Electronic equipment

Abstract

To provide electronic equipment that suppresses a decrease in security due to recovery processing on detecting boot data being altered.SOLUTION: A storage device 2 is a nonvolatile storage device which comprises a normal use region 2A and a backup region 2B. An alteration detection part 21 reads a boot code 31A out of the normal use region 2A, and determines whether the read boot code 31A is altered. When it is determined that the read boot code 31A is not altered, a boot code rewrite part 22 rewrites the boot code 31B in the backup region 2B with the boot code 31A in the normal use region 2A on condition that the boot code 31A in the normal use region 2A and the boot code 31B in the backup region 2B are not the same.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an electronic device. [Background technology]

[0002] In a certain information processing device, when tampering with boot data is detected, the boot data is restored to the state before the tampering was detected (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent Publication No. 2021-131710 Summary of the Invention [Problem to be solved by the invention]

[0004] However, in the above-described information processing device, when tampering with the boot data is detected, there is a possibility that the boot data may be returned to a vulnerable state, which is undesirable from the viewpoint of security.

[0005] The present invention has been made in view of the above-mentioned problems, and has an object to provide an electronic device that suppresses a decrease in security caused by recovery processing when tampering with boot data is detected. [Means for solving the problem]

[0006] The electronic device of the present invention comprises a non-volatile memory device having a first memory area and a second memory area, a tampering detection unit that reads the boot code in the first memory area and determines whether the read boot code has been tampered with, and a boot code rewriting unit that rewrites the boot code in the second memory area with the boot code in the first memory area when it is determined that the read boot code has not been tampered with and the boot code in the first memory area and the boot code in the second memory area are not identical. [Effects of the Invention]

[0007] According to the present invention, an electronic device can be obtained that suppresses a decrease in security caused by recovery processing when tampering with boot data is detected.

[0008] The above and other objects, features and advantages of the present invention will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a block diagram showing the configuration of an electronic device according to an embodiment of the present invention. [Figure 2] FIG. 2 is a flowchart illustrating the operation of the electronic device shown in FIG. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0011] Figure 1 is a block diagram showing the configuration of an electronic device according to an embodiment of the present invention. The electronic device shown in Figure 1 includes a processor chip 1 and a rewritable nonvolatile storage device 2 such as a flash memory. The processor chip 1 reads and writes data from and to the storage device 2.

[0012] The processor chip 1 includes a processor 11 such as a CPU (Central Processing Unit) and a ROM (Read Only Memory) 12 .

[0013] The processor 11 executes various processes by executing programs (such as a boot loader, a boot program, and an application program) stored in the ROM 12 or the storage device 2. In particular, when the power is turned on, the processor 11 loads and executes programs such as a boot loader from the ROM 12, thereby operating as a tampering detection unit 21 and a boot code rewriting unit 22.

[0014] Furthermore, the storage device 2 has a normal use area 2A (first storage area) and a backup area 2B (second storage area) secured as storage areas.

[0015] The normal use area 2A stores a boot code 31A, a hash value 32A of the boot code 31A, and tampering detection information 33A. The tampering detection information 33A is (one) hash value for the boot code 31A and the hash value 32A.

[0016] The backup area 2B stores a boot code 31B, a hash value 32B of the boot code 31B, certification information 34, and tampering detection information 33B. The tampering detection information 33B is (one) hash value for the boot code 31B, the hash value 32B, and the certification information 34.

[0017] The boot code 31B and hash value 32B in the backup area 2B are the boot code 31A and hash value 32A that have been read from the normal use area 2A and written to the backup area 2B.

[0018] The certification information 34 is data having a value unique to the electronic device (processor chip 1).

[0019] Furthermore, the tampering detection unit 21 reads the boot code 31A in the normal use area 2A and determines whether the read boot code 31A has been tampered with. Specifically, the tampering detection unit 21 reads the hash value 32A and the tampering detection information 33A in addition to the boot code 31A, derives a hash value for the read boot code 31A and hash value 32A, determines whether the derived hash value matches the tampering detection information 33A, and if they match, determines that the boot code 31A has not been tampered with. If they do not match, determines that the boot code 31A has been tampered with. Here, "tampering" includes not only intentional changes but also unintentional data damage.

