Electronic device

Abstract

To improve efficiency of alteration verification processing while securing integrity of a program in an electronic apparatus.SOLUTION: An electronic device (100a) performs falsification verification of a snapshot image (230a) configured to include a state of a first area (executing area) of a storage unit (150) when a first program (240a) is being executed and a state of a second area (unexecuted area) of the storage unit (150) when a second program (250b) that the electronic device has not yet executed is stored in the storage unit (150).SELECTED DRAWING: Figure 11

Description

[Technical Field]

[0001] The present disclosure relates to electronic devices. [Background technology]

[0002] Electronic devices incorporating electronic boards equipped with processors, memory, flash memory, etc. is also called an embedded system. In an embedded system, an OS (Operating System) In order to start programs such as RAM (Random Access Memory) images containing the state of the device are stored in flash memory, etc. The next time you start up, the RAM image will be loaded from flash memory etc. into RAM. Here, Patent Document 1 describes a method of storing a part of the RAM image in RAM at startup. Pre-reading is performed to sequentially read pages that have generated page faults during program execution from RAM. The RAM image is also called a snapshot image. Called. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2011-145933 Summary of the Invention [Problem to be solved by the invention]

[0004] Generally, a snapshot image is a data stored in a non-volatile memory unit that represents the state of a main memory unit during program execution. Therefore, programs that are not yet executed when the snapshot image is generated are not included in the snapshot image and are not subject to tampering verification when the electronic device is started up. Therefore, when an unexecuted program is executed, a separate tampering verification of the program is required, which takes time and makes tampering verification inefficient. Note that the technology disclosed in the above-mentioned Patent Document 1 does not handle tampering checks of snapshot images.

[0005] The present disclosure has been made in consideration of the above-mentioned problems, and provides a method for implementing a program in an embedded system. Method for booting an embedded system to streamline the tamper verification process while ensuring the integrity of the system - Patents.com The present invention aims to provide a boot program and an embedded system. [Means for solving the problem]

[0006] A first aspect of the present disclosure provides an electronic device that performs tamper verification of a snapshot image that includes the state of a first area of ​​a memory unit when a first program is being executed and the state of a second area of ​​the memory unit when the electronic device stores a second program in the memory unit that has not yet been executed. [Effects of the Invention]

[0007] The present disclosure makes it possible to provide an electronic device that ensures the integrity of programs stored in the electronic device while improving the efficiency of tamper verification processing. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a block diagram showing a configuration of an embedded system according to a first embodiment of the present invention. [Figure 2] FIG. 4 is a diagram showing an example of data stored in a nonvolatile storage unit according to the first embodiment. [Figure 3]1 is a block diagram showing a functional configuration of an embedded system according to a first embodiment of the present invention. [Figure 4] 10 is a flowchart showing the flow of a startup process of the embedded system according to the first embodiment. [Figure 5] FIG. 10 is a sequence diagram showing the flow of a snapshot image startup process according to the first embodiment. [Figure 6] FIG. 2 is a diagram for explaining the concept of snapshot image startup processing according to the first embodiment. [Figure 7] FIG. 10 is a sequence diagram showing the flow of a snapshot image startup process according to another example of the first embodiment. [Figure 8] FIG. 10 is a diagram for explaining the concept of a snapshot image startup process according to another example of the first embodiment. [Figure 9] FIG. 10 is a block diagram showing the functional configuration of an embedded system according to a second embodiment. [Figure 10] 10 is a flowchart showing the flow of a snapshot image storage process according to the second embodiment. [Figure 11] FIG. 10 is a diagram for explaining the concept of snapshot image storage processing according to the second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0009] Specific embodiments of the present disclosure will be described in detail below with reference to the drawings. In each drawing, the same elements are given the same reference numerals, and for clarity of explanation, Duplicate explanations will be omitted accordingly.

