Information processing apparatus, information processing method, and computer program

Abstract

To shorten a starting time while ensuring security.SOLUTION: An information processing apparatus comprising: a non-volatile memory including a data area capable of storing a program and a designation area for designating a verification range in the data area; and a verification unit configured to verify the verification range based on the designation area, wherein the verification range includes a use area currently used for storing the program in the data area and does not include at least a part of a free area that is an area other than the use area in the data area.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to an information processing device, an information processing method, and a computer program. [Background technology]

[0002] A technology known as "secure boot" executes a program verification process when a device is started in order to detect software tampering due to unauthorized access. For example, Patent Document 1 discloses a technology that limits the scope of secure boot execution in order to shorten the startup time of an in-vehicle system.

[0003] In the technology of Patent Document 1, a system administrator selects in advance from all application programs those application programs that require tamper detection, and stores a list of those programs in non-volatile memory as a "tamper detection target list." Then, when a program included in the tamper detection target list is launched, secure boot is performed, and when a program not included in the tamper detection target list is launched, the program is launched as is without secure boot. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2017-33248 Summary of the Invention [Problem to be solved by the invention]

[0005] The technology in Patent Document 1 attempts to shorten the time required for verification processing by limiting the targets of secure boot to application programs that require tamper detection. However, with Patent Document 1, for example, if the number or amount of application programs that require tamper detection increases, the time required for verification processing inevitably increases.

[0006] Furthermore, some users may wish to verify all programs in order to ensure security. In such cases, the technology of Patent Document 1, which allows certain programs to be started without performing a secure boot, cannot be used.

[0007] In view of the above problem, an object of the present disclosure is to provide an information processing device, an information processing method, and a computer program that can further shorten the startup time while ensuring security. [Means for solving the problem]

[0008] The information processing device disclosed herein comprises a non-volatile memory including a data area capable of storing a program, a designated area within the data area that specifies a verification range, and a verification unit that verifies the verification range based on the designated area, wherein the verification range includes a used area within the data area that is currently being used to store the program, and does not include at least a portion of the free area within the data area other than the used area. [Effects of the Invention]

[0009] According to the present disclosure, it is possible to further shorten the startup time while ensuring security. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram illustrating an example of the configuration of an information processing apparatus according to an embodiment. [Figure 2] FIG. 2 is a table showing an outline of an example of the configuration of a data area. [Figure 3] FIG. 3 is a table showing an outline of an example of the configuration of the designated area. [Figure 4] FIG. 4 is a table showing an outline of an example of the configuration of the designated area. [Figure 5] FIG. 5 is a sequence diagram illustrating an example of an information processing method. [Figure 6]FIG. 6 is a diagram showing a data structure in a nonvolatile memory according to a modified example. [Figure 7] FIG. 7 is a diagram schematically illustrating an example of the configuration of a designated area. [Figure 8] FIG. 8 is a sequence diagram showing an example of an information processing method according to a modified example. [Figure 9] FIG. 9 is a sequence diagram showing an example of an information processing method according to a modified example. [Figure 10] FIG. 10 is a sequence diagram showing an example of an information processing method according to a modified example. DETAILED DESCRIPTION OF THE INVENTION

[0011] [Description of the embodiments of the present disclosure] The gist of the present disclosure includes the following configurations.

[0012] (1) The information processing device disclosed herein comprises a non-volatile memory including a data area capable of storing a program and a designated area within the data area that specifies a verification range, and a verification unit that verifies the verification range based on the designated area, wherein the verification range includes a used area within the data area that is currently being used to store the program, and does not include at least a portion of the free area within the data area other than the used area.

[0013] Since the verification range includes the used area of ​​the data area that is currently being used to store programs, all programs stored in the non-volatile memory can be verified without omission, ensuring security. On the other hand, since the verification range does not include at least a portion of the free area, which is the area other than the used area of ​​the data area, it is possible to omit unnecessary verification processing for areas not used to store programs, thereby reducing the time required for the verification processing. This allows for further shortening of startup time while ensuring security.

[0014] (2) In the information processing device of (1) above, the verification unit may verify the verification range after verifying the specified area.

[0015] If the designated area is tampered with, there is a risk that the designated area may have excluded the area in use from the verification range, and if the information processing device is started up as is, there is a risk of malfunction. Also, the designated area contains less data than the verification range, so verification can be performed in a shorter time. Therefore, by verifying the designated area first, if there is tampering, errors can be discovered early, and the time required for startup processing can be further shortened.

[0016] (3) In the information processing device of (2) above, the verification unit may verify the verification range if it determines, as a result of verifying the specified area, that the data in the specified area has not been tampered with, and may verify the entire range of the data area if it determines that the data in the specified area has been tampered with.

[0017] If the specified area is tampered with, the verification process is not terminated but the entire data area is verified. This allows the verification process for the data area to be completed while ensuring security, thereby reducing the time lost due to incomplete verification.

[0018] (4) In the information processing device of (1) to (3) above, the usage area may include a first area in which a first program executed as basic software is stored, and the verification unit may verify the first area when the information processing device is started up, and may verify areas of the usage area other than the first area after the information processing device is started up.

[0019] By postponing the verification of programs that are not used when the information processing device is started up, the time required for the verification process at the time of start-up can be further reduced.

