Information processing method, information processing device, and program

Abstract

This information processing method is executed by an information processing device comprising: a first storage unit that stores a first boot loader and a first public key in a non-rewritable storage area; and a second storage unit that stores, in a rewritable storage area, a second boot loader to be verified by the first boot loader, firmware to be verified by the second boot loader, a second public key corresponding to the firmware, and a first signature of the second public key. The information processing method includes: determining, on the basis of prescribed information, whether or not to update the signature scheme of a first signature, which is used by the second boot loader to verify the firmware, to a second signature scheme higher in security than a first signature scheme (S20); and if it is determined that the update from the first signature scheme to the second signature scheme is to be made (Yes in S20), performing processing to update the signature scheme of the first signature from the first signature scheme to the second signature scheme (S30, S60, S100).

Description

Information processing method, information processing apparatus, and program

[0001] The present disclosure relates to an information processing method, an information processing apparatus, and a program.

[0002] Conventionally, in secure boot, a 1st Bootloader written in a ROM (Read Only Memory) verifies a 2nd Bootloader on a RAM (Random Access Memory), and then the 2nd Bootloader verifies firmware. This enables only trusted firmware to be executed.

[0003] However, if cryptanalysis technology evolves and signature schemes are compromised in the future due to technological progress of quantum computers and other factors, secure boot itself will become vulnerable, which poses a very serious security problem. For example, most signatures used in current secure boot are ECDSA (Elliptic Curve Digital Signature Algorithm), which is considered unable to guarantee security in the quantum era.

[0004] Therefore, Patent Document 1 discloses an information processing apparatus capable of selecting a plurality of signature schemes with a 1st Bootloader. For each signature scheme, a public key used for verifying the 2nd Bootloader is written in the ROM.

[0005] Japanese Unexamined Patent Publication No. 2023-182388

[0006] However, since the public key in the ROM cannot be rewritten, the technology of Patent Document 1 cannot update the signature scheme used in a shipped device to a more secure signature scheme such as PQC (Post-Quantum Cryptography).

[0007] Accordingly, the present disclosure provides an information processing method, an information processing apparatus, and a program that can be updated to a more secure signature scheme in a shipped device.

[0008] An information processing method according to one aspect of the present disclosure is an information processing method executed by an information processing device comprising: a first storage unit that stores a first boot loader and a first public key in an immutable storage area; and a second storage unit that stores a second boot loader which is the subject of verification of the first boot loader, firmware which is the subject of verification of the second boot loader, a second public key corresponding to the firmware, and a first signature of the second public key in an immutable storage area, wherein the device determines, based on predetermined information, whether or not to update the signature scheme of the first signature used by the second boot loader to verify the firmware to a second signature scheme which is more secure than the first signature scheme, and if it is determined to update the first signature scheme to the second signature scheme, it executes a process to update the signature scheme of the first signature from the first signature scheme to the second signature scheme.

[0009] An information processing device according to one aspect of the present disclosure includes: a first storage unit that stores a first boot loader and a first public key in an immutable storage area; and a second storage unit that stores a second boot loader which is the subject of verification of the first boot loader, firmware which is the subject of verification of the second boot loader, a second public key corresponding to the firmware, and a first signature of the second public key in an immutable storage area, the information processing device comprising: a determination unit that determines, based on predetermined information, whether or not to update the signature scheme of the first signature used by the second boot loader to verify the firmware to a second signature scheme which is more secure than the first signature scheme; and a processing unit that, if it is determined to update the first signature scheme to the second signature scheme, executes a process to update the signature scheme of the first signature from the first signature scheme to the second signature scheme.

[0010] A program relating to one aspect of this disclosure is a program that causes a computer to execute the above-described information processing method.

[0011] According to one aspect of this disclosure, it is possible to realize an information processing method, etc., that can be updated to a more secure signature scheme in a shipped device.

[0012] Figure 1 is a diagram showing the configuration of an information processing system according to an embodiment. Figure 2 is a block diagram showing the functional configuration of a storage device according to an embodiment. Figure 3 is a block diagram showing the functional configuration of an automatic update determination device according to an embodiment. Figure 4 is a block diagram showing the functional configuration of an external information storage device according to an embodiment. Figure 5 is a block diagram showing the functional configuration of a firmware update device according to an embodiment. Figure 6 is a block diagram showing the functional configuration of a 2nd Bootloader update device according to an embodiment. Figure 7 is a block diagram showing the functional configuration of an automatic update determination device according to an embodiment. Figure 8 is a block diagram showing the functional configuration of an encryption device according to an embodiment. Figure 9 is a sequence diagram showing an example of the operation of updating the signature scheme in the information processing system according to an embodiment. Figure 10 is a flowchart showing the detailed operation of step S20 shown in Figure 9. Figure 11 is a sequence diagram showing an example of rollback processing in the information processing system according to an embodiment. Figure 12 is a sequence diagram showing another example of the operation of updating the signature scheme in the information processing system according to an embodiment. Figure 13 is a sequence diagram showing another example of rollback processing in the information processing system according to an embodiment.

[0013] An information processing method according to a first aspect of this disclosure is an information processing method executed by an information processing device comprising: a first storage unit that stores a first boot loader and a first public key in an immutable storage area; and a second storage unit that stores a second boot loader which is the subject of verification of the first boot loader, firmware which is the subject of verification of the second boot loader, a second public key corresponding to the firmware, and a first signature of the second public key in an immutable storage area, wherein the device determines, based on predetermined information, whether or not to update the signature scheme of the first signature used by the second boot loader to verify the firmware to a second signature scheme which is more secure than the first signature scheme, and if it is determined to update the first signature scheme to the second signature scheme, it executes a process to update the signature scheme of the first signature from the first signature scheme to the second signature scheme.

[0014] This allows the signature scheme used by the second bootloader to be appropriately updated to a more secure signature scheme. Therefore, it is possible to update to a more secure signature scheme in shipped devices. For example, if PQC level security is required for devices after shipment in the future, the required security can be achieved without a recall.

[0015] Furthermore, for example, the information processing method according to the second embodiment is the information processing method according to the first embodiment, and in determining whether or not to update the first signature scheme to the second signature scheme, the timing for updating the first signature scheme to the second signature scheme is determined based on the predetermined information, and the processing is executed based on the timing.

[0016] This automatically determines the timing for updating from the first signature method to the second signature method, ensuring that updates are performed at the appropriate time, even if the user managing the information processing device lacks security knowledge.

