Information processing device and starting method of information processing device

Abstract

To make it possible to easily and appropriately start an information processing device when verification of a software image has failed at starting of the information processing device.SOLUTION: In an information processing device 1, controllers 10-1 and 10-2 include a CPU20 and FPGA30 and respectively SPI-ROM40, 50. The SPI-ROM50 stores an SPI-ROM image 51. The SPI-ROM40 memorizes an electronic signature and a public key 42. FPGA30-1 and 30-2 of respective controllers 10-1 and 10-2 are configured to acquire the electronic signature and a public key at starting of the information processing device 1, and verifies presence or absence of an alteration of an SPI ROM image 51. The FPGA30-1 of the controller 10-1 in which an alteration has been detected acquires the SPI-ROM image via the FPGA30-2 of the controller 10-2 in which absence of the alteration has been detected, and the operation of CPU-20-1 is started.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a technique for safely starting up an information processing device. [Background technology]

[0002] A conventional technology for safely booting an information processing device is known as a secure boot, which verifies whether firmware or other data has been tampered with and boots the information processing device if no tampering is detected. For example, if firmware tampering is detected and the secure boot fails, the information processing device cannot be booted. If the secure boot fails, the information processing device must be replaced or a recovery operation using a special tool or the like must be performed, which takes a long time to recover.

[0003] In response to this, Patent Document 1 discloses a technology in which a computer system is provided with a first controller and a second controller, the first controller writes a firmware image to the second controller, and the security of the written firmware image can be verified. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] U.S. Patent No. 10,740,468 Summary of the Invention [Problem to be solved by the invention]

[0005] In the technology disclosed in Patent Document 1, the first controller writes firmware to the second controller and verifies its security, which places a burden on the first controller. Also, a configuration must be prepared for accessing the second controller from the first controller.

[0006] The present invention has been made in consideration of the above circumstances, and its purpose is to provide a technology that can easily and appropriately start up an information processing device when verification of a software image fails when the information processing device is started up. [Means for solving the problem]

[0007] In order to achieve the above-mentioned object, an information processing device according to one aspect is an information processing device having a plurality of control devices, each of which is equipped with a processor, a processing circuit, a first storage device, and a second storage device, and the second storage device stores a software image to be executed by the processor, and the first storage device stores an electronic signature and a public key for verifying whether the software image has been tampered with, and the processing circuit of each control device acquires the electronic signature and public key from the first storage device when the information processing device is started, and verifies whether the software image stored in the second storage device has been tampered with, and the first processing circuit of a first control device that detects that the software image has been tampered acquires the software image via the second processing circuit of a second control device that detects that the software image has not been tampered with, and starts operation of the processor of the first control device using the acquired software image. [Effects of the Invention]

[0008] According to the present invention, when verification of a software image fails at the time of booting up an information processing apparatus, the information processing apparatus can be booted up easily and appropriately. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram showing the overall configuration of an information processing apparatus according to an embodiment. [Figure 2] FIG. 2 is a diagram illustrating a secure boot status table according to an embodiment. [Figure 3] FIG. 3 is a diagram illustrating an inter-FPGA connection state table according to an embodiment. [Figure 4] FIG. 4 is a diagram illustrating a recovery history table according to an embodiment. [Figure 5] FIG. 5 is a configuration diagram of a recovery management table according to one embodiment. [Figure 6] FIG. 6 is a first operational transition diagram of the startup process according to one embodiment. [Figure 7] FIG. 7 is a second operational transition diagram of the startup process according to an embodiment. [Figure 8] FIG. 8 is a flowchart of a startup process according to an embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0010] The following description of the embodiments will be given with reference to the drawings. Note that the embodiments described below do not limit the scope of the invention as claimed, and not all of the elements and combinations thereof described in the embodiments are necessarily essential to the solution of the invention.

[0011] In the following explanation, information may be described using the expression "AAA table", but the information may be expressed in any data structure. In other words, to show that the information does not depend on the data structure, the "AAA table" can be called "AAA information".

[0012] FIG. 1 is a diagram showing the overall configuration of an information processing apparatus according to an embodiment.