[0020] (5) In the information processing device of (4) above, the usage area may further include a second area in which a second program executed as an application is stored, and the verification unit may verify the second area after the information processing device is started and before the application is started.

[0021] By configuring in this manner, the verification process for the second area is performed at the latest before the second program is executed, i.e., before the application is launched, so that a program for which the verification process has not been executed is not executed, thereby ensuring security.

[0022] (6) In the information processing device according to any one of (1) to (5) above, the specified area may actively specify the verification range by setting the verification range itself.

[0023] This allows the settings in the specified area to match the verification range, making it easier to determine whether the settings are correct, and allowing the verification range to be specified more reliably.

[0024] (7) In the information processing device of (1) to (5) above, the specified area may passively specify the verification range by setting a non-verification range in the data area in which the verification process is not executed.

[0025] This makes it possible to clearly define the range of non-verification, i.e., the amount of non-verification processing, from the specified area, and therefore to easily perform processing such as predicting the time to be saved based on the description of the specified area.

[0026] (8) The information processing device described in (1) to (7) above may be mounted on a vehicle.

[0027] In the case of an in-vehicle information processing device, shortening of the startup time is particularly required. According to the information processing device of the present disclosure, the effects described in (1) to (7) above are achieved, and therefore it is particularly suitable to apply the information processing device to an in-vehicle device.

[0028] (9) The information processing method of the present disclosure is an information processing method performed by the information processing devices described above in (1) to (7). Therefore, the information processing method of the present disclosure has the same effects as the information processing devices described above in (1) to (7).

[0029] (10) The computer program of the present disclosure is a computer program for causing a computer to function as the information processing device described above in (1) to (7). Therefore, the computer program of the present disclosure has the same effects as the information processing device described above in (1) to (7).

[0030] [Details of the embodiments of the present disclosure] Hereinafter, details of embodiments of the present disclosure will be described with reference to the drawings.

[0031] [Overview of information processing device 10] FIG. 1 is a diagram showing an example of the configuration of an information processing device 10 according to an embodiment. The information processing device 10 is an in-vehicle device mounted on a vehicle V1 such as an automobile. The function of the information processing device 10 is not particularly limited, but it may be, for example, an ECU (Electronic Control Unit), and more specifically, a device (operation system ECU) that controls the hardware of each part of the vehicle V1 (for example, a braking system, doors, a battery, an air conditioner, etc.). The function of the information processing device 10 is not particularly limited, and the information processing device 10 may be a device (cognition system ECU) that communicates with a sensor and monitors the state of each part of the vehicle V1. Furthermore, the information processing device 10 may be a relay device that relays communication between multiple ECUs.

[0032] The information processing device 10 is supplied with power from a battery (not shown) of the vehicle V1, and is therefore powered off when the engine of the vehicle V1 is stopped. For example, when the engine of the vehicle V1 is started, power supply to the information processing device 10 is started, and the information processing device 10 is powered on.

[0033] For example, when the information processing device 10 is involved in driving control of the vehicle V1, the information processing device 10 must complete a series of startup processes between the start of the engine of the vehicle V1 and the start of driving of the vehicle V1, and the startup time allowed for executing the startup processes is several hundred milliseconds (for example, 300 milliseconds or less). Thus, there is a need to further shorten the startup time of the information processing device 10.

[0034] On the other hand, if the program of the information processing device 10 is tampered with due to unauthorized access or the like, it may cause problems in the driving control of the vehicle V1, so it is essential to ensure security to verify program tampering. For this reason, there is a demand to further shorten the startup time while ensuring security.

[0035] The program to be verified is stored in the nonvolatile memory 13 of the information processing device 10. The nonvolatile memory 13 usually has a larger capacity than the program to accommodate the program capacity flexibly. Therefore, the nonvolatile memory 13 naturally includes a "free area 52."

[0036] Conventionally, when verifying a program, the entire area of ​​the nonvolatile memory 13, including the free area 52, is verified, which requires a long time for the verification process. Therefore, in the present disclosure, a designation area 41 is newly provided in the nonvolatile memory 13 to instruct the distinction between the used area 51 and the free area 52. Then, based on the designation area 41, at least a portion of the free area 52 (more preferably the entire free area 52) is excluded from the verification target, thereby reducing the area to be verified and shortening the time required for the verification process. This makes it possible to further shorten the startup time while ensuring security. The configuration of the information processing device 10 will be specifically described below.

[0037] [Configuration of information processing device 10] The information processing device 10 is a computer device such as an MCU (Micro Controller Unit) or an MPU (Micro Processor Unit). The information processing device 10 includes a verification unit 11, a control unit 12, a non-volatile memory 13, a communication unit 14, and an interface unit 15. These units 11 to 15 are electrically connected to each other via a bus B1.

[0038] The verification unit 11 is, for example, an HSM (Hardware Security Module), and verifies whether or not the program stored in the nonvolatile memory 13 has been tampered with. In order to maintain a high level of security, the verification unit 11 is configured as dedicated hardware that is functionally and physically independent from the other functional units 12 to 15.

