Control apparatus, control method, and control program

Abstract

To provide a control apparatus, a control method, and a control program for suppressing unauthorized access to a storage unit.SOLUTION: A control apparatus 10 (BMC (Baseboard Management Controller)) mounted on a system board in a server computer or the like and directly connected to a storage unit by a bus, comprises: an access determination unit 21 for determining whether or not predetermined information is written in the storage unit; and an access control unit 22 for permitting access to the storage unit if the predetermined information is written, and blocking access to the storage unit by determining that the access is unauthorized if the predetermined information is not written.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to a control device, a control method, and a control program. [Background technology]

[0002] In server computers and the like, a BMC (Baseboard Management Controller) is mounted on the motherboard and the server computer is monitored by this BMC. Hereinafter, the server computer may be simply referred to as a server.

[0003] SPI (Serial Peripheral Interface) is known as a means of communication between devices inside a server. In a server, SPI is also used to connect the BMC to the EEPROM (Electrically Erasable Programmable Read-Only Memory) that stores the firmware executed by the BMC.

[0004] FIG. 5 is a diagram illustrating a connection between a BMC and an EEPROM on a server board.

[0005] 5, a BMC 501 and an EEPROM 502 are mounted on a server motherboard 500. The BMC 501 and EEPROM 502 are connected via a bus 503 conforming to the SPI standard.

[0006] A debug pin 504 is connected to the bus 503, and a debug tool 505 is connected to the debug pin 504. The debug tool 505 accesses the EEPROM 502 via the debug pin 504 and the bus 503 to read data and perform other operations.

[0007] Firmware executed by the BMC 501 and setting information used by the firmware are stored in the EEPROM 502. Firmware security is achieved by encrypting the firmware using a hash when the firmware is read from the EEPROM 502 to the BMC 501 at the time of booting the server.

[0008] In addition, since the setting information is not encrypted when it is read from the firmware, some parts of it may be readable.

[0009] In SPI communication between devices, the master device (SPI master) takes the initiative and requests the slave device (SPI slave) to read and write data.

[0010] A device that complies with SPI has the following signal terminals: clock (CLK), chip select (CS), master output / slave input (MOSI), and master input / slave output (MISO).

[0011] Here, CS enables mode fault detection when multiple devices (microcontrollers) are connected, preventing multiple devices from becoming masters at the same time. A master can communicate with a target slave by setting the CS of that slave to L (Low). Also, when there are multiple masters, communication is not possible if CS is H (High).

[0012] For example, in the example shown in FIG. 5, when the debugging tool 505 accesses the EEPROM 502 to read or write data, the debugging tool 505, as the master, sets CS to L and then accesses the EEPROM 502.

[0013] Furthermore, the BMC 501 can detect that CS has become L due to a known function of the SPI, and thereby detect access to the EEPROM 502 by something other than itself (eg, the debug tool 505). [Prior art documents] [Patent documents]

[0014] [Patent Document 1] JP 2007-18442 A [Patent Document 2] Japanese Patent Application Publication No. 6-67985 Summary of the Invention [Problem to be solved by the invention]

[0015] In the above-mentioned SPI communication, the BMC 501 can detect that CS has become L through the SPI function and can detect access to the EEPROM 502 by anyone other than itself. However, there is a problem in that it cannot determine whether the access to the EEPROM 502 is due to a legitimate debugger or due to hacking by an unauthorized device.

[0016] In one aspect, the present invention aims to suppress unauthorized access to a storage unit. [Means for solving the problem]

[0017] For this reason, this control device is a control device directly connected to the memory unit by a bus, and is equipped with an access judgment unit that judges whether specified information has been written to the memory unit, and an access control unit that allows access to the memory unit if the specified information has been written, and that judges the access to be an irregular access and blocks access to the memory unit if the specified information has not been written. Effect of the Invention

[0018] According to one embodiment, unauthorized access to the storage unit can be suppressed. [Brief description of the drawings]

