JP4775011B2 - Information processing device with password function - Google Patents

Description

  The present invention relates to a security function of an information processing apparatus typified by a personal computer (hereinafter “PC”).

  In recent years, portable information processing devices such as notebook PCs have become widespread and can be easily taken out outdoors, but they are stolen and there are many incidents in which information recorded inside is leaked. It has become a social problem. It is a well-known fact that security functions are generally added to recent PCs for such problems.

  For example, in order to prevent unauthorized use of a PC, if the password is not entered or verified at the time of activation, the operating system (OS) will not be activated and the activation of the PC itself will be refused. It is common to perform correctness judgment and control access to data. However, since the password is composed of alphanumeric characters or symbols of a certain number of digits, if the password is repeatedly input while changing the alphanumeric characters, it will eventually match the correct password. At this time, if the user's password input operation is illegally monitored, the number of characters in the password and the characters to be configured are estimated from the display of the input status on the display and the operation status of the keyboard, and the password can be identified with a small number of trials. Can be done. Therefore, the possibility of password leakage is still high, and even if a password determination step is provided, unauthorized access to individual information cannot be effectively prevented.

  FIG. 5 is a flowchart showing the operation of the unauthorized access prevention system for a PC according to Patent Document 1 as a prior art.

  First, in step A, the user turns on the PC. In step B, the password confirmation processing unit of the PC displays a password input screen on the display device before starting the OS, and prompts the user to input a password. Here, the user inputs a password from a keyboard which is an input device. The input key code is stored in a temporary input buffer of the password confirmation processing unit for each character until a line feed key is received, and is displayed on the display device so that the user can understand the input status. However, it is generally displayed after being replaced with another symbol such as “*” so that the password itself is not displayed.

  If the user inputs a password from the keyboard in response to the input request, in step C, the password confirmation processing unit checks the input password against a preset password, and if the password is invalid. In step D, after the password confirmation processing unit displays a warning message on the display device, the warning message display count is counted up. In step F, if the warning message display count is up to two, step Return to B and prompt for the password again. Alternatively, in step F, if the entered password is the third incorrect password entered from the keyboard, the password confirmation processing unit turns off the PC. If the password verification result is correct in step C, the OS is started in step E.

As described above, unauthorized access to a PC that could not be prevented by the OS can be prevented at the power-on stage of the PC.
JP 2001-27911 A

  However, the conventional configuration is not sufficient as a security function.

  In the prior art of Patent Document 1, once a password is set on this PC, the power is turned off by a plurality of attempts unless the password is correctly input when the PC is started. As a result, the contents of the storage medium such as the HDD are saved. It is certainly impossible to read.

  However, with this conventional technology, although the power is turned off after multiple attempts to enter the password, the number of characters in the password and the constituent characters are not guessed or leaked by monitoring the display status on the display or the user's keyboard operation. It is not possible, and it becomes possible to start the PC by decrypting the password, and it is still possible to read data recorded in the HDD illegally. In recent years, leaks of passwords and passwords caused by such fraud monitoring have been reported as damages when using ATMs at banks, and it is necessary to pay attention to password input operations themselves.

  On the other hand, if the security at the time of use is strengthened, it may cause trouble during actual use or repair.

  For example, a long and complicated password is strong, but if the user forgets it, the PC itself cannot be used by the authorized user. In addition, when repairing equipment due to a device failure, etc. with security settings, the repair operator must obtain the password information of the authorized user and release the security settings. However, since the PC cannot be started, troubles may occur in repair work and confirmation work. In this way, strengthening and securing security and repair work are generally difficult issues.

  The present invention solves the above-mentioned conventional problems, and provides a security function that is not easily guessed even if the keyboard operation during password input is illegally monitored and solves the problem of forgetting and repairing passwords. It aims to provide a way to do.