[0039] The verification unit 11 includes a processor 21, a volatile memory 22, and a non-volatile memory 23. The processor 21 is an arithmetic processing unit including a circuit configuration such as a CPU (Central Processing Unit) or a GPU (Graphics Processing Unit). The processor 21 may include a programmable logic device such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0040] The volatile memory 22 is a semiconductor memory for temporary storage, such as a static random access memory (SRAM) or a dynamic random access memory (DRAM).

[0041] The nonvolatile memory 23 is a storage device for long-term storage, such as a hard disk drive (HDD), a solid state drive (SSD), a read-only memory (ROM), or a flash memory. The nonvolatile memory 23 stores various data including a computer program 24 and a verification key K1 used in the verification process. The computer program 24 includes a program for executing the verification process when the information processing device 10 is started up.

[0042] The processor 21 reads various data from the nonvolatile memory 23, and temporarily stores the data and the results of calculations on the data in the volatile memory 22, while executing various calculations and controls, which will be described later.

[0043] The control unit 12 is a so-called host CPU that realizes the functions of the information processing device 10 by executing programs stored in the non-volatile memory 13. The control unit 12 includes a processor 31 and a volatile memory 32. The processor 31 and the volatile memory 32 may be realized by hardware that is physically different from the processor 21 and the volatile memory 22 of the verification unit 11, or may be realized by using the same hardware as the processor 21 and the volatile memory 22 but for different areas or times.

[0044] The processor 31 is an arithmetic processing unit including a circuit configuration such as a CPU or a GPU, etc. The volatile memory 32 is a semiconductor memory for temporary storage such as an SRAM or a DRAM, etc.

[0045] The nonvolatile memory 13 stores programs executed by the control unit 12. The nonvolatile memory 13 is a storage device for long-term storage, such as an HDD, SSD, ROM, or flash memory. The nonvolatile memory 13 is, for example, a code flash that stores application code.

[0046] The nonvolatile memory 13 includes a specification area 41 and a data area 42. The data area 42 is an area capable of storing a program.

[0047] FIG. 2 is a table showing an example of the structure of the data area 42. The data area 42 includes a used area 51 that is currently used to store programs, and other free areas 52. In the example of FIG. 2, data describing programs is stored from address 0x1000 to address 0x1FFF and from address 0x3000 onwards, and these areas constitute the used area 51. For example, data D1000 is stored at address 0x1000. The value of data D1000 is not particularly limited and may be, for example, any one-byte data. Furthermore, no data describing programs is stored from address 0x2000 to address 0x2FFF, and this area constitutes the free area 52.

[0048] The free area 52 may be in a state where no data has been written, or may be in a state where dummy data (i.e., data not used as a program) has been written. The free area 52 may also be called an "unused area" in the sense that it is not currently being used to store a program.

[0049] Referring to Figure 1, various programs are stored in the used area 51. The used area 51 includes a first area 61 and a second area 62. The first area 61 stores a first program P1 that is executed as basic software generally used for the functions of the information processing device 10. The first program P1 includes, for example, a boot loader for executing processing (bootstrap) required to start up the information processing device 10, and an OS (Operating System) program.

[0050] The second area 62 stores a second program P2 that is executed as an application. The second program P2 is software that runs under the execution environment of the operating system. Therefore, the second program P2 is executed after the first program P1 has been executed. Furthermore, while the first program P1 is always executed when the information processing device 10 is started up, the second program P2 is executed at an appropriate timing in response to a user request.

[0051] The second program P2 is not particularly limited, but may be software for, for example, individually controlling the hardware of each part of the vehicle V1, detecting the status of the hardware of each part of the vehicle V1, monitoring the status around the vehicle V1, etc. The second program P2 may be software for relaying communication between a plurality of ECUs, or software for updating a program when a new version of the program is provided from outside the information processing device 10.

[0052] The processor 31 reads various data (such as the first program P1 or the second program P2) from the data area 42 of the non-volatile memory 13, and temporarily stores the data and the calculation results of the data in the volatile memory 32, while performing various calculations and controls described below.

[0053] The specified area 41 specifies a verification range within the data area 42 for executing verification processing by the verification unit 11. The specified area 41 may set, for example, the used area 51 within the data area 42 as the verification range, or may set the free area 52 within the data area 42 as the non-verification range. In either case, the fact remains that the specified area 41 actively or passively "specifies the verification range."

[0054] FIG. 3 is a table that shows a schematic example of the configuration of the specified area 41 that sets the verification range of the data area 42. The verification range is set in advance, for example, by the program creator. The specified area 41 actively specifies the verification range by setting the start address and end address of the verification range. In other words, the specified area 41 sets the verification range itself. This ensures that the setting content and the verification range match, making it easier to check whether the setting is correct and allowing the verification range to be specified more reliably.

[0055] 3, the verification range completely matches the used area 51, but for example, the verification range may include some addresses of the free area 52. In the example of Fig. 3, addresses 0x1000 to 0x1FFF and addresses 0x3000 to 0x3FFF are set as the verification range.

[0056] 4 is a table showing an example of the configuration of a designated area 41a that sets a non-verification range in the data area 42. The non-verification range is a range in which verification processing is not performed, and is set in advance by, for example, the program creator. Designated area 41a may be used instead of designated area 41.

