JP6293216B2 - Information processing apparatus, control method, and program - Google Patents

Description

  The present invention relates to an information processing apparatus, a control method, and a program.

  In the information processing apparatus, an HDD is used as a storage medium.

  Mirroring exists as a technique for improving HDD reliability. In mirroring, the same data is written to two HDDs. As a result, even if one HDD fails, if the HDD is replaced with a new HDD, rebuilding can be executed using the other HDD, and the same state as before the HDD can be recovered can be restored.

  In addition, a password may be set in the HDD in order to protect the HDD information. A unique password is set between the information processing apparatus and the HDD. Once the password is set, the HDD is locked when the power is turned on next time, and data cannot be accessed to the HDD until the HDD successfully authenticates the password.

  Patent Document 1 describes a technique for setting different passwords for a plurality of HDDs. In Patent Document 1, the password of each HDD is managed in association with the physical connection channel to which the HDD is connected.

JP2007-102761

  In recent years, a removable HDD has been used from the viewpoint of security. The removable HDD is handled so that it is connected to the apparatus only when it is used, and is removed from the apparatus and stored in a safe or the like otherwise.

  When the technique of Patent Document 1 is adopted in an environment where a removable HDD is used, the following problems occur. In an environment where a removable HDD is used, there are many opportunities to attach / detach the HDD to / from the information processing apparatus. For this reason, when the user connects the HDD, the physical connection channel may be wrong. In this case, even if the HDD is originally usable in the information processing apparatus, password authentication fails and the HDD cannot be used. It will disappear.

  The present invention makes it possible to properly execute authentication of the HDD.

An information processing apparatus in which a plurality of storage devices that can be mirrored in the present embodiment can be attached and detached, a detection unit that detects connection of the plurality of storage devices to the information processing device, and the detection unit detects a connection An acquisition unit that acquires information unique to each of the storage devices from a plurality of storage devices, and a plurality of authentication information respectively corresponding to the plurality of storage devices based on the unique information acquired by the acquisition unit Generating means for generating, storing means for storing a plurality of authentication information generated by the generating means, and setting a plurality of authentication information stored by the storing means for the plurality of storage devices set to mirroring, respectively. Setting means for determining, and determining means for determining whether authentication information is set for at least one storage device among the plurality of storage devices; In response to the determination unit determining that the authentication information is set for the one storage device, and the detection unit detecting connection of the one storage device, the storage unit Using the first authentication information among the plurality of stored authentication information, executing the authentication process in one storage device detected by the detection means, and succeeding in the authentication of the one storage device Accordingly, the first authentication information that has succeeded in the authentication is not used, and the second authentication information that is different from the first authentication information is used, and mirroring is set with the one storage device. Disclosed is an information processing apparatus having authentication means for authenticating another storage device.

  According to the present invention, it is possible to appropriately execute HDD authentication.

Block diagram showing the configuration of the disk array system Block diagram showing the configuration of the controller Flow chart showing overall control flow Flow chart showing the flow of password registration Flow chart showing the flow of password authentication

  In the following description, a disk array system will be described as an example of an information processing apparatus (a collective term for various devices such as a PC and an MFP).

[First Embodiment]
FIG. 1 is a block diagram showing the configuration of a disk array system.

  The disk array system 10 includes a controller 100, a RAID control unit 200, and HDDs A300 (first storage means) and HDD B400 (second storage means) as a plurality of HDDs.

  The controller 100 and the RAID control unit 200 are connected via the SATA I / F 500.

  The RAID control unit 200 and HDD A300 are detachably connected via a SATA I / F 501, and the SATA I / F 501 is a physical connection channel A. The RAID control unit 200 and the HDD B400 are detachably connected via a SATA I / F 502, and the SATA I / F 502 is a physical connection channel B. The controller 100 is a block for accessing the HDD A300 and the HDD B400 via the RAID control unit 200, and password management for the HDD A300 and the HDD B400 is also performed in this block.

  The RAID control unit 200 is a block that performs RAID control for access from the controller 100. For example, it is assumed that the function realized by the RAID control unit 200 is RAID1. At this time, the RAID control unit 200 stores one of the HDD A300 and the HDD B400 as a master HDD and the other as a backup HDD. When the RAID control unit 200 receives write data from the controller 100, the RAID control unit 200 transfers the write data to the master HDD and the backup HDD, and when receiving a read request from the controller 100, the RAID control unit 200 transfers the read request to the master HDD. Further, the RAID control unit 200 identifies the master HDD and the backup HDD according to the ID information included in the HDD A300 and the HDD B400.

