Information processing device

Abstract

To leave the history of modification of a modified program even when the program is restored.SOLUTION: An information processing apparatus comprises: a CPU 301 that stores the history of operation of the information processing apparatus as a log; a Boot ROM 303 for a CPU that stores a program executed by the CPU 301; a secure microcomputer 315 that detects modification of the program stored in the Boot ROM 303 for a CPU; a Boot ROM 316 for a secure microcomputer that stores a program for restoration for restoring the program the modification of which is detected by the secure microcomputer 315; and a register 317 that stores information indicating the modification of the program detected by the secure microcomputer 315. The CPU 301 stores the information stored in the register 317 as a log.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present invention relates to an information processing device capable of detecting alteration of a program executed by a processing unit and restoring the altered program. [Background technology]

[0002] An information processing device has a network interface and provides users with a file server function and an email sending / receiving function. When an information processing device is connected to a network, there is a possibility that the information processing device may be illegally used by being hacked. In recent years, on the premise that it is impossible to eliminate all risks from diversifying cyber attacks, emphasis has been placed on the idea of ​​cyber resilience, which allows an information processing device to restore itself to a state before a cyber attack even if it is attacked. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2009-301429 A [Patent Document 2] JP 2012-78953 A Summary of the Invention [Problem to be solved by the invention]

[0004] Patent Document 1 discloses a technology for detecting tampering of software installed in a device when the device is started. The method for detecting software tampering involves calculating a hash value of the software, comparing it with a master hash value, and detecting software tampering based on the comparison result. In Patent Document 1, when software tampering is detected, the tampered software and other software that uses that software are rendered unusable.

[0005] Patent Document 2 discloses a method for repairing a tampered program. In Patent Document 2, a specific user such as a serviceman connects a legitimate program storage means for storing a legitimate program to a program storage means of the multifunction device 100, and inputs a key for executing repair of the tampered program. This rewrites the tampered program into a legitimate program. In order to execute the rewritten legitimate program, it is necessary to reset the processor that executes the program, but resetting the processor makes it impossible to leave a history of the tampering.

[0006] SUMMARY OF THE PRESENT DISCLOSURE An object of the present invention is to provide an information processing device that is capable of leaving a history of an alteration even if an altered program is restored. [Means for solving the problem]

[0007] In order to achieve the above-mentioned object, the information processing device of the present invention comprises a processing means for storing the operation history of the information processing device as a log, a first storage means for storing a program executed by the processing means, a detection means for detecting alteration of the program stored in the first storage means, a second storage means for storing a recovery program for recovering the program whose alteration has been detected by the detection means, and a third storage means for storing information indicating the alteration of the program detected by the detection means, wherein the processing means stores the information stored in the third storage means as a log. Effect of the Invention

[0008] According to the present invention, it is possible to prevent the recovery program from being altered by the processing means. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a block diagram showing a system including an image forming apparatus. [Diagram 2] FIG. 1 is a perspective view of an image forming apparatus. [Diagram 3] FIG. 2 is a block diagram showing details of a controller. [Figure 4A] FIG. 2 is a diagram showing details of a Boot ROM for a secure microcomputer. [Figure 4B] FIG. 2 is a diagram showing details of a Boot ROM for a CPU. [Diagram 5] This figure shows the configuration of the bus connecting the CPU, secure microcontroller, and Boot ROM. [Figure 6] 11 is a flowchart executed by a secure microcomputer. [Figure 7] 4 is a flowchart executed by a power supply control unit. [Figure 8] 1 is a flowchart executed by a CPU. [Figure 9A] FIG. 11 is a diagram showing details of a Boot ROM for a secure microcomputer according to a second embodiment. [Figure 9B] FIG. 11 is a diagram showing details of a Boot ROM for a CPU according to a second embodiment. [Figure 10] 10 is a flowchart executed by a secure microcomputer according to a second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings. Note that the following preferred embodiments do not limit the scope of the present invention.