[0010] <Embodiment 1> FIG. 1 is a block diagram showing the configuration of an embedded system 100 according to the first embodiment. The embedded system 100 is a computer system for realizing a specific function. The embedded system 100 is a microcomputer installed in, for example, a home appliance, an industrial device, a mobile object, etc. Electronic devices include, for example, car navigation systems. Examples include, but are not limited to, computer equipment, television receivers, and hard disk recorders. The embedded system 100 includes a processor 110, a Boot ROM (Read Only A memory 120, a time ROM 130, a non-volatile memory unit 140, and a main memory unit 150 At least prepare.

[0011] The processor 110 is a control device that controls each part of the embedded system 100. The processor 110 is, for example, a CPU (Central Processing Unit) or the like, and an MMU (Memory Management Unit). It is also acceptable to have multiple CPUs and FPGAs. A(Field Programmable Gate Array), ASIC(Application Specific Integrated C It is also possible to combine various devices such as a controller (circuit) in any way to control each part in a coordinated manner.

[0012] The BootROM 120 is a processor read / write device that is used when the embedded system 100 is powered on. The server 110 reads, for example, the system BIOS (Basic Input / Output System) The initial processing program is a storage device that stores the initial processing program described below. If the verification confirms that the first boot program is normal, Boot is a computer program that implements the process of loading and starting RAM. The ROM 120 may be configured by dividing it into areas on the nonvolatile storage unit 140, which will be described later.

[0013] The 1timeROM 130 is, for example, a ROM that can be written only once. The time ROM 130 stores encryption key information such as a public key 131 and an ID unique to the device. The public key 131 is used by the above-mentioned initial processing program during verification. The BootROM 120 and the 1timeROM 130 are secure areas. It is preferable that the processor 110 is configured as a single chip. stomach.

[0014] The nonvolatile storage unit 140 stores various programs and data executed by the embedded system 100. The nonvolatile storage unit 140 is a nonvolatile storage device that stores data. The nonvolatile storage unit 140 may be a semiconductor memory such as a hard disk drive. For example, an example of flash memory is eMMC (embedded Multi Media Card), The nonvolatile storage unit 140 may include, but is not limited to, flash ROM. It is also called an external storage device or auxiliary storage device.

[0015] FIG. 2 is a diagram showing an example of data stored in the nonvolatile storage unit 140 according to the first embodiment. The nonvolatile storage unit 140 stores a first boot program 210, a second boot program 220, a first program 230, a second program 240 and a snapshot image Remember Ji 250.

[0016] The first boot program 210 verifies the second boot program 220 and if the verification is successful, A computer program that loads and starts a second startup program when a malfunction is detected. The first boot program 210 is a program that implements the so-called boot loader process. The first startup program 210 is encrypted using a secret key (not shown). Here, the private key is a key paired with the public key 131 described above. The first startup program 210 is a more complicated program than the above-mentioned initial processing program. Specifically, the first startup program 210 is a A process for verifying whether the running program 220 and the snapshot image 250 have been tampered with The first boot program 210 is implemented as a second boot program 220. The process of issuing an instruction to transfer the snapshot image 250 to the main memory unit 150 is The first startup program 210 is verified as normal and has not been tampered with during tampering verification. If it is confirmed that the snapshot image 250 is restored, a process of issuing an instruction to restore the snapshot image 250 is performed. It has been implemented.

[0017] The second startup program 220 is more complex than the first startup program 210 described above. Specifically, the second startup program 2 20 transfers the snapshot image in response to a transfer instruction from the first boot program 210. The process of transferring the message 250 from the nonvolatile storage unit 140 to the main storage unit 150 is implemented. In particular, the second boot program 220 compresses the snapshot image 250 into a predetermined format. The compressed data is transferred from the nonvolatile storage unit 140 to the main storage unit 150. The second boot program 220 saves the snapshot from the nonvolatile storage unit 140 to the main storage unit 150. The image data 250 is copied. Various known formats can be used for data compression. The second boot program 220 may be a program that is the same as the first boot program. In response to a restore command from the RAM 210, a process of restoring the snapshot image 250 is performed. More specifically, the second boot program 220 is installed in the main memory 150. The compressed data is expanded and the first program is restored. The process of restoring the image 250 is, for example, restoring the hardware registers of the processor 110. The state of settings, memory, etc. is the same as when the snapshot image 250 was created. The snapshot image is a process to restore the state, i.e., the state where the program can be executed again. The process of restoring 250 may be a process of deploying the processes required for the operation in a timely manner. The snapshot image is created in such a way that the compressed data can be expanded and restored in one go. By creating page 250, you can efficiently complete the process from booting to restoring a snapshot. Then, the second startup program 220 executes the restored first program. Move to the state.

