Image processing apparatus and rewrite protection execution control method

Abstract

To provide an image processing apparatus or the like capable of maintaining a base point of reliability related to verification of firmware in an appropriate state.SOLUTION: An image processing apparatus including: a setting unit configured to perform one of a first security setting and a second security setting different from the first security setting on the image processing apparatus; a storage unit configured to store firmware and a verification program for verifying whether the firmware has been tampered with; and a control unit configured to control execution of rewrite protection on a partial storage area having the verification program according to the first security setting or the second security setting setting on the image processing apparatus.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present disclosure relates to an image processing device and the like. [Background technology]

[0002] For example, in order for a hardcopy device such as a multifunction printer to obtain Common Criteria (CC) certification, it is necessary to satisfy the security requirements stipulated in the collaborative Protection Profile for Hardcopy Devices (HCDcPP).

[0003] The security requirements specified in the HCDcPP include secure boot, which is one of the security functions that restricts the execution of the boot process if tampering or damage to the firmware is detected during device boot-up.

[0004] For example, Patent Document 1 discloses an information processing device that reduces the time required to verify whether firmware has been tampered with. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2022-182838 A Summary of the Invention [Problem to be solved by the invention]

[0006] An object of the present disclosure is to provide an image processing device and the like that is capable of maintaining the root of trust related to firmware verification in an appropriate state. [Means for solving the problem]

[0007] In order to solve the above problems, the image processing device of the present disclosure is characterized in that it includes a setting unit that sets either a first security setting or a second security setting different from the first security setting for the image processing device, a memory unit that stores firmware and a verification program for verifying whether the firmware has been tampered with, and a control unit that controls the execution of rewrite protection for a portion of the memory area including the verification program in accordance with the first security setting or the second security setting set for the image processing device.

[0008] In addition, the method of controlling the execution of write protection according to the present disclosure is characterized in that it stores firmware and a verification program for verifying whether the firmware has been tampered with, and controls the execution of write protection for a portion of a memory area including the verification program in accordance with a first security setting set for an image processing device or a second security setting different from the first security setting. Effect of the Invention

[0009] According to the present disclosure, it is possible to provide an image processing device and the like that is capable of maintaining the root of trust related to firmware verification in an appropriate state. [Brief description of the drawings]

[0010] [Figure 1] 1 is an external perspective view of a multifunction peripheral according to a first embodiment; [Diagram 2] FIG. 2 is a diagram illustrating a functional configuration according to the first embodiment. [Diagram 3] FIG. 2 is a diagram illustrating a memory map of a non-volatile memory. [Figure 4] 4 is a flowchart illustrating a process flow according to the first embodiment. [Diagram 5] 4 is a flowchart illustrating a process flow according to the first embodiment. [Figure 6] FIG. 4 is a diagram illustrating an operation example according to the first embodiment. [Figure 7] FIG. 4 is a diagram illustrating an operation example according to the first embodiment. [Figure 8] FIG. 4 is a diagram illustrating an operation example according to the first embodiment. [Figure 9] 10 is a flowchart illustrating a process flow according to the second embodiment. [Figure 10] 10 is a flowchart illustrating a process flow according to the second embodiment. [Figure 11] FIG. 11 is a diagram illustrating an operation example according to the second embodiment. [Figure 12] 11 is a diagram for explaining a combination of verification flags and write protection conditions for implementing secure boot. FIG. [Figure 13] FIG. 13 is a diagram illustrating a modified example. [Figure 14] FIG. 1 is a diagram illustrating the advantages of a secure boot according to the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. Note that the following embodiments are merely examples for explaining the present disclosure, and the technical content of the description described in the claims is not limited to the following description.

[0012] CC certification is a system for evaluating IT products based on the international security evaluation standard ISO / IEC15408. CC certification is carried out to ensure security in government procurement of civilian products. CC certification is an international system currently mutually recognized by 31 countries.

[0013] In CC certification, the validity of security functions and the correctness of implementation are evaluated by a third party (evaluation organization). The third party confirms that the evaluation was conducted based on CC.

[0014] For example, for hard copy devices such as multifunction copiers, the HCDcPP is defined as a security requirement specification for obtaining CC certification. The HCDcPP includes secure boot, which is one of the requirements for conformance with the HCDcPP.

[0015] Secure boot is a security function that restricts the execution of the boot process if firmware tampering / damage is detected during device boot. In secure boot, in order to detect firmware tampering / damage, the program code that is executed first and the encrypted data used for verification are rewritten and protected by hardware as the root of trust.

