Information processing device and information processing system

Abstract

To facilitate proving data erasure.SOLUTION: An information processing device 10 includes a processor 11, a storage device 12 that stores data, and a nonvolatile memory 13 that stores a start program 14 and an erasure program 15. The start program 14 causes the processor 11 to execute start processing for starting the information processing device 10. The erasure program 15 causes the processor 11 to execute erasure processing for erasing the data from the storage device 12. The erasure program 15 further causes the processor 11 to execute log generation processing for: generating hash data 18 using a specified hash algorithm, from log data 17 indicating an execution result of the erasure processing; and outputting log data 16 indicating the log data 17 and the hash data 18.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an information processing device and an information processing system. [Background technology]

[0002] Information processing devices such as personal computers have storage devices such as HDDs (Hard Disk Drives) and SSDs (Solid State Drives). Storage devices may store data that should not be leaked to the public, such as personal information. Users may dispose of their information processing devices by discarding or transferring them, and may want to erase the data stored in the storage device before disposal to reduce the risk of information leakage. In this case, users may want to be able to later prove that data erasure has been performed. For example, a certificate of erasure issued by a third party may be used to prove that data has been erased.

[0003] As an example, a data erasure method has been proposed that certifies that data erasure on a personal computer has been completed. In the proposed data erasure method, the client PC generates a processing ID before erasing the data and displays an encrypted ID obtained by encrypting the processing ID. The management server acquires the displayed encrypted ID and decrypts it. After erasing the data, the client PC displays the unencrypted processing ID. The management server acquires the displayed processing ID and issues an erasure certificate if it matches the decrypted result. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Publication No. 2018-136778 Summary of the Invention [Problem to be solved by the invention]

[0005] However, if an information processing device other than the information processing device to be disposed of attempts to confirm that data erasure has been completed on the information processing device to be disposed of, complex procedures such as complex encrypted communications may be required, which may increase the burden of proving data erasure. Therefore, in one aspect, the present invention aims to simplify the process of proving data erasure. [Means for solving the problem]

[0006] In one aspect, an information processing device is provided that has a processor, a storage device that stores data, and a non-volatile memory that stores a startup program that causes the processor to execute a startup process to start the information processing device, and an erasure program that causes the processor to execute an erasure process to erase data from the storage device, wherein the erasure program further causes the processor to execute a log generation process that generates hash data using a specific hash algorithm from first log data that indicates the results of executing the erasure process, and outputs second log data that indicates the first log data and the hash data. [Effects of the Invention]

[0007] One aspect is that it simplifies proof of data erasure. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 illustrates an example of an information processing apparatus according to a first embodiment. [Figure 2] FIG. 10 illustrates an example of an information processing system according to a second embodiment. [Figure 3] FIG. 1 is a block diagram illustrating an example of hardware of a personal computer. [Figure 4] FIG. 2 is a diagram illustrating an example of program and data arrangement. [Figure 5] FIG. 2 is a block diagram illustrating an example of functions of the information processing system. [Figure 6] FIG. 10 is a diagram illustrating an example of generating a hash ID. [Figure 7]FIG. 10 is a diagram illustrating an example of an output of an erasure execution log. [Figure 8] FIG. 10 is a diagram illustrating an example of a PC data table. [Figure 9] 10 is a flowchart illustrating an example of a procedure for generating a log. [Figure 10] 10 is a flowchart illustrating an example of a procedure for log verification. DETAILED DESCRIPTION OF THE INVENTION

[0009] The present embodiment will be described below with reference to the drawings. Note that a plurality of embodiments may be combined and implemented within a consistent range. [First embodiment] A first embodiment will be described.

[0010] FIG. 1 is a diagram illustrating an example of an information processing device according to a first embodiment. The information processing device 10 according to the first embodiment erases data stored in a storage device to reduce the risk of information leakage. The information processing device 10 outputs log data 16 indicating the execution result of the erasure process. The information processing device 10 may be a client device or a server device. Typically, the information processing device 10 is a personal computer (PC) such as a notebook, tablet, or desktop computer.

[0011] The information processing device 10 starts the erasure process in response to, for example, an input. The erasure process is performed, for example, when the information processing device 10 is disposed of by discarding or transferring. The entity that instructs the information processing device 10 to perform the erasure process may be the user who used the information processing device 10, or an erasure service provider commissioned by the user. The user of the information processing device 10 may be an organization such as a company. The log data 16 is transmitted, for example, to another information processing device. In response to the transmission of the log data 16, the user or the erasure service provider may obtain an erasure certificate issued by a third party. The erasure certificate certifies that the erasure process of the information processing device 10 has been completed.

[0012] The information processing device 10 has a processor 11, a storage device 12, and a non-volatile memory 13. The processor 11 is an arithmetic processing device capable of executing programs. The processor 11 may also be called a central processing unit (CPU), a micro processing unit (MPU), a microprocessor, a processing device, etc. However, the processor 11 may also include electronic circuits such as a graphics processing unit (GPU), a digital signal processor (DSP), an application specific integrated circuit (ASIC), or a field programmable gate array (FPGA).

