Information processing device, information processing method, and program

Abstract

To provide an information processing apparatus which can verify integrity and authenticity of a file at and after system start-up.SOLUTION: An information processing apparatus includes: means for setting, at system start-up, a storage area of a first file system as a verification target area for verifying integrity and authenticity and setting, after system start-up, a storage area of a second file system as a verification target area; means for confirming, at system start-up, a compressed file using authentication data and the compressed file stored in the storage area of the first file system; and means for decompressing the compressed file that has been confirmed successfully, and developing the file and the authentication data in the storage area of the second file system. The confirming means confirms integrity and authenticity of the file, after the storage area of the second file system is set as a verification target area, using the file and the authentication data stored in the storage area of the second file system.SELECTED DRAWING: Figure 2

Description

Technical Field

[0001] The present invention relates to an information processing apparatus, an information processing method, and a program.

Background Art

[0002] In recent years, in information processing apparatuses, there has been known a technique (such as Linux (registered trademark)-IMA) for detecting unauthorized tampering with files (firmware, software) constituting a system and ensuring integrity and authenticity by allowing only legitimate files to be executed.

[0003] Linux-IMA stores authentication data such as an expected value of a hash value (measurement value) and an electronic signature for a target file in advance, and checks integrity and authenticity by comparing and verifying with the expected value and the electronic signature, thereby performing confirmation of integrity and authenticity on a file-by-file basis.

[0004] There has been described a technique for shortening the processing time for verifying the integrity and authenticity of a file by setting a verification target area for verifying integrity and authenticity and a non-verification target area not subject to verification of integrity and authenticity, expanding a compressed file verified for integrity and authenticity in the verification target area, and arranging it in the non-verification target area (see, for example, Patent Document 1).

Summary of the Invention

Problems to be Solved by the Invention

[0005] In a technique for ensuring integrity and authenticity by allowing only legitimate files to be executed at system startup, if it is possible to detect that a file has been rewritten after system startup, the integrity and authenticity of the file can be ensured even after system startup. An embodiment of the present invention aims to provide an information processing apparatus capable of verifying the integrity and authenticity of files at system startup and after system startup.

Means for Solving the Problems

[0006] To achieve the above-mentioned objectives, the information processing device of claim 1 of the present application includes: a verification setting change means that sets the storage area of ​​a first file system as a verification target area for verifying integrity and authenticity when the system starts up, and sets the storage area of ​​a second file system as the verification target area after the system starts up; a signature verification means that verifies the integrity and authenticity of a compressed file at system startup using the compressed file stored in the storage area of ​​the first file system and the authentication data of the compressed file; and an expansion / decompression means that decompresses the compressed file that has been successfully verified and expands the expanded file and the authentication data of the file into the storage area of ​​the second file system, wherein the signature verification means verifies the integrity and authenticity of a file using the file stored in the storage area of ​​the second file system and the authentication data of the file after the storage area of ​​the second file system has been set as the verification target area by the verification setting change means. [Effects of the Invention]

[0007] According to embodiments of the present invention, the integrity and authenticity of files can be verified during and after system startup. [Brief explanation of the drawing]

[0008] [Figure 1] This is a hardware configuration diagram of an example of an information processing device according to the embodiment. [Figure 2] This is a software configuration diagram of an example of an information processing device according to this embodiment. [Figure 3] This diagram illustrates an example of the processing image during a system update according to this embodiment. [Figure 4] This diagram illustrates an example of the processing image during and after system startup according to this embodiment. [Figure 5] This is a diagram illustrating an example of an IMA policy file configuration that defines the verification target area by file system. [Figure 6]This diagram illustrates an example of switching between signature verification modes during system startup and system operation of the information processing device according to this embodiment. [Figure 7] This is a sequence diagram of an example of the process for creating a system update file during a system update according to this embodiment. [Figure 8] This is a sequence diagram of an example of the processing during system startup and system operation according to this embodiment. [Figure 9] This is a sequence diagram of an example of the processing during system startup and system operation according to this embodiment. [Figure 10] This is an activity diagram of an example of a launched application. [Figure 11] This is an activity diagram of an example of a verification settings change application. [Figure 12] This is an activity diagram of an example signature verification application. [Figure 13] This is an activity diagram of an example of an expand / contract application. [Figure 14] This is an activity diagram of an example error notification application. [Figure 15] This diagram illustrates an example of switching between signature verification modes during system startup and system operation of the information processing device according to this embodiment. [Figure 16] This diagram illustrates an example of the processing image during and after system startup according to this embodiment. [Figure 17] This is a diagram illustrating an example of an IMA policy file that sets the verification target area using a UUID. [Figure 18] This is a hardware configuration diagram of an example PC. [Figure 19] This is a hardware configuration diagram of an example MFP. [Modes for carrying out the invention]

[0009] Hereinafter, embodiments will be described with reference to the accompanying drawings. To facilitate understanding of the description, the same reference numerals are used for the same components in each drawing as much as possible, and redundant descriptions are omitted.

