Information processing apparatus and control method

Abstract

To suppress infection by malware to enhance security.SOLUTION: An information processing apparatus includes: a risk state storage unit which stores risk-state information indicating that a security problem is likely to occur; and a control unit which executes processing based on BIOS and an OS, and causes the risk state storge unit to store, when the risk state is detected, the risk-state information by processing based on the BIOS. The control unit is configured to start, when starting the OS, in the case where the risk state storage unit stores the risk-state information in the processing based on the BIOS, a dedicated secured OS, which is different from the OS, and restricts connection to a management network which is a managed local network.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to an information processing device and a control method. [Background technology]

[0002] In recent years, information processing devices such as personal computers are sometimes attacked by malware, and techniques for preventing malware infection are known (see, for example, Patent Document 1). In addition, malware exploits vulnerabilities in, for example, an OS (Operating System), and when a vulnerability that may be exploited by malware is discovered in an information processing device, a countermeasure is taken in which an update program for eliminating the vulnerability of the OS is provided. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2018-10499 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, in conventional information processing devices, for example, if a patch program to resolve a vulnerability in the OS was released but an update to apply the patch program was not performed, and the device was connected to a managed local network such as an in-house network, there was a risk that malware would spread within the managed network.

[0005] The present invention has been made to solve the above problems, and has an object to provide an information processing device and a control method that can suppress malware infection and improve security. [Means for solving the problem]

[0006] In order to solve the above problem, one aspect of the present invention is an information processing device that includes a risk state memory unit that stores information indicating a risk state indicating the possibility of a security problem, and a control unit that executes processing based on a BIOS (Basic Input Output System) and an OS (Operating System), and when the risk state is detected, stores information indicating the risk state in the risk state memory unit through processing based on the BIOS, and when the control unit starts the OS, if the risk state memory unit stores information indicating the risk state in the processing based on the BIOS, the control unit starts a dedicated OS that is different from the OS and is guaranteed to be secure, and restricts connection to a management network, which is a managed local network.

[0007] In addition, one aspect of the present invention is that in the above-mentioned information processing device, the risk state includes a case where the OS is started at an interval of more than a preset period, and when the control unit starts the OS, in processing based on the BIOS, if the OS is started at an interval of more than a preset period, the control unit may store information indicating the risk state in the risk state memory unit and start the dedicated OS instead of the OS.

[0008] In addition, one aspect of the present invention is that in the above-mentioned information processing device, the risk state includes a case where malware is detected during processing of executing a program capable of detecting malware executed on the OS, and the control unit may store information indicating the risk state in the risk state memory unit by processing based on the BIOS when the malware is detected during execution of the program capable of detecting the malware.

[0009] In one aspect of the present invention, in the information processing device described above, the control unit may execute an update process for the OS that applies the latest patch program for the OS through processing based on the dedicated OS.

[0010] In addition, one aspect of the present invention is that in the above-mentioned information processing device, when execution of the OS update process is completed, the control unit may store information indicating that the risk state is not present in the processing based on the BIOS in the risk state memory unit.

[0011] In addition, one aspect of the present invention is that in the above-mentioned information processing device, the risk state includes a case where an opening detection sensor detects that the housing in which the device is implemented has been opened, and when the control unit starts the OS, if the opening detection sensor detects that the housing has been opened in a processing based on the BIOS, the control unit stores information indicating the risk state in the risk state memory unit and starts the dedicated OS instead of the OS.

[0012] In addition, one aspect of the present invention is that in the above-mentioned information processing device, the risk state includes a case where a storage device on which the OS program is stored has been replaced, and when the control unit detects that a storage device has been replaced in a process based on the BIOS when starting the OS, it stores information indicating the risk state in the risk state storage unit and starts the dedicated OS instead of the OS.

[0013] In addition, one aspect of the present invention is that in the above-mentioned information processing device, the control unit may notify a security administrator of information indicating the risk state when the risk state memory unit stores information indicating the risk state.

[0014] In addition, one aspect of the present invention is that in the above-mentioned information processing device, the control unit may further perform a detection process for determining whether or not the OS is infected with malware when the risk state memory unit stores information indicating the risk state.

[0015] Moreover, one aspect of the present invention is a control method for an information processing device having a risk state memory unit that stores information indicating a risk state indicating that there is a possibility of a security problem, and a control unit that executes processing based on a BIOS (Basic Input Output System) and an OS (Operating System), the control method including a step of, when the control unit detects the risk state, storing information indicating the risk state in the risk state memory unit by processing based on the BIOS, and a step of, when the control unit starts the OS, starting a dedicated OS that is different from the OS and whose security is ensured, and restricting connection to a management network, which is a managed local network, if the risk state memory unit stores information indicating the risk state in the processing based on the BIOS. Effect of the Invention

[0016] According to the above aspects of the present invention, it is possible to suppress malware infection and improve security. [Brief description of the drawings]

[0017] [Figure 1] FIG. 2 is a diagram illustrating an example of a main hardware configuration of a notebook PC according to the present embodiment. [Diagram 2] 2 is a functional block diagram showing an example of a functional configuration of an information processing system and a notebook PC according to the present embodiment. FIG. [Diagram 3] FIG. 1 is a diagram showing an overview of security countermeasure processing for a notebook PC according to an embodiment of the present invention. [Figure 4] 5 is a flowchart showing an example of a startup process of the notebook PC according to the present embodiment. [Diagram 5] 10 is a flowchart showing an example of a malware detection process for a notebook PC according to the present embodiment. [Figure 6] 10 is a flowchart showing an example of recovery processing of the notebook PC according to the present embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0018] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An information processing apparatus and a control method according to an embodiment of the present invention will be described below with reference to the drawings.

