Information processing system, information processing device, information processing method and program

Abstract

To enable, in an information processing system that updates an activation file for an information processing device using an update file, a further correct verification of the updated activation file.SOLUTION: An information processing system includes: a first generation unit that generates first signature data using a hash value acquired from an update file; an acquisition unit that acquires the update file and the first signature data; a first verification unit that verifies the update file using the first signature data when a start-up file is updated; an update unit that updates, with the verified update file, the start-up file for a second information processing device; a second generation unit that generates verification data for verifying the updated activation file on the basis of a hash value acquired from the first signature data; and a second verification unit that verifies the start-up file updated by the updating unit using the verification data when the second information processing device starts up using the updated start-up file.SELECTED DRAWING: Figure 4

Description

[Technical Field]

[0001] The present invention relates to an information processing system, an information processing device, an information processing method, and a program. [Background technology]

[0002] In information processing devices, technologies (e.g., Trusted Boot or Linux-IMA) are known that detect tampering or damage to startup files (firmware or software) and verify that only legitimate files can be executed during startup.

[0003] In addition, an information processing system is known that verifies the update file using signature data created by a network server when updating, and verifies the updated startup file using a signature file such as Linux-IMA when starting up (see, for example, Patent Document 1). Summary of the Invention [Problem to be solved by the invention]

[0004] The technology in Patent Document 1 has a problem in that if part of an updated startup file written to a storage device or the like is corrupted due to an unexpected error, the verification signature data is created based on the corrupted startup file, making it impossible to correctly verify the startup file.

[0005] One embodiment of the present invention has been made in consideration of the above-mentioned problems, and enables the updated startup file to be verified more accurately in an information processing system that updates the startup file of an information processing device using an update file. [Means for solving the problem]

[0006] In order to solve the above problem, an information processing system according to one embodiment is an information processing system including a first information processing device that provides an update file and a second information processing device that updates a startup file using the update file, wherein the first information processing device has a first creation unit that creates first signature data for the update file using a hash value obtained from the update file, and the second information processing device has an acquisition unit that acquires the update file and the first signature data, a first verification unit that verifies the update file using the first signature data when updating the startup file with the update file, an update unit that updates the startup file of the second information processing device with the update file verified by the first verification unit, a second creation unit that creates verification data for verifying the startup file updated by the update unit based on the hash value obtained from the first signature data, and a second verification unit that verifies the startup file updated by the update unit using the verification data when starting up the second information processing device using the startup file updated by the update unit. [Effects of the Invention]

[0007] According to one embodiment of the present invention, in an information processing system that updates a startup file of an information processing device using an update file, it becomes possible to more accurately verify the updated startup file. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram illustrating an example of a system configuration of an information processing system according to an embodiment. [Figure 2] FIG. 2 is a diagram illustrating an example of a hardware configuration of a computer according to an embodiment. [Figure 3] FIG. 1 is a diagram illustrating an example of a hardware configuration of an image forming apparatus according to an embodiment. [Figure 4] FIG. 1 is a diagram illustrating an example of a functional configuration of an information processing system according to an embodiment. [Figure 5]FIG. 3 is a diagram illustrating an image of processing performed by a server device according to the first embodiment. [Figure 6] 6 is a flowchart showing an example of processing by a server device according to the first embodiment. [Figure 7] FIG. 2 is a diagram illustrating an image of processing performed during update of the information processing device according to the first embodiment. [Figure 8] 10 is a flowchart showing an example of processing performed during update of the information processing device according to the first embodiment. [Figure 9] FIG. 11 is a diagram (1) showing an example of an error notification screen according to the first embodiment. [Figure 10] FIG. 2 is a diagram illustrating an image of processing at the time of startup of the information processing device according to the first embodiment. [Figure 11] 5 is a flowchart showing an example of processing at the time of startup of the information processing device according to the first embodiment. [Figure 12] FIG. 10 is a diagram (2) showing an example of an error notification screen according to the first embodiment. [Figure 13] 10 is a flowchart illustrating an example of processing performed during update of an information processing device according to the second embodiment. [Figure 14] 10 is a flowchart showing an example of processing at the time of startup of an information processing device according to a second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. <System configuration> 1 is a diagram illustrating an example of a system configuration of an information processing system according to an embodiment. The information processing system 1 includes a server device 10 that provides an update file 21 for an information processing device 100, and the information processing device 100 that updates a startup file 121 using the update file 21.

[0010] The server device (first information processing device) 10 is, for example, an information processing device having a computer configuration, or a system including multiple computers. Note that the computer is not limited to a physical machine (computer), and may be a virtual machine on the cloud, or the like. The server device 10 creates first signature data 22 for verifying the update file 21 by executing a predetermined program (such as a signature creation application) on one or more computers. The server device 10 also provides the information processing device 100 with a download file 20 including the update file 21 and the first signature data 22. At this time, the server device 10 creates the first signature data 22 for the update file 21 using a hash value calculated from the update file 21.