The invention described in claim 1 of the present invention
A first character input means for inputting a password (for example, the keyboard 113 in FIG. 1);
At least one input means (for example, the FDC 108 that detects the loading / unloading of the FDD 109 in FIG. 1) capable of detecting a state of two or more values such as detection of attachment / detachment of a recording medium and turning on / off of a button;
Second character input means for detecting an attachment / detachment signal of each recording medium (for example, FDD 109) from each of the one or more input means and an on / off state signal of each of the left and right buttons of the touch pad, and converting them into a special character code. When,
Display means for presenting to the user the character input status from the first and second character input means;
Password verification means for verifying characters input from the first and second character input means with a predetermined password;
With
The display means adds specified attribute information to the special character input by the second input means, and enables the user to confirm or hide the special character by visual observation, The password verification unit combines or processes the character input by the first input unit and the special character input by the second input unit by a predetermined method, compares the character with a predetermined password, and corrects the error. It is an information processing device with a password function characterized by making a determination,
In addition to the password input by the first character input means, the password itself is strengthened by configuring the password by mixing special characters by the second character input means. Even if the operation of the first character input means is illegally monitored, the characters constituting the password are input in order to input the characters by mixing operations that are not generally regarded as character input by the second character input means. It is difficult to guess. Furthermore, since it is possible to limit the display of the input state of special characters, it is possible to strengthen defense against unauthorized monitoring of the display device.

  Thereby, security can be made stronger.

The invention according to claim 2 of the present invention is
At least one of the one or more status input means is installed in a portion that cannot be operated by a normal user in the information processing apparatus, such as a jumper switch 119 on the motherboard 101 in FIG. The collating unit satisfies a predetermined condition in which a state signal detected by one or more state input units including the state input unit disposed in a portion where the normal operation is not possible can be determined not to depend on a normal user. The character input from the first character input means and the special character input from the second character input means are combined, separated or processed by a predetermined method, and matched with a predetermined password. In this case, the information processing apparatus is provided with a password function characterized by starting a predetermined built-in function installed in advance in the information processing apparatus,
Operate buttons and jumper on / off status signals installed in parts that cannot be operated by normal users only by repair workers, and those conditions signals that cannot be input by normal users If both the above and the first and second predetermined passwords are satisfied, a special function for a repair worker incorporated in advance in the apparatus is activated. In this special function, for example, the security setting is bypassed and the apparatus is activated so that repair operation can be confirmed.

  Thereby, the repair worker can perform a desired repair work without knowing the password information of the user, and the security can be enhanced and the repairability can be improved.

  As described above, according to the present invention, the password is configured by using the second character input unit that is not a normal input unit, such as a keyboard, but includes a special operation, and it is difficult to guess the password constituent characters. Provides an information processing device that does not interfere with repair work by concealing a part of the state input means constituting the second character input means from the normal use state. Will be able to.

  Hereinafter, the best mode for carrying out the present invention will be described with reference to FIGS.

(Embodiment 1)
FIG. 1 is a hardware configuration diagram of a general PC according to the first embodiment.

  In FIG. 1, reference numeral 101 denotes a motherboard, which is a part for fixing or mounting main parts constituting the PC. Reference numeral 102 denotes a CPU (central processing unit), and 103 and 104 denote chip sets. The north bridge 103 controls data flowing between the CPU 102, the memory, and the graphic chip 121. The liquid crystal display 122 displays the video signal from the north bridge via the graphic chip 121. The south bridge 104 is an ATA (IDE) interface 105 that connects the HDD 106 and the CD / DVD drive 107, a keyboard / mouse interface 112, peripheral devices (such as the SD controller 110, LAN, sound device), and other interfaces. Take control. Reference numeral 118 denotes a nonvolatile flash memory, which is an HDD 106, a CD / DVD 107, an FDD 109 (floppy (registered trademark) disk drive), or an FDC 108 (floppy (registered trademark)) connected to a PC called BIOS (Basic Input / Output System). A program group for controlling devices such as a disk such as a disk drive controller, a keyboard, and a graphic chip is incorporated. The BIOS can call up a setup menu and change the setting content by pressing a predetermined key immediately after the PC is started by the user. The set contents are stored in the CMOS 116 in the CMOS area in the south bridge 104 and are backed up by the coin battery 117, so that they are retained even when the power is turned off.

  A jumper switch 119 is installed on the mother board 101 and is connected to the GPIO pin 120 of the south bridge 104 so that the setting state of the switch can be read out via the BIOS.