[0019] [Figure 1]FIG. 2 is a diagram illustrating an example of a hardware configuration of a system board equipped with a BMC according to an embodiment. [Diagram 2] FIG. 2 is a diagram illustrating a functional configuration of a BMC according to an embodiment. [Diagram 3] 11 is a timing chart for explaining a process performed by a BMC according to an embodiment when a legitimate access is made from a legitimate debugger. [Figure 4] 11 is a timing chart for explaining a process performed by a BMC according to an embodiment when a legitimate access is made from an unauthorized debugger. [Diagram 5] FIG. 2 is a diagram illustrating a connection between a BMC and an EEPROM on a server board. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0020] Hereinafter, an embodiment of the present control device, control method, and control program will be described with reference to the drawings. However, the embodiment shown below is merely an example, and there is no intention to exclude the application of various modified examples and techniques not explicitly stated in the embodiment. In other words, this embodiment can be implemented with various modifications within the scope of its purpose. Furthermore, each figure does not intend to include only the components shown in the figure, but can include other functions, etc.

[0021] (A) Configuration (A-1) Hardware configuration FIG. 1 is a diagram illustrating an example of a hardware configuration of a system board 1 on which a BMC 10 according to an embodiment is mounted.

[0022] The system board 1 is a substrate device mounted on a server computer (not shown) etc. The system board may also be called a motherboard.

[0023] The system board 1 illustrated in FIG. 1 has a central processing unit (CPU) 14, a dual inline memory module (DIMM) 15, a fan 16, an interface card 17, a power supply (PSU) 18, a BMC 10, and a firmware memory 13 mounted thereon.

[0024] In addition, the system board 1 illustrated in FIG. 1 is provided with multiple CPUs 14, DIMMs 15, FANs 16, interface cards 17, and PSUs 18, thereby realizing redundancy.

[0025] The BMC 10 is a control device that monitors the system board 1 and devices installed in the server computer in which the system board 1 is installed, and collects information on the system board 1 and each device. The BMC 10 may be called a management device. The BMC 10 may be configured as, for example, an LSI (Large Scale Integration) chip.

[0026] 1, the BMC 10 includes as its components a processor 11 and a memory 12. The BMC 10 is a computer. A firmware memory 13 is connected to the BMC 10 via a bus 23 conforming to the SPI standard.

[0027] A debug pin 24 is also connected to the bus 23, and a device (not shown) is connected to the debug pin 24. The debug pin 24 corresponds to a data access pin for the device to access the firmware memory 13 (storage unit). A regular debugger and an irregular debugger, which will be described later, are connected to the firmware memory 13 via the debug pin 24. These regular debuggers and irregular debuggers correspond to examples of devices.

[0028] The firmware memory 13 is a storage unit that readably stores firmware (programs) executed by the processor 11 and setting information used by the firmware.

[0029] The firmware may include a control program executed by the processor 11 to enable the BMC 10 to realize the security functions of this embodiment.

[0030] The firmware memory 13 may be, for example, a ROM (Read Only Memory). In this embodiment, an example in which the firmware memory 13 is an EEPROM will be described.

[0031] Furthermore, as the firmware memory 13, for example, a storage class memory (SCM) or a semiconductor memory device such as a flash memory (SSD: Solid State Drive) can also be used.

[0032] The processor 11 is a control unit that controls the entire BMC 10. The processor 11 may be a multiprocessor. The processor 11 may be, for example, any one of a CPU (Central Processing Unit), an MPU (Micro Processing Unit), a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), a PLD (Programmable Logic Device), and an FPGA (Field Programmable Gate Array). The processor 11 may also be a combination of two or more types of elements from the CPU, MPU, DSP, ASIC, PLD, and FPGA.

[0033] The memory 12 is used as a main storage device of the BMC 10. The memory 12 temporarily stores at least a part of the firmware (program) to be executed by the processor 11. The memory 12 also stores various data necessary for processing by the processor 11. The various data necessary for processing by the processor 11 may include setting information read from the firmware memory 13.