[0019] 1 is a diagram showing an example of a main hardware configuration of a notebook PC 1 according to this embodiment. In this embodiment, the notebook PC 1 will be described as an example of an information processing device.

[0020] As shown in FIG. 1, the notebook PC 1 includes a CPU 11, a main memory 12, a video subsystem 13, a display unit 14, a chipset 21, a BIOS memory 22, an SSD 23, an audio system 24, a WLAN card 25, a USB connector 26, an embedded controller 31, an input unit 32, a power supply circuit 33, and a sensor unit 34.

[0021] In this embodiment, the CPU 11 and the chipset 21 correspond to the main control unit 10. The main control unit 10 is an example of a processor (main processor) that executes a program stored in a memory (main memory 12).

[0022] A CPU (Central Processing Unit) 11 executes various arithmetic processes under program control, and controls the entire notebook PC 1. The main memory 12 is a writable memory used as a read area for the execution program of the CPU 11 or as a work area for writing processing data for the execution program. The main memory 12 is composed of, for example, multiple DRAM (Dynamic Random Access Memory) chips. The execution program includes a BIOS (Basic Input Output System), an OS, various drivers for operating the hardware of peripheral devices, various services / utilities, application programs, etc.

[0023] Video subsystem 13 is a subsystem for implementing functions related to image display, and includes a video controller. This video controller processes drawing commands from CPU 11, writes the processed drawing information to a video memory, and also reads the drawing information from the video memory and outputs it to display unit 14 as drawing data (display data).

[0024] The display unit 14 is, for example, a liquid crystal display, and displays a display screen based on drawing data (display data) output from the video subsystem 13.

[0025] The chipset 21 includes controllers for a Universal Serial Bus (USB), a serial AT Attachment (Serial ATA), a Serial Peripheral Interface (SPI) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express bus, and a Low Pin Count (LPC) bus, and is connected to a plurality of devices. In FIG. 1, a BIOS memory 22, an SSD 23, an audio system 24, a WLAN card 25, and a USB connector 26 are connected to the chipset 21 as examples of devices.

[0026] The BIOS memory 22 is configured with an electrically rewritable non-volatile memory such as an EEPROM (Electrically Erasable Programmable Read Only Memory) or a flash ROM, etc. The BIOS memory 22 stores the BIOS, system firmware for controlling the embedded controller 31, etc.

[0027] An SSD (Solid State Drive) 23 (an example of a non-volatile storage device) stores an OS, various drivers, various services / utilities, application programs, and various data. The audio system 24 records, plays back, and outputs audio data.

[0028] A WLAN (Wireless Local Area Network) card 25 connects to a network via a wireless LAN and performs data communication. The USB connector 26 is a connector for connecting peripheral devices that use USB.

[0029] The embedded controller 31 (an example of a sub-controller) is a one-chip microcomputer that monitors and controls various devices (peripheral devices, sensors, etc.) regardless of the system state of the notebook PC 1. The embedded controller 31 also has a power management function that controls the power circuit 33. The embedded controller 31 is composed of a CPU, ROM, RAM, etc. (not shown), and also has A / D input terminals for multiple channels, D / A output terminals, a timer, and digital input / output terminals. For example, an input unit 32, a power circuit 33, and a sensor unit 34 are connected to the embedded controller 31 via these input / output terminals, and the embedded controller 31 controls the operations of these units.

[0030] The input unit 32 is, for example, an input device such as a keyboard, a pointing device, or a touch pad. The power supply circuit 33 includes, for example, a DC / DC converter, a charge / discharge unit, a battery unit, an AC / DC adapter, and converts a DC voltage supplied from the AC / DC adapter or the battery unit into a plurality of voltages required to operate the notebook PC 1. The power supply circuit 33 also supplies power to each part of the notebook PC 1 based on the control of the embedded controller 31.

[0031] The sensor unit 34 is a sensor that detects various detection data inside the notebook PC 1. The sensor unit 34 includes, for example, a temperature sensor, a three-dimensional acceleration sensor, a gyro sensor, an opening detection sensor unit 341 (see FIG. 2) described later, and the like.

[0032] Next, the functional configuration of the notebook PC 1 according to this embodiment will be described with reference to FIG. Fig. 2 is a functional block diagram showing an example of the functional configuration of the information processing system 100 and the notebook PC 1 according to this embodiment. Note that Fig. 2 shows only the functional configuration related to the present invention among the functional configuration of the notebook PC 1.

[0033] 2, the information processing system 100 includes a notebook PC 1, a boot server 2, and an in-house management server 3. The notebook PC 1, the boot server 2, and the in-house management server 3 are connectable to each other via a network NW1 and a network NW2.