[0011] Here, the update file 21 is a program for updating the startup file 121, which is a program (software or firmware) that is read and executed by the information processing device 100 at startup. Note that the update file 21 and the startup file 121 may include data such as setting data in addition to the program. The first signature data 22 is a digital signature for verifying that the update file 21 has not been tampered with.

[0012] The information processing device (second information processing device) 100 is, for example, an electronic device such as an image forming device having a computer configuration, or a general-purpose information processing device such as a PC (Personal Computer), a tablet terminal, or a smartphone. Note that the electronic device is not limited to an image forming device, and may be, for example, a PJ (Projector), an IWB (Interactive White Board: a white board with an electronic blackboard function capable of intercommunication), an output device such as digital signage, or a HUD (Head Up Display) device. Furthermore, the electronic device may be, for example, industrial machinery, an imaging device, a sound collecting device, a medical device, a network home appliance, an automobile (Connected Car), a game console, a PDA (Personal Digital Assistant), a digital camera, a wearable terminal, or the like.

[0013] Here, as an example, the following description will be given assuming that the information processing device 100 is an image forming device such as an MFP (Multifunction Peripheral) that has scan, copy, print, and FAX functions mounted in one housing.

[0014] The information processing device 100 acquires the download file 20 provided by the server device 10 and stores it in a temporary storage area 110, for example, an external memory or a storage device provided in the information processing device 100. For example, the information processing device 100 may download the download file 20 from the server device 10 via the communication network 2 and store it in the temporary storage area 110. Alternatively, the information processing device 100 may acquire the download file 20 downloaded by another information processing device via the other information processing device. For example, the information processing device 100 may use, as the temporary storage area 110, an external memory in which the other information processing device has saved the download file 20.

[0015] When updating the startup file 121, the information processing device 100 verifies the update file 21 with the first signature data 22, and if the verification is successful, updates the startup file 121 stored in the storage unit 120 with the update file 21. This allows the information processing device 100 to guarantee that the update file 21 used to update the startup file 121 has not been tampered with (integrity or authenticity).

[0016] At this time, the information processing device 100 creates verification data for verifying the updated startup file 121 and stores the verification data in the metadata area of ​​the startup file 121. Furthermore, when starting up using the updated startup file 121, the information processing device 100 verifies the updated startup file 121 with the verification data stored in the metadata area, and if the verification is successful, permits access to the updated startup file 121. This allows the information processing device 100 to guarantee that the updated startup file 121 has not been tampered with (integrity or authenticity).

[0017] However, in conventional technology, signature data such as Linux-IMA (Integrity Measurement Architecture) is used to verify that the updated startup file 121 has not been tampered with. This method has the problem that if some data in the updated startup file 121 is corrupted due to an unexpected error or the like, the signature data is created based on the corrupted startup file 121, making it impossible to correctly verify the corrupted startup file 121.

[0018] Furthermore, in the conventional technology, after the updated startup file 121 is stored in the memory unit 120, a hash operation is performed on the updated startup file 121 to create signature data, etc., which results in the problem of the processing time required for the hash operation.

[0019] Therefore, the information processing device 100 according to this embodiment acquires a hash value calculated by the server device 10 from the first signature data 22 included in the download file 20, and creates verification data for verifying the updated startup file 121 based on the acquired hash value. As a result, even if some of the data in the updated startup file 121 is corrupted, the information processing device 100 according to this embodiment can correctly verify the updated startup file 121 using the verification data based on the hash value calculated by the server device 10. Furthermore, because the information processing device 100 creates the verification data without performing a hash calculation on the updated startup file 121, the processing time required for the hash calculation can be reduced.

[0020] As described above, according to this embodiment, in the information processing system 1 that updates the startup file of the information processing device 100 using an update file, it becomes possible to more correctly verify the updated startup file.

[0021] 1 is an example. For example, the server device 10 and the information processing device 100 do not have to be connected via the communication network 2. As a specific example, the information processing device 100 may acquire, via an external memory or the like, a download file 20 downloaded from the server device 10 by another information processing device.

[0022] <Hardware configuration> The server device 10 has, for example, the hardware configuration of a computer 200 as shown in Fig. 2. Alternatively, the server device 10 is configured by a plurality of computers 200.

[0023] Fig. 2 is a diagram showing an example of the hardware configuration of a computer according to an embodiment. For example, as shown in Fig. 2, a computer 200 includes a CPU (Central Processing Unit) 201, a ROM (Read Only Memory) 202, a RAM (Random Access Memory) 203, a HD (Hard Disk) 204, an HDD (Hard Disk Drive) controller 205, a display 206, an external device connection I / F (Interface) 207, a network I / F 208, a keyboard 209, a pointing device 210, a DVD-RW (Digital Versatile Disk Rewritable) drive 212, a media I / F 214, and a bus line 215.

