Information processing device

Abstract

To provide an information processing device capable of making a transition to another crypto algorithm when a crypto algorithm for secure boot becomes risky.SOLUTION: An information processing device includes: an arithmetic unit that executes arithmetic processing of a program; and a storing unit that stores a first control program, and a first activation program that executes the signature verification of the first control program. The first activation program can execute multiple signature verification schemes, and executes a process of determining the signature verification scheme corresponding to the signature type of the first control program among the multiple signature verification schemes, and obtaining the execution result of the signature verification through the determined signature verification scheme.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to an information processing device, and more particularly to an information processing device that performs signature verification of a control program during secure boot. [Background technology]

[0002] There are concerns that unauthorized rewriting of software or firmware by attackers could cause serious damage to embedded systems found in automobiles, home appliances, medical devices, etc. As a countermeasure against such threats, secure boot technology is being considered, which allows only untampered programs to be launched when the ECU starts up.

[0003] As one method of secure booting, Patent Document 1 discloses a technology in which, when a client device is started up, the validity of a program to be executed is verified based on information obtained from a server device, and then the program is executed. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2011-003020 Summary of the Invention [Problem to be solved by the invention]

[0005] Normally, the cryptographic algorithm used for program verification during secure boot is fixed for each ECU. Therefore, if future advances in quantum computing technology lead to advances in decryption technology that compromise the cryptographic algorithm, secure boot itself will become vulnerable, posing a major security problem.

[0006] According to the technology of Patent Document 1, the normal boot program and the encrypted OS use different encryption algorithms, and it is suggested that the fastest encryption algorithm can be selected at that time, so it can be said that multiple verification methods are provided. However, there is only one normal boot program for startup, and if this is compromised, it will still pose a major security problem.

[0007] The present invention has been made in view of the above problems, and has an object to provide an information processing device that can switch to another encryption algorithm when the encryption algorithm for secure boot is compromised. [Means for solving the problem]

[0008] An example of an information processing device according to the present invention has an arithmetic unit that performs arithmetic processing of a program, and a memory unit that stores a first control program and a first startup program that performs signature verification of the first control program, wherein the first startup program is capable of executing a plurality of signature verification methods, and executes a process of determining a signature verification method corresponding to the signature type of the first control program from the plurality of signature verification methods, and obtaining the results of performing signature verification using the signature verification method. [Effects of the Invention]

[0009] According to the present invention, if the encryption algorithm for secure boot is compromised, it is possible to easily switch to another encryption algorithm, thereby ensuring security. Further features related to the present invention will become apparent from the description of the present specification and the accompanying drawings. Furthermore, problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram showing a hardware configuration of an information processing apparatus according to an embodiment of the present invention. [Figure 2] FIG. 2 is a block diagram showing the functional configuration of a ROM in which a boot loader program and a control program are stored. [Figure 3] FIG. 10 is a diagram showing the processing flow of a boot loader program according to an embodiment in a single bank configuration. [Figure 4] FIG. 10 is a flowchart showing a process flow of a program update according to an embodiment in a single bank configuration. [Figure 5] FIG. 10 is a diagram showing a processing flow of a boot loader program according to the first embodiment in a double-bank configuration. [Figure 6] FIG. 10 is a diagram showing a processing flow of a program update according to the first embodiment in a double-bank configuration. [Figure 7] FIG. 10 is a diagram showing a processing flow of a boot loader program according to a second embodiment in a double-bank configuration. [Figure 8] FIG. 10 is a diagram showing a processing flow of a program update according to the second embodiment in a double-bank configuration. [Figure 9] FIG. 11 is a diagram showing a processing flow of a boot loader program according to a third embodiment in a double-bank configuration. [Figure 10] FIG. 10 is a diagram showing a processing flow of program update according to the third embodiment in a double-bank configuration. [Figure 11] FIG. 10 is a diagram showing the processing flow of a boot loader program according to a fourth embodiment in a double-bank configuration. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, embodiments of the present invention will be described in detail using examples with reference to the drawings.

[0012] First, we will explain the hardware configuration of the information processing device 1 according to the present invention. The information processing device 1 includes a ROM (Read Only Memory) 12, which is a storage device that can read data, a RAM (Random Access Memory) 13 that can both write and read data, a CPU (Central Processing Unit) 11 that calculates parameters necessary for vehicle control based on the data, and a communication module 10 that converts the calculation results into a communication protocol and transmits the converted results.

