Information processing device, information processing procedure and information processing program

Abstract

Information processing device (100) that verifies software, comprising: a validity verification unit (101) for verifying the validity of startup software by comparing verification object data, which are verification data calculated on the basis of data stored at a memory location specified in startup record data (102) which specifies the memory location where the startup software executed at startup of the information processing device (100) is to be stored, and which are verification data calculated at startup of the information processing device (100), with comparison data (104), which are verification data calculated before startup of the information processing device (100) on the basis of the startup software, and which are verification data used as a comparison object of the verification object data; a startup completion notification unit (105) for determining that software whose execution is to be started last of parts of the startup software has been executed; and a startup record acquisition unit (106) for acquiring memory location data indicating the memory location of each software that is started from the start of the information processing device (100) until it is determined that the software whose execution is to be started last among the parts of the startup software has been executed, and for updating the startup record data (102) using the acquired memory location data.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to an information processing apparatus, an information processing method, and an information processing program. BACKGROUND TO THE STATE OF THE ART

[0002] Patent Literature 1 discloses a technique for verifying the validity of software upon startup of an information processing device. In this technique, a region to be checked is first determined in advance, a hash value or the like is calculated in the region to be checked, and the calculated hash value or the like is stored as a comparison item. Then, upon startup of the information processing device, a hash value or the like is recalculated in the region to be checked, and the recalculated hash value or the like is compared with the hash value or the like stored as the comparison item. If they match, it is determined that the description in the region to be checked has not been changed.

[0003] Patent Literature 2 discloses a technique that enables the startup time to be reduced when multiple programs are started on multiple devices, wherein a composite device stores an authentication program and an initialization program in a non-volatile memory, has a Trusted Platform Module authenticate the validity of the authentication program executed by a sub-CPU during startup, has a sub-CPU perform authentication processing of the initialization program executed by a main CPU using the authentication program, and, when the validity is authenticated, has the main CPU execute the initialization program and have the sub-CPU perform authentication processing of a program executed by the sub-CPU using the authentication program during the time when the validity is authenticated, and has the program start.when the validity is authenticated, and let the main CPU perform authentication processing of the program executed by the main CPU when the initialization of the main CPU is completed.

[0004] Patent Literature 3 discloses a software distribution processing apparatus that stores a verification key of an electronic signature of update data on software and a common key of an ECU, verifies an electronic signature of update data received from a management server apparatus using the verification key, calculates a message authentication code of update data whose electronic signature has been successfully verified, and transmits the update data whose electronic signature has been successfully verified, and the message authentication code calculated with respect to the update data to the ECU.

[0005] Patent Literature 4 discloses a software checking device that activates activation software to be activated, the software checking device specifically comprising: a security calculation unit that includes a storage unit and, when an "expected value" hash, which is an expected value of a hash value of the activation software, is stored in the storage unit, for comparing the hash value of the activation software with the "expected value" hash;and a main processing unit for activating the activation software if the hash value and the hash "expected value" match, and for stopping a process if both do not match, and wherein the main processing unit performs a signature check for the activation software if the hash "expected value" is not stored in the storage unit, stores the hash value of the activation software in the storage unit as the hash "expected value", and activates the activation software if the signature check is successful, and stops a process if the signature check is unsuccessful.;

[0006] Patent Literature 5 discloses a method for updating an integrity check value stored in a hardware security module, the method comprising: storing user authentication information of the terminal transmitted from the terminal to pre-register a user of the terminal; transmitting an authentication information request message requesting the user authentication information to the terminal in response to an update request message transmitted from the terminal and including an update value of the integrity check value; comparing the user authentication information transmitted from the terminal with the stored user authentication information to perform an authentication operation for the user of the terminal according to the authentication information request message;and if the terminal user has been successfully authenticated, updating the stored integrity check value using the update value.; REFERENCE LISTPATENT LITERATURE Patent literature 1: JP 2013 - 084 078 A Patent literature 2: JP 2014 - 021 953 A Patent literature 3: JP 2017 - 208 859 A Patent literature 4: DE 11 2018 007 934 T5 Patent literature 5: US 9,904,806 B2 SUMMARY OF THE INVENTIONTECHNICAL PROBLEM

[0007] According to the technique disclosed in Patent Literature 1, the validity of all software in the information processing device is verified when the information processing device starts up. Therefore, the problem is that it takes time to verify the validity. Since the information processing device often has a startup time constraint, the startup time constraint cannot be met if the validity verification takes time.