[0011] [First embodiment] <System configuration> Fig. 1 is a block diagram showing a system including an image forming apparatus according to a first embodiment. The system in Fig. 1 has host computers 40 and 50, and image forming apparatuses 10, 20, and 30. The host computers 40 and 50 and the image forming apparatuses 10, 20, and 30 are each connected to a LAN 60. The image forming apparatuses 10, 20, and 30 of this embodiment may be connected to a network different from the LAN, such as a WAN (public line).

[0012] Host computers (hereinafter referred to as PCs) 40 and 50 have the functions of a personal computer. PC 40 can send and receive files and e-mails using FTP or SMB protocols via LAN 60. PC 40 can also issue print commands to image forming devices 10, 20, and 30 via a printer driver. PC 40 can also periodically inquire of image forming devices 10, 20, and 30 about the status of the image forming devices. In response to a request from PC 40, image forming devices 10, 20, and 30 return status information indicating the status of the image forming devices, such as whether printing is possible, configuration information indicating the configuration of the image forming devices, and information on consumables (remaining toner, remaining paper) used in the image forming devices.

[0013] Image forming apparatuses 10 and 20 are apparatuses having a print function (printing function) and a scanner function (reading function), while image forming apparatus 30 is an apparatus having a print function but no scanner function. Image forming apparatus 10 includes a scanner unit 13 which is an image input device, a printer unit 14 which is an image output device, a controller 11 which controls the operation of the entire image forming apparatus 10, and an operation unit 12 which is a user interface (UI). Image forming apparatus 20 also includes a scanner unit 23, a printer unit 24, a controller 21, and an operation unit 22. Image forming apparatus 30 includes a printer unit 34, a controller 31, and an operation unit 32.

[0014] The image forming apparatus 10 will be described in detail below, and the image forming apparatuses 20 and 30 will not be described because they are similar to the image forming apparatus 10. The image forming apparatus 10 is an example of an information processing apparatus of the present invention.

[0015] <Configuration of Image Forming Apparatus> FIG. 2 is a perspective view of the image forming apparatus.

[0016] As shown in FIG. 2, the image forming apparatus 10 includes an operation unit 12 which is a user interface (UI), a scanner unit 13 which is an image input device, and a printer unit 14 which is an image output device.

[0017] The operation unit 12 has a hard key 121 and a display unit 122 that displays information. The hard key 121 has a power saving / recovery button 121c for switching the image forming apparatus 10 to a power saving state or for recovering the image forming apparatus 10 from the power saving state, a start key 121b for instructing the start of printing, a number key 121c, etc.

[0018] The scanner unit 13 is a device that reads an image formed on a document and acquires image data. The reflected light of light irradiated onto the image formed on the document is input to a CCD, and the image information is converted into an electrical signal. This electrical signal is converted into a luminance signal consisting of R, G, and B colors, and is output to the controller 11, which will be described later.

[0019] The document to be read by the scanner unit 13 is set on a tray 202 of a document feeder 201. When a user inputs an instruction to start reading using the operation unit 12, the scanner unit 13 feeds documents one by one from the tray 202 of the document feeder 201 and performs a document reading operation. Note that the method of reading the document does not have to be an automatic feeding method using the document feeder 201, but may be a method of scanning a carriage equipped with a light source and a CCD with respect to a document placed on a glass surface (not shown).

[0020] The printer unit 14 is a device that forms an image on paper using input image data. Note that the image forming method of the printer unit 14 in this embodiment is an electrophotographic method using a photosensitive drum or a photosensitive belt, but the present invention is not limited to this. For example, the printer unit 14 may be an inkjet method that ejects ink from a minute nozzle array to print on paper.

[0021] Furthermore, image forming apparatus 10 has a plurality of paper cassettes 203, 204, and 205 that store paper on which an image is formed by printer unit 14. Furthermore, image forming apparatus 10 has a plurality of paper cassette discharge trays 206 onto which paper on which an image is formed by printer unit 14 is discharged.

