JP4732269B2 - Information device and remote access method thereof - Google Patents

Description

  The present invention relates to an information device, and more particularly to a technique effective when applied to maintenance of security during remote access.

  Currently, an information system such as a PC is equipped with an operating system [for example, Windows (registered trademark) XP] having a remote access (remote desktop) function so that it can be remotely operated from an external information device.

  Also, the information device has a password setting function in the hard disk as a conventional technology of the information protection system, and a function (access lock) that allows the hard disk to be read / written by setting a password input by the user to the hard disk by the system BIOS. Function (see, for example, Japanese Patent Application Laid-Open No. 2004-78539 (Patent Document 1)).

  When the access lock function is enabled in the information device, the system BIOS provides the user with a password input means for releasing the access lock of the hard disk at startup, and the password input by the user is set in the hard disk If it matches the password, the hard disk can be accessed, and if it does not match the set password, the hard disk cannot be accessed to prevent data leakage.

  In addition, the current hard disk is reset to a Parallel ATA (PATA) standard hard disk and a Serial ATA (SATA) standard hard disk that changes to the access locked state when the hard disk is reset from the unlocked state. However, there is a Serial ATA II (SATA II) standard hard disk that can be set so as not to change to the access lock state.

  The SATA II standard hard disk supports the [Enabled / Disabled] command of Software Setting Preservation that can set whether or not this access lock setting is cleared by a reset operation, and when the setting of Software Setting Preservation is Enable, The hard disk access lock setting is retained even if a reset is applied.

  As a method of performing remote access while effectively setting the hard disk access lock function, for example, as in JP 2000-215167 A (Patent Document 2), a client requests a password between client server systems, A method has been proposed in which a server sends a password in response to the request.

  As for remote access, a method of using Virtual Private Network (VPN) for improving communication security has been proposed.

However, due to the exchange of data through the communication line, it is impossible to completely prevent leakage of communication data except when a dedicated line that does not allow access from an external information device is used.
JP 2004-78539 A JP 2000-215167 A

  The remote access and the hard disk access lock of the above technology are in a contradictory relationship. Currently, when an information device such as a PC sets the hard disk access lock to be effective, a wake-up signal transmitted from the outside [for example, Even if the system is activated by the “Wake On LAN (WOL) signal”, it cannot be activated from the hard disk on which the operating system exists unless the password is input.

  For this reason, if you want to perform remote access, you must use it by disabling the access lock of the hard disk or by waiting the information device in a state where remote access is possible. The essential meaning of having an access lock function of a certain hard disk is significantly reduced.

  Therefore, in order to solve the above problem, the present invention remotely accesses the information apparatus, inputs a password to the hard disk, releases the access lock of the hard disk, and maintains the security of the information apparatus. It is an object of the present invention to provide a means for starting an operating system existing in the system.

  In addition to the above-mentioned means, the present invention further makes it meaningless for a third party to decrypt the input password transmitted from the external information device when performing remote access and inputting the password to the hard disk. The purpose of this is to provide a means for changing the hard disk password when the hard disk access lock is released so that the security of the information device is maintained.

  In addition to the above-described means, the present invention further maintains the security of the information device by disabling the function of receiving and starting a wake-up signal transmitted from the outside when the password reading fails. For the purpose.

  The above and other objects and novel features of the present invention will be apparent from the description of this specification and the accompanying drawings.

  Of the inventions disclosed in the present application, the outline of typical ones will be briefly described as follows.

  An information device according to the present invention is an information device connected to a network and remotely accessed from an external device via the network, having an access lock function by setting a password, and storing a first operating system. 1 storage device, a second storage device that stores a second operating system that is activated when a wake-up signal transmitted from an external device is received, and the access lock function of the first storage device is released And a password storage device for storing a plurality of passwords, and the second operating system displays a password input screen for inputting the current password to an external device that has transmitted a wake-up signal after startup, and the external device The password entered in is received, and the received password is the first Input to the storage device, release the access lock function of the first storage device, release the access lock function, then read and read the password different from the current password from the multiple passwords stored in the password storage device The first operating system stored in the first storage device is activated in a state where the password is set for the first storage device and the access lock function is released.

  Specifically, the information apparatus according to the present invention includes a device that can be controlled so that it can be activated only when an external wake-up signal is received from the system BIOS. Furthermore, the information device of the present invention has independent first and second operating systems, and the first operating system exists in a hard disk to which a password can be set as a security function. The operating system exists in a device that can be controlled so as to be activated only when an external wake-up signal is received.