[0016] The root of trust is unconditionally trusted, and any program code verified by a program (code) related to that root of trust is consequently trusted.

[0017] Conventionally, a portion of the non-volatile memory that stores firmware is protected from rewriting as initial code that serves as the base of trust, and therefore, if there was a defect in the initial code or in the event of a failure, it was not possible to rewrite the non-volatile memory to modify the program code related to the initial code.

[0018] In the present disclosure, an image processing device or the like capable of maintaining the root of trust related to firmware verification in an appropriate state is realized in the following embodiments.

[0019] [1 First embodiment] [1.1 Functional configuration] Fig. 1 is a perspective view illustrating the overall configuration of a multifunction peripheral 10 as an image processing apparatus according to a first embodiment of the present invention. Fig. 2 is a functional configuration diagram of the multifunction peripheral 10.

[0020] The multifunction device 10 is an example of an image processing device capable of performing various types of jobs such as printing, copying, faxing, image transmission, etc., in a single housing. Note that the image processing device according to the present disclosure is not limited to the multifunction device 10, and may be, for example, an image processing device specialized for a specific function such as a printer or fax.

[0021] The multifunction device 10 includes a control unit 11, a display unit 13, an operation input unit 15, a communication unit 17, a second storage unit 19, an image forming unit 21, and an image input unit 23 as functional units.

[0022] The control unit 11 controls the entire multifunction device 10. The control unit 11 includes a processing unit 111 including one or more processing devices (e.g., a CPU (Central Processing Unit), a SoC (System on a Chip), etc.), and a first storage unit 113 that stores firmware related to the control unit 11. The processing unit 111 can function as the control unit 11 by controlling the driving of the hardware that constitutes the control unit 11 based on the firmware.

[0023] The processing unit 111 verifies the firmware by reading out the verification program code stored in the first storage unit 113 in response to an input of an instruction to start the multifunction device 10. The verification program code has the leading code specified as the execution start address on a memory map of the first storage unit 113, which will be described later. When an instruction to start the multifunction device 10 is input, the processing unit 111 first reads out the verification program code, thereby functioning as a verification program and executing firmware verification.

[0024] Here, firmware verification according to the present disclosure is intended to determine whether or not to permit the start (operation) of hardware based on the firmware, based on a process for detecting tampering or damage to the firmware. In the present disclosure, a case in which firmware verification permits the start (operation) of hardware based on the firmware is expressed as firmware verification being successful. On the other hand, a case in which firmware verification does not permit the start (operation) of hardware based on the firmware is expressed as firmware verification being unsuccessful.

[0025] For example, a digital signature method using a public key can be used to verify the firmware. In the digital signature method, the software developer calculates a hash value of the entire firmware and signs it using a private key. The firmware and the signature are written (stored) in the first storage unit 113 at the time of shipment from the factory or when the firmware is updated.

[0026] When the multifunction device 10 is started up, the processing unit 111 compares a hash value calculated from the entire firmware with a hash value obtained by decrypting the signature using the public key. If the hash value of the entire firmware calculated at start-up matches the hash value obtained by decrypting the signature, the processing unit 111 determines that the firmware verification has been successful. On the other hand, if the hash value of the entire firmware calculated at start-up does not match the hash value obtained by decrypting the signature, the processing unit 111 determines that the firmware verification has failed.

[0027] If it is determined that the firmware verification has been successful, the processing unit 111 executes the start-up process based on the firmware. On the other hand, if it is determined that the firmware verification has failed, the processing unit 111 does not execute the start-up process based on the firmware. In this case, the processing unit 111 can display an error number related to the firmware failure and the error content on a touch panel or the like described later, and notify the user of the multifunction device 10 that the firmware verification has failed. The processing unit 111 can also display contact information for customer service on the touch panel. Furthermore, if a backup firmware is prepared separately from the firmware related to the verification, the processing unit 111 may restore the firmware for which the verification has failed from the backup firmware.

[0028] The first storage unit 113 is one or more storage devices that store at least a verification program code, a public key, firmware, and a signature of the firmware. There is no limitation on the type and configuration of the storage device as long as the contents written once cannot be rewritten later (referred to as rewrite protection in this disclosure). As the first storage unit 113, for example, a non-volatile memory such as a mask ROM (Read Only Memory), a PROM (Programmable ROM), an EPROM (Erasable Programmable ROM), an EEPROM (Electrically Erasable and Programmable ROM), a flash memory, an MRAM (Magnetoresistive Random Access Memory), or a FRAM (Ferroelectric Random Access Memory) (registered trademark) can be used.

