JP5289510B2 - Information processing apparatus and lock setting method - Google Patents

Description

  The present invention relates to an information processing apparatus and a lock setting method.

  Conventionally, in an information processing device such as a personal computer, in order to prevent unauthorized use in the case of theft, the processing operation or Some have a lock mechanism that locks data access. Japanese Patent Application Laid-Open No. 2004-151867 discloses a conventional technique for remotely locking a terminal by notifying a terminal of a signal for instructing PC lock to the terminal via a communication network.

JP 2007-12028 A

  However, in the above prior art, the lock cannot be made effective for a lock mechanism of a type different from the lock mechanism that is remotely locked. Therefore, if the information processing device has a plurality of different types of lock mechanisms, even if the lock is remotely locked by one lock mechanism, the other lock mechanisms cannot be used effectively, for example, there are a plurality of lock mechanisms. However, the locking mechanism cannot enhance the security effect of preventing unauthorized use.

  The present invention has been made in view of the above, and provides an information processing apparatus and program capable of enhancing the security effect of these lock mechanisms when they have a plurality of different types of lock mechanisms. For the purpose.

In order to solve the above-described problems and achieve the object, the information processing apparatus according to the embodiment is interlocked with the setting of the lock mechanism of a plurality of lock modules that can set the lock mechanism to be valid or invalid and the lock mechanism of another lock module. And setting means for enabling or disabling the interlock setting for enabling the lock mechanism of each lock module, and when at least one of the lock mechanisms of the plurality of lock modules is enabled, the interlock setting is valid. And a control means for enabling the lock mechanism of the set lock module, and at least one of the plurality of lock modules can be set to enable or disable the lock mechanism by a remote notification. It is characterized by that.
In addition, the information processing apparatus according to the embodiment includes a plurality of lock modules that can be set to enable or disable the lock mechanism, and an interlock that enables the lock mechanism of each lock module in conjunction with the setting of the lock mechanism of another lock module. And setting means for setting the setting as valid or invalid.

Further, the lock setting method of the embodiment is a lock setting method executed by the information processing device , wherein the setting unit of the information processing device sets the lock mechanism of a plurality of lock modules to be valid or invalid, and a step of interlocking setting unit of the information processing apparatus sets the enable or disable the link setting to enable the locking mechanism of the lock module in conjunction with the setting of the locking mechanism of the other lock module, the information processing apparatus The control means, when at least one of the lock mechanisms of the plurality of lock modules is set to be valid, enabling the lock mechanism of the lock module for which the interlocking setting is set to be valid, And at least one of the plurality of lock modules enables or disables the lock mechanism based on a remote notification. Characterized in that it is a configurable.

  According to the present invention, when a plurality of lock mechanisms of different types are provided, it is possible to increase the security effect of the lock mechanisms.

FIG. 1 is an example of a perspective view of the information processing apparatus according to the present embodiment. FIG. 2 is an example of a block diagram illustrating a system configuration of the information processing apparatus according to the present embodiment. FIG. 3 is a flowchart illustrating an example of processing at the time of starting the information processing apparatus according to the present embodiment. FIG. 4 is a diagram illustrating an example of a setup screen.

  Exemplary embodiments of an information processing apparatus and a program according to the present invention will be explained below in detail with reference to the accompanying drawings. In the drawings, the same elements are given the same reference numerals, and duplicate descriptions are omitted.

  FIG. 1 is an example of a perspective view of an information processing apparatus 1 according to the present embodiment. As shown in FIG. 1, the information processing apparatus 1 is a notebook personal computer. In the present embodiment, a notebook personal computer is exemplified as the information processing apparatus 1, but the information processing apparatus 1 may be a desktop personal computer, for example, and is not particularly limited.

  The information processing apparatus 1 includes a computer main body 3 and a display unit 5 that can be opened and closed with respect to the computer main body 3. In the display unit 5, an LCD 7 (Liquid Crystal Display) is incorporated as a display device, and the display screen of the LCD 7 is located substantially at the center of the display unit 5.

  The display unit 5 is attached to the computer main body 3 so as to be rotatable between an open position and a closed position. The computer main body 3 has a thin box-shaped housing 3a, and a keyboard 9 having various keys on the top surface thereof, a power switch 11 for powering on / off the information processing apparatus 1, a touch pad 15, and A click button 17 and the like are arranged. In addition, a large capacity storage medium such as a communication I / F 13 for connecting to a LAN (Local Area Network) or the Internet or a DVD (Digital Versatile Disc) medium is taken in and out of the case 3a. A slot 19 is provided.

