 102 are coupled (connected) via a hinge mechanism 103, and the display housing 101 and the device housing are arranged around the rotation axis formed by the hinge mechanism 103. The body 102 is relatively rotatable. A state in which the opening angle θ about the rotation axis between the display housing 101 and the device housing 102 is approximately 0° is a state in which the display housing 101 and the device housing 102 are overlapped and closed (referred to as a “closed state”). ). A state in which the display housing 101 and the device housing 102 are opened with respect to the closed state is referred to as an “open state”. The open state is a state in which the display housing 101 and the device housing 102 are relatively rotated until the opening angle θ becomes larger than a preset threshold value (for example, 10°). The appearance of the information processing apparatus 10 shown in FIG. 1 shows an example of the open state.

Here, the surface on which the display unit 14 of the display housing 101 is provided is referred to as a display surface 101a, and the surface opposite to the display surface 101a is referred to as a top surface 101b. The surface of the device housing 102 on which the keyboard 32 is provided is called a keyboard surface 102a, and the surface opposite to the keyboard surface 102a is called a bottom surface 102b. In the closed state, the display surface 101a and the keyboard surface 102a are surfaces facing each other. In the illustrated example, the keyboard 32 is a physical keyboard on which a plurality of keys (an example of manipulators) for accepting user operations are arranged. In addition to the keyboard 32, a touch pad or the like may be provided on the keyboard surface 102a. A power button 35 is provided on the side surface of the device housing 102 .

In the closed state, the display surface 101a of the display housing 101 and the keyboard surface 102a of the device housing 102 face each other and overlap each other. On the other hand, in the open state, the display unit 14 is visible and the keyboard can be operated.

[Hardware Configuration of Information Processing Device 10]
FIG. 4 is a block diagram showing an example of the main hardware configuration of the information processing apparatus 10 according to this embodiment. As shown in FIG. 4, the information processing apparatus 10 includes a CPU 11, a main memory 12, a video subsystem 13, a display section 14, a chipset 21, a BIOS memory 22, a communication section 23, and an RTC power supply 25. , an embedded controller 31 , a keyboard 32 , a power supply circuit 33 , a power button 35 and a battery 60 . In addition, in FIG. 4, the same reference numerals are assigned to the configurations corresponding to the respective parts in FIG. 2, and the description thereof will be omitted as appropriate.

The CPU 11 executes various arithmetic processes under program control and controls the entire information processing apparatus 10 . For example, the CPU 11 executes processing based on programs such as an OS (Operating System) and a BIOS (Basic Input Output System).

The main memory 12 is a writable memory used as a read area for the execution program of the CPU 11 or as a work area for writing processing data of the execution program. The main memory 12 is composed of, for example, a plurality of DRAM (Dynamic Random Access Memory) chips. The execution program includes an OS, various drivers for hardware operation of peripheral devices, various services/utilities, application programs, and the like.

The video subsystem 13 is a subsystem for realizing functions related to image display, and includes a video controller. The video controller processes drawing commands from the CPU 11, writes the processed drawing information to the video memory, reads the drawing information from the video memory, and outputs it to the display unit 14 as drawing data (display data).

The display unit 14 is, for example, a liquid crystal display or an organic EL display, and displays a display screen based on drawing data (display data) output from the video subsystem 13 .

The chipset 21 supports USB (Universal Serial Bus), serial ATA (AT Attachment), SPI (Serial Peripheral Interface) bus, PCI (Peripheral Component Interconnect) bus, PCI-Express bus, and LPC (Low Pin Count) bus. It has a controller and multiple devices are connected. In FIG. 4, a BIOS memory 22, an embedded controller 31, and a storage device 40 are connected to the chipset 21 as examples of multiple devices. The chipset 21 also includes an RTC (Real Time Clock) 211 that measures time. The RTC 211 operates by power supply from the RTC power supply 25 (for example, coin battery).

The BIOS memory 22 is, for example, a non-volatile memory such as an SPI (Serial Peripheral Interface) flash memory or an EEPROM (Electrically Erasable Programmable Read Only Memory). The BIOS memory 22 stores system firmware such as BIOS programs and programs for controlling the embedded controller 31 . The BIOS memory 22 also stores BIOS data and codes, data related to control of the embedded controller 31, and the like.