[0018] The first program 230 includes one or more computer programs. The program 230 includes an OS (Operating System) 231, an application program 232, application programs 233, etc. Basic software, including the kernel. Application programs 23 2 and 233 are responses that realize functions provided to users in electronic devices, respectively. It is software for use.

[0019] The second program 240 includes one or more computer programs other than the OS. In this case, the second program 240 includes application programs 241, . . . The application program 241 is the above-mentioned application program This is application software that is different from 232 and 233.

[0020] The snapshot image 250 is a snapshot of the main memory 15 while the first program 230 is running. The state of 0 is the output data. The snapshot image 250 is The application programs 232 and 233 are loaded into the main memory 150. The snapshot image 250 also includes the OS 231, application The contents of registers and program counters when the programs 232 and 233 are executed, It includes a stack pointer, etc. Also, the snapshot image 250 is compressed in a predetermined format. The embedded system 100 may store, for example, snapshot data. There is no need to update the snapshot image 250, and the system always uses the same snapshot image 250. In the case of an operation to start the system, the first program and the second program shown by the dashed lines in Figure 2 The construction of a program may not be necessary.

[0021] Returning to Figure 1, we continue the explanation. The main memory unit 150 is a memory area for temporarily storing information while the processor 110 is operating. The main memory unit 150 is also called a volatile memory unit, a primary memory unit, or simply a "memory." The main storage unit 150 is, for example, a high-speed volatile storage device such as a RAM. The main memory unit 150 is a DRAM (Dynamic RAM), an SRAM (Static RAM), or the like. For example, the main storage unit 150 may store the above-mentioned initial processing program, the first startup program, 210, second startup program 220, first program 230, second program 2 40 and snapshot images 250, etc.

[0022] The embedded system 100 also includes a general microcomputer as a configuration not shown. It shall have the configuration of a computer.

[0023] FIG. 3 is a block diagram showing the functional configuration of the embedded system 100 according to the first embodiment. FIG. 3 shows how the processor 110 of the embedded system 100 stores various programs in the main memory. The functional blocks when various programs are executed by loading them into 150 are shown. Specifically, the processor 110 loads an initial processing program from the BootROM 120 into the main memory. By loading the program into the initial processing unit 150 and executing it, it functions as the initial processing unit 160. The unit 160 executes the startup process of the embedded system 100 implemented in the above-mentioned initial processing program. This is a functional block that realizes the initial processing at the time.

[0024] The processor 110 also downloads the first boot program 210 from the nonvolatile storage unit 140. By loading it into the main storage unit 150 and executing it, it functions as the first startup processing unit 161. The first boot processing unit 161 is a built-in system 1 is a functional block that realizes the first startup process of the system 100.

[0025] The processor 110 also downloads the second boot program 220 from the nonvolatile storage unit 140. By loading it into the main storage unit 150 and executing it, it functions as the second startup processing unit 162. The second boot processing unit 162 is a built-in system 1 is a functional block that realizes the second startup process of the system 100.

[0026] The processor 110 also reads the first program 230 from the nonvolatile storage unit 140. By loading the program into the memory unit 150 and executing it, the snapshot unit 163 and the basic function unit 1 70, a function for realizing the main processing of the embedded system 100 such as an application 171 The snapshot section 163 functions as a block. The state of the main memory unit 150 during program execution is periodically or at an externally specified timing. A snapshot image 250 is generated from the state and stored in the non-volatile storage unit 140. This function unit 170 is a function block that realizes the processing implemented in the OS 231. The snapshot unit 163 may also be realized by a process implemented in the OS 231. The application 171 is implemented in application programs 232 and 233, . . . The processor 110 is a functional block that realizes the above-described processing. 0 to the main memory unit 150 and executes the second program 240. The processing of the application may be realized.

