Information processing device, information processing method, and program

Abstract

To prevent the reduction in operating ratio and functional degeneracy while maintaining security.SOLUTION: An information processing apparatus has: a rewrite request receiving unit that receives a rewrite request from an execution module; an update module determination unit that determines whether or not an update module that issues the rewrite request is a normal module; a first alteration detection unit that detects an alteration of a white list; an unauthorized rewrite protection unit that, when the execution module that issues the rewrite request is registered in the white list determined to have no alteration by the first alteration detection unit and when the rewrite request is issued by the update module determined not to be normal by the update module determination unit, rejects the rewrite request without stopping the functions of the information processing apparatus to protect unauthorized rewrite while maintaining the functions; and a notification unit that, when the unauthorized rewrite protection unit protects unauthorized rewrite, notifies a user of the protection.SELECTED DRAWING: Figure 10

Description

[Technical field]

[0001] The present invention relates to an information processing device, an information processing method, and a program for preventing unauthorized rewriting of an execution module. [Background technology]

[0002] Attacks in which a third party illegally tampers with a program (hereinafter sometimes referred to as a module or an execution module) that controls an information processing device to steal information assets in the information processing device, or attacks that use an information processing device with a tampered module as a springboard, have become a problem. In order to prevent such attacks, methods have been devised to prevent a third party from tampering (illegally rewriting) a module in an information processing device, and to prevent the illegal rewriting act itself by a third party.

[0003] In Patent Document 1, a module execution request is received, the hash value of the module is calculated, and compared with a whitelist, and the module is started only if it matches, thereby preventing the start of a tampered module. A whitelist is a list showing a list of modules that are permitted to be started, and in order to detect tampering with the module, the hash value of a normal module is held for each module as a correct hash value. In order to improve the operation rate, when tampering with a module not registered in the whitelist or an extended JAVA (registered trademark) application is detected, the execution of the module is simply prohibited, and the system does not stop, so the information processing device can be used continuously. On the other hand, since other modules affect the normal operation of the system, the system is stopped and operation is suspended. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent application 2018-214138 Summary of the Invention [Problem to be solved by the invention]

[0005] However, Patent Document 1 only mentions the availability rate when tampering is detected during module execution, and does not mention the availability rate when tampering is prevented. If Patent Document 1 is applied as is to error processing during tampering protection, even though tampering of the module is prevented by tampering protection, the system will be stopped or module execution will be prohibited by error processing, resulting in a decrease in availability and functional degradation. [Means for solving the problem]

[0006] In order to achieve the above object, the present invention provides An information processing device for detecting a tampering request of an execution module, A storage means for storing association information between an execution module and information for detecting tampering of the execution module, and a storage means for storing association information between the execution module and information for detecting tampering of the execution module, request as a first tampering, a second detection means for detecting tampering of the association information as a second tampering, and a notification means for making a first notification without stopping the function of the information processing device when the first tampering is detected but the second tampering is not detected. Effect of the Invention

[0007] According to the present invention, when unauthorized tampering is prevented, the system and modules do not stop but continue to operate as is, and the user is notified that protection has been achieved, thereby preventing a decrease in operating rate and degradation of functionality while maintaining security, and further making it possible to inform the user of signs of an upcoming attack. [Brief description of the drawings]

[0008] [Figure 1] Block diagram showing the connection between the MFP and a PC. [Diagram 2] FIG. 2 is a diagram showing the internal configuration of a controller unit of the MFP according to the first embodiment. [Diagram 3]FIG. 2 is a block diagram of the software executed in a controller of the MFP according to the first embodiment. [Figure 4] An example of data placed in Flash ROM. [Diagram 5] Whitelist example. [Figure 6] 11 is a flowchart for carrying out processing on the MFP side according to the first embodiment. [Figure 7] 11 is a flowchart for carrying out a process on the MFP side according to the first modified example of the first embodiment. [Figure 8] 11 is a flowchart for carrying out processing on the MFP side in the second, third, fourth and fifth modified examples of the first embodiment. [Figure 9] 13 is a flowchart for carrying out a process on the MFP side according to the sixth modified example of the first embodiment. [Figure 10] A diagram of the display screen configuration when preventing unauthorized tampering. [Figure 11] FIG. 13 is a configuration diagram of a setting display screen according to a fifth modified example of the first embodiment. [Figure 12] A diagram of the error display screen when the system is stopped. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, information processing according to an embodiment of the present invention will be described in detail with reference to the drawings. In this embodiment, an unauthorized tampering prevention process in which an information processing device prevents a third party from tampering with a module, and a control process of the information processing device during the defense will be described. In this embodiment, an MFP (Multi-Functional Peripheral) which is an image forming device will be described as an example of an information processing device, but the present invention is a technology that can be applied to information processing devices other than MFPs.