[0008] The present disclosure aims to reduce the time required to verify the validity of software by treating only software that is executing at the time of startup as the subject of validity verification. SOLUTION TO THE PROBLEM

[0009] An information processing apparatus according to the present disclosure that verifies software comprises a validity verification unit for verifying the validity of startup software by comparing verification object data, which is data for verification calculated based on data stored in a storage location indicated in startup record data indicating the storage location where the startup software executed at the startup of the information processing device is to be stored, and which is data for verification calculated at the startup of the information processing device, with comparison data, which is data for verification calculated before the startup of the information processing device based on the startup software, and which is data for verification used as a comparison object of the verification object data. ADVANTAGEOUS EFFECTS OF THE INVENTION

[0010] According to the present disclosure, only software stored in a storage location specified in the boot record data is treated as a subject of validity verification. Therefore, according to the present disclosure, the time required for software validity verification can be reduced by treating only the software executed at boot as a subject of validity verification. BRIEF DESCRIPTION OF THE DRAWINGS Fig. 1 is a diagram showing a configuration example of an information processing apparatus 100 according to Embodiment 1. Fig. 2 is a diagram showing a specific example of start recording data 102 according to Embodiment 1. Fig. 3 is a diagram showing a specific example of comparison data 104 according to Embodiment 1. Fig. 4 is a diagram showing an example of the hardware configuration of the information processing apparatus 100 according to Embodiment 1. Fig. 5 is a flowchart showing the operation of the information processing apparatus 100 according to Embodiment 1. Fig. 6 is a diagram showing an example of the hardware configuration of the information processing apparatus 100 according to a modification of Embodiment 1. Fig. 7 is a diagram showing a configuration example of the information processing apparatus 100 according to Embodiment 2. Fig. 8 is a flowchart showing the operation of a startup completion notification unit 105 according to Embodiment 2. Fig. 9 is a flowchart showing the operation of a start record acquisition unit 106 according to Embodiment 2. Fig. 10 is a diagram showing a configuration example of the information processing apparatus 100 according to Embodiment 3. Fig. 11 is a flowchart showing the operation of the information processing apparatus 100 according to Embodiment 3. DESCRIPTION OF THE EMBODIMENTS

[0011] In the description and drawings of the embodiments, the same elements and corresponding elements are designated by the same reference numerals. The description of elements designated by the same reference numerals is omitted or simplified where appropriate. Arrows in the drawings primarily indicate the flow of data or the flow of processing. Furthermore, "unit" can also be interpreted as "circuit," "step," "method," "process," or "circuitry." Embodiment 1.

[0012] The present embodiment will be described in detail below with reference to the drawings. *** Description of the configuration ***

[0013] Fig. 1 shows a configuration example of an information processing apparatus 100 according to Embodiment 1. As shown in Fig. 1, the information processing apparatus 100 includes a validity verification unit 101 and a software memory 103, and records start recording data 102 and comparison data 104. (Validity Verification Unit 101)

[0014] The validity verification unit 101 verifies the validity of each startup software by comparing verification subject data with the comparison data 104. The startup software is software that is executed when the information processing device 100 starts up. The number of pieces of startup software may be plural. The verification subject data is verification data calculated based on data stored in a storage location specified in the startup record data 102 and verification data calculated when the information processing device 100 starts up.