[0027] FIG. 4 is a flowchart showing the flow of the startup process of the embedded system according to the first embodiment. It is assumed that the embedded system 100 has been running on each of the programs that were running at the time of the previous startup. The state of the main memory 150 of the seed program is stored as a snapshot image 250 in a non-volatile manner. It is assumed that the data has already been stored in the storage unit 140.

[0028] First, the embedded system 100 is powered on. 0 receives a power-on notification (S101). The processor 110 of the embedded system 100 starts the boot process. The above-mentioned initial processing program is read from M120 and executed ( S102) As a result, the processor 110 functions as the initial processing unit 160.

[0029] Next, the initial processing unit 160 verifies the first boot program 210 (S103). Specifically, the initial processing unit 160 reads the first boot program 210 from the nonvolatile storage unit 140. into the main memory unit 150. Then, the initial processing unit 160 loads the first The public key 131 in the 1-time ROM 130 is used to authenticate the boot program 210. The encryption and signature using the asymmetric key are verified. The verification process by the initial processing unit 160 is performed by a known method. Techniques may be used, as may other verification processes.

[0030] Then, the initial processing unit 160 determines whether the first boot program 210 has been successfully verified. If the verification fails (NO in S104), the embedded system 10 0 ends without starting. At this time, the embedded system 100 notifies the user that the verification has failed. You may output it.

[0031] Here, the first activation program 210 is registered in advance by a public key 131 and a corresponding private key. Therefore, the initial processing unit 160 uses the public key 13 1 to decrypt the first boot program 210 and verify the signature, and the verification is successful. (YES in S104). Therefore, the initial processing unit 160 executes the first boot program 210. As a result, the processor 110 executes the first activation processing unit 161 (S105). It works.

[0032] Next, the first boot processing unit 161 verifies the second boot program 220 (S10 6) Specifically, the first startup processing unit 161 retrieves the second startup program from the nonvolatile storage unit 140. The first startup processing unit 161 then loads the program 220 into the main storage unit 150. A hash value is calculated from the second boot program 220 on the storage unit 150 and stored in advance. Verification is performed by comparing the calculated hash value with a verification hash value (not shown). cormorant.

[0033] Then, the first boot processing unit 161 determines whether the second boot program 220 has been successfully verified. For example, if the matched hash values ​​are different, the verification is considered to have failed. If the verification fails (NO in S107), the embedded system 100 At this time, the embedded system 100 is stopped by the Watchdog. Alternatively, the embedded system 100 may output a message indicating that the verification has failed. That's fine.

[0034] On the other hand, if the hash values ​​match, the verification is successful (YES in S107). The first startup processing unit 161 performs snapshot image startup processing (S108). First, the first activation processing unit 161 executes the second activation program 220. The processor 110 also functions as a second activation processing unit 162 .

[0035] FIG. 5 is a sequence diagram showing the flow of the snapshot image startup process according to the first embodiment. 6 is a diagram showing the snapshot image startup process according to the first embodiment. 5 and 6 are diagrams for explaining the concept of the present invention. In the following description, reference will be made to FIGS. do.

[0036] First, the first activation processing unit 161 issues an initialization instruction to the second activation processing unit 162. In response to this, the second boot processing unit 162 starts the second boot program 220 (S111). After the initialization is completed, the second startup processing unit 162 Then, the first activation processing unit 161 is notified of the completion of initialization (S113).

[0037] Then, the first activation processing unit 161 sends a snapshot to the second activation processing unit 162. At this time, the first startup processing unit 161 issues a transfer instruction to the host computer 250 (S114). is the destination address of the snapshot image 250 in the main memory 150, that is, For example, the destination address is the address in Figure 6. Let the address be addr1.