[0013] The processor 11 loads a program into a volatile main storage device such as a RAM (Random Access Memory) and executes the loaded program. A set of multiple processing units may be called a multiprocessor or simply a "processor."

[0014] The storage device 12 is a non-volatile auxiliary storage device that stores data. The storage device 12 may also be called a disk, a drive, a device, etc. The storage device 12 is, for example, an HDD or an SSD. The storage device 12 is usually attached to the information processing device 10 from the initial manufacturing stage of the information processing device 10. However, the storage device 12 may also be attached later by a user.

[0015] The data stored in the storage device 12 may include an operating system (OS) program. The data may also include user data added by a user. The user data may include data to be protected that should not be leaked to the outside, such as personal information.

[0016] The nonvolatile memory 13 is a nonvolatile storage device different from a main storage device or an auxiliary storage device. The nonvolatile memory 13 is fixedly attached to a board such as a motherboard. The nonvolatile memory 13 is sometimes called a ROM (Read Only Memory), a BIOS (Basic Input Output System) memory, or the like. The nonvolatile memory 13 may be a non-rewritable memory or a rewritable memory such as a flash memory.

[0017] The nonvolatile memory 13 stores a startup program 14 and an erasure program 15. The information processing device 10 has a mechanism for protecting the programs stored in the nonvolatile memory 13, preventing the programs from being freely read or written. For example, the processor 11 may restrict access to the nonvolatile memory 13 from the user space, for example, by preventing user programs from recognizing the nonvolatile memory 13. The OS may also restrict rewriting of the nonvolatile memory 13 by any method other than a verified update program.

[0018] The boot program 14 causes the processor 11 to execute a boot process for booting the information processing device 10. The boot program 14 may be called a BIOS program. The software implemented by the boot program 14 may be called a BIOS. The BIOS may be a UEFI BIOS that employs UEFI (Unified Extensible Firmware Interface), or a classic BIOS that does not employ UEFI.

[0019] For example, when the power button of the information processing device 10 is pressed, the processor 11 is initialized. The initialized processor 11 first reads the boot program 14 from the nonvolatile memory 13 and executes the boot program 14. The boot process may include a process of accessing the storage device 12 or another storage device to read the OS program.

[0020] The erasure program 15 causes the processor 11 to execute an erasure process that erases data from the storage device 12. Although the startup program 14 and the erasure program 15 are shown separately in FIG. 1, the erasure program 15 may be incorporated into the startup program 14. The erasure program 15 may be called from the startup program 14. For example, the erasure program 15 is called in response to an input from a BIOS screen. This causes the processor 11 to read the erasure program 15 from the nonvolatile memory 13 and execute it.

[0021] Typically, the erasure process is performed to reduce the risk of information leakage. Therefore, the erasure process erases user data added by a user from the storage device 12. The erasure process may also erase data that has been stored in the storage device 12 since its initial manufacture. The data to be erased may include an OS program, or recovery data stored in a storage area separated from the user area.

[0022] The erasure process erases data from the storage device 12 so that the original data cannot be restored. There are several possible methods for making restoration difficult. The erasure program 15 may allow the user to select an erasure method at the start of the erasure process. For example, the erasure process writes a specific meaningless byte sequence or a random byte sequence one or more times throughout the entire target storage area of the storage device 12. Furthermore, if the data stored in the storage device 12 is encrypted, the erasure process erases the encryption key for decryption, for example.

[0023] After the erasure process, the erasure program 15 causes the processor 11 to further execute the following log generation process. The log generation process acquires log data 17 that indicates the execution result of the erasure process. The log data 17 includes information for identifying the erasure process that was executed, such as the serial number of the information processing device 10, the disk serial number of the storage device 12, and the erasure date and time.

[0024] The log generation process uses a specific hash algorithm to generate hash data 18 from the log data 17. The hash data 18 is, for example, a fixed-length or variable-length byte string. The hash data 18 may also be called a hash ID or a hash value.

[0025] A specific hash algorithm is incorporated into the erasure program 15. This hash algorithm is preferably kept secret and is preferably not known to the user or the erasure service provider. The hash algorithm may be changed through an update of the erasure program 15. Alternatively, one of multiple hash algorithms may be automatically selected from among multiple candidates according to information held by the information processing device 10.

[0026] A hash algorithm generates hash data 18 by, for example, converting a character string included in log data 17 according to a specific rule and inputting the result into a one-way hash function. A one-way hash function makes it difficult to restore log data 17 from hash data 18. There are an enormous number of possible combinations of a conversion method for log data 17 and a hash function to be used. Therefore, by keeping the conversion method and hash function secret, it becomes difficult to generate hash data 18 corresponding to log data 17 without using erasure program 15.