[0010] [First Embodiment] <Hardware Configuration> FIG. 1 is a hardware configuration diagram of an example of an information processing apparatus according to an embodiment. The information processing apparatus 1 in FIG. 1 includes a controller 2, an external memory 3, a storage 4 for system startup, and an operation unit 5. The information processing apparatus 1 is communicably connected to a network server 6 via a network line such as the Internet.

[0011] The controller 2 controls the overall operation of the information processing apparatus 1. The controller 2 guarantees the integrity and authenticity of a file by performing signature verification on files (such as firmware and software) that constitute the system

[0012] The controller 2 includes a CPU (Central Processing Unit) 21, a ROM (Read Only Memory) 22, and a RAM (Random Access Memory) 23. The CPU 21 controls the operation of the entire information processing apparatus 1. The ROM 22 stores programs used for driving the CPU 21, such as the CPU 21 and IPL (Initial Program Loader). The RAM 23 is used as a work area for the CPU 21.

[0013] The external memory 3 is, for example, an SD card or the like, and stores a system update file (compressed file) for newly writing to the system startup storage 4. The system update file may also be called a ROM update file. The system startup storage 4 is, for example, an eMMC (embedded Multi Media Card) or the like. The system startup storage 4 stores files (firmware, software) that constitute the system. The operation unit 5 has an input unit and an output unit, receives a user's operation from the input unit, and performs outputs such as display from the output unit.

[0014] The network server 6 stores a system update file for newly writing to the system startup storage 4.

[0015] <Software Configuration> FIG. 2 is a software configuration diagram of an example of the information processing apparatus according to the present embodiment. The network server 6 shown in FIG. 2 includes a system update file 60, an update file creation application 62, a compression application 64, a signature creation application 66, a signature verification private key 68, and an OS 70.

[0016] The OS 70 controls the entire network server 6. The system update file 60 is a system update file for newly writing to the system startup storage 4 of the information processing apparatus 1.

[0017] When the signature creation application 66 is executed on the network server 6, it functions as a signature creation unit. The signature creation unit creates an electronic signature (authentication data) for each application stored in the system update file. The signature verification private key 68 is private key data used for creating the signature of the application.

[0018] The update file creation application 62 functions as an update file creation unit when executed on the network server 6. The compression application 64 functions as a compression unit when executed on the network server 6. The update file creation unit and the compression unit create a system update file 60 using the applications to be saved in the system update file and authentication data for each application.

[0019] The information processing device 1 shown in Figure 2 includes a system update file 30, a signature verification setting file 32, a signature for the system update file 34, a private key for signature verification 36, a public key for signature verification 38, a signature creation application 40, a startup application 42, an expansion application 44, a signature verification application 46, an error notification application 48, "Application 1" 50, "Application 2" 52, a verification setting change application 54, and an OS 56.

[0020] The OS56 of the information processing device 1 controls the entire information processing device 1. The system update file 30 is a system update file to be written to the new system boot storage 4. The signature verification setting file 32 sets the verification target area for verifying integrity and authenticity as described below. The signature for the system update file 34 is authentication data used to verify the signature of the system update file 30. The private key for signature verification 36 is private key data used when creating the signature for the signature for the system update file signature 34. The public key for signature verification 38 is private key data used when verifying the signature. The signature creation application 40 functions as a signature creation unit when executed by the information processing device 1. The signature creation unit creates the authentication data for the system update file 30.

[0021] The startup application 42 functions as a startup unit when executed by the information processing device 1. The startup unit starts the files (firmware, software) that make up the system. For example, if the startup unit succeeds in signature verification using authentication data, it starts "Application 1" 50 or "Application 2" 52 stored in the verification target area.

[0022] The signature verification application 46 functions as a signature verification unit when executed on the information processing device 1. The signature verification unit verifies signatures using the authentication data in the system update file 30 when the system starts up. After the system starts up, the signature verification unit also verifies signatures using the authentication data when launching "App 1" 50 or "App 2" 52, which were stored in the system update file 30.

[0023] The decompression application 44 functions as a decompression unit when executed on the information processing device 1. If signature verification is successful, the decompression unit decompresses the system update file 30 and extracts it onto RAM 23.