  FIG. 2 is an example of a block diagram illustrating a system configuration of the information processing apparatus 1 according to the present embodiment. As shown in FIG. 2, the information processing apparatus 1 includes a motherboard 101 in a housing 3 a of the computer main body 3. On the motherboard 101, chips such as a CPU 102, a north bridge 103, and a south bridge 104 are mounted as main arithmetic units.

  A CPU 102 (Central Processing Unit) centrally controls the operation of the information processing apparatus 1. Specifically, the CPU 102 executes a program such as a BIOS, an OS, and various applications that are read from the ODD 121, the BIOS-ROM 106, etc., and expanded in the memory 105, and outputs a control signal to each unit, thereby processing the information processing apparatus. 1 operation is controlled.

  The north bridge 103 is a chip that performs memory and display-related control, and the south bridge 104 is a chip that controls a peripheral component interconnect (PCI) bus, a low pin count (LPC) device, and the like. The LCD 7 of the display unit 5 is connected to the display controller 107 of the north bridge 103. The housing 3a incorporates an HDD (Hard Disk Drive) in which an OS (Operation System), various applications, data files, and the like are stored. Further, an ODD 121 (Optical Disc Drive) in which a large-capacity storage medium such as a DVD medium can be inserted from the outside through the slot 19 is also built in the housing 3a. The ODD 121 writes data to the mass storage medium inserted through the slot 19 and reads data stored in advance.

  The south bridge 104 includes a PCI device 109 such as a SATA (Serial Advanced Technology Attachment) controller or a USB (Universal Serial Bus) controller. Various devices such as the HDD 120, the ODD 121, and the communication device 21 that are connected via USB are connected to the south bridge 104 via the PCI device 109. Here, the communication device 21 connected by USB is a communication device for using a mobile communication service provided to the public by a telecommunications carrier, and performs data communication using, for example, a third generation communication system. .

  The motherboard 101 further includes a memory 105 such as a random access memory (RAM), a BIOS-ROM 106 (BIOS memory) that is a rewritable nonvolatile memory, an EC / KBC 108, a CMOS 111, a network controller 113, and a flash ROM 114. Yes.

  Programs such as BIOS and OS are expanded in the memory 105 and operate. The BIOS-ROM 106 stores a BIOS program that controls the information processing apparatus 1. A program for controlling the display controller 107 is stored in a VGA-BIOS 110 (Video Graphics Array-BIOS) of the BIOS-ROM 106. The setting memory 112 is a nonvolatile memory that stores various setting information.

  The EC / KBC 108 is a chip in which an embedded controller (EC) for power management and a keyboard controller (KBC) for controlling the keyboard 9, the touch pad 15, the click button 17, and the like are integrated. The EC / KBC 108 has a function of turning on / off the power of the information processing apparatus 1 according to the operation of the power switch 11 by the user. Further, the EC / KBC 108 accepts operations of the keyboard 9, the touch pad 15, and the click button 17 by the user.

  A CMOS 111 (Complementary Metal Oxide Semiconductor) and a Flash ROM 114 store information necessary for starting up the information processing apparatus 1. The network controller 113 is a communication device that performs communication with an external network such as a LAN or the Internet connected via the communication I / F 13.

  In the information processing apparatus 1, the CPU 102 executes a program stored in the BIOS-ROM 106, the HDD 120, or the like, or is controlled by a dedicated engine provided in the south bridge 104 or the like. It has a lock mechanism that locks the processing operation, data access, etc. of the information processing apparatus 1 using a notification via the communication device 21 and the communication I / F 13 as a trigger. The lock of the processing operation by the lock mechanism may include erasure of data stored in the HDD 120 or the like in addition to stopping execution of the OS and various applications. The state in which the processing operation or data access of the information processing apparatus 1 is locked by the activation of the above-described locking mechanism is referred to as a locked state in the following description. With this locking mechanism, the information processing apparatus 1 can prevent unauthorized use by a user. Moreover, when stolen, the locked state can be remotely established.

  The information processing apparatus 1 has a plurality of different types of the locking mechanisms described above. In the present embodiment, it is assumed that the information processing apparatus 1 has three lock mechanisms: a first lock mechanism, a second lock mechanism, and a third lock mechanism. The information processing apparatus 1 may have any number of locking mechanisms as long as it is at least two.