[0010] Example 1 (Apparatus configuration of Example 1) The connection between the MFP and the client PC is explained using the block diagram in FIG.

[0011] The MFP 100 and client PC 110 are connected via a LAN 120. The MFP 100 has an operation unit 102 that inputs and outputs data to and from the user. The MFP 100 has a printer unit 103 that outputs electronic data to paper media. The MFP 100 has a scanner unit 104 that reads paper media and converts it into electronic data. The operation unit 102, printer unit 103, and scanner unit 104 are connected to a controller unit 101, and function as a multifunction peripheral according to the control of the controller unit 101. The client PC 110 performs processes such as sending print jobs to the MFP 100.

[0012] FIG. 2 is a block diagram showing details of the controller unit 101 of the MFP. The CPU 201 performs main arithmetic processing within the controller. The CPU 201 is connected to the DRAM 202 via a bus. The DRAM 202 is used by the CPU 201 as a working memory for temporarily storing program data representing arithmetic instructions during the CPU 201's arithmetic process and data to be processed. The CPU 201 is connected to the I / O controller 203 via a bus. The I / O controller 203 performs input / output to various devices according to instructions from the CPU 201. A SATA (Serial Advanced Technology Attachment) I / F 205 is connected to the I / O controller 203, and a Flash ROM 211 is connected to the SATA I / F 205. The CPU 201 uses the Flash ROM 211 to permanently store programs for implementing the functions of the MFP and document files. A network I / F 204 is connected to the I / O controller 203, and a wired LAN device 210 is connected to the network I / F 204.

[0013] The CPU 201 realizes communication on the LAN 120 by controlling the wired LAN device 210 via the network I / F 204. A panel I / F 206 is connected to the I / O controller 203, and the CPU 201 realizes input / output for the user to the operation unit 102 via the panel I / F 206. A printer I / F 207 is connected to the I / O controller 203, and the CPU 201 realizes output processing of paper media using the printer unit 103 via the printer I / F 207. A scanner I / F 208 is connected to the I / O controller 203, and the CPU 201 realizes reading processing of an original using the scanner unit 104 via the scanner I / F 208. A USB I / F 209 is connected to the I / O controller 203, and controls any device connected to the USB I / F 209. The ROM 220 is connected to the CPU 201 via a bus, and stores a control program that realizes a BIOS (Basic Input Output System) 360, which will be described later in FIG. 3.

[0014] When performing a copy function, the CPU 201 loads program data (module data) from the Flash ROM 211 into the DRAM 202 via the SATA I / F 205. The CPU 201 detects a copy instruction from the user to the operation unit 102 via the panel I / F 206 in accordance with the program (module) loaded into the DRAM 202. When the CPU 201 detects a copy instruction, it receives an original as electronic data from the scanner unit 104 via the scanner I / F 208 and stores it in the DRAM 202. The CPU 201 performs color conversion processing suitable for output on the image data stored in the DRAM 202. The CPU 201 transfers the image data stored in the DRAM 202 to the printer unit 103 via the printer I / F 207, and performs output processing onto paper media.

[0015] When PDL printing is performed, the client PC 110 issues a print instruction via the LAN 120. The CPU 201 loads module data from the Flash ROM 211 via the SATA I / F 205 into the DRAM 202, and detects a print instruction via the network I / F 204 according to the module loaded into the DRAM 202. When the CPU 201 detects a PDL transmission instruction, it receives print data via the network I / F 204, and stores the print data in the Flash ROM 211 via the SATA I / F 205. When the CPU 201 has completed storing the print data, it develops the print data stored in the Flash ROM 211 into the DRAM 202 as image data. The CPU 201 performs color conversion processing suitable for output on the image data stored in the DRAM 202. The CPU 201 transfers the image data stored in the DRAM 202 to the printer unit 103 via the printer I / F 207, and performs output processing onto paper media.

[0016] The TPM (Trusted Platform Module) 212 is a security chip with tamper resistance. Tamper resistance is a characteristic that makes external analysis difficult and provides self-defense by destroying modules or data stored inside if an attempt is made to analyze from the outside. The TPM 212 also holds NVRAM and multiple PCRs. The NVRAM is a non-volatile memory that allows any data to be written and read. The PCR is a volatile memory that has the function of saving the hash value of any module when that module is executed.

[0017] The functional configuration and the flow of the unauthorized tampering prevention process in this embodiment will be described below.

[0018] (Functional configuration of the first embodiment) An example of a functional configuration realized by software executed in the controller unit 101 of the MFP of the first embodiment will be described with reference to the block diagram of Fig. 3. All of the software executed in the controller unit 101 is executed by the CPU 201.