[0027] The log generation process generates and outputs log data 16 indicating log data 17 and hash data 18. The log data 16 may be text data including character strings indicating the log data 17 and hash data 18, or may be PDF (Portable Document Format) data converted from the text data. The information processing device 10 may write the log data 16 to an external storage device such as a USB memory. The log data 16 may also be a code, such as a two-dimensional code, converted from character strings indicating the log data 17 and hash data 18. The information processing device 10 may display the log data 16 on a display.

[0028] As described above, the information processing device 10 of the first embodiment includes the processor 11, the storage device 12 that stores data, and the nonvolatile memory 13 that stores the startup program 14 and the erasure program 15. The startup program 14 causes the processor 11 to execute a startup process that starts up the information processing device 10. The erasure program 15 causes the processor 11 to execute an erasure process that erases data from the storage device 12. The erasure program 15 further causes the processor 11 to execute a log generation process that generates hash data 18 using a specific hash algorithm from log data 17 that indicates the execution result of the erasure process, and outputs log data 16 that indicates the log data 17 and the hash data 18.

[0029] This reduces the risk of information leakage from the information processing device 10 when disposing of the information processing device 10. Furthermore, since data is erased using the erasure program 15 stored in the nonvolatile memory 13 together with the startup program 14, data erasure is speeded up and data erasure is performed safely through the protection of the erasure program 15.

[0030] Furthermore, hash data 18 generated by the protected erasure program 15 is added to the log data 17, improving the reliability of the log data 17. By verifying the hash data 18, other information processing devices can confirm that the log data 17 has not been created fraudulently, and can guarantee that data erasure in the information processing device 10 has been completed. Because verification is possible from the log data 16 itself, complex procedures such as complex encrypted communications are not required between the information processing device 10 and other information processing devices, simplifying the procedure for proving the completion of data erasure.

[0031] Furthermore, the user of the information processing device 10 can obtain an erasure certificate issued by a third-party certification authority using the verifiable log data 16. This allows the user of the information processing device 10 to later confirm and prove that the information processing device 10 has been appropriately disposed of, thereby reducing the risk associated with information leakage.

[0032] [Second embodiment] Next, a second embodiment will be described.

[0033] 2 is a diagram illustrating an example of an information processing system according to a second embodiment. The information processing system according to the second embodiment includes personal computers 41 and 100, a smartphone 42, and servers 200 and 300. The personal computer 41, the smartphone 42, and the servers 200 and 300 are connected to a network 40. The network 40 may include a LAN (Local Area Network) or a wide-area data communication network such as the Internet.

[0034] The personal computer 100 is a client computer used by a user. The personal computer 100 corresponds to the information processing device 10 of the first embodiment. The personal computer 100 is, for example, a notebook, tablet, or desktop computer. In the second embodiment, it is assumed that the user is an organization such as a company, and that the personal computer 100 is used for business purposes.

[0035] The storage of the personal computer 100 may store confidential business information, such as a customer list. Users often want to prevent such confidential information from leaking to the public. However, simply deleting a file on a GUI (Graphical User Interface) may only update the management information that manages the file, and may not actually delete the file from the storage. Therefore, using a data recovery tool may allow an invisible file to be restored from the storage.

[0036] Therefore, when disposing of or transferring the personal computer 100, the user may wish to erase the data stored in the storage so that it is difficult to restore. The personal computer 100 has a function for performing such data erasure. The data erasure may be performed by the user himself or by an erasure service provider commissioned by the user.

[0037] The personal computer 41 is a client computer separate from the personal computer 100. The personal computer 41 is an operating computer owned by a user or an erasure service provider. The personal computer 41 is, for example, a notebook or desktop computer. The personal computer 41 acquires an erasure execution log indicating the results of the data erasure from the personal computer 100, and transmits the acquired erasure execution log to the server 200. Thereafter, the personal computer 41 receives an erasure certificate issued by a third-party certification authority from the server 200.

[0038] The smartphone 42 is a portable computer with communication and camera functions. However, other types of computers with communication and camera functions, such as a tablet terminal, may also be used. The smartphone 42 is owned, for example, by the user or the erasure service provider. The smartphone 42 is wirelessly connected to the network 40.

[0039] The smartphone 42 may transmit the erasure execution log to the server 200 instead of the personal computer 41. The personal computer 100 displays the erasure execution log on its display. The smartphone 42 captures an image of the display screen to recognize the erasure execution log. The erasure execution log may be displayed encoded as a two-dimensional code. In this case, the smartphone 42 decodes the captured two-dimensional code into the erasure execution log.

[0040] The server 200 is a server computer that acts as an intermediary between the user of the personal computer 100 and a third-party certification authority and provides a service of providing erasure certificates. The server 200 simplifies the process for users to obtain erasure certificates and promotes the use of erasure certificates. The server 200 may be operated by the manufacturer of the personal computer 100, or by another manufacturer or an organization other than the manufacturer.