  Here, the first lock mechanism is a lock mechanism that enables / disables the lock remotely by notification from the third generation communication system connected via the communication device 21. The status for enabling / disabling the first lock mechanism is stored in a predetermined area in the Flash ROM 114 when notified from the remote by the third generation communication system. In the information processing apparatus 1, when the CPU 102 periodically refers to the status stored in the FlashROM 114 and the status enables the first lock mechanism, a predetermined program is set to activate the first lock mechanism. Execute.

  The second lock mechanism is a lock mechanism that enables / disables the lock remotely by a notification from a server such as a LAN or the Internet connected via the communication I / F 13. The status for enabling / disabling the second lock mechanism is stored in a predetermined area in the CMOS 111 when notified from a remote location by a notification from a server such as a LAN or the Internet. In the information processing apparatus 1, the CPU 102 periodically refers to the status stored in the CMOS 111, and when the status enables the second lock mechanism, a predetermined program is set to activate the second lock mechanism. Execute.

  The third locking mechanism is a locking mechanism that is realized by being controlled by a dedicated ME (Management Engine, hereinafter referred to as ME) provided in the south bridge 104. This ME polls each part of the information processing apparatus 1 to monitor the state of the device, and there is a notification that the lock is valid due to a user authentication failure or communication via the communication I / F 13 or communication device 21. If not, it operates in normal mode without locking. When there is a notification that the lock is valid due to failure of user authentication or communication via the communication I / F 13 or the communication device 21, the ME shifts to a theft mode in which the lock is performed. The processing operation of the information processing apparatus 1 is locked, for example, by limiting access to Note that the CPU 102 checks in which mode the ME is operating, that is, when checking the status regarding the validity / invalidity of the third lock mechanism, via the MEBx (Management Engine BIOS Extension) having the BIOS I / F function of the ME. To do that check.

  The types of the first to third lock mechanisms described above are merely examples, and are not particularly limited. For example, any of the first to third lock mechanisms has a status indicating that the lock is valid in the nonvolatile memory such as the FlashROM 114 when there is a user authentication failure by a password or a fingerprint authentication device (not shown). The information processing apparatus 1 may be locked by writing.

  Next, the operation at the time of starting the information processing apparatus 1 will be described with reference to FIG. FIG. 3 is a flowchart illustrating an example of processing at the time of starting the information processing apparatus 1 according to the present embodiment.

  As shown in FIG. 3, when the power switch 11 of the information processing apparatus 1 is operated and the power is turned on (S11), the EC / KBC 108 notifies the CPU 102 that the power is turned on. In response to the power-on notification, the CPU 102 reads out the BIOS program stored in the BIOS-ROM 106, expands it in the memory 105, and starts its execution (S12).

  Next, the CPU 102 serving as a check unit checks the status of the first to third lock mechanisms (S13 to S15). Specifically, the CPU 102 accesses the status stored in the Flash ROM 114 to check the status of whether the first lock mechanism is valid or invalid. Further, the CPU 102 accesses the status stored in the CMOS 111 to check the status of whether the second lock mechanism is valid or invalid. Further, the CPU 102 checks the status of whether the third lock mechanism is valid or invalid by accessing the ME via the MEBx.

  Next, the CPU 102 determines whether or not any one of the first to third lock mechanisms is effective based on the status check in S13 to S15 (S16). In S16, if none of the first to third lock mechanisms is valid and all are invalid (NO), the CPU 102 continues to execute the BIOS as usual (S17).

  When executing the BIOS after S17, the CPU 102 displays the setup screen depending on whether or not a predetermined key operation for displaying a setup screen for performing various setups has been performed on the keyboard 9. It is determined whether or not to perform (S18). When a predetermined key operation is performed on the keyboard 9 and a setup screen is displayed (S18: YES), the CPU 102 as the linkage setting means reads and sequentially executes the VGA-BIOS 110, and stores the current setting information in the setting memory. The setup screen is read from 112 and displayed on the LCD 7 (S19), and the setting from the user is received from the keyboard 9 or the like (S20).

  FIG. 4 is a diagram illustrating an example of a setup screen. As shown in FIG. 4, in S19, the LCD 7 displays a setup screen including an item selection area G1, a detailed setting area G2, an operation guide display area G3, a setting guide display area G4, a cursor G5, and the like. The item selection area G1 is an area that displays various setting items and receives selection of an item to be set by the cursor G5. The detailed setting area G2 is an area in which the detailed setting of the item selected in the item selection area G1 is received by the cursor G5. The operation guide display area G3 is an area for displaying an operation method on the setup screen. The setting guide display area G4 is an area for displaying an item selected in the item selection area G1 and guidance regarding detailed settings of the item.