[0029] Here, an example of a memory map of the first storage unit 113 according to the present disclosure will be described with reference to Fig. 3. Fig. 3 is an image diagram showing firmware and the like being memory-mapped in a non-volatile memory serving as the first storage unit 113.

[0030] As shown in FIG. 3, the first storage unit 113 stores a firmware signature 1131, firmware 1133, a verification program code 1135, and a public key 1137.

[0031] In the first embodiment, a part of the storage area of ​​the first storage unit 113 including the verification program code 1135 and the public key 1137 is set as a target area for rewrite protection.

[0032] In the first embodiment, execution of the write protection for the target area of ​​the write protection is controlled in accordance with a first security setting or a second security setting (to be described later) for the multifunction device 10. Details will be described later.

[0033] 2, the display unit 13 is a display device that displays various information to a user, etc. The display unit 13 can be configured, for example, by an LCD (Liquid Crystal Display), an organic EL (Electro-Luminescence) display, or the like.

[0034] The operation input unit 15 is an input device that accepts information input by a user or the like. The operation input unit 15 can be configured with various input devices such as operation keys such as hard keys and software keys, and buttons. The operation input unit 15 can be configured as a touch panel that allows input via the display unit 13. In this case, the input method of the touch panel can be a general method such as a resistive film method, an infrared method, an electromagnetic induction method, or a capacitance method.

[0035] The communication unit 17 includes a wired / wireless interface or both for communicating with other devices (terminal device 30) via a network NW such as a LAN (Local Area Network), a WAN (Wide Area Network), the Internet, a telephone line, a fax line, etc. The communication unit 17 may also include an interface related to (short-distance) wireless communication technology such as Bluetooth (registered trademark), NFC (Near field communication), Wi-Fi (registered trademark), ZigBee (registered trademark), IrDA (Infrared Data Association), and wireless USB.

[0036] The second storage unit 19 is one or more storage devices that store various programs and various data necessary for the operation of the multifunction device 10. The second storage unit 19 can be configured with storage devices such as a RAM (Random Access Memory), an HDD (Hard disk Drive), an SSD (Solid State Drive), and a ROM (Read Only Memory).

[0037] In the first embodiment, the second storage unit 19 stores a security setting program 191 and an authentication program 193.

[0038] The security setting program 191 is a program that the control unit 11 reads out when receiving a setting input related to security to be implemented on the multifunction device 10. The control unit 11 that reads out the security setting program 191 functions as a setting unit and receives a setting instruction for a first security setting from an administrator (user) via a system setting screen described later. When receiving an instruction to select the first security setting from the administrator (user), the control unit 11 transitions the security state for the multifunction device 10 to a high security state. Here, the high security state refers to at least a security level in which the security state implemented on the multifunction device 10 satisfies the requirements for executing secure boot. On the other hand, in this disclosure, a setting that implements security of a non-security state that is lower than the high security state or in which no security is implemented on the multifunction device 10 is referred to as a second security setting.

[0039] The authentication program 193 is a program that the control unit 11 reads out when authenticating a user who attempts to log in to the multifunction device 10. The control unit 11 that reads out the authentication program 193 operates as an authentication unit that operates based on a user authentication function. When the user authentication function is enabled, the control unit 11 displays a login screen (not shown) on the touch panel and accepts input of authentication information related to user authentication by the user. For example, when the authentication condition is a combination of a login user name and a login password, the control unit 11 performs user authentication by previously storing the login user name and the login password related to the user authentication in association with each other, and collating the login user name and the login password input via the login screen. Note that the user authentication can be performed by, in addition to knowledge authentication that combines the login user name and the login password, for example, possession authentication using a token, a key, an IC (Integrated circuit) card, a smartphone, or biometric authentication such as face authentication or fingerprint authentication. Note that the control unit 11 can accept a setting of enabling / disabling the user authentication function from an administrator having management authority via a system setting screen or the like described later.

[0040] The image forming unit 21 feeds paper from a paper feed tray 25, forms an image of image information related to a print job or the like on the paper, and then discharges the paper to a paper discharge tray 27. The image forming unit 21 can be configured, for example, with a laser printer or the like that utilizes an electrophotographic method. In this case, the image forming unit 21 forms an image using toner supplied from a toner cartridge (not shown) that corresponds to a toner color (for example, cyan, magenta, yellow, black, etc.).