[0024] The error notification application 48 functions as an error notification unit when executed on the information processing device 1. The error notification unit notifies the user of an error if signature verification by the signature verification unit fails. The verification setting change application 54 functions as a verification setting change unit when executed on the information processing device 1. The verification setting change unit sets the storage area of ​​the first file system as the area to be verified when the system starts up, and sets the storage area of ​​the second file system as the area to be verified after the system starts up.

[0025] The signature creation application 40 and the signature verification application 46 are implemented, for example, by Linux-IMA. The information processing device 1 may also perform tamper detection on the firmware used during system startup (e.g., BIOS and boot loader) using, for example, Trusted Boot.

[0026] For example, the information processing device 1 in Figure 2 uses the CPU 21 shown in Figure 1 as a work area and executes processing according to the program to realize the signature creation unit, startup unit, decompression unit, signature verification unit, error notification unit, verification setting change unit, and OS 56.

[0027] <Processing or operation of the embodiment> The processing or operation of each embodiment will be described below. Figure 3 is a diagram illustrating an example of the processing image during a system update according to this embodiment.

[0028] In step S1, the network server 6 creates authentication data for each file of one or more applications 100 to be updated, and stores the authentication data in the metadata area of ​​each file. The authentication data can be created by performing a hash operation on the files of one or more applications 100 and encrypting the resulting value with the signature verification secret key 68.

[0029] In step S2, the network server 6 compresses the entire application 102, which has authentication data stored in the metadata area, to create a single system update file 60. The process of creating the system update file 60 may also be performed by the information processing device 1. The system update file 60 is stored in the external memory 3 of the information processing device 1.

[0030] During a system (ROM) update, the information processing device 1 saves the system update file 60 stored in the external memory 3 as the system update file 30 to the system boot storage 4. In step S3, the information processing device 1 creates a partition (storage area) in the storage area of ​​the system boot storage 4, formatted, for example, with "file system 1".

[0031] In step S4, the information processing device 1 saves the system update file 30 to the partition of "file system 1". In step S5, the information processing device 1 creates authentication data for the system update file 30 and saves the authentication data to the metadata area of ​​the system update file 30. The authentication data can be created by performing a hash operation on the system update file 30 and encrypting the resulting value with the signature verification secret key 36.

[0032] Figure 4 is a diagram illustrating an example of the processing image during and after system startup according to this embodiment.

[0033] In step S6, the information processing device 1 sets the partition of "file system 1" as "verification target area 1" to be checked for integrity and authenticity. In Linux-IMA, for example, the file system of the verification target area is set in an IMA policy file as shown in Figure 5. A partition formatted with the file system set as the verification target area in the IMA policy file in Figure 5 becomes a verification target area partition. Figure 5 is a diagram showing an example of an IMA policy file that sets the verification target area by file system. As a result of the process in step S6, the partition of the system boot storage 4 where the system update file 30 is stored becomes a verification target area.

[0034] In step S7, the information processing device 1 performs signature verification using the system update file 30 stored in the partition of the area to be verified and the authentication data stored in the metadata area of ​​the system update file 30. Specifically, the information processing device 1 performs signature verification by comparing the value obtained by decrypting the authentication data stored in the metadata area using the signature verification public key 38B with the value generated by performing a hash operation on the system update file 30.

[0035] If signature verification is successful, the information processing device 1 expands the system update file 16 in step S8 and obtains the entire application 102. The information processing device 1 mounts the entire application 102 to a partition (loopback device) formatted with "filesystem 2" on the system boot storage 4 and expands it onto RAM 23. A loopback device is a function that allows general files to be treated as if they were block-type devices such as hard disks. With a loopback device, by mounting an image file, individual files within the image file can be operated on in the same way as normal files.

[0036] If signature verification fails, the information processing device 1 detects the system update file 30 as an invalid file in step S9 and notifies the user of the error.

[0037] After the system starts up, the information processing device 1 monitors the usage rate of the CPU 21, and if the usage rate of the CPU 21 falls below a set threshold (for example, if the usage rate of the CPU 21 falls below 10%), it performs the process in step S10.

[0038] In step S10, the information processing device 1 sets the partition of "File System 2" as "Verification Target Area 2" to verify its integrity and authenticity. In Linux-IMA, for example, "File System 2" is set as the verification target area in the IMA policy file shown in Figure 5. For example, a partition formatted with "File System 2" becomes the partition of "Verification Target Area 2".

[0039] As a result of the process in step S10, the partition of the system boot storage 4 where the entire application 102 is stored becomes "Verification Area 2".