[0057] The designation area 41a passively designates the verification range within the data area 42 by setting the start address and end address of the non-verification range. This makes the non-verification range, i.e., the amount of verification processing that will not be executed, clear from the designation area 41a, making it possible to easily perform processing such as predicting the time reduction based on the description in the designation area 41a.

[0058] 4, the non-verification range completely matches the free area 52, but for example, the non-verification range may not include some addresses of the free area 52. In the example of Fig. 4, the range from address 0x2000 to address 0x2FFF is set as the non-verification range.

[0059] See Fig. 1. The communication unit 14 is a communication card that complies with a communication standard such as Ethernet (registered trademark), and converts an electrical signal input to the communication unit 14 from the bus B1 into a communication signal and outputs it to the outside of the information processing device 10. The communication unit 14 also converts a communication signal input to the communication unit 14 from the outside into an electrical signal and takes it into the bus B1. The communication unit 14 is connected to a public communication network such as the Internet via an in-vehicle communication device such as a TCU (Telematics Control Unit).

[0060] The interface unit 15 is, for example, an input / output port, and is electrically connected to other devices mounted on the vehicle V1.

[0061] [Information processing method] Fig. 5 is a sequence diagram showing an example of an information processing method executed by information processing device 10. In Fig. 5, the process executed by verification unit 11 is shown on the left side, and the process executed by control unit 12 is shown on the right side. The order of the processes shown in Fig. 5 may be changed as appropriate.

[0062] In the verification unit 11, the processor 21 reads a computer program 24 from the nonvolatile memory 23 and executes various processes. In the control unit 12, the processor 31 reads various programs (for example, the first program P1 or the second program P2) from the data area 42 of the nonvolatile memory 13 and executes various processes.

[0063] First, the outline of the information processing method will be explained. In the information processing method of the present disclosure, when the information processing device 10 is started, the verification unit 11 verifies the program in the non-volatile memory 13. At this time, the verification unit 11 executes the verification process only within the verification range specified by the specification area 41, thereby eliminating unnecessary verification processes and ensuring security and shortening the startup time.

[0064] Each step will be described in detail below.

[0065] First, the information processing device 10 is powered on, which starts power supply to the units 11 to 15 of the information processing device 10 (step S101). For example, the driver turns on the ignition switch of the vehicle V1, which turns on the information processing device 10. This starts various startup processes described below.

[0066] The following startup process may be performed not only when the power is turned on ("power on"), but also when the information processing device 10 transitions from a sleep state to a normal state ("wake up"). The sleep state is a state in which, for example, some functions of the information processing device 10 are stopped to reduce power consumption compared to the normal state. In the present disclosure, both power on and wake up are collectively referred to as "starting up" the information processing device 10.

[0067] In addition, in this disclosure, "start-up of the information processing device 10" refers to the period from the start point when the power is turned on or when the device wakes up to the end point when the basic software described below is completed (step S107).

[0068] Next, the verification unit 11 executes its own initialization process (step S102). For example, it initializes various flags included in the verification unit 11 and waits until the voltage in the circuit stabilizes. This initialization process is also called "initialization of the microcomputer" or "resetting the microcomputer."

[0069] Next, the verification unit 11 verifies the designated area 41 (step S103). Here, the verification unit 11 verifies the entire range of the designated area 41. The method of the verification process executed by the verification unit 11 is not particularly limited, and a known method can be used.

[0070] For example, the verification unit 11 reads data in the designated area 41 to be verified from the non-volatile memory 13. Then, the verification unit 11 generates a hash value H1 for verification from the data. The designated area 41 is previously assigned a digital signature E1 created by the creator of the designated area 41 using a private key. The digital signature E1 is information generated by encrypting a hash value generated from the data stored in the designated area 41 with the private key. The verification unit 11 obtains a legitimate hash value H2 by decrypting the digital signature E1 using a verification key K1 stored in the non-volatile memory 23 in advance.

[0071] Finally, if the verification hash value H1 matches the legitimate hash value H2, the verification unit 11 determines that the data in the designated area 41 has not been tampered with (i.e., is valid). In this case, the information processing device 10 proceeds to the processing of step S104 and subsequent steps, which will be described later.

[0072] On the other hand, if the verification hash value H1 does not match the legitimate hash value H2, the verification unit 11 determines that the data in the designated area 41 has been tampered with. In this case, the designated area 41 may have excluded the area of ​​use 51 from the verification range due to the tampering, and there is a risk that a malfunction will occur in the information processing device 10 if the information processing device 10 is started up in this state.

[0073] Therefore, if the verification unit 11 determines that the data in the designated area 41 has been tampered with, it stops the startup process from step S103 onwards. Furthermore, the verification unit 11 notifies the administrator of the vehicle V1 of the abnormality by sending an error message to another device (for example, an on-board management device) via the communication unit 14 or the interface unit 15, indicating that the data in the designated area 41 is invalid. This completes the verification process for the designated area 41.

[0074] Here, because the designated area 41 mainly contains data indicating the start address and end address of the verification range, the amount of data in the designated area 41 is less than the amount of data in the data area 42, and the verification process for the designated area 41 can be executed in a shorter time than the verification process for the verification range. Therefore, by configuring the system to first verify the designated area 41 and then start verification of the verification range based on the results, if the designated area 41 has been tampered with, an error can be found early, and the time required for the startup process can be further reduced.