[0041] In addition to hardware necessary for image formation, image forming unit 21 includes a processing unit 211 that controls the operation of the hardware, and a first storage unit 213 that stores firmware related to image forming unit 21. Processing unit 211 can function as image forming unit 21 by controlling the operation of the hardware necessary for image formation based on the firmware.

[0042] The configuration of the processing unit 211 can be the same as that of the processing unit 111 associated with the control unit 11. The configuration of the first storage unit 213 differs only in the firmware it stores, and other configurations can be the same as those of the first storage unit 113 associated with the control unit 11. Therefore, the description of the processing unit 211 and the first storage unit 213 will be omitted here.

[0043] The image input unit 23 generates image information by scanning an original. The image input unit 23 can be configured as an automatic document feeder (ADF) equipped with an image sensor such as a charge coupled device (CCD) or a contact image sensor (CIS) and equipped with a function of simultaneously reading both sides of an original, or as a scanner device having a flatbed for placing and reading an original. There is no particular limitation on the configuration of the image input unit 23 as long as it is configured to generate image information by reading a reflected light image from an original image with an image sensor. The image input unit 23 can also be configured as an interface capable of acquiring document information stored in an external storage medium such as a universal serial bus (USB) memory, or image information included in a print job transmitted from an external device.

[0044] In addition to hardware necessary for image input, image input unit 23 includes a processing unit 231 that controls the driving of the hardware, and a first storage unit 233 that stores firmware related to image input unit 23. Processing unit 231 can function as image input unit 23 by controlling the driving of the hardware necessary for image input based on the firmware.

[0045] The configuration of the processing unit 231 can be the same as that of the processing unit 111 associated with the control unit 11. The configuration of the first storage unit 233 differs only in the firmware it stores, and other configurations can be the same as that of the first storage unit 113 associated with the control unit 11. Therefore, the description of the processing unit 231 and the first storage unit 233 will be omitted here.

[0046] [1.2 Processing flow] Next, a process flow according to the first embodiment will be described. Fig. 4 is a flowchart for explaining execution control of rewrite protection according to the first embodiment. The control unit 11 of the multifunction device 10 executes the process according to Fig. 4 by reading out the security setting program 191 stored in the second storage unit 19.

[0047] In the first embodiment, it is assumed that write protection is not performed on the memory area to be write-protected, which includes the verification program code 1135 and the public key 1137 illustrated in FIG. 3, at least at the time of shipment from the factory or during firmware update.

[0048] When the process starts, the control unit 11 checks the security state of the multifunction device 10 (step S100). If the control unit 11 determines that the security state of the multifunction device 10 has transitioned to a high security state, the control unit 11 executes write protection for the storage area to be write-protected, which includes the verification program code 1135 and the public key 1137 (step S110; Yes→step S120).

[0049] On the other hand, if the control unit 11 determines that the security state of the multifunction device 10 has not transitioned to the high security state, it restricts rewriting of the storage area that is the object of rewriting protection (step S110; No→step S130), and ends the process.

[0050] In the first embodiment, rewriting of the storage area that is the object of rewrite protection is not restricted from the time of shipment from the factory or the time of updating the firmware until the security state of the multifunction device 10 is changed to high security. During this period, if a defect or the like is found in the verification program code 1135, for example, the administrator (user) can correct the verification program code 1135.

[0051] Then, when the administrator (user) sets the security setting for the multifunction device 10 to the first security setting and the security state of the multifunction device 10 transitions to a high security state, the control unit 11 rewrites and protects the storage area that is the object of rewrite protection. After the security state of the multifunction device 10 transitions to the high security state, the verification program code 1135 and the like related to the storage area that is the object of rewrite protection cannot be changed, and therefore can be trusted as a base of trust. And the firmware verified by the verification program that is the base of trust can be trusted.

[0052] Next, the start-up process of the processing unit 111 according to the verification result of the firmware 1133 will be described with reference to the flowchart of FIG.

[0053] Note that the verification of firmware in each of the functional units of the control unit 11, the image forming unit 21, and the image input unit 23 can be executed similarly between the functional units. Therefore, in the following description, the verification of firmware in the control unit 11 will be described as an example.

[0054] When an instruction to start the multifunction device 10 is input, the processing unit 111 of the control unit 11 reads the verification program code 1135 and starts verification of the firmware 1133 (step S200).

