Information processing device and program

Abstract

To update BIOS by means of an external storage, safely in terms of security.SOLUTION: An information processing apparatus 10 includes a control unit 11 and storage units 12, 13. The control unit 11 executes processing to recognize whether an external storage medium has been connected or not when detecting a predetermined user operation during device startup. When detecting that a specific external storage medium 2 including specific information has been connected, the control unit 11 disables an access from the specific external storage medium 2 to the storage unit 12 equipped in the apparatus and executes device startup based on the specific information. The control unit 11 executes startup control to update a device setup program stored in the storage unit 13 using update data stored in the specific external storage medium 2.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an information processing device and a program. [Background technology]

[0002] Information processing devices such as personal computers (PCs) are equipped with a basic input output system (BIOS) for starting up the hardware. The BIOS is updated using update data to fix defects and improve functions.

[0003] In a BIOS update, update data is usually provided to an information processing device via a manufacturer's website. Alternatively, an external storage device such as a USB (Universal Serial Bus) memory device that stores the update data can be connected to the information processing device and the update data can be provided to the information processing device through the external storage device.

[0004] As a related technique, for example, a technique has been proposed in which a BIOS program stored in a normal use rewritable non-volatile memory is updated in accordance with BIOS update type information stored in a backup rewritable non-volatile memory. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2015-153334 A Summary of the Invention [Problem to be solved by the invention]

[0006] In an information processing device to which an external storage can be connected, there is a possibility that user data (user programs) stored in the built-in storage of the information processing device may be illegally retrieved by connecting the external storage to the information processing device. Therefore, as a security measure, some information processing devices disable the communication port to which the external storage is connected, thereby prohibiting the connection of the external storage.

[0007] On the other hand, in maintenance work for information processing devices, customer engineers, repair departments, etc. may want to update the BIOS using external storage. However, for information processing devices for which the connection of external storage is prohibited, it is difficult to update the BIOS using external storage, which causes a problem that the maintenance work is delayed.

[0008] In one aspect, the present invention aims to provide an information processing device and program that enables BIOS updates to be performed in a limited manner using external storage in a secure manner from a security standpoint for devices that prohibit BIOS updates from external storage. [Means for solving the problem]

[0009] In order to solve the above problem, an information processing device is provided. The information processing device has a control unit that performs a recognition process of whether an external storage medium is connected when a predetermined user operation is detected at the time of starting up the device, and when it detects the connection of a specific external storage medium including specific information, performs a startup control to invalidate access from the specific external storage medium to a first storage unit built in the device, execute device startup based on the specific information, and update a device setup program stored in a second storage unit using update data stored in the specific external storage medium. The first storage unit is connected to a port destination of the expansion bus, and when the control unit detects the connection of a specific external storage medium including specific information, the control unit logically disconnects the connection interface of the expansion bus to disable access to the first storage unit. . In order to solve the above problem, there is provided a program for causing a computer to execute control similar to that of the information processing device. Effect of the Invention

[0010] According to one aspect, it is possible to perform a BIOS update in a secure manner using external storage. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a diagram illustrating an example of an information processing device. [Diagram 2] FIG. 2 is a diagram illustrating an example of functional blocks of an information processing device. [Diagram 3] FIG. 2 illustrates an example of a hardware configuration of an information processing device. [Figure 4] 10 is a flowchart illustrating an example of an operation of the information processing device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] The present embodiment will be described below with reference to the drawings. 1 is a diagram for explaining an example of an information processing device. The information processing device 10 includes a control unit 11, a storage unit 12 (first storage unit), and a storage unit 13 (second storage unit). The functions of the control unit 11 can be realized, for example, by a processor (not shown) included in the information processing device 10 executing a predetermined program. The storage unit 12 stores user data of an OS (Operating System) and various control information for operating the information processing device 10. The storage unit 13 stores a device setup program (hereinafter referred to as BIOS).

[0013] [Step S1] The control unit 11 detects a predetermined user operation when the device is started up. [Step S2] When a predetermined user operation is detected, the control unit 11 performs a process of recognizing whether or not an external storage medium is connected. [Step S3] The control unit 11 detects whether a specific external storage medium 2 containing specific information is connected.

[0014] [Step S4] When the control unit 11 detects the connection of the specific external storage medium 2, it disables access from the specific external storage medium 2 to the storage unit 12 built into the information processing device 10. Disabling access to the storage unit 12 built into the device means, for example, making it impossible for the control unit 11 to recognize the existence of the storage unit 12. [Step S5] The control unit 11 executes device startup based on the specific information stored in the specific external storage medium 2, and updates the BIOS stored in the memory unit 13 using the update data stored in the specific external storage medium 2.