[0040] In step S11, the information processing device 1 performs signature verification on one or more application files 100 included in the entire application 102 stored in the partition of "Verification Target Area 2", and on the authentication data stored in the metadata area of ​​each file. Specifically, the information processing device 1 performs signature verification by comparing the value obtained by decrypting the authentication data stored in the metadata area using the signature verification public key 38A with the value generated by performing a hash operation on each file.

[0041] If signature verification is successful, the information processing device 1 performs the process in step S12. In step S12, the information processing device 1 performs file access on the file whose signature verification was successful.

[0042] If signature verification fails, the information processing device 1 performs the process in step S13. In step S13, the information processing device 1 detects the file that failed signature verification as a malicious file and notifies the user of the error. Alternatively, if signature verification fails, the information processing device 1 may shut down the system.

[0043] In this embodiment, the integrity and authenticity of files stored in the system boot storage 4 can be verified at and after system startup. Furthermore, in this embodiment, a system update file 30, which is a compressed version of the entire application 102, is stored in the "verification target area 1" of the system boot storage 4. This reduces the number of files whose integrity and authenticity are verified at system startup (number of files to verify), thereby reducing the processing load at system startup.

[0044] Figure 6 is a diagram illustrating an example of the mode switching for signature verification during system startup and system operation of the information processing device according to this embodiment. System operation refers to the period after system startup.

[0045] In Figure 6, the information processing device 1 performs signature verification in the "file system 1" area when the system starts up. When the system is running, the information processing device 1 monitors the usage rate of the CPU 21, and performs signature verification in the "file system 2" area when the CPU 21 usage rate falls below a set threshold.

[0046] Thus, the information processing device 1 according to this embodiment switches the file system to be verified for signature verification at a time when the system is running (after system startup) and does not affect the startup time.

[0047] Figure 7 is a sequence diagram of an example of the process for creating a system update file during a system update according to this embodiment.

[0048] Network server 6 digitally signs (authenticates) one or more application files 100 to be updated. The process in step S21 is repeated until the data is created. In step S21, the update file creation application 62 of the network server 6 causes the signature creation application 66 to create digital signatures for one or more applications 100 to be updated. The update file creation application 62 saves the digital signatures in the metadata area of ​​each file.

[0049] In step S22, the update file creation application 62 compresses the entire application 102, which has its digital signature stored in the metadata area, into the compression application 64, thereby creating a single system update file 60. The process in step S22 is the process of creating an image file for mounting on the "file system 2".

[0050] Figures 8 and 9 are sequence diagrams showing an example of the processing during system startup and system operation according to this embodiment. In Figures 8 and 9, it is assumed that the integrity and authenticity of the verification setting change application 54, the signature verification application 46, and the error notification application 48 have been confirmed.

[0051] In step S31, the verification setting change application 54 of the information processing device 1 enables signature verification of "file system 1". In step S32, the startup application 42 causes the signature verification application 46 to perform signature verification of the system update file (compressed file).

[0052] If signature verification is successful, the startup application 42 requests the decompression application 44 to decompress the system update file (compressed file) in step S33. In step S34, the decompression application 44 decompresses the system update file (compressed file).

[0053] In step S35, the decompression application 44 mounts the entire application 102, which has its digital signature stored in the metadata area, to a loopback device formatted with "file system 2".

[0054] If signature verification fails, the startup application 42 detects the system update file (compressed file) as a malicious file and requests an error notification from the error notification application 48. The error notification application 48 then notifies the user of the error.

[0055] If signature verification is successful, the launch application 42 launches "App 1" 50 and "App 2" 52, which are included in the entire application 102 mounted on the loopback device, in steps S37 to S38.

[0056] After the system starts up, the verification configuration change application 54 monitors the usage of CPU 21, and if the usage of CPU 21 falls below a set threshold, it performs the process in step S39. In step S39, the verification configuration change application 54 enables signature verification of "file system 2".

[0057] Here, we will explain assuming that in step S40, a request for file access to "App 1" 50 was made. In step S41, "App 1" 50 requests signature verification of "App 1" 50 from signature verification app 46. If the signature verification is successful, file access to "App 1" 50 becomes possible in step S42. On the other hand, if the signature verification fails, "App 1" 50 requests an error notification from error notification app 48. Error notification app 48 notifies the user of the error.

[0058] If a request to access a file in "App 2" 52 is received, it will be processed in the same way as "App 1" 50. According to the sequence diagrams shown in Figures 8 and 9, the integrity and authenticity of files mounted on "File System 2" can be verified while the system is running.

[0059] Figure 10 is an activity diagram of an example of a startup application. In step S50, the startup application 42 has the signature verification application perform signature verification of the system update file (compressed file).