[0015] The operations performed by the validity verification unit 101 at the startup of the information processing device 100 will be described. First, the validity verification unit 101 reads the startup record data 102 to decide the software to be verified. Next, the validity verification unit 101 determines an address range of the software memory 103 subject to verification based on a start address and a software size recorded in the read startup record data 102, and calculates data for verification in each address range of the determined software memory 103. The start address is a leading address of an area where each startup software is stored. The software size is a data size of the software.Verification data is data for verifying the validity of software, such as a hash or a message authentication code (MAC) in an area where software is stored. Thus, verification data is data indicating a hash value or MAC of the software that corresponds to the verification data. Furthermore, the verification data calculated here is also referred to as verification object data. The validity verification unit 101 then determines whether the calculated verification data matches the comparison data stored for each piece of software in the comparison data 104.When all the calculated verification data agree with the comparison data stored in the comparison data 104 and corresponding to each verification data, the validity verification unit 101 considers that the verification of the validity of the startup software is completed. (Start recording data 102)

[0016] Fig. 2 shows a concrete example of the start recording data 102. As in Fig. As shown in Figure 2, the startup record data 102 is data indicating a memory location where the startup software is to be stored, and data recording the startup address and software size of the software executed when the information processing device 100 starts up. The startup record data 102 is stored in the information processing device 100 in advance upon delivery of the information processing device 100 from the factory or the like. When software is stored in a storage area whose address is not consecutive, the startup record data 102 records the startup address and software size of each fragment of the split software. (Software Memory 103)

[0017] The software memory 103 is a memory that stores each software executed by the information processing device 100. Each software stored in the software memory 103 is divided into two types: software that is executed when the information processing device 100 starts up and software that is not executed when the information processing device 100 starts up. (Comparison data 104)

[0018] The comparison data 104 is data for verification calculated in advance before the startup of the information processing device 100, and indicates the verification data that must be included in each startup software. Furthermore, the comparison data 104 is data for verification used when verifying the validity of software as a comparison object against the verification object data. All data included in the comparison data 104 is data for comparison. The comparison data 104 is stored in advance in the information processing device 100 upon delivery of the information processing device 100 at the factory or the like. The comparison data 104 and the verification object data may be data corresponding to software that is not running when the information processing device 100 starts up.

[0019] Fig. 3 shows a concrete example of the comparison data 104. As in Fig. As shown in Figure 3, the comparison data 104 includes information about the verification data, as well as the starting address and software size of the startup software corresponding to the verification data. The starting address and software size are information indicating an area where each startup software is stored.

[0020] Fig. 4 shows an example of a hardware configuration example for the information processing apparatus 100. As in Fig. As shown in Figure 4, the information processing device 100 is configured with a computer including a hardware security module (HSM) 10, a storage device 20, a main CPU (central processing unit) 30, and a RAM 40. The information processing device 100 may be configured with a plurality of computers. (Description of HSM 10)

[0021] The HSM 10 is a module housing circuitry for security processing. As a specific example, the HSM 10 is a module that has the function of executing cryptographic calculations using a cryptographic computing engine 12 through a secure CPU 11 and the function of providing a tamper-proof storage area through a secure memory 13. (Secure CPU 11)

[0022] The secure CPU 11 is a CPU that performs the processing of the HSM 10. The secure CPU 11 performs processing, or the like, where the processing corresponds to a computation command to the cryptographic computing engine 12, a command to the secure memory 13 for storing data, and a command request to the HSM 10 from the main CPU 30 outside the HSM 10. Furthermore, the validity verification unit 101 operates in the secure CPU 11. (Cryptographic Computing Machine 12)

[0023] The cryptographic computing engine 12 is a circuit that performs the cryptographic processing within the HSM 10 at high speed. (Secure Storage 13)

[0024] Secure storage 13 is a tamper-proof storage for storing data that is to be protected from tampering. Specific examples of data stored in secure storage 13 are described below. A secret key here is an encryption key used in calculating the MAC specified in the comparison data 104.

[0025] A program that functionally implements the validity verification unit 101

[0026] The start recording data 102

[0027] The comparison data 104

[0028] The secret key (Storage device 20)

[0029] The storage device 20 plays the role of the software memory 103 and is, as a specific example, a memory such as a flash memory. (Main CPU 30)

[0030] The main CPU 30 is an arithmetic circuit that handles the processing of the information processing device 100 and performs the processing of the software stored in the software memory 103. (RAM 40)

[0031] The RAM 40 is a volatile memory that temporarily records data at the time of execution of software by the main CPU 30 and the like.