The communication unit 23 includes a communication adapter compatible with wireless LAN or wired LAN, and communicates with an external device such as the authentication server 80 via the network NT.

The storage device 40 includes an SSD (Solid State Drive), an HDD (Hard Disk Drive), and the like. For example, the storage device 40 stores an OS, various drivers, various services/utilities, application programs, and various data.

An embedded controller (EC) 31 is a processor provided separately from the CPU 11 that executes OS and BIOS processing. For example, the embedded controller 31 is a one-chip microcomputer having a CPU, ROM, RAM, flash memory, multiple channels of A/D input terminals, D/A output terminals, timers, and digital input/output terminals (not shown). Microcomputer). For example, a keyboard 32, a power supply circuit 33, a power button 35, and the like are connected to the embedded controller 31 via respective input terminals. The embedded controller 31 also exchanges data with the CPU 11 via the chipset 21 connected via a bus.

For example, the embedded controller 31 receives an operation signal corresponding to a user's operation of the power button 35, and controls the power supply circuit 33 and instructs system startup. The embedded controller 31 also receives an operation signal corresponding to a user's operation on the keyboard 32 and performs processing according to the operation signal. The embedded controller 31 also executes password encryption processing in the one-time scan code mode according to this embodiment. Details of processing in this one-time scan code mode will be described later.

The keyboard 32 is an input device in which a plurality of keys (an example of manipulators) for accepting user operations are arranged. The keyboard 32 is provided on the keyboard surface 102a of the device housing 102, as shown in FIG. The keyboard 32 outputs an operation signal to the embedded controller 31 according to the user's operation. As an input device other than the keyboard 32, an arbitrary input device such as a pointing device or a touch pad may be provided at an arbitrary location.

The power supply circuit 33 includes, for example, a DC/DC converter, a charging/discharging unit, and the like. The DC/DC converter converts the voltage of DC power supplied from an AC adapter (external power supply) or battery 60 into a voltage required by each part. Electric power whose voltage is converted by the DC/DC converter is supplied to each part via each power supply system. For example, the power supply unit 400 supplies power to each unit through each power supply system based on control by the embedded controller 31 .

[One-time scan code mode]
The password encryption processing in the one-time scan code mode described with reference to FIGS. 1 and 2 is mainly executed under the control of the embedded controller 31. FIG.

The embedded controller 31 acquires from the keyboard 32 key information indicating the key operated by the user's operation on the keyboard 32 . For example, when the user operates the keyboard 32 to input the character string "ABC", the embedded controller 31 stores key information indicating the positions of the "A", "B", and "C" keys on the keyboard 32. get. Then, the embedded controller 31 generates encrypted data by encrypting the acquired key information based on an encryption rule that changes according to time.

For example, the encryption rule is a change rule according to the time of the scan code corresponding to each of the plurality of keys arranged on the keyboard 32, as described above. Based on the key information acquired from the keyboard 32 and the time when the key information was acquired, the embedded controller 31 converts the key information into a scan code according to the encryption rule at that time to generate encrypted data.

Specifically, a "secure key" defining encryption rules for generating a one-time scan code map that changes according to time is stored in a storage unit (eg, ROM, flash memory, etc.) inside the embedded controller 31. stored in The embedded controller 31 generates a one-time scan code map as an encryption rule for each time according to the "secure key" at each preset time (every 30 seconds, for example).

The embedded controller 31 acquires current time information from the BIOS executed by the CPU 11 .

Then, when a password is input by a user's operation on the keyboard 32, the embedded controller 31 acquires key information corresponding to the input character string from the keyboard 32, and the acquired key information and the key information at the time of acquiring the key information. Based on the time, the key information is converted into a scan code (one-time scan code) according to the one-time scan code map corresponding to the time and encrypted. Embedded controller 31 outputs the converted scan code to CPU 11 .

When the CPU 11 acquires the scan code output from the embedded controller 31 by the processing of the OS, the CPU 11 converts the acquired scan code into a character string (character code) based on a prescribed scan code map, and transmits the character string through the communication unit 23. Send to authentication server 80 . As a result, as described with reference to FIG. 1, when the character string "ABC" is input to the keyboard 32 as the password, the character string "EFG", the character string "AHK", the character string "S5T", and the character string "S5T" ” or the like is transmitted to the authentication server 80 .