[0060] If signature verification is successful, the startup application 42 instructs the decompression application 44 to decompress the system update file (compressed file) in step S52. If signature verification fails, the startup application 42 instructs the error notification application 48 to send an error notification in step S54.

[0061] Figure 11 is an activity diagram of an example of a verification configuration change application. In step S60, the verification configuration change application 54 rewrites the signature verification configuration file 32 to enable signature verification of "file system 1" at system startup. After system startup, the verification configuration change application 54 monitors the CPU usage rate of 21 and repeats the process in step S60 until the CPU usage rate of 21 falls below a set threshold. When the CPU usage rate of 21 falls below the set threshold, the verification configuration change application 54 rewrites the signature verification configuration file 32 in step S62 to enable signature verification of "file system 2" while the system is running.

[0062] Figure 12 is an activity diagram of an example signature verification application. In step S70, the signature verification application 46 performs a hash operation on the system update file. In step S72, the signature verification application 46 decrypts the digital signature (system update signature) stored in the metadata area of ​​the system update file using the signature verification public key 38B.

[0063] In step S74, the signature verification application 46 performs signature verification by comparing and verifying whether the hash calculation result of the system update file matches the result of decrypting the system update signature.

[0064] If signature verification is successful, the signature verification application 46 sends the success result to the launch application 42 in step S76. If signature verification fails, the signature verification application 46 sends the failure result to the launch application 42 in step S78.

[0065] Figure 13 is an activity diagram of an example of a decompression application. In step S80, the decompression application 44 decompresses the system update file. In step S82, the decompression application 44 mounts the decompressed file (entire application 102) on "file system 2" using a loopback device and extracts it onto RAM 23.

[0066] Figure 14 is an activity diagram of an example of an error notification application. In step S90, the error notification application 48 notifies the operation unit 5 of an error and causes the operation unit 5 to display an error message to allow the user to recognize the error.

[0067] Figure 15 is an example diagram illustrating the mode switching of signature verification during system startup and system operation of the information processing device according to this embodiment. In Figure 15, the information processing device 1 performs signature verification in the "file system 1" area when the system starts up. During system operation, the information processing device 1 monitors the number of file descriptors. The number of file descriptors is a number assigned to identify the target file when a program manipulates a file. When the number of file descriptors falls below a set threshold, the information processing device 1 performs signature verification in the "file system 2" area.

[0068] Thus, the information processing device 1 according to this embodiment switches the file system to be verified for signature verification at a time when the system is running (after system startup) and does not affect the startup time.

[0069] Figure 16 is a diagram illustrating an example of the processing image during and after system startup according to this embodiment. The processing in steps S100 to S103 is the same as in steps S6 to S9 in Figure 4.

[0070] After the system starts up, the information processing device 1 monitors the number of file descriptors. If the number of file descriptors falls below a set threshold (for example, if the number of file descriptors falls below 100), the information processing device 1 performs the process in step S104.

[0071] In step S104, the information processing device 1 sets the partition of "file system 2" as "verification target area 2" to verify its integrity and authenticity. The partition of the system boot storage 4 where the entire application 102 is stored becomes "verification target area 2".

[0072] In step S105, the information processing device 1 performs signature verification on one or more application files 100 included in the entire application 102 stored in the partition of "Verification Target Area 2", and on the authentication data stored in the metadata area of ​​each file. Specifically, the information processing device 1 performs signature verification by comparing the value obtained by decrypting the authentication data stored in the metadata area using the signature verification public key 38A with the value generated by performing a hash operation on each file.

[0073] If signature verification is successful, the information processing device 1 performs the process in step S106. In step S106, the information processing device 1 performs file access on the file whose signature verification was successful.

[0074] If signature verification fails, the information processing device 1 performs the process in step S107. In step S107, the information processing device 1 detects the file that failed signature verification as a malicious file and notifies the user of the error. Alternatively, if signature verification fails, the information processing device 1 may shut down the system.

[0075] In this embodiment, the integrity and authenticity of files stored in the system boot storage 4 can be verified at and after system startup. Furthermore, in this embodiment, a system update file 30, which is a compressed version of the entire application 102, is stored in the "verification target area 1" of the system boot storage 4. This reduces the number of files whose integrity and authenticity are verified at system startup (number of files to verify), thereby reducing the processing load at system startup.

[0076] While this example describes a file system for formatting a partition, similar settings are possible when configuring a file system such as squashfs, which compresses and decompresses directly into RAM23, as the file system for the area being verified for integrity and authenticity.

[0077] [Other embodiments] The IMA policy file in Figure 5 is just one example; for example, the partitions of the area to be verified may be defined by a unique ID (e.g., UUID) assigned to each partition, as in the IMA policy file in Figure 17.