[0034] The BMC 10 realizes the security function of this embodiment by executing a program (such as a control program) recorded on, for example, a computer-readable non-transitory recording medium. The program (firmware) describing the processing content to be executed by the BMC 10 can be recorded on various recording media. For example, the program to be executed by the BMC 10 can be stored in a firmware memory 13. The processor 11 loads at least a part of the program in the firmware memory 13 into the memory 12 and executes the loaded program.

[0035] Also, the programs to be executed by the BMC 10 (processor 11) can be recorded on a non-transitory portable recording medium such as an optical disk, a memory device, or a memory card (not shown). The programs stored on the portable recording medium become executable after being installed in the firmware memory 13, for example, under the control of the processor 11. Also, the processor 11 can read and execute the programs directly from the portable recording medium.

[0036] (A-2) Functional configuration FIG. 2 is a diagram showing the functional configuration of the BMC 10 according to an embodiment.

[0037] As shown in FIG. 2, the BMC 10 has at least the functions of an access determining unit 21 and an access control unit 22.

[0038] The processor 11 of the BMC 10 functions as the access determination unit 21 and the access control unit 22 by executing a control program included in the firmware.

[0039] The program (control program) for realizing the functions of the access determination unit 21 and the access control unit 22 is provided in a form recorded on a computer-readable recording medium such as a flexible disk, a CD (CD-ROM, CD-R, CD-RW, etc.), a DVD (DVD-ROM, DVD-RAM, DVD-R, DVD+R, DVD-RW, DVD+RW, HD DVD, etc.), a Blu-ray disk, a magnetic disk, an optical disk, a magneto-optical disk, etc. Then, the BMC 10 (computer) reads the program from the recording medium, transfers it to an internal storage device or an external storage device, stores it, and uses it. Also, the program may be recorded on a storage device (recording medium) such as a magnetic disk, an optical disk, a magneto-optical disk, etc., and provided to the computer from the storage device via a communication path.

[0040] When the functions of the access determination unit 21 and the access control unit 22 are realized, a program stored in an internal storage device (memory 12 in this embodiment) is executed by a microprocessor of a computer (processor 11 in this embodiment). At this time, the program recorded on a recording medium may be read and executed by the computer.

[0041] When an access is made to the firmware memory 13, the access determination unit 21 determines whether the access is a legitimate access or an illegitimate access.

[0042] In the following, an example is shown in which the firmware memory 13 is accessed from either a regular debugger (not shown), which is a device that performs regular access (regular device), or an irregular debugger (not shown), which is a device that performs irregular access (irregular device).

[0043] The access determination unit 21 monitors access to the firmware memory 13. Specifically, the access determination unit 21 checks whether or not predefined identification information has been written in a predetermined storage area in the firmware memory 13. The identification information corresponds to the predetermined information.

[0044] When identification information is written in this predetermined storage area, the access judging unit 21 judges that a legitimate access has been made to the firmware memory 13. On the other hand, when identification information is not written in this predetermined storage area, the access judging unit 21 judges that an unauthorized access has been made to the firmware memory 13.

[0045] Here, the predetermined storage area in the firmware memory 13 may be, for example, an area of ​​a predetermined size (for example, 32 bytes) at the beginning of the storage area of ​​the firmware memory 13. However, the predetermined storage area is not limited to the beginning area of ​​the storage area of ​​the firmware memory 13, but may be another area, and can be implemented in various modifications.

[0046] Furthermore, the identification information may be a predefined data string, for example, a predetermined data string having a predetermined length (for example, 32 bytes). Hereinafter, the identification information may be referred to as a connection destination identifier.

[0047] Hereinafter, the predetermined storage area in the firmware memory 13 where the connection destination identifier is stored may be referred to as an identification area.

[0048] In order to monitor whether a connection destination identifier is written in the identification area of ​​the firmware memory 13, the access determination unit 21 needs to access the firmware memory 13. For this reason, the access determination unit 21 sets CS of the firmware memory 13 to L, and then reads the data in the identification area of ​​the firmware memory 13.

[0049] The access determination unit 21 checking whether a connection destination identifier is written in the identification area of ​​the firmware memory 13 may be referred to as monitoring the identification area.