[0024] Of these, the CPU 201 controls the overall operation of the computer 200. The ROM 202 stores, for example, programs used to start up the computer 200, such as startup files, and data. The RAM 203 is used, for example, as a work area for the CPU 201. The HD 204 stores, for example, programs such as an OS (Operating System), applications, and device drivers, as well as various data. The HDD controller 205 controls the reading and writing of various data from and to the HD 204, for example, under the control of the CPU 201.

[0025] The display 206 displays various types of information such as a cursor, a menu, a window, characters, or an image. The display 206 may be provided outside the computer 200. The external device connection I / F 207 is an interface for connecting various external devices such as an external memory to the computer 200. The network I / F 208 is an interface for data communication using, for example, the communication network 2.

[0026] The keyboard 209 is a type of input means having multiple keys for inputting characters, numbers, various instructions, etc. The pointing device 210 is a type of input means for selecting and executing various instructions, selecting a processing target, moving a cursor, etc. The keyboard 209 and pointing device 210 may be provided outside the computer 200.

[0027] The DVD-RW drive 212 controls reading and writing of various data from and to a DVD-RW 211, which is an example of a removable recording medium. The DVD-RW 211 is not limited to a DVD-RW, and may be another removable recording medium. The media I / F 214 controls reading and writing (storing) of data from and to a medium 213, such as a flash memory. The bus line 215 includes an address bus, a data bus, and various control signals for electrically connecting the above components.

[0028] 2 is an example of the configuration of the computer 200. The computer 200 may have any configuration as long as it has, for example, a CPU 201, a ROM 202, a RAM 203, a network I / F 208, and the like.

[0029] (Hardware configuration of image forming device) Here, a description will be given of the hardware configuration of an image forming apparatus 300, which is an example of the information processing apparatus 100. Note that the information processing apparatus 100 may have the hardware configuration of a computer 200 as shown in FIG.

[0030] 3 is a diagram illustrating an example of the hardware configuration of an image forming apparatus according to an embodiment. As shown in FIG. 3, the image forming apparatus 300 includes a controller 310, a short-range communication circuit 320, an engine control unit 330, an operation panel 340, a network I / F 350, and an external device connection I / F 360.

[0031] Of these, the controller 310 has a CPU 301, which is the main part of the computer, a system memory (MEM-P) 302, a north bridge (NB) 303, a south bridge (SB) 304, an ASIC (Application Specific Integrated Circuit) 305, a local memory (MEM-C) 306, which is a storage unit, an HDD controller 307, and an HD 308, which is also a storage unit, and is configured such that the NB 303 and the ASIC 305 are connected by an AGP (Accelerated Graphics Port) bus 311.

[0032] Of these, the CPU 301 is a control unit that performs overall control of the image forming apparatus 300. The NB 303 is a bridge that connects the CPU 301 with the MEM-P 302, the SB 304, and the AGP bus 311, and includes a memory controller that controls reading and writing to the MEM-P 302, a PCI (Peripheral Component Interconnect) master, and an AGP target.

[0033] The MEM-P 302 comprises a ROM 302a, which is memory for storing programs and data that realize the functions of the controller 310, and a RAM 302b, which is used for expanding the programs and data and as a drawing memory during memory printing. The programs stored in the RAM 302b may be provided by being recorded in an installable or executable format on a computer-readable recording medium such as a CD-ROM, CD-R, or DVD. The ROM 302a is an example of a startup storage area that stores the startup file 121.

[0034] The SB 304 is a bridge for connecting the NB 303 with PCI devices and peripheral devices. The ASIC 305 is an integrated circuit (IC) for image processing applications that has hardware elements for image processing and serves as a bridge connecting the AGP bus 311, PCI bus 312, HDD controller 307, and MEM-C 306. The ASIC 305 includes a PCI target and AGP master, an arbiter (ARB) that forms the core of the ASIC 305, a memory controller that controls the MEM-C 306, multiple direct memory access controllers (DMACs) that perform image data rotation using hardware logic, and a PCI unit that transfers data between the scanner unit 331 and printer unit 332 via the PCI bus 312. A USB interface or an IEEE 1394 (Institute of Electrical and Electronics Engineers) interface may also be connected to the ASIC 305.

[0035] The MEM-C 306 is a local memory used as an image buffer for copying and a code buffer. The HD 308 is a storage for storing image data, font data used during printing, and forms. The HD 308 may also store programs such as an OS, applications, and device drivers, as well as various data. The HDD controller 307 controls the reading and writing of data from and to the HD 308 under the control of the CPU 301. The AGP bus 311 is a bus interface for a graphics accelerator card proposed to speed up graphics processing. By directly accessing the MEM-P 302 at high throughput, the graphics accelerator card can be made faster.

[0036] The short-range communication circuit 320 performs various types of short-range wireless communication using an antenna 320a for the short-range communication circuit, etc. The engine control unit 330 is composed of, for example, a scanner unit 331 and a printer unit 332, etc. The scanner unit 331 is a reading device that reads documents, etc. The printer unit 332 is a printing device that prints print data on a print medium. The scanner unit 331 or the printer unit 332 includes an image processing unit that performs, for example, error diffusion, gamma conversion, etc.

