JP2014048635A - Hard disk encryption program and hard disk encryption system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a technique for, when constructing the same environment on a plurality of user terminals, maintaining security strength of data in the respective user terminals and increasing efficiency at a time of construction of an environment of the plurality of user terminals.SOLUTION: The invention relates to an encryption program for encrypting data stored in a storage device of an information processing device. The encryption program causes the information processing device to perform encryption processing for encrypting data stored in the storage device and setting processing for setting the information processing device so as to perform the encryption processing at a time of next activation of the information processing device.

Description

  The present invention relates to a technique for managing encryption processing in a case where a user terminal environment in which hard disk encryption software is introduced to prevent leakage of confidential information from a user terminal is copied to at least one other user terminal. It is.

  When constructing an environment of a plurality of user terminals to which the hard disk encryption program is applied, if the encryption key is the same between the user terminals, data can be referred to between the user terminals, and the security strength is reduced. Therefore, it is necessary to manage by applying different encryption keys between the user terminals.

  For example, in the system disclosed in the following patent document 1 filed prior to the present applicant, encryption keys created for each client are managed in a table format, and different encryption keys are applied to each user terminal. It becomes possible to do.

  On the other hand, as a method for constructing an environment of a large number of user terminals, a method using disk image duplication software is widely used. This is a method of constructing an environment by constructing an environment of one user terminal and then duplicating the disk image of the user terminal to another user terminal using the disc image duplication software. Since only one user terminal is required to construct the environment, it is possible to efficiently construct the environment of many user terminals.

JP 2010-154297 A

  However, for a user terminal to which a hard disk encryption program is applied, when the disk image is duplicated by the disk image duplication software, the encryption key for encryption and the encrypted data are also directly sent to the duplication destination user terminal. Duplicated. Therefore, there is a problem that the encryption keys in the copy source and copy destination user terminals are the same, and the security strength is reduced.

  Due to the above problems, when building a large number of user terminals by disk image duplication of the disk image duplication software, to maintain the security strength, the hard disk encryption program is distributed to all duplicate user terminals after duplicating the disk image. Need arises. That is, it is necessary to execute the hard disk encryption program again on all user terminals after copying, generate different encryption keys on each user terminal, and encrypt the data with the generated encryption keys. Efficiency when constructing the terminal environment is reduced.

  The present invention has been made in view of such a situation. When the same environment is constructed in a plurality of user terminals, the environment of the plurality of user terminals is constructed while maintaining the security strength of data in each user terminal. Technology to improve efficiency at the time.

  In order to solve the above-described problem, according to an embodiment of the present invention, an encryption program for encrypting data stored in a storage device of an information processing device is provided. The encryption program causes the information processing apparatus to execute encryption processing for encrypting data stored in the storage device, and to execute the encryption processing when the information processing apparatus is started next time. And a setting process for setting the information processing apparatus.

  According to another embodiment of the present invention, there is provided an encryption system in an environment construction system that replicates the environment of a first information processing apparatus to at least one second information processing apparatus. In the encryption system, the encryption unit installed in the first information processing apparatus and the data stored in the storage device of the first information processing apparatus are transferred to the at least one second information processing apparatus. A copy means for copying, wherein the encryption means encrypts data stored in a storage device of the information processing apparatus in which the encryption means is installed, and the encryption means Setting processing means for setting the information processing apparatus so that the encryption processing means is executed when the installed information processing apparatus is activated next time.

  According to the present invention, when the same environment is constructed in a plurality of user terminals, it is possible to improve the efficiency in constructing the environment of the plurality of user terminals while maintaining the security strength of data in each user terminal. become.

  Further features related to the present invention will become apparent from the description of the present specification and the accompanying drawings. Further, problems, configurations, and effects other than those described above will be clarified by the following description of embodiments.