[0055] The processing unit 111 judges whether or not the verification of the firmware 1133 has been successful (step S210). If the processing unit 111 judges that the verification of the firmware has been successful, the processing unit 111 starts the startup process based on the firmware 1133 and ends the process (step S210; Yes->step S220). On the other hand, if the processing unit 111 judges that the verification of the firmware has failed, the processing unit 111 restricts the startup process based on the firmware 1133 and ends the process (step S210; No->step S230).

[0056] 5 illustrates an embodiment in which the verification of firmware in each of the functional units, the control unit 11, the image forming unit 21, and the image input unit 23, is executed by processing units 111, 211, and 231 of each functional unit. The verification of firmware in each functional unit can be executed serially, for example, in the order of the control unit 11, the image forming unit 21, and the image input unit 23, upon receiving an instruction to start the multifunction device 10. The verification of firmware in each functional unit may also be executed simultaneously (in parallel) upon receiving an instruction to start the multifunction device 10.

[0057] Incidentally, when the processing unit 111 of the control unit 11 supports multi-threading, the verification of the firmware of the image forming unit 21 and the image input unit 23 may be executed by the processing unit 111 of the control unit 11. In this case, it is preferable that the processing unit 111 of the control unit 11 restricts the start of the processing unit 211 of the image forming unit 21 and the processing unit 231 of the image input unit 23 until the verification of the firmware of the image forming unit 21 and the image input unit 23 is successful.

[0058] Furthermore, a processing unit (microcomputer) that exclusively performs firmware verification may be provided in addition to processing unit 111 of control unit 11, processing unit 211 of image forming unit 21, and processing unit 231 of image input unit 23, and the processing unit (microcomputer) may be made to perform verification of firmware related to each functional unit of control unit 11, image forming unit 21, and image input unit 23.

[0059] In this disclosure, the firmware to be verified has been described as firmware related to the control unit 11, image forming unit 21, and image input unit 23, but it is also possible to add firmware related to other functional units, such as functional units related to fax and image transmission, as targets for firmware verification.

[0060] [1.3 Example of operation] Next, an operation example according to the first embodiment will be described. Fig. 6 shows a state in which a part of the storage area of ​​the first storage unit 113 including the verification program code 1135 and the public key 1137 is protected as a protected area R10 as the multifunction device 10 transitions to a high security state in the memory map of the first storage unit 113 shown in Fig. 3.

[0061] A storage area including the verification program code 1135 and the public key 1137 is protected as the protected area R10, and the verification program code 1135 etc. are trusted as the root of trust. The verification program code 1135 and the public key 1137, which are the root of trust, are used to verify the firmware 1133. If the processing unit 111 successfully verifies the firmware, the execution requirements for secure boot are satisfied, and the processing unit 111 can start the startup process based on the firmware.

[0062] FIG. 7(a) is a diagram illustrating an example of the screen configuration of a system setting screen W10 that accepts a setting instruction for the first security setting by an administrator (user).

[0063] The system setting screen W10 includes an execute button B10 that accepts an instruction to execute advanced security settings as the first security settings. The advanced security settings via the system setting screen W10 can be enabled by an administrator (user) having administrator authority who has been authenticated by an authentication unit of the multifunction device 10.

[0064] When the execute button B10 is selected by the administrator (user), the system setting screen W10 transitions to a system setting screen W20 illustrated in FIG. 7(b).

[0065] The system setting screen W20 includes a Yes button B12 and a No button B14, in addition to a notice for when the multifunction device 10 transitions to a high security state.

[0066] The Yes button B12 is a button for receiving consent from the administrator (user) who has confirmed the notice. When the Yes button B12 is selected by the administrator (user), the control unit 11 sets the first security setting in the multifunction device 10. On the other hand, the No button B14 is a button for receiving a cancellation instruction from the administrator (user). When the No button B14 is selected by the administrator (user), the control unit 11 does not set the first security setting for the multifunction device 10 and ends the process.

[0067] 8 is a display configuration example of a confirmation screen W30 for confirming the security status of the multifunction device 10. The confirmation screen W30 can be viewed not only by the administrator (user) but also by general users and guest users. When the system information button B16 is selected by the user, the control unit 11 displays the confirmation screen W30. The confirmation screen W30 can display the security status of the multifunction device 10 (e.g., "High security status") together with the name of the optional device (e.g., "Data Security Kit (AAA-BBBB)") if the installation of an optional device is required to set the first security setting.

