WO2004072855A1

WO2004072855A1 - Security management system

Info

Publication number: WO2004072855A1
Application number: PCT/JP2003/001441
Authority: WO
Inventors: Haruhisa Sakuma
Original assignee: Fujitsu Limited
Priority date: 2003-02-12
Filing date: 2003-02-12
Publication date: 2004-08-26

Abstract

A security management system for improving safety under the condition of security cease that a plurality of computers are present. The security management system comprises a security information registering section for registering security information on computers, a security object registering section for registering a device to be secured, an acquiring section for acquiring security information from the computers, an authorizing section for granting authorization after comparing security information acquired by the acquiring section with security information registered in the security registering section, and a security function section for limiting the use of the device if the authorizing section does not grant authorization and permitting the use of the device if authorization is granted.

Description

Specification

Security management system

Technical field .

The present invention relates to a technique for ensuring security, such as preventing unauthorized use of a computer and protecting confidential data in the computer. Background art

Conventionally, in the case of information devices that are deployed in companies and homes, such as personal computers and workstations, if there is information that you do not want to be seen by others or applications that cannot be used illegally, etc. It is common practice for an administrator (user) to set a security code, password, etc., and to require the input of the password, etc., when the information device is started, thereby ensuring security. As an application example of the secured technology, for example, when an administrator of a personal computer deployed in an office places a security lock on the personal computer with a password and leaves the office and is in a remote location, the administrator of the personal computer Your colleagues, subordinates, or supervisors can use the information If you must have to access the Ya program has occurred, the system which the administrator has to be released the security lock remotely has been proposed (see Patent Document 1).

In recent years, authentication using a biometric such as a fingerprint and authentication using a smart card (registered trademark) are known.

[Patent Document 1]

In the system described above, if someone enters a correct password, the lock is released. You. That is, the level of security is left to one person managing the password. The use of smart cards (registered trademark), fingerprints, and the like can increase the security level, but it is still left to one person. However, depending on the very important data and the nature of the data, it is not desirable to delegate the security level to one person.

Also, if the computer is stolen, the protection may be released by repeatedly trying to enter the password.

The present invention has been made in view of the above circumstances, and has as its object to provide a security management technique that improves security by using a plurality of computers as conditions for canceling protection and using authentication performed by the plurality of computers as conditions for canceling protection. . Disclosure of the invention

The present invention adopts the following configuration in order to solve the above problems.

That is, the security management system of the present invention

A security information registration unit for registering, as security information, information on a plurality of devices designated in advance for security release;

A protection target registration unit for registering a device to be protected;

An acquisition unit that acquires information on the plurality of designated devices;

An authentication unit that determines whether to perform authentication based on the information acquired by the acquisition unit and the security information registered in the security registration unit;

A security function unit that restricts use of the device to be protected when the authentication unit does not obtain authentication, and enables use of the device to be protected when the authentication is obtained.

In the security management system, the security information registration unit registers a designated device required for security release as security information,

The acquisition unit acquires the presence or absence of the specified device,

The authentication unit determines the authentication based on the presence / absence of the designated device acquired by the acquisition unit and the designated device registered as the security information, and the designated device exists. In such a case, authentication may be performed, and if the designated device does not exist, authentication may not be performed.

The security management system is a device to which the designated device can be connected via a network, The security information registration unit registers identification information of the designated device that is unique in the network as security information,

The acquisition unit may acquire the identification information from a designated device existing on a network.

The security management system may be configured such that a BIOS (Basic Input Output System) of the security management system registers the security information in the security information registration unit and a protection target in the protection target registration unit during setup. good.

In the security management system, the BIOS of the security management system may restrict use of a device to be protected by the security function unit before an operating system is started.

The security management system includes a BIOS of the management system, the operation system, and an interface for transmitting and receiving the protection target information and the security information so that the operation system can register the protection target and perform the security information. The security management system according to claim 1, comprising: In the security management system, the device to be protected may be the security system itself, a device configuring the security system, or a device usable from the security system.

Further, the security management program of the present invention comprises:

It is operated on a computer that has a security information registration unit that registers, as security information, information on a plurality of devices specified in advance to release security, and a protection target registration unit that registers devices to be protected.