It is a figure for demonstrating the hard disk encryption program and hard disk encryption system which concern on 1st Embodiment. It is a figure explaining the structure and process of a hard disk encryption program. It is a flowchart which shows the process of a hard-disk encryption program. It is a flowchart which shows a process when the replication origin user terminal and the replication destination user terminal are started again. It is a flowchart which shows the procedure of environment construction of many user terminals to which the hard disk encryption program is applied by the environment builder. It is a flowchart which shows the flow of a process at the time of the user of each user terminal starting own terminal after environment construction. It is explanatory drawing which shows the flow of operation | movement of the whole system demonstrated in FIGS. It is a figure for demonstrating the hard disk encryption program and hard disk encryption system which concern on 2nd Embodiment.

  DESCRIPTION OF EMBODIMENTS Hereinafter, embodiments for implementing a hard disk encryption program and a hard disk encryption system of the present invention will be described in detail with reference to the accompanying drawings.

<First Embodiment>
FIG. 1 is a diagram for explaining a hard disk encryption program and a hard disk encryption system according to the first embodiment. FIG. 1 shows an environment construction system that replicates the environment of one user terminal [1] 101 that is a replication source to at least one user terminal [2 to N] (N is an integer of 2 or more) 102 that is a replication destination. ing. Hereinafter, in order to simplify the description, the user terminal [1] 101 and the user terminals [2 to N] 102 are referred to as “user terminal 101” and “user terminal 102”.

  The user terminal 101 and the user terminal 102 are configured by an information processing apparatus such as a personal computer or a workstation. These information processing apparatuses include a central processing unit 121 such as a CPU (Central Processing Unit), a memory 122, a hard disk (storage device) 123, an input device (not shown) such as a keyboard, and an output such as a display. Device (not shown). In the user terminal 102, the central processing unit and memory drawing are omitted, and only the hard disk 123 is shown.

  The environment builder installs the operating system 107 using the operating system installer 103 on the user terminal 101 that is the disk image copy source. Then, the environment builder installs the application 108 using the application installer 104, and installs the hard disk encryption program 109 using the hard disk encryption program installer 105. As a result, an environment in which the operating system 107, the application 108, and the hard disk encryption program 109 are incorporated is constructed in the user terminal 101. Note that data 110 other than these may be incorporated.

  Note that the operating system 107, the application 108, the hard disk encryption program 109, and the data 110 are stored in the hard disk 123 of the user terminal 101. The operating system 107, the application 108, the hard disk encryption program 109, and the like are read from the hard disk 123 to the memory 122, and the central processing unit 121 executes actual processing according to instructions of the program codes.

  The hard disk encryption program 109 (encryption means) is a program for encrypting data stored in the hard disk 123 of the information processing apparatus in which the hard disk encryption program 109 is installed and executing a process of writing to the hard disk 123. It is. Specifically, the information processing apparatus (that is, the central processing unit 121) creates an encryption key by generating a random number using the hard disk encryption program 109, and the encryption key is stored in the hard disk 123 using the encryption key. Encrypt data. In addition, the information processing apparatus executes a process of automatically decrypting the encrypted data when the encrypted data is read from the hard disk 123 by the hard disk encryption program 109.

  The disk image copying software (duplicating means) 106 stores the disk image (the operating system 107, the application 108, the hard disk encryption program 109, and the data 110) of the hard disk 123 of the user terminal 101 that is the copy source, and the hard disk 123 of the user terminal 102 that is the copy destination. Software for copying to. The disk image duplication software 106 may be installed in another information processing apparatus on the network or an external storage device and executed via the network. Also, the user terminal 101 is provided with a computer-readable recording medium such as a CD-ROM or DVD-ROM in which the disk image duplicating software 106 is stored, and the disc image duplicating software is read by the user terminal 101 by reading from the recording medium. 106 may be executed.

  As shown in FIG. 1, by executing the disk image duplication software 106, the disc image on the hard disk 123 of the user terminal 101 is duplicated on the hard disk 123 of the user terminal 102 that is the duplication destination. As a result, in the hard disk 123 of the user terminal 102, an environment in which the operating system 107, the application 108, the hard disk encryption program 109, and the data 110 are incorporated is constructed.