[0078] The information processing device 1 according to this embodiment is not limited to the configuration illustrated in Figure 1, as long as it is a device equipped with a function to verify the integrity and authenticity of files at system startup, etc. The information processing device 1 may also be an embedded device.

[0079] The information processing device 1 may be an output device such as a PJ (Projector), IWB (Interactive White Board), or digital signage; a HUD (Head Up Display) device; industrial machinery; imaging devices; sound collection devices; medical equipment; networked home appliances; automobiles (Connected Car); notebook PCs (Personal Computers); mobile phones; smartphones; tablet devices; game consoles; PDAs (Personal Digital Assistants); digital cameras; wearable PCs; or desktop PCs.

[0080] For example, the information processing device 1 according to this embodiment may be either a PC600 or an MFP900 having the hardware configuration shown in Figure 18 or Figure 19.

[0081] Figure 18 is a hardware configuration diagram of an example PC. As shown in Figure 18, the PC600 is built by a computer and includes a CPU601, ROM602, RAM603, HD604, HDD (Hard Disk Drive) controller605, display606, external device connection I / F (Interface)608, network I / F609, data bus610, keyboard611, pointing device612, DVD-RW (Digital Versatile Disk Rewritable) drive614, and media I / F616.

[0082] The CPU 601 controls the overall operation of the PC 600. The ROM 602 stores programs used to drive the CPU 601, such as the IPL. The RAM 603 is used as the work area for the CPU 601. The HD 604 stores various data, such as programs. The HDD controller 605 controls the reading or writing of various data to the HD 604 according to the control of the CPU 601.

[0083] Display 606 displays various information such as cursors, menus, windows, characters, or images. External device connection I / F 608 is an interface for connecting various external devices. In this case, external devices include, for example, USB (Universal Serial Bus) memory and printers. Network I / F 609 is an interface for data communication using a communication network. Data bus 610 is an address bus and data bus for electrically connecting various components such as the CPU 601 in Figure 18.

[0084] The keyboard 611 is a type of input means equipped with multiple keys for inputting characters, numbers, and various instructions. The pointing device 612 is a type of input means for selecting and executing various instructions, selecting processing targets, and moving the cursor. The DVD-RW drive 614 controls the reading or writing of various data to the DVD-RW 613, which is an example of a removable recording medium. Note that it is not limited to DVD-RW, but may also be DVD-R, etc. The media I / F 616 controls the reading or writing (storage) of data to the recording medium 615, such as flash memory.

[0085] Figure 19 is a hardware configuration diagram of an example of an MFP (Multifunction Peripheral / Product / Printer). As shown in Figure 19, the MFP (Multifunction Peripheral / Product / Printer) 900 includes a controller 910, a short-range communication circuit 920, an engine control unit 930, an operation panel 940, and a network interface 950. The controller 910 has the main components of the computer: a CPU 901, system memory (MEM-P) 902, a northbridge (NB) 903, a southbridge (SB) 904, an ASIC (Application Specific Integrated Circuit) 906, a local memory (MEM-C) 907 which is the storage unit, an HDD controller 908, and an HD 909 which is the storage unit. The NB 903 and the ASIC 906 are connected by an AGP (Accelerated Graphics Port) bus 921.

[0086] The CPU901 is a control unit that performs overall control of the MFP9. The NB903 is a bridge that connects the CPU901 to the MEM-P902, SB904, and AGP bus 921, and includes a memory controller that controls reading and writing to the MEM-P902, as well as a PCI (Peripheral Component Interconnect) master and an AGP target.

[0087] MEM-P902 consists of ROM902a, which is a memory for storing programs and data that realize the various functions of the controller 910, and RAM902b, which is used for program and data deployment and drawing during memory printing. The programs stored in RAM902b may be configured to be provided as installable or executable files recorded on a computer-readable recording medium such as a CD-ROM, CD-R, or DVD. SB904 is a bridge for connecting NB903 to PCI devices and peripheral devices. ASIC906 is an integrated circuit (IC) for image processing applications that has hardware elements for image processing, and acts as a bridge connecting the AGP bus 921, PCI bus 922, HDD908, and MEM-C907, respectively.

[0088] The ASIC906 consists of a PCI target and AGP master, an arbiter (ARB) that forms the core of the ASIC906, a memory controller that controls the MEM-C907, multiple DMACs (Direct Memory Access Controllers) that perform image data rotation and other operations using hardware logic, and a PCI unit that performs data transfer between the scanner unit 931 and the printer unit 932 via the PCI bus 922. The ASIC906 may also be configured to have a USB (Universal Serial Bus) interface or an IEEE1394 (Institute of Electrical and Electronics Engineers 1394) interface.