Further, when the CPU 11 receives a request for time information from the embedded controller 31 through processing of the BIOS, the CPU 11 acquires current time information from the RTC 211 and transmits it to the embedded controller 31 . The time kept by the RTC 211 is adjusted to the correct current time as needed by a time server connected for communication via the network NT based on the processing of the OS. Also, the current time in the authentication server 80 is similarly adjusted to the correct current time by a time server or the like.

When the authentication server 80 receives and acquires encrypted character string (character code) data from the information processing device 10, the acquired time and a “secure key” (a “secure key” shared with the information processing device 10) Using the one-time scan code map (common encryption rule) generated by and, the data of the encrypted character string (character code) is compounded, and the original input by the user in the information processing device 10 get a string. The authentication server 80 then executes authentication processing. For example, the authentication server 80 combines encrypted character string (character code) data, and registers the composite character string (character string input as a password in the information processing apparatus 10) in association with the user ID in advance. User authentication is performed by matching with the password character string provided.

[Authentication processing by one-time scan code mode]
Next, the operation of authentication processing in the one-time scan code mode performed by the information processing system 1 according to this embodiment will be described.
FIG. 5 is a flowchart showing an example of authentication processing in the information processing system 1 according to this embodiment.

(Step S101) The CPU 11 starts the BIOS, and after user authentication, executes the OS startup process. Note that this user authentication at startup is, for example, one-factor authentication such as password authentication, fingerprint authentication, face authentication, etc., and is different from authentication by the one-time scan code mode. When the system is activated, the process proceeds to step S103.

(Step S103) The embedded controller 31 shifts to the one-time scan code mode in response to an operation on a specific key among the keys arranged on the keyboard 32. FIG. An operation for a specific key is, for example, an operation combining a plurality of specific keys such as "Fn"+"P". Note that the embedded controller 31 may shift to the one-time scan code mode not only by operating a specific key, but also by operating within a specific application. You can switch to mode. Then, the process proceeds to step S105.

(Step S105) The embedded controller 31 requests the CPU 11 for time information. Then, the process proceeds to step S107.

(Step S107) The CPU 11 transmits current time information to the embedded controller 31 in response to a request for time information from the embedded controller 31 by processing the BIOS. The embedded controller 31 acquires current time information from the CPU 11 (BIOS). Then, the process proceeds to step S109.

(Step S109) Embedded controller 31 generates a one-time scan code map based on the "secure key" and time. Then, the process proceeds to step S111.

(Step S<b>111 ) When a password is input by the user's operation on the keyboard 32 , the embedded controller 31 acquires key information corresponding to the input character string from the keyboard 32 . Then, the process proceeds to step S113.

(Step S113) Based on the acquired key information and the time when the key information was acquired, the embedded controller 31 scans the key information (password) according to the one-time scan code map corresponding to the time (one-time scan). code) and encrypt it. Then, the process proceeds to step S115.

(Step S115) The embedded controller 31 outputs to the CPU 11 a scan code obtained by encrypting the password. Then, the process proceeds to step S117.

(Step S<b>117 ) The CPU 11 generates encrypted data by converting the password-encrypted scan code into a character string (character code) based on a prescribed scan code map, and transmits the encrypted data via the communication unit 23 (step S<b>117 ). to the authentication server 80. Then, the process proceeds to step S201.

(Step S201) When the authentication server 80 receives the encrypted data from the information processing device 10, it acquires the encrypted data and proceeds to the process of step S203.

(Step S203) Based on the time when the encrypted data was obtained from the information processing device 10 and the one-time scan code map generated by the "secure key" shared with the information processing device 10, the authentication server 80 checks the encrypted data. are combined to obtain the character string of the original password input by the user in the information processing apparatus 10 . Then, the process proceeds to step S205.

(Step S205) The authentication server 80 executes password authentication processing based on the compounded password. For example, the authentication server 80 compares the character string of the compounded password (the character string input as the password in the information processing device 10) with the character string of the password registered in advance in association with the user ID. Perform user authentication processing.