  FIG. 2 is a diagram for explaining the configuration and processing of the hard disk encryption program. The environment builder uses the hard disk encryption program installer 105 to install the hard disk encryption program 109 on the user terminal 101 that is the copy source.

  As a feature of the present embodiment, the hard disk encryption program 109 includes an encryption processing unit 201, a decryption processing unit 202, a setting processing unit 203, and a restriction processing unit 204. The encryption processing unit 201 encrypts data stored in the hard disk 123 of the information processing apparatus in which the hard disk encryption program 109 is installed. Specifically, the encryption processing unit 201 first creates an encryption key by random number generation, and then encrypts data on the hard disk 123 using the created encryption key. Further, the decryption processing unit 202 automatically decrypts the encrypted data when the encrypted data is read from the hard disk 123.

  The setting processing unit 203 performs setting so that the encryption processing unit 201 of the hard disk encryption program 109 is executed when the information processing apparatus in which the hard disk encryption program 109 is installed is started next time. The setting processing unit 203 sets, for example, in the registry of the operating system 107 so that the encryption processing unit 201 is executed when the information processing apparatus is started next time. With this setting, the encryption processing of the encryption processing unit 201 is not executed immediately after installation (or copying).

  The setting method may be any setting as long as the encryption processing unit 201 is executed when the information processing apparatus is started next time, and may be registered in the startup of the operating system 107. Good. Further, the setting processing means 203 may be set so that the encryption processing means 201 is executed before the login of the operating system 107 at the next startup, or the encryption processing after the login of the operating system 107 at the next startup. You may set so that the means 201 may be performed.

  The setting processing unit 203 has a function of automatically executing the above setting. For example, the setting processing unit 203 is automatically executed when the hard disk encryption program 109 is installed in the user terminal 101 as shown in FIG. Further, the setting processing unit 203 has a function of automatically executing the above setting when copying a disk image, other than copying by an installer, for example, in the copy destination user terminal 102. This is automatically executed immediately after the disk image is copied from the user terminal 101.

The restriction processing unit 204 monitors the copy process by the disk image copy software 106 and restricts the user terminal 101 from being restarted until the copy process to the copy destination user terminal 102 is completed. For example, if the user terminal 101 is restarted before the copying process by the disk image copying software 106 is completed, an encryption key is created before the disk image is copied. As a result, the same encryption key as that of the copy destination user terminal 102 is obtained, and the security strength is reduced. Therefore, processing is performed so as not to restart the user terminal 101. For example, when the copying process by the disk image copying software 106 is being executed, there are methods such as displaying a warning message on the output device so as not to execute the restart, or limiting the operation by the input device.
The monitoring process for the disk image duplication software 106 may be performed by monitoring access to the user terminal 101 from the disk image duplication software 106 when the disk image duplication software 106 is executed via a network, for example. When the disk image duplication software 106 is executed on the user terminal 101 by reading a computer-readable recording medium, the process of the disc image duplication software 106 on the user terminal 101 may be monitored.

  FIG. 2 also shows a flow when the environment builder copies the disk image of the user terminal 101 to the other user terminal 102 and restarts after the environment of the other user terminal 102 is constructed. When the user using the user terminal 101 restarts the user terminal 101 after constructing the environment of the other user terminal 102, the hard disk encryption program 109 is automatically started according to the setting of the operating system 107.

  The encryption processing unit 201 of the hard disk encryption program 109 first creates an encryption key 205 by random number generation, and then encrypts the data 206 of the hard disk 123 of the user terminal 101 using the created encryption key 205. In the other user terminal 102, when the user using the user terminal 102 activates the user terminal 102, an encryption key is created by random number generation as described above. Different encryption keys are used for the terminal 102.