[0019] The CPU 201 executes the BIOS 360 stored in the ROM 220. The CPU 201 loads the loader 370, initrd 380, and controller software 300 stored in the Flash ROM 211 into the DRAM 202 and then executes them. The BIOS 360 executes basic processing for the CPU 201 to control the I / O controller 203 and the DRAM 202. The BIOS 360 further includes processing for reading the loader 370 from the Flash ROM 211 and starting it up. The loader 370 loads the kernel 390 and initrd 380 according to the boot mode (to be described later) from the Flash ROM 211 and starts it up. The initrd 380 loads the controller software 300 from the Flash ROM 211 and starts it up.

[0020] An operation control unit 301 displays a screen image for the user on the operation unit 102, detects a user operation, and executes processing associated with screen components such as buttons displayed on the screen.

[0021] In response to a request from another control unit, the data storage unit 302 stores and reads data in the Flash ROM 211. For example, when a user wants to change some device setting, the operation control unit 301 detects the content input by the user to the operation unit 102, and in response to a request from the operation control unit 301, the data storage unit 302 saves the content in the Flash ROM 211 as a setting value.

[0022] A job control unit 303 controls job execution according to instructions from other control units.

[0023] An image processing unit 304 processes the image data into a format suitable for each purpose according to instructions from the job control unit 303 .

[0024] A print processing unit 305 prints and outputs an image on a paper medium via a printer I / F 207 in accordance with an instruction from the job control unit 303 .

[0025] The reading processing unit 306 reads the placed original via the scanner I / F 208 in accordance with an instruction from the job control unit 303 .

[0026] A network control unit 307 performs network settings such as IP address settings in a TCP / IP control unit 308 at system startup or when a change in settings is detected, in accordance with the setting values ​​stored in the data storage unit 302 .

[0027] A TCP / IP control unit 308 performs transmission and reception processing of network packets via the network I / F 204 in accordance with instructions from other controls.

[0028] The USB control unit 309 controls the USB I / F 209, and controls any device connected via USB.

[0029] The software update unit 310 performs a process of updating the program files constituting the controller software 300 in the installation environment. For example, the software update unit 310 rewrites the module A402 and the module B412 arranged on the Flash ROM 211 in Fig. 4, which will be described later. Specifically, the software update unit 310 rewrites the module A402 and the module B412 by the update module A406 and the update module B416 arranged on the Flash ROM 211 in Fig. 4, which will also be described later.

[0030] The rewrite request receiving unit 311 receives a rewrite request for the module A 402 and the module B 412 arranged on the Flash ROM 211 described later when the MFP 100 is in operation. The rewrite request includes, for example, information about the update module that issued the rewrite request and information about the module to be rewritten. Here, the operation of the MFP 100 refers to a state in which the BIOS 360, the loader 370, the initrd 380, the kernel 390, and the controller software 300 have started up normally and the functions of the MFP 100 can be provided.

[0031] The update module determination unit 312 determines whether the module that issued the rewrite request is a genuine update module. Specifically, it determines that only the update module A 406 and the update module B 416 arranged on the Flash ROM 211 described later that realizes the function of the software update unit 310 are genuine update modules. It determines that the other modules that issued the rewrite request are non-genuine update modules.

[0032] The first tampering detection unit 313 detects tampering of the STD whitelist 403 and the SAFE whitelist 413 arranged on the Flash ROM 211 in FIG. 4 described later. For example, a digital signature verification using a public key encryption algorithm can be used as a method of tampering detection. In this case, the first tampering detection unit 313 can detect tampering of the whitelist by verifying the signature value (signature data) of the whitelist using a public key that is a signature verification key. When tampering of the whitelist is detected, the first tampering detection unit 313 notifies the user that tampering has been detected via the notification unit 315 described later, and stops the system.

[0033] The unauthorized tampering prevention unit 314 prevents modules to be protected and listed in the whitelist from being unauthorizedly rewritten by unauthorized update modules. Specifically, when an update module determined to be an unauthorized update module by the update module determination unit 312 issues a rewrite request for a module to be protected (a module listed in the whitelist), the unauthorized tampering is prevented by rejecting the rewrite request. An example of the whitelist is, for example, as shown in FIG. 5, a list in which the module name and the hash value (correct hash value) of the module in a state where the module is not tampered with are listed for each module to be protected from unauthorized tampering. For example, well-known hash values ​​such as SHA256 and SHA512 can be used. The whitelist 403 for STD that lists modules for STD and the whitelist 413 for SAFE that lists modules for SAFE may be separated, or may be combined into one whitelist 502. Also, a whitelist may be provided in which the module name of the whitelist 501 is modified so that the STD module and the SAFE module can be distinguished, as in the whitelist 501. This is merely an example, and this embodiment can also be realized with a whitelist that lists only the names of modules to be protected.