[0050] Furthermore, the access judging unit 21 repeatedly monitors the identification area of ​​the firmware memory 13 at predetermined intervals. That is, the access judging unit 21 monitors the identification area of ​​the firmware memory 13 at regular intervals (periodic monitoring).

[0051] The interval of this regular monitoring is determined to be equal to or longer than the time required for the authorized debugger (authorized device, device) to write the connection destination identifier into the identification area of ​​the firmware memory 13. The interval of regular monitoring may be, for example, several tens of milliseconds.

[0052] The access determination unit 21 monitors the identification area in the firmware memory 13 and determines whether or not a connection destination identifier has been written.

[0053] Here, in the SPI communication carried out on the bus 23, the connection destination identifier is written into the identification area of ​​the firmware memory 13 by the regular device that has become the master.

[0054] The regular device is equipped with a function of writing a connection destination identifier to the identification area after setting CS of the firmware memory 13 to be accessed to L. After writing the connection destination identifier to the identification area, the regular device executes data access (reading and writing data) to the firmware memory 13.

[0055] The access determination unit 21 may detect an access to the firmware memory 13 by detecting that the CS of the firmware memory 13 has become L by a known function of the SPI, for example.

[0056] Then, when the access determining section 21 detects an access made to the firmware memory 13, the access determining section 21 may monitor the identification area in the firmware memory 13 and determine whether or not a connection destination identifier has been written.

[0057] The access control unit 22 controls access made by the device to the firmware memory 13 in accordance with the result of the determination made by the access determination unit 21 .

[0058] If the access judging unit 21 judges that an unauthorized access has been made to the firmware memory 13, the access control unit 22 blocks access to the firmware memory 13 by the device (unauthorized device).

[0059] Specifically, the access control unit 22 sets CS of the firmware memory 13 to L. This makes it impossible for devices other than the BMC 10 to set CS of the firmware memory 13 to L. Therefore, an unauthorized debugger cannot access the firmware memory 13.

[0060] The access control unit 22 realizes the access inhibition by artificially generating an access conflict to the firmware memory 13 from an access source other than the BMC 10.

[0061] When the access control unit 22 detects that the unauthorized debugger is no longer connected to the firmware memory 13, it releases the blockage of access to the firmware memory 13.

[0062] Specifically, the access control unit 22 changes CS of the firmware memory 13 from L to H. This allows devices other than the BMC 10 to change CS of the firmware memory 13 to L. Therefore, devices other than the BMC 10 can access the firmware memory 13.

[0063] The access control unit 22 may detect that the CS of the firmware memory 13 has changed from L to H, thereby detecting that the unauthorized debugger has lost connection to the firmware memory 13.

[0064] When the access determination unit 21 determines that a legitimate access has been made to the firmware memory 13, the access control unit 22 does not block access by a device (a legitimate device) to the firmware memory 13. The access determination unit 21 sets CS to H to put the firmware memory 13 into an access permitted state.

[0065] This allows the regular debugger to set CS of the firmware memory 13 to L and read the data in the firmware memory 13.

[0066] Furthermore, when the access control unit 22 detects that the connection from the authorized debugger to the firmware memory 13 has been lost, the access control unit 22 erases the connection destination identifier in the identification area of ​​the firmware memory 13. For example, the access control unit 22 may erase the connection destination identifier by overwriting the identification area with 0 or a random value.

[0067] The access control unit 22 may detect that the CS of the firmware memory 13 has changed from L to H, thereby detecting that the connection to the firmware memory 13 from the authorized debugger has been lost.

[0068] (B) Operation The process performed by the BMC 10 according to the embodiment configured as described above when a regular access is made from a regular debugger will be described with reference to the timing chart shown in FIG.

[0069] In this example, a regular debugger is connected to the debug pin 24, and data in a predetermined storage area of ​​the firmware memory 13 is read out.

[0070] In FIG. 3, the CS signal, the master output / slave input signal (MOSI1) of the BMC 10, and the master output / slave input signal (MOSI2) of the regular debugger are shown.