[0017] Furthermore, for example, the information processing method relating to the third embodiment is an information processing method relating to the first or second embodiment, and in determining whether or not to update the first signature scheme to the second signature scheme, the second signature scheme may be determined from among a plurality of signature schemes that are more secure than the first signature scheme, based on the predetermined information.

[0018] This automatically determines which second signature method to use, allowing the system to be updated to an appropriate second signature method even if the user managing the information processing device lacks security knowledge.

[0019] Furthermore, for example, the information processing method according to the fourth embodiment is the information processing method according to the third embodiment, wherein the processing receives a third public key and a second signature generated based on the second signature scheme, and updates the second public key and the first signature corresponding to the firmware stored in the second storage unit with the third public key and the second signature.

[0020] This allows for updating to an appropriate third public key and second signature based on the second signature scheme.

[0021] Furthermore, for example, the information processing method according to the fifth embodiment is an information processing method according to any of the first to fourth embodiments, and if, after updating from the first signature scheme to the second signature scheme, a malfunction occurs in the system including the information processing device, a decrease in interoperability between the device on which the information processing device is installed and other devices, and a compromise of the second signature scheme, the signature scheme may be reverted to the first signature scheme before the update.

[0022] This allows you to quickly revert to the previous stable state if any problems occur after the update.

[0023] Furthermore, for example, the information processing method relating to the sixth embodiment is an information processing method relating to any of the first to fifth embodiments, wherein the predetermined information may include at least one of the following: first information indicating the expiration date of the signature scheme; second information including information indicating the vulnerability status of the signature scheme or a recommended cryptographic scheme; third information indicating the performance of the device on which the information processing device is installed or how to use the device; and fourth information indicating security requirements relating to the signature scheme.

[0024] This allows for a more appropriate decision regarding updating to a more secure signature scheme on shipped devices by using at least one of the first to fourth pieces of information.

[0025] Furthermore, for example, the information processing method according to the seventh embodiment may be an information processing method according to any of the first to sixth embodiments, wherein the first signature scheme is a signature scheme that does not support PQC (Post-Quantum Cryptography), and the second signature scheme is a signature scheme that supports PQC.

[0026] This allows for updating to a signature scheme that is difficult for quantum computers to decipher.

[0027] Furthermore, an information processing device according to the eighth aspect of this disclosure includes a first storage unit that stores a first boot loader and a first public key in a non-rewritable storage area, and a second storage unit that stores a second boot loader which is the subject of verification of the first boot loader, firmware which is the subject of verification of the second boot loader, a second public key corresponding to the firmware, and a first signature of the second public key in a rewritable storage area, the information processing device comprising a determination unit that determines, based on predetermined information, whether or not to update the signature scheme of the first signature used by the second boot loader to verify the firmware to a second signature scheme which is more secure than the first signature scheme, and a processing unit that, if it is determined to update the first signature scheme to the second signature scheme, executes a process to update the signature scheme of the first signature from the first signature scheme to the second signature scheme.

[0028] This produces the same effects as the information processing method according to the first embodiment described above.

[0029] Furthermore, the program relating to the ninth aspect of this disclosure is a program that causes a computer to execute an information processing method relating to any of the first to seventh aspects.

[0030] This produces the same effects as the information processing method according to the first embodiment described above.

[0031] These general or specific embodiments may be implemented using a system, method, integrated circuit, computer program, or a non-temporary recording medium such as a computer-readable CD-ROM, or any combination of a system, method, integrated circuit, computer program, or recording medium. The program may be pre-stored on the recording medium or supplied to the recording medium via a wide-area communication network, including the Internet.

[0032] The embodiments will be described in detail below with reference to the drawings.

[0033] The embodiments described below are all comprehensive or specific examples. The components, their arrangement and connection configurations, steps, and the order of steps shown in the following embodiments are examples only and are not intended to limit this disclosure. Furthermore, any components in the following embodiments that are not described in an independent claim will be described as optional components.

[0034] Furthermore, each figure is a schematic diagram and not necessarily a strictly accurate representation. Therefore, for example, the scale may not necessarily match in each figure. Also, in each figure, substantially identical components are given the same reference numerals, and redundant explanations may be omitted or simplified.

[0035] Furthermore, in this specification, ordinal numbers such as "first," "second," etc., do not mean the number or order of components unless otherwise specified, but are used to avoid confusion and to distinguish similar components.

[0036] (Embodiment) The information processing system according to this embodiment will be described below with reference to Figures 1 to 13.

[0037] [1. Configuration of the Information Processing System] First, the configuration of the information processing system according to this embodiment will be described with reference to Figures 1 to 8. Figure 1 is a diagram showing the configuration of the information processing system 1 according to this embodiment. Note that Figure 1 shows an exemplary configuration of the information processing system 1, and the configuration of the information processing system 1 is not limited to Figure 1.

[0038] As shown in Figure 1, the information processing system 1 comprises a device 10, a server 20, and an external information storage device 300. The information processing system 1 is a system for updating the signature scheme used by the 2nd Bootloader stored in the device 10 for firmware verification. The device 10, the server 20, and the external information storage device 300 are connected to each other in a communicative manner. The communication method is not particularly limited and may be wired communication or wireless communication. The 2nd Bootloader is an example of a second bootloader. In the following description, the 2nd Bootloader will also be referred to as 2nd BL.

[0039] Device 10 is an IoT (Internet of Things) device having a predetermined function, and has the function to perform secure boot. Device 10 may be a home appliance (so-called smart appliance) such as a refrigerator, washing machine, smartwatch, or smart speaker, or an information terminal such as a personal computer or smartphone, or a mobile device such as an autonomous vehicle, an industrial robot, or an agricultural robot. Device 10 is an example of a device.

[0040] Secure Boot is a function that prevents tampering with firmware by allowing the startup of authorized firmware through signature verification. The firmware is intended to perform the operations defined in the design purpose or specifications of the device 10 (i.e., the original functions of the device 10). For example, if the device 10 is a refrigerator, the firmware may be for the functions of measuring, changing, and maintaining the internal temperature.

[0041] Device 10 comprises a storage device 100 and an automatic update determination device 200. Device 10, for example, incorporates the storage device 100 and the automatic update determination device 200. The storage device 100 and the automatic update determination device 200 are examples of information processing devices.