Obtaining information on the plurality of designated devices;

Determining whether to perform authentication based on the acquired information and the security information registered in the security registration unit;

Restricting the use of the protected device when the authentication is not obtained, and enabling the use of the protected device when the authentication is obtained;

On a computer.

The security management program is characterized in that the security information registration unit In the case where a designated device required for security release is registered as security information, in the step of acquiring information on the designated device, the presence or absence of the designated device is obtained,

In the step of performing the authentication, the authentication is determined based on the presence / absence of the designated device and the designated device registered as the security information. If the designated device is present, the authentication is performed. However, if the specified device does not exist, authentication may be performed.

The security management program is a device to which the designated device can be connected via a network,

When the security information registration unit registers identification information of the designated device that is unique in the network as security information,

In the step of acquiring information on the designated device, the identification information may be acquired from a designated device existing on a network.

In the security management program, the BIOS of the computer may register the security information in the security information registration unit and register a protection target in the protection target registration unit at the time of setup.

The security management program may be configured such that the BIOS of the computer restricts use of the device to be protected before the operating system is activated. In the security management program, the device to be protected may be the security system itself, a device configuring the security system, or a device usable from the security system.

Furthermore, the security management method of the present invention

A step of acquiring information of a plurality of designated devices specified in advance for security release;

Judging whether or not to authenticate based on the information of the plurality of designated devices; and restricting the use of the device to be protected when the authentication is not obtained, and when the authentication is obtained, Enabling the use of the device to be protected;

Is executed by the information processing apparatus.

Also, the security management method of the present invention The security management system includes a security information registration unit that registers information on a plurality of devices designated in advance for security release as security information, and a protection target registration unit that registers devices to be protected.

Obtaining information on the plurality of designated devices;

Determining whether to perform authentication based on the obtained information and the security information registered in the security registration unit;

including.

The security management method includes: when the security information registration unit has registered a designated device required for security release as security information,

In the step of obtaining information on the designated device, acquiring the presence or absence of the designated device,

The security management method, wherein the designated device is a device connectable via a network,

In the security management method, the security information may be registered in the security information registration unit and a protection target may be registered in the protection target registration unit at the time of setting up the BIOS in the computer.

The security management method may limit the use of the device to be protected before starting the BIOS operating system of the computer.

The security management method may be configured such that the device to be protected is the security system. The system itself, a device that constitutes the security system, or a device that can be used from the security system. BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 is a schematic configuration diagram of an embodiment according to the present invention.

FIG. 2 is a block diagram of the security system according to the first embodiment.

Figure 3 illustrates the security management procedure.

Figure 4 is an illustration of the BIOS setup screen

Figure 5 is an illustration of the BIOS setup screen

Figure 6 is an illustration of the BIOS setup screen

Figure 7 is an illustration of the BIOS setup screen

Figure 8 is an illustration of the BIOS setup screen

FIG. 9 is a schematic configuration diagram of Embodiment 2 according to the present invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings. The configuration of the embodiment is an exemplification, and the present invention is not limited to the configuration of the embodiment.

<< Embodiment 1 >>

FIG. 1 is a schematic diagram of Embodiment 1 according to the present invention.

The security management system of the present embodiment connects four computers (corresponding to designated devices) A to D specified in advance to release security by a LAN (local area network), and connects these pre-registered computers. It exchanges security information with each other and manages security so that the devices (hardware resources) to be protected can be used only when all registered computers are started up correctly.

FIG. 2 is a configuration example of the computers A to D.

As shown in the figure, each of the computers A to D has a display controller that controls a display such as a CRT and a liquid crystal display, a keyboard controller that controls a keyboard and a mouse, and a communication controller that controls communication with other computers. LAN controller as part, FLASH Memoir storing BIOS, hard disk storing OS application software, hard disk controller controlling the hard disk, controlling input / output by serial port and parallel port (printer terminal), etc. It has an I / O controller, a CMOS RAM that stores BIOS setting information, a CPU (central processing unit) that performs arithmetic processing, a main storage device, and a system controller that controls each unit based on the arithmetic processing of the CPU. .

In the present embodiment, the BIOS of each of the computers A to D includes a security management program that causes the computers to execute a security management method. When setting up the BIOS, enter the security information required for authentication and the protection target, and register them in CMOS RAM (corresponding to the security information registration unit and protection target registration unit).