[0013] The information processing device 1 is, for example, a storage device, a general-purpose computer, or the like, and includes a plurality of controllers 10. The controllers 10 include a first controller 10-1 (also referred to as CTL1) and a second controller 10-2 (also referred to as CTL2). Here, when the first controller 10-1 is an example of a first control device, the second controller 10-2 is an example of a second control device, and when the first controller 10-1 is an example of a second control device, the second controller 10-2 is an example of a first control device.

[0014] The controller 10 (10-1, 10-2) includes a CPU 20 (20-1, 20-2) as an example of a processor, a field programmable gate array (FPGA) 30 (30-1, 30-2) as an example of a processing circuit, a serial peripheral interface (SPI) ROM 40 (40-1, 40-2) as an example of a first storage device, an SPI ROM 50 (50-1, 50-2) as an example of a second storage device, and a RAM 60 (60-1, 60-2). The FPGA 30-1 and the FPGA 30-2 are connected via a signal line 2. Here, when the FPGA 30-1 is an example of the first processing circuit, the FPGA 30-2 is an example of the second processing circuit, and when the FPGA 30-1 is an example of the second processing circuit, the FPGA 30-2 is an example of the first processing circuit.

[0015] Here, as shown in FIG. 1, CPU20-1 may be referred to as CPU1, CPU20-2 as CPU2, FPGA30-1 as FPGA1, FPGA30-2 as FPGA2, SPI ROM40-1 as SPI ROM1-1, SPI ROM40-2 as SPI ROM2-1, SPI ROM50-1 as SPI ROM1-2, SPI ROM50-2 as SPI ROM2-2, RAM60-1 as RAM1, and RAM60-2 as RAM2.

[0016] The SPI ROM 40 is, for example, a flash ROM (Read Only Memory), and stores various data used by the FPGA 30. In this embodiment, the SPI ROM 40 stores FPGA main body data 41, a public key and digital signature 42, a recovery history table 43, and a recovery management table 44. The FPGA main body data 41 is data for the FPGA 30 to construct a circuit within the FPGA 30.

[0017] The SPI ROM 50 is, for example, a flash ROM, and stores data such as programs used by the CPU 20. In this embodiment, the SPI ROM 50 stores an SPI ROM image 51 as an example of a software image. The SPI ROM image 51 includes an OS (Operating System) image 52 and a BL (Boot Loader) 53.

[0018] The RAM 60 is, for example, a double-data-rate synchronous dynamic RAM (DDR SDRAM). The RAM 60 stores data used by the FPGA 30, software images executed by the CPU 20, etc. In this embodiment, the RAM 60 stores an SPI ROM image 61 (OS image 62, BL 63) which is a copy of the SPI ROM image 51 in the SPI ROM 50.

[0019] The CPU 20 performs the startup process of the information processing device 1 and controls the hardware after startup using the SPI ROM image 61 including data read from the SPI ROM 50 into the RAM 60, such as an OS image 62 and a BL 63. In this embodiment, the CPU 20 is unable to access the storage area of ​​the SPI ROM image 51 in the SPI ROM 50 of another controller 10.

[0020] The FPGA 30 reads FPGA body data 41 from the SPI ROM 40, constructs a circuit that executes predetermined processing, and executes various processes, such as startup processing, using the constructed circuit. The FPGA 30 stores a secure boot status table 31 and an inter-FPGA connection status table 32.

[0021] Next, the secure boot status table 31 will be described.

[0022] FIG. 2 is a diagram illustrating a secure boot status table according to an embodiment.

[0023] The secure boot status table 31 includes a field for a secure boot status 31a. The secure boot status 31a stores information indicating the status of the secure boot during the startup process. In this embodiment, the secure boot status 31a stores one of "1" indicating that the secure boot was successful (OK), "2" indicating that the secure boot is in progress (Progress), or "3" indicating that the secure boot failed (Not OK).

[0024] Next, the inter-FPGA connection state table 32 will be described.

[0025] FIG. 3 is a diagram illustrating an inter-FPGA connection state table according to an embodiment.