[0034] The boot server 2 is a server device for network booting, which is provided by, for example, the manufacturer of the notebook PC 1 to provide various services. The boot server 2 provides the notebook PC 1 with a dedicated local OS program (described later) via the network NW1.

[0035] The in-house management server 3 is, for example, a management server that manages an in-house network and the notebook PC 1. The in-house management server 3 is, for example, a server device managed by a security administrator.

[0036] The network NW1 is a wide area network (WAN) or a local area network (LAN) within a company. In this embodiment, for example, a notebook PC 1, a boot server 2, and an in-house management server 3 can be connected to the network NW1.

[0037] The network NW2 is a local area network (LAN) within a company, and is an in-house network. The network NW2 is, for example, an example of a managed network, which is a managed local network. For example, devices managed within the company can be connected to the network NW2, and for example, a notebook PC 1 and an in-house management server 3 are connected to the network NW2.

[0038] As shown in FIG. 2, the notebook PC 1 includes a main control unit 10, an embedded controller 31, a storage unit 40, a NW (Network) communication unit 250, and an opening detection sensor unit 341.

[0039] The NW communication unit 250 is a functional unit realized by a network device such as a WLAN card 25. The main control unit 10 is connectable via the NW communication unit 250 to the network NW1 and the network NW2.

[0040] The opening detection sensor unit 341 is a sensor that detects that the housing of the notebook PC 1 has been opened, and is used to determine whether there is a possibility of a security problem such as a hardware attack, for example. The opening detection sensor unit 341 outputs detection data indicating that the housing of the notebook PC 1 has been opened to the main control unit 10 via the embedded controller 31.

[0041] The storage unit 40 is realized by a memory such as the BIOS memory 22 or the SSD 23, and stores, for example, various information used for various processes of the main control unit 10. The storage unit 40 includes a risk state storage unit 41 and an OS startup date and time storage unit 42.

[0042] The risk state storage unit 41 is a storage unit realized by a memory such as the BIOS memory 22, and stores information indicating a risk state indicating that a security problem may occur. The risk state storage unit 41 may store different data as information indicating the risk state depending on the case of the risk state described below.

[0043] The OS boot date and time storage unit 42 is a storage unit realized by the BIOS memory 22 or the like, and stores date and time information when the OS (for example, Windows (registered trademark)) was booted last time. The date and time information stored in the OS boot date and time storage unit 42 is used to detect how long it has been since the OS was booted last time.

[0044] The main control unit 10 (an example of a control unit) is a functional unit realized by causing the CPU 11 and the chipset 21 to execute programs stored in the BIOS memory 22 and the SSD 23, and executes various processes based on the BIOS and the OS.

[0045] When the main control unit 10 detects a risk state, the main control unit 10 stores information indicating the risk state in the risk state storage unit 41 through processing based on the BIOS. Furthermore, when starting the OS, if the risk state storage unit 41 stores information indicating a risk state in processing based on the BIOS, the main control unit 10 starts a dedicated OS that is different from the OS and is secured to be safe, and restricts connection to the network NW2 (management network), which is a managed local network (e.g., an in-house network). Here, the dedicated OS is, for example, Windows PE (Preinstallation Environment) (Windows is a registered trademark), which is a dedicated portable OS.

[0046] When the risk state storage unit 41 stores information indicating a risk state, the main control unit 10 acquires the dedicated portable OS program from the boot server 2 using network boot (HTTPs Boot), or acquires the dedicated portable OS program from a partition in a secure system area of ​​the SSD 23, and starts up the dedicated portable OS. In this case, the main control unit 10 also prohibits connection to the network NW2 (corporate network). The main control unit 10 includes a BIOS processing unit 101, an OS processing unit 102, and a local OS processing unit 103.

[0047] The BIOS processing unit 101 is a functional unit that is realized by causing the CPU 11 and the chipset 21 to execute a BIOS program stored in the BIOS memory 22. The BIOS processing unit 101 executes processing based on the BIOS (BIOS processing).

[0048] When the BIOS processing unit 101 detects a risk state, it causes information indicating the risk state to be stored in the risk state storage unit 41 by processing based on the BIOS. The risk status includes the following four cases:

[0049] <Case (1)> The risk state includes case (1) where an interval of a preset period or more has elapsed since the OS was started. Case (1) is a case where, for example, three months or more have elapsed since the previous OS startup. When starting the OS, the BIOS processing unit 101 acquires date and time information of the previous OS startup from the OS startup date and time storage unit 42, and calculates the period elapsed since the previous startup based on the previous date and time information and the current date and time information. If the period elapsed since the previous startup is, for example, three months or more, the BIOS processing unit 101 stores information indicating a risk state (for example, "01") in the risk state storage unit 41.

[0050] <Case (2)> The risk state includes, as case (2), a case where malware is detected in a process in which a program capable of detecting malware is executed on the OS. Examples of programs capable of detecting malware include EPP (Endpoint Protection Platform) and EDR (Endpoint Detection and Response). When malware is detected in a process in which a program capable of detecting malware is executed, the BIOS processing unit 101 stores information indicating the risk state (e.g., "02") in the risk state storage unit 41.