[0034] When the unauthorized tampering prevention unit 314 performs unauthorized tampering prevention, the notification unit 315 notifies the user of the fact. As a notification method, for example, first, "the name of the unauthorized update module that attempted unauthorized tampering", "the name of the module that was the target of unauthorized tampering", "the time when unauthorized tampering was prevented", and the like are recorded as a log file for each event that occurred. Then, there is a method of recording and saving one line at a time in the data storage unit 302. The recorded and saved log file can be transmitted to an external management server or displayed on the operation unit 102 so that the administrator can confirm that there was an attempt at unauthorized tampering by a third party. In addition, when the first tampering detection unit 313 detects tampering of the whitelist, the user is notified of the fact. As a notification method, for example, as in the above-mentioned unauthorized tampering prevention, "the name of the whitelist that detected tampering", "the time when tampering was detected", and the like can be recorded and saved as a log file. As a notification method when the system is stopped when tampering of the whitelist is detected, a message that the system has been stopped is displayed on the front surface 1201 of the operation unit 102 as shown in FIG. 12. To shut down the system, the button display is removed and a message is displayed on the entire surface 1201 indicating that the system has been shut down due to tampering detection.

[0035] When a module is updated (rewritten) by software update unit 310, whitelist update unit 316 calculates a hash value from the module, and updates the correct hash value of the module described in the whitelist of Fig. 5. This makes it possible to ensure consistency between the hash value of a module in a normal state in MFP 100 and the correct hash value described in the whitelist.

[0036] FIG. 4 shows an example of data stored in the Flash ROM 211.

[0037] The FlashROM 211 logically divides the usage area for each start mode into a normal start area (STD start area) 401, an update start area (SAFE start area) 411, and other common areas. This is merely an example, and start modes other than STD and SAFE may be additionally provided, in which case the FlashROM 211 area can also be divided into additional areas. The STD start area 401 includes a module A 402, a whitelist for STD 403, a kernel for STD 404, an initrd for STD 405, and an update module A 406, which will be described later. The SAFE start area 411 includes a module B 412, a whitelist for SAFE 413, a kernel for SAFE 414, an initrd for SAFE 415, and an update module B 416, which will be described later. A start mode flag 421 stored in the common area is used to determine the current start mode, etc. For example, the loader 370 reads the start mode flag 421, and if the flag indicates STD start, loads the STD kernel 404 and the STD initrd 405 to start STD start. Similarly, if the start mode flag 421 indicates SAFE start, the loader 370 loads the SAFE kernel 414 and the SAFE initrd 415 to start SAFE start. The module A 402 includes a module for STD start, and by executing this module, a function required for STD start is provided via the MFP 100. Similarly, the module B 412 includes a module for SAFE start, and by executing this module, a function required for SAFE start is provided via the MFP 100. In the following description, the module included in the STD start area 401 is described as the module A 402, and the module included in the SAFE start area 411 is described as the module B 412, but a plurality of other modules may be included. The STD whitelist 403 lists module A 402 for STD startup, which is to be protected from unauthorized tampering, together with the correct hash value, as shown in Fig. 5. Similarly, the SAFE whitelist 413 lists module B 412 for SAFE startup, which is to be protected from unauthorized tampering, together with the correct hash value, as shown in Fig. 5.The update module A406 updates the modules by rewriting the module B412 and the update module B416 included in the SAFE startup area 411 at the time of STD startup. The update module B416 updates the modules by rewriting the module A402 and the update module A406 included in the STD startup area 401 at the time of SAFE startup. In this way, when the module A402 and the update module A406 in the STD startup area 401 are to be rewritten, first, SAFE startup is performed and the update is performed by the update module B416. Therefore, it is possible to update the module in another area without affecting the operation of the current startup mode. The same is true when rewriting the module in the SAFE startup area 411; if STD startup is performed and the update is performed by the update module A406, the modules in another area (module B412, update module B416) can be safely updated.

[0038] (Processing flow of the first embodiment) The process of preventing unauthorized tampering in this embodiment will be described with reference to the flowcharts of FIGS.

