Information processing apparatus and information processing method

Abstract

To prevent tampering of firmware.SOLUTION: An information processing apparatus comprises: a first determination unit which determines whether or not instruction information giving an instruction to switch from a first verification method of verifying the validity of firmware by a digital signature generated based on public key cryptography to a second verification method of verifying the validity of firmware by a message authentication code generated by using a message authentication key generated based on a random number is received: a random number generator which generates the random number; a first generation unit which, if the first determination unit determines that the instruction information is received, generates a message authentication key for use in generation of the message authentication code on the basis of the random number; and a second generation unit which uses the message authentication key to generate the message authentication code of firmware.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present embodiment relates to an information processing device and an information processing method. [Background technology]

[0002] 2. Description of the Related Art In recent years, technology has become increasingly software-based, and there has been an increase in information processing devices that perform various types of information processing using software called firmware that controls hardware such as a CPU (Central Processing Unit).

[0003] Firmware is easy to update, and updates can correct defects and expand functions. On the other hand, firmware is easier to tamper with than hardware, and there is a risk of malicious tampering when updating firmware. For this reason, when updating firmware, it is common to provide the updated firmware with a digital signature attached.

[0004] Digital signatures are generated using public key cryptography and are said to be more secure than message authentication codes generated using message authentication keys. However, quantum computers are known to be able to efficiently solve the discrete logarithm problem and the prime factorization problem, which are necessary for decryption, and as quantum computers become more widespread, digital signatures may be tampered with. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] US Patent Application Publication No. 2015 / 0286823 Summary of the Invention [Problem to be solved by the invention]

[0006] An object of the present embodiment is to provide an information processing device and an information processing method capable of detecting firmware tampering. [Means for solving the problem]

[0007] According to this embodiment, there is provided an information processing device comprising: a first determination unit that determines whether or not instruction information has been received instructing to switch from a first verification method, which verifies the authenticity of the firmware using a digital signature generated based on public key cryptography, to a second verification method, which verifies the authenticity of the firmware using a message authentication code generated using a message authentication key generated based on a random number; a random number generator that generates random numbers; a first generation unit that generates a message authentication key based on the random number when the first determination unit determines that the instruction information has been received, the message authentication key being used to generate the message authentication code; and a second generation unit that generates a message authentication code for the firmware using the message authentication key. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a block diagram of an information processing system according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a functional block diagram of a controller according to the embodiment. [Diagram 3] FIG. 4 is a sequence diagram showing a processing operation executed by a controller according to the embodiment when updating firmware. [Figure 4] 4 is a sequence diagram showing a processing operation executed immediately after power is supplied to the controller after the processing in FIG. 3 is executed. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, the present embodiment will be described with reference to the drawings.

[0010] 1 is a block diagram of an information processing system 1 according to this embodiment. The information processing system 1 includes a storage device 2 and a host device 3. The storage device 2 and the host device 3 are connected via a host bus 20.

[0011] The storage device 2 is a device that stores data. The storage device 2 is, for example, a solid state drive (SSD), a universal serial bus (USB) memory, a universal flash storage (UFS) device, a multi media card (MMC), or an SD card.

[0012] The host device 3 is an information processing device external to the storage device 2 .

[0013] The memory device 2 has a memory chip 4, a controller 5, a firmware memory unit (hereinafter referred to as FW memory unit) 6, a digital signature memory unit 7, an instruction information memory unit 8, a MAC key (Message Authentication Code key) memory unit 9, and a MAC value (Message Authentication Code) memory unit 10.

[0014] The memory chip 4 is a device for storing data in a non-volatile manner. The memory chip 4 is, for example, a chip including a NAND flash memory.

[0015] The controller 5 is an information processing device inside the storage device 2. The controller 5 is connected to the memory chip 4 via a memory bus 12. The controller 5 has a host interface circuit (host I / F) 21, a processor (CPU) 22, a memory interface circuit (memory I / F) 23, and an ECC (Error Checking and Correcting) circuit 24. The host I / F 21, the CPU 22, the memory I / F 23, and the ECC circuit 24 are connected to a main bus 25.

[0016] The host I / F 21 is an interface circuit for transmitting and receiving data between the storage device 2 and the outside.

[0017] The CPU 22 is a processing unit that executes firmware.

[0018] The memory I / F 23 is an interface circuit for sending and receiving data.

[0019] The ECC circuit 24 is a circuit that detects and corrects errors in the data read from the memory chip 4 .

[0020] The FW storage unit 6 is a non-volatile memory that stores firmware.