[0089] MEM-C907 is local memory used as a copy image buffer and code buffer. HD909 is storage for storing image data, font data used during printing, and forms. HD909 controls data reading or writing to it according to the control of CPU901. The AGP bus 921 is a bus interface for graphics accelerator cards proposed to speed up graphics processing, and by directly accessing MEM-P902 with high throughput, the graphics accelerator card can be made faster.

[0090] Furthermore, the short-range communication circuit 920 is equipped with a short-range communication circuit 920a. The short-range communication circuit 920 is a communication circuit such as NFC or Bluetooth (registered trademark).

[0091] Furthermore, the engine control unit 930 is composed of a scanner unit 931 and a printer unit 932. The operation panel 940 includes a panel display unit 940a, such as a touch panel, which displays current settings and selection screens and accepts input from the operator, and an operation panel 940b, which consists of a numeric keypad that accepts setting values ​​for image formation conditions such as density settings and a start key that accepts a copy start command. The controller 910 controls the entire MFP9, for example, controlling drawing, communication, and input from the operation panel 940. The scanner unit 931 or the printer unit 932 includes an image processing section, such as error diffusion and gamma conversion.

[0092] The MFP900 allows users to sequentially switch between document box, copy, printer, and facsimile functions using the application switching key on the control panel 940. When the document box function is selected, the MFP900 enters document box mode; when the copy function is selected, it enters copy mode; when the printer function is selected, it enters printer mode; and when the facsimile mode is selected, it enters facsimile mode.

[0093] Furthermore, the network interface 950 is an interface for data communication using a communication network. The short-range communication circuit 920 and the network interface 950 are electrically connected to the ASIC 906 via the PCI bus 922.

[0094] The present invention is not limited to the embodiments specifically disclosed above, and various modifications and changes are possible without departing from the scope of the claims. It goes without saying that the information processing device 1 described in this embodiment is just one example, and there are various configurations depending on the application and purpose.

[0095] Each of the functions of the embodiments described above can be realized by one or more processing circuits. Hereinafter, "processing circuit" as used herein includes processors programmed to execute each function by software, such as processors implemented by electronic circuits, as well as devices such as ASICs (Application Specific Integrated Circuits), DSPs (digital signal processors), FPGAs (field programmable gate arrays), and conventional circuit modules designed to execute each of the functions described above.

[0096] The apparatus described in the examples represents only one of several computing environments for carrying out the embodiments disclosed herein.

[0097] Examples of the present invention are as follows: <1> A verification setting change means that sets the storage area of ​​the first file system as a verification target area for verifying integrity and authenticity when the system starts up, and sets the storage area of ​​the second file system as the verification target area after the system starts up, A signature verification means that verifies the integrity and authenticity of the compressed file at system startup using the compressed file stored in the storage area of ​​the first file system and the authentication data of the compressed file, Decompression and decompression means decompresses the compressed file that has been successfully verified, and expands the decompressed file and the authentication data of the file into the storage area of ​​the second file system, It has, The signature verification means, after the storage area of ​​the second file system has been set as the verification target area by the verification setting change means, uses the file stored in the storage area of ​​the second file system and the authentication data of the file to verify the integrity and authenticity of the file. An information processing device characterized by the following: <2> An error notification means that notifies an error if the verification by the signature verification means fails, The aforementioned further having <1> The information processing device described. <3> The verification setting change means sets the storage area of ​​the second file system as the verification target area when the CPU usage falls below a set threshold after the system has started. The aforementioned <1> or <2> The information processing device described. <4> The verification setting change means sets the storage area of ​​the second file system as the verification target area when the number of file descriptors falls below a set threshold after the system has started. The aforementioned <1> or <2> The information processing device described. <5> The signature verification means, after the storage area of ​​the second file system has been set as the verification target area by the verification setting change means, verifies the file that was accessed when there is a file access to the file stored in the storage area of ​​the second file system. The aforementioned <1> ~ <4> An information processing device as described in any one of the following items. <6> Information processing device, A verification setting change step which involves setting the storage area of ​​the first file system as the verification target area for verifying integrity and authenticity when the system starts up, and setting the storage area of ​​the second file system as the said verification target area after the system starts up, A signature verification step that verifies the integrity and authenticity of the compressed file at system startup using the compressed file stored in the storage area of ​​the first file system and the authentication data of the compressed file, The decompression and decompression step involves decompressing the compressed file that has been successfully verified, and deploying the decompressed file and the authentication data of the file into the storage area of ​​the second file system. Execute, The signature verification step, after the storage area of ​​the second file system has been set as the area to be verified in the verification setting change step, verifies the integrity and authenticity of the file using the file stored in the storage area of ​​the second file system and the authentication data of the file. An information processing method characterized by the following: <7> In an information processing device, A verification setting change procedure that sets the storage area of ​​the first file system as the verification target area for verifying integrity and authenticity when the system starts up, and sets the storage area of ​​the second file system as the said verification target area after the system starts up. A signature verification procedure that verifies the integrity and authenticity of a compressed file at system startup using a compressed file stored in the storage area of ​​the first file system and authentication data of the compressed file. A decompression and extraction procedure comprising decompressing the compressed file that has been successfully verified, and deploying the decompressed file and the authentication data of the file to the storage area of ​​the second file system, Make it run, The signature verification procedure, after the storage area of ​​the second file system has been set as the verification target area in the verification setting change procedure, uses the file stored in the storage area of ​​the second file system and the authentication data of the file to verify the integrity and authenticity of the file. A program characterized by the following features. [Explanation of Symbols]