[0022] <Detailed explanation of Controller 11> 3 is a block diagram showing a controller that controls the entire image forming apparatus. The controller 11 is electrically connected to a scanner unit 13 and a printer unit 14. The controller 11 is also connected to PCs 40 and 50 and external devices via a LAN 60 or the like so as to be able to communicate with them.

[0023] The CPU 301 executes a program stored in the CPU Boot ROM 303 and accesses peripheral devices connected to the CPU 301. The CPU 301 stores the operation history of the image forming apparatus 10 as a log in a storage such as an HDD 304. The RAM 302 is a system work memory for the CPU 301 to operate, and is also a memory for temporarily storing image data. The RAM 302 is an SRAM and a DRAM. The CPU Boot ROM 303 stores a program for starting the CPU 301. An image of the program being memory-mapped in the CPU Boot ROM 303 is as shown in FIG. 4B. The CPU Boot ROM 303 is configured to be accessible from both the CPU 301 and the secure microcomputer 315. A connection bus configuration for accessing from both the CPU 301 and the secure microcomputer 315 will be described later.

[0024] The HDD 304 is a hard disk drive capable of storing system software and image data. The operation unit I / F 305 is an interface unit for connecting the system bus 307 and the operation unit 12. The operation unit I / F 305 receives image data to be displayed on the operation unit 12 from the system bus 307 and outputs the image data to the operation unit 12. The operation unit I / F 305 also outputs information input from the operation unit 12 to the system bus 307.

[0025] A LAN controller 306 is connected to the LAN 60 and a system bus 307, inputs and outputs information, and controls communication between the image forming apparatus and the network. An image bus 308 is a transmission path for exchanging image data, and is configured with a PCI bus or IEEE1394. An image processing unit 309 is for performing image processing, and is capable of reading image data stored in the RAM 302, and performing image processing such as enlargement or reduction of JPEG, JBIG, etc., and color adjustment. The data that has undergone image processing here is stored in the RAM 302 or HDD 304.

[0026] The scanner image processing unit 310 corrects, processes, and edits image data received from the scanner unit 13 via the scanner I / F 311. The scanner image processing unit 310 judges whether the received image data is a color document or a black and white document, a text document or a photograph document, and attaches the judgment result to the image data. Such attached information is called attribute data. The printer image processing unit 312 performs image processing on the image data while referring to the attribute data attached to the image data. The image data after image processing is output to the printer unit 14 via the printer I / F 313.

[0027] The power control unit 314 controls changes in the internal power state of the image forming apparatus 10, such as power control at startup or when the power is off, and transition / return to a power saving state. The power control unit 314 also detects return factors (e.g., receiving a fax or pressing a switch) when returning from a power saving state, and also controls the power when transitioning to a standby state according to each return factor.

[0028] The power supply control unit 314 has a register 317 that indicates that a program has been altered. The register 317 holds information indicating that the program has been altered according to a signal from the secure microcomputer 315. The register 317 holds information according to the logic of a general-purpose input / output (GPIO) signal 507 output from the secure microcomputer 315, and the CPU 301 accesses the information after startup. For example, if the signal from the secure microcomputer 315 is Hi, the register holds a register value of "1" as it is determined that the program has been altered. Also, if the signal from the secure microcomputer 315 is Low, the register holds a register value of "0" as it is determined that the program has not been altered. Even if the CPU program 401 is restored before the reset of the CPU 301 is released, the CPU 301 can refer to the register 317 and confirm that the CPU program 401 has been altered.

[0029] The secure microcomputer 315 is a hardware device that serves as the base point of the trusted boot. The secure microcomputer 315 includes a fuse that stores key information inside the device. The secure microcomputer 315 uses the key information to detect alteration of the secure microcomputer program 402 stored in the secure microcomputer boot ROM 316. If the secure microcomputer 315 determines that the secure microcomputer program 402 has not been tampered with, it executes the secure microcomputer program 402. The secure microcomputer 315 also verifies the CPU program 403 stored in the CPU boot ROM 303 and detects alteration of the program. If it determines that the CPU program 403 stored in the CPU boot ROM 303 has not been altered, the reset of the CPU 301 is released.