[0042] The storage device 100 stores various information necessary for performing secure boot on the device 10. The storage device 100 is implemented using, but is not limited to, a non-volatile storage device (ROM, flash memory, SSD (Solid State Drive) using flash memory, or HDD (Hard Disk Drive)) and a volatile storage device (RAM).

[0043] The automatic update determination device 200 is a processing device that determines whether or not to update the signature method used for verification by the 2ndBL (described later) in the device 10 to a more secure signature method.

[0044] The external information storage device 300 is a server that manages the compromise status of each signature scheme, a list related to signature schemes recommended by public institutions (e.g., a list of signature algorithms), and the like. The external information storage device 300 may be a server of the vendor of the device 10, or may be an external server managed by NIST (National Institute of Standards and Technology) or the like. Examples of signature algorithms recommended by public institutions include, but are not limited to, signature algorithms recommended by NIST.

[0045] The external information storage device 300 transmits information to at least one of the automatic update determination devices 200 and 600, for example. NIST is a U.S. standardization organization that promotes the standardization of PQC. Furthermore, the external information may be a list of signature algorithms (recommended cipher list) published by a public institution other than NIST. PQC is a cipher that does not rely on prime factorization or discrete logarithm, and representative examples thereof include lattice-based ciphers, code-based ciphers, and multivariate ciphers.

[0046] The server 20 is, for example, a server managed by the vendor of the device 10, and includes a firmware update device 400, a 2nd Bootloader update device 500, an automatic update determination device 600, and a cryptographic device 700. Each of these devices may be implemented by a single information processing device, or may be implemented by a plurality of information processing devices communicating with each other. In the following description, the 2nd Bootloader update device 500 is also referred to as the 2ndBL update device 500.

[0047] The firmware update device 400 is a processing device that, when the signature scheme used for verification by 2ndBL is updated, adds a public key and a signature generated by the updated signature scheme to firmware and transmits the firmware to the device 10. The firmware update device 400 also updates the firmware used in the device 10 as necessary.

[0048] The 2ndBL update device 500 is a processing device that, when the signature scheme used for verification by 2ndBL is updated, generates a 2ndBL capable of verifying a signature generated by the updated signature scheme.

[0049] The automatic update determination apparatus 600 has the same functions as the automatic update determination apparatus 200. Specifically, it is a processing apparatus that determines whether or not to update the signature scheme used when verifying the 2ndBL, which will be described later, in the device 10 to a more secure signature scheme.

[0050] The cryptographic apparatus 700 generates a key pair and a signature using a signature scheme. The key pair includes a private key and a public key. The signature is generated using a private key, for example.

[0051] Although FIG. 1 shows a configuration in which each of the device 10 and the server 20 includes an automatic update determination apparatus, the present invention is not limited thereto, and it is sufficient that at least one of the device 10 and the server 20 includes the automatic update determination apparatus.

[0052] The functional configuration of each apparatus will be described below with reference to FIGS. 2 to 8. FIGS. 2 to 8 show exemplary configurations of each apparatus, and the configuration of each apparatus is not limited to those shown in FIGS. 2 to 8.

[0053] (Storage device 100) FIG. 2 is a block diagram showing the functional configuration of the storage device 100 according to the present embodiment.

[0054] As shown in FIG. 2, the storage device 100 includes a firmware storage unit 101, a 2ndBootloader program storage unit 102, a reception unit 103, and a ROM 104. The firmware storage unit 101 and the 2ndBootloader program storage unit 102 are examples of a second storage unit, and the ROM 104 is an example of a first storage unit.

[0055] The storage device 100 also includes a processor, a memory, and the like as a hardware configuration. The memory includes, for example, a ROM and a RAM, and can store programs to be executed by the processor. Each function of the storage device 100 is implemented by a processor or the like that executes a program stored in the memory. For example, the storage device 100 is implemented by a computer. In the following description, the 2ndBootloader program storage unit 102 is also referred to as the 2ndBL program storage unit 102.

[0056] The firmware storage unit 101 has a rewritable storage area and stores firmware 101a, a second public key 101b, and a signature of the second public key 101c in this storage area. Firmware 101a is the firmware to be verified by 2ndBootloader 102a (2ndBL102a). The second public key 101b and the signature of the second public key 101c are attached to firmware 101a and are the public key and signature corresponding to the current signature scheme. The information stored in the firmware storage unit 101 can be updated by the information received by the receiving unit 103.

[0057] Firmware 101a is software incorporated to control and manage the operation of device 10.

[0058] The second public key 101b is the public key used by 2ndBL 102a when verifying firmware 101a. The second public key 101b is the public key in the key pair (private key and public key) generated using the signature algorithm that generates the signature 101c of the second public key. The private key may be stored by, for example, server 20.

[0059] The signature 101c of the second public key is a signature to firmware 101a that is verified with the second public key 101b, and is the signature used by 2ndBL102a when verifying firmware 101a.

[0060] The 2ndBL program storage unit 102 has a rewritable storage area and stores the 2ndBL 102a and the signature of the first public key 102b in this storage area. The information stored in the 2ndBL program storage unit 102 can be updated by the information received by the receiving unit 103. The signature of the first public key 102b is an example of the first signature.

[0061] 2ndBL102a is a program that performs verification on RAM by 1stBootloader104a, and after successful verification, reads firmware 101a from firmware storage unit 101 and verifies it on RAM. After successful verification of firmware 101a, 2ndBL102a executes firmware 101a. Verification of 2ndBL102a is performed, for example, by inputting the signature 102b of the first public key and the first public key 104b into a verification function (verification program). Verification of firmware 101a is performed, for example, by inputting the second public key 101b and the signature 101c of the second public key attached to firmware 101a into a verification function. 1stBootloader104a is an example of a first bootloader. In the following specification, 1stBootloader104a will also be referred to as 1stBL104a.

[0062] The signature 102b of the first public key is a signature to 2ndBL102a that is verified with the first public key 104b, and is the signature used when 1stBL104a verifies 2ndBL102a.

[0063] The receiving unit 103 receives information transmitted from the server 20 or the like. The receiving unit 103 may be configured to include, for example, a communication circuit (for example, a communication module).

[0064] ROM 104 functions as a storage unit for the 1st Bootloader program and has a non-rewritable memory area, which stores the 1st BL 104a and the first public key 104b.

[0065] 1stBL104a is a program that reads 2ndBL102a from the 2ndBL program storage unit 102, verifies it in RAM, and executes 2ndBL102a after the verification is successful.