  Furthermore, the second operating system of the information device of the present invention comprises means for releasing the hard disk access lock, and the means for releasing the access lock is a password input to the hard disk. With such a configuration, when the information device is to be activated by a wake-up signal transmitted from the outside, it is activated from the second operating system provided with a hard disk access lock releasing means, and the hard disk is accessed by inputting a password. The lock can be released.

  Furthermore, after releasing the hard disk access lock, the information device of the present invention restarts the second operating system while releasing the access lock, thereby enabling the first operating system existing in the hard disk to be started. it can. In order to perform the restart while maintaining the unlocked state of the hard disk, a hard disk compatible with the Serial ATA II standard having a function of maintaining the access lock state even if the hard disk is restarted is used.

  The information device of the present invention comprises a password storage device, and in the second operating system, when the hard disk access lock release is successful, means for reading the password from the password storage device, and the hard disk And a means for setting the read password as a new hard disk password.

  With this configuration, in the method of performing remote access while setting the hard disk access lock to be effective, the password input when releasing the hard disk access lock is transmitted via the communication line. Even if the password is decrypted during communication by the three parties, the transmitted password is invalidated as the hard disk password after the next time after it is used to release the access lock of the hard disk.

  Therefore, even if an attempt is made to unlock the hard disk access lock with a password decrypted by a third party, the hard disk access lock cannot be unlocked with the decrypted password, so that the security of the information device can be maintained.

  Further, the information device of the present invention has a function of storing a password in the password storage device, and a plurality of passwords stored in the password storage device can be registered.

  Furthermore, the information device of the present invention includes an encryption device, and the encryption device performs encryption as means for storing a password in the password storage device. With such a configuration, the password stored in the password storage device is improved in security by the encryption device, and further, it is possible to execute the method of performing remote access while maintaining the security of the information device for the number of registered passwords. it can.

  In addition, the information device according to the present invention is characterized in that the function of receiving and starting a wake-up signal transmitted from the outside from the second operating system can be disabled.

  With such a configuration, since the information device is not started from the second operating system, it is possible to maintain the security of the information device.

  Among the inventions disclosed in the present application, effects obtained by typical ones will be briefly described as follows.

  According to the present invention, an information device that can be activated by receiving a wake-up signal from the outside and has a password set in the hard disk as a security function can be maintained from an external information device while maintaining security. Remote access can be realized.

  Further, even if the hard disk can be accessed from an external information device by remote access, it is possible to prevent data leakage from the hard disk by restricting remote access.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. Note that components having the same function are denoted by the same reference symbols throughout the drawings for describing the embodiment, and the repetitive description thereof will be omitted.

  An information device according to an embodiment of the present invention will be described in detail below with reference to FIGS.

  First, the configuration of an information apparatus according to an embodiment of the present invention will be described with reference to FIGS. FIG. 1 is a configuration diagram showing the overall configuration of a network to which an information device according to an embodiment of the present invention is connected, and FIG. 2 is a configuration diagram showing the configuration of the information device according to an embodiment of the present invention.

  In FIG. 1, an information device according to an embodiment of the present invention is connected to a network (including the Internet) 40 as a remote target information device 10 and is connected to an external device that accesses the remote target information device 10 via the network 40. An information device 20 and an external information device 30 are connected.

  In FIG. 2, the remote target information device includes a PCI bus, an LPC bus, a CPU 100 (a device that controls the operation of the entire information device), a North Bridge 101 (a control controller such as the CPU 100 and the main memory 103), and a South Bridge 102 (a PCI bus or LPC). Control controller for devices connected to the bus), main memory 103 (main storage device for information device), keyboard controller 104 (device for controlling keyboard and mouse), system BIOS (Basic I / O System) 105, encryption Device 106 (device that encrypts data when writing data to password storage device 110), communication control controller 107 (controller that controls communication data from outside to inside or from inside to outside of information device) Communication connector 108 (connector for connecting a communication line with the external), a hard disk 109, the password storage unit 110, a flash memory 111 is provided.

  The hard disk 109 can use a hard disk access lock function as a security function. The hard disk 109 has a first operating system 113 (hereinafter referred to as OS1).

  The flash memory 111 is, for example, a compact flash (registered trademark) (CF), and can be activated only when a wake-up signal (for example, a Wake On LAN (WOL) signal) transmitted from the outside by the system BIOS 105 is received. It is a device that can be controlled.

  The flash memory 111 includes a second operating system 112 (OS2), and the second operating system 112 can perform remote access from the external information device 20.

  Further, the second operating system 112 includes a method of releasing the access lock of the hard disk 109, and the method of releasing the access lock is a password input.