[0041] The server 200 receives the erasure execution log from the personal computer 41 or the smartphone 42. The server 200 verifies the erasure execution log to confirm that the log data included in the erasure execution log has not been fraudulently created. If the verification is successful, the server 200 transmits the log data to the server 300 and receives an erasure certificate from the server 300. Thereafter, the server 200 transfers the erasure certificate to the personal computer 41 in response to a request from the personal computer 41.

[0042] Server 300 is a server computer used by a third-party certification authority. The third-party certification authority is an authority other than the user of personal computer 100, the erasure service provider, and the operator of server 200. From a third-party perspective, the third-party certification authority issues an erasure certificate that certifies that data erasure on personal computer 100 has been completed. The erasure certificate may also be called a third-party certificate.

[0043] Server 300 receives log data from server 200. Server 300 registers the received log data in a database held by server 300. Server 300 generates an erasure certificate based on the log data registered in the database and transmits it to server 200. In addition to the contents registered in the database, the erasure certificate includes a digital signature indicating the authenticity of the erasure certificate. The digital signature is generated using the private key of a third-party certification authority. A user can confirm the authenticity of the erasure certificate by obtaining the public key of the third-party certification authority from a PKI (Public Key Infrastructure) and verifying the digital signature.

[0044] 3 is a block diagram showing an example of hardware of a personal computer. The personal computer 100 has a CPU 101, RAM 102, storage 103, a SPI (Serial Peripheral Interface) ROM 104, a power button 105, a display 106, an input device 107, a USB port 108, and a network interface 109. These hardware units are connected to a bus. The personal computer 41, the smartphone 42, and the servers 200 and 300 may have hardware similar to that of the personal computer 100.

[0045] The CPU 101 is a processor that executes arithmetic processing based on program instructions. The CPU 101 corresponds to the processor 11 of the first embodiment. The CPU 101 loads a program from the storage 103 or the SPI ROM 104 into the RAM 102 and executes the program. The personal computer 100 may have a GPU (Graphics Processing Unit) inside or outside the CPU 101.

[0046] The RAM 102 is a volatile semiconductor memory that temporarily stores programs executed by the CPU 101 and user data used for arithmetic processing by the CPU 101. The RAM 102 functions as a main storage device. The personal computer 100 may also have other types of volatile memory besides RAM.

[0047] The storage 103 is a non-volatile storage device that stores software programs such as an OS, middleware, and application software, as well as user data. The storage 103 functions as an auxiliary storage device. The storage 103 corresponds to the storage device 12 of the first embodiment. There are several types of storage 103. For example, the type of storage 103 is an HDD or an SSD.

[0048] The SPI ROM 104 is a nonvolatile memory that stores a BIOS program. The SPI ROM 104 may be called a BIOS memory. The SPI ROM 104 may be a rewritable memory such as a flash memory. The SPI ROM 104 corresponds to the nonvolatile memory 13 of the first embodiment. The SPI ROM 104 is connected to the CPU 101 and the RAM 102 via a bus interface called an SPI.

[0049] The power button 105 is pressed by the user when starting up the personal computer 100. When the power button 105 is pressed, the CPU 101 is initialized, and an instruction at a specific address stored in the SPI ROM 104 is executed by the CPU 101. Then, the CPU 101 recognizes peripheral devices such as the storage 103 in accordance with the BIOS program, and reads out the OS program from the storage 103.

[0050] The display 106 displays images under the control of the CPU 101. The display 106 is, for example, a liquid crystal display or an organic EL (Electro Luminescence) display. The display 106 may be built into the personal computer 100 or may be an external device external to the personal computer 100. The personal computer 100 may also have other types of output devices.

[0051] The input device 107 detects an input operation by a user and transmits an input signal to the CPU 101. Examples of the input device 107 include a keyboard, a touchpad, and a touch panel. The personal computer 100 may have multiple input devices. The input device 107 may be built into the personal computer 100 or may be an external device external to the personal computer 100.

[0052] The USB port 108 is a communication port to which an external device having a USB interface can be connected. A USB memory 43 can be connected to the USB port 108. The USB memory 43 is a flash memory having a USB interface. The CPU 101 can write data from the RAM 102 to the USB memory 43 and can read data from the USB memory 43 to the RAM 102.

[0053] The USB memory 43 is an example of an external recording medium. Other types of external recording media include, for example, magnetic disks and optical disks. Magnetic disks include flexible disks (FDs) and HDDs. Optical disks include compact discs (CDs) and digital versatile discs (DVDs). The personal computer 100 may have a media reader capable of reading optical disks.

[0054] The external recording medium may be a portable recording medium that can be carried around. The portable recording medium may be used to distribute a program. The CPU 101 may copy the program from the portable recording medium to the RAM 102 or the storage 103 and execute the copied program. The external recording medium or the storage 103 may also be called a "computer-readable recording medium."