In each of the computers A to D, an acquisition unit, an authentication unit, and a security function unit are realized by executing processing by a CPU or a system controller in accordance with the BIOS.

The function of the acquisition unit is to acquire information on the plurality of computers. For example, information such as whether or not the computer exists on the network, identification information of the computer (such as a MAC address or CPU number) and a password that are unique in the network is obtained.

The function of the authentication unit is to perform authentication based on the information acquired by the acquisition unit and the security information registered in the security registration unit. For example, the obtaining unit obtains identification information of a computer existing on the network, and the authentication unit determines whether or not to perform authentication based on the identification information and the security information, and is registered in the security information registration unit. If the computer exists, the authentication is performed. If the computer registered in the security information registration section does not exist, the authentication is not performed. In the present embodiment, the presence or absence of this computer is determined based on whether or not a combination of a MAC address and a password can be correctly obtained from each computer.

As the security function unit, if authentication is not obtained by the authentication unit, The use of the device to be protected is restricted, and when the authentication is obtained, the device to be protected can be used.

Table 1 shows an example of a data area for storing security information described later.

【table 1】

Such information is stored in a non-volatile storage medium (CMOS RAM or Flash Memory).

This “security function state” stores the setting state of whether to use or not use the security function realized by this system. “Participant number of personal computers” stores the number of devices required to release the security function. “Number of hardware resources” stores the number of hardware resources to be protected. “Hardware resource information” stores information on hardware that imposes restrictions on access. Here, as an example, it is assumed that access to the hard disk 1, the hard disk 2, the CD-ROM, and the floppy disk is restricted. The device to be protected can be arbitrarily selected, and in addition to the example here, may be a partial area of a hard disk, an input / output port (such as a printer terminal or a USB port), or the computer itself. “Security Information 1” to “Security Information n” are required to release the security function. The necessary attribute information unique to each device is stored. Here, the MAC address of each device and the password of the user are used for this.

Figure 3 shows the process of releasing the security function. When the computer A is turned on, the computer A executes the BIOS and performs a self-diagnosis test to check whether each hardware is operating normally (step S1).

After confirming that there is no problem in the self-diagnosis test, computer A reads “security function status” from the non-volatile storage medium and checks whether to use the security function before starting the OS (step S2). ). If the security function is not used here, normal OS startup processing is performed.

When security is used, the computer A prompts the user to enter a password (S3), and determines whether a correct password has been entered (S4).

If the correct password is entered, the security information is mutually checked. First, the computer A reads the “number of participating personal computers” from the non-volatile storage medium and checks the number of devices that need to be confirmed (the number of repetitions of steps S5 to S8). If this is N, the security information 1 to security information N are read from the non-volatile storage medium in accordance with this, and the individual security release conditions from device 1 to device N (computers B to D in this example) are determined. Check whether it is established. Here, the computer A checks whether or not the registered MAC address exists on the LAN by using the function of the obtaining unit (S5). Computer A determines whether or not the MAC address acquired in the above step matches the one registered in the CMOS RAM by using the function of the authentication unit (S6). If they match, the computer A sends a signal requesting a password to the computers B to D with the matching MAC address by the function of the acquisition unit, and in response, sends the password returned from the computers B to D in response. Receive (acquire). At this time, if the same authentication is performed on the other computers B to D, the computer A sends its own password to each of the computers B to D in response to the signal requesting the password from each of the computers B to D. Send (S7). Then, the computer A determines whether or not the combination of the password and the MAC address obtained in the above step matches the one registered in the CMOS RAM by the function of the authentication unit (S8).

Then, the above processing (S5 to S8) is repeated for the N computers B to D, and if the security release condition is satisfied for all the computers, the process proceeds to the OS startup processing (S9).