[0015] In this way, when the information processing device 10 detects the connection of a specific external storage medium 2 containing specific information, it disables access to the memory unit 12 built into the device, starts up the device based on the specific information, and updates the BIOS stored in the memory unit 13 using the update data stored in the specific external storage medium 2.

[0016] As a result, even in an information processing device that prohibits BIOS updates from external storage media during normal use, by using a specific external storage medium 2 that contains specific information, it becomes possible to start up the device from the specific external storage medium 2 in a limited manner and perform a BIOS update in a secure manner from a security standpoint.

[0017] <Function block> 2 is a diagram showing an example of a functional block of an information processing device. In the following description, the external storage medium is called an external storage. The control unit 11 of the information processing device 10 includes a user operation detection unit 11a, an external storage recognition unit 11b, a startup mode transition processing unit 11c, an access invalidation processing unit 11d, and an external storage startup processing unit 11e.

[0018] The user operation detection unit 11a detects whether a specific user operation has been performed when the device is started up. The external storage recognition unit 11b recognizes whether an external storage connected to the information processing device 10 is an external storage including specific information. An example of the external storage is a USB.

[0019] If the external storage includes specific information, the start-up mode transition processing unit 11c performs a start-up mode transition process using the specific information, and requests the user to input a start-up password (dedicated password).

[0020] When the access invalidation processing unit 11d recognizes that the startup password matches the password input by the user, it invalidates access from the external storage to the memory unit 12 (hereinafter, may be referred to as the built-in storage). The external storage startup processing unit 11e performs startup via the external storage, and updates the BIOS stored in the memory unit 13 using the BIOS update data stored in the external storage.

[0021] <Hardware configuration> 3 is a diagram showing an example of a hardware configuration of an information processing device. The information processing device 10 is entirely controlled by a processor (computer) 100. The processor 100 realizes the functions of a control unit 11. A memory 101, an input / output interface 102, a network interface 104, a communication port 105, a storage device 106, and a non-volatile memory (flash memory) 107 for BIOS are connected to the processor 100 via a bus 103.

[0022] The processor 100 may be a multiprocessor. The processor 100 may be, for example, a central processing unit (CPU), an FPGA, a micro processing unit (MPU), a digital signal processor (DSP), an application specific integrated circuit (ASIC), or a programmable logic device (PLD). The processor 100 may also be a combination of two or more elements of a CPU, an FPGA, an MPU, a DSP, an ASIC, or a PLD.

[0023] The memory 101 is used as a main storage device of the information processing device 10. The memory 101 temporarily stores at least a part of the OS program and application programs to be executed by the processor 100. The memory 101 also stores various data required for processing by the processor 100.

[0024] The storage device 106 corresponds to the memory unit 12 that is the target of the access invalidation process, and stores the OS program, application programs, and various data. The storage device 106 may include, for example, a semiconductor memory device such as a flash memory or an SSD (Solid State Drive) or a magnetic recording medium such as an HDD (Hard Disk Drive) as an auxiliary storage device. The non-volatile memory 107 for BIOS corresponds to the memory unit 13, and stores the BIOS.

[0025] Peripheral devices connected to the bus 103 include an input / output interface 102, a network interface 104, and a communication port 105. The input / output interface 102 controls the input / output interface with the information processing device 10. The input / output interface 102 can also connect to information input devices such as a display, a keyboard, and a mouse, and transmits signals sent from the information input devices to the processor 100.

[0026] Furthermore, the input / output interface 102 also functions as a communication interface for connecting peripheral devices. For example, the input / output interface 102 can connect an optical drive device that uses laser light or the like to read data recorded on an optical disc. Optical discs include Blu-ray Disc (registered trademark), CD-ROM (Compact Disc Read Only Memory), CD-R (Recordable) / RW (Rewritable), etc.

[0027] Furthermore, the input / output interface 102 can connect to a memory device or a memory reader / writer. The memory device is a recording medium equipped with a function for communicating with the input / output interface 102. The memory reader / writer is a device for writing data to a memory card or reading data from a memory card. The memory card is a card-type recording medium.

[0028] The network interface 104 is connected to a network and performs network interface control. For example, a NIC (Network Interface Card), a wireless LAN (Local Area Network) card, etc. may be used as the network interface 104. Data received by the network interface 104 is output to the memory 101 and the processor 100. The communication port 105 is a port that connects to the external storage 20, for example, a USB port. The communication port 105 connects to the external storage 20 such as a USB, and data stored in the external storage 20 is output to the memory 101 and the processor 100 via the communication port 105.

[0029] The above hardware configuration can realize the processing functions of the information processing device 10. For example, the information processing device 10 can execute the processing of the present invention by the processor 100 executing a predetermined program.