[0051] <Case (3)> The risk state includes, as case (3), a case where the opening detection sensor unit 341, which detects that the housing in which the device itself (notebook PC 1) is mounted, detects that the housing has been opened. That is, the opening detection sensor unit 341 detects that the housing of the notebook PC 1 has been opened. When starting the OS, if the opening detection sensor unit 341 detects that the housing has been opened, the BIOS processing unit 101 stores information indicating a risk state (for example, "03") in the risk state storage unit 41, and starts a dedicated OS instead of the OS.

[0052] <Case (4)> The risk state includes, as case (4), a case where a storage device (e.g., an important part such as SSD 23) in which an OS program is stored has been replaced. When the BIOS processing unit 101 detects that a storage device (e.g., an important part such as SSD 23) has been replaced when starting the OS, the BIOS processing unit 101 stores information indicating a risk state (e.g., "04") in the risk state storage unit 41 and starts a dedicated OS instead of the OS.

[0053] The OS processing unit 102 is a functional unit realized by causing the CPU 11 and the chipset 21 to execute various programs including the OS stored in the SSD 23. The OS processing unit 102 executes processing based on the OS (OS processing) and also executes processing based on various drivers and application programs that operate on the OS.

[0054] The OS processing unit 102 executes a process of running a program capable of detecting malware, such as EPP and EDR, on the OS, and when a malware infection is detected, passes the process to the BIOS processing unit 101 and stores information indicating the risk state (e.g., "02") in the risk state storage unit 41. Note that the OS processing unit 102 may, for example, isolate the malware or prohibit connection to the network NW2 using the EPP and EDR.

[0055] The local OS processing unit 103 is a functional unit realized by causing the CPU 11 and the chipset 21 to execute a program of the dedicated portable OS, and executes various processes based on the dedicated portable OS. The local OS processing unit 103 executes, for example, a recovery process from a risk state.

[0056] When the risk state is the above-mentioned case (1) or case (2), the local OS processing unit 103 executes an OS update process that applies the latest patch program of the OS by processing based on the dedicated portable OS. When the risk state is the above-mentioned case (1) or case (2), the local OS processing unit 103 executes a process of installing the latest patch program of the OS, for example, by executing a program "dism.exe".

[0057] The local OS processing unit 103 executes "dism.exe" to prepare an environment for installing the latest patch program for the OS, and then restarts the notebook PC 1 to install the latest patch program in the SSD 23. Furthermore, when the installation of the latest patch program is completed by the restart, the local OS processing unit 103 causes the BIOS processing unit 101 to store information indicating that there is no risk state (for example, "00") in the risk state storage unit 41.

[0058] Furthermore, when the risk state is one of the above-mentioned cases (3) and (4), the local OS processing unit 103 notifies the security administrator of information indicating the risk state (for example, information indicating that the casing has been opened, and information on replaced parts (for example, SSD 23, etc.)). The local OS processing unit 103 notifies the in-house management server 3 of the information indicating the risk state via the NW communication unit 250, for example, by executing an agent program.

[0059] Next, the operation of the notebook PC 1 and the information processing system 100 according to this embodiment will be described with reference to the drawings. FIG. 3 is a diagram showing an overview of security countermeasure processing of the notebook PC 1 according to this embodiment.

[0060] As shown in FIG. 3, the security countermeasure processing of the notebook PC 1 includes the following four steps. The process of step S1 is a "Detect" process (detection process), and the notebook PC 1 detects the above-mentioned risk state. In step S1, the main control unit 10 of the notebook PC 1 detects the risk state according to the above-mentioned cases (1) to (4), and stores information indicating the risk state in the risk state storage unit 41 by processing based on the BIOS.

[0061] Next, the process of step S2 is an "Isolate" process (isolation process), in which the main control unit 10 prohibits connection to the network NW1 (corporate network) and isolates the notebook PC 1 in a risk state.

[0062] Next, the process of step S3 is a "Heal" process (recovery process), in which the main control unit 10, for example, starts up a dedicated portable OS and executes an OS update process for applying the latest patch program for the OS, thereby recovering the OS.

[0063] Next, the process of step S4 is a "Restore" process (restoration process), in which the main control unit 10 restores (recovers) the notebook PC 1, for example, from a risk state to a normal state.

[0064] Next, the start-up process of the notebook PC 1 according to this embodiment will be described with reference to FIG. FIG. 4 is a flowchart showing an example of the startup process of the notebook PC 1 according to this embodiment.

[0065] 4, the main control unit 10 of the notebook PC 1 first acquires the previous OS boot date and time information (step S101). The BIOS processing unit 101 of the main control unit 10 acquires the previous OS boot date and time information from the OS boot date and time storage unit 42.

[0066] Next, the BIOS processing unit 101 judges whether or not a predetermined period (e.g., three months or more) has elapsed since the previous OS boot (step S102). The BIOS processing unit 101 calculates the period elapsed since the previous OS boot based on the previous OS boot date and time information and the current date and time information, and judges whether or not the period elapsed is three months or more. If the predetermined period (e.g., three months or more) has elapsed since the previous OS boot (step S102: YES), the BIOS processing unit 101 advances the process to step S105. If the predetermined period (e.g., three months or more) has not elapsed since the previous OS boot (step S102: NO), the BIOS processing unit 101 advances the process to step S103.