[0075] Next, the verification unit 11 verifies the verification range specified by the specified area 41 (step S104). Here, the verification unit 11 verifies the entire range of the verification range. The method of the verification process executed by the verification unit 11 is not particularly limited, and a known method can be used. For example, the verification unit 11 verifies the verification range by comparing hash values ​​as described above.

[0076] Since the verification range includes the entire used area 51 of the data area 42 that is currently being used to store programs, all programs stored in the non-volatile memory 13 can be verified without omission, ensuring security. On the other hand, since the verification range does not include at least a portion of the free area 52 of the data area 42 (in this embodiment, the entire free area 52), it is possible to omit unnecessary verification processing for areas not used to store programs, thereby reducing the time required for the verification processing. This makes it possible to further reduce the startup time while ensuring security.

[0077] If the verification unit 11 determines that the data in the verification range has not been tampered with, the information processing device 10 proceeds to the processing of step S105 and subsequent steps described below. On the other hand, if the verification unit 11 determines that the data in the verification range has been tampered with, similar to the example of step S103, the verification unit 11 sends an error message to the external device indicating that the data in the verification range is invalid, and stops the startup processing of step S104 and subsequent steps. This completes the verification processing of the verification range.

[0078] After the verification process of the verification range, the verification unit 11 outputs a start command to the control unit 12 (step S105). The control unit 12 receives the start command via the bus B1, and with this as a trigger, sequentially executes the following steps S106 and thereafter.

[0079] First, the control unit 12 executes its own initialization process in the same manner as the verification unit 11, and then reads the first program P1 from the nonvolatile memory 13 and starts the operating system. Specifically, the control unit 12 reads a boot loader from the nonvolatile memory 13 and executes bootstrap (step S106). Next, the control unit 12 reads the OS program from the nonvolatile memory 13 and starts the OS (step S107). This starts the operating system.

[0080] This completes the series of startup processes of the information processing device 10.

[0081] Thereafter, the control unit 12 reads the second program P2 from the nonvolatile memory 13 at an appropriate timing and starts the application (step S108).

[0082] According to the information processing method described above, the verification range of verification unit 11 can be limited to usage area 51 by using designated area 41, thereby reducing the time required for verification processing. Furthermore, since the entire usage area 51 is verified, security can be ensured.

[0083] Here, technically, it is also possible to specify the verification range by the computer program 24, rather than by the specified area 41 in the non-volatile memory 13. However, if the verification range is specified by the computer program 24, the verification unit 11 that stores the computer program 24 must also be updated every time the software in the data area 42 is updated, which increases the frequency of updates to the verification unit 11.

[0084] Because the verification unit 11 is required to have a higher security level than other units (e.g., the non-volatile memory 13) due to the nature of the verification process it performs, frequent changes and updates should be avoided from the perspective of ensuring security. In addition, the update method for the verification unit 11 may be complicated in order to maintain a security level, and specifying the verification range in the computer program 24 may result in the disadvantage of increasing the burden on personnel and equipment for software updates.

[0085] On the other hand, if the verification range is specified in the specified area 41 in the non-volatile memory 13, when updating the software in the data area 42, it is sufficient to update both the specified area 41 and the data area 42 in the non-volatile memory 13, so that the update range can be contained in the non-volatile memory 13 and there is no need to update the verification unit 11. This makes the update process easier than when the verification range is specified in the computer program 24.

[0086] Updating of the program in the non-volatile memory 13 may be performed by an OTA (Over The Air) update, in which an update program is provided from an external device via a public communication network and the communication unit 14, or by providing an update program via a wired connection from an external device via the interface unit 15.

[0087] [Variations] Modifications of the embodiment will be described below. In the modifications, the same components as those in the above embodiment will be denoted by the same reference numerals and the description thereof will be omitted.

[0088] [Variation 1: Verify the verification range in stages] In the above embodiment, the entire verification range is verified in step S104. Here, the verification range includes a program (e.g., the second program P2) that is not used when starting up the information processing device 10, and postponing the verification of this program does not cause any inconvenience to the startup process.

[0089] Therefore, in this modified example, at startup, only the first area 61 where the first program P1 is stored is verified, and then the second area 62 where the second program P2 is stored is verified at an appropriate timing, thereby further shortening the time required for the verification process at startup.

[0090] 6 is a diagram showing the data structure in the nonvolatile memory 13 according to the modified example. The main difference from the embodiment is that the designated area 41 of the embodiment is replaced with a designated area 41b. The designated area 41b includes a basic area 71 and a specific area 72.

[0091] 7 is a diagram schematically illustrating an example of the configuration of the designation area 41b. The designation area 41b defines the verification range as well as the verification timing, which is the timing at which the verification process is executed.

[0092] Here, it is assumed that a first program P1 is stored from address 0x1000 to address 0x1FFF in the data area 42, and a second program P2 is stored from address 0x2000 to address 0x2FFF and from address 0x3000 to address 0x3FFF. It is also assumed that the second program P2 from address 0x2000 to address 0x2FFF is a program that executes a first application APP1 (for example, hardware control software for the vehicle V1), and that the second program P2 from address 0x3000 to address 0x3FFF is a program that executes a second application APP2 (for example, update software) different from the first application APP1.

