JP2009230178A - Security policy observance device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To achieve an information processor which is high in robustness by preventing an operating system from being started when a security policy is not observed by comparing security policy setting with the pre-boot environment of the operating system. <P>SOLUTION: Whether or not security setting acquired by a security setting configuration means 10 is adapted to a security policy recorded in a security policy information recording part is decided by a start control part 12, and start control corresponding to the decision result is performed, so that it is possible to prompt compliance with the security policy. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an information processing apparatus, such as a personal computer or a portable information terminal, which has startup and termination processing and can provide information to a user.

  In recent years, the role of information processing apparatuses has grown, and the effects of information leakage have become enormous. As a result, the idea of security to prevent information leakage has become more important. For example, information security managers in companies should encourage each user to comply with security using verbal, e-mail, or dedicated software. It has become.

  The prior art will be described below.

  Patent Document 1 describes an information processing apparatus that protects contents stored in a disk device by encrypting and decrypting a boot area of a computer.

Japanese Patent Application Laid-Open No. 2004-228561 describes an activation unit that executes an activation process of an operating system using biometric information or identification information stored in a storage device.
JP 2006-350596 A JP 2002-66089 A

  For example, in a large-scale company, when each invention is used in the above patent document, the boot function can be kept safe. However, even if the information security department proposes these methods, the information processing apparatus can be used when the user who uses the target information processing apparatus is set to not use the function proposed in the invention without observing the security policy. If it is stolen, there is a problem that information leakage can easily occur.

  The present invention solves the above-described conventional problems, and it is an object of the present invention to determine whether a security policy is observed based on information that can be used without the user's awareness, and to control the activation of the information processing apparatus. .

  The present invention includes a security policy information recording unit that holds various setting states related to security, a security setting confirmation unit that confirms security settings, the security policy information recording unit, and a security setting acquired by the security setting confirmation unit. And a startup control unit that controls startup according to the comparison result, for example, confirms whether or not a password is set at startup in a personal computer, and the password at startup is set in the security policy information recording unit Check whether the password setting is valid, and if the password setting at startup is disabled even though the password at startup is required for security policy, the personal computer cannot be started Be aware of the security policy. It can realize the management of information.

  In the present invention, the security setting confirmation unit acquires information that can be automatically referred to at the time of activation, and is automatically referred to at the time of activation. be able to.

  Since it is possible to determine whether the settings are appropriate for the security policy, rather than the conventional biometric information and information such as passwords, for example, companies distribute security policies and the security It is possible to reinforce conventional security, such as automatically determining whether the policy is being followed.

  Hereinafter, an embodiment of the present invention will be described with reference to FIG.

(Embodiment 1)
FIG. 1 is a schematic diagram of an embodiment of the present invention.

  In FIG. 1, reference numeral 10 denotes a security setting confirmation unit that acquires security settings, and reference numeral 11 denotes a security policy information recording unit that records security policy information to be compared with information acquired by the security setting confirmation unit 10. Reference numeral 12 denotes an activation control unit that controls activation by comparing the information acquired by the security policy information recording unit 11 and the security setting confirmation unit 10. All of these parts 10 to 12 can be placed on the BIOS.

  The security setting confirmation means 10 can acquire information as to whether or not the password setting at the time of startup is required for BIOS setting, for example. Further, the security policy information recording unit stores security policy information that a personal computer used in the company needs to have a valid password at startup, for example.

  By comparing the information acquired by the security setting confirmation unit 10 with the information held in the security policy information recording unit 11, the activation control unit 12 determines whether or not the security policy is being followed. Activation according to the security policy can be provided, for example, activation is not permitted if the policy is not observed.

  In this embodiment, various types of security can be realized by changing the information to be confirmed by the security setting confirmation unit 10 and the information to be recorded by the security policy information recording unit 11.

  Examples are listed below.

  Whether the fingerprint authentication device is connected and whether the fingerprint authentication function is enabled is checked, and activation is controlled based on the policy that fingerprint authentication must be enabled.

  The location information acquired by the GPS is confirmed to indicate the location, and the activation at a location away from the company is restricted by a policy that obliges use within the company.

  The time when the start button is pressed is checked, and based on the policy that it can be started only during working hours, start-up at a suspicious time is prohibited.

  Based on the policy that it is necessary to be connected to the in-house LAN based on the policy that it is necessary to connect to the in-house LAN, a warning message is displayed at the start-up if the in-house LAN is not connected.

  Checking the installed software, for example, based on a policy that makes it impossible to use an application other than those listed in the white list indicating a safe application, the activation is controlled when unauthorized software is installed.

  The above enumerated examples can perform more flexible activation control by changing or combining the objects to be confirmed and the contents of the policy. Also, the activation control unit 12 does not simply allow activation, but displays a warning message, deletes HDD data, does not release HDD encryption, requires another password input, etc. It is also possible to perform effective control.

  Next, specific implementation means will be described with reference to the drawings.

  FIG. 2 is a block diagram showing the configuration of the security policy observing apparatus according to the embodiment of the present invention. 201 is a password setting unit for setting a password at startup, 202 is a fingerprint authentication unit as a security measure, 203 is a GPS for detecting the position of the security policy compliant device body, and 204 is a LAN for network connection. Reference numeral 205 denotes an activation time acquisition unit that detects the activation time of the main body, and acquires the time at the time of activation from a timer built in the main body or the Internet.