[0067] In step S103, the BIOS processing unit 101 judges whether or not the operation of the opening detection sensor unit 341 is detected. That is, the BIOS processing unit 101 judges whether or not the case of the notebook PC 1 is opened, depending on whether or not the operation of the opening detection sensor unit 341 is detected. If the operation of the opening detection sensor unit 341 is detected (the case is opened) (step S103: YES), the BIOS processing unit 101 advances the process to step S105. If the operation of the opening detection sensor unit 341 is not detected (the case is not opened) (step S103: NO), the BIOS processing unit 101 advances the process to step S104.

[0068] In step S104, the BIOS processing unit 101 determines whether the SSD 23 has been replaced. That is, the BIOS processing unit 101 detects the SSD 23 by the BIOS to determine whether the device information (parameters) of the SSD 23 has been changed. If the SSD 23 has been replaced (step S104: YES), the BIOS processing unit 101 advances the process to step S105. If the SSD 23 has not been replaced (step S104: NO), the BIOS processing unit 101 advances the process to step S106.

[0069] In step S105, the BIOS processing unit 101 stores information indicating the risk state in the risk state storage unit 41. The BIOS processing unit 101 stores, for example, information (risk information) indicating the risk state corresponding to each of the above-mentioned cases (1), (3), and (4) in the risk state storage unit 41. After processing of step S105, the BIOS processing unit 101 advances the processing to step S106.

[0070] In step S106, the BIOS processing unit 101 determines whether the risk information is information indicating a risk state. The BIOS processing unit 101 acquires risk information from the risk state storage unit 41, and determines whether the risk information is information indicating a risk state (for example, any of "01" to "04"). If the risk information is information indicating a risk state (step S106: YES), the BIOS processing unit 101 advances the process to step S107. If the risk information is not information indicating a risk state (the risk information is, for example, "00") (step S106: NO), the BIOS processing unit 101 advances the process to step S108.

[0071] In step S107, the BIOS processing unit 101 executes the startup of a dedicated local OS (dedicated portable OS). The BIOS processing unit 101 acquires a program of the dedicated portable OS (for example, Windows PE (Windows is a registered trademark)) from the HTTPs boot or a partition of a secure system area of ​​the SSD 23, and starts the dedicated portable OS.

[0072] In step S108, the BIOS processing unit 101 executes normal OS startup. The BIOS processing unit 101 obtains an OS (for example, Windows (registered trademark)) program from the SSD 23 and starts the OS.

[0073] Next, the malware detection process of the notebook PC 1 will be described with reference to FIG. FIG. 5 is a flowchart showing an example of malware detection processing in the notebook PC 1 according to this embodiment.

[0074] As shown in Fig. 5, the main control unit 10 of the notebook computer OC1 determines whether or not a malware infection has been detected in the OS (step S201). The OS processing unit 102 of the main control unit 10 determines whether or not a malware infection has been detected in the OS by executing a program such as EPP or EDR. If the OS processing unit 102 detects a malware infection in the OS (step S201: YES), the process proceeds to step S202. If the OS processing unit 102 does not detect a malware infection in the OS (step S201: NO), the process returns to step S201.

[0075] In step S202, the OS processing unit 102 stores information indicating the risk state (for example, “02” corresponding to case (2)) in the risk state storage unit 41. The OS processing unit 102 stores the information indicating the risk state in the risk state storage unit 41 via the BIOS processing unit 101.

[0076] Next, the recovery process of the notebook PC 1 according to this embodiment will be described with reference to FIG. Fig. 6 is a flow chart showing an example of recovery processing of the notebook PC 1 according to this embodiment. Note that the recovery processing shown in Fig. 6 is processing after the processing of step S107 in Fig. 4 described above.

[0077] 6, the main control unit 10 of the notebook PC 1 first restricts connection to the in-house network (network NW2) (step S301). The local OS processing unit 103 of the main control unit 10, for example, prohibits connection to the in-house network (network NW2). The process of step S301 corresponds to the isolation process of step S2 described above.

[0078] Next, the local OS processing unit 103 judges whether or not the operation of the opening detection sensor unit 341 is detected (step S302). The local OS processing unit 103 judges whether or not the operation of the opening detection sensor unit 341 is detected based on whether or not the risk information stored in the risk state storage unit 41 is information ("03") corresponding to case (3). If the operation of the opening detection sensor unit 341 is detected (the risk information is information ("03") corresponding to case (3)) (step S302: YES), the local OS processing unit 103 advances the process to step S304. If the operation of the opening detection sensor unit 341 is not detected (the risk information is not information ("03") corresponding to case (3)) (step S302: NO), the local OS processing unit 103 advances the process to step S303.