[0037] The operation panel 340 includes a panel display unit 340a such as a touch panel that displays current setting values ​​and selection screens and receives input from the operator, and operation buttons 340b including a numeric keypad that receives setting values ​​for image formation conditions such as density setting conditions and a start key that receives a copy start command. The controller 310 controls the entire image forming apparatus 300, and controls, for example, drawing, communication, and input from the operation panel 340.

[0038] The image forming apparatus 300 can sequentially switch among the document box function, copy function, printer function, and facsimile function using, for example, an application switching key on the operation panel 340. For example, when the document box function is selected, the mode switches to document box mode, when the copy function is selected, the mode switches to copy mode, when the printer function is selected, the mode switches to printer mode, and when the facsimile mode is selected, the mode switches to facsimile mode.

[0039] The network I / F 350 is an interface for performing data communication using the communication network 2. The external device connection I / F 360 is an interface for connecting various external devices, such as an external memory, to the image forming apparatus 300. The short-range communication circuit 320, the network I / F 350, and the external device connection I / F 360 are electrically connected to the ASIC 305 via, for example, a PCI bus 312.

[0040] 3 is an example of the hardware configuration of the information processing device 100. The information processing device 100 may have any configuration as long as it has, for example, a CPU 301, a ROM 302a, a RAM 302b, a network I / F 208, an external device connection I / F 360, and the like.

[0041] <Functional configuration> Next, a description will be given of the functional configuration of the information processing system 1. Fig. 4 is a diagram showing an example of the functional configuration of the information processing system according to an embodiment.

[0042] (Functional configuration of server device) The server device (first information processing device) 10 includes, for example, a storage unit 421, a first creation unit 422, and a provision unit 423.

[0043] The storage unit 421 is realized by, for example, a program executed by the CPU 201, the HD 204, the HDD controller 205, etc., and stores the download file 20, the private key A 424, etc. The information processing system 1 generates a combination of the private key A and the public key A of the public key cryptography, and stores the private key A in the storage unit 421 of the server device 10 in advance, and stores the public key A in the storage unit 120 of the information processing device 100 in advance.

[0044] The first creation unit 422 is realized by, for example, a program (such as a signature creation application) executed by the CPU 201, and executes a first creation process to create first signature data 22 for verifying the update file 21. The first creation unit 422 also creates a download file 20 including the update file 21 and the first signature data 22, and stores the download file 20 in the storage unit 421.

[0045] The providing unit 423 is realized by, for example, a program (such as a signature creation application) executed by the CPU 201, and executes a providing process for providing the download file 20 created by the first creating unit 422. For example, the server device 10 may provide the download file 20 to the information processing device 100 in response to a download request from the information processing device 100. Alternatively, the server device 10 may provide the download file 20 to another information processing device different from the information processing device 100 in response to a request from the other information processing device. In this case, a user who uses the other information processing device stores the download file 20 downloaded from the server device 10 in an external memory and connects the external memory to the information processing device 100.

[0046] (Functional configuration of information processing device) The information processing device 100 includes, for example, an acquisition unit 401, a first verification unit 402, an update unit 403, a second creation unit 404, a second verification unit 405, a notification unit 406, a temporary storage area 110, and a storage unit 120.

[0047] Acquisition unit 401 is realized by, for example, a program (such as a system update application) executed by CPU 301, and executes an acquisition process to acquire download file 20 including update file 21 and first signature data 22. For example, acquisition unit 401 may acquire download file 20 provided by server device 10 via an external memory or the like, or may acquire download file 20 provided by server device 10 via communication network 2.

[0048] The first verification unit 402 is realized, for example, by a program (such as a system update application) executed by the CPU 301. When updating the startup file 121 with the update file 21, the first verification unit 402 executes a first verification process to verify the update file 21 using the first signature data 22. For example, the first verification unit 402 decrypts the first signature data 22 with the public key A to obtain a first hash value, and performs a hash operation on the update file 21 to obtain a second hash value. Furthermore, the first verification unit 402 compares the first hash value with the second hash value, and if they match, determines that the update file 21 is a valid file (not tampered with). On the other hand, the first verification unit 402 compares the first hash value with the second hash value, and if they do not match, determines that the update file 21 is an unauthorized file (tampered with).

[0049] As described above, the information processing system 1 generates a combination of a private key A and a public key A of the public key cryptography, and pre-stores the private key A in the memory unit 421 of the server device 10 and pre-stores the public key A in the memory unit 120 of the information processing device 100.

[0050] The update unit 403 is realized by, for example, a program (such as a system update application) executed by the CPU 301, and executes an update process to update the startup file 121 of the information processing device 100 with the update file 21 verified by the first verification unit 402. For example, the update unit 403 overwrites the startup file 121 in the storage unit 120 with the update file 21 that the first verification unit 402 has determined to be valid.