[0071] The BMC 10 (access determination unit 21) periodically performs monitoring access to the firmware memory 13.

[0072] The access judging unit 21 first sets CS to L in order to periodically monitor the monitoring area of ​​the firmware memory 13 (see symbol P1 in FIG. 3). The access judging unit 21 monitors the monitoring area of ​​the firmware memory 13 and checks whether a connection destination identifier has been written (see symbol P2 in FIG. 3). At this timing, the connection destination identifier has not yet been written to the monitoring area. After checking, the access judging unit 21 sets CS to H (see symbol P3 in FIG. 3).

[0073] Here, in order for the authorized debugger to access the firmware memory 13, it sets CS to L in order to write the connection destination identifier into the monitoring area of ​​the firmware memory 13 (see symbol P4 in FIG. 3). After that, the authorized debugger writes the connection destination identifier into the monitoring area of ​​the firmware memory 13 (see symbol P5 in FIG. 3). When writing of the connection destination identifier is completed, the authorized debugger sets CS to H (see symbol P6 in FIG. 3).

[0074] When the next timing for regular monitoring of the monitoring area of ​​the firmware memory 13 arrives, the access judging unit 21 waits until CS becomes H, and when it detects that the regular debugger has set CS to H (see symbol P6 in FIG. 3), it sets CS to L (see symbol P7 in FIG. 3). The access judging unit 21 monitors the monitoring area of ​​the firmware memory 13 and confirms that the connection destination identifier has been written (see symbol P8 in FIG. 3).

[0075] Since the connection destination identifier is stored in the monitoring area, the access determination unit 21 determines that a legitimate access has been made to the firmware memory 13. The access control unit 22 does not block access by the device (legitimate device) to the firmware memory 13. The access determination unit 21 sets CS to H, thereby putting the firmware memory 13 into an access-permitted state (see symbol P9 in FIG. 3).

[0076] The access control unit 22 waits until CS is set to H by the authorized debugger after it reaches the next timing for regular monitoring of the monitoring area of ​​the firmware memory 13. When the access control unit 22 detects that the authorized debugger is no longer connected to the firmware memory 13 and CS has become H (see reference symbol P10 in FIG. 3), it sets CS to L (see reference symbol P11 in FIG. 3) and then erases the connection destination identifier in the identification area of ​​the firmware memory 13. After that, the access control unit 22 sets CS to H (see reference symbol P12 in FIG. 3).

[0077] The official debugger sets CS to L in order to connect to the firmware memory 13 (see symbol P13 in FIG. 3). The official debugger makes valid access to the storage area to be accessed in the firmware memory 13, and executes data reading (see symbol P14 in FIG. 3). When the official debugger completes reading the data from the firmware memory 13, it sets CS to H (see symbol P15 in FIG. 3).

[0078] The access determining unit 21 resumes regular monitoring of the monitoring area of ​​the firmware memory 13, and repeatedly executes the process from reference symbol P1 onwards.

[0079] Next, a process performed by the BMC 10 according to an embodiment when an illegal access is made from an illegal debugger will be described with reference to a timing chart shown in FIG.

[0080] In this example, an unauthorized debugger is connected to the debug pin 24 and an attempt is made to illegally read data in a predetermined storage area of ​​the firmware memory 13.

[0081] In FIG. 4, the CS signal, the master output / slave input signal (MOSI1) of the BMC 10, and the master output / slave input signal (MOSI2) of the irregular debugger are shown.

[0082] The BMC 10 periodically monitors and accesses the firmware memory 13 .

[0083] The access judging unit 21 first sets CS to L (see symbol P1 in FIG. 4) in order to periodically monitor the monitoring area of ​​the firmware memory 13. The access judging unit 21 monitors the monitoring area of ​​the firmware memory 13 and checks whether a connection destination identifier has been written (see symbol P2 in FIG. 4). After checking, the access judging unit 21 sets CS to H (see symbol P3 in FIG. 4).