[0026] The inter-FPGA connection status table 32 includes a field for an inter-FPGA connection status 32a. The inter-FPGA connection status 32a stores information indicating whether communication with the FPGA 30 of another controller 10 is possible. In this embodiment, the inter-FPGA connection status 32a stores either "1" indicating that communication between the FPGAs is possible (connected) or "2" indicating that communication is not possible (not connected). Here, the FPGA 30 periodically inquires of the FPGA 30 of another controller 10 connected via the signal line 2 whether communication is possible, and stores information corresponding to the result in the inter-FPGA connection status 32a.

[0027] Next, the recovery history table 43 will be described.

[0028] FIG. 4 is a diagram illustrating a recovery history table according to an embodiment.

[0029] The recovery history table 43 includes a field for secure boot retry 43a. The secure boot retry 43a stores information indicating whether a secure boot retry has been performed using the SPI ROM image of another controller 10. In this embodiment, the secure boot retry 43a stores either "1" indicating that a retry has not been performed (no retry), or "2" indicating that a retry has been performed (retry performed).

[0030] Next, the recovery management table 44 will be described.

[0031] FIG. 5 is a configuration diagram of a recovery management table according to one embodiment.

[0032] The recovery management table 44 is a table for managing whether or not recovery using the SPI ROM image of another controller 10 has been performed when the information processing device 1 is started up, and each piece of information is registered by the FPGA 30 during the start-up process. The recovery management table 44 stores, for example, an entry for each start-up process of the information processing device 1. The entry of the recovery management table 44 includes fields for a date and time 44a, an event ID 44b, an event name 44c, an importance 44d, a location 44e, and a location ID 44f.

[0033] The date and time 44a stores the date and time of startup. The event ID 44b stores the identification information (ID) of the startup process event corresponding to the entry. The event name 44c stores the name of the event. The importance 44d stores information on whether recovery was performed in the startup process corresponding to the entry. The location 44e stores the position (location) of the part that was the target of recovery. The location ID 44f stores the ID of the location corresponding to the entry.

[0034] Next, a secure boot process of the information processing device 1 will be described.

[0035] Here, in the information processing device 1, in order to perform secure boot, the SPI ROM image 51 is stored in the SPI ROM 50 in advance, and an electronic signature and a public key for detecting tampering of this SPI ROM image 51 are stored in the SPI ROM 40.

[0036] FIG. 6 is a first operational transition diagram of the startup process according to an embodiment. FIG. 7 is a second operational transition diagram of the startup process according to an embodiment. FIG. 8 is a flowchart of the startup process according to an embodiment. Here, FIG. 6 is an operational transition diagram when verification of an existing SPI ROM image in its own controller 10 is executed and the verification is successful, and FIG. 7 is an operational transition diagram after verification of the existing SPI ROM image has failed. Also, FIG. 8 is a flowchart of the startup process in CTL1, but a similar startup process is also performed in CTL2. Specifically, processing is performed in which the configuration of CTL1 and the configuration of CTL2 are swapped.

[0037] When the information processing device 1 is powered on, the FPGA 1 of the CTL 1 reads the FPGA body data 41 from the SPI ROM 1-1 and builds an internal circuit based on the FPGA body data 41 (S11, FIG. 6(1)). At this time, the FPGA 1 stores information indicating that the secure boot is being executed (in this example, "2") in the secure boot status table 31.

[0038] Next, the FPGA 1 reads the public key and the digital signature 42 from the SPI ROM 1-1 (S12: FIG. 6(2)).

[0039] Next, the FPGA 1 acquires the SPI ROM image 51 from the SPI ROM 1-2 (FIG. 6(3)), and writes the SPI ROM image 51 to the RAM 1 (FIG. 6(4)) (S13).

[0040] Next, the SPI ROM image 61 in RAM1, the public key, and the electronic signature are used to verify whether the SPI ROM image 61 has been tampered with (S14, FIG. 6(5)).