[0039] The rewrite request receiving unit 311 receives a rewrite request for a module (S601). The first tampering detection unit 313 verifies whether or not the whitelist has been tampered with (S602). When tampering with the whitelist is detected (S603), the notification unit 315 notifies the user by recording a log and displaying a screen on the operation unit 102, and stops the system (S610, S611, S612). When the whitelist has not been tampered with (S603), the unauthorized rewrite protection unit 314 checks whether or not the module to be rewritten is registered in the whitelist (whether or not it is to be protected) (S604). When the module is not registered in the whitelist (S605), it is determined that it is not to be protected, and the software update unit 310 executes rewriting of the module in response to the rewrite request (S606). If the update module is registered in the whitelist (S605), the update module determination unit 312 determines whether the update module that issued the rewrite request is a genuine module (S620, S621). If it is determined that the rewrite request is not from a genuine update module (S621), the unauthorized rewrite protection unit 314 prevents unauthorized rewrite by refusing the rewrite request (S622). Furthermore, the notification unit 315 logs the occurrence of unauthorized rewrite, thereby notifying the user of the sign of an attack (S624). If it is determined that the rewrite request is from a genuine update module (S621), the software update unit 310 rewrites the module in response to the rewrite request (S623), and the whitelist update unit 316 updates the whitelist (S625).

[0040] It should be noted that the order of log recording (S611) and system shutdown (S612), and the processing order of rewrite request refusal (S622) and log recording (S624) are merely examples, and the orders may be reversed.

[0041] In this manner, in this embodiment, when unauthorized tampering is prevented, the system and modules do not stop but continue to operate as is, and the user is notified that protection has been achieved. This makes it possible to prevent a decrease in operating rate and degradation of functionality while maintaining security, and also to inform the user of signs of an impending attack.

[0042] (Modification 1 of the first embodiment) The above-mentioned SAFE startup is an emergency startup mode that is normally used when updating modules for STD startup or when STD startup does not operate normally, so the functions that can be used are often limited compared to STD startup. In this modified example, a method of notifying the user will be described when the log recording function by the notification unit 315 cannot be used during SAFE startup due to such functional limitations and when unauthorized tampering is prevented during SAFE startup.

[0043] In this modification, when unauthorized tampering is prevented during SAFE startup, the unauthorized tampering prevention unit 314 performs simplified log recording since the notification unit 315 cannot record logs due to the above-mentioned functional limitations. Simplified log recording means, for example, recording a text file in which the "name of the unauthorized update module that attempted unauthorized tampering," "name of the module that was the target of unauthorized tampering," and "time when unauthorized tampering was prevented" are described on one line for each event. These text files may be referred to as simplified logs. This can be realized by saving these in the data storage unit 302. It is possible to determine whether the current startup mode is STD startup or SAFE startup by reading the startup mode flag 421 described above.

[0044] In this modification, the notification unit 315 further includes a function for checking whether or not a simple log is saved when the STD is started. If a simple log is saved, the notification unit 315 also records the contents of the simple log in a log file managed by the notification unit 315, thereby realizing a user notification function such as sending the log file to a management server and displaying it on the operation unit 102. After completing the log recording, the notification unit 315 deletes the simple log.

[0045] The processing flow of this modified example will be described with reference to FIG. 6(C), FIG. 7(A), and FIG. 7(B). Note that a description of processes that are substantially the same as those in the first embodiment will be omitted. When unauthorized tampering has been prevented (S622), the unauthorized tampering prevention unit 314 judges whether the current startup mode is STD startup or not (S701). When it is judged to be STD startup (S701), the notification unit 315 records a log (S702). When it is judged to be SAFE startup (S701), the unauthorized tampering prevention unit 314 generates and saves a simple log (S703). At the next STD startup of the MFP 100, the notification unit 315 checks whether a simple log has been saved (S711), and when a simple log has been saved, it records a log (S712) and deletes the simple log (S713).

[0046] In this manner, in this modification, if log recording is not possible when SAFE is started, a simplified log file is generated, and the next time STD is started, log recording is performed formally by the notification unit 315. This makes it possible to notify the user even if unauthorized tampering is prevented when SAFE is started.

[0047] (Modification 2 of Example 1) In this modified example, a method of notifying the user by the notification unit 315 when the FlashROM 211 cannot be used due to a malfunction, etc., will be described. When recording a log in a log file, the notification unit 315 of the first embodiment stores the log in the FlashROM 211 via the data storage unit 302. Therefore, when the FlashROM 211 cannot be used due to a malfunction, etc., the log cannot be recorded and the user cannot be notified.

[0048] In this modification, the notification unit 315 further includes a function of displaying, via a display area 1006 of the operation unit 102 shown in FIG. 10, that unauthorized rewriting has been prevented when the FlashROM 211 is unavailable due to a malfunction or the like and cannot be logged. FIG. 10 shows a menu screen 1001 displayed on the operation unit 102, which is used by the user to instruct the execution of various functions of the multifunction device. The button 1002 is used by the user to instruct the copy function. The button 1003 is used by the user to instruct the scan and save function. The button 1004 is used by the user to instruct the scan and send function. The button 1005 is used by the user to instruct a change in the settings of the device. The display area 1006 displays various messages for the user that are generated during the operation of the device. The user notification via the operation unit 102 does not use the FlashROM 211, so that the user notification is possible even when the FlashROM 211 is unavailable due to a malfunction or the like. Whether the flash ROM 211 is usable or not can be determined, for example, if an error occurs when the notification unit 315 tries to save a log file in the flash ROM 211 and the file cannot be saved, it can be determined that the flash ROM 211 is in an unusable state due to a malfunction or the like.