[0021] The digital signature storage unit 7 is a non-volatile memory. The digital signature storage unit 7 stores the digital signature and the public key received together with the firmware. The digital signature storage unit 7 stores the digital signature and the public key in association with the firmware. The FW storage unit 6 and the digital signature storage unit 7 can be integrated into one non-volatile memory.

[0022] The instruction information storage unit 8 is a non-volatile memory or an electronic fuse. The instruction information storage unit 8 stores instruction information. The instruction information will be described later. An electronic fuse is a storage device that stores information in a non-volatile manner. An electronic fuse is provided for each bit of a digital signal consisting of multiple bits. A 0 or 1 is stored depending on whether an element of the electronic fuse is cut by an electrical signal.

[0023] The MAC key storage unit 9 is a non-volatile memory or an electronic fuse. The MAC key storage unit 9 stores a message authentication key (hereinafter referred to as a MAC key). The MAC key is used to generate a message authentication code (hereinafter referred to as a MAC value). The MAC key is a key unique to the storage device 2. The instruction information storage unit 8 and the MAC key storage unit 9 can be integrated into one non-volatile memory.

[0024] The MAC value storage unit 10 is a non-volatile memory. The MAC value storage unit 10 stores the MAC value in association with the firmware. The MAC value storage unit 10 and the FW storage unit 6 can be integrated into one storage unit.

[0025] 2 is a functional block diagram of the controller 5 according to this embodiment. The controller 5 according to this embodiment includes a first determination unit 31, a random number generator 32, a first generation unit 33, and a second generation unit 34. The controller 5 according to this embodiment also includes a second determination unit 35, a first verification unit 36, a second verification unit 37, an error processing unit 38, and a firmware storage control unit (hereinafter, FW storage control unit) 39.

[0026] The first determination unit 31 determines whether the storage device 2 has received instruction information. The instruction information is information transmitted when instructing the storage device 2 to switch from the first verification method to the second verification method. The instruction information is transmitted when the firmware is updated, or at a timing unrelated to the firmware update. The first verification method is a method for verifying the authenticity of the firmware by using a public key to verify a digital signature generated using public key cryptography (private key). The second verification method is a method for verifying the authenticity of the firmware by a MAC value generated using a MAC key.

[0027] The random number generator 32 generates random numbers. The random number generator 32 generates random numbers using, for example, a hash function. The random numbers generated by the random number generator 32 are, for example, pseudo-random numbers.

[0028] The first generation unit 33 generates a MAC key by using the random numbers generated by the random number generator 32. The MAC key is a key unique to the controller 5. The MAC key is used to generate a MAC value.

[0029] The second generation unit 34 generates a MAC value using the MAC key generated by the first generation unit 33. The MAC value is identification information.

[0030] The second determination unit 35 determines whether the instruction information storage unit 8 stores instruction information.

[0031] The first verification unit 36 ​​verifies the firmware stored in the FW storage unit 6 by using the MAC value stored in the MAC value storage unit 10.

[0032] The second verification unit 37 verifies the firmware stored in the FW storage unit 6 by using the digital signature and public key stored in the digital signature storage unit 7 .

[0033] The error processing unit 38 performs a predetermined error processing. The predetermined error processing is, for example, a processing for generating log information indicating that the security risk has become higher. Alternatively, the predetermined error processing is a processing for stopping a predetermined information processing executed by the controller 5.

[0034] The FW storage control unit 39 stores the received firmware in the FW storage unit 6, and also stores the digital signature and public key received together with the firmware in the digital signature storage unit .

[0035] FIG. 3 is a sequence diagram showing the processing operations executed by the controller 5 according to this embodiment when updating firmware.

[0036] When updating firmware, the first determination unit 31 determines whether or not the storage device 2 receives instruction information before a predetermined period of time has elapsed (S1).

[0037] If the storage device 2 receives the instruction information before the predetermined period has elapsed (S1 [Yes]), the first determination unit 31 stores the instruction information received by the storage device 2 in the instruction information storage unit 8 (S2).

[0038] After storing the instruction information in the instruction information storage unit 8, the first judgment unit 31 transmits an instruction to generate a random number to the random number generator 32 (S3).

[0039] Upon receiving the instruction to generate a random number, the random number generator 32 generates a random number (S4).

[0040] The random number generator 32 sends the generated random number to the first generation unit 33 (S5).

[0041] Upon receiving the random number, the first generation unit 33 generates a MAC key using the received random number (S6).