  The SATA command can be expanded individually by each vendor. The disk array system 10 according to the embodiment of the present invention has a mechanism in which SATA I / Fs 501 and 502 that transmit SATA commands can be selected by preparing some SATA commands as vendor definition commands. The mechanism for selecting the SATA I / F is to prepare a vendor definition command for designating SATA I / Fs 501 and 502 as transmission destinations. The controller 100 continuously transmits a command for selecting the SATA I / F and a SATA command to be actually sent to the HDD to the RAID control unit 200. The RAID control unit 200 receives the command for selecting the SATA I / F, and transmits the SATA command received immediately after to the selected SATA I / F 501 or SATA I / F 502.

  In the disk array system 10 according to the embodiment of the present invention, two HDDs are used. However, the present invention is not limited to this, and the number of HDDs defined by RAID can be accommodated.

  In the disk array system 10 according to the embodiment of the present invention, the HDD is used as a storage medium. However, the present invention is not limited to this, and other types of storage media such as an SSD may be used. .

  FIG. 2 is a block diagram showing the configuration of the controller 100.

  The CPU 101 is a functional module that controls the controller 100.

  The ROM 102 is a functional module that holds a control program (not shown) that runs on the CPU 101.

  The RAM 103 is a functional module used for holding temporarily generated data.

  The unique information holding unit 104 is a functional module that holds unique information of the disk array system 10, and the unique information means manufacturer-specific information, a serial number, and the like. Note that the unique information holding unit 104 may exist in the ROM 102.

  The password generation unit 105 is a functional module that generates passwords for the HDD A300 and the HDD B400. Note that the function of the password generation unit 105 may be executed by the CPU 101.

  The password management unit 106 is a functional module that manages the password generated by the password generation unit 105. Note that the password management unit 106 may exist in the ROM 102.

  The SATA control unit 107 is a functional module that controls a device that conforms to the serial ATA specification.

  Each functional module in the controller 100 is connected via an internal bus 108. In the embodiment of the present invention, the internal bus is realized by using a standardized bus architecture such as PCI. The SATA control unit 107 functions as a bus bridge between the internal bus 108 and the SATA I / F 500.

  FIG. 3 is a flowchart showing the flow of the entire control.

  The control shown in FIG. 3 is realized by the CPU 101 reading out the program stored in the ROM 102 to the RAM 103 and executing it.

  First, the disk array system 10 is powered on (S100).

  At this time, the RAID control unit 200 detects the connection of the master HDD and the backup HDD.

  Next, the CPU 101 prepares a master HDD non-detection flag in the RAM 103, and substitutes “0” for the master HDD non-detection flag (S101).

  Next, the CPU 101 determines whether the connection of the master HDD is detected via the RAID control unit 200 (S102).

  When the connection of the master HDD is detected (S102 Yes), the CPU 101 determines whether or not a password is set for the master HDD (S103). Specifically, the following control is executed. The CPU 101 instructs the SATA control unit 107 to confirm the password setting status of the master HDD. The SATA control unit 107 transmits an IDENTIFY DEVICE command to the master HDD. The CPU 101 determines whether a password has been set for the master HDD from the execution result of the IDENTIFY DEVICE command.

  When no password is set in the master HDD (No in S103), the CPU 101 performs password registration according to an HDD password registration flow (described later with reference to FIG. 4) (S110).

  When a password is set in the master HDD (S103 Yes), the CPU 101 performs password authentication (first authentication processing) according to the HDD password authentication flow (described later with reference to FIG. 5) (S111).

  When the connection of the master HDD is not detected (No in S102), the CPU 101 substitutes “1” for the master HDD non-detection flag (S106).

  Next, the CPU 101 determines whether the connection of the backup HDD has been detected via the RAID control unit 200 (S104).

  When the connection of the backup HDD is detected (S104 Yes), the CPU 101 determines whether or not a password is set for the backup HDD (S105). Specifically, the following control is executed. The CPU 101 instructs the SATA control unit 107 to confirm the password setting status of the backup HDD. The SATA control unit 107 transmits an IDENTIFY DEVICE command to the backup HDD. The CPU 101 determines whether a password has been set for the backup HDD from the execution result of the IDENTIFY DEVICE command.

  When the password is not set in the backup HDD (No in S105), the CPU 101 performs password registration according to the HDD password registration flow (described later with reference to FIG. 4) (S110).

  When a password is set for the backup HDD (S105 Yes), the CPU 101 performs password authentication (second authentication processing) according to the HDD password authentication flow (described later with reference to FIG. 5) (S111).

  When the connection of the backup HDD is not detected (No in S104), the CPU 101 determines whether or not the value of the master HDD non-detection flag is “1” (S107).

  When the value of the master HDD non-detection flag is “1” (S107 Yes), the CPU 101 detects a system error (S108). When the disk array system 10 detects a system error, it notifies the user interface (not shown) of this content.