[0032] Each program described in this specification may be stored on a computer-readable, non-volatile recording medium. The non-volatile recording medium is, as a specific example, an optical disk or a flash memory. Each program described in this specification may be provided as a program product. *** Description of a function ***

[0033] An operating method of the information processing device 100 corresponds to an information processing method. Furthermore, a program that implements the operation of the information processing device 100 is synonymous with an information processing program.

[0034] Fig. 5 is a flowchart showing an example of the processing at the start of the information processing device 100 according to Embodiment 1. The processing at the start of the information processing device 100 will be described with reference to Fig. 5 described. (Step S101)

[0035] When a power source of the information processing apparatus 100 is turned on by a user of the information processing apparatus 100, the validity verification unit 101 starts executing processing.

[0036] The validity verification unit 101 determines an address range of the software memory 103 subject to verification based on the start address and the software size specified in the start record data 102, and calculates data for verification using data stored in the determined address range of the software memory 103. (Step S102)

[0037] The validity verification unit 101 compares the verification data calculated in step S101 with the comparison data 104.

[0038] If at least part of the verification data does not match the data specified in the comparison data 104 in the calculated verification data, the validity verification unit 101 proceeds to step S104. Otherwise, the validity verification unit 101 proceeds to step S103. (Step S103)

[0039] The validity verification unit 101 causes the main CPU 30 to start the execution of each startup software stored in the software memory 103.

[0040] After completing this step, the validity verification unit 101 proceeds to step S105. (Step S104)

[0041] The validity verification unit 101 performs a countermeasure. As a specific example, consider the countermeasure that causes the information processing device 100 to not execute software corresponding to verification data that does not match the data specified in the comparison data 104, but to execute only software corresponding to verification data that does match the data specified in the comparison data 104. (Step S105)

[0042] The validity verification unit 101 verifies the validity of the software not executed when the information processing apparatus 100 starts up. *** Description of the effects of Embodiment 1 ***

[0043] Through the above operation, the information processing apparatus 100 according to Embodiment 1 checks only the software that is running at the start of the information processing apparatus 100, instead of all the software in the information processing apparatus 100, when the information processing apparatus 100 starts up. Therefore, according to the information processing apparatus 100 according to Embodiment 1, the number of software whose validity is checked can be reduced. This can reduce the amount of software that is checked for validity. Generally, the time required for validity verification is proportional to the amount of software. Therefore, the time required for validity verification can be reduced by reducing the amount of software used to check validity.

[0044] Furthermore, all software subject to verification is verified by calculating a hash value and the like in an area where the software to be verified is stored. Therefore, even if only a portion of the software is located in a tampered area, tampering with the software to be verified can be detected.

[0045] Furthermore, the information processing device 100 according to the present embodiment is suitable for use in a vehicle control device, as a specific example. A device used as a vehicle control device has a startup time restriction. When the amount of software in the vehicle control device is large, there is a risk that the startup time restriction will not be met if validity verification is performed for all software in the vehicle control device upon startup of the vehicle control device.

[0046] However, when the information processing apparatus 100 according to Embodiment 1 is used as a vehicle control device, the risk of violation of the limitation on the start time is reduced. *** Other configurations ***<Modifikation 1>

[0047] Fig. 6 shows an example of the hardware configuration of the information processing apparatus 100 according to the present modification.

[0048] The information processing apparatus 100 includes a processing circuit 50 instead of the main CPU 30, the main CPU 30 and the RAM 40, the main CPU 30 and the storage device 20, or the main CPU 30, the RAM 40 and the storage device 20.

[0049] Processing circuit 50 is hardware that implements at least a portion of each unit included in information processing device 100. Processing circuit 50 can perform the function of HSM 10.

[0050] The processing circuit 50 may be dedicated hardware or a processor that executes the programs stored in the RAM 40.