[0013] The information processing device 1 is, for example, a device that is mounted on a vehicle and controls the vehicle. However, the information processing device 1 may not be mounted on a vehicle, and may be a device that controls an object other than a vehicle.

[0014] The information processing device 1 is connected to an update program management server 3 and a program verification execution module 4 via a communication path 2. The communication path 2 may physically include multiple communication buses, and the standards of each communication bus may be the same or different. These communication bus standards include CAN (registered trademark), LIN (registered trademark), FlexRay (registered trademark), Ethernet (registered trademark), etc.

[0015] The update program management server 3 transmits an update program to the information processing device 1 in response to a request from the information processing device 1 or when a need arises to update the control program. The program verification execution module 4 verifies the signature of the control program in response to a request from the boot loader program in the information processing device 1 and transmits the result to the information processing device 1. Program Verification Execution Module 4 It is composed of, for example, an HSM (hardware cryptographic module), which is a device certified according to international standards that define the characteristics that cryptographic processing and key management devices should have.

[0016] The information processing device 1 receives data that has passed through the communication channel 2. Then, in response to reception, the received data is expanded in the RAM 13. Then, the CPU 11 performs calculations based on the written data in the RAM 13 and the read data from the ROM 12. In addition, a program is pre-installed in the information processing device 1, and the CPU 11 executes the program to enable the processing described in the following embodiments to be performed.

[0017] 2A and 2B are functional block diagrams showing the functional configuration of programs stored in the ROM 12 according to an embodiment of the present invention. Fig. 2A shows a single-bank configuration with one program storage area, while Fig. 2B shows a double-bank configuration with two program storage areas.

[0018] 2(a), the ROM 12 having a single bank configuration has a control program 121 and a boot loader program 122. The control program 121 is a program for implementing functions installed in the information processing device 1, such as, but not limited to, an OS (Operating System). The boot loader program 122 is a program for executing a secure boot process that verifies the signature of the control program 121 when the information processing device 1 is started up and determines whether the control program 121 has been tampered with.

[0019] The control program 121 stored in the single-bank ROM 12 has a program reception function 121a, a program deployment function 121b, and a reset function 121c. The program reception function 121a receives an update program from the update program management server 3. The program deployment function 121b deploys the received program in bank 0. The reset function 121c makes the program executable after receiving and deploying the update program.

[0020] The boot loader program 122 has a signature method confirmation function 122a, a signature verification function 122b, a program control function 122c, and a cryptographic algorithm storage function 122d. The signature method confirmation function 122a can confirm the signature method of the control program 121. The signature verification function 122b can verify the signature of the control program 121. The program control function 122c executes and deletes the control program 121. The cryptographic algorithm storage function 122d can store multiple cryptographic algorithms.

[0021] The encryption algorithms used are symmetric key encryption methods such as AES and triple DES, and public key encryption methods such as RSA and elliptic curve encryption. methodFurthermore, although signature verification will be described as an example in this specification, the present invention can also be suitably applied to MAC (Message Authentication Code) verification.

[0022] FIG. 2(b) shows the program configuration of the ROM 12 with a double bank configuration. The ROM 12 with a double bank configuration differs from the ROM 12 with a single bank configuration in that it has two areas, bank 0 and bank 1, for storing programs, and in that it has a bank switching / reset function 121d. The bank switching / reset function 121d switches between bank 0 and bank 1 to execute the control program 121 stored therein. The differences in processing and effects between the single bank configuration and the double bank configuration will be described in detail later.

[0023] <Example of single bank configuration> 3 and 4 are flowcharts explaining the processing performed when the single-bank ROM 12 shown in Fig. 2(a) is used. Note that the following explanation assumes that Program 1 of Signature Method A is stored as the control program in Bank 0 at the start of processing, including when a double-bank configuration is used.

[0024] First, a description will be given of FIG. 3, which shows the secure boot process executed when the information processing device 1 is started. In step S301, the boot loader program 122 in bank 0 is started in response to a command from the CPU 11. Then, in step S302, the signature method of program 1 is confirmed by the signature method confirmation function 122a. A known technique can be used for this signature method confirmation method, so a description thereof will be omitted. Then, in step S303, the signature verification function 122b applies signature method A to program 1 to perform signature verification. Note that this signature verification process may be executed by the program verification execution module 4 shown in FIG. 1 and the result thereof may be received, or may be executed by the boot loader program 122 itself.