[0030] The information processing device 10 can cause the control unit 11 to execute the processing functions of the present invention by, for example, executing a program recorded on a computer-readable recording medium. The program describing the processing contents to be executed by the information processing device 10 can be recorded on various recording media.

[0031] For example, the program to be executed by the information processing device 10 may be stored in an auxiliary storage device. The processor 100 loads at least a part of the program in the auxiliary storage device into the main storage device and executes the program.

[0032] The program may also be recorded on a portable recording medium such as an optical disk, a memory device, or a memory card. The program stored on the portable recording medium is executable after being installed in an auxiliary storage device under the control of the processor 100. The processor 100 may also directly read out and execute the program from the portable recording medium.

[0033] <Flowchart> FIG. 4 is a flowchart showing an example of the operation of the information processing device. [Step S10] An external storage device is connected to the information processing device 10 by the user. [Step S11] The control unit 11 determines whether or not a predetermined user operation has been performed. If the predetermined user operation has been performed, the process proceeds to step S12. If the predetermined user operation has not been performed, the process proceeds to step S20. Note that, although the process is described as being performed after the external storage is connected, the external storage may be connected after the process is performed.

[0034] The predetermined user operation is an operation in which the user presses the power button while pressing any multiple keys on the keyboard of the information processing device 10. For example, the operation corresponds to pressing the power button while simultaneously pressing the keys "r", "m", "d" and "b" on the keyboard. The combination of multiple keys can be changed as desired in the BIOS setup.

[0035] [Step S12] When the control unit 11 detects the execution of a specific user operation, it performs a process of recognizing the connected external storage. Here, the control unit 11 disables the function of the communication port to which the external storage is connected when the device is started up, and when a specific user operation is detected, it enables the function of the communication port and performs a process of recognizing whether or not the external storage is connected. As a result, if a specific user operation is not detected, the communication port remains disabled and access from the external storage is prohibited, thereby improving security.

[0036] In some OSs (for example, Windows (registered trademark)), a fast startup mode may be set by default to reduce startup time, and the fast startup mode may skip the process of recognizing external storage. Even when such a fast start-up mode is set, if the control unit 11 detects the execution of a predetermined user operation, it disables the fast start-up mode and executes the process of recognizing the external storage.

[0037] [Step S13] The control unit 11 judges whether the connected external storage is an external storage including specific information. If the control unit 11 detects the connection of an external storage including specific information (hereinafter, may be referred to as a specific external storage), the process proceeds to step S14, and if the control unit 11 does not detect the connection of a specific external storage, the process proceeds to step S20.

[0038] [Step S14] When the control unit 11 recognizes the specific information stored in the specific external storage, it transitions to a startup mode using the specific information. Note that the fixed path of the specific external storage stores specific information (a startup file or a startup flag) that defines that the device is started by the specific external storage, and the control unit 11 transitions to a startup mode using the specific external storage by detecting this specific information.

[0039] [Step S15] A boot password for booting from the specific external storage is preset by the BIOS setup in the control unit 11. When the control unit 11 transitions to a boot mode using the specific external storage, it displays a password input field on the screen.

[0040] In addition to the BIOS setup of a PC, which usually includes a BIOS setup password, an OS startup password, and a HDD password, you will also need to set a startup password for booting from a specific external storage device.

[0041] [Step S16] The control unit 11 determines whether the startup password matches the password entered in the password entry field. If the startup password matches the entered password, the process proceeds to step S17. If they do not match, the process proceeds to step S20.

[0042] [Step S17] The control unit 11 disables access to the built-in storage. For example, if the built-in storage is connected to a port of an expansion bus such as PCIe (Peripheral Component Interconnect Express: registered trademark), the control unit 11 disables access to the built-in storage by logically disconnecting the connection interface. Examples of the built-in storage include an SSD on which user data (such as an OS) is installed, and an expansion HDD for storing data.

[0043] In this way, when transitioning to a startup mode using a specific external storage, a process is executed to disable access to the internal storage. Therefore, even if the specific external storage contains a virus, for example, it will not affect the user data stored in the internal storage, thereby ensuring security.

[0044] [Step S18] The control unit 11 starts up in a start-up mode using the specific external storage. [Step S19] The control unit 11 performs a BIOS update using the BIOS update data stored in the specific external storage. The specific external storage stores an EFI (Extensible Firmware Interface) Shell, and the BIOS update is performed using the EFI Shell. The startup program (e.g., EFI / Boot / bootx64.efi) and startup batch (e.g., startup.nsh) by the specific external storage conform to the mechanism of the EFI Shell.

[0045] [Step S20] The control unit 11 starts up in the normal start-up mode. When starting up in the normal start-up mode and updating the BIOS, for example, update data is acquired via the Web and the BIOS is updated. Note that the processes from step S11 to step S18 and step S20 are realized by executing the program of the BIOS before the update.