  The second operating system 112 enables remote access to the remote target information device 10 in which the access lock of the hard disk 109 is set as a security function.

  Further, the encryption device 106 is, for example, a trusted platform module (TPM), and the password storage device 110 is, for example, a flash memory that can be encrypted by the encryption device 106.

  The encryption device 106 and password storage device 110 described above realize security maintenance when remote access is performed while security of the remote target information device 10 is maintained.

  Next, a processing method from when the system BIOS 105 of the information device according to the embodiment of the present invention starts up to the operating system will be described with reference to FIGS. FIG. 3 is a flowchart showing normal boot processing performed by the system BIOS of the information device according to the embodiment of the present invention, and FIGS. 4 and 5 are provided in the system BIOS of the information device according to the embodiment of the present invention. FIG. 4 is a diagram illustrating an example of setting items, FIG. 4 is a diagram illustrating an example of setting items of Boot Device Priority in the BIOS Setup Utility, and FIG. 5 is a diagram illustrating an example of setting items of the Boot Priority from S5 in the BIOS Setup Utility. is there. FIG. 6 is a flowchart showing the operation when the wakeup signal of the information device according to the embodiment of the present invention is received, and shows the operation when the setting of Boot Priority from S5 of the system BIOS is [FLASH]. Yes.

  First, in the boot process of the system BIOS 105 of the remote target information device 10, normally, as shown in the operation flow chart of FIG. 3, when the power of the remote target information device 10 is turned on (step S001), the system BIOS 105 (For example, the main memory 103, the hard disk 109, etc.) are initialized (step S002), and the system BIOS 105 is set according to Boot Device Priority (for example, set as shown in FIG. 4) set in the BIOS Setup Utility. A boot process is performed (step S003).

  In the present embodiment, the remote target information device 10 receives the WOL signal transmitted from the external information devices 20 and 30 to the system BIOS 105 through the communication connector 108 for communicating with the outside. It has a function to start up.

  Further, after performing initialization processing of various devices, before the system BIOS 105 performs boot processing processing in accordance with Boot Device Priority, a WOL signal transmitted from the external information device 20 to the system BIOS 105 from a power-off state, The remote target information device 10 has a function of booting from the flash memory 111 when it is received through the communication connector 108 for communicating with the outside.

  As for the above function, setting items as shown in FIG. 5 exist in the BIOS Setup Utility of the system BIOS 105 so that the user can use the function. The system BIOS 105 having the above function performs normal boot when the power is turned on by receiving the WOL signal according to the flowchart shown in FIG. 6 until the device is initialized and booted. Boot processing from the hard disk) and boot processing from the flash memory 111 are switched.

  When the power button is pressed to turn on the power, the system BIOS 105 performs normal boot processing.

  As shown in FIG. 6, when the setting of Boot Priority from S5 is set to [Normal] in the BIOS Setup Utility, the WOL signal is received and the information device is turned on in the same way as the flowchart shown in FIG. Even when S101 is performed, the system BIOS 105 performs initialization processing of various devices (step S102), and performs boot processing in the order of the boot device priority set in the BIOS Setup Utility (step S103).

  Further, when the Boot Priority from S5 is set to [FLASH] and a Wake On LAN signal is received and the information device is turned on (step S101), the system BIOS 105 performs initialization processing of various devices (step S102). ), 1st Boot Device of Boot Device Priority is allocated to the flash memory 111 (step S104).

  Next, the device that has been assigned to the 1st, 2nd, 3rd Boot Device until then is assigned as the 2nd, 3rd, 4th Boot Device (step S105).

  After that, the system BIOS 105 performs boot processing in the order of the Boot Device Priority settings, as in the normal boot. At this time, the boot device priority change performed by the system BIOS 105 during the boot process does not affect the next stand-alone startup.

  Next, the remote access method of the remote target information device 10 in which the access lock of the hard disk 109 is set as a security function of the information device according to the embodiment of the present invention will be described with reference to FIGS. FIG. 7 is a flowchart showing an operation of remotely accessing an information device in which the hard disk access lock is set according to the embodiment of the present invention, and FIG. 8 is a second operating system of the information device according to the embodiment of the present invention. It is an example of a screen display for inputting a hard disk password when releasing an access lock of a hard disk included in the system.

  First, when the setting of Boot Priority from S5 of the system BIOS 105 of the remote target information device 10 is [FLASH], the remote target information is transmitted through the communication connector 108 for communicating the WOL signal transmitted from the external information device 20 with the outside. When the device 10 receives the information (step S201), the system BIOS 105 starts up from the second operating system 112 (step S202).