[0084] Here, the unauthorized debugger sets CS to L in order to access the firmware memory 13 for the purpose of hacking or the like (see symbol P4 in FIG. 4). At this time, the unauthorized debugger accesses the firmware memory 13 without writing a connection destination identifier in the monitoring area of ​​the firmware memory 13 (see symbol P5 in FIG. 4). The unauthorized debugger sets CS to H in order to put the firmware memory 13 into an access permitted state (see symbol P6 in FIG. 4).

[0085] When the next timing for regular monitoring of the monitoring area of ​​the firmware memory 13 arrives, the access judging unit 21 waits until CS becomes H, and when it detects that the unauthorized debugger has set CS to H (see symbol P6 in FIG. 3), it sets CS to L (see symbol P7 in FIG. 4). The access judging unit 21 monitors the monitoring area of ​​the firmware memory 13 and confirms that a connection destination identifier has not been written (see symbol P8 in FIG. 4).

[0086] Since the connection destination identifier is not stored in the monitoring area, the access determination unit 21 determines that an unauthorized access has been made to the firmware memory 13. The access control unit 22 blocks access by the device (unauthorized device) to the firmware memory 13. Specifically, the access determination unit 21 sets the firmware memory 13 in an access-prohibited state by keeping CS in the L state (see symbol P9 in FIG. 4).

[0087] Since the irregular debugger cannot set CS of the firmware memory 13 to L by itself, the irregular debugger is maintained in a state in which its connection to the firmware memory 13 is inhibited.

[0088] Incidentally, the access determining unit 21 may also determine whether or not a connection destination identifier has been written in the identification area in the firmware memory 13 at the timing when an access made to the firmware memory 13 is detected.

[0089] (C) Effects Thus, according to the BMC 10 of one embodiment, the access determination unit 21 determines whether a connection destination identifier has been written to the identification area of ​​the firmware memory 13. If the connection destination identifier has been written, the access control unit 22 permits access to the firmware memory 13. On the other hand, if the connection destination identifier has not been written to the identification area, the access control unit 22 determines that the access is an unauthorized access and blocks the access to the firmware memory 13.

[0090] It is possible to determine whether the access is from a legitimate device or an unauthorized device by determining whether a connection destination identifier has been written to the identification area of ​​the firmware memory 13. Therefore, even in a state where the firmware memory 13 and the debugger are directly connected, it is possible to distinguish between access by a legitimate debugger and unauthorized access (hacking) by an unauthorized debugger.

[0091] It is possible to realize protection of data in the firmware memory 13 at low cost without providing security circuit components between the firmware memory 13 and the debugger.

[0092] In addition, when unauthorized access (hacking) is made to the firmware memory 13 from an unauthorized debugger, the access control unit 22 blocks access to the firmware memory 13, thereby preventing unauthorized access to the firmware memory 13 and improving security.

[0093] The access control unit 22 can easily block access to the firmware memory 13 by an unauthorized debugger by setting CS of the firmware memory 13 to L.

[0094] (D) Other The configurations and processes of this embodiment may be selected as necessary, or may be combined as appropriate.

[0095] The disclosed technology is not limited to the above-described embodiment, but can be implemented in various modifications without departing from the spirit of the present embodiment.

[0096] Furthermore, the above disclosure enables a person skilled in the art to implement and manufacture the present embodiment.

[0097] (E) Notes Regarding the above embodiment, the following supplementary notes are further disclosed.

[0098] (Appendix 1) A control device directly connected to a memory unit by a bus, an access determination unit that determines whether predetermined information is written in the storage unit; an access control unit that permits access to the storage unit when the predetermined information is written, and that determines that the access is an unauthorized access when the predetermined information is not written, and blocks the access to the storage unit; A control device comprising:

[0099] (Appendix 2) A data access pin is formed on the bus for a device to access the storage unit; The access determination unit periodically determines whether the predetermined information has been written at an interval determined to be equal to or longer than the time required for a legitimate device to complete writing of the predetermined information to the storage unit. 2. The control device according to claim 1 .