[0049] The processing flow of this modified example will be described with reference to Fig. 6(C) and Fig. 8(A) and (B). Note that the description of the processing that is substantially the same as that of the first embodiment will be omitted. When the unauthorized rewrite protection unit 314 protects against unauthorized rewrite (S622), the notification unit 315 judges whether the Flash ROM 211 is available (S801). When the Flash ROM 211 is available (S801), the notification unit 315 performs log recording via the Flash ROM 211 (S802). When the Flash ROM 211 is not available (S801), the notification unit 315 notifies the user that unauthorized rewrite has been protected against via the display area 1006 of the operation unit 102 (S810, S811).

[0050] In this manner, in this modified example, when the Flash ROM 211 cannot be used due to a malfunction or the like, a user notification is given via the display area 1006 of the operation unit 102. This makes it possible to notify the user even when unauthorized rewriting is prevented when the Flash ROM 211 malfunctions.

[0051] (Modification 3 of Example 1) In the second modification of the first embodiment, a method of notifying the user when the Flash ROM 211 is unavailable by displaying the message on the operation unit 102 has been described, but in this modification, a method of using another storage device will be described. For example, a hard disk drive (HDD) or an eMMC (embedded multi media card) connectable to the SATA I / F 205 is additionally connected to the MFP 100. These devices can then be used as another storage device suitable for this modification. Also, by additionally connecting a Flash ROM other than the Flash ROM 211 to the MFP 100, the added Flash ROM may be used as another storage device in this modification.

[0052] This modification enables a user to be notified via another storage device even when the FlashROM 211 is unavailable due to a malfunction, etc. In this modification, when the FlashROM 211 is unavailable due to a malfunction, etc., the notification unit 315 records a log via another available storage device, so that a user can be notified.

[0053] In this modification, when the FlashROM 211 is unavailable and log recording is not possible, the notification unit 315 records a simple log in another storage device. A method similar to that of the first modification can be applied as a method for recording a simple log. In this case, in this modification, a text file in which a simple log is written is stored in a storage device other than the FlashROM 211. Whether the FlashROM 211 is available can be determined by a method similar to that of the second modification. Furthermore, when the FlashROM 211 becomes available, the notification unit 315 checks whether a simple log exists in the other storage device, and if a simple log exists, performs log recording and notifies the user in the same manner as the first modification.

[0054] The processing flow of this modification will be described with reference to FIG. 6(C), FIG. 8(A), (C), and FIG. 7(B). Note that the description of the processing that is substantially the same as that of the first embodiment will be omitted. When the unauthorized rewrite protection unit 314 protects against unauthorized rewrite (S622), the notification unit 315 judges whether the FlashROM 211 is available (S801). When the FlashROM 211 is available (S801), the notification unit 315 performs log recording via the FlashROM 211 (S802). When the FlashROM 211 is not available (S801), the notification unit 315 records a simple log in another storage device (S810, S812). When the FlashROM 211 becomes available and a simple log exists in another storage device (S711), the notification unit 315 performs log recording (S712) and deletes the simple log (S713).

[0055] In this manner, in this modification, if the Flash ROM 211 cannot be used due to a malfunction or the like, a simple log is stored in another storage device, and the log is officially recorded by the notification unit 315 after the Flash ROM 211 is restored. This makes it possible to notify the user even if unauthorized rewriting is prevented when the Flash ROM 211 malfunctions.

[0056] (Variation 4 of the First Embodiment) In this modification, when the Flash ROM 211 is unavailable, the simple log is stored in the NVRAM of the TPM 212. Since the simple log is stored in the NVRAM of the TPM 212, which is a tamper-resistant security chip, security is improved compared to the modification 3 of the first embodiment. Since this modification makes it difficult to tamper with the simple log, it is possible to defend against attacks that interfere with the log recording and user notification of the notification unit 315 by, for example, tampering with or deleting the simple log.

[0057] In this modification, when the Flash ROM 211 is unavailable and log recording is not possible, the notification unit 315 performs simple log recording in the NVRAM of the TPM 212. The method of simple log recording can be substantially the same as in the first and third modifications. Whether the Flash ROM 211 is available can be determined by the same method as in the second and third modifications. Furthermore, substantially the same as in the third modification, when the Flash ROM 211 becomes available, the notification unit 315 checks whether there is a simple log in the NVRAM of the TPM 212, and if there is a simple log, performs log recording and notifies the user in the same manner as in the first and third modifications.