[0079] In step S303, the local OS processing unit 103 determines whether the SSD 23 has been replaced. The local OS processing unit 103 determines whether the SSD 23 has been replaced based on whether the risk information stored in the risk state storage unit 41 is information ("04") corresponding to case (4). If the SSD 23 has been replaced (the risk information is information ("04") corresponding to case (4)) (step S303: YES), the local OS processing unit 103 advances the process to step S304. If the SSD 23 has not been replaced (the risk information is not information ("04") corresponding to case (4)) (step S303: NO), the local OS processing unit 103 advances the process to step S305.

[0080] In step S304, the local OS processing unit 103 notifies the security administrator of information indicating that the notebook PC 1 is in a risk state (for example, information indicating that the casing has been opened, and information on replaced components (for example, SSD 23, etc.)). The local OS processing unit 103 notifies the in-house management server 3 of the information indicating the risk state, for example, via the NW communication unit 250 and the network NW1. After processing of step S304, the local OS processing unit 103 terminates the processing.

[0081] In step S305, the local OS processing unit 103 updates the OS to the latest version. The local OS processing unit 103 executes, for example, a program called "dism.exe" to execute a process of installing the latest patch program of the OS. After preparing an environment for installing the latest patch program of the OS by executing "dism.exe", the local OS processing unit 103 restarts the notebook PC 1 and installs the latest patch program in the SSD 23.

[0082] Next, the local OS processing unit 103 stores information indicating that the system is not in a risk state in the risk state storage unit 41 (step S306). When the installation of the latest patch program is completed by rebooting, the local OS processing unit 103 causes the BIOS processing unit 101 to store information indicating that the system is not in a risk state (for example, "00") in the risk state storage unit 41.

[0083] Next, the local OS processor 103 restarts the notebook PC 1 (step S307). In this case, the main controller 10 executes the startup process shown in FIG. 4, and restores the startup to a normal state (a state that is not at risk) (the startup state of step S108 shown in FIG. 4). After the process of step S307, the main controller 10 ends the process.

[0084] As described above, the notebook PC 1 (information processing device) according to this embodiment includes a risk state storage unit 41 and a main control unit 10 (control unit). The risk state storage unit 41 stores information indicating a risk state that indicates that a security problem may occur. The main control unit 10 is a control unit that executes processing based on the BIOS and the OS, and when a risk state is detected, stores information indicating the risk state in the risk state storage unit 41 by processing based on the BIOS. Furthermore, when starting the OS, if the risk state storage unit 41 stores information indicating a risk state in the processing based on the BIOS, the main control unit 10 starts a dedicated portable OS (dedicated OS) whose security is ensured, unlike the OS, and restricts connection to the network NW2 (management network), which is a managed local network.

[0085] As a result, when the notebook PC 1 (information processing device) according to this embodiment is in a risky state where security problems may occur, it starts up a dedicated portable OS (dedicated OS) whose security is ensured, and restricts connection to the network NW2 (management network), which is a managed local network. Therefore, the notebook PC 1 according to this embodiment can suppress malware infection and improve security.

[0086] For example, in a case where a patch program that resolves a vulnerability in the OS has been released but no update to apply the patch program has been made and no countermeasures have been taken for a long time, the notebook PC 1 according to this embodiment can start up a dedicated portable OS (dedicated OS) as a risk state and appropriately restrict connection to the network NW2 (management network). Therefore, even in such a case, the notebook PC 1 according to this embodiment can reduce the possibility of malware spreading within the network NW2 (management network).

[0087] In the notebook PC 1 of this embodiment, a secure dedicated portable OS (dedicated OS) is started up instead of using an OS that may pose security problems, so recovery and restoration can be performed safely.

[0088] In this embodiment, the risk state includes a case where the OS boot has been started at an interval of at least a preset period (case (1)). When starting the OS, in the process based on the BIOS, if the OS boot has been started at an interval of at least a preset period (for example, three months or more), the main control unit 10 stores information indicating a risk state (for example, "01") in the risk state storage unit 41 and starts a dedicated portable OS (dedicated OS) instead of the OS.

[0089] As a result, the notebook PC 1 according to this embodiment determines that, for example, a notebook PC 1 that has not been started for a long period of time is a device (a dark endpoint) that may pose a security problem, thereby appropriately suppressing malware infection and improving security.

[0090] In this embodiment, the risk state includes a case where malware is detected during a process in which a program capable of detecting malware is executed on the OS (case (2)). When malware is detected during the execution of a program capable of detecting malware (e.g., EPP and EDR), the main control unit 10 stores information indicating the risk state (e.g., "02") in the risk state storage unit 41 by processing based on the BIOS.

[0091] As a result, the notebook PC 1 of this embodiment, for example, when executing a program capable of detecting malware (e.g., EPP and EDR), determines that the device is one in which security issues may arise if malware is detected, thereby appropriately suppressing malware infection and improving security.

[0092] Furthermore, in this embodiment, the main control unit 10 executes an OS update process for applying the latest patch program for the OS through processing based on the dedicated portable OS.

[0093] As a result, the notebook PC 1 according to this embodiment automatically applies the latest patch program for the OS to a device in an at-risk state, so that the device in an at-risk state can be appropriately restored to a safe state.

