electronic machines

Abstract

To obtain an electronic device that can perform secure boot after installing a TPM without updating the boot loader program. [Solution] The boot loader 31 (a) determines whether or not a TPM 17 is installed in the image forming apparatus 1 when the image forming apparatus 1 is started, and (b) if a TPM 17 is installed, it passes an argument indicating the secure boot setting and performs a secure boot on the firmware 32, and if a TPM 17 is not installed, it performs a normal boot on the firmware 32 without passing such an argument. In the case of secure boot, the firmware 32 (a) detects that it has been started in secure boot mode based on the above-mentioned argument, and (b) upon detecting that it has been started in secure boot mode, it executes the processing that should be performed during secure boot.

Description

Technical Field

[0001] The present invention relates to an electronic device.

Background Art

[0002] An information processing apparatus has a secure boot function, and in the secure boot function, while performing tampering detection processing of firmware, startup processing of the firmware is performed (see, for example, Patent Document 1).

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] A certain electronic device can be equipped with a Trusted Platform Module (TPM), and when the TPM is equipped, secure boot using the TPM can be performed. When performing secure boot using the TPM, it is necessary to update the bootloader program. However, when updating the bootloader program, due to power failure during the update or the like, it may become impossible to resume the update and the device may become inoperable. Therefore, it is preferable that the number of updates of the bootloader program is small.

[0005] The present invention has been made in view of the above problems, and an object thereof is to obtain an electronic device that can perform secure boot after TPM installation without updating the bootloader program.

Means for Solving the Problems

[0006] The electronic device according to the present invention comprises a boot loader and firmware that is started by the boot loader. The boot loader (a) determines whether a specific hardware module is installed in the electronic device when the electronic device is started, (b) if the specific hardware module is installed, it passes an argument indicating the secure boot setting and performs a secure boot on the firmware, and if the specific hardware module is not installed, it performs a normal boot on the firmware without passing the argument, and in the case of secure boot, the firmware (a) detects that it has been started in secure boot mode based on the argument, and (b) if it has been detected that it has been started in secure boot mode, it executes a process corresponding to secure boot. [Effects of the Invention]

[0007] According to the present invention, an electronic device is obtained that can perform secure boot after TPM installation without updating the boot loader program.

[0008] The above or other objects, features, and advantages of the present invention will become even more apparent from the following detailed description in conjunction with the accompanying drawings. [Brief explanation of the drawing]

[0009] [Figure 1] Figure 1 is a block diagram showing the configuration of an image forming apparatus according to an embodiment of the present invention. [Figure 2] Figure 2 is a flowchart illustrating the operation of the image forming apparatus shown in Figure 1. [Modes for carrying out the invention]

[0010] Embodiments of the present invention will be described below with reference to the figures.

[0011] Figure 1 is a block diagram showing the configuration of an image forming apparatus according to an embodiment of the present invention. The image forming apparatus 1 shown in Figure 1 is a device such as a multifunction printer and is a type of electronic device.

[0012] The image forming apparatus 1 includes a communication device 11, a storage device 12, an arithmetic processing unit 13, a printing device 14, an image reading device 15, a facsimile device 16, and the like. Furthermore, the image forming apparatus 1 is capable of mounting a TPM 17 (for example, an interface or slot for the TPM 17 is provided in advance). The arithmetic processing unit 13 can access the TPM 17 via such an interface or slot.

[0013] The communication device 11 is a network interface or the like, which performs data communication using a predetermined protocol.

[0014] The storage device 12 is a non-volatile and rewritable storage device (such as flash memory) that stores the boot loader program 21 and the firmware program 22. For example, the firmware program 22 includes the operating system (such as the kernel) and application programs.

[0015] The arithmetic processing unit 13 is a computer having a CPU (Central Processing Unit), ROM (Read Only Memory), and RAM (Random Access Memory), and operates as various processing units by loading programs stored in the ROM and storage device 12 into the RAM and executing them with the CPU.

[0016] The printing device 14 prints images based on print data received from an external device, images read by the image reading device 15, and images generated by the facsimile device 16. The image reading device 15 optically reads an image from a document and generates image data of that document image. The facsimile device 16 generates and transmits facsimile signals based on images based on print data received from an external device, images read by the image reading device 15, and also receives facsimile signals from an external source and generates images from those facsimile signals.

[0017] The arithmetic processing unit 13 operates as a boot loader 31 by executing the boot loader program 21. The arithmetic processing unit 13 also operates as firmware 32 by executing the firmware program 22. Firmware 32 is started by the boot loader 31 and includes an operating system and applications. The operating system includes the kernel and file system, among other things. The applications control internal devices such as the printer 14, image reader 15, and facsimile machine 16.

[0018] The boot loader 31 (a) determines whether a TPM 17 as a specific hardware module is installed in the image forming apparatus 1 when the image forming apparatus 1 is started, and (b) if the TPM 17 is installed, it passes an argument indicating the secure boot setting and performs a secure boot of the firmware 32, and if the TPM 17 is not installed, it performs a normal boot (non-secure boot) of the firmware 32 without passing such an argument.

[0019] Furthermore, in the case of secure boot, firmware 32 (a) detects that it was started in secure boot mode based on the arguments described above, and (b) performs a runtime integrity check once it has detected that it was started in secure boot mode.