[0093] In this case, for example, the creator of the program needs to execute the first program P1 when the information processing device 10 is started up, so the verification timing for addresses 0x1000 to 0x1FFF where the first program P1 is stored is set to the time when the information processing device 10 is started up.

[0094] Furthermore, since it is not necessary for the second program P2 to be executed when the information processing device 10 is started up, the creator sets the verification timing for the addresses 0x2000 to 0x3FFF where the second program P2 is stored to a timing later than the start-up of the information processing device 10.

[0095] For example, the verification timing for addresses 0x2000 to 0x2FFF where the program of the first application APP1 is stored is set at the time of startup of the first application APP1, and the verification timing for addresses 0x3000 to 0x3FFF where the program of the second application APP2 is stored is set at the time of startup of the second application APP2.

[0096] In addition, by setting the verification timing for all areas where the second program P2 is stored to later than the startup of the information processing device 10, the time required for the verification process when the information processing device 10 is started can be further shortened, but for example, if there is sufficient processing capacity in the verification unit 11, the verification timing for part of the areas where the second program P2 is stored may also be set to the startup of the information processing device 10.

[0097] For example, the verification timing for addresses 0x2000 to 0x2FFF where the program of the first application APP1 is stored may be set at the time of startup of the first application APP1, while the verification timing for addresses 0x3000 to 0x3FFF where the program of the second application APP2 is stored may be set at the time of startup of the information processing device 10.

[0098] The basic area 71 is an area of ​​the specified area 41b in which the verification timing is set to "when the information processing device 10 starts up." In the above example, the area of ​​the specified area 41b that specifies addresses 0x1000 to 0x1FFF as the verification range is the basic area 71. Furthermore, if the verification timing from addresses 0x3000 to 0x3FFF is set to when the information processing device 10 starts up, the area of ​​the specified area 41b that specifies addresses 0x3000 to 0x3FFF also becomes the basic area 71.

[0099] In other words, the basic area 71 is an area in the data area 42 where the verification timing of the first area 61 is set to "when the information processing device 10 is started up." In the basic area 71, the verification timing of part of the second area 62 may be set to "when the information processing device 10 is started up." However, in this modified example, the verification process of at least part of the second area 62 is postponed, and therefore the verification timing of the entire second area 62 is not set to "when the information processing device 10 is started up."

[0100] The specific area 72 is an area of ​​the specified area 41b in which the verification timing is set to later than "when the information processing device 10 is started up." In the above example, the specific area 72 is an area of ​​the specified area 41b that specifies addresses 0x2000 to 0x2FFF and addresses 0x3000 to 0x3FFF as the verification range.

[0101] In other words, the specific area 72 is an area in which the verification timing of at least a part of the second area 62 (for example, the entire second area 62) is set to later than "when the information processing device 10 is started up."

[0102] FIG. 8 is a sequence diagram showing an example of an information processing method according to a modified example. First, the information processing device 10 is started by turning on the power or the like (step S201). Next, the verification unit 11 performs an initialization process (step S202), and then the verification unit 11 verifies the entire range of the designated area 41b (step S203).

[0103] As a result, if it is determined that the description of the verification range and verification timing for the specified area 41b has not been tampered with, the verification unit 11 verifies the range specified by the basic area 71 in the data area 42 (step S204). In the example of Fig. 7, the verification unit 11 verifies the range from address 0x1000 to address 0x1FFF in the data area 42. As a result, the verification of the first area 61 is performed when the information processing device 10 is started up.

[0104] If it is determined that the range has not been tampered with, the verification unit 11 outputs a start-up command to the control unit 12 (step S205).

[0105] Upon receiving the start command, the control unit 12 executes its own initialization process, then executes bootstrap (step S206), and then starts the OS, thereby starting the operating system (step S207). Since the first area 61 including the first program P1 has been verified in step S204, the control unit 12 can safely realize basic functions such as the boot loader and operating system.

[0106] Thereafter, the control unit 12 monitors whether or not the verification timing set in the specific area 72 has arrived. In the example of Fig. 7, the verification timing in the specific area 72 is always the start-up of an application, so the control unit 12 monitors whether or not there is a request to start an application from the user or the like (step S208). If there is no such start-up request, the control unit 12 waits until a request is made.

[0107] When a request to start an application is made, the control unit 12 outputs a request notification to the verification unit 11 (step S209). In response to the request notification, the verification unit 11 verifies the range of the data area 42 specified by the specific area 72 (step S210). As a result, the second area 62 is verified after the information processing device 10 is started up.

[0108] Specifically, the verification unit 11 verifies only the range of the verification range specified by the specific area 72 for which the verification timing has arrived. For example, when a request to launch the first application APP1 is made, the control unit 12 sends a request notification indicating that "this is a request to launch the first application APP1" to the verification unit 11. The verification unit 11 compares the request notification with the specified area 41b, extracts a range of the specific area 72 that matches the request notification, and verifies the range. In the example of FIG. 7, the verification unit 11 verifies the range from address 0x2000 to address 0x2FFF in the second area 62.