[0030] When the Secure Microcontroller 315 detects a modification to the CPU program 403, it rewrites the program in the CPU Boot ROM 303 using the recovery program 401 in the Secure Microcontroller Boot ROM 316, which will be described later. In order to prevent the Secure Microcontroller 315 from being attacked by cyberattacks, in this embodiment, the CPU 301 cannot access the Secure Microcontroller Boot ROM 316.

[0031] The Secure Microcontroller Boot ROM 316 stores a program for starting the CPU 301 and a Secure Microcontroller program 402 for starting the Secure Microcontroller 315. The program for starting the CPU 301 (hereinafter, appropriately referred to as the recovery program) is used to recover the CPU program 403 stored in the CPU Boot ROM 303. The images in which the Secure Microcontroller program 402 and the recovery program 401 are memory-mapped in the Secure Microcontroller Boot ROM 316 are as shown in FIG. 4A. The Secure Microcontroller Boot ROM 316 is configured to be accessible only from the Secure Microcontroller 315. In order to prevent the Secure Microcontroller Boot ROM 316 from being attacked by cyberattacks, the CPU 301 cannot access the Secure Microcontroller Boot ROM 316.

[0032] <Detailed Configuration of Boot ROM> FIG. 4A is a diagram showing the program stored in the Secure Microcontroller Boot ROM 316, and FIG. 4B is a diagram showing the program stored in the CPU Boot ROM 303.

[0033] As shown in FIG. 4A, the BootROM 316 for the secure microcontroller stores a program 402 for the secure microcontroller to start up the secure microcontroller 315. Further, the BootROM 316 for the secure microcontroller stores a recovery program 401 for recovering the CPU program 403. The recovery program 401 is a program 401 for returning the CPU program 403 to the state at the restoration point such as at the time of shipment. For example, the restoration program 401 is the CPU program 403 at the restoration point.

[0034] Also, as shown in FIG. 4B, the Boot ROM 303 for the CPU stores a CPU program 403 for starting up the CPU 301. This CPU program 403 is verified by the secure microcontroller 315. Then, the CPU 301 executes the CPU program 403 that is determined not to have been modified by the secure microcontroller 315.

[0035] <Configuration of SPI Bus> FIG. 5 shows the bus configuration for accessing each ROM. Here, the description will be made by taking the SPI (Serial Peripheral Interface) bus as an example, but the present invention is not limited to the SPI bus.

[0036] The signal 501 is the chip select signal (CS1#) of the SPI. The chip select signal is a signal for selecting a device to be read and written. The chip select signal 501 is a signal used to access the Boot ROM 303 for the CPU. The chip select signal 501 is a signal that can be used by both the CPU 301 and the secure microcontroller 315. Therefore, when the secure microcontroller 315 accesses the Boot ROM 303 for the CPU, the secure microcontroller 315 controls the chip select signal 501. And when the CPU 301 accesses the Boot ROM 303 for the CPU, the CPU 301 controls the chip select signal 501.

[0037] A signal 502 is a clock signal (CLK) of the SPI. The clock signal 502 is supplied from the CPU 301, which is the master, to the Boot ROM 303 for the CPU and the Boot ROM 316 for the secure microcomputer. The secure microcomputer 512 can also supply the clock signal 502 to the Boot ROM 303 for the CPU and the Boot ROM 316 for the secure microcomputer. Therefore, when the secure microcomputer 315 accesses the Boot ROM 303 for the CPU or the Boot ROM 316 for the secure microcomputer, the secure microcomputer 315 controls the clock signal 502. When the CPU 301 accesses the Boot ROM 303 for the CPU or the Boot ROM 316 for the secure microcomputer, the CPU 301 controls the clock signal 502.