  FIG. 3 is a flowchart showing the processing of the hard disk encryption program 109. First, in step 301, the hard disk encryption program 109 is copied to the hard disks 123 of the user terminals 101 and 102 by the copying process of the hard disk encryption program installer 105 or the disk image copying software 106.

Next, in step 302, the setting processing unit 203 of the hard disk encryption program 109 is automatically set when the encryption processing unit 201 of the hard disk encryption program 109 copied in step 301 is activated next time for the user terminals 101 and 102. Settings are made to the operating system 107 so as to start up.
As described above, the user terminal 101, 102 is set to automatically start the encryption processing unit 201 of the hard disk encryption program 109 when the user terminal 101, 102 is started next time.

  FIG. 4 is a flowchart showing processing of the hard disk encryption program when the copy source user terminal 101 and the copy destination user terminal 102 are activated again. This process is executed for each copy source user terminal 101 in which the hard disk encryption program 109 is installed and each copy destination user terminal 102 in which the hard disk encryption program 109 is copied.

  First, in step 401, the encryption processing means 201 of the hard disk encryption program 109 generates a random number and creates an encryption key based on the generated random number. Since each user terminal 101 and 102 creates an encryption key by generating a random number, each user terminal 101 and 102 has a different encryption key. Next, in step 402, the data on the hard disk 123 of the user terminals 101 and 102 is encrypted using the encryption key created in step 401. Since each user terminal 101, 102 is encrypted with a different encryption key, the security strength is maintained.

  FIG. 5 is a flowchart showing an environment construction procedure of a large number of user terminals to which the hard disk encryption program is applied by the environment builder.

  In step 501, the environment builder first installs the operating system 107 and the application 108 in the user terminal 101 that is the copy source. Next, in step 502, the environment builder installs the hard disk encryption program 109 in the user terminal 101. At this time, after the hard disk encryption program 109 is copied to the user terminal 101, the process of step 302 in FIG. 3 is executed.

  Next, in step 503, the disk image of the copy source user terminal 101 is copied to the copy destination user terminal 102 using the disk image copy software 106. At this time, after the hard disk encryption program 109 is copied to the user terminal 102, the process of step 302 in FIG. 3 is executed. At this time, since the user terminal 101 has not been restarted, the processing in FIG. 4 has not been executed, and therefore an encryption key has not yet been created.

  If the user terminal 101 is restarted before step 503, the processing in FIG. 4 is executed, and an encryption key is created before copying the disk image. As a result, the copy source user terminal 101 and the copy destination user terminal 102 have the same encryption key, and the security strength is reduced. Therefore, restart may be prevented by the restriction processing unit 204 described above.

  FIG. 6 is a flowchart showing the flow of processing when the user of each user terminal activates his / her own terminal after the environment is constructed.

  In step 601, first, the user [X] activates the user terminal [X]. Here, X is 1 to N and means the user terminal 101 or the user terminal 102. Next, in step 602, since the user terminal [X] is activated for the first time after the hard disk encryption program 109 is installed, the encryption processing means 201 of the hard disk encryption program 109 is automatically activated.

  In step 603, the encryption processing means 201 of the activated hard disk encryption program 109 executes the processing of FIG. The encryption processing unit 201 creates an encryption key by random number generation, and then encrypts data on the hard disk 123 with the generated encryption key. By separately generating an encryption key using a random number in each user terminal [X], it is possible to set different encryption keys in each user terminal [X].

FIG. 7 is an explanatory diagram showing a flow of operation of the entire system described with reference to FIGS.
First, the environment builder installs the hard disk encryption program 109 using the hard disk encryption program installer 105 in the user terminal 101 that is the disk image copy source. At this point, the hard disk 701 of the user terminal 101 is in an unencrypted state (not encrypted). Next, the environment builder uses the disk image duplication software 106 to duplicate the disk image of the user terminal 101 to the duplication destination user terminal 102 and complete the environment construction. At this point, the hard disk 702 of the user terminal 102 is in an unencrypted state.