[0046] On the other hand, in the above, when the control unit 11 detects the connection of a non-specific external storage (non-specific external storage medium) that does not include identification information, it prohibits the device from starting up from the non-specific external storage and displays a device start-up prohibition screen.

[0047] Furthermore, when the user switches from a non-specific external storage to a specific external storage while the device startup prohibition screen is displayed, the control unit 11 executes the startup control of steps S14 to S19. This allows the user to easily recognize that the non-specific external storage has been connected by mistake by displaying the device startup prohibition screen, and to switch to a specific external storage connection, thereby enabling safe and prompt maintenance work.

[0048] As described above, according to the present invention, even for an information processing device for which BIOS updates from external storage are prohibited, by using an external storage containing specific information, the device can be started and the BIOS can be safely updated without accessing user data in the internal storage, which makes it possible to improve the efficiency of maintenance work.

[0049] The processing functions of the information processing device 10 of the present invention described above can be realized by a computer. In this case, a program is provided that describes the processing contents of the functions that the information processing device 10 should have. The above processing functions are realized on the computer by executing the program on the computer.

[0050] The program describing the processing contents can be recorded on a computer-readable recording medium. Examples of computer-readable recording media include magnetic storage units, optical disks, magneto-optical recording media, and semiconductor memories. Examples of magnetic storage units include hard disk drives (HDDs), flexible disks (FDs), and magnetic tapes. Examples of optical disks include CD-ROM / RWs. Examples of magneto-optical recording media include MOs (Magneto Optical disks).

[0051] When distributing a program, for example, a portable recording medium such as a CD-ROM on which the program is recorded is sold. Also, the program can be stored in the memory of a server computer and transferred from the server computer to other computers via a network.

[0052] A computer that executes a program stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage unit. The computer then reads the program from its own storage unit and executes processing according to the program. Note that the computer can also read the program directly from a portable recording medium and execute processing according to the program.

[0053] The computer can also execute processing according to the programs it receives each time the programs are transferred from a server computer connected via a network. At least a part of the processing functions can be realized by electronic circuits such as DSPs, ASICs, and PLDs.

[0054] Although the embodiments have been described above, the configurations of the parts shown in the embodiments can be replaced with other parts having similar functions. Any other components or steps may be added. Furthermore, any two or more configurations (features) of the above-mentioned embodiments may be combined. [Explanation of symbols]

[0055] 10. Information processing device 11 Control section 12 Memory unit (first memory unit) 13 Memory unit (second memory unit) 2 Specific external storage media

Claims

1. a control unit that performs a recognition process for determining whether an external storage medium is connected when a predetermined user operation is detected during startup of the device, and when it detects that a specific external storage medium including specific information is connected, disables access from the specific external storage medium to a first storage unit built in the device, starts the device based on the specific information, and performs startup control to update a device setup program stored in a second storage unit using update data stored in the specific external storage medium, the first storage unit is connected to a port destination of an expansion bus; when the control unit detects the presence of a connection of the specific external storage medium including the specific information, the control unit logically disconnects a connection interface of the expansion bus to disable access to the first storage unit. Information processing device.

2. 2. The information processing device according to claim 1, wherein the control unit disables the function of the communication port to which the external storage medium is connected when the device is started up, and when the specified user operation is detected, enables the function of the communication port and performs processing to recognize whether or not the external storage medium is connected.

3. 3. The information processing device of claim 2, wherein the control unit, when detecting a connection of a non-specific external storage medium that does not contain the specific information, prohibits device startup from the non-specific external storage medium and displays a device startup prohibition screen, and when the connection is switched from the non-specific external storage medium to the specific external storage medium while the device startup prohibition screen is being displayed, executes the startup control.

4. The information processing apparatus according to claim 1 , wherein the control unit detects pressing of a preset combination of a plurality of keys on a keyboard and pressing of a power button as the predetermined user operation.

5. 2. The information processing device according to claim 1, wherein the control unit, when detecting that the specific external storage medium is connected, displays an input field for a dedicated password for the specific external storage medium, and executes the startup control when it detects that the dedicated password matches the input password.

6. On the computer, When a specific user operation is detected during startup of the device, the device performs a process to recognize whether an external storage medium is connected or not; when detecting the connection of a specific external storage medium including specific information, disable access from the specific external storage medium to a first storage unit built in the device, and perform startup control to start the device based on the specific information and update the device setup program stored in the second storage unit using update data stored in the specific external storage medium; the first storage unit is connected to a port destination of an expansion bus; when detecting the connection of the specific external storage medium including the specific information, logically disconnecting a connection interface of the expansion bus to disable access to the first storage unit; A program that executes a process.

Images