[0100] (Appendix 3) When an access to the storage unit is detected, the access determination unit determines whether or not predetermined information has been written in the storage unit. 3. The control device according to claim 1 or 2.

[0101] (Appendix 4) The bus performs communication based on SPI (Serial Peripheral Interface). 2. The control device according to claim 1 .

[0102] (Appendix 5) In a control device directly connected to a memory unit by a bus, determining whether predetermined information has been written in the storage unit; If the predetermined information is written, access to the storage unit is permitted, and if the predetermined information is not written, the access is determined to be an unauthorized access and the access to the storage unit is blocked. A control method, characterized in that a control unit executes a process.

[0103] (Appendix 6) A data access pin is formed on the bus for a device to access the storage unit; The control unit: Whether the predetermined information has been written is determined periodically at intervals determined to be equal to or longer than the time required for a regular device to complete writing of the predetermined information to the storage unit. 6. The control method according to claim 5, further comprising the step of:

[0104] (Appendix 7) The control unit: When an access to the storage unit is detected, it is determined whether or not predetermined information has been written to the storage unit. 7. The control method according to claim 5 or 6, further comprising the step of:

[0105] (Appendix 8) The bus performs communication based on SPI (Serial Peripheral Interface). 6. The control method according to claim 5,

[0106] (Appendix 9) A control device having a processor and directly connected to a memory unit by a bus, determining whether predetermined information has been written in the storage unit; If the predetermined information is written, access to the storage unit is permitted, and if the predetermined information is not written, the access is determined to be an unauthorized access and the access to the storage unit is blocked. A control program for causing the processor to execute a process.

[0107] (Appendix 10) A data access pin is formed on the bus for a device to access the storage unit; Whether the predetermined information has been written is determined periodically at intervals determined to be equal to or longer than the time required for a regular device to complete writing of the predetermined information to the storage unit. 10. The control program according to claim 9, further comprising: causing the processor to execute a process.

[0108] (Appendix 11) When an access to the storage unit is detected, it is determined whether or not predetermined information has been written to the storage unit. 11. The control program according to claim 9 or 10, which causes the processor to execute a process.

[0109] (Appendix 12) The bus performs communication based on SPI (Serial Peripheral Interface). 10. The control program according to claim 9, [Explanation of symbols]

[0110] 1 System Board 10 BMC 11 Processors 12. Memory 13 Firmware Memory 14 CPU 15 DIMM 16 FAN 17 HDD 18 PCIe Cards 19 PSU 20 Multiplexer 21 Access Judgment Unit 22 Access control section 23 Bus 24 Debug Pin

Claims

1. A control device directly connected to a memory unit by a bus, an access determination unit that determines whether predetermined information is written in the storage unit; an access control unit that permits access to the storage unit when the predetermined information is written, and that determines that the access is an unauthorized access when the predetermined information is not written, and blocks the access to the storage unit; A control device comprising:

2. A data access pin is formed on the bus for a device to access the storage unit; The access determination unit periodically determines whether the predetermined information has been written at an interval determined to be equal to or longer than the time required for a legitimate device to complete writing of the predetermined information to the storage unit. The control device according to claim 1 .

3. When an access to the storage unit is detected, the access determination unit determines whether or not predetermined information has been written in the storage unit.

3. The control device according to claim 1 or 2.

4. The bus performs communication based on the SPI (Serial Peripheral Interface). The control device according to claim 1 .

5. In a control device directly connected to a memory unit by a bus, determining whether predetermined information has been written in the storage unit; If the predetermined information is written, access to the storage unit is permitted, and if the predetermined information is not written, the access is determined to be an unauthorized access and the access to the storage unit is blocked. A control method, characterized in that a control unit executes a process.

6. A control device having a processor and directly connected to a memory unit by a bus, determining whether predetermined information has been written in the storage unit; If the predetermined information is written, access to the storage unit is permitted, and if the predetermined information is not written, the access is determined to be an unauthorized access and the access to the storage unit is blocked. A control program for causing the processor to execute a process.

Images