[0038] The signal 503 is a data bus signal (IO) of the SPI. The data bus signal 503 is a signal for writing data to the Boot ROM 303 for CPU and the Boot ROM 316 for secure microcomputer, and for reading data from the Boot ROM 303 for CPU and the Boot ROM 316 for secure microcomputer. The data bus signal 503 is a signal that can be used by both the CPU 301 and the secure microcomputer 315. Therefore, when the secure microcomputer 315 accesses the Boot ROM 303 for CPU or the Boot ROM 316 for secure microcomputer, the secure microcomputer 315 controls the data bus signal 503. Also, when the CPU 301 accesses the Boot ROM 303 for CPU or the Boot ROM 316 for secure microcomputer, the CPU 301 controls the data bus signal 503.

[0039] Signal 504 is a chip select signal (CS0#) of the SPI. Chip select signal 504 is a signal used to access Boot ROM 316 for the secure microcomputer. Chip select signal 504 is a signal that can be used only by the secure microcomputer 315. Since CPU 301 cannot control chip select signal 504, CPU 301 cannot access Boot ROM 316 for the secure microcomputer.

[0040] Signal 505 is a signal (Reset#) for secure microcomputer 315 to release the reset of CPU 301. Secure microcomputer 315 verifies CPU program 403 in CPU Boot ROM 303, and if it determines that CPU program 403 has not been altered, changes reset signal 505 from Low to Hi. When reset signal 505 becomes Hi (reset is released), CPU 301 executes CPU program 403 in CPU Boot ROM 303.

[0041] Signal 506 is a bus signal for CPU 301 to access register 317. Bus signal 506 may be any signal as long as it is a bus that enables CPU 301 to read information stored in register 317.

[0042] Signal 507 is a general-purpose input / output (GPIO) signal for notifying the result of verifying the CPU program 403. The secure microcomputer 317 controls the level of the GPIO signal 507 depending on the result of detecting alteration of the CPU program 403. When the secure microcomputer 317 detects alteration of the CPU program 403, it changes the GPIO signal 507 from low to high. On the other hand, when the secure microcomputer 317 does not detect alteration of the CPU program 403, it keeps the GPIO signal 507 low.

[0043] <Operation of secure microcontroller> FIG. 6 shows the operation flow of the secure microcomputer 315.

[0044] In S601, the secure microcomputer 315 is not powered on. When the secure microcomputer 315 is powered on, the process transitions to S602. In S602, the secure microcomputer 315 reads the secure microcomputer program 402 from the secure microcomputer Boot ROM 316. The secure microcomputer 315 then verifies the secure microcomputer program 402 using key information stored in a fuse inside the secure microcomputer 315. If the secure microcomputer program 402 is determined to have not been altered, the secure microcomputer 315 executes the secure microcomputer program 402.

[0045] Next, in S603, the secure microcomputer 315 that executed the secure microcomputer program 402 reads out the CPU program 403 stored in the CPU Boot ROM 303. In S604, the secure microcomputer 315 verifies the read out CPU program 403. Specifically, the secure microcomputer 315 detects whether the CPU program 403 has been altered based on the hash value and the correct answer value of the read out CPU program 403. If the secure microcomputer 315 determines that the read out CPU program 403 has not been altered, it transitions to S609, and if it determines that the read out CPU program 403 has been altered, it transitions to S610.

[0046] In S610, the secure microcomputer 315 outputs "Hi" to the GPIO signal 507. By setting the GPIO signal 507 to "Hi", the secure microcomputer 315 notifies the register 317 that the CPU program 403 has been altered. When the secure microcomputer 315 sets the GPIO signal 507 to "Hi" output, the process transitions to S605.

[0047] In S605, the secure microcomputer 315 reads out the recovery program 401 stored in the secure microcomputer Boot ROM 316. The secure microcomputer 315 reads out the recovery program 401 in order to recover the program stored in the CPU Boot ROM 303 that is determined to have been altered.

[0048] In S606, the secure microcomputer 315 uses the read recovery program 401 to rewrite the CPU program 403 stored in the CPU Boot ROM 303. Specifically, the secure microcomputer 315 writes the recovery program 401 read from the secure microcomputer Boot ROM 316 in S605 to the area of ​​the CPU Boot ROM 303 where the CPU program 403 was stored. This makes it possible to recover the altered data in the CPU Boot ROM 303.