[0051] The second creation unit 404 is realized by, for example, a program (such as a system update application) executed by the CPU 301. The second creation unit 404 executes a second creation process to create verification data 122 for verifying the startup file 121 updated by the update unit 403, based on, for example, a first hash value acquired from the first signature data 22. As an example, the second creation unit 404 encrypts the first hash value acquired from the first signature data 22 with a startup private key B to create second signature data, which is used as the verification data 122. In this case, the information processing device 100 stores in advance in the storage unit 120 a combination of the startup private key B and public key B.

[0052] As another example, the second creation unit 404 may use the first hash value obtained from the first signature data 22 as the verification data 122.

[0053] The second verification unit 405 is realized, for example, by a program (such as a system update application) executed by the CPU 301. For example, when the information processing device 100 is started up using the startup file 121 updated by the update unit 403, the second verification unit 405 executes a second verification process to verify the startup file 121 updated by the update unit 403 using the verification data 122 created by the second creation unit 404. As an example, the second verification unit 405 decrypts the second signature data (an example of verification data) created by the second creation unit 404 with the public key B to obtain a first hash value, and performs a hash operation on the updated startup file 121 to obtain a third hash value. Furthermore, the second verification unit 405 compares the first hash value with the third hash value, and if they match, determines that the updated startup file 121 is a legitimate file (not tampered with). In this case, the information processing device 100 expands the updated startup file 121 in the RAM area and permits access to the startup file 121.

[0054] On the other hand, if the second verification unit 405 compares the first hash value with the third hash value and finds that they do not match, it determines that the updated startup file 121 is an invalid file (has been tampered with). In this case, the information processing device 100 stops expanding the updated startup file 121 into the RAM area or prohibits access to the startup file 121.

[0055] The notification unit 406 is realized by, for example, a program (such as a system update application) executed by the CPU 301. If the first verification unit 402 fails to verify the update file 21, the notification unit 406 executes a notification process (first notification process) to notify of an error. Furthermore, if the second verification unit 405 fails to verify the startup file 121, the notification unit 406 executes a notification process (second notification process) to notify of an error. As one example, the notification unit 406 notifies of the error by displaying an error notification screen on a display unit such as the operation panel 340. As another example, the notification unit 406 may notify of the error by sending an email or a push notification to a predetermined terminal device or the like.

[0056] The temporary storage area 110 is realized by, for example, an external memory connected to the information processing device 100, a storage device such as the RAM 302b or the HD 308, and temporarily stores the update file 21, the first signature data 22, and the like.

[0057] The storage unit 120 is realized by, for example, storage devices such as the ROM 302a, the RAM 302b, the MEM-C 306, the HD 308, or a storage area inside the ASIC 305. The storage unit 120 stores, for example, a public key A 411, a private key B 412, a public key B 413, a startup file 121, and verification data 122. The storage unit 120 includes, for example, a startup storage area and a RAM area.

[0058] <Processing flow> Next, the processing flow of the information processing method according to this embodiment will be described.

[0059] [First embodiment] (Server device processing) 5 is a diagram showing an image of processing by the server device according to the first embodiment. In step S1 of FIG. 5, the first creation unit 422 of the server device 10 acquires the update file 21. At this time, the first creation unit 422 may acquire the update file 21 from a storage unit 421 or the like included in the server device 10, or may acquire the update file 21 from a server device or the like external to the information processing system 1.

[0060] In step S2, the first creation unit 422 performs a hash calculation on the acquired update file 21 to calculate a first hash value. For example, the first creation unit 422 performs a hash calculation on the update file 21 using a hash function such as SHA-256 (Secure Hash Algorithm 256-bit).

[0061] In step S3, the first creation unit 422 encrypts the calculated first hash value with the update private key A to create first signature data 11. In step S4, the first creation unit 422 creates a download file 20 including the update file 21 and the first signature data 22, and stores the download file 20 in the storage unit 421.

[0062] If there are multiple update files 21, the first creating unit 422 performs the processes of steps S1 to S4 on each of the multiple update files to create multiple download files 20.

[0063] In step S5, the providing unit 423 of the server device 10 provides one or more downloads stored in the storage unit 421 in response to a request from, for example, the information processing device 100. The process of FIG. 5 is shown in a flowchart in FIG. 6.

[0064] (Flowchart of processing by the server device) Fig. 6 is a flowchart showing an example of processing by the server device according to the first embodiment. This processing shows an example of processing in which the server device 10 creates and provides a download file 20 including an update file 21 and first signature data 22. Note that the processing content of Fig. 6 is similar to the processing content described in Fig. 5, and therefore detailed description of the similar processing will be omitted here.

[0065] In step S601, the first creating unit 422 of the server device 10 acquires the update file 21.

[0066] In step S602, the first creating unit 422 performs a hash operation on the acquired update file 21 to calculate a first hash value.

[0067] In step S603, the first creation unit 422 encrypts the first hash value with the private key A to create first signature data.

[0068] In step S604, the first creating unit 422 creates a download file 20 including the acquired update file 21 and the created first signature data 22.