[0094] In addition, in this embodiment, when the execution of the OS update process is completed, the main control unit 10 stores information indicating that the BIOS-based processing is not in a risk state (e.g., “00”) in the risk state memory unit 41.

[0095] As a result, the notebook PC 1 according to this embodiment can appropriately eliminate the risk state and safely restore (recover) to the normal state.

[0096] Furthermore, in this embodiment, the risk state includes a case where an opening detection sensor (opening detection sensor unit 341) that detects that the housing in which the device is mounted has been opened detects that the housing has been opened (case (3)). When starting the OS, if the opening detection sensor unit 341 detects that the housing has been opened in a process based on the BIOS, the main control unit 10 stores information indicating a risk state (for example, "03") in the risk state storage unit 41 and starts a dedicated portable OS (dedicated OS) instead of the OS.

[0097] As a result, the notebook PC 1 according to this embodiment can determine that a device may pose a security problem if, for example, the casing is opened, thereby appropriately suppressing malware infection and improving security.

[0098] Furthermore, in this embodiment, the risk state includes a case where a storage device (e.g., SSD23) in which an OS program is stored has been replaced (case (4)). When the main control unit 10 detects in a process based on the BIOS that a storage device (e.g., SSD23) has been replaced during booting of the OS, the main control unit 10 stores information indicating a risk state (e.g., "04") in the risk state storage unit 41 and boots a dedicated portable OS (dedicated OS) instead of the OS.

[0099] As a result, the notebook PC 1 according to this embodiment can determine that a device that may pose a security problem, for example, if a storage device (e.g., SSD 23) is illegally replaced, thereby appropriately suppressing malware infection and improving security.

[0100] In addition, in this embodiment, when the risk state memory unit 41 stores information indicating a risk state, the main control unit 10 notifies the security administrator of information indicating the risk state (for example, information indicating that the housing has been opened (for example, "03" or "04"), information on replaced parts (for example, SSD23, etc.)).

[0101] As a result, the notebook PC 1 according to this embodiment notifies the security administrator of information indicating a risky state (for example, information indicating that the casing has been opened (for example, "03" or "04"), information on parts that have been replaced (for example, SSD23, etc.)), thereby further improving security.

[0102] In addition, in this embodiment, when the risk state memory unit 41 stores information indicating a risk state (for example, “03” or “04”), the main control unit 10 further executes a detection process to determine whether the OS is infected with malware.

[0103] As a result, the notebook PC 1 according to this embodiment executes a process for detecting whether or not the OS of a device that may cause a security problem is infected with malware, thereby further improving security.

[0104] Furthermore, the control method according to this embodiment is a control method for a notebook PC 1 including a risk state storage unit 41 that stores information indicating a risk state indicating that a security problem may occur, and a main control unit 10 that executes processing based on the BIOS and the OS, and includes a risk state detection step and a restriction step. In the risk state detection step, if the main control unit 10 detects a risk state, information indicating the risk state is stored in the risk state storage unit 41 by processing based on the BIOS. In the restriction step, when the main control unit 10 starts the OS, if the risk state storage unit 41 stores information indicating a risk state in the processing based on the BIOS, the main control unit 10 starts a dedicated OS that is different from the OS and whose security is ensured, and restricts connection to the network NW2, which is a managed local network.

[0105] As a result, the control method according to the present embodiment has the same effects as the above-described notebook PC 1, making it possible to prevent malware infection and improve security.

[0106] The present invention is not limited to the above-described embodiment, and can be modified without departing from the spirit of the present invention. For example, in the above embodiment, the information processing device is the notebook PC 1, but the information processing device is not limited to this, and may be, for example, another information processing device such as a tablet terminal device or a desktop PC.

[0107] In addition, in the above embodiment, an example was described in which the OS of the notebook PC 1 is Windows (registered trademark), but this is not limited to this and may be applied to other OSs, such as Android (registered trademark), iOS (registered trademark), etc.

[0108] In addition, in the above embodiment, an example has been described in which the dedicated local OS retrieves and launches a program from a partition in a secure system area of ​​the boot server 2 or SSD 23, but this is not limited to this, and the program may be retrieved from a memory that cannot be tampered with, such as the BIOS memory 22 or a ROM.

[0109] In addition, in the above embodiment, an example has been described in which the information processing system 100 has a boot server 2 and an internal management server 3 separately provided, but this is not limited to this, and the boot server 2 and the internal management server 3 may be configured as a single server device.

[0110] In addition, in the above embodiment, an example has been described in which the BIOS processing unit 101 determines that the OS is in a risk state when, for example, three months or more have elapsed since the last OS startup. However, this is not limited to this, and the BIOS processing unit 101 may determine that the OS is in a risk state when another interval has elapsed, for example, one month or more, six months or more, or the like.

[0111] Each of the components of the notebook PC 1 described above has a computer system inside. A program for implementing the functions of each of the components of the notebook PC 1 described above may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read into a computer system and executed to perform processing in each of the components of the notebook PC 1 described above. Here, "reading a program recorded on a recording medium into a computer system and executing it" includes installing the program into a computer system. The "computer system" referred to here includes hardware such as an OS and peripheral devices. Furthermore, a "computer system" may include multiple computer devices connected via a network including the Internet, WAN, LAN, dedicated lines, and other communication lines. Furthermore, a "computer-readable recording medium" refers to portable media such as flexible disks, optical magnetic disks, ROMs, and CD-ROMs, and storage devices such as hard disks built into a computer system. In this way, the recording medium storing the program may be a non-transitory recording medium such as a CD-ROM.