[0049] Furthermore, in S607, the secure microcomputer 315 reads out the CPU program 403 stored in the CPU Boot ROM 303. Then, in S608, the secure microcomputer 315 verifies the read out post-recovery CPU program 403. The secure microcomputer 315 determines whether the CPU program 403 read out in S607 has been altered, and transitions to S609 if it determines that the read out CPU program 403 has not been altered. Also, if it determines that the read out CPU program 403 has been altered, it stops processing. The image forming apparatus 10 may be shut down. Note that the second verification of the CPU program 403 (S607, S608) is not essential.

[0050] In S609, the secure microcomputer 315 releases the reset state of the CPU 301. The secure microcomputer 315 changes the reset signal 505 for the CPU 301 from "Low" to "Hi" to release the reset state of the CPU 301. This makes the CPU 301 operable.

[0051] <Power supply control unit operation> FIG. 7 shows the operation flow of the power supply control unit 314.

[0052] In S701, the power supply control unit 314 is in a state where the power is not turned on. When the power is turned on to the power supply control unit 314, it transitions to S702. In S702, the power supply control unit 314 stores the initial value "0" in the register 317. When the power is turned on to the power supply control unit 314, the power supply control unit 314 initializes the register 317 and stores "0" as the register value. In S703, the power supply control unit 314 is determining the signal level (signal logic) of the GPIO signal 507 which is an input signal. The power supply control unit 314 is making a judgment on the value to be stored according to the notification by the GPIO signal 507 output from the secure microcontroller 315. When the power supply control unit 314 determines that the GPIO signal 507 is "Hi", it transitions to S704, and when it determines that the GPIO signal 507 is "Low", it transitions to S705.

[0053] In S704, the power supply control unit 314 stores the value "1" indicating that a modification has occurred to the CPU program 401 in the register 317. The power supply control unit 314 stores "1", which is a value indicating that a modification has occurred, in the register 317 based on the notification indicating the modification of the CPU program 401 from the secure microcontroller 315 in S703. When "1" is stored in the register 317, it transitions to S705.

[0054] In S705, the power supply control unit 314 determines whether the CPU 301 has set a value in the register 317. If the CPU 301 sets a value in the register 317, it transitions to S703, and if the CPU 301 does not set a value in the register 317, the flow ends. S705 is a flow provided mainly for clearing the value in the register 317 after the CPU 301 has confirmed the value stored in the register 317. Also, it can be used when a modification is detected during the startup of the CPU 301 to leave a record that a modification has occurred to the register 317.

[0055] <Operation of CPU> Figure 8 shows the operation flow of the CPU 301.

[0056] In S801, the CPU 301 is not powered on. When the power is turned on, the process transitions to S802. In S802, the CPU 301 is in a reset state. When the reset is released, the process transitions to S903. The CPU 301 is released from the reset state by the secure microcomputer 315 in the process of S609 in FIG. 6, and the process transitions to S803.

[0057] In S803, the CPU 301 reads out and executes the CPU program 403 from the CPU Boot ROM 303. The CPU 301 executes the CPU program 403 that the secure microcomputer 315 has determined not to have been altered.

[0058] In S804, the CPU 301 reads the register 317.

[0059] In S805, the CPU 301 determines whether the value of the register 317 is "1". If the CPU 301 determines that the value of the register 317 is "1", it determines that an alteration has occurred and that the secure microcomputer 315 has restored it. If the CPU 301 determines that the value of the register 317 is "0", it determines that no alteration has occurred. If the CPU 301 determines that the register 317 is "1", the process transitions to S806, and if the CPU 301 determines that the register 317 is "0", the flow ends.

[0060] In S806, the CPU 301 stores the occurrence of the alteration as an audit log. The storage destination is a non-volatile storage device such as the HDD 304 or a memory.