[0058] The processing flow of this modification will be described with reference to FIG. 6(C), FIG. 8(A), (D), and FIG. 7(B). Note that the description of the processing that is substantially the same as that of the first embodiment will be omitted. When the unauthorized rewrite protection unit 314 protects against unauthorized rewrite (S622), the notification unit 315 judges whether the FlashROM 211 is available (S801). When the FlashROM 211 is available (S801), the notification unit 315 performs log recording via the FlashROM 211 (S802). When the FlashROM 211 is not available (S801), the notification unit 315 records a simple log in the NVRAM of the TPM 212 (S810, S813). When the FlashROM 211 becomes available and there is a simple log in the NVRAM of the TPM 212 (S711), the notification unit 315 performs log recording (S712) and deletes the simple log (S713).

[0059] In this manner, in this modification, if the Flash ROM 211 cannot be used due to a malfunction or the like, a simple log is stored in the NVRAM of the TPM 212, and the notification unit 315 formally records the log after the Flash ROM 211 is restored. This makes it possible to notify the user even if unauthorized rewriting is prevented when the Flash ROM 211 malfunctions. Furthermore, since the simple log is stored in the NVRAM of the TPM 212, which is a tamper-resistant security chip, it is also possible to respond to attacks such as tampering with the simple log.

[0060] (Modification 5 of the First Embodiment) The alternative notification process (screen display, use of another storage device, use of NVRAM of TPM) when the storage device (FlashROM 211) described in the modified examples 2, 3, and 4 of the first embodiment is unavailable can be dynamically switched according to conditions. Specifically, the notification by screen display on the operation unit 102 described in the modified example 2 is always performed because it is available regardless of the availability of the storage device or the TPM 212. The remaining alternative notification processes, the use of another storage device in the modified example 3 and the use of the NVRAM of the TPM 212 in the modified example 4, are switched depending on whether the respective device functions are available. Furthermore, in this modified example, security is prioritized, and only when the use of the NVRAM of the TPM 212 in the modified example 4 is unavailable, the process is switched to the use of another storage device in the modified example 3.

[0061] In this modification, in addition to the functions described in the modifications 2, 3, and 4, the notification unit 315 further includes a function of determining whether the TPM 212 is available, and if the TPM 212 is available, storing a simple log in the NVRAM of the TPM 212 as in the modification 4. Furthermore, if the TPM 212 is unavailable, the notification unit 315 determines whether a storage device other than the Flash ROM 211 is available, and if the storage device is available, stores the simple log in the storage device as in the modification 2. Furthermore, when the Flash ROM 211 becomes available, the notification unit 315 checks whether a simple log exists in the NVRAM of the TPM 212 or in the storage device, and if the simple log exists, performs log recording and user notification as in the modifications 3 and 4. The determination of whether the TPM 212 is available can be made, for example, by determining whether the TPM function 1102 in the setting screen 1101 shown in FIG. 11 is enabled. FIG. 11 shows a setting screen 1101 displayed on the operation unit 102, which is a screen transition that is made by pressing the setting button 1005 in FIG. 10. When the TPM function 1102 is selected as in FIG. 11, it can be determined that the above-mentioned function of saving data to the NVRAM of the TPM 212 is available for use.

[0062] The processing flow of this modification will be described with reference to FIG. 6(C), FIG. 8(A), (E), and FIG. 7(B). Note that the description of the processing that is substantially the same as that of the first embodiment will be omitted. When the unauthorized rewrite protection unit 314 protects against unauthorized rewrite (S622), the notification unit 315 judges whether the Flash ROM 211 is available (S801). When the Flash ROM 211 is available (S801), the notification unit 315 performs log recording via the Flash ROM 211 (S802). When the Flash ROM 211 is not available (S801), the notification unit 315 notifies the user that unauthorized rewrite has been protected against via the display area 1006 of the operation unit 102 (S810, S814). The notification unit 315 judges whether the TPM 212 is available (S815), and when it is available, records a simple log in the NVRAM of the TPM 212 (S816). If the TPM 212 is unavailable, the notification unit 315 determines whether or not another storage device is available (S817). If another storage device is available (S817), the notification unit 315 records a simple log in the other storage device (S818). If it is unavailable, the process ends (S817). If the flash ROM 211 becomes available and a simple log exists in the NVRAM of the TPM 212 or in another storage device (S711), the simple log is recorded (S712) and the simple log is deleted (S713).

[0063] In this modification, the NVRAM of the TPM 212 is used preferentially with security in mind, but a separate storage device may be used preferentially. For example, since the storage capacity of the NVRAM of the TPM 212 is usually limited to several tens of Mbytes, it is also possible to prioritize free space and use a separate storage device, which generally has ample capacity, preferentially. In this case, the availability of the separate storage device is determined first, and the NVRAM of the TPM 212 is used only when the separate storage device cannot be used.