[0051] When the processing circuit 50 is dedicated hardware, a specific example of the processing circuit 50 is a single circuit, a composite circuit, a programmed processor, a parallel-programmed processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a combination thereof.

[0052] The information processing device 100 may include a plurality of processing circuits as an alternative to the processing circuit 50. The plurality of processing circuits share the role of the processing circuit 50.

[0053] In the information processing device 100, some functions may be implemented by special hardware and the remaining functions by software or firmware.

[0054] In a specific example, the processing circuit 50 is implemented by hardware, software, firmware, or a combination thereof.

[0055] The main CPU 30, the RAM 40, the storage device 20, and the processing circuit 50 are collectively referred to as "processing circuits." That is, the functions of the individual functional components of the information processing device 100 are realized by the processing circuits.

[0056] The information processing apparatus 100 according to other embodiments may also have the same configuration as that of the present modification. Embodiment 2.

[0057] The differences from the embodiment described above will be described below mainly with reference to the drawings. *** Description of the configuration ***

[0058] In Embodiment 1, it is assumed that the startup record data 102 is stored in advance in the information processing device 100 upon delivery of the information processing device 100 from the factory or the like. However, if the configuration of the startup software changes, for example, due to the installation or update of the startup software after delivery from the factory or the like, the installed or updated startup software also starts executing upon startup of the information processing device 100, but the pre-stored startup record data 102 may not be consistent with the installed or updated startup software. Software related to a configuration change in the startup software after delivery from the factory or the like, such asBoot software installed after delivery from the factory or the like, or boot software updated after delivery from the factory or the like, is collectively referred to as modified boot software.

[0059] Then, the information processing apparatus 100 according to Embodiment 2 responds to the changed startup software by acquiring the startup record data 102 at the startup of the information processing apparatus 100.

[0060] When the configuration of the boot software is changed, it is necessary to calculate verification data for the changed boot software and update the comparison data 104 based on the calculated verification data. Regarding the update of the comparison data 104, the information processing device 100 may calculate the verification data when the changed boot software is installed, updated, or the like, and add the calculated verification data to the comparison data 104. Alternatively, the verification data for the changed boot software is added in advance, and the information processing device 100 may add the added verification data to the comparison data 104 when the changed boot software is installed, updated, or the like. [Description of additional configuration components in Embodiment 2]

[0061] Fig. 7 shows a configuration example of the information processing apparatus 100 according to Embodiment 2. The functions added in Embodiment 2 will be mainly described below. (Start completion notification unit 105)

[0062] A launch completion notification unit 105 is executed after the completion of the verification of the validity of the launch software. When the launch completion notification unit 105 determines that the launch software whose execution is to be launched last among the pieces of each launch software has been executed, the launch completion notification unit 105 transmits a launch completion notification to a launch record acquisition unit 106, indicating that the launch of the launch software is complete. (Start record acquisition unit 106)

[0063] The startup record acquisition unit 106 is executed after the completion of the validity verification of the startup software. The startup record acquisition unit 106 records the startup address and software size of the software whose execution began immediately after the completion of the validity verification of the startup software by the validity verification unit 101, until the startup record acquisition unit 106 receives a startup completion notification from the startup completion notification unit 105. That is, the startup record acquisition unit 106 acquires memory location data indicating a memory location for each software launched from the startup of the information processing device 100 until it is determined that the software whose execution is to be started last among the startup software has been executed.

[0064] When the boot completion notification unit 105 notifies the boot record acquisition unit 106 of the completion of the boot, the boot record acquisition unit 106 stops recording the boot software. Thereafter, the boot record acquisition unit 106 updates the current boot record data 102 using the storage space data that is a record of the currently acquired boot software. [Hardware configuration example]

[0065] A program that functionally implements the start completion notification unit 105 and the start record acquisition unit 106 is stored in the storage device 20 and is executed by the main CPU 30 in the manner shown in Fig. 4 shown hardware configuration as a specific example. *** Description of a function ***

[0066] Fig. 8 is a flowchart showing an example of processing of the start completion notification unit 105 according to Embodiment 2. Fig. 9 is a flowchart showing an example of the start record acquisition unit 106 according to Embodiment 2. Referring to Fig. 8 and Fig. 9, the processing of the start completion notification unit 105 and the processing of the start record acquisition unit 106 will be described.