  When the value of the master HDD non-detection flag is “0” (No in S107), the CPU 101 detects an operation state in one HDD called “degrade” (S109). The degraded state is a state in which only one HDD (non-failed HDD) is operating, and no access is being made to the other HDD (failed HDD). When the disk array system 10 detects the degradation, it notifies the user interface (not shown) of this content.

  FIG. 4 is a flowchart showing the flow of password registration (S110).

  First, the CPU 101 controls the SATA control unit 107 to acquire the HDD ID (S200). Specifically, the following control is executed. The CPU 101 instructs the SATA control unit 107 to acquire the HDD ID. The SATA control unit 107 transmits an IDENTIFY DEVICE command that is a SATA command. The RAID control unit 200 transmits the received command to a suitable HDD, either HDD A300 or HDD B400. The HDD that has received the IDENTIFY DEVICE command transmits HDD ID information and the like to the SATA control unit 107 via the RAID control unit 200. The SATA control unit 107 transmits the acquired HDD ID information and the like to the RAM 103, and then notifies the CPU 101 of the completion of acquisition of the ID information.

  Next, the CPU 101 acquires unique information (S201). Specifically, the following control is executed. In response to the completion of the HDD ID acquisition, the CPU 101 instructs the unique information holding unit 104 to transmit the unique information held by the unique information holding unit 104 to the RAM 103. The unique information holding unit 104 receives the unique information transmission instruction, transmits the unique information to the RAM 103, and notifies the CPU 101 of the fact after the transmission is completed.

  Next, the CPU 101 controls the password generation unit 105 to generate a password (S202). Specifically, the following control is executed. In response to the completion of acquisition of the unique information, the CPU 101 instructs the password generation unit 105 to generate a password using the HDD ID and unique information held in the RAM 103. The password generation unit 105 receives a password generation instruction, generates a password, and transmits the generated password to the RAM 103. The password generation unit 105 notifies the CPU 101 of the completion of transmission of the password to the RAM 103.

  Next, the CPU 101 controls the password management unit 106 to register a password (S203). Specifically, the following control is executed. In response to the completion of the password generation, the CPU 101 instructs the password management unit 106 to register the generated password. The password management unit 106 receives the password registration instruction, holds the password held in the RAM 103 in a nonvolatile memory (not shown), and notifies the CPU 101 of the fact after the password holding is normally completed.

  Next, the CPU 101 controls the SATA control unit 107 to set a password in the HDD (S204). Specifically, the following control is executed. In response to the completion of password registration, the CPU 101 instructs the SATA control unit 107 to set a password in the HDD. The SATA control unit 107 transmits a SECURITY SET PASSWORD command that is a SATA command based on the password held in the password management unit 106. The RAID control unit 200 transmits the received command to a suitable HDD, either HDD A300 or HDD B400. The HDD that has received the SECURITY SET PASSWORD command sets a password according to the command. The HDD transmits to the SATA control unit 107 via the RAID control unit 200 that the SECURITY SET PASSWORD command has been successfully executed. The SATA control unit 107 notifies the CPU 101 of the completion of password setting after the SECURITY SET PASSWORD command is normally executed.

  Note that a fixed address that is determined in advance may be used as the address that holds the HDD ID, unique information, password, and the like held in the RAM 103. An address dynamically secured by an operating system (not shown) operating on the CPU 101 may be used.

  FIG. 5 is a flowchart showing the flow of password authentication (S111).

  First, the CPU 101 prepares an authentication NG flag in the RAM 103, and substitutes “0” for the authentication NG flag (S300).

  Next, the CPU 101 selects the password 1 (first authentication information) held by the password management unit 106 (S301).

Next, the CPU 101 executes HDD authentication using the password 1 (S302).
Specifically, the following control is executed. The CPU 101 instructs the SATA control unit 107 to transmit the selected password to the HDD. The SATA control unit 107 transmits a SECURITY UNLOCK command based on the selected password. The RAID control unit 200 transmits the received command to either the HDD A300 or the HDD B400.

  Next, the CPU 101 determines whether or not the HDD authentication result is OK (S303). Specifically, the following control is executed. According to the specification of the SATA command, the success / failure of password authentication for the HDD can be determined by the end state of the SECURITY UNLOCK command. If the SECURITY UNLOCK command ends normally, it means that password authentication for the HDD has been successful (S303 Yes). In this case, use of the HDD is permitted. If the SECURITY UNLOCK command ends abnormally, it means that password authentication for the HDD has failed (No in S303). In this case, the use of the HDD is restricted (for example, prohibited). The RAID control unit 200 transmits the end state of the SECURITY UNLOCK command to the SATA control unit 107. The SATA control unit 107 notifies the CPU 101 of the execution result of the SECURITY UNLOCK command.

  If the HDD authentication with the password 1 is successful (S303 Yes), the CPU 101 ends the HDD authentication process.