[0025] Then, in step S304, the signature verification function 122b determines whether the signature verification has been successful. It was determined that If the signature verification is successful, the program 1 may have been tampered with and the process is terminated. It was determined that If so, in step S305, the program control function 122c starts the execution of program 1.

[0026] As described above, in this embodiment, it is possible to prepare multiple encryption algorithms required for secure boot by providing the encryption algorithm storage function 122d to the boot loader program 122. Therefore, if a certain encryption algorithm is compromised, it is possible to easily switch to another encryption algorithm without replacing the device itself.

[0027] 4 is a flowchart showing the update process when it becomes necessary to update the program 1. The need to update the program occurs, for example, when a function is added to the program, when a patch is applied to fix a bug, when a vulnerability is discovered in the program, etc.

[0028] First, in step S401, the program control function 122c of the boot loader program 122 stops the reading of program 1, making bank 0 rewritable. Then, in step S402, the program reception function 121a receives update program 2 from the update program management server 3, and the program deployment function 121b deploys it on bank 0. Note that the signature method for program 2 can be signature method A or any other signature method stored in the encryption algorithm storage function 122d. The program can be received, for example, by an OTA (Over The Air) method.

[0029] In step S403, the boot loader program 122 is started again and the signature verification is performed using the corresponding signature method. In step S404, it is determined whether the verification is successful or not. If the verification is unsuccessful, It was determined thatIf the verification is successful, the process ends. It was determined that If so, in step S405, the reset function 121c resets bank 0 to an executable state. Then, in step S406, the boot loader program 122 is started again, and if the signature verification passes, the program control function 122c starts the execution of program 2.

[0030] As described above, since multiple cryptographic algorithms can be applied even when updating a program, if, for example, signature scheme A is compromised and a program update becomes necessary, another signature scheme that has not been compromised can be applied, thereby ensuring security.

[0031] <Example 1 of double bank configuration> Next, a process when the ROM 12 having the double bank configuration shown in Fig. 2(b) is employed will be described with reference to Fig. 5 to Fig. 11. Fig. 5 is a flowchart showing a secure boot process executed when the information processing device 1 having the ROM 12 having the double bank configuration is started up.

[0032] In this case, steps S301 to S305 are the same as those in the single-bank configuration, and therefore a description thereof will be omitted. When the double-bank configuration is adopted, steps S501 and S502 are added.

[0033] After execution of program 1 is started in step S305, in step S501, the program control function 122c of bank 0 determines whether or not there is program data in the buffer (the area where the program is loaded) of bank 1. If there is program data, then in step S502, the program data is deleted. Note that this deletion process does not necessarily have to be performed.

[0034] Next, the update process when the need to update program 1 arises will be described with reference to Fig. 6. In this embodiment, the boot loader program 122 cannot be rewritten, and the control program 121 can be rewritten only when the control program 121 or boot loader program 122 in the other bank is being executed.

[0035] First, in step S601, the program receiving function 121a of bank 0 receives the update program 2 from the update program management server 3. In step S602, the program expanding function 121b expands the program 2 in the buffer of bank 1. Note that in this embodiment as well, in addition to signature method A, other signature methods stored in the cryptographic algorithm storage function 122d can be adopted as the signature method for program 2.

[0036] In step S603, the boot loader program 122 is started again and the signature verification is performed using the corresponding signature method. In step S604, it is determined whether the verification is successful or not. If the verification is unsuccessful, It was determined that If the verification is successful, the process ends. It was determined that If so, in steps S605 and S606, the bank switching / reset function 121d issues a switching command to switch the operating area from bank 0 to bank 1, and further resets bank 1 to make it executable. Then, in step S607, the program control function 122c starts the execution of program 2.

[0037] In this embodiment, as in the case of a single bank configuration, multiple cryptographic algorithms can be applied even during program updates, so that if, for example, signature method A is compromised and a program update becomes necessary, another signature method that has not been compromised can be applied, thereby ensuring security.

[0038] Furthermore, by adopting a double-bank configuration, it is possible to make the OTA mechanism used when receiving update programs more robust, and by leaving the data in Bank 0 as is, it is possible to perform a rollback process that returns the operating area from Bank 1 to Bank 0. Furthermore, by making Program 2 for updating the same as Program 1, it is possible to ensure redundancy.