[0066] The first public key 104b is the public key used when 1stBL 104a verifies 2ndBL 102a. The first public key 104b is the public key in the key pair (private key and public key) generated using the signature algorithm that generates the signature 102b of the first public key. The private key may be stored by, for example, server 20.

[0067] (Automatic update decision device 200) Figure 3 is a block diagram showing the functional configuration of the automatic update decision device 200 according to this embodiment.

[0068] As shown in Figure 3, the automatic update decision device 200 comprises an automatic update decision algorithm storage unit 201, an automatic update decision algorithm processing unit 202, a rollback decision unit 203, a receiving unit 204, and a transmitting unit 205. The automatic update decision device 200 also includes a processor and memory as part of its hardware configuration. The memory is ROM and RAM, and can store programs executed by the processor. Each function of the automatic update decision device 200 is realized by the processor and other components that execute the programs stored in memory. For example, the automatic update decision device 200 can be implemented by a computer.

[0069] The automatic update decision algorithm storage unit 201 is a memory device that stores an algorithm for determining whether or not to update the signature scheme used by the 2ndBL 102a during verification.

[0070] The automatic update decision algorithm processing unit 202 executes the automatic update decision algorithm (see Figure 10, described later) stored in the automatic update decision algorithm storage unit 201 and determines whether or not to update the signature scheme used for verification by the 2ndBL 102a. The automatic update decision algorithm processing unit 202 is an example of a decision unit.

[0071] The rollback determination unit 203 determines whether to perform a rollback to revert to the original signature method if a malfunction occurs in the system including device 10, a decrease in interoperability between IoT devices including device 10, or a compromise of the signature method after the signature method has been updated, starting from a request from device 10 or server 20.

[0072] The receiving unit 204 receives information from at least the external information storage device 300, the 2nd BL update device 500, and the encryption device 700. The receiving unit 204 may be configured to include, for example, a communication circuit (for example, a communication module). The receiving unit 204 is an example of a processing unit.

[0073] The transmitting unit 205 transmits information to at least the external information storage device 300, the 2nd BL update device 500, and the encryption device 700. The transmitting unit 205 may be configured to include, for example, a communication circuit (e.g., a communication module).

[0074] (External Information Storage Device 300) Figure 4 is a block diagram showing the functional configuration of the external information storage device 300 according to this embodiment.

[0075] As shown in Figure 4, the external information storage device 300 comprises an external information storage unit 301, a receiving unit 302, and a transmitting unit 303. The external information storage device 300 also includes a processor and memory as part of its hardware configuration. The memory is ROM and RAM, and can store programs executed by the processor. Each function of the external information storage device 300 is realized by the processor and other components that execute the programs stored in the memory. For example, the external information storage device 300 can be implemented by a computer.

[0076] The external information storage unit 301 is a memory device that stores external information. The external information storage unit 301 updates the stored external information based on information from the administrator of the external information or publicly available information from a public institution (for example, updating it to the latest content).

[0077] Here, the external information is information used by at least one of the automatic update determination devices 200 and 600 to determine whether or not to update the signature scheme used by 2ndBL 102a for verification, and includes, for example, information indicating the security of each signature scheme. The security information includes, but is not limited to, the security status of the signature scheme and the list of signature algorithms recommended by public institutions, as described above.

[0078] The receiving unit 302 receives information from at least one of the automatic update determination devices 200 and 600. The receiving unit 302 receives, for example, a request to transmit external information. The receiving unit 302 may be configured to include, for example, a communication circuit (for example, a communication module).

[0079] The transmitting unit 303 transmits information to at least one of the automatic update determination devices 200 and 600. The transmitting unit 303 transmits, for example, external information corresponding to a received transmission request. The transmitting unit 303 may be configured to include, for example, a communication circuit (e.g., a communication module).

[0080] (Firmware update device 400) Figure 5 is a block diagram showing the functional configuration of the firmware update device 400 according to this embodiment.

[0081] As shown in Figure 5, the firmware update device 400 comprises a firmware generation unit 401, a public key addition unit 402, a signature addition unit 403, a receiving unit 404, and a transmitting unit 405. The firmware update device 400 also includes a processor and memory as part of its hardware configuration. The memory is ROM and RAM, and can store programs executed by the processor. Each function of the firmware update device 400 is realized by the processor and other components that execute the programs stored in memory. For example, the firmware update device 400 can be implemented by a computer.

[0082] The firmware generation unit 401 is a processing unit that generates updated firmware 101a when the firmware 101a used by the device 10 is updated. Any known method may be used to generate the firmware 101a. The timing of the firmware 101a update may be determined, for example, by the administrator of the server 20 (for example, the vendor of the device 10).

[0083] The public key addition unit 402 is a processing unit that adds the public key received from the cryptographic device 700 to the firmware 101a (in this case, the firmware image). The public key addition unit 402 may, for example, embed the public key in a header placed at the beginning of the firmware binary, or include the public key in an accompanying file. The firmware image is a binary / file packaged for distributing, saving, and writing the firmware 101a.

[0084] The signature addition unit 403 is a processing unit that adds the signature received from the cryptographic device 700 to the firmware 101a (in this case, the firmware image). The signature addition unit 403 may, for example, embed the signature in the header of the firmware binary or include the signature in an accompanying file.

[0085] The receiving unit 404 receives the public key and signature from the cryptographic device 700. The receiving unit 404 may be configured to include, for example, a communication circuit (e.g., a communication module).

[0086] The transmitting unit 405 transmits the firmware 101a, to which the public key and signature have been added, to the device 10 (for example, the storage device 100). The transmitting unit 405 may be configured to include, for example, a communication circuit (for example, a communication module).

[0087] (2nd Bootloader update device 500) Figure 6 is a block diagram showing the functional configuration of the 2nd BL update device 500 according to this embodiment.

[0088] As shown in Figure 6, the 2nd BL update device 500 comprises a 2nd Bootloader verification function generation unit 501, a 2nd Bootloader generation unit 502, a receiving unit 503, and a transmitting unit 504. The 2nd BL update device 500 also includes a processor and memory as hardware components. The memory is ROM and RAM, and can store programs executed by the processor. Each function of the 2nd BL update device 500 is realized by the processor and other components that execute programs stored in memory. For example, the 2nd BL update device 500 is realized by a computer. In the following specification, the 2nd Bootloader verification function generation unit 501 will also be referred to as the 2nd BL verification function generation unit 501, and the 2nd Bootloader generation unit 502 will also be referred to as the 2nd BL generation unit 502.