[0041] If the tampering verification detects that there is no tampering (verification is OK) (S15: Yes), FPGA 1 releases the reset state of CPU 1 and stores information indicating that secure boot was successful (in this example, "1") in the secure boot status table 31 (S16, FIG. 6(6)). As a result, CPU 1 starts up the BL and OS using the BL 63 and OS image 62 in RAM 1 (S17).

[0042] On the other hand, if the tampering verification result indicates that tampering has occurred (verification Not OK) (S15: No), the FPGA 1 determines whether secure boot has been retried (recovery has been performed) (S21). Specifically, the FPGA 1 makes this determination based on the value of the secure boot retry 43a in the recovery history table 43.

[0043] As a result, if the retry has already been performed (S21: Yes), this means that the verification was not successful even after the retry, so FPGA1 stores information indicating that the secure boot has failed (in this example, "3") in the secure boot status table 31, and terminates the startup process as a failure.

[0044] On the other hand, if the retry has not been completed (S21: No), FPGA1 refers to the FPGA connection status table 32, checks the connection status between FPGA1 and FPGA2 (S22), and determines whether the connection between the FPGAs is complete (S23).

[0045] As a result, if the connection is not completed (S23: No), the FPGA 1 advances the process to step S22.

[0046] On the other hand, if the connection is complete (S23: Yes), FPGA1 refers to the secure boot status table 31 of FPGA2, checks the secure boot status (S24), and determines which status the secure boot is in (S25).

[0047] As a result, when the secure boot state is in progress (S25: Progress), the FPGA1 advances the process to step S24 to wait for processing by the CTL2.

[0048] Furthermore, if the secure boot status is a failure (S25: Not OK), this means that the tampering verification will not be OK even if the SPI ROM image of CTL2 is used, so FPGA1 stores information indicating that the secure boot has failed (in this example, "3") in the secure boot status table 31 and terminates the startup process as a failure.

[0049] If the secure boot status is successful (S25: OK), FPGA1 acquires the SPI ROM image 61 from RAM2 via FPGA2 (FIG. 7(7)), and writes the acquired SPI ROM image to RAM1 (FIG. 7(8)) (S26). FPGA1 may also acquire the SPI ROM image 61 from SPI ROM2-2.

[0050] Next, FPGA1 acquires the public key and the electronic signature from SPI ROM2-1 via FPGA2 (FIG. 7(9)), and writes the acquired public key and the electronic signature to SPI ROM1-1 (FIG. 7(10)) (S27).

[0051] Next, FPGA1 obtains SPI ROM image 61 from RAM1 and writes it to SPI ROM1-2 (FIG. 7(11)(S28)). Next, FPGA1 updates secure boot retry 43a in recovery history table 43 to "retry enabled" (S29), reads the public key and electronic signature (the public key and electronic signature written in step S27) from SPI ROM1-1 (FIG. 7(12), S30), and proceeds to step S14.

[0052] After that, in step S14, the FPGA 1 verifies whether the SPI ROM image 61 has been tampered with, using the SPI ROM image 61 in the RAM 1 (the SPI ROM image written in step S26), the public key, and the electronic signature (FIG. 7(13)).

[0053] If the tampering verification finds no tampering (verification is OK) (S15: Yes), FPGA 1 releases the reset state of CPU 1 (S16, FIG. 7(14)). As a result, CPU 1 starts up the BL and OS using the BL 63 and OS image 62 in RAM 1 (S17).

[0054] As described above, according to the startup process of this embodiment, if the tampering verification of the SPI ROM image 51 stored in the SPI ROM 50 in one controller 10 is unsuccessful, the FPGA 30 acquires the SPI ROM image 51 from the other controller 10, and the CPU 20 can use the SPI ROM image 51 to further proceed with the startup process of the controller 10. Furthermore, since the public key and electronic signature corresponding to the SPI ROM image are acquired from the other controller 10 to perform tampering verification, even if the versions of the SPI ROM image used by the one controller 10 and the other controller 10 are different, for example, the one controller 10 can appropriately perform tampering verification.

[0055] The present invention is not limited to the above-described embodiment, and can be modified appropriately without departing from the spirit of the present invention.