[0020] Similarly, if the tampering detection unit 21 determines that the boot code 31A read from the normal use area 2A has been tampered with, it reads the boot code 31B from the backup area 2B and determines whether the boot code 31B read from the backup area 2B has been tampered with based on the tampering detection information 33B.

[0021] Furthermore, if the boot code rewriting unit 22 determines that the boot code 31A read from the normal use area 2A has not been tampered with, and if the boot code 31A in the normal use area 2A and the boot code 31B in the backup area 2B are not identical, the boot code rewriting unit 22 rewrites the boot code 31B in the backup area 2B with the boot code 31A in the normal use area 2A.

[0022] That is, every time the electronic device is started up, the boot code 31B is set to match the boot code 31A unless the boot code 31A has been tampered with.

[0023] If it is determined that the boot code 31A read from the normal use area 2A has been tampered with and that the boot code 31B read from the backup area 2B has not been tampered with, the boot code rewriting unit 22 acquires the latest boot code from an external server or the like and rewrites the boot code 31A in the normal use area 2A with the acquired boot code.

[0024] In addition, in this embodiment, the boot code rewriting unit 22 (a) if it determines that the boot code 31B read from the backup area 2B has not been tampered with, acquires the latest boot code and the hash value of the latest boot code, and rewrites the boot code 31A and hash value 32A in the normal use area 2A with the acquired boot code and hash value, and (b) if it determines that the boot code 31A read from the normal use area 2A has not been tampered with and the boot code 31A in the normal use area 2A and the boot code 31B in the backup area 2B are not identical, rewrites the boot code 31B and hash value 32B in the backup area 2B with the boot code 31A and hash value 32A in the normal use area 2A.

[0025] Furthermore, the tampering detection unit 21 (a) acquires a hash value for the boot code 31A and hash value 32A in the normal use area 2A and writes it to the normal use area 2A as tampering detection information 33A, and determines whether the boot code 31A read from the normal use area 2A has been tampered with based on the tampering detection information, and (b) determines whether the boot code 31B read from the backup area 2B has been tampered with based on the tampering detection information in the backup area 2B.

[0026] Furthermore, when the boot code 31B and hash value 32B in the backup area 2B are rewritten with the boot code 31A and hash value 32A in the normal use area 2A, the tampering detection unit 21 generates certification information 34 unique to the electronic device and stores it in the backup area 2B, and writes the hash value of the boot code 31B, hash value 32B, and certification information 34 in the backup area 2B to the backup area 2B as tampering detection information. When reading the boot code 31B from the backup area 2B, the tampering detection unit 21 also reads tampering detection information 33B and certification information 34 from the backup area 2B, and determines whether the boot code 31B read from the backup area 2B has been tampered with based on the read tampering detection information 33B. If the read certification information 34 differs from the certification information 34 when it was generated, the tampering detection unit 21 determines that the storage device 2 has been fraudulently replaced and aborts the startup process using the boot codes 31A and 31B.

[0027] Next, the operation of the electronic device will be described with reference to FIG.

[0028] When the electronic device is powered on (step S1), the tampering detection unit 21 reads the boot code 31A and the like from the normal use area 2A (step S2), and determines whether the boot code 31A has been tampered with (step S3).

[0029] If it is determined that the boot code 31A has not been tampered with, a predetermined startup process is executed in accordance with the boot code 31A (step S4).Then, the boot code rewriting unit 22 determines whether the boot code 31A and the boot code 31B in the backup area 2B are the same (step S5), and if they are not the same, rewrites the boot code 31B in the backup area 2B with the boot code 31A (step S6).

[0030] On the other hand, if it is determined in step S3 that the boot code 31A has been tampered with, the tampering detection unit 21 reads the boot code 31B etc. in the backup area 2B (step S7) and determines whether the boot code 31B has been tampered with (step S8).

[0031] If it is determined that the boot code 31B has not been tampered with, a predetermined startup process is executed in accordance with the boot code 31B (step S9). Then, the boot code rewriting unit 22 downloads the latest boot code (step S10) and rewrites the boot code 31A in the normal use area 2A with the downloaded boot code (step S11).

[0032] On the other hand, if it is determined in step S8 that the boot code 31B has been tampered with, error processing is executed and the startup processing of the electronic device is stopped (step S12).