[0055] The network interface 109 communicates with other computers via a network. The network interface 109 may be a wired communication interface connected via a cable to a wired communication device such as a switch or a router, or may be a wireless communication interface connected via a wireless link to a wireless communication device such as a base station or an access point.

[0056] 4 is a diagram showing an example of the arrangement of programs and data. The storage 103 stores an OS program 111 and user data 112. The OS program 111 is a program of the OS that controls the personal computer 100. Typically, the OS program 111 is stored in the storage 103 from the time the personal computer 100 is initially manufactured. The user data 112 is data added by the user after the personal computer 100 begins to be used. The user data 112 may include confidential business information that should not be leaked to the outside.

[0057] The SPI ROM 104 stores a BIOS program 113, an erasure program 114, and PC identification information 115. The BIOS program 113 is a BIOS program that boots the personal computer 100. The BIOS program 113 corresponds to the boot program 14 of the first embodiment. The BIOS program 113 complies with UEFI, which is an interface between an OS and firmware. The BIOS program 113 is executed by the CPU 101 before the OS program 111.

[0058] The BIOS program 113 recognizes peripheral devices and defines the startup process for reading the OS program 111 from the storage 103. When a specific input operation is received from the user at startup, the CPU 101 displays a BIOS screen on the display 106 in accordance with the BIOS program 113. On the BIOS screen, the user can configure various startup settings, such as specifying a boot drive. Furthermore, when an instruction to start data erasure is given on the BIOS screen, the BIOS program 113 calls the erasure program 114.

[0059] The erasure program 114 defines an erasure process for erasing the user data 112 from the storage 103. The erasure process may erase the OS program 111 from the storage 103 in addition to the user data 112. The erasure program 114 corresponds to the erasure program 15 of the first embodiment. The erasure program 114 may be incorporated into the BIOS program 113. The erasure program 114 is executed by the CPU 101 when the OS program 111 has not yet been executed.

[0060] A possible method of erasing data is to write a specific meaningless byte sequence one or more times to an entire specific partition of the storage 103. Alternatively, if the user data 112 is encrypted, a possible method of erasing data is to erase an encryption key for decrypting the user data 112 from the storage 103. The latter method of erasing data can be completed more quickly than the former method of erasing data.

[0061] PC identification information 115 is identification information assigned to personal computer 100. PC identification information 115 does not overlap with PC identification information assigned to other personal computers of the same type. PC identification information 115 is kept secret from anyone outside the manufacturer and is not disclosed to the user of personal computer 100. However, instead of storing PC identification information 115 in SPI ROM 104, PC identification information 116 equivalent to PC identification information 115 may be held in CPU 101. PC identification information 116 is embedded in CPU 101 in a fixed manner so that it will not be lost even when CPU 101 is initialized.

[0062] The BIOS program 113, erasure program 114, and PC identification information 115 are stored in the SPI ROM 104 from the time the personal computer 100 is first manufactured. However, the BIOS program 113 may be updated by a BIOS update. At least one of the erasure program 114 and the PC identification information 115 may be updated during a BIOS update.

[0063] The personal computer 100 has a mechanism for protecting data stored in the SPI ROM 104, preventing free reading and writing of data in the SPI ROM 104. For example, after the OS starts up, the CPU 101 restricts access to addresses in the SPI ROM 104 from the user space. Also, for example, the OS allows data in the SPI ROM 104 to be rewritten by a verified BIOS update, but denies rewriting of data in the SPI ROM 104 by other methods.

[0064] The personal computer 100 may also have a hardware mechanism that blocks unauthorized access to the SPI ROM 104. This makes it difficult for a user to read the erasure program 114 or the PC identification information 115, and makes it difficult for the user to tamper with the erasure program 114 or the PC identification information 115.

[0065] 5 is a block diagram showing an example of the functions of the information processing system. The personal computer 100 has a BIOS 121, an OS 122, and a data erasure unit 123. The BIOS 121 is implemented by the CPU 101 executing the BIOS program 113. The BIOS 121 calls the OS 122 when the personal computer 100 is started up. Furthermore, when the personal computer 100 is started up, the BIOS 121 calls the data erasure unit 123 instead of calling the OS 122 in response to an instruction from the user.

[0066] The OS 122 is implemented by the CPU 101 executing the OS program 111. The OS 122 allocates the hardware resources of the personal computer 100 to various processes and controls the execution of application programs.

[0067] The data erasure unit 123 is implemented by the CPU 101 executing the erasure program 114. To prevent information leakage, the data erasure unit 123 erases the user data 112 from the storage 103 so that the data is difficult to restore. When the erasure process is completed, the data erasure unit 123 collects log data indicating the execution result of the erasure process.