[0039] <Example 2 for double bank configuration> Next, a process executed by an information processing device 1 having a ROM 12 with a double bank configuration according to a second embodiment will be described with reference to Fig. 7 and Fig. 8. Note that, in the first embodiment, it is explained that it does not matter whether or not there is program data in bank 1 at the start of the process, but in the following embodiments, it is assumed that at the start of the process, program 1 of signature method A is stored in bank 0, and a program having signature method B different from signature method A and having the same content as program 1 is stored in bank 1.

[0040] 7 is a flowchart showing a secure boot process executed when an information processing device 1 having a ROM 12 with a double bank configuration according to the second embodiment is started. As shown in FIG. 7, in this embodiment, steps S501 and S502 are deleted from the secure boot process according to the first embodiment shown in FIG. 5. That is, in this embodiment, the same process as the secure boot process executed by an information processing device 1 having a ROM with a single bank configuration is executed. As described above, the program stored in bank 1 has the same content as program 1 but has a different signature scheme B. This makes it possible to immediately switch the operating area from bank 0 to bank 1 to ensure security when, for example, signature scheme A of program 1 is compromised but signature scheme B is not.

[0041] Next, the update process of program 1 stored in bank 0 will be described with reference to FIG.

[0042] In this embodiment, steps S601 to S607 shown in FIG. 6 are the same as the processes executed in the first embodiment.

[0043] In this embodiment, steps S801 to S805 are added to the steps in embodiment 1. After the processing related to program 2 in bank 1 is started in Fig. 6, in step S801, a new update program 3 is received by the program reception function 121a of the control program 121 in bank 1. This program 3 has the same content as program 2 stored in bank 1 but a different signature method.

[0044] In step S802, the program expansion function 121b expands program 3 into bank 0. In step S803, the signature verification function 122b verifies the signature of program 3. As described above, this signature is a signature method different from signature method B of program 2.

[0045] In step S804, it is determined whether the signature verification has been successful. It was determined that If the signature verification is successful, the process ends. It was determined that In this case, in the first embodiment, if the signature verification of the updated program is successful, the process proceeds to step S805. It was determined that In this case, the bank of the operating area was switched, but in this embodiment, as shown in step S805, the bank is not switched and execution of program 2 in bank 1 continues. As described above, program 3 has the same content as program 2 but a different signature method. Therefore, for example, if the signature method of program 2 has been compromised but the signature method of program 3 has not been compromised, by switching the operating area from bank 1 to bank 0, it becomes possible to perform the same processing as program 2 while ensuring security.

[0046] <Double bank example 3> Next, a process executed by the information processing device 1 having the ROM 12 with a double bank configuration according to the third embodiment will be described with reference to FIGS.

[0047] 9 is a flowchart showing a secure boot process executed when starting up an information processing device 1 having a double-bank ROM 12 according to the third embodiment. As shown in Fig. 9, in this embodiment, steps S901 and S902 are added to the secure boot process according to the second embodiment shown in Fig. 7.

[0048] In this embodiment, after execution of program 1 is started in step S305, the signature method verification function 122a of the boot loader program 122 further verifies the generation of signature method A of program 1 in bank 0 and the generation of signature method B of the program stored in bank 1.

[0049] Here, we will explain the generations of signature schemes. As mentioned above, RSA encryption and elliptic curve encryption are often used as encryption methods for secure boot. However, it has been found that these encryption methods will be easily decrypted when quantum computers are realized. For this reason, efforts are being made to put quantum-resistant encryption methods that cannot be easily decrypted even using quantum computers (e.g., lattice encryption). In this case, the generation of lattice encryption is said to be newer than the generations of RSA encryption and elliptic curve encryption. In this way, if a technology that can decrypt encryption of a certain generation A is realized, and an encryption method that cannot be easily decrypted even using that technology is realized in the next generation B, generation B is defined as newer than generation A. In other words, signature schemes of older generations are more likely to be compromised than signature schemes of newer generations, or have already been compromised.

[0050] Therefore, in step S901, the generation of signature method B for program 2 in bank 1 is checked, and if that generation is older than signature method A, it is highly likely that the program has already been compromised, resulting in a security vulnerability. Therefore, if the generation of signature method B is older than the generation of signature method A, the process proceeds to step S902, and program 2 is deleted.

[0051] Next, the program update process in this embodiment will be described with reference to Fig. 10. Steps S1001 to S1007, which are processes that take into account the generation of the signature method, have been added to the program update process in this embodiment. These added processes will be described below.