[0061] As described above, the secure microcomputer 315 can notify the CPU 301 of program alteration via the register 317. As a result, the CPU 301 can save the occurrence of program alteration as a log. This makes it possible to take appropriate security measures based on information on whether or not program alteration has occurred. Also, by configuring the secure microcomputer Boot ROM 316 so that the CPU 301 cannot access it, it becomes possible to protect the secure microcomputer Boot ROM 316 from cyber attacks via the CPU 301.

[0062] [Second embodiment] In the first embodiment, the secure microcomputer 315 executes the secure microcomputer program 402 stored in the secure microcomputer Boot ROM 316. However, the secure microcomputer program 404 may be stored in the CPU Boot ROM 316, and the secure microcomputer 315 may execute the secure microcomputer program 404 stored in the CPU Boot ROM 316.

[0063] FIG. 9A is a diagram showing the programs stored in the secure microcomputer Boot ROM 316, and FIG. 9B is a diagram showing the programs stored in the CPU Boot ROM 303. As shown in FIG.

[0064] As shown in FIG. 9A, the secure microcomputer Boot ROM 316 stores a recovery program 401 for a CPU program 403 .

[0065] 9B, the CPU Boot ROM 303 stores a CPU program 403 for starting up the CPU 301. This CPU program 403 is verified by the secure microcomputer 315. The CPU 301 then executes the CPU program 403 that has been determined by the secure microcomputer 315 to have not been altered. In the second embodiment, the CPU Boot ROM 301 stores a secure microcomputer program 404 for starting up the secure microcomputer 315.

[0066] FIG. 6 shows the operation flow of the secure microcomputer 315.

[0067] In S1001, the secure microcomputer 315 is not powered on. When the secure microcomputer 315 is powered on, the process transitions to S1002. In S1002, the secure microcomputer 315 reads the secure microcomputer program 404 from the CPU Boot ROM 303. The secure microcomputer 315 then verifies the secure microcomputer program 404 using key information stored in a fuse inside the secure microcomputer 315. If the secure microcomputer 315 determines that the secure microcomputer program 404 has not been altered, the secure microcomputer 315 executes the secure microcomputer program 404.

[0068] Next, in S1003, the secure microcomputer 315 that executed the secure microcomputer program 404 reads out the CPU program 403 stored in the CPU Boot ROM 303. In S1004, the secure microcomputer 315 verifies the read out CPU program 403. Specifically, the secure microcomputer 315 detects whether the CPU program 403 has been altered based on the hash value and the correct answer value of the read out CPU program 403. If the secure microcomputer 315 determines that the read out CPU program 403 has not been altered, it transitions to S1009, and if it determines that the read out CPU program 403 has been altered, it transitions to S1010.

[0069] In S1010, the secure microcomputer 315 outputs "Hi" to the GPIO signal 507. By setting the GPIO signal 507 to "Hi", the secure microcomputer 315 notifies the register 317 that the CPU program 403 has been altered. When the secure microcomputer 315 sets the GPIO signal 507 to "Hi", the process transitions to S1005.

[0070] In S1005, the secure microcomputer 315 reads out the recovery program 401 stored in the secure microcomputer Boot ROM 316. The secure microcomputer 315 reads out the recovery program 401 in order to recover the program stored in the CPU Boot ROM 303 that is determined to have been altered.

[0071] In S1006, the secure microcomputer 315 uses the read recovery program 401 to rewrite the CPU program 403 stored in the CPU Boot ROM 303. Specifically, the secure microcomputer 315 writes the recovery program 401 read from the secure microcomputer Boot ROM 316 in S1005 to the area of ​​the CPU Boot ROM 303 where the CPU program 403 was stored. This makes it possible to recover the altered data in the CPU Boot ROM 303.