[0068] The data erasure unit 123 generates a hash ID from the collected log data and PC identification information 115 (or PC identification information 116) using a hash algorithm incorporated in the erasure program 114. The data erasure unit 123 generates an erasure execution log by adding the hash ID to the log data, and outputs the erasure execution log. The erasure execution log does not include the PC identification information 115 (or PC identification information 116). At this time, the data erasure unit 123 saves the erasure execution log in the USB memory 43 connected to the personal computer 100, and displays a two-dimensional code indicating the erasure execution log on the display 106. However, only one of saving to the USB memory 43 and displaying the two-dimensional code may be performed.

[0069] When using the USB memory 43, the user or the erasure service provider removes the USB memory 43 from the personal computer 100 and connects it to the personal computer 41. The personal computer 41 reads the erasure execution log from the USB memory 43. The personal computer 41 transmits the erasure execution log to the server 200.

[0070] The server 200 has a display unit 221, a log analysis unit 222, a PC database 223, and a communication unit 224. The display unit 221 is a web interface that provides a web screen to be displayed on the personal computer 41 or the smartphone 42. For example, the display unit 221 transmits HTML (HyperText Markup Language) text using HTTP (Hypertext Transfer Protocol). The display unit 221 receives an erasure execution log and transmits an erasure certificate acquired using the erasure execution log.

[0071] The log analysis unit 222 verifies the erasure execution log received by the display unit 221 and confirms that the log data contained in the erasure execution log has not been created fraudulently. The erasure execution log is verified using a hash ID contained in the erasure execution log. The log analysis unit 222 knows the hash algorithm incorporated in the erasure program 114. The log analysis unit 222 generates a hash ID by itself using this hash algorithm and compares the generated hash ID with the hash ID contained in the erasure execution log.

[0072] If the two match, the verification is successful, and if the two do not match, the verification is unsuccessful. If the verification is unsuccessful, there is a possibility that the user or the erasure service provider has forged the log data when the data erasure on the storage 103 has not been completed. In this case, the display unit 221 returns an error message indicating that there is an inconsistency in the contents of the erasure execution log.

[0073] The PC database 223 stores the PC identification information of each personal computer. The log analysis unit 222 identifies the personal computer 100 from the log data included in the erasure execution log, and reads out the PC identification information assigned to the personal computer 100 from the PC database 223. The log analysis unit 222 uses the read-out PC identification information and log data to generate a hash ID for verification.

[0074] The communication unit 224 communicates with the server 300. For example, the communication unit 224 communicates with the server 300 using HTTP. If the verification by the log analysis unit 222 is successful, the communication unit 224 transmits the log data included in the erasure execution log to the server 300. At this time, the communication unit 224 does not need to transmit the hash ID included in the erasure execution log to the server 300. The communication unit 224 receives an erasure certificate from the server 300. This erasure certificate is temporarily stored in the server 200 and is transferred by the display unit 221 without being altered.

[0075] Server 300 includes a communication unit 321 and a log database 322. Communication unit 321 receives log data from server 200. For example, communication unit 321 communicates with server 200 using HTTP. Communication unit 321 registers the log data in log database 322. Communication unit 321 generates a digital signature from the log data using the private key of a third-party certification authority, and returns an erasure certificate including the log data and the digital signature.

[0076] Log database 322 stores log data of data erasures performed on various personal computers. Log database 322 may store log data of personal computers managed by server 200 and log data of personal computers not managed by server 200 in a unified manner.

[0077] 6 is a diagram showing an example of hash ID generation. When data erasure in the storage 103 is completed, the data erasure unit 123 collects log data that identifies the executed data erasure. As an example, the log data includes the PC model name, PC serial number, disk type, disk serial number, erasure start date and time, erasure end date and time, and execution result.

[0078] The PC model name indicates the type of personal computer. The PC serial number is an identification number that identifies each individual personal computer within each type. The PC model name and PC serial number are assigned by the manufacturer of the personal computer. Each personal computer is uniquely identified by the combination of the PC model name and PC serial number.

[0079] The disk type is the type of storage, such as HDD or SSD. The disk serial number is an identification number that identifies each storage. The disk serial number is assigned by the manufacturer that produces the storage. The erasure start date and time is the start time of data erasure. The erasure end date and time is the end time of data erasure. The execution result indicates whether the data erasure was successful or not. This log data corresponds to the log data 17 in the first embodiment.

[0080] The data deletion unit 123 generates input data 131 by reading out the PC identification information 115 (or the PC identification information 116) and adding it to the log data. The data deletion unit 123 generates a hash ID 133 by inputting the input data 131 into a hash algorithm 132. The hash ID 133 is a byte string of fixed length or variable length. The hash ID 133 corresponds to the hash data 18 in the first embodiment.