  Since the second operating system 112 is capable of remote access, it is in a state of accepting remote access after startup (step S203).

  Since the second operating system 112 is a system that can further release the access lock of the hard disk 109, the second operating system 112 stands by in such a state that a password input screen as shown in FIG. 8 can be displayed on the operation screen of the external information device 20. (Step S204).

  Here, remote access is performed from the external information device 20 to the second operating system 112, and a password is input to the hard disk 109 (step S205).

  If the entered password is correct, the access lock of the hard disk 109 is released (step S206). The second operating system 112 restarts (step S207), and the system BIOS starts the first operating system 113 from the hard disk 109 of the remote target information device 10 (step S208).

  When the remote target information device 10 is restarted from the second operating system 112, if the hard disk 109 is in the access lock release state, the remote target information device 10 maintains the access lock release state. Therefore, the first operating system 113 can be started from the hard disk 109.

  Therefore, remote access is possible even with an information device in which a hard disk access lock is set as a security function.

  Next, a method for maintaining security when performing remote access while maintaining security of the information device according to the embodiment of the present invention will be described with reference to FIGS. FIG. 9 is a flowchart showing an operation of setting a new password for the hard disk by the second operating system of the information device according to the embodiment of the invention, and FIG. 10 is an information device according to the embodiment of the invention. FIG. 11 is a display example of a password registration screen in the BIOS Setup Utility for inputting a password when registering a password in the password storage device included in the system BIOS of FIG. 11. FIG. 11 is a diagram of the information device according to the embodiment of the present invention. 2 is a screen display example for inputting a hard disk password when releasing an access lock of a hard disk included in an operating system.

  First, when the access lock of the hard disk 109 is released (step S301), the second operating system 112 reads the password from the password storage device 110 (step S302), and sets a new password in the hard disk 109 (step S303).

  Further, the second operating system 112 sends a message indicating success or failure of the access lock release of the hard disk 109 to the user who performs remote access from the external information device 20 to release the access lock of the hard disk 109. 20 screens are displayed.

  A user who performs remote access from the external information device 20 can confirm the access lock release of the hard disk 109 and the change of the hard disk password by this message.

  When the access lock release of the hard disk 109 and the change of the hard disk password of the hard disk 109 have failed, the hard disk password of the hard disk 109 is not changed.

  By using the above method, when the external information device 20 remotely accesses the second operating system 112 of the remote target information device 10 and inputs the password to the hard disk, the hard disk password of the hard disk 109 is automatically set. Can be changed.

  Further, even if the password input during communication from the external information device 30 is decrypted, the access lock of the hard disk 109 of the remote target information device 10 cannot be released with the decrypted password. The security of the set information device can be maintained.

  Furthermore, the remote target information device 10 of this embodiment has a function of registering a password in the password storage device 110 as a function of the system BIOS 105. The password is registered by the user starting a password list in the BIOS Setup Utility shown in FIG. 10 and inputting a key from the keyboard. The password registered in the password list is the same as the hard disk password registration. For example, as shown in FIG. 10, when the user registers six passwords 1st to 6th, the contents registered in 1st to 6th are used. I need to remember.

  By registering a plurality of passwords in the password storage device 110, when the remote access user releases the access lock of the hard disk 109 from the second operating system 112, the second operating system 112 performs a plurality of password changes to the hard disk 109. Can be executed once.

  Further, when the hard disk password is changed, the second operating system 112 deletes the hard disk password currently used from the password list.

  Further, when the remote access user releases the access lock of the hard disk 109 from the second operating system 112, the second operating system 112 displays a screen as shown in FIG. 11 on the screen of the external information device 20.

  In FIG. 11, the “2nd” portion of the 2nd Password of Password List is a portion indicating which password has been changed in the password list set by the password list in the BIOS Setup Utility shown in FIG. 10. Is displayed corresponding to the currently set password.

  By displaying the screen as shown in FIG. 11, it is not necessary to remember which password in the password list the remote access user inputs, and it is only necessary to remember the contents of the password list. Therefore, by using the above method, a method for performing remote access while maintaining the security of the information device can be executed for the number of registered passwords.

  Next, with reference to FIG. 12, a method for realizing security maintenance when the password cannot be changed in the password changing method of the hard disk 109 of the information device according to the embodiment of the present invention will be described. FIG. 12 is a flowchart showing an operation for maintaining the security of the information device when the information device according to the embodiment of the present invention cannot change the hard disk password.