If the security release condition is not satisfied in Steps 4, 6, and 8, Computer A invalidates the hardware resource subject to access protection by the function of the security function unit (Step S). 10-S12). That is, the “number of hardware resources” is read from the non-volatile storage medium, and the number of hardware resources requiring access protection (the number of repetitions of steps S10 and S11) is checked. Assuming that this is N, according to this, from Bit O to Bit (N-1) of the "Hardware Resource Information" are read from the non-volatile storage medium, and the hardware resource corresponding to each Bit is protected. Check whether it is (step S10). Then, the hardware resources that need to be protected are invalidated (step S11), and then OS is started if possible. For example, if hard disk 2 is protected, hard disk 2 becomes inaccessible after startup. When the protection target is the computer A itself, all hardware resources are invalidated and the entire computer A becomes unusable. That is, in this case, the OS is not started. If it is determined that the computer A itself is to be protected (S10), the power supply of the computer A may be turned off immediately in step S11. Note that it is not necessary that all devices connected to the network be configured to participate in security release. For example, only the members of mandatory members who need to be authenticated for contract reasons participate in the security release, and the other devices may simply be connected to the network. Even with such a configuration, access to hardware resources is protected until authentication is completed.

FIGS. 4 to 8 show examples in the case where the BIOS setup program is executed. This setup program is started by pressing a specific key such as the F2 key during the self-diagnosis test. “Lock by multiple devices” in Fig. 4 is for setting the “security function status”. Move the cursor to this item and press the space key to switch between [ON] and [OFF].

Similarly, “Number of devices” in Fig. 4 is used to set “Number of participating personal computers”. Position the cursor on this item and enter the desired number in numerical values. “Registration of device information” is for setting attribute information unique to each device required for security release.

"Setting of access protection" The following four items are for setting "Hardware resource information". Pressing the space key also switches between [Protect] and [No] for these items. Move the cursor to "Register device information" and press the Enter key, and the following setting screen shown in Fig. 5 appears. The details are set on this screen.

Figure 5 shows a state in which nothing is set in the initial state, and all items are set to [Unset]. “MAC address of device n” (where n is a value from 1 to the number of participating personal computers) sets the MAC address of each device. If you move the cursor to this item and press the Enter key, a screen like the one shown in Fig. 6 below appears, where you enter the 6-byte MAC address in hexadecimal. The results of these settings are stored in the “MAC address” field of “Security information n”.

"Password for device n" (again, n takes a value from 1 to "number of participating personal computers") sets the password for each device. When you move the cursor to this item and press the Enter key, a screen like the one shown in Figure 7 below appears, where you can enter an 8-character password. The result of this setting is stored in the "Password" field of "Security information n".

FIG. 8 shows a state in which information of all computers is set. However, for security reasons, the registered content is not displayed directly, but only that it is set.

Tables 2, 3, and 4 show examples of software interfaces prepared by BIOS programs. [Table 2]

Get Security Status

Function: Get security setting status of multiple devices

WORD FAR (* entryPoint) (function, status); / * For 1 6bit Real Mode * /

WORD (* entryPoint) (function, status); / * For 32bit Protected

Mode * /

WORD function; / * 0x0000 * /

WORD * status;

♦ status: 0: Do not use security with multiple devices

1: Use security with multiple devices

Set Security status

Function: Set multiple devices

WORD FAR (* entryPoint) (function, status); / * For 1 6bit Real Mode * /

WORD (* entryPoint) (function, status); / * For 32bit Protected

Mode * /

WORD function; / * 0x0001 * /

WORD status; status: 0: Do not use multi-device security

1: Use security with multiple devices

Get Number of Macnes

Function: Gets the number of set devices

WORD FAR (* entryPoint) (function, n); / * For 16bit Real Mode * /

WORD (* entryPoint) (function, n); / * For 32bit Protected

Mode * /

WORD function; / * 0x0002 * /

WORD * n;

* n: Number of devices ― [Table 3]

Set Number of Machines

Function: Set the number of devices

WORD FAR (* entryPoint) (function, n) / * For 16bit Real Mode * / WORD (* entryPoint) (function, n); / * For 32bit Protected Mode 氺 /

WORD function; / * 0x0003 * /

WORD n; n: Number of devices

Get Machine Information

Function: Returns registered device information

WORD FAR (* entryPoint) (function, mac_address, password); / * For 16bit Real Mode 氺 /

WORD (* entryPoint) (function, mac_address, password); / * For 32bit Protected Mode * /

WORD function; / * 0x0004 * /

WORD i;

WORD * mac one address;

char * password; i: Device identification number (1 to n)

* mac_address: MAG address of device i (all 0 if not set)

♦ password: Password for device i (null string if not set)

Set Machine information

Function: Register device information

WORD FAR (* entryPoint) (function, mac_address, password); / * For 16bit Real Mode * /