[0056] For example, in the above embodiment, if tampering verification in one controller 10 is unsuccessful, an SPI ROM image is obtained from another controller 10 and tampering verification is performed, but the SPI ROM image obtained from the other controller 10 may be used without tampering verification.

[0057] Furthermore, in the above embodiment, if the tampering verification in one controller 10 is unsuccessful, the public key and electronic signature are acquired from the other controller 10, and the tampering verification is performed using the acquired public key and electronic signature, but if the same SPI ROM image is used by the one controller 10 and the other controller 10, the tampering verification may be performed using the public key and electronic signature in the one controller 10, without acquiring the public key and electronic signature from the other controller 10. In this way, the amount of data transmitted and the processing performed between the one controller 10 and the other controller 10 can be reduced. [Explanation of symbols]

[0058] 1...information processing device, 10, 10-1, 10-2...controller, 20, 20-1, 20-2...CPU, 30, 30-1, 30-2...FPGA, 40, 40-1, 40-2...SPI ROM, 50, 50-1, 50-2...SPI ROM, 51...SPI ROM image, 60, 60-1, 60-2...RAM

Claims

1. An information processing device having a plurality of control devices, Each of the control devices is a processor, a processing circuit, a first storage device, and a second storage device; a second storage device for storing a software image to be executed by the processor; the first storage device stores an electronic signature and a public key for verifying whether the software image has been tampered with; The processing circuitry of each control device When the information processing device is started, the digital signature and the public key are acquired from the first storage device; Verifying whether the software image stored in the second storage device has been tampered with; The first processing circuit of the first control device that detects that the software image has been tampered with, acquiring the software image via a second processing circuit of the second control device in which it has been detected that the software image has not been tampered with; The processor of the first control device is started to operate with the acquired software image. Information processing device.

2. The first processing circuit stores the software image acquired via the second processing circuit of the second control device in the second storage device of the first control device. The information processing device according to claim 1 .

3. The first processing circuit verifying whether or not the software image acquired via the second processing circuit of the second control device has been tampered with; When it is detected that the software image has not been tampered with, the processor of the first control device is started to operate using the acquired software image. The information processing device according to claim 1 .

4. The first processing circuit acquires the digital signature and the public key stored in the first storage device of the second control device via the second processing circuit; verifying whether the software image has been tampered with by using the digital signature and the public key obtained via the second processing circuit; When it is detected that the software image has not been tampered with, the software image is used to start the operation of the processor of the first control device. The information processing device according to claim 3 .

5. The first processing circuit and the second processing circuit are directly connected to each other so as to be able to communicate with each other. The information processing device according to claim 1 .

6. The storage area of ​​the software image in the second storage device of the second control device is an area that cannot be accessed by the processor of the first control device. The information processing device according to claim 1 .

7. The first processing circuit of the first control device that has verified that the software image has been tampered with, The second control device waits until the verification of whether the software image has been tampered with is completed, and if it is detected that the software image has not been tampered with, the second control device acquires the software image via a second processing circuit. The information processing device according to claim 1 .

8. The first processing circuit of the first control device that detects that the software image has been tampered with, storing information indicating that the processor has started operating with the software image in the second control device; The information processing device according to claim 1 .

9. the processing circuit is a field programmable gate array (FPGA), The first storage device stores data for configuring a circuit of the FPGA. The information processing device according to claim 1 .

10. 1. A method for starting up an information processing device by an information processing device having a plurality of control devices, comprising: Each of the control devices is a processor, a processing circuit, a first storage device, and a second storage device; a second storage device for storing a software image to be executed by the processor; the first storage device stores an electronic signature and a public key for verifying whether the software image has been tampered with; The processing circuitry of each control device When the information processing device is started, the digital signature and the public key are acquired from the first storage device; Verifying whether the software image stored in the second storage device has been tampered with; The first processing circuit of the first control device that detects that the software image has been tampered with, acquiring the software image via a second processing circuit in the second control device in which it has been detected that the software image has not been tampered with; The processor of the first control device is started to operate with the acquired software image. Method for starting up an information processing device.

Images