  Next, the user of each user terminal 101, 102 activates each user terminal 101, 102. When the user terminals 101 and 102 are activated, the user terminal 101 generates an encryption key [1] 703 by random number generation, encrypts the data in the hard disk 701 with the encryption key [1] 703, and as a result, is encrypted. The hard disk 705 stores data. In another user terminal 102, the encryption key [2-N] 704 is created by random number generation, and the data in the hard disk 702 is encrypted with the encryption key [2-N] 704. As a result, the encrypted data is encrypted. Is stored in the hard disk 706.

  As described above, in the present embodiment, the encryption keys of the user terminal 101 that is the copy source are copied to the user terminal 102 that is the copy destination and the same encryption key is used. Since the encryption keys 703 and 704 to be encrypted are created with random numbers after the disk image is copied, they are different encryption keys in the user terminals 101 and 102. Therefore, security strength is maintained.

  As described above, according to the first embodiment, when the hard disk encryption program 109 is copied to the user terminals 101 and 102, the encryption processing unit 201 creates the encryption key and encrypts the hard disk 123. First, the encryption processing means 201 is set in the operating system 107 so that it is automatically executed when the user terminals 101 and 102 are activated next time. Then, at the next activation of the user terminals 101 and 102, the encryption processing unit 201 is automatically activated to generate an encryption key using a random number and encrypt the hard disk 123. As a result, the environment builder installs the hard disk encryption program 109 in one user terminal 101 that is the copy source, and then restarts the user terminal 101 with the disk image duplication software 106 before the user terminal 101 is restarted. It is possible to construct an environment with high security strength having different encryption keys only by performing processing for copying 123 disk images to other user terminals 102.

  Accordingly, in an environment construction system that replicates the environment of the copy source user terminal 101 to at least one copy destination user terminal 102, the disk image copy software 106 may copy the disk image after the hard disk encryption program 109 is installed. The user terminals 101 and 102 can have different encryption keys. Therefore, the environment of many user terminals 101 and 102 to which the hard disk encryption program 109 is applied can be efficiently constructed using the disk image duplication software 106 without reducing the security strength.

Second Embodiment
FIG. 8 is a diagram for explaining a hard disk encryption system according to the second embodiment. In FIG. 8, only the parts different from the configuration described in FIGS. Therefore, the configuration other than that shown in FIG. 8 is the same as the configuration described in FIGS.

  In a hard disk encryption system in an environment construction system that replicates the environment of a user terminal 101 that is a replication source to at least one user terminal 102 that is a replication destination, the user terminal 101 includes a master data creation unit 801 and a transmission unit 802. In addition.

  The master data creation unit 801 copies the disk image stored in the hard disk 123 of the user terminal 101 as a master data 803 to a computer-readable recording medium or a storage device on a network. As described above, the computer-readable recording medium is a CD-ROM, a DVD-ROM, or the like. The master data 803 duplication process by the master data creation unit 801 is set to be executed before the user terminal 101 is restarted, for example, during the duplication process to the duplication destination user terminal 102.

  The transmission unit 802 transmits or distributes master data 803 copied to a computer-readable recording medium or a storage device on a network to the user terminal 102 that is a copy destination.

  As described above, according to the second embodiment, since the master data creation unit 801 and the transmission unit 802 are provided, for example, after the environment is once constructed, it is useful when the user terminal 102 that needs to be copied newly appears. It is. Once the environment is constructed, the user terminal 101 is restarted, and the hard disk 123 of the user terminal 101 is in an encrypted state. Therefore, the disk image of the hard disk 123 of the user terminal 101 cannot be used as it is. When a new user terminal 102 that needs to be copied appears, an unencrypted disk image is required, but since unencrypted master data 803 has been created, a new encryption is required. There is no need to prepare a user terminal that has not been made into a state. By transmitting or distributing the master data 803 to the user terminal 102 that newly needs to be copied by the transmission unit 802, it becomes possible to deal with the user terminal 102 that needs to be newly copied.