[Summary of embodiment]
As described above, the information processing system 1 according to the present embodiment includes the information processing device 10 and the authentication server 80 (an example of a server) that is communicatively connected to the information processing device 10 . The information processing apparatus 10 includes a main memory 12 (an example of a memory) that temporarily stores an OS program, a CPU 11 (an example of a processor) that executes the OS program, and a processor provided separately from the CPU 11 . It includes an embedded controller 31 and a communication section 23 (an example of a transmission section) that communicates with the authentication server 80 . The embedded controller 31 acquires from the keyboard 32 key information (an example of first key information) indicating a key operated by a user on a keyboard 32 (an example of an operation unit) on which a plurality of keys are arranged, and acquires the key information. Encrypted data (first key An example of second key information different from the information) is generated and transmitted to the CPU 11 . The CPU 11 transmits data based on the encrypted data generated by the embedded controller 31 to the authentication server 80 without obtaining key information indicating the key operated by the user. The authentication server 80 acquires data based on the encrypted data transmitted from the information processing device 10, and the data based on the acquired encrypted data and the same encryption rule used in the information processing device 10 at the same time. Based on a common encryption rule for encryption, key information indicating a key operated by a user is obtained.

As a result, the information processing system 1 encrypts the password entered in the information processing device 10 based on the encryption rule that changes according to the time in the information processing device 10, and transmits the encrypted password to the authentication server 80. Therefore, security against unauthorized access can be enhanced. For example, in the information processing system 1, the password is encrypted inside the information processing apparatus 10, unlike conventional hardware tokens and security cards in which the character string used for one-time authentication can be visually recognized. . Therefore, the information processing system 1 can improve security against unauthorized access without fear of unauthorized access due to dropping or loss, unlike conventional hardware tokens or security cards.

For example, the encryption rule is a change rule according to the time of the scan code corresponding to each of the plurality of keys arranged on the keyboard 32, and is a one-time code generated based on the time and the "secure key". Scan code map. Based on the key information (an example of the first key information) acquired from the keyboard 32 and the time when the key information was acquired, the embedded controller 31 follows the encryption rule (for example, one-time scan code map) at that time. The key information is converted into a scan code to generate encrypted data (an example of second key information).

As a result, the information processing apparatus 10 generates a one-time scan code map according to the time, thereby converting the character string of the password input to the keyboard 32 into a different scan code according to the time and encrypting it. be able to.

The authentication server 80 encrypts the data based on the encrypted data (an example of the second key information) from the information processing device 10 based on the time and the common encryption rule (for example, the one-time scan code map). The authentication process is performed by decrypting the data based on the authentication data.

As a result, the authentication server 80 can execute the authentication process by combining the character string of the password that is converted into different scan codes according to the time and encrypted by the information processing device 10 .

In this embodiment, the authentication server 80 combines the encrypted password character string acquired from the information processing device 10 based on the common one-time scan code map to perform the authentication process. , but not limited to. For example, the authentication server 80 is registered in advance based on the time when the data based on the encrypted data (an example of the second key information) was acquired and the common encryption rule (for example, one-time scan code map). Authentication data may be generated by encrypting the character string (password), and authentication processing may be executed based on the authentication data and data based on the encrypted data (an example of the second key information). Description will be made with reference to FIG.

FIG. 6 is an explanatory diagram of another example of the mechanism of password authentication according to this embodiment. In this figure, processing in the one-time scan code mode in the information processing apparatus 10 is the same as in FIG. The authentication server 80 generates authentication data by encrypting a pre-registered character string (password) based on a one-time scan code map generated according to time (every 30 seconds, for example). The authentication data is data for matching with the encrypted data transmitted from the information processing device 10 .

In the example shown in FIG. 6, when the character string "ABC" is input as the password in the information processing apparatus 10, at time "12:45:10", it is encrypted into the character string "EFG" based on the one-time scan code map. The received data is transmitted to the authentication server 80 . In the authentication server 80, at the same time "12:45:10", authentication data encrypted into a character string "EFG" based on a common one-time scan code map with pre-registered character strings (passwords) is transmitted. generated. As a result, the authentication server 80 compares the encrypted data (character string “EFG”) transmitted from the information processing device 10 with the authentication data (character string “EFG”), thereby performing user authentication processing. to run.