[0089] The 2ndBL verification function generation unit 501 is a processing unit that generates a function (for example, a verification function) that enables the 2ndBL 102a to verify the signature generated by the signature algorithm (the signature algorithm to be updated) using the public key generated by the signature algorithm that generates a signature based on the updated signature scheme.

[0090] The 2ndBL generation unit 502 is a processing unit that generates a 2ndBL 102a updated with the verification function generated by the 2ndBL verification function generation unit 501. The 2ndBL generation unit 502 may, for example, embed the verification function in a header placed at the beginning of the 2ndBL binary, or include the verification function in an accompanying file.

[0091] The receiving unit 503 receives predetermined information from the automatic update determination devices 200 and 600 and the encryption device 700. As predetermined information, the receiving unit 503 receives from at least one of the automatic update determination devices 200 and 600 the determination result of whether or not to update the signature scheme used when 2ndBL 102a is verified. The receiving unit 503 also receives the signature algorithm to be updated from the encryption device 700. The signature algorithm to be updated may also be received from the automatic update determination devices 200 and 600. The receiving unit 503 may be configured to include, for example, a communication circuit (for example, a communication module).

[0092] The transmitting unit 504 transmits the 2ndBL 102a generated by the 2ndBL generation unit 502 to the device 10 (for example, the storage device 100). The transmitting unit 504 may be configured to include, for example, a communication circuit (for example, a communication module).

[0093] (Automatic update decision device 600) Figure 7 is a block diagram showing the functional configuration of the automatic update decision device 600 according to this embodiment.

[0094] As shown in Figure 7, the automatic update decision device 600 has the same configuration and functions as the automatic update decision device 200, and comprises an automatic update decision algorithm storage unit 601, an automatic update decision algorithm processing unit 602, a rollback decision unit 603, a receiving unit 604, and a transmitting unit 605. The automatic update decision device 600 also includes a processor and memory as hardware components. The memory is ROM and RAM, and can store programs executed by the processor. Each function of the automatic update decision device 600 is realized by the processor and other components that execute the programs stored in the memory. For example, the automatic update decision device 600 is implemented by a computer.

[0095] (Encryption device 700) Figure 8 is a block diagram showing the functional configuration of the encryption device 700 according to this embodiment.

[0096] As shown in Figure 8, the cryptographic device 700 comprises a key / signature storage unit 701, a key generation unit 702, a signature generation unit 703, a receiving unit 704, and a transmitting unit 705. The cryptographic device 700 also includes a processor and memory as part of its hardware configuration. The memory is ROM and RAM, and can store programs executed by the processor. Each function of the cryptographic device 700 is realized by the processor and other components that execute the programs stored in memory. For example, the cryptographic device 700 can be implemented by a computer.

[0097] The key / signature storage unit 701 is a storage device that stores the key pair generated by the key generation unit 702 and the signature generated by the signature generation unit 703. The key / signature storage unit 701 may also include an HSM (Hardware Security Module) or the like. Furthermore, the key / signature storage unit 701 may also store the signature algorithm that was used before the update.

[0098] The key generation unit 702 is a processing unit that generates a key pair using a cryptographic library or dedicated hardware (e.g., HSM, TPM (Trusted Platform Module), secure element) based on the key type (e.g., ECDSA (Elliptic Curve Digital Signature Algorithm), or PQC, etc.) and key parameters (key length, curve name, etc.). The key type and key parameters are set by at least one of the update automatic determination devices 200 and 600.

[0099] The signature generation unit 703 generates a signature for the firmware 101a using the private key generated by the key generation unit 702.

[0100] The receiving unit 704 receives from at least one of the automatic update determination devices 200 and 600 the determination result of whether or not to update the signature scheme used for verification by the 2nd BL 102a. The receiving unit 704 may be configured to include, for example, a communication circuit (for example, a communication module).

[0101] The transmitting unit 705 transmits the signature and public key generated by the cryptographic device 700 to the firmware update device 400. The transmitting unit 705 also transmits the signature algorithm to be updated to the 2ndBL update device 500. The transmitting unit 705 may be configured to include, for example, a communication circuit (for example, a communication module).

[0102] [2. Operation of the Information Processing System] Next, the operation of the information processing system 1 configured as described above will be explained with reference to Figures 9 to 13. Figure 9 is a sequence diagram showing an example of the operation (information processing method) for updating the signature scheme in the information processing system 1 according to this embodiment. Each process shown in Figure 9 is executed, for example, after the equipment 10 is shipped (for example, after a user purchases the equipment 10).

[0103] As shown in Figure 9, the receiving unit 204 of the automatic update determination device 200 acquires external information from the external information storage device 300 (S10). For example, the transmitting unit 303 of the external information storage device 300 reads the external information stored in the external information storage unit 301 and transmits it to the automatic update determination device 200. The receiving unit 204 of the automatic update determination device 200 receives the external information transmitted by the transmitting unit 303. The receiving unit 204 may, for example, receive external information periodically, or it may receive external information when the transmitting unit 205 transmits a request to transmit external information.

[0104] Next, the automatic update decision algorithm processing unit 202 uses the automatic update decision algorithm stored in the automatic update decision algorithm storage unit 201 to determine whether or not to update the signature method used by the 2ndBL 102a for verification (S20). It can also be said that the automatic update decision algorithm processing unit 202 determines, based on predetermined information, whether or not to switch the signature method used by the 2ndBL 102a for verifying firmware 101a to a second signature method that is more secure than the first signature method. The first signature method is the signature method currently in use (the signature method before the update), and the second signature method is the signature method after the update. The first signature method may be a signature method that does not support PQC, and the second signature method may be a signature method that supports PQC.

[0105] The specified information includes at least one of the following: first information relating to the expiration date of the first signature scheme; second information including external information indicating the vulnerability status of the first signature scheme or a recommended signature scheme; third information indicating the performance of the device 10 or how to use the device 10; and fourth information indicating the security level required for the signature scheme based on the security requirements of the device 10.

[0106] The performance of device 10 is stored in device 10 at the time of shipment. The performance of device 10 includes, for example, information processing capability and memory capacity. The method of use of device 10 includes whether or not it is a method of use that handles private information. If device 10 is an IoT camera, it takes pictures, so it is a method of use that handles private information. Also, if device 10 has a microphone, it collects sound, so it is a method of use that handles private information. The security requirements of device 10 are the security requirements required for device 10, and may include the required security rank (for example, the JC-STAR (Japan Cyber-Security Technical Assessment Requirements) rank), or may include the risk assessment evaluation results that show the degree of impact on the system if device 10 is attacked.