[0033] As described above, according to the above embodiment, the storage device 2 is a non-volatile storage device including the normal use area 2A and the backup area 2B. The tampering detection unit 21 reads the boot code 31A in the normal use area 2A and determines whether the read boot code 31A has been tampered with. If it is determined that the read boot code 31A has not been tampered with and the boot code 31A in the normal use area 2A and the boot code 31B in the backup area 2B are not identical, the boot code rewriting unit 22 rewrites the boot code 31B in the backup area 2B with the boot code 31A in the normal use area 2A.

[0034] As a result, each time the electronic device is started up, if boot code 31A has not been tampered with, boot code 31B will match boot code 31A, so even if boot code 31A is tampered with and boot code 31B is used instead, boot code 31B that is identical to boot code 31A will be used. This prevents a decrease in security due to recovery processing when tampering with boot data is detected.

[0035] It should be noted that various changes and modifications to the above-described embodiments will be apparent to those skilled in the art. Such changes and modifications may be made without departing from the spirit and scope of the subject matter and without diminishing its intended advantages. In other words, it is intended that such changes and modifications be included within the scope of the claims.

[0036] For example, in the above embodiment, a processor other than the processor that executes the boot codes 31A and 31B may operate as the tampering detection unit 21 and the boot code rewriting unit 22.

[0037] Furthermore, in the above embodiment, when determining whether boot codes 31A and 31B are identical to each other, it may be determined whether hash values ​​32A and 32B are identical to each other, or hash values ​​of boot codes 31A and 31B may be derived and it may be determined whether the derived hash values ​​are identical to each other. [Industrial Applicability]

[0038] The present invention is applicable to, for example, electronic devices. [Explanation of symbols]

[0039] 2 Storage device 2A Normally used area (an example of the first storage area) 2B Backup area (an example of a second storage area) 21 Tampering detection unit 22 Boot code rewriting section 31A, 31B Boot Code 32A,32B hash value 33A, 33B Tamper detection information 34 Certification Information

Claims

1. a non-volatile storage device having a first storage area and a second storage area; a tampering detection unit that reads the boot code in the first storage area and determines whether the read boot code has been tampered with; a boot code rewriting unit that rewrites the boot code in the second storage area with the boot code in the first storage area when it is determined that the read boot code has not been tampered with and the boot code in the first storage area and the boot code in the second storage area are not identical; An electronic device comprising:

2. when determining that the boot code read from the first storage area has been tampered with, the tampering detection unit reads the boot code in the second storage area and determines whether the boot code read from the second storage area has been tampered with; when it is determined that the boot code read from the second storage area has not been tampered with, the boot code rewriting unit acquires the latest boot code and rewrites the boot code in the first storage area with the acquired boot code; 2. The electronic device according to claim 1,

3. the boot code rewriting unit (a) when it is determined that the boot code read from the second storage area has not been tampered with, acquires the latest boot code and a hash value of the latest boot code, and rewrites the boot code in the first storage area and the hash value of the boot code with the acquired boot code and hash value; (b) when it is determined that the boot code read from the first storage area has not been tampered with and the boot code in the first storage area and the boot code in the second storage area are not identical, rewrites the boot code in the second storage area and the hash value of the boot code with the boot code in the first storage area and the hash value of the boot code; the tampering detection unit (a) acquires the boot code in the first storage area and a hash value of the boot code, and writes the hash value of the boot code as tampering detection information in the first storage area, and determines whether the boot code read from the first storage area has been tampered with based on the tampering detection information; and (b) determines whether the boot code read from the second storage area has been tampered with based on the tampering detection information in the second storage area.

3. The electronic device according to claim 2,

4. The electronic device according to claim 3, wherein the tampering detection unit (a) generates certification information unique to the electronic device and stores it in the second storage area when the boot code and the hash value of the boot code in the first storage area are rewritten with the boot code and the hash value of the boot code, and writes the boot code, the hash value of the boot code, and the hash value of the certification information in the second storage area as tampering detection information to the second storage area; and (b) reads the tampering detection information and the certification information from the second storage area when reading the boot code from the second storage area, and determines whether the boot code read from the second storage area has been tampered with based on the read tampering detection information. Furthermore, if the read certification information differs from the generated certification information, the electronic device determines that the storage device has been fraudulently replaced and aborts the startup process using the boot code.

Images