[0109] If the verification unit 11 determines that the range has not been tampered with, it outputs a completion notification to the control unit 12 (step S211). In response to the completion notification, the control unit 12 starts up the first application APP1 (step S212). Since the range in the second area 62 in which the program of the first application APP1 is written has been verified in step S210, the control unit 12 can safely execute the first application APP1.

[0110] In this way, by setting the verification timing in the specified area 41b and executing the verification process for the range described for the second program P2 after the startup process of the information processing device 10 (i.e., after the startup of the basic software), the time required for the verification process when the information processing device 10 is started can be further shortened.

[0111] Furthermore, since the verification process for the relevant range is executed at the latest before the execution of the second program P2, i.e., before the start of the application, a program for which verification process has not been executed will not be executed, thereby ensuring security.

[0112] In the example of FIG. 8, verification of the second area 62 is performed in response to a request to start an application. However, the implementation of the present disclosure is not limited to this, and the verification process of the second area 62 (step S210) may be performed at an appropriate timing after the startup process of the operating system (step S207). For example, the second area 62 may be verified when there is free time in the processing of the verification unit 11 or the like, without waiting for a request to start an application. Even in this configuration, by postponing the verification process of the second program P2, the time required for the verification process at the startup of the information processing device 10 can be further reduced. Furthermore, by allocating free time in the processing of the verification unit 11 or the like to verify the second area 62, the time from the request to start an application to the startup of the application can be reduced.

[0113] [Variation 2: Inspect the specified area step by step] In the above-described first modification, the "entire range" of the specified area 41b is verified in step S203. Here, the range to be deferred is described for the specific area 72 of the specified area 41b, so there is no problem with the startup process even if the verification of the range specified by the specific area 72 of the data area 42 is deferred and the verification of the specific area 72 itself of the specified area 41b is deferred.

[0114] Therefore, in this modification, verification of the basic area 71 of the designated area 41b is performed when the information processing device 10 is started up, and verification of the specific area 72 is performed after the information processing device 10 is started up. This makes it possible to further reduce the time required for the startup process.

[0115] FIG. 9 is a sequence diagram showing an example of an information processing method according to a modified example. First, the information processing device 10 is started by turning on the power or the like (step S301). Next, the verification unit 11 performs an initialization process (step S302), and then the verification unit 11 verifies only the basic area 71 of the designated area 41b (step S303). That is, at the time of step S303, the verification unit 11 does not verify the specific area 72 of the designated area 41b.

[0116] In step S303, the verification unit 11 may verify a portion of the specific area 72, but does not verify the entire specific area 72. That is, when the information processing device 10 is started up, the verification unit 11 does not verify at least a portion of the specific area 72.

[0117] As a result, if it is determined that there is no tampering with the description of the verification range and verification timing of the basic area 71 (and, if verified, a portion of the specific area 72), the verification unit 11 verifies the range of the data area 42 specified by the basic area 71 (step S304).

[0118] If it is determined that the range has not been tampered with, the verification unit 11 outputs a startup command to the control unit 12 (step S305). Upon receiving the startup command, the control unit 12 executes bootstrap (step S306), and then starts the OS, thereby starting the operating system (step S307).

[0119] Thereafter, the control unit 12 monitors whether or not the verification timing set in the specific area 72 has arrived. In the example of Fig. 7, the verification timing in the specific area 72 is always the start-up of an application, so the control unit 12 monitors whether or not there is a request to start an application from the user or the like (step S308). If there is no such start-up request, the control unit 12 waits until a request is made.

[0120] When a request to start an application is made, the control unit 12 outputs a request notification to the verification unit 11 (step S309). In response to the request notification, the verification unit 11 first verifies the specific area 72 itself within the designated area 41b (step S310). Specifically, the verification unit 11 verifies only the range of the specific area 72 for which the verification timing has arrived.

[0121] If it is determined that the range has not been tampered with, the verification unit 11 verifies the range specified by the specific area 72 in the data area 42 (step S311). If it is determined that the range has not been tampered with, the verification unit 11 outputs a completion notification to the control unit 12 (step S312). In response to the completion notification, the control unit 12 starts an application (step S313).

[0122] In this way, for the specified area 41b, verification processing is performed only on some areas (such as the basic area 71) when the information processing device 10 is started up, and verification processing is performed on other areas after the information processing device 10 is started up, thereby further shortening the time required for verification processing when the information processing device 10 is started up.

[0123] Furthermore, at the latest before the application is launched, a verification process is performed on the designated area 41b (specific area 72) that specifies the range of the program related to the application and the data area 42 (second area 62) in which the program is stored, so that a program for which the verification process has not been performed will not be executed, thereby ensuring security.

[0124] [Variation 3: Verify the entire range of the data area when there is tampering in the specified area] In the above embodiment, if tampering is found in the designated area 41 in step S103 (FIG. 5), the information processing device 10 outputs an error message, terminates the verification process, and does not verify the data area .

[0125] However, if only the designated area 41 has been tampered with and the data area 42 has not, there is no abnormality in the programs related to the operating system or applications, and so continuing the verification process for these is unlikely to cause any problems. However, since the designated area 41 has been tampered with, if the data area 42 is verified according to the verification range specified in the designated area 41, there is a risk that the verification process for the data area 42 will be insufficient due to an abnormality such as the area that is originally the used area 51 being outside the verification range due to tampering.