[0112] The recording medium also includes a recording medium installed inside or outside and accessible from a distribution server to distribute the program. The program may be divided into a plurality of parts, downloaded at different times, and then combined with each component of the notebook PC 1, or each divided program may be distributed by a different distribution server. Furthermore, the "computer-readable recording medium" includes a recording medium that holds a program for a certain period of time, such as a volatile memory (RAM) inside a computer system that becomes a server or a client when a program is transmitted via a network. The program may be a recording medium for implementing part of the above-mentioned functions. Furthermore, the program may be a recording medium that can realize the above-mentioned functions in combination with a program already recorded in the computer system, that is, a so-called difference file (difference program).

[0113] In addition, some or all of the above-mentioned functions may be realized as an integrated circuit such as LSI (Large Scale Integration). Each of the above-mentioned functions may be individually processed, or some or all of the functions may be integrated into a processor. The integrated circuit method is not limited to LSI, and may be realized by a dedicated circuit or a general-purpose processor. In addition, if an integrated circuit technology that can replace LSI appears due to advances in semiconductor technology, an integrated circuit based on that technology may be used. [Explanation of symbols]

[0114] 1. Laptop 2 Boot Server 3 In-house management server 10 Main control section 11 CPU 12. Main memory 13 Video Subsystem 14 Display section 21 Chipset 22 BIOS memory 23 SSD 24 Audio System 25 WLAN Card 26 USB connector 31 Embedded Controller (EC) 32 Input section 33 Power supply circuit 34 Sensor section 40 Storage section 41 Risk status memory unit 42 OS startup date and time storage section 100 Information Processing Systems 101 BIOS processing unit 102 OS processing section 103 Local OS Processing Unit 250 Network Communications Department 341 Opening detection sensor unit NW1, NW2 networks

Claims

1. a risk state storage unit that stores information indicating a risk state indicating that a security problem may occur; a control unit that executes processing based on a basic input output system (BIOS) and an operating system (OS), and when the risk state is detected, causes information indicating the risk state to be stored in the risk state storage unit by processing based on the BIOS; Equipped with When the risk state storage unit stores information indicating the risk state in a process based on the BIOS when booting the OS, the control unit boots a dedicated OS that is different from the OS and whose safety is ensured, and restricts connection to a management network that is a managed local network. Information processing device.

2. The risk state includes a case where the OS has not been started for a predetermined period of time or longer, When starting the OS, in a process based on the BIOS, if the start of the OS is an interval equal to or longer than a preset period, the control unit stores information indicating the risk state in the risk state storage unit and starts the dedicated OS instead of the OS. The information processing device according to claim 1 .

3. The risk state includes a case where malware is detected in a process in which a program capable of detecting malware is executed on the OS, When the malware is detected during execution of a program capable of detecting the malware, the control unit stores information indicating the risk state in the risk state storage unit by processing based on the BIOS. The information processing device according to claim 1 .

4. The control unit executes an update process of the OS that applies the latest patch program of the OS by a process based on the dedicated OS. The information processing device according to claim 1 .

5. When the execution of the OS update process is completed, the control unit stores information indicating that the BIOS is not in the risk state in the risk state storage unit in the process based on the BIOS. The information processing device according to claim 4.

6. The risk state includes a case where an opening detection sensor detects that a housing in which the device is mounted has been opened, and the case detects that the housing has been opened, When starting up the OS, if the opening detection sensor detects that the housing has been opened in a process based on the BIOS, the control unit stores information indicating the risk state in the risk state storage unit and starts up the dedicated OS instead of the OS. The information processing device according to claim 1 .

7. The risk state includes a case where a storage device in which the OS program is stored is replaced, When the control unit detects that a storage device has been replaced in a process based on the BIOS when booting the OS, the control unit stores information indicating the risk state in the risk state storage unit and boots the dedicated OS instead of the OS. The information processing device according to claim 1 .

8. The control unit notifies a security administrator of the information indicating the risk state when the risk state storage unit stores the information indicating the risk state.

8. The information processing device according to claim 6 or 7.

9. The control unit further executes a process of detecting whether the OS is infected with malware when the risk state storage unit stores information indicating the risk state. The information processing device according to claim 8.

10. A method for controlling an information processing device including a risk state storage unit that stores information indicating a risk state indicating that a security problem may occur, and a control unit that executes processing based on a BIOS (Basic Input Output System) and an OS (Operating System), comprising: a step of causing the control unit to store information indicating the risk state in the risk state storage unit by processing based on a BIOS when the control unit detects the risk state; when the control unit starts the OS, in a process based on the BIOS, if the risk state storage unit stores information indicating the risk state, starting a dedicated OS that is different from the OS and whose safety is ensured, and restricting connection to a management network that is a managed local network; A control method comprising:

Images