As a result, the information processing system 1 encrypts the password entered in the information processing device 10 based on the encryption rule that changes according to the time in the information processing device 10, and transmits the encrypted password to the authentication server 80. Since user authentication can be performed in the authentication server 80, security against unauthorized access can be enhanced.

Note that in the present embodiment, the information processing apparatus 10 converts a scan code obtained by encrypting a character string input to the keyboard 32 as a password into a character string (character code) based on a prescribed scan code map. Although an example has been described in which encrypted data is generated and transmitted to the authentication server 80 via the communication unit 23, a scan code obtained by encrypting a character string entered as a password on the keyboard 32 is used as encrypted data by the communication unit. 23 to the authentication server 80. In this case, the authentication server 80 may perform authentication processing by decoding the encrypted scan code transmitted from the information processing device 10 based on the one-time scan code map, or a pre-registered character string ( The authentication process may be performed by collating a scan code encrypted based on a common one-time scan code map as authentication data.

Also, information (eg, “secure key”) indicating encryption rules (eg, one-time scan code map) and user identification information (eg, user ID) are associated with each other so that information processing device 10 and authentication server 80 are stored in respective storage units of .

As a result, the information processing system 1 can perform password authentication for each user as two-factor authentication processing using the one-time scan code mode.

For example, information indicating encryption rules in the information processing device 10 (for example, “secure key”) is stored in a storage unit (for example, ROM, flash memory, etc.) in the embedded controller 31 .

As a result, since the information processing apparatus 10 can perform one-time authentication using data in the hardware, there is concern about unauthorized access due to dropping or loss, unlike conventional hardware tokens and security cards. security against unauthorized access can be enhanced.

As a method of storing the "secure key" in the storage unit in the embedded controller 31 of the information processing apparatus 10, a method of downloading from a server such as the authentication server 80 that provides the "secure key" can be applied. When performing this download, in addition to password authentication, one-time authentication for entering a one-time key sent to the one-time authentication e-mail address may be used.

The embedded controller 31 requests time information from the BIOS executed by the CPU 11 . In response to a request for time information from the embedded controller 31, the CPU 11 transmits current time information to the embedded controller 31 by processing the BIOS.

As a result, the information processing apparatus 10 can generate the one-time scan code map according to the correct time, so that the authentication processing in the authentication server 80 can be performed appropriately.

The embedded controller 31 responds to a user's operation on a specific key among the keys arranged on the keyboard 32 (for example, an operation combining a plurality of specific keys such as "Fn" + "P"). Shift to time scan code mode (processing mode for encrypting key information based on encryption rules).

Thereby, the information processing apparatus 10 can execute two-factor authentication processing using the one-time scan code mode with a simple operation by the user.

As described above, the embedded controller 31 may shift to the one-time scan code mode not only by operating a specific key but also by operating within a specific application. You can switch to the one-time scan code mode with .

Further, the information processing apparatus 10 according to the present embodiment includes a main memory 12 (an example of a memory) that temporarily stores an OS program, a CPU 11 (an example of a processor) that executes the OS program, and a It includes an embedded controller 31 that is a processor provided, and a communication section 23 (an example of a transmission section) that communicates with the authentication server 80 . The embedded controller 31 acquires from the keyboard 32 key information (an example of first key information) indicating a key operated by a user on a keyboard 32 (an example of an operation unit) on which a plurality of keys are arranged, and acquires the key information. Encrypted data (first key An example of second key information different from the information) is generated and transmitted to the CPU 11 . The CPU 11 transmits data based on the encrypted data generated by the embedded controller 31 to the authentication server 80 without obtaining key information indicating the key operated by the user.

As a result, the information processing apparatus 10 encrypts the password input to the keyboard 32 based on the encryption rule that changes according to the time in the information processing apparatus 10 and transmits the encrypted password to the authentication server 80, thereby preventing unauthorized access. can increase the safety against For example, the information processing apparatus 10 encrypts the password inside the information processing apparatus 10, unlike conventional hardware tokens, security cards, etc., in which the character string used for one-time authentication can be visually recognized. Therefore, unlike conventional hardware tokens and security cards, the information processing apparatus 10 is free from concerns about unauthorized access due to dropping or loss, and can improve security against unauthorized access.