  On the setup screen shown in FIG. 4, the interlocking setting of the lock mechanism, which is the item selected in the item selection area G1, is performed. In the interlock setting of the lock mechanism, it is set whether or not each lock mechanism included in the information processing apparatus 1 is enabled in conjunction with another lock mechanism being enabled. For example, when the second lock mechanism is enabled in conjunction with the first and third lock mechanisms being effective, the second lock mechanism is effective in a state where the cursor G5 is aligned with the second lock mechanism in the detailed setting area G2. Select the item with the arrow keys. Conversely, even if the first and third lock mechanisms are valid, if they are not valid in conjunction with each other, an invalid item is selected with an arrow key or the like. Further, the interlocking setting may be uniformly performed by selecting an item that enables the interlocking setting of all the locking mechanisms or disables the interlocking setting of all the locking mechanisms.

  Thus, on the setup screen, it is possible to set the validity / invalidity of the interlock setting for each of the first to third lock mechanisms. In the example of FIG. 4, the interlock setting of the first and second lock mechanisms is valid, and the interlock setting of the third lock mechanism is invalid. For this reason, the first and second locking mechanisms are interlocked when the other locking mechanisms are effective, but the third locking mechanism is interlocked even when the other locking mechanisms are effective. Will not be considered effective.

  Next, the CPU 102 updates the setting information in the setting memory 112 with the setting contents received in S20 (S21). By this S21, the interlocking setting of the lock mechanism accepted in S20 is updated. The setting information in S21 may be updated only when there is an update instruction using the keyboard 9 or the like. When the setup screen is not displayed (S18: NO), or after updating the setting information in the setting memory 112 in S21, the CPU 102 expands the OS stored in the HDD 120 in the memory 105 by continuing the execution of the BIOS. Then, normal activation by the OS is started (S22).

  If at least one of the first to third lock mechanisms is valid in S16 (YES), the CPU 102 refers to the above-described interlocking setting relating to each lock mechanism from the setting information stored in the FlashROM 114 (S23).

  Next, the CPU 102 determines whether or not the first lock mechanism is invalid due to the status check and the interlocking setting of the first lock mechanism referred to in S23 is valid (S24). In S24, when the first lock mechanism is invalid and the interlocking setting of the first lock mechanism is valid (YES), the CPU 102 as the lock setting means effectively rewrites the status stored in the FlashROM 114. The first lock mechanism is activated (S25). When the interlock setting of the first lock mechanism is invalid (NO), the CPU 102 proceeds to the next process without performing S25. That is, in S25, when the interlock setting of the first lock mechanism is valid, the first lock mechanism is validated in conjunction with a lock mechanism other than the first lock mechanism.

  Next, the CPU 102 determines whether or not the second lock mechanism is invalid by the status check and whether or not the interlocking setting of the second lock mechanism referred to in S23 is valid (S26). In S26, when the second lock mechanism is invalid and the interlocking setting of the second lock mechanism is valid (YES), the CPU 102 as the lock setting means rewrites the status stored in the CMOS 111 effectively. Then, the second locking mechanism is enabled (S27). If the interlock setting of the second lock mechanism is invalid (NO), the CPU 102 proceeds to the next process without performing S27. That is, in S27, when the interlock setting of the second lock mechanism is valid, the second lock mechanism is enabled in conjunction with a lock mechanism other than the second lock mechanism.

  Next, the CPU 102 determines whether or not the third lock mechanism is invalid due to the status check, and whether or not the interlocking setting of the third lock mechanism referred to in S23 is valid (S28). In S28, when the third lock mechanism is invalid and the interlocking setting of the third lock mechanism is valid (YES), the CPU 102 as the lock setting means performs polling performed by the ME to each part of the information processing apparatus 1. The third locking mechanism is enabled by hooking and notifying the ME of dummy information such as failure of user authentication (S29). On the other hand, when the interlocking setting of the third lock mechanism is invalid (NO), the CPU 102 proceeds to the next process without performing S29. That is, in S29, when the interlock setting of the third lock mechanism is valid, the third lock mechanism is enabled in conjunction with a lock mechanism other than the third lock mechanism.

  Next, the CPU 102 continues to execute the BIOS (S30). At this time, among the first to third lock mechanisms, any one of the lock mechanisms in which the status is valid is sequentially activated, and the information processing apparatus 1 is locked (S31).