[0068] In the first embodiment, rewriting of the storage area that is the object of rewriting protection is not restricted from the time of shipment from the factory or the time of updating the firmware until the security state of the multifunction device is changed to the high security state. Therefore, for example, if a defect or the like is found in the verification program code, the administrator (user) can correct the verification program code.

[0069] When the administrator (user) sets the security setting for the multifunction device to the first security setting and the security state of the multifunction device transitions to a high security state, the control unit rewrites and protects the storage area that is the object of rewrite protection. After the security state of the multifunction device transitions to the high security state, the verification program code and the like related to the storage area that is the object of rewrite protection cannot be changed, so that the reliability as the base of trust can be obtained.

[0070] As described above, according to the first embodiment, the root of trust related to firmware verification can be maintained in an appropriate state, and a secure boot based on the root of trust can be realized.

[0071] [2 Second embodiment] The second embodiment is an embodiment in which a verification flag is provided as setting information for determining whether or not verification of firmware based on a verification program can be performed in the first embodiment.

[0072] [2.1 Functional configuration] The functional configuration of the multifunction device according to the second embodiment can be similar to the functional configuration of the multifunction device 10 according to the first embodiment. Therefore, the description of the functional configuration of the multifunction device 10 according to the second embodiment will be omitted, and the same reference numerals as in the first embodiment will be used for the description.

[0073] [2.2 Processing flow] The process flow relating to the execution control of rewrite protection according to the second embodiment is obtained by replacing the flowchart in Fig. 4 with the flowchart in Fig. 9. Therefore, the same processes are given the same step numbers and their explanations are omitted, and only the differences will be explained.

[0074] When the control unit 11 of the multifunction device 10 determines that the security state of the multifunction device 10 has transitioned to high security, it sets the value of the verification flag to valid (step S110; Yes→step S140).

[0075] Here, the verification flag is a flag identifier for the processing unit 111 to determine whether or not to execute verification of the firmware 1133 based on the verification program code 1135. When the value of the verification flag is set to valid, the processing unit 111 executes verification of the firmware 1133 based on the verification program code 1135. On the other hand, when the value of the verification flag is set to invalid, the processing unit 111 omits (avoids) execution of verification of the firmware 1133 based on the verification program code 1135.

[0076] The control unit 11 executes write protection for the storage area to be write-protected, including the verification program code 1135 and the public key 1137, together with the value (valid) of the verification flag (step S140→step S120).

[0077] On the other hand, if the control unit 11 determines that the security state of the multifunction device 10 has not transitioned to high security, it sets the value of the verification flag to invalid (step S110; No -> step S150).Then, the control unit 11 does not execute write protection for the storage area to be write-protected (step S130), and ends the process.

[0078] Next, the start-up process of the processing unit 111 in response to the verification result of the firmware 1133 according to the second embodiment will be described with reference to the flowchart of FIG.

[0079] The flow of the startup process of the processing unit 111 in response to the verification result of the firmware 1133 according to the second embodiment is obtained by replacing the flowchart of Fig. 5 with the flowchart of Fig. 10. Therefore, the same processes are given the same step numbers, their explanations are omitted, and only the differences will be explained.

[0080] When an instruction to start the multifunction device 10 is input, the processing unit 111 of the control unit 11 judges whether or not the value of the verification flag is valid (step S240). If it is judged that the value of the verification flag is valid, the processing unit 111 executes the verification of the firmware 1133 by the verification program code 1135 (step S240; Yes→step S200).

[0081] On the other hand, if it is determined that the value of the verification flag is invalid, the processing unit 111 omits (avoids) the verification of the firmware 1133 by the verification program code 1135, and starts the startup process based on the firmware 1133 (step S240; No->step S220).

[0082] [2.3 Example of operation] Next, an operation example according to the second embodiment will be described. Fig. 11 shows a state in which a part of the storage area of ​​the first storage unit 113 including the verification program code 1135, the public key 1137, and the verification flag 1139 is protected as a protected area R12 as the multifunction device 10 transitions to a high security state in the memory map of the first storage unit 113 shown in Fig. 3.

[0083] A portion of the storage area including the verification program code 1135, the public key 1137, and the verification flag 1139 is protected as a protected area R12, and thereby the verification program code 1135 etc. are trusted as a root of trust. The verification program code 1135 and the public key 1137, which are the root of trust, are used to verify the firmware 1133 based on the value of the verification flag 1139. If the verification of the firmware 1133 by the processing unit 111 is successful, the execution requirements for secure boot are satisfied, and the processing unit 111 can start the startup process based on the firmware 1133.