[0020] Specifically, the boot loader 31 boots the firmware 32 normally without passing the above arguments during the first startup after the TPM 17 is installed in the image forming apparatus 1. The firmware 32 then (a) initializes the TPM 17 and (b) restarts the image forming apparatus 1 during the first startup after the TPM 17 is installed in the image forming apparatus 1. During the initialization of the TPM 17, authentication information used for secure boot (such as a public encryption key and a public encryption key digest) is written to the TPM 17. For example, a specific application (such as the init program of the root system (rootfs)) writes the above authentication information to the TPM 17.

[0021] Then, when the bootloader 31 is started after the second and subsequent startups after the TPM 17 is attached to the image forming apparatus 1, in secure boot, the TPM 17 is used (that is, based on the above-mentioned public key, public key digest, etc.) to pass the above-mentioned arguments and securely boot the firmware 32. When the firmware 32 is started after the second and subsequent startups after the TPM 17 is attached to the image forming apparatus 1, (a) (for example, by referring to procfs to identify the above-mentioned arguments) it detects that it has been started in secure boot based on the above-mentioned arguments, and (b) when it detects that it has been started in secure boot, it performs a runtime integrity check. For example, the operating kernel in the firmware 32 initializes the driver for the runtime integrity check, and a specific application in the firmware 32 starts the runtime integrity check.

[0022] Next, the operation of the image forming apparatus 1 will be described. FIG. 2 is a flowchart for explaining the operation of the image forming apparatus shown in FIG. 1.

[0023] When the image forming apparatus 1 is started, a bootloader program 21 is executed by the arithmetic processing unit 13, and the bootloader 31 is started. The bootloader 31 determines whether the TPM 17 is attached (step S1).

[0024] When the TPM 17 is attached, the bootloader 31 securely boots the firmware 32 by passing the arguments for secure boot settings (step S2), and the firmware 32 determines that it will perform a runtime integrity check (RTIC) by referring to the above-mentioned arguments and starts the RTIC (step S3).

[0025] On the other hand, if the TPM17 is not installed, the bootloader 31 boots the firmware 32 normally without passing any arguments for secure boot settings (step S4). In this case, the firmware 32 determines that it does not need to perform RTIC because it does not have the aforementioned arguments. Therefore, the firmware 32 does not refer to the TPM17 to determine whether or not secure boot is enabled.

[0026] As described above, according to the above embodiment, the boot loader 31 (a) determines whether or not a TPM 17 is installed in the image forming apparatus 1 when the image forming apparatus 1 is started, and (b) if a TPM 17 is installed, passes an argument indicating the secure boot setting and performs a secure boot on the firmware 32, and if a TPM 17 is not installed, performs a normal boot on the firmware 32 without passing such an argument. In the case of secure boot, the firmware 32 (a) detects that it has been started in secure boot mode based on the above argument, and (b) when it detects that it has been started in secure boot mode, it executes the processing that should be performed during secure boot.

[0027] This allows secure boot to be performed after installing the TPM17 without updating the boot loader program 21. Furthermore, the firmware 32 can detect secure boot and execute the processes that should be performed during secure boot.

[0028] Furthermore, various changes and modifications to the embodiments described above will be obvious to those skilled in the art. Such changes and modifications may be made without deviating from the spirit and scope of the subject matter and without diminishing the intended advantages. In other words, such changes and modifications are intended to be included in the claims.

[0029] For example, in the above embodiment, when the system is first started after the TPM 17 is installed, the firmware 32 may write data indicating that the TPM 17 is installed to a predetermined storage area of ​​the storage device 12, and the boot loader 31 may determine whether or not the TPM 17 is installed (i.e., whether or not to perform secure boot) based on whether or not that data has been written to the predetermined storage area. [Industrial applicability]

[0030] The present invention is applicable, for example, to electronic devices that can be fitted with a TPM (Total Processing Module). [Explanation of Symbols]

[0031] 1. Image forming apparatus (an example of electronic equipment) 31 Bootloader 32 Firmware

Claims

1. In electronic devices, Boot loader, The system includes firmware that is started by the aforementioned boot loader, The boot loader (a) determines whether a specific hardware module is installed in the electronic device when the electronic device is started, and (b) if the specific hardware module is installed, it securely boots the firmware by passing an argument indicating the secure boot setting, and if the specific hardware module is not installed, it normally boots the firmware without passing the argument. In the case of secure boot, the firmware (a) detects that it has been started in secure boot mode based on the arguments, and (b) when it detects that it has been started in secure boot mode, it executes the process that should be performed during secure boot mode. Electronic devices characterized by the following:

2. The electronic device according to claim 1, characterized in that the firmware performs a runtime integrity check when it detects that it has been started in secure boot mode.

3. The boot loader, upon the first startup after the specific hardware module has been installed in the electronic device, boots the firmware normally without passing the arguments. The firmware, upon the first startup after the specific hardware module has been installed in the electronic device, (a) initializes the specific hardware module, and (b) restarts the electronic device. The boot loader securely boots the firmware by passing the arguments during the second and subsequent startups after the specific hardware module has been installed in the electronic device. The firmware, upon the second or subsequent startup after the specific hardware module has been installed in the electronic device, (a) detects that it has been started in secure boot mode based on the arguments, and (b) if it has been detected that it has been started in secure boot mode, performs a runtime integrity check. The electronic device according to claim 2, characterized by the following:

4. The electronic device according to any one of claims 1 to 3, characterized in that the specified hardware module is a trusted platform module.

Images