[0069] In step S605, the providing unit 423 of the server device 10 provides the download file 20 to, for example, the information processing device 100 or another information processing device.

[0070] (Processing when updating) 7 is a diagram showing an image of processing during update of the information processing device according to the first embodiment. In step S11 of FIG. 7, the acquisition unit 401 of the information processing device 100 acquires one or more download files 20 provided by the server device 10. For example, the acquisition unit 401 may download one or more download files 20 from the server device 10 via the communication network 2 and store them in the temporary storage area 110. Alternatively, the acquisition unit 401 may acquire one or more download files 20 from an external memory or the like connected to the information processing device 100. Here, for ease of explanation, the following explanation will be given assuming that there is one download file 20.

[0071] In step S12, the first verification unit 402 of the information processing device 100 performs a hash calculation on the update file 21 included in the download file 20 acquired by the acquisition unit 401, and acquires a second hash value. For example, the first verification unit 402 performs a hash calculation on the update file 21 using a hash function such as SHA-256.

[0072] In step S13, the first verification unit 402 decrypts the first signature data 22 included in the download file 20 acquired by the acquisition unit 401 using the update public key A411 to acquire a first hash value.

[0073] In step S14, first verification unit 402 verifies first signature data 22. For example, first verification unit 402 compares the first hash value with the second hash value, and if they match, determines that update file 21 is an authentic file that has not been tampered with. In this case, update unit 403 of information processing device 100 updates startup file 121 stored in the startup memory area of ​​memory unit 120 with update file 21 that was determined to be an authentic file in step S51a, and executes the processes from step S16 onwards.

[0074] On the other hand, the first verification unit 402 compares the first hash value with the second hash value, and if they do not match, determines that the update file 21 is an invalid file that has been tampered with (or corrupted). In this case, the notification unit 406 of the information processing device 100 issues a system error notification and stops the execution of the processing from step S16 onwards.

[0075] In step S16, the second creation unit 404 of the information processing device 100 encrypts the first hash value acquired by the first verification unit 402 in step S13 with the startup private key B412 to create second signature data 701.

[0076] In step S17, second creation unit 404 stores the created second signature data in the metadata area of ​​updated startup file 121 stored in the startup storage area of ​​storage unit 120.

[0077] If there are multiple download files 20, the information processing device 100 executes the processes of steps S12 to S17 for each of the multiple download files 20. The process of FIG. 7 is shown in a flowchart in FIG.

[0078] (Flowchart of update processing) Fig. 8 is a flowchart showing an example of processing during update of the information processing device according to the first embodiment. This processing shows an example of processing in which the information processing device 100 updates the startup file 121 of the information processing device 100 using the download file 20 provided by the server device 10. Note that the processing content of Fig. 8 is similar to the processing content described in Fig. 7, and therefore detailed description of the similar processing will be omitted here.

[0079] In step S801, the acquisition unit 401 of the information processing device 100 acquires the update file 21 and the first signature data 22 included in the download file 20 provided by the server device 10.

[0080] In step S802, the first verification unit 402 of the information processing device 100 performs a hash operation on the update file 21 acquired by the acquisition unit 401, and acquires a hash value (second hash value).

[0081] In step S803, first verification unit 402 decrypts first signature data 22 acquired by acquisition unit 401 using update public key A411 stored in advance in storage unit 120, and acquires the first hash value created by server device 10. Note that the process of step S803 may be executed before the process of step S802, or may be executed in parallel with the process of step S802.

[0082] In step S804, the first verification unit 402 determines whether the first hash value and the second hash value match. If the two hash values ​​match, the first verification unit 402 shifts the process to step S805. On the other hand, if the two hash values ​​do not match, the first verification unit 402 shifts the process to step S805.

[0083] When proceeding to step S805, the update unit 403 of the information processing device 100 determines that the update file 21 acquired by the acquisition unit 401 is a valid file, and updates the startup file 121 stored in the memory unit 120 with the update file 21.

[0084] In step S806, the second creation unit 404 of the information processing device 100 encrypts the first hash value acquired by the first verification unit 402 in step S803 with the startup private key B412 to create second signature data 701.

[0085] In step S807, the second creation unit 404 stores the created second signature data 701 in the metadata area of ​​the updated startup file 121. The second signature data 701 is an example of verification data 122 for verifying the updated startup file 121. For example, the verification data 122 may be a first hash value or the like, as will be described later in the second embodiment.

[0086] On the other hand, when the process proceeds from step S804 to step S808, the information processing device 100 stops the update process, and the notification unit 406 of the information processing device 100 notifies the user of an error. For example, the notification unit 406 displays an error notification screen 900 as shown in FIG. 9 on a display unit such as the operation panel 340. In the example of FIG. 9, the error notification screen 900 displays information such as a message indicating that the update of the startup file 121 has failed, an error code, and contact information. In this way, the information processing device 100 according to this embodiment can notify the user of error information on the screen of a display unit such as the operation panel 340 when verification of the first signature data 22 has failed.