[0067] The start completion notification unit 105 and the start record acquisition unit 106 basically operate in parallel. [Operation of the start completion notification unit 105] (Step S201)

[0068] Step S201 starts in a state where the validity verification is completed, that is, in a state after step S103 in Embodiment 1. The main CPU 30 starts the start completion notification unit 105. (Step S202)

[0069] The startup completion notification unit 105 determines whether or not the startup software whose execution has been started by the main CPU 30 is the startup software whose execution should be started last among the pieces of each startup software.

[0070] If the startup software whose execution has been started is the startup software whose execution should be started last, the startup completion notification unit 105 proceeds to step S203. Otherwise, the startup completion notification unit 105 repeats the processing from step S202 until the execution of the startup software whose execution should be started last is started. (Step S203)

[0071] The launch completion notification unit 105 transmits the launch completion notification to the launch record acquisition unit 106. [Operation of the start record acquisition unit 106] (Step S301)

[0072] Step S301 starts in a state where the verification of validity is completed, that is, in a state after step S103 in Embodiment 1. The main CPU 30 puts the start record acquisition unit 106 into operation. (Step S302)

[0073] The startup record acquisition unit 106 records the startup address and software size of each startup software whose execution is to be started by the main CPU 30 when the information processing apparatus 100 starts up. (Step S303)

[0074] The start record acquisition unit 106 checks whether the start completion notification has been received from the start completion notification unit 105 or not.

[0075] If the boot completion notification is received, the boot record acquisition unit 106 proceeds to step S304. Otherwise, the boot record acquisition unit 106 returns to step S302 and continues to record the boot address and software size of the boot software. (Step S304)

[0076] The startup record acquisition unit 106 finishes recording the startup address and software size of each startup software. (Step S305)

[0077] The boot record acquisition unit 106 updates the boot record data 102 using the start address and the software size of each boot software that has been re-encoded until step S304. *** Description of the effects of embodiment 2 ***

[0078] In such a case where new software is installed as startup software or where software stored in the software storage 103 is updated, the information processing apparatus 100 according to Embodiment 2 is capable of dynamically deciding the software to be verified by recording the start address and software size of the software whose execution is to be started when the information processing apparatus 100 starts.

[0079] The information processing device 100 according to the present embodiment is suitable for use in, for example, a vehicle control device. In a device used as a vehicle control device, a technique is adopted that allows a user to perform software installation or software update in the vehicle control device via the Internet. When this technique is applied to the vehicle control device, a developer of the vehicle control device is not allowed to manage the configuration of the software in the vehicle control device. Accordingly, in the conventional validation method in which a verification object and a verification order are statically determined, if the user installs software that is not recognized by the developer, the software installed by the user cannot be considered as the subject of validity.

[0080] In the information processing device 100 according to Embodiment 2, the startup record acquisition unit 106 records startup software. Accordingly, any software installed by the user is also subject to validity verification when executed upon startup of the information processing device 100. Embodiment 3.

[0081] The differences from the embodiment described above will be described below mainly with reference to the drawings. *** Description of the configuration ***

[0082] According to Embodiments 1 and 2, when a configuration change is performed in the software while the information processing device 100 is operating, the information processing device 100 does not record the software whose configuration has been changed in the startup record data 102. In this case, the configuration change of the software means that the configuration of the software stored in the information processing device is changed, for example, by installing new software in the information processing device 100 or by updating the software stored in the information processing device 100. Accordingly, the software in which the configuration change has been implemented is not subject to validity verification at the next startup of the information processing device 100.However, new software or updated software in which the configuration change has been implemented may also be the modified startup software. Therefore, if the modified startup software, which is software in which the configuration change has been implemented, is tampered with and the information processing device 100 starts, while the tampered modified startup software is excluded from the validity verification at the startup of the information processing device 100, the information processing device 100 operates without verifying the validity of the tampered modified startup software.