[0107] Figure 10 is a flowchart showing the detailed operation (information processing method) of step S20 shown in Figure 9. The flowchart shown in Figure 10 includes a decision process to determine whether or not to update the first signature method to the second signature method. The device 10 may also have a list of signature methods to be updated.

[0108] As shown in Figure 10, the automatic update determination algorithm processing unit 202 determines whether the deadline for the signature method to become compromised or to be deprecated is approaching from the product warranty expiration date (S21). The product warranty expiration date indicates the warranty expiration date of the device 10 and is set at the time of purchase of the device 10, etc. The product warranty expiration date may be stored in the automatic update determination algorithm processing unit 202, or it may be obtained from an external device via the receiving unit 204, or it may be obtained by user operation. The product warranty expiration date is an example of the first information. The deadline for the signature method to become compromised or to be deprecated is an example of the second information.

[0109] For each signature scheme, information such as the deadline by which the signature scheme will become compromised or the deadline by which the signature scheme will be deprecated is included in the external information. The update automatic determination algorithm processing unit 202 obtains from this external information the deadline by which the signature scheme currently used in the device 10 will become compromised or the deadline by which the signature scheme will be deprecated, and determines whether or not that deadline is before the end of the product warranty period.

[0110] Next, the automatic update determination algorithm processing unit 202 determines that it is time to update the signature method if it determines that the deadline for the signature method to become compromised or to be deprecated is approaching (Yes in S21) from the end of the product warranty period. It can also be said that the automatic update determination algorithm processing unit 202 determines the timing to update the first signature method to the second signature method based on the end of the product warranty period and the deadline for the signature method to become compromised or to be deprecated.

[0111] The automatic update decision algorithm processing unit 202 then determines whether the signature schemes that are candidates for update can be processed based on the equipment performance and functional requirements. In the example in Figure 10, the automatic update decision algorithm processing unit 202 determines, for example, whether ML-DSA87 and FALCON1024 can be processed based on the equipment performance and functional requirements (S22). The automatic update decision algorithm processing unit 202 reads the performance or functional requirements of the equipment 10 stored in the equipment 10 and determines whether it meets the recommended performance or functional requirements for executing ML-DSA87 and FALCON1024. The performance and functional requirements of the equipment 10 are an example of third information.

[0112] ML-DSA87 and FALCON1024 are examples of signature schemes that could be candidates for replacement. "ML-DSA" and "FALCON" indicate the key type, and "87" and "1024" indicate the key length. While ML-DSA87 and FALCON1024 are presented as examples of signature schemes with higher security than those currently in use, the signature scheme is not limited to ML-DSA87 and FALCON1024. Furthermore, higher security may also mean a longer key length or a key type that supports PQC.

[0113] Next, if the automatic update determination algorithm processing unit 202 determines that it can process the ML-DSA87 and FALCON1024 based on the equipment performance and functional requirements (Yes in S22), that is, if there are multiple candidates for an updatable signature scheme, it executes a process to determine which signature scheme to update to (for example, at least one of S23 and S25 shown below).

[0114] Furthermore, if the automatic update determination algorithm processing unit 202 determines that the deadline for the signature method to become unsafe or to be deprecated is far off from the end of the product warranty period (No in S21), or if it determines that it is not possible to process ML-DSA87 and FALCON1024 due to equipment performance and functional requirements (No in S22), it decides not to update the signature method (S24) and terminates processing.

[0115] The candidates for the updatable signature scheme may be stored in the device 10, or they may be obtained from an external information storage device 300 or the like.

[0116] Next, the automatic update decision algorithm processing unit 202 determines whether the safety requirements of the equipment 10 are above a certain level (S23). The automatic update decision algorithm processing unit 202 obtains the JC-Star rank or the risk assessment evaluation result and determines whether the rank or evaluation result is above a certain level. The safety requirements of the equipment 10 are an example of the fourth information.

[0117] Next, the automatic update determination algorithm processing unit 202 determines whether or not the device 10 stores privacy information (S25). If the device 10 has a camera, microphone, etc., the automatic update determination algorithm processing unit 202 may determine that it stores privacy information such as images and audio.

[0118] Next, the automatic update decision algorithm processing unit 202 determines that if the device 10 stores privacy information (Yes in S25), it will update to ML-DSA87 (S27). If the device 10 does not store privacy information (No in S25), it will update to FALCON512 (S28). Also, if the automatic update decision algorithm processing unit 202 determines that the security requirements of the device 10 are not above a certain level (No in S23), it will update to ML-DSA44 (S26). ML-DSA44, FALCON512, and ML-DSA87 are in that order of increasing security. In other words, the automatic update decision algorithm processing unit 202 determines the signature scheme to be updated, including the key type and key length according to the security requirements of the device 10 and the privacy information. Privacy information is an example of third-party information.

[0119] In this way, the automatic update determination algorithm processing unit 202 determines a second signature method from among several signature methods (for example, ML-DSA44, FALCON512, and ML-DSA87) that are more secure than the first signature method (for example, ECDSA currently in use) based on predetermined information.

[0120] Furthermore, if it is determined in step S22 that ML-DSA87 and FALCON1024 cannot be processed, the automatic update determination algorithm processing unit 202 may further determine whether processing becomes possible by shortening the key length. In other words, in step S22, the automatic update determination algorithm processing unit 202 may determine whether there is a signature scheme that is determined to be processable.

[0121] The decisions in steps S26 to S28 are an example of deciding to update the first signature method to the second signature method. As a result, the process of updating the first signature method to the second signature method (the process in steps S30 to S100 shown in Figure 9) is executed. This process is executed based on the timing determined in step S21, for example. This process may be executed on the same day that the decisions in steps S26 to S28 are made.

[0122] Referring again to Figure 9, the transmission unit 205 then transmits a signature algorithm (the signature algorithm to be updated) that generates a signature based on the updated signature scheme determined by the update automatic determination algorithm processing unit 202 to the 2nd BL update device 500 and the encryption device 700 (S30). Hereafter, an example in which the updated signature scheme is ML-DSA87 will be described.