[0038] In response to this, the second startup processing unit 162 stores the snapshot image 250 in a nonvolatile manner. The data is transferred from the specific storage unit 140 to the main storage unit 150 (S115). The unit 162 reads the snapshot image 250 from the nonvolatile storage unit 140 and stores it in the main memory. The address addr1 in the storage unit 150 is used as the start address for transfer, and the snapshot image is In the startup process, before step S115, the non-volatile A simple image validation is performed on the snapshot image 250 in the storage unit 140. For example, the first startup processing unit 161 or the second startup processing unit 162 may Check the header and file SUM of snapshot image 250 to make sure there are no problems. If there is no need to do so, step S115 may be performed. The snapshot image 250a is assumed to be compressed data. The shot image 250a has been transferred to the main memory 150, but the internal programs have not yet been transferred. It will be an execution.

[0039] After step S115, the second startup processing unit 162 reads the snapshot data transferred to the main storage unit 150. Data size s from address addr2, which corresponds to the end of snapshot image 250a ize is acquired, and the transfer including the data size size is sent to the first startup processing unit 161. An end notification is sent (S116).

[0040] In response to this, the first startup processing unit 161 selects the transfer destination and the snapshot before deployment. The first boot processing unit 161 performs tampering verification on the image 250a (S117). The snapshot image 250a in the main memory unit 150 is then verified for tampering. Specifically, the first activation processing unit 161 starts the process at the address addr1 specified in step S114. Add the data size (size) included in the transfer completion notification to the address that is the end address. Then, the first startup processing unit 161 calculates addr2. Tamper verification is performed on the range from addr1 to addr2.

[0041] For example, the first startup processing unit 161 executes a hash on the snapshot image 250a. The hash value is calculated and compared with a previously stored verification hash value (not shown). That is, the first activation processing unit 161 determines whether or not the verification is successful. If the hash values ​​match, the tampering verification is successful. If the tampering verification fails, the embedded system 100 determines that the The embedded system 100 ends without starting (not shown). A message to that effect may be output.

[0042] If the tampering verification is found to be normal, the first startup processing unit 161 62 is instructed to restore the snapshot image 250a (S118). In response to this, the second boot processing unit 162 extracts the snapshot image 250a. As a result, the first program 230a is restored in the main storage unit 150 (S119). For example, as shown in FIG. 6, the main storage unit 150 contains an OS 231a, an application program As a result, the first program 230a including the programs 232a and 233a is transferred. In addition, the second startup processing unit 162 is included in the snapshot image 250a. The OS 231a, application programs 232a and 233a, etc., which are used for The second startup processing unit sets the contents of the program, the program counter, the stack pointer, etc. 162, even if the snapshot image 250a is released from the main memory unit 150 after restoration. good.

[0043] Thereafter, the second startup processing unit 162 executes the restored first program 230a. (S120). As a result, the embedded system 100 creates a snapshot image 25 The execution of the program resumes in the state when 0 was acquired. This startup process uses the snapshot image 250a, so The first program 230 in the storage unit 140 is loaded, and each program is initialized and executed. It can start up faster than when using

[0044] In this way, the startup process of the embedded system according to the first embodiment is a so-called secure It is a process that corresponds to and extends booting, and meets the security requirements that have been increasing in recent years. Before executing the main program of the embedded system, the integrity of the target program is verified. In particular, in the first embodiment, the tamper detection For verification, the snapshot image 250 is transferred from the non-volatile storage unit 140 to the main storage unit 150. After the tampering verification, the snapshot image on the main memory unit 150 is transferred to the 250a is extracted and restored, and the program is resumed. The number of transfers of the image from the non-volatile storage unit 140 to the main storage unit 150 is minimized. This allows for fast startup of embedded systems while ensuring their integrity.