[0087] (Startup processing) Fig. 10 is a diagram showing an image of processing at the time of startup of the information processing device according to the first embodiment. In step S21 of Fig. 10, the information processing device 100 updates the startup file 121 through the processing of Fig. 7 or Fig. 8, and then starts up (or restarts).

[0088] In step S22, when the start-up file 121 is accessed, the second verification unit 405 of the information processing device 100 performs a hash calculation on the start-up file 121 to obtain a third hash value.

[0089] In step S23, the second verification unit 405 decrypts the second signature data 701 in the metadata area of ​​the accessed startup file 121 using the startup public key B to obtain a first hash value.

[0090] In step S24, second verification unit 405 and first verification unit 402 verify first signature data 22. For example, second verification unit 405 compares the first hash value with the third hash value, and if they match, determines that startup file 121 is an authentic file that has not been tampered with. In this case, second verification unit 405 expands startup file 121, which was determined to be an authentic file in step S24a, into the RAM area of ​​storage unit 120, and permits file access to the startup file 121.

[0091] On the other hand, the second verification unit 405 compares the first hash value with the third hash value, and if they do not match, determines that the startup file 121 is an invalid file that has been tampered with or corrupted. In this case, the notification unit 406 of the information processing device 100 issues a system error notification and stops the processing of step S24a. The processing of FIG. 10 is represented by a flowchart as shown in FIG. 11.

[0092] (Startup process flowchart) Fig. 11 is a flowchart showing an example of processing at the time of startup of the information processing device according to the first embodiment. This processing shows an example of startup processing executed when the information processing device 100 starts up or restarts after updating the startup file 121, for example, by the processing of Fig. 8. Note that the processing content of Fig. 11 is similar to the processing content described in Fig. 10, and therefore detailed description of the similar processing will be omitted here.

[0093] In step S1101, when the information processing device 100 accesses the updated startup file 121, the information processing device 100 executes the processes from step S1102 onwards.

[0094] In step S1102, the second verification unit 405 of the information processing device 100 performs a hash calculation on the updated startup file 121 to obtain a hash value (third hash value).

[0095] In step S1103, second verification unit 405 obtains a hash value (first hash value) by decrypting second signature data 701 in the metadata area of ​​updated startup file 121 with startup public key B. Note that the process of step S1103 may be executed before the process of step S1102, or may be executed in parallel with the process of step S1102.

[0096] In step S1104, the second verification unit 405 determines whether the first hash value and the third hash value match. If the two hash values ​​match, the second verification unit 405 shifts the process to step S1105. On the other hand, if the two hash values ​​do not match, the second verification unit 405 shifts the process to step S1106.

[0097] In step S1105, the second verification unit 405 expands the startup file 121, which has been determined to be a legitimate file, into the RAM area of ​​the storage unit 120 and permits file access to the startup file 121. This allows the information processing device 100 to execute the startup file 121.

[0098] On the other hand, in step S1106, the information processing device 100 prohibits access to the startup file 121 that has been determined to be an invalid file, and the notification unit 406 of the information processing device 100 notifies an error. For example, the notification unit 406 displays an error notification screen 1200 as shown in FIG. 12 on a display unit such as the operation panel 340.

[0099] 12, the error notification screen 1200 displays a message indicating that the startup file 121 cannot be started, an error code, contact information, etc. In this way, the information processing device 100 according to this embodiment can notify the user of error information on the screen of a display unit such as the operation panel 340 when verification of the first signature data 22 fails.

[0100] In this way, in the first embodiment, when the information processing device 100 is started up after updating the startup file 121, the information processing device 100 can verify the validity of the updated startup file 121 using the first hash data calculated by the server device 10.

[0101] [Second embodiment] In the first embodiment, an example of processing has been described in which the verification data 122 for verifying the updated startup file 121 is the second signature data. However, this is just an example, and the verification data 122 for verifying the updated startup file 121 may be the first hash value. In the second embodiment, an example of processing will be described in which the verification data 122 for verifying the updated startup file 121 is the first hash value.

[0102] (Flowchart of update processing) Fig. 13 is a flowchart showing an example of processing during update of an information processing device according to the second embodiment. This processing shows another example of processing in which the information processing device 100 updates the startup file 121 of the information processing device 100 using the download file 20 provided by the server device 10. Note that, among the processing shown in Fig. 13, the processing of steps S801 to S805 and S808 is the same as the processing during update according to the first embodiment described in Fig. 8, so here, differences from the first embodiment will be described.

[0103] 13, the second creation unit 404 of the information processing device 100 stores the first hash value acquired by the first verification unit 402 as the verification data 122 in the metadata area of ​​the updated startup file 121. The first hash value is another example of the verification data 122 for verifying the updated startup file 121.