  For example, when the status stored in the Flash ROM 114 is valid, the first lock mechanism is activated, and the BIOS forcibly turns off the information processing apparatus 1 without starting the OS. The information processing apparatus 1 is set to the locked state. When the statuses of a plurality of lock mechanisms are valid, all the lock mechanisms whose statuses are valid are activated sequentially, and the information processing apparatus 1 is forcibly turned off until it is individually locked. Or processing such as stopping the execution of the BIOS is not performed. Therefore, in S31, all the lock mechanisms having valid statuses are in a locked state, and the security effect of preventing unauthorized use can be further enhanced.

  As described above, the information processing apparatus 1 checks whether or not the lock is effective for each of a plurality of lock mechanisms of different types under the control of the CPU 102, and as a result of the check, the lock is effective. When there is a certain lock mechanism, the lock of another lock mechanism in which the lock is not valid is set to be effective in conjunction with the lock mechanism. Therefore, when there is a lock mechanism in which the lock is effective, the information processing apparatus 1 is also effective in conjunction with the lock mechanism, and other lock mechanisms in which the lock is not effective is also effective. Can be increased.

  Note that the program executed by the information processing apparatus 1 of the present embodiment is provided by being incorporated in advance in a ROM or the like. A program executed by the information processing apparatus 1 according to the present embodiment is an installable or executable file, and is a computer-readable recording such as a CD-ROM, a flexible disk (FD), a CD-R, or a DVD. You may comprise so that it may record and provide on a medium.

  Furthermore, the program executed by the information processing apparatus 1 according to the present embodiment may be provided by being stored on a computer connected to a network such as the Internet and downloaded via the network. Further, the program executed by the information processing apparatus 1 of the present embodiment may be configured to be provided or distributed via a network such as the Internet.

  It should be noted that the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. In addition, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the above embodiments. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, constituent elements over different embodiments may be appropriately combined.

1 Information processing device 7 LCD
9 Keyboard 11 Power switch 13 Communication I / F
21 Communication device 102 CPU
103 North Bridge 104 South Bridge 105 Memory 106 BIOS-ROM
107 Display controller 108 EC / KBC
109 PCI device 110 VGA-BIOS
111 CMOS
112 Setting memory 114 FlashROM
120 HDD
121 ODD
G5 cursor

Claims (9)

Multiple locking modules that can be set to enable or disable the locking mechanism; and
A setting means for setting the interlocking setting to enable or disable the lock mechanism of each lock module in conjunction with the setting of the lock mechanism of another lock module;
When at least one of the lock mechanisms of the plurality of lock modules is set to be effective, control means for enabling the lock mechanism of the lock module in which the interlock setting is set to be effective;
With
At least one of the plurality of lock modules can set the lock mechanism to be valid or invalid by a notification from a remote.   The information processing apparatus according to claim 1, further comprising an output unit that outputs a display screen for setting the interlocking setting.   2. The apparatus according to claim 1, further comprising an activation control unit that locks a processing operation or data access of the information processing apparatus when a lock mechanism is set to be valid among the plurality of lock modules. The information processing apparatus described in 1. Multiple locking modules that can be set to enable or disable the locking mechanism; and
A setting means for setting the interlocking setting to enable or disable the lock mechanism of each lock module in conjunction with the setting of the lock mechanism of another lock module;
An information processing apparatus comprising:   The control device for enabling the lock mechanism of the lock module in which the interlock setting is set to be effective when at least one of the lock mechanisms of the plurality of lock modules is set to be effective. Item 5. The information processing apparatus according to Item 4.   The information processing apparatus according to claim 4, further comprising an output unit that outputs a display screen for setting the linkage setting.   The information processing apparatus according to claim 4, wherein at least one of the plurality of lock modules can set the lock mechanism to be valid or invalid by a notification from a remote.   The information processing apparatus according to claim 4, wherein at least one of the plurality of lock modules can set the lock mechanism to be valid or invalid based on a result of user authentication in the information processing apparatus. A lock setting method executed by an information processing apparatus,
The setting means of the information processing apparatus sets the lock mechanism of a plurality of lock modules to be valid or invalid; and
A step of setting the linkage setting means of the information processing device to be valid or invalid in conjunction with the setting of the lock mechanism of another lock module to enable the lock mechanism of each lock module;
The control means of the information processing apparatus, when at least one of the lock mechanisms of the plurality of lock modules is set to be effective, enabling the lock mechanism of the lock module for which the interlocking setting is set to be effective And having
The lock setting method, wherein at least one of the plurality of lock modules can set the lock mechanism to be valid or invalid by a remote notification.

Images