Further, the authentication server 80 according to the present embodiment stores key information (an example of first key information) indicating a key operated by a user on the keyboard 32 (an example of an operation unit) on which a plurality of keys are arranged. Obtained from the keyboard 32 and encrypted based on the obtained key information and an encryption rule that changes according to the time (for example, a one-time scan code map generated based on the time and a "secure key") Communication connection is made with an information processing device 10 that transmits data based on encrypted data (an example of second key information different from the first key information). The authentication server 80 acquires data based on the encrypted data transmitted from the information processing device 10, and the data based on the acquired encrypted data and the same encryption rule used in the information processing device 10 at the same time. Based on a common encryption rule for encryption, key information indicating a key operated by a user is obtained.

As a result, the authentication server 80 encrypts the password entered in the information processing device 10 based on the encryption rule that changes according to the time, and then transmits the encrypted password. security against unauthorized access.

Further, the control method in the information processing system 1 according to the present embodiment is such that in the information processing apparatus 10, the embedded controller 31 is operated by the user's operation on the keyboard 32 (an example of the operation unit) on which a plurality of keys are arranged. a step of acquiring from the keyboard 32 key information (an example of the first key information) indicating the key that has been acquired; and an encryption rule (for example, time and "secure a step of generating encrypted data (an example of second key information different from the first key information) encrypted based on the one-time scan code map generated based on the "key" and transmitting it to the CPU 11; a step in which the CPU 11 transmits data based on the second key information generated by the embedded controller 31 without acquiring the first key information to the authentication server 80, wherein the data is transmitted from the information processing apparatus 10 in the authentication server 80 a step of acquiring data based on the encrypted data; and common encryption in which the same encryption is performed at the same time as the encryption rule used in the information processing apparatus 10 for the data based on the acquired encrypted data. and obtaining key information indicating the key operated by the user's operation based on the rule.

As a result, the information processing system 1 encrypts the password entered in the information processing device 10 based on the encryption rule that changes according to the time in the information processing device 10, and transmits the encrypted password to the authentication server 80. Therefore, security against unauthorized access can be enhanced. For example, in the information processing system 1, the password is encrypted inside the information processing apparatus 10, unlike conventional hardware tokens and security cards in which the character string used for one-time authentication can be visually recognized. . Therefore, the information processing system 1 can improve security against unauthorized access without fear of unauthorized access due to dropping or loss, unlike conventional hardware tokens or security cards.

<Second embodiment>
Next, a second embodiment of the invention will be described.
In this embodiment, a mode will be described in which a plurality of users can share and use one "secure key".

FIG. 7 is a diagram showing a configuration example of an information processing system 1A according to this embodiment. In the information processing system 1A according to the present embodiment, information indicating a common encryption rule (eg, "secure key") is associated with identification information (eg, user ID) of each of a plurality of users, and information processing is performed. It is stored in the respective storage units of the device 10 and the authentication server 80 .

As a result, the information processing system 1A can perform authentication using the one-time scan code mode described in the first embodiment when multiple users use one system (service) such as a library system or a company system. Treatment can be applied.

<Third Embodiment>
Next, a third embodiment of the invention will be described.
In this embodiment, a mode in which one user can use a plurality of "secure keys" will be described.

FIG. 8 is a diagram showing a configuration example of an information processing system 1B according to this embodiment. In the information processing system 1B according to the present embodiment, information indicating a plurality of encryption rules (eg, "secure key") is associated with identification information (eg, user ID) of one user, and the information processing apparatus 10 and authentication server 80 respectively. A plurality of "secure keys" are respective "secure keys" of a plurality of systems (services) such as banks, insurance companies, online shops, and VPNs. When the authentication server 80 is different for each system (service), the authentication server 80 for each system (service) stores a "secure key" for each of the systems (services). On the other hand, one information processing apparatus 10 used by a user stores "secure keys" for each of a plurality of systems (services).

As a result, the information processing system 1B can be used in the one-time scan code mode described in the first embodiment when one user uses a plurality of systems (services) such as banks, insurance companies, online shops, and VPNs. can be applied.

<Fourth Embodiment>
Next, a fourth embodiment of the invention will be described.
In the present embodiment, a mode in which the information processing apparatus 10 is shipped from the factory with the "secure key" stored therein will be described.