[0104] (Startup process flowchart) Fig. 14 is a flowchart showing an example of processing during update of the information processing device according to the second embodiment. This processing shows another example of startup processing that is executed when the information processing device 100 starts up or restarts after updating the startup file 121 through the processing of Fig. 13. Of the processing shown in Fig. 14, the processing of steps S1101, 1102, and S1104 to S1106 is the same as the processing during startup according to the first embodiment described in Fig. 11, so here, differences from the first embodiment will be described.

[0105] 14, the second verification unit 405 of the information processing device 100 acquires the first hash value stored as the verification data 122 in the metadata area of ​​the updated startup file 121. The second verification unit 405 verifies the authenticity of the startup file 121 using the acquired first hash value.

[0106] In this way, the verification data 122 for verifying the startup file 121 is not limited to the second signature data 701, but may be the first hash data, etc. In the second embodiment as well, the information processing device 100 can verify the validity of the updated startup file 121 by using the first hash data calculated by the server device 10 at the time of startup after updating the startup file 121.

[0107] As described above, according to each embodiment of the present invention, in the information processing system 1 that updates the startup file 121 of the information processing device 100 using the update file 21, the updated startup file 121 can be verified more correctly.

[0108] <Supplementary information> Each function of each embodiment described above can be realized by one or more processing circuits. Here, the term "processing circuit" in this specification includes a processor programmed to perform each function by software, such as a processor implemented by an electronic circuit, as well as devices such as an ASIC (Application Specific Integrated Circuit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), and conventional circuit modules designed to perform each of the functions described above.

[0109] Additionally, the devices described in the examples are merely illustrative of one of several computing environments for implementing the embodiments disclosed herein. In one embodiment, server apparatus 10 includes multiple computing devices, such as a server cluster, configured to communicate with each other via any type of communication link, including a network, shared memory, etc., and to perform the processes disclosed herein.

[0110] The server device 10 may be integrated into one device or may be divided into multiple devices. Furthermore, at least a part of the functional configuration of the server device 10 and the information processing device 100 may be executed using an external cloud service or the like. [Explanation of symbols]

[0111] 1. Information Processing Systems 10 Server device (first information processing device) 21 Update file 22 First signature data 100 Information processing device (second information processing device) 121 Startup file 122 validation data 401 Acquisition Department 402 First Verification Section 403 Update Department 404 Second Creation Section 405 Second Verification Section 406 Notification Department 422 First Creation Section 900, 1200 error notification screen [Prior art documents] [Patent documents]

[0112] [Patent Document 1] Patent Publication No. 2021-077971

Claims

1. An information processing system including a first information processing device that provides an update file, and a second information processing device that updates a startup file using the update file, The first information processing device a first creation unit that creates first signature data for the update file using a hash value calculated from the update file; The second information processing device an acquisition unit that acquires the update file and the first signature data; a first verification unit that verifies the update file using the first signature data when updating the startup file with the update file; an update unit that updates the startup file of the second information processing device with the update file verified by the first verification unit; a second creation unit that creates verification data for verifying the boot file updated by the update unit based on the hash value obtained from the first signature data; a second verification unit that verifies the startup file updated by the update unit using the verification data when the second information processing device is started using the startup file updated by the update unit; An information processing system having:

2. The information processing system according to claim 1 , wherein the verification data includes second signature data created using the hash value obtained from the first signature data.

3. The information processing system according to claim 1 , wherein the verification data includes the hash value obtained from the first signature data.

4. 4. The information processing system according to claim 1, wherein the information processing device further comprises a notification unit that notifies an error when the first verification unit fails to verify the update file.

5. The information processing system according to claim 1 , wherein the information processing device further comprises a notification unit that notifies an error when the second verification unit fails to verify the startup file.

6. The information processing system according to claim 4 , wherein the notification unit displays an error notification screen that notifies the user of the error.

7. 7. The information processing system according to claim 1, wherein the second creation unit, when creating the verification data, creates the verification data without calculating a hash value of the startup file updated by the update unit.

8. An information processing device that updates a startup file using an update file, an acquisition unit that acquires an update file that updates the startup file and that is created by another information processing device, and first signature data that verifies the update file; a first verification unit that verifies the update file using the first signature data when updating the startup file with the update file; an update unit that updates the startup file of the information processing device with the update file verified by the first verification unit; a second creation unit that creates verification data for verifying the boot file updated by the update unit based on a hash value obtained from the first signature data; a second verification unit that verifies the startup file updated by the update unit using the verification data when the information processing device is started up using the startup file updated by the update unit; An information processing device having the above.

9. an information processing device that updates a startup file using an update file, an acquisition process for acquiring an update file for updating the startup file, which is created by another information processing device, and first signature data for verifying the update file; a first verification process for verifying the update file using the first signature data when updating the startup file with the update file; an update process for updating the startup file of the information processing device with the update file verified in the first verification process; a second generation process for generating verification data for verifying the boot file updated in the update process based on a hash value obtained from the first signature data; a second verification unit that verifies the startup file updated in the update process using the verification data when the information processing device is started up using the startup file updated in the update process; An information processing method that performs the above.

10. A program that causes an information processing device to execute the information processing method according to claim 9.

Images