[0052] Program to bank 1 in step S602 2 After expanding the signature scheme, in step S1001, the generation of signature scheme B is confirmed by the signature scheme confirmation function 122a of bank 0. If the generation of signature scheme B is older than signature scheme A of program 1, in step S1004, program 2 is deleted for the same reason as above, and the process ends.

[0053] If the generation of signature method B is newer than or the same as the generation of signature method A, in steps S1002 and S1003, signature verification of program 2 is performed by signature verification function 122b. Subsequent steps S605 to S802 are the same as in the second embodiment.

[0054] After program 3 is expanded again in bank 0 in step S802, the generation of signature method C of program 3 is compared with the generation of signature method B of program 2 in step S1005. If the generation of signature method C is older than the generation of signature method B, program 3 is deleted in step S1007, and execution of program 2 continues in step S805.

[0055] If the generation of signature method C is newer than or the same as the generation of signature method B, signature verification of program 3 is performed using signature method C by signature verification function 122b of boot loader program 122 in bank 0 in step S1006.

[0056] In step S804, the signature verification fails. It was determined that If the signature verification is successful, the process ends. It was determined that If so, the process proceeds to step S805, and execution of program 2 in bank 1 continues.

[0057] As described above, according to this embodiment, program updates are performed taking into consideration the generation of the signature scheme, thereby eliminating the risk of executing a program that uses a signature scheme that has already been compromised.

[0058] <Double bank example 4> Finally, a process executed by the information processing device 1 having the ROM 12 with a double bank configuration according to the fourth embodiment will be described with reference to Fig. 11. In this embodiment, the process of updating a program is the same as in the second or third embodiment, but the secure boot process when starting up the information processing device 1 is different.

[0059] FIG. 11 shows an example 4 11 is a flowchart showing a secure boot process executed when starting up the information processing device 1 having the double-bank ROM 12 according to the second embodiment. As shown in FIG. 11, in this embodiment, step S1101 is added to the secure boot process according to the second embodiment shown in FIG.

[0060] In this embodiment, after the boot loader in bank 0 is started, the program control function 122c compares the version of program 1 stored in bank 0 with the version of the program stored in bank 1. If the version of program 1 stored in bank 0 is older than the version of the program stored in bank 1, the subsequent processing is not performed, and only if the version of program 1 stored in bank 0 is newer than or the same as the version of the program stored in bank 1, the process proceeds to step S302 and signature verification of program 1 stored in bank 0 is performed. The subsequent processing is the same as in the above embodiment.

[0061] According to this embodiment, it is possible to prevent the execution of a control program that is an old version and has a vulnerability problem, for example.

[0062] According to the embodiment of the present invention described above, the following advantageous effects are achieved. (1) An information processing device according to one embodiment of the present invention has an arithmetic unit that performs arithmetic processing of a program, and a memory unit that stores a first control program and a first startup program that performs signature verification of the first control program, wherein the first startup program is capable of executing multiple signature verification methods, determines a signature verification method corresponding to the signature type of the first control program from the multiple signature verification methods, and executes a process of obtaining the results of performing signature verification using the signature verification method. With the above configuration, if the encryption algorithm for secure boot is compromised, it is possible to easily switch to another encryption algorithm, thereby ensuring security.

[0063] (2) The storage unit has a first storage area for storing a first control program and a first boot program, and a second storage area for storing a second control program having a different signature type from that of the first control program, and a second boot program capable of implementing multiple signature verification methods and performing signature verification using a signature verification method corresponding to the signature type of the second control program from among the multiple signature verification methods. This makes it possible to make the OTA mechanism used when receiving an update program more robust, and by leaving the data in bank 0 as is, it becomes possible to perform a rollback process that returns the operating area from bank 1 to bank 0. Furthermore, by making update program 2 the same as program 1, redundancy can be ensured.

[0064] (3) Signature verification is performed by the first startup program, which allows for easy signature verification without the need for additional equipment such as an HSM.

[0065] (4) After the second control program is stored in the second storage area, the storage area to be executed is switched from the first storage area to the second storage area, and the first storage area stores a third control program that is the same as the second control program but has a different type of signature from the signature of the second control program, thereby ensuring redundancy between the second control program and the third control program.

[0066] (5) The priority of the signature of the first control program and the signature of the second control program is compared, and the control program with the signature with the lower priority is deleted. This makes it possible to compare the generations and versions of the control programs, and to prevent security vulnerabilities from occurring when a program with an older generation or version, a compromised signature method, or a vulnerable program is executed.