  First, the second operating system 112 of the remote target information device 10 reads out the password from the password storage device 110 included in the remote target information device 10 (step S401) because the registered password has been used up. If the password reading fails, the function of the information device that is activated by receiving the wake-up signal transmitted from the outside is invalidated (step S402).

  In order to invalidate the function of the information device that is activated by receiving the wakeup signal transmitted from the outside, the Wake On LAN setting item of the system BIOS 105 is set to [Disabled].

  By using the above method, even if the hard disk can be accessed by remote access from an external information device, data leakage from the hard disk can be prevented by restricting remote access.

  As mentioned above, the invention made by the present inventor has been specifically described based on the embodiment. However, the present invention is not limited to the embodiment, and various modifications can be made without departing from the scope of the invention. Needless to say.

  The present invention relates to information devices, and can be widely applied to devices that need to maintain security during remote access in an information society.

1 is a configuration diagram showing an overall configuration of a network to which an information device according to an embodiment of the present invention is connected. It is a block diagram which shows the structure of the information device which concerns on one embodiment of this invention. It is a flowchart which shows the normal boot process which the system BIOS of the information device which concerns on one embodiment of this invention performs. It is a figure which shows an example of the setting item which the system BIOS of the information device which concerns on one embodiment of this invention has. It is a figure which shows an example of the setting item which the system BIOS of the information device which concerns on one embodiment of this invention has. It is a flowchart which shows operation | movement when the wake-up signal of the information device which concerns on one embodiment of this invention is received. 6 is a flowchart showing an operation of remotely accessing an information device in which a hard disk access lock is set according to an embodiment of the present invention. It is an example of a screen display for inputting the hard disk password when releasing the access lock of the hard disk included in the second operating system of the information device according to the embodiment of the present invention. It is a flowchart which shows the operation | movement which the 2nd operating system of the information device which concerns on one embodiment of this invention sets a new password with respect to a hard disk. It is a display example of the password registration screen in the BIOS Setup Utility for inputting a password when registering a password in the password storage device included in the system BIOS of the information device according to the embodiment of the present invention. It is an example of a screen display for inputting the hard disk password when releasing the access lock of the hard disk included in the second operating system of the information device according to the embodiment of the present invention. 6 is a flowchart showing an operation for maintaining the security of the information device when the information device according to the embodiment of the present invention cannot change the hard disk password.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 10 ... Remote object information device, 20 ... External information device, 30 ... External information device, 100 ... CPU, 101 ... North Bridge, 102 ... South Bridge, 103 ... Main memory, 104 ... KBC, 105 ... System BIOS, 106 DESCRIPTION OF SYMBOLS ... Encryption apparatus 107 ... Communication control controller 108 ... Communication connector 109 ... Hard disk 110 ... Password storage device 111 ... Flash memory 112 ... Second operating system 113 ... First operating system

Claims (3)

An information device connected to a network and remotely accessed from an external device via the network,
A first storage device having an access lock function by setting a password and storing a first operating system;
A second storage device for storing a second operating system that is activated when a wake-up signal transmitted from the external device is received;
A password storage device for storing a plurality of passwords for releasing the access lock function of the first storage device;
The second operating system displays a password input screen for allowing the external device that has transmitted the wake-up signal after startup to input a current password, receives the password input by the external device, and receives the received password Is input to the first storage device, the access lock function of the first storage device is released, and after the access lock function is released, the current password is determined from a plurality of passwords stored in the password storage device. The first operating system stored in the first storage device in a state in which the read password is set, the read password is set for the first storage device, and the access lock function is released. An information device that is activated. It has an access lock function by setting a password, and is activated when it receives a wake-up signal transmitted from a first storage device storing a first operating system and an external device connected via a network A second storage device for storing a second operating system; and a password storage device for storing a plurality of passwords for releasing the access lock function of the first storage device; A remote access method in an information device remotely accessed from a device of
The second operating system activated when receiving the wake-up signal transmitted from the external device displays a password input screen that allows the external device that transmitted the wake-up signal to input the current password, and After receiving a password from an external device, inputting the received password to the first storage device, releasing the access lock function of the first storage device, and releasing the access lock function, the password A password different from the current password is read from a plurality of passwords stored in the storage device, the read password is set in the first storage device, and the access lock function is released. Starting the first operating system stored in the storage device Remote access method information device according to symptoms. In the remote access method of the information device according to claim 2,
When reading the password different from the current password from the plurality of passwords stored in the password storage device by the second operating system, the current password is deleted from the password storage device after reading the different password When the password stored in the password storage device fails to be read, the activation by the wake-up signal is invalidated.

Images