[0081] The hash algorithm 132 includes a process of rearranging the input data 131. The hash algorithm 132 also includes a process of inputting the conversion result of the input data 131 into a one-way hash function. The hash algorithm 132 is implemented in the erasure program 114 and is kept secret. The hash algorithm 132 may be changed by a BIOS update. The hash algorithm 132 may also differ depending on the personal computer. It is difficult for users and erasure service providers to read the erasure program 114 and therefore difficult to know the hash algorithm 132.

[0082] Therefore, it is difficult for a user or an erasure service provider to generate a hash ID 133 that matches the forged log data. Furthermore, it is also difficult for a user or an erasure service provider to read the PC identification information 115 (or the PC identification information 116). The PC identification information 115 may be changed by a BIOS update. Therefore, the reliability of the hash ID 133 is strengthened by the hash algorithm 132 using the PC identification information 115 (or the PC identification information 116).

[0083] FIG. 7 is a diagram showing an example of an output of an erasure execution log. The data erasure unit 123 saves the erasure execution log 134 in the USB memory 43. The erasure execution log 134 corresponds to the log data 16 of the first embodiment. The erasure execution log 134 includes log data such as the PC model name, PC serial number, disk type, disk serial number, erasure start date and time, erasure end date and time, and execution results. The erasure execution log 134 also includes a hash ID. However, the erasure execution log 134 does not include the PC identification information 115 (or PC identification information 116). The erasure execution log 134 may be in text format or PDF format.

[0084] Furthermore, the data erasure unit 123 displays a screen 135 on the display 106. The screen 135 includes a two-dimensional code that indicates the same content as the erasure execution log 134. For example, the data erasure unit 123 converts a character string included in the erasure execution log 134 into a two-dimensional code according to a rule according to the type of two-dimensional code employed.

[0085] At this time, the data erasure unit 123 may generate a character string by concatenating the contents of the erasure execution log 134 as a parameter after a uniform resource locator (URL) for accessing the server 200, and convert the character string into a two-dimensional code. This allows the user or the erasure service provider to transmit the erasure execution log 134 to the server 200 simply by accessing the URL recognized by the smartphone 42.

[0086] 8 is a diagram showing an example of a PC data table 231. The PC data table 231 is stored in the PC database 223. The PC data table 231 includes a plurality of records that associate PC model names, PC serial numbers, PC identification information, and disk serial numbers.

[0087] The log analysis unit 222 extracts the PC model name and PC serial number from the erasure execution log 134. The personal computer 100 is identified by the pair of the PC model name and the PC serial number. The log analysis unit 222 searches the PC data table 231 using the pair of the PC model name and the PC serial number as a key, and reads out the corresponding PC identification information. The log analysis unit 222 generates a hash ID using the read PC identification information.

[0088] The log analysis unit 222 may further use the corresponding disk serial number to determine the reliability of data erasure. The disk serial number registered in the PC data table 231 is a disk serial number known to the manufacturer of the personal computer 100, and is the disk serial number of the storage device installed at the time of manufacture. However, there is a possibility that a user may replace the storage device, and the disk serial number of the storage device 103 may differ from the one registered in the PC data table 231.

[0089] In this case, there is a possibility that data may remain in the old storage, making it difficult to prove that data erasure on the personal computer 100 has been completed. Therefore, the log analysis unit 222 may compare the disk serial number included in the erasure execution log with the disk serial number registered in the PC data table 231. If the two do not match, the display unit 221 may return a warning message.

[0090] Furthermore, if the two do not match, the log analysis unit 222 may add a comment to the log data sent to the server 300 indicating that the disk serial number is different from the one at the time of manufacture. This will result in the comment being registered in the log database 322, and the comment may be included in an erasure certificate issued by the server 300. Such an erasure certificate may only provide a limited guarantee regarding the erasure of data on the personal computer 100.

[0091] 9 is a flowchart showing an example of a procedure for generating a log. The log generation shown in FIG.

[0092] (S10) The BIOS 121 displays a BIOS screen on the display 106. The BIOS 121 accepts an input operation to start data erasure on the BIOS screen, and starts the erasure program 114 stored in the SPI ROM 104. Note that the erasure program 114 may be a module included in the BIOS program 113.

[0093] (S11) The data erasure unit 123 erases the data from the storage 103. (S12) The data erasure unit 123 collects log data for identifying data erasure. For example, the data erasure unit 123 collects the PC model name, PC serial number, disk type, disk serial number, erasure start date and time, erasure end date and time, execution result, etc.

[0094] (S13) The data erasure unit 123 reads out the PC identification information embedded in the personal computer 100. For example, the data erasure unit 123 reads out the PC identification information 115 stored in the SPI ROM 104.

[0095] (S14) The data erasure unit 123 generates a hash ID 133 from the collected log data and the read PC identification information using a hash algorithm 132 built into the personal computer 100. The hash algorithm 132 is implemented in the erasure program 114 and is kept secret from anyone outside the manufacturer.