FIG. 9 is a diagram showing a configuration example of an information processing system 1C according to this embodiment. In the information processing system 1C according to the present embodiment, information indicating encryption rules (for example, "secure key") is stored in a storage unit (for example, ROM, flash memory, etc.) in the embedded controller 31 of the information processing apparatus 10. It is shipped from the factory 90 in a state where A “secure key” for each of a plurality of systems (services) is stored and managed in the cloud 100 . When the user purchases the information processing device 10, the user selects the system (service) to be used, associates the "secure key" of the system (service) to be used with the user's identification information (for example, user ID), Register with the cloud service provided by the cloud 100 . The information processing apparatus 10 purchased by the user stores the selected "secure key" and the user's identification information (for example, user ID), and is shipped from the factory 90 and delivered to the user. The authentication server 80 of each system (service) acquires a "secure key" and user identification information (for example, user ID) from the cloud service provided by the cloud 100, and executes authentication processing.

As a result, the information processing system 1C can use the authentication processing in the one-time scan code mode described in the first embodiment in a state where the purchased information processing apparatus 10 is delivered to the user, which is convenient. Good nature.

Although each embodiment of the present invention has been described in detail above with reference to the drawings, the specific configuration is not limited to the above-described embodiments, and includes design within the scope of the present invention. . For example, the configurations described in the above embodiments can be combined arbitrarily.

In the above embodiment, the information processing apparatus 10 is a clamshell notebook PC, but may be a desktop PC, tablet PC, or the like. Moreover, the keyboard 32 is not limited to being provided in the information processing apparatus 10 , and may be a peripheral device (external device) connected to the information processing apparatus 10 .

The information processing apparatus 10 described above has a computer system inside. Then, a program for realizing the function of each configuration included in the information processing apparatus 10 described above is recorded in a computer-readable recording medium, and the program recorded in the recording medium is read and executed by a computer system. , the processing in each configuration included in the information processing apparatus 10 described above may be performed. Here, "loading and executing the program recorded on the recording medium into the computer system" includes installing the program in the computer system. The "computer system" here includes hardware such as an OS and peripheral devices. A "computer system" may also include a plurality of computer devices connected via a network including communication lines such as the Internet, WAN, LAN, and dedicated lines. The term "computer-readable recording medium" refers to portable media such as flexible discs, magneto-optical discs, ROMs and CD-ROMs, and storage devices such as hard discs incorporated in computer systems. Thus, the recording medium storing the program may be a non-transitory recording medium such as a CD-ROM.

Recording media also include internal or external recording media accessible from the distribution server for distributing the program. Note that the program may be divided into a plurality of parts, downloaded at different timings, and then integrated in each structure of the information processing apparatus 10, or the distribution servers that distribute the divided programs may be different. In addition, "computer-readable recording medium" is a volatile memory (RAM) inside a computer system that acts as a server or client when the program is transmitted via a network, and retains the program for a certain period of time. It shall also include things. Further, the program may be for realizing part of the functions described above. Further, it may be a so-called difference file (difference program) that can realize the above functions by combining with a program already recorded in the computer system.

Also, part or all of the functions of the information processing apparatus 10 in the above-described embodiment may be implemented as an integrated circuit such as an LSI (Large Scale Integration). Each function may be individually processorized, or part or all may be integrated and processorized. Also, the method of circuit integration is not limited to LSI, but may be realized by a dedicated circuit or a general-purpose processor. In addition, when an integration circuit technology that replaces LSI appears due to advances in semiconductor technology, an integrated circuit based on this technology may be used.

Reference Signs List 1, 1A, 1B, 1C information processing system 10 information processing device 101 display housing 101a display surface 101b top surface 102 equipment housing 102a keyboard surface 102b bottom surface 103 hinge mechanism 11 CPU 12 main memory, 13 video subsystem, 14 display unit, 21 chipset, 211 RTC, 22 BIOS memory, 23 communication unit, 25 RTC power supply, 31 embedded controller, 32 keyboard, 33 power supply circuit, 35 power button, 40 storage device, 60 battery

Claims (14)