  206 is a security setting confirmation means for confirming the security setting set in the main body, 207 is an activation control unit, 208 is an information processing unit, 209 is a security information recording unit in which security policy information is recorded, and 210 is a display unit. is there.

  Note that the security policy compliance device configured as described above may be configured using a bus 300 connected to the information processing unit 208 as illustrated in FIG. 3, for example. 3, the same reference numerals as those in FIG. 2 have the same functions. In FIG. 3, the information processing unit 208 is a CPU, for example, and operates with the hard disk drive 301 and the memory 302.

  The operation of the security policy compliance device configured as described above will be described with reference to FIGS.

  First, when the power of the main body is turned on (S400), security policy information is read from the security policy information recording unit 109 (S401). Here, the security policy information has items as shown in FIG. 5, for example. FIG. 5 stipulates that password setting is necessary as described above. Further, in this example, for example, the password is required to have 6 or more characters, and the password character type is required to be composed of a combination of letters, numbers and symbols. GPS authentication is also required, and it is required that the latitude is in the range of W1 to E1 degrees and the longitude is in the range of S1 to N1 degrees. Network authentication is also required, and it is required to be connected to address 1 which is an in-house address. The address 1 may be a fixed address or an address group having a certain width. In this example, fingerprint authentication is not required. The start restriction is necessary, for example, it is necessary to start between 7 and 22:00.

  After reading the security policy information set in this way, the security setting confirmation means performs security setting confirmation processing (S402). In the security setting confirmation means, the current state of the security policy compliant device main body is acquired for the items specified by the security policy information. For example, the state as shown in FIG. 6 is acquired corresponding to the security policy information described in FIG. Here, for example, if there is already acquired information such as password setting, the information is returned to the activation control unit 107, and information that requires the current status, such as position acquisition by GPS, network connection destination, activation time information, etc. Collect (S403) and return to the activation control unit 107.

  Next, the activation control unit 107 determines whether the information acquired by the security setting confirmation unit 106 satisfies all the security policies (S404). For example, in the example shown in FIG. 6, all the conditions set in the security policy information, such as password setting, GPS authentication, network authentication, and start time restriction, are satisfied. In this case, activation processing is performed (S405). On the other hand, in the example shown in FIG. 7, for example, the number of characters and the character type of the password do not satisfy the conditions defined by the security policy information. In this case, assuming that the security policy is not satisfied, the information processing unit 108 displays a warning to that effect on the display unit 110. Then, the user is prompted whether to change the security setting. If the security setting is not changed, the power is turned off as it is (S308). If the security setting is changed, the security setting is confirmed again.

  As described above, if the security setting satisfies the security policy, the main body is activated, and if not, the main body is not activated and the power is turned off.

  Although it has been described that the security setting is confirmed after reading the security policy, various security settings may be automatically acquired immediately after the power is turned on.

  The security policy information recording unit may be a hard disk drive or the like built in the main body, or may be an external storage medium such as an SD memory card. When security policy information is recorded on an external storage medium such as a memory card, a stricter security policy can be set by changing the memory card depending on, for example, the person who uses it, and the location of use, and the security policy can be set flexibly. It is possible. Even when a security policy is recorded on a hard disk drive or the like, the security policy can be changed via a network or the like.

  The security policy compliance device according to the present invention reinforces the low security mind of the user, in which individual settings of the user, which conventionally had to be confirmed one by one, could not be judged as important for security, such as before the operating system was started. can do. In addition, even if it is stolen, flexible control is possible such that even if it is not connected to the in-house LAN, it cannot be activated, so that it is possible to prevent information leakage.

  The present invention can be widely applied to fields that require a certain level of security, such as companies that need to manage user security settings.

Configuration diagram of an apparatus according to Embodiment 1 of the present invention The block diagram which shows the structure of this invention Second block diagram showing the configuration of the present invention The flowchart which shows operation | movement of Embodiment 1 of this invention. The figure which shows an example of security policy information Diagram showing an example of security settings that satisfy the security policy Diagram showing an example of security settings that do not satisfy the security policy

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Security setting confirmation means 11 Security policy information acquisition part 12 Activation control part 201 Password setting part 202 Fingerprint authentication part 203 GPS
204 LAN
205 activation time acquisition unit 206 security setting confirmation unit 207 activation control unit 208 information processing unit 209 security policy information recording unit 210 display unit

Claims (5)

A security policy information recording unit for holding various setting states related to security;
Security setting confirmation means for acquiring security settings;
A security policy compliance device comprising: a security policy information recording unit; and a startup control unit that compares a security setting acquired by a security setting confirmation unit and limits startup according to a comparison result. The security policy compliance device according to claim 1, wherein the security setting confirmation unit automatically acquires information that can be referred to at the time of activation. The security policy compliance device according to claim 1, wherein the activation control unit permits activation only when the security settings acquired by the security setting confirmation unit satisfy all of the security policies. 4. The security according to claim 3, wherein when the security setting acquired by the security setting confirmation unit does not satisfy all of the security policies, the activation control unit issues a warning to that effect and prompts the user to change the security setting. Policy compliance device. Reading security policy information;
Checking security settings,
Determining whether the security settings satisfy all of the security policies;
If the security settings satisfy all of the security policies, permitting a startup process;
A security policy observing method including a step of issuing a warning and prompting to change the security setting when the security setting does not satisfy all of the security policies.

Images