[0126] Therefore, in this modification, when the designated area 41 is tampered with, the verification process is not terminated but the entire data area 42 is verified. This allows the verification process of the data area 42 to be completed while ensuring security, thereby reducing the time loss caused by incomplete verification process.

[0127] FIG. 10 is a sequence diagram showing an example of an information processing method according to a modified example. First, the information processing device 10 is started up by turning on the power or the like (step S401). Next, the verification unit 11 performs an initialization process (step S402), and then the verification unit 11 verifies the designated area 41 (step S403). Note that in the example of Fig. 10, the verification unit 11 verifies the entire range of the designated area 41, but as in Modification 2, it is also possible to verify only a part of the designated area 41 and perform verification of the other part after the information processing device 10 is started up.

[0128] As a result, if it is determined that the specified area 41 has not been tampered with, the verification unit 11 verifies the verification range of the data area 42 that is specified by the specified area 41 (step S404).

[0129] On the other hand, if it is determined that the specified area 41 has been tampered with, the verification unit 11 verifies the entire range of the data area 42 (step S405). Furthermore, since the specified area 41 has been tampered with, the verification unit 11 also outputs an error message to that effect. This makes it possible to notify the user or the like of the abnormality while verifying the data area 42.

[0130] If it is determined in step S404 or step S405 that the data area 42 has not been tampered with, the verification unit 11 outputs a startup command to the control unit 12 (step S406). In response to the startup command, the control unit 12 executes bootstrap (step S407) and then starts the OS, thereby starting the operating system (step S408). On the other hand, if it is determined that the data area 42 has been tampered with, the verification unit 11 outputs an error message and does not execute the processes from step S406 onwards.

[0131] After step S408, the control unit 12 starts the application at an appropriate timing (step S410).

[0132] As described above, even if the designated area 41 has been tampered with, the verification unit 11 executes the verification process for the data area 42. If the data area 42 has not been tampered with, the processes from step S405 onward are executed. As a result, if the range of tampering is limited to the designated area 41, the startup of the operating system and applications can be continued, thereby shortening the time required for the startup process while ensuring security.

[0133] [Additional Note] It should be noted that at least some of the above-described embodiments and various modifications may be combined with each other in any desired manner. Furthermore, the embodiments and modifications disclosed herein should be considered to be illustrative in all respects and not restrictive. The scope of the present disclosure is defined by the claims, and all modifications within the meaning and scope equivalent to the claims are intended to be included. [Explanation of symbols]

[0134] 10. Information processing equipment 11 Verification Department 12 Control Unit 13 Non-volatile memory 14 Communications Department 15 Interface section 21 processors 22 Volatile Memory 23 Non-volatile memory 24 Computer Programs 31 processors 32 Volatile Memory 41,41a,41b Specified area 42 Data Area 51 Usage area 52 free space 61 1st area 62 Second area 71 Basic area 72 Specific area V1 vehicle B1 Bus K1 Validation Key P1 1st Program P2 2nd Program H1,H2 hash values E1 Electronic Signature APP1 Application 1 APP2 Second application

Claims

1. a non-volatile memory including a data area capable of storing a program and a designation area within the data area for designating a verification range; a verification unit that verifies the verification range based on the specified area; Equipped with the verification range includes a used area of ​​the data area that is currently being used to store a program, and does not include at least a part of a free area of ​​the data area that is an area other than the used area; Information processing device.

2. the verification unit verifies the specified area and then verifies the verification range. The information processing device according to claim 1 .

3. As a result of the verification of the designated area, the verification unit If it is determined that the data in the specified area has not been tampered with, verifying the verification range; If it is determined that the data in the specified area has been tampered with, the entire range of the data area is verified. The information processing device according to claim 2 .

4. the use area includes a first area in which a first program executed as basic software is stored, The verification unit verifying the first area when the information processing device is started; verifying an area other than the first area in the used area after the information processing device is started up; The information processing device according to any one of claims 1 to 3.

5. the use area further includes a second area in which a second program executed as an application is stored; the verification unit verifies the second area after the information processing device is started and before the application is started. The information processing device according to claim 4 .

6. The specified area actively specifies the verification range by setting the verification range itself. The information processing device according to any one of claims 1 to 3.

7. The specified area is a non-verification area in the data area where the verification process is not executed, thereby passively specifying the verification area. The information processing device according to any one of claims 1 to 3.

8. It is installed in the vehicle, The information processing device according to any one of claims 1 to 3.

9. 1. An information processing method for verifying data stored in a non-volatile memory, comprising: the nonvolatile memory includes a data area capable of storing a program, and a designation area in the data area for designating a verification range; The information processing method includes a step of verifying the verification range based on the specified area, the verification range includes a used area of ​​the data area that is currently being used to store a program, and does not include at least a part of a free area of ​​the data area that is an area other than the used area; Information processing methods.

10. A computer program that causes a computer to function as an information processing device that verifies data stored in a nonvolatile memory, the nonvolatile memory includes a data area capable of storing a program, and a designation area in the data area for designating a verification range; the computer program causes the computer to execute a step of verifying the verification range based on the specified area; the verification range includes a used area of ​​the data area that is currently being used to store a program, and does not include at least a part of a free area of ​​the data area that is an area other than the used area; Computer program.

Images