[0042] The first generation unit 33 stores the generated MAC key in the MAC key storage unit 9 (S7).

[0043] The first generation unit 33 sends the generated MAC key to the second generation unit 34 (S8).

[0044] Upon receiving the MAC key, the second generation unit 34 transmits a request to read the firmware to the FW storage unit 6 (S9). The firmware requested to be read is the latest firmware most recently stored in the FW storage unit 6.

[0045] When a request to read the firmware is received, the FW storage unit 6 outputs the firmware (S10).

[0046] Upon receiving the firmware, the second generation unit 34 generates a MAC value using the received MAC key and the received firmware (S11).

[0047] The second generation unit 34 stores the generated MAC value in the MAC value storage unit 10 (S12).

[0048] If the storage device 2 does not receive the instruction information before a predetermined period of time has elapsed (S1 [No]), the first determination unit 31 ends the sequence of FIG. 3 (S13).

[0049] FIG. 4 is a sequence diagram showing the processing operations executed immediately after power is supplied to the controller 5 after the processing of FIG. 3 has been executed.

[0050] Immediately after power is supplied to the controller 5, the second determination unit 35 transmits a request to read out the instruction information to the instruction information storage unit 8 (S21).

[0051] When a request to read out the instruction information is received, the instruction information storage unit 8 outputs the stored information (S22).

[0052] When the information is received, the second determination unit 35 determines whether the received information is instruction information (S23).

[0053] If the received information is instruction information (S23 [Yes]), the second determination unit 35 transmits an instruction to the first verification unit 36 ​​to verify the MAC value (S24).

[0054] Upon receiving the instruction to verify the MAC value, the first verification unit 36 ​​transmits a request to read the MAC key to the MAC key storage unit 9 (S25).

[0055] When a request to read the MAC key is received, the MAC key storage unit 9 outputs the MAC key to the first verification unit 36 ​​(S26).

[0056] Upon receiving the MAC key, the first verification unit 36 ​​transmits a request to read the firmware to the FW storage unit 6 (S27). The firmware requested to be read is the latest firmware most recently stored in the FW storage unit 6.

[0057] When the request to read the firmware is received, the FW storage unit 6 outputs the firmware to the first verification unit 36 ​​(S28).

[0058] Upon receiving the firmware, the first verification unit 36 ​​generates a MAC value using the received MAC key and the received firmware (S29).

[0059] After generating the MAC value, the first verification unit 36 ​​transmits a request to read the MAC value to the MAC value storage unit 10 (S30).

[0060] When a request to read the MAC value is received, the MAC value storage unit 10 outputs the MAC value to the first verification unit 36 ​​(S31).

[0061] Upon receiving the MAC value, the first verification unit 36 ​​compares the received MAC value with the generated MAC value (S32).

[0062] If the received MAC value does not match the generated MAC value (S32 [Mismatch]), the first verification unit 36 ​​causes the error processing unit 38 to perform a predetermined error processing (S33).

[0063] If the received MAC value matches the generated MAC value (S32 [match]), the first verification unit 36 ​​ends the sequence of FIG. 4 (S34).

[0064] If the received information is not instruction information (S23 [No]), the second determination unit 35 transmits an instruction to the second verification unit 37 to verify the digital signature (S35).

[0065] Upon receiving the instruction to verify the digital signature, the second verification unit 37 transmits a request to read the digital signature and the public key to the digital signature storage unit 7 (S36).

[0066] Upon receiving the request to read the digital signature and the public key, the digital signature storage unit 7 outputs the digital signature and the public key to the second verification unit 37 (S37).

[0067] Upon receiving the digital signature and the public key, the second verification unit 37 transmits a request to read the firmware to the FW storage unit 6 (S38).

[0068] When the request to read the firmware is received, the FW storage unit 6 outputs the firmware to the second verification unit 37 (S39).

[0069] Upon receiving the firmware, the second verification unit 37 calculates a hash value using the received firmware (S40).

[0070] The second verification grain 37 decrypts the received digital signature with the received public key and extracts a hash value (S41).

[0071] The second verification unit 37 compares the calculated hash value with the extracted hash value (S42).

[0072] If the calculated hash value does not match the extracted hash value (S42 [Mismatch]), the second verification unit 37 causes the error processing unit 38 to perform a predetermined error processing (S43).

[0073] If the calculated hash value matches the extracted hash value (S42 [match]), the second verification unit 37 ends the sequence of FIG. 4 (S44).