WORD function; / * 0x0005 * /

WORD i;

WORD 氺 mac—address;

char * password; i: Device identification number (1 to n)

* mac_address: MAG address of device i (if all 0, clear the setting)

* password: Password for device i (if null string, clear settings) [Table 4]

Get Device Information

Function: Get device information for access protection

WORD FAR (* entryPoint) (function, information); / * For 16bit Real Mode * / WORD (* entryPoint) (function, information); / * For 32bit Protected

Mode * /

WORD function; / * 0x0006 氺 /

WORD information; information: Bit 0-0: Do not protect hard disk 1, 1: Protect

Bit 1-0: Do not protect hard disk 2, 1: Protect

Bit 2-0: No protection for CD-ROM ゝ, 1: Protection

Bit 3-0: Do not protect floppy disk, 1: Protect

Bit 4 ~ 15—Reserved

Set Device Inrormation

Function: Set device information subject to access protection

Mode * /

WORD function; / * 0x0007 * /

WORD information; information: Bit 0-0: Do not protect hard disk 1, 1: Protect

Bit 1-0: Do not protect hard disk 2, 1: Protect

Bit 2-0: Do not protect CD-ROM, 1: Protect

Bit 3-0: Do not protect floppy disk, 1: Protect

Bit 4-15-Reserve

The BIOS program prepares a data structure with a specific signature in the System BIOS area, and includes 16bit Real Mode and 32bit Protected in the data structure. The Entry Point is disclosed to the application program by embedding the entry address for each interface of Mode.

The application program can easily find the Entry Point by scanning the System BIOS area and searching for the signature determined uniquely for this interface. The application program can execute each function by calling the found Entry Point with the same calling interface as the C language shown in Tables 2, 3, and 4. Each interface has a function to return the current setting and a function to change the setting. The BIOS program returns or changes the contents of various data areas in the nonvolatile storage medium shown in Table 1 for each function.

As described above, according to the present embodiment, it is possible to realize an access control in which access to extremely confidential data is not permitted unless all specific persons are present. Also, since multiple personal computers are required to release security, security against theft is enhanced.

In addition, when multiple personal computers are not activated and not authenticated, multiple personal computers must be attacked. The combined effect increases the strength of repeated attacks.

<< Embodiment 2 >>

FIG. 9 is a schematic diagram of Embodiment 2 according to the present invention. In this embodiment, security information is exchanged between an authentication server and each computer (security management system). Since the configuration of each computer is the same as that of the above-described computer, the description thereof will be omitted, and different configurations will be described. The authentication server S is a general computer, and has a function of transmitting security information to the other computers A and B only when the use of the device to be protected is permitted. For example, when a pre-registered MAC address and password are received from the computers A and B at a specific time or a statement, the security information (the MAC address and password of the server S) is transmitted.

Computer A has registered the MAC address and password of server S in CMOS RAM. The authentication server S is started independently before the other computers A and B are authenticated.

When the BIOS is started at the time of booting in the same manner as the above embodiment, the computer A prompts the user to enter a password, and when the correct password is entered, acquires the authentication server S security information and compares it with the registration information in the CMOS RAM. And authenticate. If this authentication is obtained, OS is started, and if not, the device to be protected is invalidated and OS is started.

Computer B authenticates with server S separately from computer A.

As described above, in the present embodiment, security management is performed so that a device to be protected cannot be used unless the server S exists on the network and is not normally activated.

Therefore, according to this embodiment, if the device to be protected cannot be used when disconnected from the network, security against theft is enhanced.

Further, for example, by transmitting the security information only during the working hours, the server s can perform security management so that the users of the computers A and B do not use the device to be protected outside the working hours. Industrial applicability

In the above-described embodiment, an embodiment mainly assuming a personal computer in an office has been described. However, the present invention is not limited to this, and any device capable of performing authentication as described above and restricting use of a protection target can be used. However, the present invention can be similarly realized with a mobile phone, a game machine, a copying machine, a fax, and the like. For example, a mobile phone is used as a device for releasing security, and the mobile phone itself is subject to access protection.

In game consoles, network-based games have applications such as realizing startup control such that a child can start a game only after the authentication of a specific registered member, for example, a parent, has been confirmed. It is possible.