[0045] Furthermore, the second startup processing unit 162 creates a compressed snapshot image 25 To verify tampering against 0a, the data to be verified is made smaller than the data after expansion. In addition, when tamper verification is performed on compressed data before decompression, In this case, unexpected problems that may occur during the deployment process can be prevented, and the process can be executed safely.

[0046] In addition, in steps S114 to S116, the first activation processing unit 161 transfers the The actual address range of the main memory 150 in the snapshot image 250a is not shown. Therefore, the first activation processing unit 161 can accurately grasp the range of the appropriate target. This allows for tamper verification.

[0047] Next, another example of the first embodiment will be described. An embedded system according to this example The configuration of 100 is the same as that of FIG. 1. In this embodiment, snapshot image 2 The extraction process of 50a extracts the snapshot image 250 from the non-volatile storage unit 140 to the main storage unit 140. This differs from the above embodiment in that at least part of the transfer process to the memory unit 150 is performed in parallel. .

[0048] FIG. 7 shows a flow of a snapshot image storage process according to another example of the first embodiment. FIG. 8 is a sequence diagram showing a snapshot according to another example of the first embodiment. 7 is a diagram for explaining the concept of shot image storage processing. In the following description, The description will be made with reference to FIG. 8 as needed. Note that similar components are denoted by the same or corresponding reference numerals. The title will be assigned, and duplicate content will be omitted as appropriate.

[0049] The first startup processing unit 161 sends a snapshot image to the second startup processing unit 162. In this embodiment, the second The explanation will be given assuming that the startup processing unit 162 also performs tampering verification after the transfer. There is no need to specify a starting address.

[0050] In response to the instruction in step S114b, the second startup processing unit 162 starts the snapshot instance. While transferring the image 250 from the nonvolatile memory unit 140 to the main memory unit 150, The snapshot image 250a in the main memory 150 is expanded in the main memory 150 to form the first program. For example, the second startup processing unit 162 restores the nonvolatile program 230a (S121). The partial data of the snapshot image 250 transferred from the functional memory unit 140 is sequentially stored in the main memory. While storing the snapshot image 250a in the storage unit 150, the stored part Therefore, the second startup processing unit 162 performs the expansion in order from the snapshot data. Before the transfer of the snapshot image is completed, the snapshot image already stored in the main memory unit 150 at that time is This starts the extraction of the partial data of the snapshot image. At least a part of the process of transferring the snapshot image and the process of expanding the snapshot image are performed in parallel. In other words, the second startup processing unit 162 converts the snapshot image 150 into a predetermined format. After starting to transfer the compressed data from the nonvolatile storage unit 140 to the main storage unit 150, During the time from the start of the transfer to the completion of the transfer, the compressed data is decompressed on the main memory unit 150, and the first The program 230a is restored.

[0051] Next, the second startup processing unit 162 reads the snapshot image data transferred to the main storage unit 150. The second activation processing unit 16 performs tampering verification on the image 250a (S122). The second boot processing unit 16 performs tampering verification on the compressed data after transfer. 2 is concurrently developing the snapshot image 250a, i.e., the first program Therefore, the snapshot that has been transferred and is not yet deployed may be in the process of being restored. The tampering verification process for the image 250a and the snapshot image 250a are There is a time period in which the expansion process (restoration process) to the program 230a of the first program is executed in parallel. Good too.

[0052] If the tampering verification in step S122 confirms normality, the second startup processing unit 162 The first program 230a that has already been restored is executed (S120). The program execution system 100 executes the program in the state at the time when the snapshot image 250 was acquired. The line is restarted, i.e., the embedded system 100 boots up.

[0053] If the tampering verification in step S122 does not confirm normality, or if the tampering verification in step S12 If an area error occurs during the first extraction process, the second startup processing unit 162 The second activation processing unit 162 terminates the process without instructing the first activation processing unit 161 to execute the process (not shown). You may return it to finish the startup process.