[0074] According to this embodiment, it is possible to verify whether firmware has been tampered with without compromising confidentiality using a method other than a digital signature.

[0075] According to this embodiment, since the MAC key generated from the random numbers is not made public and is difficult to identify even with a quantum computer, it is possible to switch to a verification method using the MAC key, which makes it possible to detect firmware tampering. [Note]

[0076] [Item 1] a first determination unit that determines whether or not instruction information instructing to switch from a first verification method that verifies the authenticity of the firmware using a digital signature generated based on public key cryptography to a second verification method that verifies the authenticity of the firmware using a message authentication code generated using a message authentication key generated based on a random number has been received; A random number generator for generating the random numbers; a first generation unit that generates, when the first determination unit determines that the instruction information has been received, the message authentication key used to generate the message authentication code based on the random number; a second generation unit that generates the message authentication code of the firmware using the message authentication key; Information processing device. [Item 2] a firmware storage control unit that stores the firmware in a firmware storage unit and stores the digital signature received together with the firmware in a digital signature storage unit; When the first determination unit determines that the instruction information has been received, the first determination unit stores the instruction information in an instruction information storage unit; The first generation unit stores the generated message authentication key in a message authentication key storage unit, The second generation unit stores the generated message authentication code in a message authentication code storage unit. Item 1. An information processing device according to item 1. [Item 3] the firmware storage control unit causes the digital signature to be stored in the digital signature storage unit in association with the firmware until the message authentication code is generated by the second generation unit; After the message authentication code is generated by the second generation unit, the second generation unit stores the message authentication code in the message authentication code storage unit in association with the firmware. Item 3. An information processing device according to item 2. [Item 4] a second determination unit that determines whether the instruction information is stored in the instruction information storage unit immediately after power is supplied; a first verification unit that verifies the firmware stored in the firmware storage unit by using the message authentication code stored in the message authentication code storage unit when the second determination unit determines that the instruction information is stored in the instruction information storage unit; a second verification unit that verifies the digital signature when the second determination unit determines that the instruction information is not stored in the instruction information storage unit. Item 2. The information processing device according to item 2 or 3. [Item 5] when the second determination unit determines that the instruction information is stored in the instruction information storage unit, the first verification unit generates the message authentication code using the message authentication key read from the message authentication key storage unit and the firmware read from the firmware storage unit, and verifies whether the generated message authentication code matches the message authentication code read from the message authentication code storage unit. Item 5. An information processing device according to item 4. [Item 6] the second verification unit verifies the digital signature stored in the digital signature storage unit when the second determination unit determines that the instruction information is not stored in the instruction information storage unit immediately after power is supplied. Item 6. The information processing device according to item 4 or 5. [Item 7] when the second determination unit determines that the instruction information is not stored in the instruction information storage unit immediately after power is supplied, the second verification unit calculates a hash value using the firmware received from the firmware storage unit, and decrypts the digital signature received from the digital signature storage unit with a public key to extract a hash value, and verifies whether the calculated hash value matches the extracted hash value. Item 7. An information processing device according to item 6. [Item 8] an error processing unit that performs a predetermined error processing when a mismatch is verified by at least one of the first verification unit or the second verification unit; 8. An information processing device according to any one of items 4 to 7. [Item 9] The predetermined error handling includes generating log information indicating that the security risk has increased. Item 9. An information processing device according to item 8. [Item 10] the predetermined error processing includes processing for stopping execution of the predetermined information processing, Item 9. An information processing device according to item 8. [Item 11] The instruction information is instructed by a command from a host device at the time of updating the firmware or at a timing unrelated to updating the firmware. 11. The information processing device according to any one of items 1 to 10. [Item 12] each of the instruction information storage unit and the message authentication key storage unit is a non-volatile storage unit that stores the instruction information or the message authentication key in a non-volatile manner; 11. The information processing device according to any one of items 2 to 10. [Item 13] At least one of the instruction information storage unit and the message authentication key storage unit is an electronic fuse that stores the instruction information or the message authentication key. Item 13. An information processing device according to item 12. [Item 14] determining whether or not instruction information has been received instructing a switch from a first verification method that verifies the authenticity of the firmware using a digital signature generated based on public key cryptography to a second verification method that verifies the authenticity of the firmware using a message authentication code generated using a message authentication key generated based on a random number; generating a message authentication key, which is used to generate the message authentication code, based on the random number when it is determined that the instruction information has been received; Information processing methods.