[0098] 1. Information Processing Device 2 Controllers 3. External memory 4. System boot storage 5 Control section 6 Network Server 21 CPU(Central Processing Unit) 22 ROM (Read Only Memory) 23. RAM (Random Access Memory) 40 Signature creation apps 42 Launchable Apps 44 Expandable Apps 46 Signature Verification Apps 48 Error notification apps 54 Verification settings change app [Prior art documents] [Patent Documents]

[0099] [Patent Document 1] Japanese Patent Publication No. 2021-177593

Claims

1. A verification setting change means that sets the storage area of ​​the first file system as a verification target area for verifying integrity and authenticity when the system starts up, and sets the storage area of ​​the second file system as the verification target area after the system starts up, A signature verification means that verifies the integrity and authenticity of a compressed file at system startup using a compressed file stored in the storage area of ​​the first file system and authentication data of the compressed file, Decompression and decompression means decompresses the compressed file that has been successfully verified, and expands the decompressed file and the authentication data of the file into the storage area of ​​the second file system, It has, The signature verification means, after the storage area of ​​the second file system has been set as the verification target area by the verification setting change means, uses the file stored in the storage area of ​​the second file system and the authentication data of the file to verify the integrity and authenticity of the file. An information processing device characterized by the following:

2. An error notification means that notifies an error if the verification by the signature verification means fails, The information processing apparatus according to claim 1, further comprising the above.

3. The verification setting change means sets the storage area of ​​the second file system as the verification target area when the CPU usage falls below a set threshold after the system has started. The information processing apparatus according to claim 1 or 2.

4. The verification setting change means sets the storage area of ​​the second file system as the verification target area when the number of file descriptors falls below a set threshold after the system has started. The information processing apparatus according to claim 1 or 2.

5. The signature verification means, after the storage area of ​​the second file system has been set as the verification target area by the verification setting change means, verifies the integrity and authenticity of the file accessed when there is a file access to the file stored in the storage area of ​​the second file system. The information processing apparatus according to claim 1 or 2.

6. Information processing device, A verification setting change step which involves setting the storage area of ​​the first file system as the verification target area for verifying integrity and authenticity when the system starts up, and setting the storage area of ​​the second file system as the said verification target area after the system starts up, A signature verification step that verifies the integrity and authenticity of the compressed file at system startup using the compressed file stored in the storage area of ​​the first file system and the authentication data of the compressed file, The decompression step involves decompressing the compressed file that has been successfully verified, and expanding the decompressed file and the authentication data of the file into the storage area of ​​the second file system. Execute, The signature verification step, after the storage area of ​​the second file system has been set as the verification target area in the verification setting change step, verifies the integrity and authenticity of the file using the file stored in the storage area of ​​the second file system and the authentication data of the file. An information processing method characterized by the following:

7. In an information processing device, A verification setting change procedure that sets the storage area of ​​the first file system as the verification target area for verifying integrity and authenticity when the system starts up, and sets the storage area of ​​the second file system as the said verification target area after the system starts up. A signature verification procedure that verifies the integrity and authenticity of a compressed file at system startup using a compressed file stored in the storage area of ​​the first file system and authentication data of the compressed file. A decompression and extraction procedure comprising decompressing the compressed file that has been successfully verified, and deploying the decompressed file and the authentication data of the file into the storage area of ​​the second file system, Make it run, The signature verification procedure, after the storage area of ​​the second file system has been set as the verification target area in the verification setting change procedure, uses the file stored in the storage area of ​​the second file system and the authentication data of the file to verify the integrity and authenticity of the file. A program characterized by the following features.

Images