As described above, according to the present invention, a plurality of computers are set as conditions for releasing protection, and the fact that authentication has been performed by these computers is set as a condition for releasing protection. As a result, it is possible to provide a security management system, security management program and security management method that improve safety.

Claims

The scope of the claims

1. A security information registration unit for registering, as security information, information on a plurality of devices designated in advance for releasing security.

A protection target registration unit for registering a device to be protected;

A security function unit that restricts use of the device to be protected when authentication is not obtained by the authentication unit and enables use of the device to be protected when the authentication is obtained;

Security management system with.

2. The security information registration unit registers the designated device required for security release as security information,

The acquisition unit acquires the presence or absence of the specified device,

The authentication unit determines the authentication based on the presence / absence of the designated device acquired by the acquisition unit and the designated device registered as the security information, and the designated device exists. 2. The security management system according to claim 1, wherein authentication is performed in a case, and authentication is not performed in a case where the designated device does not exist.

3. The designated device is a device connectable via a network,

The security information registration unit registers identification information of the designated device that is unique in the network as security information,

3. The security management system according to claim 2, wherein the former so-called acquisition unit acquires the identification information from a designated device existing on the network.

4. The security management system according to claim 1, wherein the BIOS of the security management system registers the security information in the security information registration unit and registers a protection target in the protection target registration unit during setup.

5. The security management system according to claim 1, wherein the BIOS of the security management system restricts the use of the device to be protected by the security function unit before the operating system is started.

6. The BIOS of the management system includes an interface for exchanging the protection target information and the security information with the operation system so that the operation system can perform the registration of the protection target and the security information. The security management system according to 1.

7. The security management system according to claim 1, wherein the device to be protected is the security system itself, a device configuring the security system, or a device usable from the security system.

8. It is operated by a computer that has a security information registration unit that registers information on multiple devices specified in advance to release security as security information, and a protection target registration unit that registers devices to be protected. Security management program,

Acquiring information on the plurality of designated devices;

Limiting the use of the protected device if the authentication has not been obtained, and enabling the use of the protected device if the authentication has been obtained;

A security management program for causing the computer to execute.

9. When the security information registration unit registers the designated device required for security release as security information,

In the step of performing the authentication, the authentication is determined based on the presence / absence of the designated device and the designated device registered as the security information. If the designated device is present, the authentication is performed. 9. The security management program according to claim 8, wherein authentication is not performed if the designated device does not exist.

10. The designated device is a device connectable via a network,

In the step of obtaining the information of the designated device, the designation existing on the network 10. The security management program according to claim 9, wherein the identification information is acquired from a device.

11. The security management program according to claim 8, wherein the BIOS of the computer registers the security information in the security information registration unit and registers a protection target in the protection target registration unit during setup.

12. The security management program according to claim 8, wherein the BIOS of the computer restricts use of the device to be protected before starting an operating system.

13. The security management program according to claim 8, wherein the device to be protected is the security system itself, a device configuring the security system, or a device usable from the security system.

1 4. obtaining information of a plurality of designated devices designated in advance for security release;

Security management method in which the information processing apparatus executes the above.

1 5. A security management system that includes a security information registration unit that registers information on multiple devices specified in advance for security release as security information, and a protection target registration unit that registers devices to be protected. The security management method to be performed,

Obtaining information on the plurality of designated devices;

Security management methods, including:

1 6. When the security information registration unit registers the designated device required for security release as security information,

In the step of acquiring information on the designated device, the presence or absence of the designated device is determined. Gain

In the step of performing the authentication, the authentication is determined based on the presence / absence of the designated device and the designated device registered as the security information. If the designated device is present, the authentication is performed. 16. The security management method according to claim 15, wherein authentication is not performed if the designated device does not exist.

1 7. The designated device is a device connectable via a network,

17. The security management method according to claim 16, wherein in the step of acquiring the information on the designated device, the identification information is acquired from a designated device existing on a network.

18. The security management method according to claim 15, wherein the BIOS of the computer registers the security information in the security information registration unit and registers a protection target in the protection target registration unit during setup.

19. The security management method according to claim 15, wherein the BIOS of the computer restricts use of the device to be protected before starting an operating system.

20. The security management method according to claim 15, wherein the device to be protected is the security system itself, a device constituting the security system, or a device usable from the security system.