[0123] Next, the 2ndBL verification function generation unit 501 of the 2ndBL update device 500 generates a 2ndBL verification function based on the received signature algorithm (S40). The 2ndBL verification function generation unit 501 generates a function that enables the 2ndBL to verify the signature generated by the signature algorithm ML-DSA87 using, for example, the public key generated by the signature algorithm ML-DSA87.

[0124] Next, the 2ndBL generation unit 502 generates a 2ndBL 102a updated with the verification function generated by the 2ndBL verification function generation unit 501, and transmits it to the device 10 (specifically, the storage device 100) via the transmission unit 504 (S50). The 2ndBL generation unit 502, for example, embeds the verification function in the header of the 2ndBL binary, or includes the verification function in an accompanying file before transmitting.

[0125] Next, the receiving unit 103 of the storage device 100 receives the 2ndBL 102a and stores the received 2ndBL 102a in the 2ndBL program storage unit 102 (S60). As a result, the 2ndBL 102a stored in the 2ndBL program storage unit 102 is replaced from a 2ndBL 102a that does not support the updated signature scheme to a 2ndBL 102a that supports the updated signature scheme. In other words, the 2ndBL 102a stored in the 2ndBL program storage unit 102 can be updated to a 2ndBL 102a that can verify signatures generated using the updated signature scheme (for example, signatures corresponding to PQC).

[0126] Furthermore, the private key used to generate the signature 102b of the first public key is not updated. As described above, even if the signature scheme used by 2ndBL102a for verification is updated to a more secure signature scheme, the signature for 2ndBL102a will still include the signature of the new first public key generated using the same private key. The newly generated signature of the first public key is generated using the same signature scheme as before the update. Therefore, since the same private key as before the update is used to generate the signature of the new first public key, 1stBL104a can perform verification of the new 2ndBL102a using the signature of the new first public key. Also, for example, the signature scheme used by 2ndBL102a to verify firmware 101a may be more secure than the signature scheme used by 1stBL104a to verify 2ndBL102a.

[0127] Furthermore, the key generation unit 702 of the cryptographic device 700 generates a corresponding key pair (private key and public key) based on the second signature scheme, and the signature generation unit 703 generates a signature for the firmware using the private key generated by the key generation unit 702 (S70). The key generation unit 702 generates a key pair (private key and public key) corresponding to the signature algorithm (the signature algorithm to be updated) that generates a signature based on the second signature scheme, using a key generation algorithm that corresponds to the said signature algorithm. The key generation unit 702 stores the generated key pair in the key / signature storage unit 701.

[0128] Then, the signature generation unit 703 reads the private key generated in step S70 from the key / signature storage unit 701 and generates a signature for the firmware using the read private key. The signature generation unit 703 may also store the generated signature in the key / signature storage unit 701.

[0129] Next, the transmission unit 705 transmits the generated public key and signature to the firmware update device 400 (S80).

[0130] Next, when the firmware update device 400 obtains the public key and signature via the receiving unit 404, it adds the public key and signature to the firmware and transmits it to the device 10 (specifically, the storage device 100) via the transmitting unit 405 (S90). In step S90, the public key addition unit 402 adds the received public key to the firmware, and the signature addition unit 403 adds the received signature to the firmware.

[0131] Here, the firmware to which the public key and signature are added is the firmware 101a currently used in the device 10. However, if the firmware is updated, the firmware generation unit 401 may generate the updated firmware, and the public key and signature may be added to the generated firmware.

[0132] Next, the receiving unit 103 of the storage device 100 receives the firmware, public key, and signature, and stores the received firmware, public key, and signature in the firmware storage unit 101 (S100). The signature received in step S100 is an example of a second signature, and the public key received in step S100 is an example of a third public key. In step S100, for example, the firmware 101a, second public key 101b, and signature 101c of the second public key stored in the firmware storage unit 101 are updated with the received firmware 101a, third public key, and second signature.

[0133] This allows the signature scheme used by 2ndBL102a for verification to be updated to a more secure signature scheme (for example, a PQC-compliant signature scheme) after the device 10 has been shipped (for example, after the device 10 has been purchased). A PQC-compliant signature scheme means, for example, a signature scheme (or signature algorithm) that can withstand attacks by quantum computers.

[0134] Next, we will explain the process for reverting to the original signature method after the signature method used by 2ndBL102a for verification has been updated, referring to Figure 11.

[0135] Figure 11 is a sequence diagram showing an example of a rollback process (information processing method) in the information processing system according to this embodiment. If, after updating from the first signature method to the second signature method, a malfunction occurs in the information processing system 1, a decrease in interoperability between the device 10 equipped with the information processing device and other devices, and a compromise of the second signature method, a rollback process is executed to revert the signature method from the second signature method back to the first signature method before the update.

[0136] As shown in Figure 11, first, the rollback determination unit 203 of the update automatic determination device 200 determines, based on the detection results of defects or external information, whether a defect has occurred in the information processing system 1, such as a malfunction, a decrease in interoperability, or a compromise of the second signature method, after the signature method used for verification by 2ndBL 102a has been updated, and decides whether or not to roll back based on the determination result (S210). If a defect has occurred in the information processing system 1, such as a malfunction, a decrease in interoperability, or a compromise of the second signature method, the rollback determination unit 203 decides to roll back.

[0137] If the rollback determination unit 203 determines that a rollback is to be performed (Yes in S210), it proceeds to step S220. If it determines that a rollback is not to be performed (No in S210), it terminates the rollback-related processing.

[0138] The decision in step S210 may be performed periodically, or it may be performed when a malfunction is detected or when a predetermined event occurs, such as when external information is updated.

[0139] Next, if the rollback determination unit 203 determines that a rollback is necessary, it sends a rollback request to the 2ndBL update device 500 and the encryption device 700 requesting them to perform the rollback (S220). The update automatic determination algorithm storage unit 201 stores the signature scheme before the update, and the rollback determination unit 203 may include a signature algorithm (for example, if the signature scheme is ECDSA, ECDSA with SHA (Secure Hash Algorithm)-256) that shows the specific procedure for generating a signature based on the signature scheme before the update (for example, ECDSA) in the rollback request.

[0140] Next, the 2ndBL verification function generation unit 501 of the 2ndBL update device 500 generates a 2ndBL verification function based on the received signature algorithm (S230). The 2ndBL verification function generation unit 501 generates a function that enables the 2ndBL 102a to verify the signature generated by the signature algorithm, for example, using the public key generated using the signature algorithm (the public key generated in S270). It can also be said that the 2ndBL verification function generation unit 501 regenerates the 2ndBL verification function that was used before the update.