An information processing system comprising an information processing device and a server connected for communication with the information processing device,
The information processing device is
a memory that temporarily stores an OS (Operating System) program;
a processor that executes the OS program;
First key information indicating a key operated by a user on an operation unit in which a plurality of keys are arranged is acquired from the operation unit, and encryption is changed according to the acquired first key information and time an EC (Embedded Controller) that generates second key information different from the first key information based on a rule and transmits the second key information to the processor;
with
the processor transmits to the server data based on the second key information generated by the EC without obtaining the first key information;
The server is
Acquiring data based on the second key information transmitted from the information processing device, and encrypting the acquired data based on the second key information with the same encryption rule used in the information processing device at the same time obtaining the first key information based on common encryption rules under which encryption is performed;
Information processing system. The encryption rule is
A change rule according to the time of the scan code corresponding to each of the plurality of keys arranged on the operation unit,
The EC is
Based on the first key information acquired from the operation unit and the time when the first key information was acquired, the first key information is converted into a scan code according to the encryption rule at that time, and the first key information is converted into a scan code. 2 Generate key information,
The information processing system according to claim 1. The server is
performing an authentication process by combining the data based on the second key information based on the time when the data based on the second key information is acquired and the common encryption rule;
The information processing system according to claim 1 or 2. The server is
Authentication data is generated by encrypting a pre-registered character string based on the time when the data based on the second key information is acquired and the common encryption rule, and the authentication data and the second key are generated. perform authentication processes based on informed data;
The information processing system according to claim 1 or 2. The information indicating the encryption rule and the identification information of the user are associated and stored in the respective storage units of the information processing device and the server,
The information processing system according to any one of claims 1 to 4. Information indicating the common encryption rule is associated with the identification information of each of a plurality of users, and stored in the respective storage units of the information processing device and the server,
The information processing system according to claim 5. Information indicating a plurality of encryption rules is associated with the identification information of one user and stored in the respective storage units of the information processing device and the server,
The information processing system according to claim 5. The information indicating the encryption rule is shipped from the factory with the information indicating the encryption rule stored in the storage unit of the information processing device.
The information processing system according to any one of claims 1 to 7. Information indicating the encryption rule in the information processing device is stored in a storage unit within the EC;
The information processing system according to any one of claims 1 to 8. The EC is
requesting time information from a BIOS (Basic Input Output System) running on the processor;
The processor
Sending current time information to the EC by the processing of the BIOS in response to a request for time information from the EC;
The information processing system according to any one of claims 1 to 9. The EC is
shifting to a processing mode in which the first key information is encrypted based on the encryption rule in response to a user's operation on a specific key among the keys arranged on the operation unit;
The information processing system according to any one of claims 1 to 10. a memory that temporarily stores an OS (Operating System) program;
a processor that executes the OS program;
First key information indicating a key operated by a user on an operation unit in which a plurality of keys are arranged is acquired from the operation unit, and the encryption rule is changed according to the acquired first key information and time. an EC (Embedded Controller) that generates second key information different from the first key information based on and transmits to the processor;
with
the processor transmits data based on the second key information generated by the EC without obtaining the first key information;
Information processing equipment. First key information indicating a key operated by a user on an operation unit in which a plurality of keys are arranged is acquired from the operation unit, and the encryption rule is changed according to the acquired first key information and time. a server that is communicatively connected to an information processing device that generates second key information different from the first key information based on and transmits data based on the generated second key information,
Acquiring data based on the second key information transmitted from the information processing device, and encrypting the acquired data based on the second key information with the same encryption rule used in the information processing device at the same time obtaining the first key information based on the common encryption rule under which encryption is performed;
server. An information processing device including a memory for temporarily storing an OS (Operating System) program, a processor for executing the OS program, and an EC (Embedded Controller); and a server connected for communication with the information processing device. A control method in an information processing system,
In the information processing device,
a step in which the EC acquires, from the operation unit, first key information indicating a key operated by a user's operation on an operation unit in which a plurality of keys are arranged;
a step in which the EC generates second key information different from the first key information based on the acquired first key information and an encryption rule that changes according to time, and transmits the generated second key information to the processor;
a step of the processor transmitting to the server data based on the second key information generated by the EC without acquiring the first key information;
including
at the server,
obtaining data based on the second key information transmitted from the information processing device;
The first key information based on the data based on the obtained second key information and the common encryption rule that performs the same encryption at the same time as the encryption rule used in the information processing device. a step of obtaining
Control method including.

Images