[0096] (S15) The data erasure unit 123 generates an erasure execution log 134 by adding the generated hash ID 133 to the collected log data. (S16) The data erasure unit 123 outputs the erasure execution log 134. For example, the data erasure unit 123 stores text data or PDF data indicating the erasure execution log 134 in the USB memory 43. Also, for example, the data erasure unit 123 displays a two-dimensional code converted from the erasure execution log 134 on the display 106.

[0097] 10 is a flowchart showing an example of a procedure for log verification. The log verification shown in FIG.

[0098] (S20) The display unit 221 receives the erasure execution log 134 from the personal computer 41 or the smartphone 42. (S21) The log analysis unit 222 extracts data items that identify the personal computer 100 from the erasure execution log 134. For example, the log analysis unit 222 extracts the PC model name and PC serial number from the erasure execution log 134.

[0099] (S22) The log analysis unit 222 searches the PC database 223 for the PC identification number associated with the extracted data item. (S23) The log analysis unit 222 uses the hash algorithm 132 implemented in the erasure program 114 to generate a hash ID from the log data included in the erasure execution log 134 and the retrieved PC identification number.

[0100] (S24) The log analysis unit 222 determines whether the generated hash ID matches the hash ID included in the erasure execution log 134. If the two hash IDs match, the process proceeds to step S25; if they do not match, the process proceeds to step S28.

[0101] (S25) The communication unit 224 transmits the log data to the server 300 of the third-party certification authority. (S26) In response to the transmission of the log data, the communication unit 224 receives an erasure certificate as a third-party certificate from the server 300 of the third-party certification authority.

[0102] (S27) The display unit 221 transfers the erasure certificate received from the server 300. For example, the display unit 221 transmits the erasure certificate to the personal computer 41 in response to a request from the personal computer 41. Then, the log verification ends.

[0103] (S28) The display unit 221 transmits an error message to the personal computer 41 or smartphone 42 that is the sender of the erasure execution log 134.

[0104] As described above, according to the information processing system of the second embodiment, the user of the personal computer 100 can obtain an erasure certificate issued by a third-party certification authority when disposing of the personal computer 100. This allows the user to prove that the data has been erased appropriately, reducing the business risk of information leakage.

[0105] The personal computer 100 also performs data erasure at the BIOS level. This speeds up data erasure and ensures secure data erasure. The server 200 also acquires the erasure execution log output by the personal computer 100, applies to a third-party certification authority to obtain an erasure certificate, and forwards the erasure certificate. This simplifies the process for users to obtain an erasure certificate and promotes the use of erasure certificates.

[0106] In addition, the personal computer 100 adds a hash ID to the erasure execution log using a hash algorithm and PC identification information protected at the BIOS level. This makes it difficult to forge an erasure execution log before data erasure is complete. The server 200 knows this hash algorithm and PC identification information and verifies the hash ID added to the erasure execution log. This makes it possible to confirm the authenticity of the erasure execution log without performing complex procedures between the personal computer 100 and the server 200, simplifying the procedure for obtaining an erasure certificate. [Explanation of symbols]

[0107] 10. Information processing equipment 11 processors 12 Storage devices 13 Non-volatile memory 14 Startup Programs 15 Erase Program 16,17 Log data 18 Hash Data

Claims

1. An information processing device, a processor; a storage device that stores data; a nonvolatile memory that stores a boot program that causes the processor to execute a boot process that starts up the information processing device, and an erasure program that causes the processor to execute an erasure process that erases the data from the storage device; the erasure program comprises: and further causing the processor to execute a log generation process of generating hash data from first log data indicating a result of the erasure process using a specific hash algorithm, and outputting second log data indicating the first log data and the hash data. Information processing device.

2. the boot program is a BIOS (Basic Input Output System) program, and the nonvolatile memory is a BIOS memory; 2. The information processing device according to claim 1.

3. the nonvolatile memory stores identification information assigned to the information processing device; the log generation process generates the hash data from the first log data and the identification information using the specific hash algorithm; 2. The information processing device according to claim 1.

4. A first information processing device, a storage device for storing data, and a nonvolatile memory for storing a startup program for executing a startup process for starting up the first information processing device and an erasure program for executing an erasure process for erasing the data from the storage device; generating first hash data from first log data indicating a result of execution of the erasure process using a specific hash algorithm based on the erasure program, and outputting second log data indicating the first log data and the first hash data; a first information processing device; a second information processing device that acquires the second log data, generates second hash data from the first log data, and verifies the first log data by comparing the first hash data with the second hash data; An information processing system having the above.

5. the nonvolatile memory stores identification information assigned to the first information processing device; the first information processing device generates the first hash data from the first log data and the identification information using the specific hash algorithm; the second information processing device has a database in which data items included in the first log data are associated with the identification information; the second information processing device acquires the identification information from the database, and generates the second hash data from the first log data and the identification information; 5. The information processing system according to claim 4.

Images