  It is also useful when the user terminals 101 and 102 are restarted after copying to the copy destination user terminal 102 and the encryption processing by the encryption processing means 201 is not successful. In this case, for example, it is necessary to analyze an error or the like and copy a disk image suitable for the environment of the user terminal 102 again. Since a disk image suitable for the environment of the user terminal 102 can be created based on the unencrypted master data 803, it is possible to easily recreate the disk image after error processing.

<Modification>
The present invention is not limited to the embodiments described above, and includes various modifications. For example, the setting processing unit 203 may perform setting so that the encryption processing unit 201 is executed after the login of the operating system 107 at the next startup. In this case, the hard disk encryption program 109 may further include means for preventing access to data in the hard disk 123 until the encryption processing of the encryption processing means 201 is completed. As a result, it is possible to prevent unencrypted data from being taken out before the end of the encryption process.

  The above-described embodiment has been described in detail for easy understanding of the present invention, and is not necessarily limited to the one having all the configurations described. In addition, it is possible to add, delete, and replace other configurations for a part of the configuration of each embodiment. For example, the hard disk encryption program 109 is at least the setting processing unit 203 in terms of improving the efficiency in constructing the environment of a plurality of user terminals while maintaining the data security strength in each of the user terminals 101 and 102. Should be provided. The configuration including all the embodiments described above is a more preferable embodiment of the present invention, and it is possible to delete the part of the configuration described as the embodiment and configure the present invention.

  Also, those skilled in the art will appreciate that there are numerous combinations of hardware, software, and firmware that are suitable for practicing the present invention. For example, the program code for realizing the functions described in the present embodiment can be implemented by a wide range of programs or script languages such as assembler, C / C ++, perl, Shell, PHP, Java (registered trademark).

101: (Replication source) User terminal 102: (Replication destination) User terminal 103: Operating system installer 104: Application installer 105: Hard disk encryption program installer 106: Disk image duplication software (duplication means)
107: Operating system 108: Application 109: Hard disk encryption program (encryption means)
110: Data 121: Central processing unit 122: Memory 123: Hard disk 201: Encryption processing means 202: Decoding processing means 203: Setting processing means 204: Restriction processing means 801: Master data creation means 802: Transmission means 803: Master data

Claims (6)

An encryption program for encrypting data stored in a storage device of an information processing device,
In the information processing apparatus,
An encryption process for encrypting data stored in the storage device;
A setting process for setting the information processing apparatus so that the encryption process is executed when the information processing apparatus is activated next time;
An encryption program for executing The encryption program according to claim 1,
Restriction processing for monitoring replication processing for copying data stored in the storage device of the information processing device to another information processing device, and limiting the information processing device from being restarted until the replication processing is completed Is further executed. An encryption system in an environment construction system that replicates the environment of a first information processing apparatus to at least one second information processing apparatus,
Encryption means installed in the first information processing apparatus;
Replication means for replicating data stored in the storage device of the first information processing device to the at least one second information processing device;
With
The encryption means is
An encryption processing means for encrypting data stored in the storage device of the information processing apparatus in which the encryption means is installed;
Setting processing means for setting the information processing apparatus so that the encryption processing means is executed when the information processing apparatus in which the encryption means is installed is activated next time;
An encryption system comprising: The encryption system of claim 3,
An encryption system, further comprising: master data creating means for copying data stored in the storage device of the first information processing apparatus to a computer-readable recording medium or a storage device on a network as master data . The encryption system of claim 4,
An encryption system, further comprising: transmission means for transmitting the master data copied to the computer-readable recording medium or a storage device on a network to the second information processing apparatus. The encryption system according to any one of claims 3 to 5,
The encryption unit further includes a limiting unit that monitors a replication process by the replication unit and restricts the first information processing apparatus from being restarted until the replication process is completed. System.

Images