[0054] As described above, the second startup processing unit 162 starts the snapshot process in step S121. The transfer process of the image and the part of the expansion process are performed in parallel, and the memory of the main memory unit 150 is stored in advance. The image is expanded to a snapshot image 250a on the server, but the execution is in step S121. Since this is done after tampering verification, the integrity of the program can be ensured. By performing processing in parallel, memory resources including the cache of the processor 110 are used. By being able to handle this efficiently, it is possible to achieve faster startup with even shorter processing times. .

[0055] <Embodiment 2> The second embodiment is a modification of the first embodiment. The object of the verification is a snapshot image of the first program 230 being executed. Therefore, when a snapshot image is acquired, the execution is not completed, that is, the main memory 1 For the second program 240 that is not loaded in the 50, the snapshot image is Therefore, the second program 240 is not included in the message and is not subject to tampering verification. In contrast, in the second embodiment, the verification of tampering that has not been performed is performed separately. By including a second program 240 in the snapshot image, the start-up modification can be performed. During the check, the first program 230 and the second program 240 are executed together. This makes the tampering verification process more efficient. The size of the RAM 240 is larger than the free space of the main memory 150 when the first program 230 is executed. It shall be smaller than

[0056] FIG. 9 is a block diagram showing the functional configuration of an embedded system 100a according to the second embodiment. The physical configuration of the embedded system 100a according to the second embodiment is shown in the above-mentioned figure. 1, the same as in the embedded system 100, and therefore the overlapping contents will be omitted as appropriate. 3, the snapshot portion 163 is changed to the snapshot portion 163a. The main memory unit 150 includes an executed area and an unexecuted area. Here, the execution area is a region that stores the first program that the processor 110 is executing. The unexecuted area is an area where the processor 110 stores the unexecuted second program. This is an area where information is stored.

[0057] An example of the procedure for generating and storing a snapshot image in this embodiment will be described below. The snapshot unit 163a according to the second embodiment creates a snapshot image. When generating the message, a second program designated in advance is transferred from the nonvolatile storage unit 140 to the main memory. In other words, the snapshot unit 163a transfers the snapshot data to the unexecuted area of ​​the built-in snapshot unit 150. During the startup of the system 100a, the first data is transferred from the nonvolatile memory unit 140 to the unexecuted area of ​​the main memory unit 150. Then, the snapshot unit 163a transfers the program of the main memory unit 150. A snapshot image is generated based on the state of the execution region and the state of the unexecuted region. The snapshot image is stored in the volatile storage unit 140. The program includes a first program and a second program that has not yet been executed.

[0058] FIG. 10 is a flowchart showing the flow of the snapshot image storage process according to the second embodiment. FIG. 11 is a chart showing a snapshot image format according to the second embodiment. 10 and 11 are diagrams for explaining the concept of the storage process. and explain.

[0059] For example, when developing the embedded system 100, a developer may Among the programs installed in the For example, a developer may use a development terminal to During execution of the first program 230a, The program 240 in step 2 is selected as being unexecuted.

[0060] The snapshot unit 163a takes the unexecuted area of ​​the main memory unit 150 from the nonvolatile memory unit 140. For example, as shown in FIG. 10, the main program 240 is transferred to the main area (S201). The second program including the application program 241a is stored in the unexecuted area 152 of the storage unit 150. The program 240a is transferred.

[0061] After that, the snapshot unit 163a takes a snapshot of the first program 230 in the main memory unit 150. a and the snapshot image 250b including the second program 240a are stored in a non-volatile The snapshot unit 163a stores the snapshot data in the characteristic storage unit 140 (S202). The area including the execution area 151 and the unexecuted area 152 of the storage unit 150 is compressed and snapped. The snapshot image 250b is generated. The image 250b is stored in a non-volatile manner as a snapshot image 250b during normal operation. The snapshot image 250b is generated and stored in the factory. When writing in or when updating a major program, For example, developers may implement the above-described procedure. Generate a snapshot image 250b using a development terminal or the like without using 100a, The generated snapshot image 250b is stored in a nonvolatile memory in the embedded system 100a. The data may be written to, or stored in, the memory 140. The program includes at least a first program 230a that is running and a second program 24 that is not running. A snapshot image 250b is generated from the state of the main memory in which the values ​​0a and 10b are stored. At this time, the main storage unit for generating the snapshot image 250b is a development terminal, etc. Even if the memory etc. is built into the computer etc., the built-in system 100a The main memory unit 150 may be used. Then, the computer such as the development terminal stores the generated snapshot. The snapshot image 250b is stored in the non-volatile storage unit 140 of the embedded system 100a. You may also pay.