[0083] In order to prevent a situation as above when the configuration change is executed in the software while the information processing apparatus 100 is in operation, the information processing apparatus 100 according to Embodiment 3 has a function to perform the verification of the validity of the software in which the configuration change has been implemented at the startup of the information processing apparatus 100. [Description of the additional configuration components in Embodiment 3]

[0084] Fig. 10 shows an example of the configuration of the information processing apparatus 100 according to the present embodiment. Fig. 10 illustrates a configuration in which a software management unit 107 is added to the information processing device 100 according to Embodiment 2. However, the configuration of the information processing device 100 may be a configuration in which the software management unit 107 is added to the information processing device 100 according to Embodiment 1. In addition to the function of calculating the data for verification, the validity verification unit 101 according to Embodiment 3 has the function of storing the calculated data for verification in the secure storage 13.

[0085] The functions added in Embodiment 3 are mainly described below. (Software Management Unit 107)

[0086] If the configuration change has been implemented in the software stored in the information processing device 100 while the information processing device 100 is in operation, the software management unit 107 detects the software in which the configuration change has been implemented. Based on a detected result, the software management unit 107 updates the startup record data 102 and issues a command to the validity verification unit 101.

[0087] When updating the startup record data 102, the software management unit 107 adds the startup address and the software size of the software in which the configuration change has been implemented to the startup record data 102, so that the software in which the configuration change has been implemented is the validity verification object at the next startup of the information processing apparatus 100.

[0088] Since the data for verifying the software in which the configuration change was performed is not stored as comparison data 104 when the command is given to the validity verification unit 101, the software management unit 107 gives the command to the validity verification unit 101 to calculate the data for verification. [Hardware configuration example]

[0089] A program that functionally implements the software management unit 107 is stored in the storage device 20 in the manner shown in Fig. 4 and is executed by the main CPU 30 in the manner shown in Fig. 4 shown hardware configuration as a specific example. *** Description of a function ***

[0090] The operation of the information processing device 100 is described below.

[0091] Fig. 11 is a flowchart showing an example of processing of the information processing apparatus 100 according to Embodiment 3. The processing in a case where the configuration change has been implemented in software while the information processing apparatus 100 is in operation will be explained with reference to Fig. 11 described. (Step S401)

[0092] When the configuration change has been implemented in the software, the software management unit 107 detects the implemented configuration change. (Step S402)

[0093] The software management unit 107 adds to the start record data 102 data each indicating the start address and the software size of the software in which the configuration change was performed.

[0094] By performing this step, the software in which the configuration change was implemented is forcibly verified the next time the information processing apparatus 100 is started. (Step S403)

[0095] The software management unit 107 instructs the validity verification unit 101 to calculate data for verification corresponding to the software in which the configuration change was performed.

[0096] The validity verification unit 101 calculates the verification data and updates the comparison data 104 using the calculated verification data. That is, when the software management unit 107 detects the software in which the configuration change was performed, the validity verification unit 101 calculates the comparison data 104 corresponding to the software in which the configuration change was performed. *** Description of the effects of embodiment 3 ***

[0097] The information processing device 100 according to Embodiment 3 updates the start record data 102 and the comparison data 104 in response to software in which a configuration change has been made. Therefore, the software in which the configuration change has been implemented during the operation of the information processing device 100 can serve as a subject of validity verification during the next startup of the information processing device 100.

[0098] On the other hand, the software in which the configuration change has been implemented and which is not startup software is excluded from the startup record data 102 at the next startup of the information processing device 100 through the operation of the startup completion notification unit 105 and the startup record acquisition unit 106 as stated in Embodiment 2. Accordingly, the software is no longer subject to validity verification at the next startup of the information processing device 100.