  On the other hand, when HDD authentication using the password 1 fails (S303 No), the CPU 101 determines whether or not the value of the authentication NG flag is “1” (S304).

  When the value of the authentication NG flag is “1” (S304 Yes), the CPU 101 determines that there is an HDD authentication error (S305). When the disk array system 10 detects an HDD authentication error, the disk array system 10 notifies the user interface (not shown) of this content.

  When the value of the authentication NG flag is “0” (No in S304), the CPU 101 assigns “1” to the authentication NG flag (S306).

Next, the CPU 101 selects the password 2 (second authentication information) held by the password management unit 106 (S307).
Thereafter, the process returns to S302, and HDD authentication is executed using the password 2.

[Second Embodiment]
In this embodiment, when the password authentication of the master HDD is successful, the password authentication of the backup HDD is performed without using the authentication information that has succeeded in the authentication.

  As a result, it is not necessary to try useless authentication in password authentication of the backup HDD, and the speed of authentication processing is increased.

[Third Embodiment]
In the present embodiment, when an HDD that has been successfully authenticated is reconnected, the HDD is authenticated by preferentially using authentication information that has been successfully authenticated.

  As a result, in the password authentication of the HDD once successfully authenticated, it is not necessary to try useless authentication, and the speed of the authentication process is increased.

[Fourth Embodiment]
In the present embodiment, when the HDD fails, the authentication information corresponding to the failed HDD is deleted from the password management unit.

  As a result, in the password authentication of the HDD connected instead of the failed HDD, unnecessary authentication is not attempted, and the speed of the authentication process is increased.

[Other Embodiments]
The present invention is also realized by executing the following processing.

  That is, software (program) that realizes the functions of the above-described embodiments is supplied to a system or apparatus via a network or various storage media, and a computer (or CPU, MPU, or the like) of the system or apparatus reads the program. It is a process to be executed.

Claims (5)

A removable information processing apparatus a plurality of storage peripherals capable mirroring configuration,
Detecting means for detecting connection of the plurality of storage devices to the information processing device;
Acquisition means for acquiring information unique to each of the storage devices from a plurality of storage devices for which the detection means has detected a connection;
Based on the unique information obtained by the obtaining means, a generating means for generating a plurality of authentication information corresponding to the plurality of storage devices,
Storage means for storing a plurality of authentication information generated by the generation means;
A plurality of authentication information said storage means has stored a setting means to set each for the plurality of storage devices that are mirrored set,
Determining means for determining whether or not authentication information is set for at least one of the plurality of storage devices;
In response to the determination by the determination unit determining that the authentication information is set for the one storage device and the detection unit detecting a connection of the one storage device, the storage unit Using the first authentication information among the plurality of stored authentication information, executing the authentication process in one storage device detected by the detection means, and succeeding in the authentication of the one storage device Accordingly, the first authentication information that has succeeded in the authentication is not used, and the second authentication information that is different from the first authentication information is used, and mirroring is set with the one storage device. An information processing apparatus comprising authentication means for authenticating another storage device. The information processing apparatus according to claim 1 , wherein when the determination unit determines that authentication information is not set in the storage device, the setting unit sets authentication information in the storage device. 3. The authentication unit according to claim 1, wherein when the storage device that has been successfully authenticated is reconnected, the authentication unit authenticates the storage device by using authentication information that has been successfully authenticated first. Information processing device. When the storage device fails, the described authentication information corresponding to the failed storage device to any one of claims 1乃optimum 3, characterized by further comprising a deleting means for deleting from the storage means Information processing device. A control method executed by an information processing device capable of detaching a plurality of storage devices that can be mirrored,
A detecting step of detecting connection of the plurality of storage devices to the information processing device;
An acquisition step of acquiring information unique to each storage device from a plurality of storage devices in which the detection step has detected connection;
Based on the unique information acquired by the acquisition step, a generation step of generating a plurality of authentication information respectively corresponding to the plurality of storage devices;
A storage step of storing a plurality of authentication information generated by the generation step in a predetermined storage unit;
A setting step for setting a plurality of authentication information stored in the storage step for each of the plurality of storage devices that are mirrored;
A determination step of determining whether authentication information is set for at least one storage device among the plurality of storage devices;
In response to the determination step determining that the authentication information is set for the one storage device, and the detection step detecting a connection of the one storage device, the storage step Using the first authentication information among the plurality of stored authentication information, executing the authentication process in one storage device detected by the detection step, and succeeding in the authentication of the one storage device Accordingly, the first authentication information that has succeeded in the authentication is not used, and the second authentication information that is different from the first authentication information is used, and mirroring is set with the one storage device. An information processing apparatus control method comprising an authentication step of authenticating another storage device.

Images