  Reference numeral 115 denotes an RTC (real time clock), which is supplied with power from the built-in battery even when the power is turned off, and the OS acquires the date and time from the real time clock at the time of startup.

  Reference numeral 113 denotes a keyboard for inputting characters, and reference numeral 114 denotes a touch pad which is a pointing device adopted in a notebook computer. Reference numeral 111 denotes a semiconductor memory (SD card) which is an external storage medium.

  With respect to the PC configured as described above, the first character input means according to the present invention is the keyboard 113. The second character input means is installed on the motherboard 101 where the FDD 109 can be taken in and out, the SD card 111 can be taken in and out, the left and right buttons of the touch pad 114 can be pushed and removed from the housing of the device. The status input means for detecting the pin state of the jumper switch 119, and the BIOS having a control program for detecting the status signal from each status input means and converting it into a special character code. The character input statuses from the first and second character input means are displayed as shown in FIG. 2 using the liquid crystal display 122 as a display means.

  FIG. 2A shows an example of a password input screen, in which all the characters constituting the password are replaced with * without distinguishing between normal key codes and special codes. Characters inputted from the keyboard are alphanumeric characters and symbols including upper and lower case letters. When expressed in ASCII code, the range is 20h to 7Eh in hexadecimal, but the special code is assumed to be mapped to other ranges. In this case, all characters are displayed as asterisks (*), so the user can confirm that the special code has been entered, but the third party cannot guess from the display which input means was used. There is an advantage.

  FIGS. 2B-1 and 2B-2 are examples in which special codes obtained from input means other than the keyboard are displayed separately from normal characters. In the case of (b-1), special codes are displayed. Are all indicated by * in different colors (color differences are indicated by underlined *). In the case of (b-2), the color and character shape are changed for each special code. Thus, by changing the display from the normal key code, the user can confirm that the special operation is effective. However, since there is a possibility that there is an input other than the keyboard, the security is weak compared to FIG.

  FIG. 2C shows an example in which these special codes can be input but are not displayed. In this case, if a special buzzer or other sound is used instead of displaying a special code, the user can confirm the input and the special code input status will not be displayed on the screen. Therefore, even if the operation is stolen, there is little risk of guessing the number of characters and constituent characters of the password. The special code display method is configured to be selectable from the BIOS setup menu.

  FIG. 3 shows a flow of operations from when the user turns on the power of the PC until password authentication is performed and the OS is started.

  When the power is turned on in step S01, a password input screen as shown in FIG. 2 is displayed in step S02. Here, the user inputs the password one character at a time using the keyboard 113 shown in FIG. 1 as the first character input means. In addition, the left and right buttons of the touch pad 114, the FDD 109, and the SD card 111 are inserted and removed between input of characters from the keyboard 113. These are the second character input operations. Which of these corresponds to a special code input operation, or which special code is to be converted depending on the order of operations, is set in advance in the BIOS setup menu. Keep it. By doing so, even if the operation of the keyboard 113 or the display state of the display 122 is stolen, there is no immediate risk of guessing or leaking the password. If it is not a key input in S03, a special operation is detected in S05 and converted into a corresponding special code in S06. At this time, different special codes such as 81h for SD card 111 insertion and 82h for extraction may be assigned to each operation, for example, 90h for both insertion and removal of the SD card 111 and FDD109. The same special code may be assigned to all special operations. When a different code is assigned for each special operation, the password gives priority to the order of operations. On the other hand, when the same code is assigned, the password becomes irrelevant in the order of special operations.

  Further, in S07, character display information of special characters is added by a method selected in advance in the setup menu, and after the input buffer is updated in S08, the display of the password input state is updated. In the case of input from the keyboard in S03, and in the case of a character code that is not a line feed key in S04, the input buffer is updated without adding a display attribute to display *. In S04, if it is a line feed key, the process proceeds to the input end process S09. At this time, the password input by the first character input means and the password input by the second character input means are stored in time series in the input buffer.

  S10 is a determination process in the password verification means. In the password verification means, character codes stored in time series in the input buffer are synthesized or processed in a predetermined procedure, and correct / incorrect determination with a preset password is performed. At this time, if the key code and the special code are not in the predetermined order in the input buffer, it may be determined that they are not correct, or the key code and the special code may be considered separately and may be determined correctly.