[0064] In this manner, in this modified example, when the FlashROM 211 cannot be used due to a malfunction or the like, the method of notifying the user is dynamically switched and implemented according to the situation. This makes it possible to notify the user using available means even if unauthorized rewriting is prevented when the FlashROM 211 malfunctions.

[0065] (Variation 6 of Example 1) In the first embodiment, if the update module determination unit 312 determines that the update module is genuine, the target module is rewritten as is (S621, S623), but in this modification, tampering detection of the target module is performed before the target module is rewritten (S623). This modification makes it possible to detect tampering even when the module is rewritten, enabling early detection of malware.

[0066] In this modification, the unauthorized tampering prevention unit 314 further includes a function of detecting tampering of the module to be rewritten using a whitelist when the update module determination unit 312 determines that the rewrite request is made by a legitimate update module. Specifically, the unauthorized tampering prevention unit 314 calculates a hash value of the module to be rewritten and compares it with the correct hash value of the module listed in the whitelists 403 and 413. If the comparison results in a match in the hash values, the unauthorized tampering prevention unit 314 permits the software update unit 310 to rewrite the module. If the hash values ​​do not match, the unauthorized tampering prevention unit 314 determines that the module has been tampered with, and the notification unit 315 logs that the module has been tampered with, and the system is stopped.

[0067] The processing flow of this modified example will be described with reference to FIG. 6(C) and FIG. 9. Note that the description of the processing that is substantially the same as that of the first embodiment will be omitted. The install module determination unit 312 determines whether the install module that issued the rewrite request is a genuine module (S621). When it is determined that the rewrite request is from a genuine install module (S621), the unauthorized rewrite protection unit 314 calculates the hash value of the module that is the target of rewrite by the rewrite request (S901) and compares it with the correct hash value in the whitelist (S902). When the hash values ​​match (S902), the software update unit 310 rewrites the target module (S623) and updates the whitelist (S625). When the hash values ​​do not match (S902), it records the log and stops the system (S610, S611, S612).

[0068] In this way, in this modified example, since tampering can be detected even when a module is rewritten, malware can be discovered early.

[0069] (Other Examples) The present invention can also be realized by a process in which a program for implementing one or more of the functions of the above-described embodiments is supplied to a system or device via a network or a storage medium, and one or more processors in a computer of the system or device read and execute the program. The present invention can also be realized by a circuit (e.g., ASIC) that implements one or more of the functions.

Claims

1. An information processing device for detecting a request to tamper with an execution module, comprising: a storage means for storing association information between the execution module and information for detecting tampering with the execution module; a first detection means for detecting a tampering request of the execution module as a first tampering by using the association information; a second detection means for detecting tampering of the association information as a second tampering; If the first tampering is detected and the second tampering is not detected, and a notification means for making a first notification without stopping the function of the management device. Information processing device.

2. The notification means notifies the user when the first tampering is detected and the second tampering is not detected. In this case, the first notification is made, When the second tampering is detected, a second notification different from the first notification is performed.

2. An information processing apparatus according to claim 1.

3. The information for detecting tampering with the execution module is a hash of the execution module.

2. The information processing apparatus according to claim 1, wherein the value is a value.

4. The first detection means detects the associated 2. The information processing method according to claim 1, wherein the first tampering is detected by using tag information. equipment.

5. a tamper-resistant security chip that stores information about the first tampering; 2. The information processing apparatus according to claim 1, further comprising:

6. The information about the first tampering is a log record when the first tampering is detected.

6. The information processing apparatus according to claim 5,

7. The notification means performs the first notification or the second notification by displaying on a screen.

3. The information processing apparatus according to claim 2,

8. An information processing method for detecting a request to tamper with an execution module, comprising: a storage step in which a storage unit included in the information processing device stores association information between the execution module and information for detecting tampering with the execution module; a first detection step in which a first detection means included in the information processing device detects a tampering request for the execution module as a first tampering by using the association information; a second detection step in which a second detection means included in the information processing device detects tampering of the association information as a second tampering; An information processing method characterized in that it has an alarm process in which an alarm means provided in the information processing device issues a first alarm without stopping the function of the information processing device when the first tampering is detected but the second tampering is not detected.

9. Computer, An information processing device for detecting a tampering request of an execution module, a storage means for storing association information between the execution module and information for detecting tampering with the execution module; a first detection means for detecting a tampering request of the execution module as a first tampering by using the association information; a second detection means for detecting tampering of the association information as a second tampering; If the first tampering is detected and the second tampering is not detected, and a notification means for making a first notification without stopping the function of the management device. A program for functioning as an information processing device.

Images