[0077] The embodiments are illustrative and the scope of the invention is not limited thereto. [Explanation of symbols]

[0078] 1. Information Processing Systems 2 Storage device 3 Host device 4. Memory chips 5. Controller 6 FW storage section 7 Digital Signature Storage Unit 8 Instruction information storage section 9 MAC key storage 10 MAC value storage section 11 RAM 12 Memory Bus 20 Host Bus 21 Host interface circuit (host I / F) 22 Processor (CPU) 23 Memory interface circuit (memory I / F) 24 ECC circuit 25 Main Bus 31 1st Judgment Section 32 Random Number Generator 33 1st generation part 34 Second generation part 35 Second Judgment Section 36 First Verification Section 37 Second Verification Section 38 Error handling section 39 FW memory control unit

Claims

1. a first determination unit that determines whether or not instruction information instructing to switch from a first verification method that verifies the authenticity of the firmware using a digital signature generated based on public key cryptography to a second verification method that verifies the authenticity of the firmware using a message authentication code generated using a message authentication key generated based on a random number has been received; A random number generator for generating the random numbers; a first generation unit that generates, when the first determination unit determines that the instruction information has been received, the message authentication key used to generate the message authentication code based on the random number; a second generation unit that generates the message authentication code of the firmware by using the message authentication key; Information processing device.

2. a firmware storage control unit that stores the firmware in a firmware storage unit and stores the digital signature received together with the firmware in a digital signature storage unit; When determining that the instruction information has been received, the first determination unit stores the instruction information in an instruction information storage unit; The first generation unit stores the generated message authentication key in a message authentication key storage unit; The second generation unit stores the generated message authentication code in a message authentication code storage unit. The information processing device according to claim 1 .

3. the firmware storage control unit causes the digital signature to be stored in the digital signature storage unit in association with the firmware until the second generation unit generates the message authentication code; After the message authentication code is generated by the second generation unit, the second generation unit stores the message authentication code in the message authentication code storage unit in association with the firmware. The information processing device according to claim 2 .

4. a second determination unit that determines whether the instruction information is stored in the instruction information storage unit immediately after power is supplied; a first verification unit that verifies the firmware stored in the firmware storage unit by using the message authentication code stored in the message authentication code storage unit when the second determination unit determines that the instruction information is stored in the instruction information storage unit; and a second verification unit that verifies the digital signature when the second determination unit determines that the instruction information is not stored in the instruction information storage unit. The information processing device according to claim 2 .

5. when the second determination unit determines that the instruction information is stored in the instruction information storage unit, the first verification unit generates the message authentication code using the message authentication key received from the message authentication key storage unit and the firmware received from the firmware storage unit, and verifies whether the generated message authentication code matches the message authentication code received from the message authentication code storage unit. The information processing device according to claim 4.

6. the second verification unit verifies the digital signature stored in the digital signature storage unit when the second determination unit determines that the instruction information is not stored in the instruction information storage unit immediately after power is supplied. The information processing device according to claim 4.

7. when the second determination unit determines that the instruction information is not stored in the instruction information storage unit immediately after power is supplied, the second verification unit calculates a hash value using the firmware received from the firmware storage unit, and decrypts the digital signature received from the digital signature storage unit with a public key to extract a hash value, and verifies whether the calculated hash value matches the extracted hash value. The information processing device according to claim 6.

8. an error processing unit that performs a predetermined error processing when a mismatch is verified by at least one of the first verification unit or the second verification unit; The information processing device according to claim 4.

9. The predetermined error handling includes generating log information indicating that the security risk has increased. The information processing device according to claim 8.

10. the predetermined error processing includes processing for stopping execution of the predetermined information processing, The information processing device according to claim 8.

11. The instruction information is instructed by a command from a host device at the time of updating the firmware or at a timing unrelated to updating the firmware. The information processing device according to claim 1 .

12. each of the instruction information storage unit and the message authentication key storage unit is a non-volatile storage unit that stores the instruction information or the message authentication key in a non-volatile manner; The information processing device according to claim 2 .

13. At least one of the instruction information storage unit and the message authentication key storage unit is an electronic fuse that stores the instruction information or the message authentication key. The information processing device according to claim 12.

14. determining whether or not instruction information has been received instructing a switch from a first verification method that verifies the authenticity of the firmware using a digital signature generated based on public key cryptography to a second verification method that verifies the authenticity of the firmware using a message authentication code generated using a message authentication key generated based on a random number; generating a message authentication key, which is used to generate the message authentication code, based on the random number when it is determined that the instruction information has been received; Information processing methods.

Images