[0067] (6) When receiving the second control program, the first priority of the signature of the first control program is compared with the second priority of the signature of the second control program, and the second control program is stored in the second storage area only if the first priority is lower than the second priority or if the first priority and the second priority are the same. This prevents the risk of security vulnerabilities occurring when a program with a compromised signature method is executed, as in (5).

[0068] (7) When receiving the second control program, the first software version information of the first control program and the second software version information of the second control program are compared, and the second control program is stored in the second storage area only if the first software version information is older than the second software version information. This prevents the risk of security vulnerabilities occurring when a vulnerable program is executed, as in (5).

[0069] (8) The first boot program and the second boot program are not rewritable, the first control program is rewritable only when the second boot program or the second control program is being executed, and the second control program is rewritable only when the first boot program or the first control program is being executed. This prevents access to banks that are not active areas except when rewriting, eliminating the risk of erroneous data writing.

[0070] (9) When receiving the third control program, the second priority of the signature verification method for the second control program is compared with the third priority of the signature verification method for the third control program, and the third control program is stored in the first storage area only if the second priority is lower or if the second priority and the third priority are the same. This achieves the same effect as (5).

[0071] (10) When deleting a control program, the first startup program deletes the second control program, and the second startup program deletes the first control program. This makes it possible to reduce memory capacity.

[0072] The present invention is not limited to the above-described embodiments, and various modifications are possible. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to embodiments including all of the described configurations. Furthermore, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment. It is also possible to add the configuration of another embodiment to the configuration of one embodiment. It is also possible to delete part of the configuration of each embodiment, or to add or replace other configurations. [Explanation of symbols]

[0073] 1 Information processing device, 11 CPU (arithmetic unit), 12 ROM (storage unit), 121 Control program, 122 Boot loader program (startup program)

Claims

1. a calculation unit that performs calculation processing of the program; a storage unit that stores a first control program and a first startup program that executes signature verification of the first control program; the first startup program is capable of executing a plurality of signature verification methods, determines a signature verification method corresponding to a signature type of the first control program from the plurality of signature verification methods, and executes a process of acquiring a result of signature verification executed using the signature verification method; The storage unit a first storage area for storing the first control program and the first startup program; a second storage area for storing a second control program having a signature type different from that of the first control program, and a second startup program capable of executing the plurality of signature verification methods and executing signature verification using the signature verification method corresponding to the signature type of the second control program from the plurality of signature verification methods; 1. An information processing device comprising:

2. 2. The information processing device according to claim 1, the signature verification is performed by the first startup program; 1. An information processing device comprising:

3. 2. The information processing device according to claim 1, After the second control program is stored in the second storage area, the storage area to be executed is switched from the first storage area to the second storage area; An information processing apparatus characterized in that the first storage area stores a third control program that is the same control program as the second control program but has a different type of signature from the signature of the second control program.

4. 2. The information processing device according to claim 1, comparing the priorities of the signature of the first control program and the signature of the second control program, and deleting the control program having the signature with the lower priority; 1. An information processing device comprising:

5. 2. The information processing device according to claim 1, when receiving the second control program, comparing a first priority of the signature of the first control program with a second priority of the signature of the second control program, and storing the second control program in the second storage area only when the first priority is lower than the second priority or when the first priority and the second priority are the same; 1. An information processing device comprising:

6. 2. The information processing device according to claim 1, when receiving the second control program, comparing first software version information of the first control program with second software version information of the second control program, and storing the second control program in the second storage area only if the first software version information is older than the second software version information; 1. An information processing device comprising:

7. 2. The information processing device according to claim 1, The first boot program and the second boot program are non-rewritable, the first control program is rewritable only when the second startup program or the second control program is being executed, the second control program is rewritable only when the first startup program or the first control program is being executed; 1. An information processing device comprising:

8. 5. The information processing device according to claim 4, when receiving a third control program, comparing the second priority of the signature verification method of the second control program with the third priority of the signature verification method of the third control program, and storing the third control program in the first storage area only when the second priority is lower than the third priority or when the second priority and the third priority are the same; 1. An information processing device comprising:

9. 5. The information processing device according to claim 4, The deletion of the control program is performed by: The first startup program deletes the second control program, The second startup program deletes the first control program.

1. An information processing device comprising:

Images