  If it is determined to be correct in S10, the OS is started in S12. If it is determined that there is an error, a warning message is displayed in S11 and the power is turned off according to the number of errors (S14) or S02. To return to.

  FIG. 4 shows an operation flow when the repair worker performs repair work and confirms the operation.

  The repair worker disassembles the apparatus main body, changes the jumper switch 119 on the mother board 101 to a desired input value, and turns on the power in S01. The password input operation S100 including the special code is the same as that in FIG. If the input value of the jumper switch 119 is a predetermined input value, it is determined in S20 that a repair function selection status signal is included, and the process proceeds to a repair function activation determination process S102.

  If the input value of the jumper switch 119 is not a predetermined input value, a password is input as normal PC activation shown in FIG. 3, and the process in S101 within the wavy line in FIG. 3 is performed.

  In the password collating means in S102, as shown in S21 to S23, a flow for separating and collating the password key code and the special code input in time series in the input buffer is illustrated. In S21, each code is separated. In S22, a password consisting of a special code is used as an ID for selecting a specific one from a plurality of repair functions, and a password consisting of a key code is a password for starting the repair function. Accordingly, the correctness / incorrectness determination is performed in S24, the repair utility is instructed to activate the corresponding repair function in S25, and the PC is turned off or restarted after the repair is completed (S26).

  The information processing apparatus according to the present invention configures a password by using a second character input unit that is a special operation that is not a normal input unit, such as a keyboard, and makes it difficult to guess password constituent characters, thereby further improving security. In addition to being able to be solid, there are no obstacles to repair work by concealing some of the state input means constituting the second character input means from the normal use state, and a personal computer is representative. It is suitable as an information processing apparatus that should have a security function.

Hardware configuration diagram of a general PC according to the first embodiment of the present invention (A) Diagram showing password input screen (normal), (b-1) (b-2) Diagram showing password input screen (in case of special code display), (c) Diagram showing password input screen (special code) (When hidden) Operation flow chart for a normal user according to Embodiment 1 of the present invention Operation flow chart for repair worker according to Embodiment 1 of the present invention The flowchart which shows operation | movement of the unauthorized access prevention system of the computer which concerns on patent document 1 which is a prior art

Explanation of symbols

101 Motherboard 102 CPU
103 North Bridge 104 South Bridge 105 ATA (IDE) Interface 106 HDD (Hard Disk Drive)
107 CD / DVD drive 108 FD controller 109 FD drive 110 SD controller 111 SD card 112 Keyboard, mouse I / O controller 113 Keyboard 114 Touchpad 115 RTC (real-time clock)
116 CMOS
117 Coin battery 118 Flash memory 119 Jumper switch 120 GPIO

Claims (2)

A first character input means for inputting a password;
At least one state input means capable of detecting a state of two or more values such as attachment / detachment of a recording medium and turning on / off of a button;
Second character input means for detecting each status signal from the one or more status input means and converting it into a special character code;
Display means for presenting a character input status from the first and second character input means to a user, and password verification means for verifying characters input from the first and second character input means with a predetermined password When,
With
The display means adds specified attribute information to the special character input by the second input means, and enables the user to confirm or hide the special character by visual observation,
The password verification unit synthesizes, separates or processes the character input by the first input unit and the special character input by the second input unit by a predetermined method, and verifies the predetermined password. An information processing apparatus having a password function characterized by performing correct / incorrect determination. At least one of the one or more state input means is installed in a part that cannot be operated by a normal user in the information processing apparatus,
The password verification unit is a predetermined input that can determine that a status signal detected by one or more status input units including a status input unit arranged in a portion where normal operation is impossible is not caused by a normal user. When the condition is satisfied, the character input from the first character input unit and the special character input from the second character input unit are synthesized, separated, or processed by a predetermined method, and a predetermined password 2. The information processing apparatus with a password function according to claim 1, wherein when the two pieces of information are matched, a predetermined built-in function installed in advance in the information processing apparatus is activated.

Images