[0062] Next, the embedded system 100a storing the snapshot image 250b is The startup process during normal operation will be described. The embedded system 100a is configured as shown in FIG. 5, the start-up process is performed. Then, in step S115, the nonvolatile memory The snapshot image 250b transferred from the memory unit 140 to the main memory unit 150 includes the second Therefore, in step S117, the first starting program 240a is The motion processing unit 161 executes a snapshot including a first program 230a and a second program 240a. The snapshot image 250b can be subjected to tamper verification. The first startup processing unit 161 executes a snapshot instance when the embedded system 100a is started. The first program 230a and the second program 240a included in the image 250b are Therefore, a tampering check is separately performed on the second program 240a. This eliminates the need for verification, making tampering verification more efficient.

[0063] If the tampering verification is found to be normal, then in step S120, the second startup process is performed. The unit 162 is configured to execute the programs restored from the snapshot image 250b that have not yet been executed. Execute the first program 230a stored in the execution area 151 other than the execution area 152. That is, the second startup processing unit 162 performs the modification to the snapshot image 250b. If the verification is successful, the snapshot image 250b is read from the main memory 1 50. Therefore, at the time of startup, the second program 230a is executed. The program 240a is not executed, and the state at the time of taking the snapshot image can be restored. Cut.

[0064] <Other embodiments> The embedded systems according to the above-described embodiments are also applicable to general-purpose information processing devices. It is available.

[0065] The present invention has been described above based on the above embodiment, but the present invention does not depend on the configuration of the above embodiment. The present invention is not limited to the above, but is within the scope of the claims of the present application. Of course, this includes various modifications, alterations, and combinations that can be made.

[0066] In the above embodiment, the configuration is explained as a hardware configuration, but the present invention is not limited to this. This disclosure does not mean that any process can be performed by causing a CPU to execute a computer program. This can also be achieved by

[0067] In the above example, when the program is loaded into a computer, the program A set of instructions (or software) that causes a computer to perform one or more of the specified functions. The program may be stored on a non-transitory computer-readable medium or tangible storage. By way of example and not limitation, the present invention may be stored on a computer-readable medium or tangible medium. The storage medium may be RAM, ROM, flash memory, solid-state drive (SSD) or other memory technology, CD-ROM, digital versatile disc (DVD), Blu-ray (registered trademark) disc or other Other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or The program may be stored on a temporary computer-readable medium, including other magnetic storage devices. or may be transmitted over a communication medium. The medium or communication medium may include electrical, optical, acoustic, or other forms of propagated signals. [Explanation of symbols]

[0068] 100 Embedded Systems 110 processors 120 BootROM 130 1timeROM 131 Public Key 140 Non-volatile memory unit 150 Main memory 210 First Startup Program 220 Second Startup Program 230 First Program 231 OS 232 Application Programs 233 Application Program 240 Second Program 241 Application Programs 250 snapshot images 160 Initial processing section 161 First startup processing unit 162 Second startup processing section 163 Snapshot Section 170 Basic function section 171 Applications addr1 address addr2 address size Data size 250a snapshot image 230a First Program 231a OS 232a Application Program 233a Application Program 100a Embedded Systems 151 Execution Area 152 Unimplemented Area 163a Snapshot section 240a Second Program 241a Application Program 250b snapshot image

Claims

[Claim 1] performing tamper verification of a snapshot image including a state of a first area of ​​a storage unit when an electronic device is executing a first program and a state of a second area of ​​the storage unit when the electronic device stores a second program that has not yet been executed in the storage unit; electronic equipment.

Images