[0099] Furthermore, the information processing apparatus 100 according to Embodiment 3 is suitable for a vehicle control device like the information processing apparatus 100 according to Embodiment 2. *** Further embodiments ***

[0100] The above embodiments can be freely combined, or any components of each of the embodiments can be modified or omitted. Alternatively, any component can be omitted in each of the embodiments.

[0101] Alternatively, the embodiments are not limited to those illustrated in Embodiments 1 and 3, and various changes may be made as needed. The procedures described in the flowcharts or the like may be modified as appropriate. LIST OF REFERENCE SYMBOLS

[0102] 10: HSM; 11: secure CPU; 12: cryptographic computing engine; 13: secure memory; 20: storage device; 30: main CPU; 40: RAM; 50: processing circuit; 100: information processing device; 101: validity verification unit; 102: boot record data; 103: software memory; 104: comparison data; 105: boot completion notification unit; 106: boot record acquisition unit; 107: software management unit.

Claims

[1] Information processing device (100) that verifies software, comprising: a validity verification unit (101) for verifying the validity of startup software by comparing verification object data, which is data for verification calculated based on data stored in a storage location indicated in startup record data (102) indicating the storage location where the startup software executed at the startup of the information processing device (100) is to be stored, and which is data for verification calculated at the startup of the information processing device (100), with comparison data (104), which is data for verification calculated before the startup of the information processing device (100) based on the startup software, and which is data for verification used as a comparison object of the verification object data; a startup completion notification unit (105) for determining that software whose execution is to be started last among pieces of the startup software has been executed; and a startup record acquisition unit (106) for acquiring memory location data indicating the memory location of each software started from the start of the information processing apparatus (100) until it is determined that the software whose execution is to be started last among the pieces of startup software has been executed, and for updating the startup record data (102) using the acquired memory location data. [2] The information processing apparatus (100) according to claim 1, wherein the startup record data (102) consists of data indicating a leading address of the storage space and data indicating a data size of the startup software. [3] The information processing apparatus (100) according to claim 1 or claim 2, wherein the verification data is data indicating a hash value or a Message Authentication Code (MAC) of software corresponding to the verification data. [4] Information processing apparatus (100) according to any one of claims 1 to 3, further comprising: a software management unit (107) for detecting software in which a configuration change has been implemented when the configuration change has been implemented to the software stored in the information processing device (100) while the information processing device (100) is in operation, wherein when the software in which the configuration change was implemented is detected, the validity verification unit (101) calculates comparison data (104) corresponding to the software in which the configuration change was implemented. [5] An information processing method performed by an information processing apparatus (100) which is a computer that verifies software, comprising: Verifying the validity of startup software by comparing verification object data, which is data for verification calculated based on data stored in a storage location indicated in startup record data (102) indicating the storage location where the startup software executed at the startup of the information processing device (100) is to be stored, and which is data for verification calculated at the startup of the information processing device (100), with comparison data (104), which is data for verification calculated before the startup of the information processing device (100) based on the startup software, and which is data for verification used as a comparison object of the verification object data; Determine that software intended to be the last of the startup software components to be executed has been executed; and Acquiring memory location data indicating the memory location for each software started from the start of the information processing device (100) until it is determined that the software whose execution is to be started last among the pieces of startup software has been executed, and updating the startup record data (102) using the acquired memory location data. [6] An information processing program for causing an information processing device (100), which is a computer that verifies software, to execute: a validity verification process of verifying the validity of startup software by comparing verification object data, which is data for verification calculated on the basis of data stored in a storage location specified in startup record data (102) indicating the storage location where the startup software executed at the startup of the information processing device (100) is to be stored, and which is data for verification calculated at the startup of the information processing device (100), with comparison data (104), which is data for verification calculated before the startup of the information processing device (100) on the basis of the startup software, and which is data for verification used as a comparison object of the verification object data, a startup completion notification process for determining that software intended to be the last of the startup software pieces to be executed has been executed; and a startup record acquiring process for acquiring memory location data indicating the memory location of each software started from the startup of the information processing apparatus (100) until it is determined that the software whose execution is to be started last among the pieces of startup software has been executed, and for updating the startup record data (102) using the acquired memory location data.

Images