[0072] Furthermore, in S1007, the secure microcomputer 315 reads out the CPU program 403 stored in the CPU Boot ROM 303. Then, in S1008, the secure microcomputer 315 verifies the read out CPU program 403. The secure microcomputer 315 determines whether the CPU program 403 read out in S1007 has been altered, and transitions to S1009 if it determines that the read out CPU program 403 has not been altered. Also, if it determines that the read out CPU program 403 has been altered, it stops processing. The image forming apparatus 10 may be shut down. Note that the second verification of the CPU program 403 (S1007, S1008) is not essential.

[0073] In S1009, the secure microcomputer 315 releases the reset state of the CPU 301. The secure microcomputer 315 changes the reset signal 505 for the CPU 301 from "Low" to "Hi" to release the reset state of the CPU 301. This makes the CPU 301 operable.

[0074] [Other embodiments] The above-mentioned embodiment can also be realized in the form of a process in which a program for realizing one or more functions is supplied to a system or device via a network or a storage medium, and one or more processors in a computer of the system or device read and execute the program. It can also be realized by a circuit (e.g., ASIC) that realizes one or more functions.

[0075] The image forming apparatus according to the first and second embodiments may be an information processing apparatus such as a printer, a scanner, a personal computer, or a server. [Explanation of symbols]

[0076] 10 Image forming device 301 CPU 303 Boot ROM for CPU 315 Secure Microcontroller 316 Boot ROM for secure microcontrollers 317 Registers

Claims

1. a first storage means for storing a program; a first control means for detecting an alteration of the program based on a start-up of an information processing device; a second control means for executing the program whose modification has not been detected by the first control means; a second storage means for storing a recovery program for recovering the program whose alteration has been detected by the first control means; a third storage means for storing information regarding the alteration of the program detected by the first control means; A fourth storage means; Equipped with The information processing apparatus according to claim 1, wherein the second control means causes the fourth storage means to store the information as a log when the information is stored in the third storage means.

2. 2. The information processing apparatus according to claim 1, wherein the first control means resets the second control means, and releases the reset of the second control means after not detecting any alteration of the program stored in the first storage means.

3. 3. The information processing apparatus according to claim 1, wherein the first control means uses the recovery program to recover the program stored in the first storage means.

4. 4. The information processing apparatus according to claim 3, wherein the first control means releases the reset of the second control means after not detecting any alteration of the program after recovery stored in the first storage means.

5. the first control means and the third storage means are connected by a GPIO signal; 5. The information processing apparatus according to claim 1, wherein the first control means controls a level of the GPIO signal in response to a detection result of the alteration of the program.

6. The information processing device according to any one of claims 1 to 5, characterized in that the second control means executes the program stored in the first storage means or the program after recovery, and the second control means that has executed the program or the program after recovery refers to the third storage means and stores the information stored in the third storage means in the fourth storage means as a log.

7. 7. The information processing apparatus according to claim 1, wherein the second control means changes the information stored in the third storage means to an initial value.

8. the second storage means further stores a startup program executed by the first control means; 8. The information processing device according to claim 1, wherein, when the information processing device is started, the first control means detects alteration of the program by executing the startup program stored in the second storage means.

9. the first storage means further stores a startup program to be executed by the first control means; 8. The information processing apparatus according to claim 1, wherein the first control means executes the startup program stored in the first storage means when the information processing apparatus is started.

10. The first control means stores key information; 10. The information processing apparatus according to claim 8, wherein the first control means executes the program that is determined to have not been altered using the key information.

11. 11. The information processing device according to claim 1, wherein the first control means is capable of selecting the second storage means as the storage means to be read from, and the second control means is not capable of selecting the second storage means as the storage means to be read from.

12. 12. The information processing device according to claim 11, wherein the first control means is connected to a chip select signal that selects the second storage means, but the second control means is not connected to the chip select signal.

13. 13. The information processing device according to claim 12, wherein the first control means is connected to a chip select signal that selects the second storage means and a chip select signal that selects the first storage means different from the chip select signal.

14. 14. The information processing apparatus according to claim 1, further comprising a printing unit for printing an image on a storage medium.

15. 15. The information processing apparatus according to claim 1, further comprising a reading unit for reading an image of a document.

Images