[0084] FIG. 12 is a diagram for explaining a combination of the verification flag 1139 and the write protection conditions for implementing a secure boot in the second embodiment.

[0085] For example, when the value of the verification flag 1139 is valid and the rewrite protection is enabled, the firmware 1133 is verified by the verification program code 1135 etc. that is protected against rewrites, and therefore this condition satisfies the requirements for executing secure boot.

[0086] If the value of the verification flag 1139 is valid and the write protection is disabled, the firmware 1133 is verified using the verification program code 1135 or the like that is not write-protected, and therefore this condition does not satisfy the requirements for executing secure boot.

[0087] If the value of the verification flag 1139 is invalid and the write protection is enabled, the firmware 1133 is not verified by the write-protected verification program code 1135 or the like, and therefore the condition does not satisfy the requirements for executing secure boot.

[0088] If the value of the verification flag 1139 is invalid and the write protection is disabled, the firmware 1133 is not verified by the verification program code 1135 or the like that is not write-protected, and therefore the condition does not satisfy the requirements for executing secure boot.

[0089] As illustrated in the example of FIG. 12, in the second embodiment, when the value of the verification flag 1139 is valid and rewrite protection is enabled, the requirements for executing secure boot can be met.

[0090] In the second embodiment, the verification flag 1139 is protected from rewriting as the protected area R12, so that the value of the verification flag 1139 cannot be rewritten. As a result, there is an advantage that the verification of the firmware 1133 cannot be circumvented when the multifunction device 10 transitions to a high security state.

[0091] On the other hand, in the second embodiment, by setting the value of the verification flag 1139 to invalid, it is also possible to restrict the execution of verification of the firmware 1133. According to the second embodiment, by restricting the execution of verification of the firmware 1133, it is also possible to reduce a delay in the startup time caused by the verification.

[0092] Furthermore, if the processing unit 111 of the control unit 11 supports multi-threading, for example, if the firmware 1133 is divided into multiple parts such as Boot / Main, it is possible to verify those sequences in parallel when verifying the firmware 1133, thereby expecting a reduction in verification time.

[0093] As described above, in the second embodiment, it is possible to control the execution of firmware verification based on the verification program code, based on the (value of the) verification flag. Therefore, according to the second embodiment, in addition to the effects of the first embodiment, it is possible to expect effects such as a reduction in the start-up time of the multifunction device.

[0094] [3 Variations] A modified example in which a storage area including a verification program code 1135 and a public key 1137 as a root of trust is rewriteably protected and a secure boot can be executed will be described with reference to FIG.

[0095] Figure 13 shows the memory map of the first memory unit 113 illustrated in Figure 3, in which a portion of the memory area of ​​the first memory unit 113 including the verification program code 1135 and the public key 1137 is protected as a protected area R10 at the time of factory shipment.

[0096] A storage area including the verification program code 1135 and the public key 1137 is protected as a protected area R10 at the time of shipment from the factory, and as a result, the verification program code 1135 etc. are trusted as a root of trust. The verification program code 1135 and the public key 1137, which are the root of trust, are used to verify the firmware 1133. If the verification of the firmware 1133 by the processing unit 111 is successful, the execution requirements for secure boot are satisfied, and the processing unit 111 can start the startup process based on the firmware 1133.

[0097] FIG. 14 is a table summarizing the advantages of the secure boot according to the first embodiment (secure boot (1)), the secure boot according to the second embodiment (secure boot (2)), and the secure boot according to the modified example (secure boot (3)).

[0098] Secure Boot (1), Secure Boot (2), and Secure Boot (3) are all secure boots that satisfy the security requirements defined in the HCDcPP.

[0099] In the secure boot (1) according to the first embodiment, rewriting of the storage area that is the object of rewrite protection is not restricted from the time of shipment from the factory or the time of updating the firmware until the security state of the multifunction device 10 transitions to a high security state. During this period, the verification program code 1135 can be corrected, so that the verification program code 1135 in which a defect has occurred can be restored.

[0100] In the secure boot (2) according to the second embodiment, in addition to the advantages associated with the secure boot (1), it is possible to switch whether or not to execute the verification of the firmware 1133 based on the verification program code 1135. In the secure boot (2), the execution of the verification of the firmware 1133 can be restricted by setting the value of the verification flag 1139 to invalid. By restricting the execution of the verification of the firmware 1133, it is also possible to reduce the delay in the startup time caused by the verification.

[0101] The present disclosure is not limited to the above-described embodiments, and various modifications are possible. In other words, the technical scope of the present disclosure also includes embodiments obtained by combining technical means that are appropriately modified within the scope of the gist of the present disclosure.

[0102] Although the above-described embodiments are described separately for convenience of explanation, they may be combined and executed within a technically feasible range.

[0103] In addition, the programs that run on each device in the embodiments are programs that control the CPU and the like (programs that make a computer function) so as to realize the functions of the above-mentioned embodiments. Information handled by these devices is temporarily stored in a temporary storage device (e.g., RAM) during processing, and is then stored in various storage devices such as ROMs (Read Only Memories) and HDDs, and is read, modified, and written by the CPU as necessary.

[0104] Here, the computer-readable non-transitory recording medium on which the program is recorded in the information processing device may be any of semiconductor media (e.g., ROM, non-volatile memory cards, etc.), optical recording media / magneto-optical recording media (e.g., DVD (Digital Versatile Disc), MO (Magneto Optical Disc), MD (Mini Disc), CD (Compact Disc), BD (Blu-ray (registered trademark) Disc, etc.)), magnetic recording media (e.g., magnetic tape, flexible disk, etc.), etc. In this case, the program recorded on the recording medium is read by the computer of the information processing device and executed by the computer to realize the functions of the above-mentioned embodiments, and the functions of the present disclosure are realized by processing in cooperation with an operating system or other application programs, etc. based on instructions from the program.

[0105] In addition, when distributing the program on the market, the program can be stored in a portable recording medium and distributed, or transferred to a server computer connected via a network such as the Internet. In this case, the storage device of the server computer is of course included in the present disclosure.

[0106] Also, each functional block or feature of the device used in the above-mentioned embodiment can be implemented and executed by an electric circuit, for example, an integrated circuit or a plurality of integrated circuits. The electric circuit designed to realize the functions described herein may include a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic device, discrete gate or trongistor logic, discrete hardware components, or a combination thereof. The general-purpose processor may be a microprocessor, or a conventional processor, controller, microcontroller, or state machine. The electric circuit described above may be composed of a digital circuit or an analog circuit. Also, when an integrated circuit technology that replaces the current integrated circuit appears due to the progress of semiconductor technology, one or more aspects of the present disclosure can use a new integrated circuit according to the technology. [Explanation of symbols]

[0107] 10 Multifunction device 11 Control section 111 Processing section 113 1st memory section 13 Display section 15 Operation input section 17 Communications Department 19 2nd memory section 191 Security Settings Program 193 Certification Program 21 Image forming section 211 Processing section 213 1st memory section 23 Image input section 231 Processing section 233 1st memory section

Claims

1. a setting unit that sets either a first security setting or a second security setting different from the first security setting for the image processing device; a storage unit that stores firmware and a verification program for verifying whether the firmware has been tampered with; An image processing device characterized by having a control unit that controls the execution of rewrite protection for a portion of a memory area including the verification program in accordance with the first security setting or the second security setting set for the image processing device.

2. The control unit is If the first security setting is set, the write protection is executed; 2. The image processing apparatus according to claim 1, wherein, when the second security setting is set, execution of the rewrite protection is restricted.

3. The setting unit is 3. The image processing apparatus according to claim 2, wherein the second security setting is set during a period from when the image processing apparatus is shipped from a factory until when the first security setting is set.

4. The storage unit is 2. The image processing apparatus according to claim 1, wherein setting information for determining whether the verification by the verification program is valid or invalid is stored in the partial storage area.

5. A processing unit that executes a startup process of the firmware, The processing unit includes: The image processing device according to claim 4, characterized in that, when the setting information is set to valid during the startup process of the image processing device, verification is performed using the verification program, and when the setting information is set to invalid, verification using the verification program is omitted and the firmware is started.

6. The firmware includes:

2. The image processing apparatus according to claim 1, further comprising firmware relating to an image input unit or an image forming unit in addition to the firmware relating to the control unit.

7. storing firmware and a verification program for verifying whether the firmware has been tampered with; A method for controlling execution of write protection for a portion of a memory area including the verification program, in accordance with a first security setting set for an image processing device or a second security setting different from the first security setting.

Images