[0141] Next, the 2ndBL generation unit 502 generates a 2ndBL 102a updated with the verification function generated by the 2ndBL verification function generation unit 501 (i.e., the 2ndBL 102a before the update) and transmits it to the device 10 (specifically, the storage device 100) via the transmission unit 504 (S240).

[0142] Next, the receiving unit 103 of the storage device 100 receives the 2ndBL 102a and stores the received 2ndBL 102a in the 2ndBL program storage unit 102 (S250). As a result, the 2ndBL 102a stored in the 2ndBL program storage unit 102 is replaced from the 2ndBL 102a corresponding to the updated second signature scheme to the 2ndBL 102a corresponding to the pre-update first signature scheme. In other words, the 2ndBL 102a stored in the 2ndBL program storage unit 102 can be returned to a 2ndBL 102a that can verify a signature generated using the pre-update signature scheme (for example, a signature corresponding to ECDSA).

[0143] Furthermore, as described above, even if the signature scheme used by 2ndBL102a for verification reverts to the previous signature scheme, the signature 102b of the first public key stored in 2ndBL program storage 102 remains unchanged. In 2ndBL program storage 102, only 2ndBL102a is modified among 2ndBL102a and the signature 102b of the first public key.

[0144] Furthermore, the private key used to generate signature 102b of the first public key will not be updated. As described above, even if the signature scheme used by 2ndBL102a for verification reverts to the original signature scheme, the signature to 2ndBL102a will be accompanied by the signature of the original first public key generated using the same private key. The signature of the original first public key will be generated using the same signature scheme as before the update.

[0145] Furthermore, based on the received rollback request, the cryptographic device 700 extracts the signature algorithm that the device 10 was using before the update from among a plurality of signature algorithms (S260). Then, the key generation unit 702 generates a key pair using the extracted signature algorithm, and the signature generation unit 703 generates a signature using the secret key generated by the key generation unit 702 (S270).

[0146] Next, the transmission unit 705 transmits the generated public key and signature to the firmware update device 400 (S280).

[0147] Next, when the firmware update device 400 obtains the public key and signature via the receiving unit 404, it adds the public key and signature to the firmware and transmits it to the device 10 (specifically, the storage device 100) via the transmitting unit 405 (S290).

[0148] Next, the receiving unit 103 of the storage device 100 receives the firmware, public key, and signature, and stores the received firmware, public key, and signature in the firmware storage unit 101 (S300). This allows the signature used by 2ndBL 102a for verification to be reverted to the previous signature (for example, the signature corresponding to ECDSA) if a problem occurs after updating the signature scheme.

[0149] Figures 9 to 11 above illustrate an example in which the automatic update determination device 200 provided in the device 10 makes decisions regarding the update and rollback of the signature scheme, but the system is not limited to this example. For example, the automatic update determination device 600 provided in the server 20 may make decisions regarding the update and rollback of the signature scheme. Below, the processing sequence when the automatic update determination device 600 makes a decision regarding the update of the signature scheme will be explained with reference to Figure 12, and the processing sequence when the automatic update determination device 600 makes a decision regarding rollback will be explained with reference to Figure 13.

[0150] Figure 12 is a sequence diagram showing another example of the operation (information processing method) for updating the signature scheme in the information processing system 1 according to this embodiment. In Figure 12, the same reference numerals as in Figure 9 are used for processes similar to those in Figure 9, and their explanations are omitted or simplified.

[0151] As shown in Figure 12, the receiving unit 604 of the automatic update determination device 600 acquires external information from the external information storage device 300 (S410). For example, the transmitting unit 303 of the external information storage device 300 reads the external information stored in the external information storage unit 301 and transmits it to the automatic update determination device 600. The receiving unit 604 of the automatic update determination device 600 receives the external information transmitted by the transmitting unit 303.

[0152] The receiving unit 604 may, for example, periodically receive external information, or it may receive external information when the transmitting unit 605 sends a request to transmit external information.

[0153] Next, the automatic update decision algorithm processing unit 602 uses the automatic update decision algorithm stored in the automatic update decision algorithm storage unit 601 to determine whether or not to update the signature scheme used when verifying the 2ndBL 102a (S420). The decision process in step S420 is the same as in step S20. The automatic update decision algorithm processing unit 602 may also obtain information necessary to perform the decisions in steps S21 to S23 and S25 shown in Figure 10 from the device 10 or the like.

[0154] Next, the transmission unit 605 transmits a signature algorithm, which generates a signature based on the updated signature scheme determined by the automatic update determination algorithm processing unit 602, to the 2nd BL update device 500 and the encryption device 700 (S430). The subsequent processing is the same as in Figure 9.

[0155] Figure 13 is a sequence diagram showing another example of the rollback process (information processing method) in the information processing system 1 according to this embodiment. In Figure 13, processes similar to those in Figure 11 are denoted by the same reference numerals as in Figure 11, and their descriptions are omitted or simplified.

[0156] As shown in Figure 13, first, the rollback determination unit 603 of the update automatic determination device 600 determines, based on the fault detection results, external information, etc., whether a malfunction has occurred in the information processing system 1, such as a malfunction, a decrease in interoperability, or a compromise of the second signature method, after the signature used for verification by 2ndBL 102a has been updated, and then decides whether or not to roll back based on the determination result (S510). If a malfunction has occurred in the information processing system 1, such as a malfunction, a decrease in interoperability, or a compromise of the second signature method, the rollback determination unit 603 decides to roll back.

[0157] If the rollback determination unit 603 determines that a rollback is to be performed (Yes in S510), it proceeds to step S520. If it determines that a rollback is not to be performed (No in S510), it terminates the rollback-related processing.

[0158] The decision in step S510 may be performed periodically, or it may be performed when a malfunction is detected or when a predetermined event occurs, such as when external information is updated.

[0159] Next, if the rollback determination unit 603 determines that a rollback is necessary, it sends a rollback request to the 2ndBL update device 500 and the encryption device 700 requesting them to perform the rollback (S520). The update automatic determination algorithm storage unit 601 stores the signature scheme before the update, and the rollback determination unit 603 may include a signature algorithm (for example, if the signature scheme is ECDSA, ECDSA with SHA (Secure Hash Algorithm)-256) that shows the specific procedure for generating a signature based on the signature scheme before the update (for example, ECDSA) in the rollback request and send it. Subsequent processing is the same as in Figure 11.

[0160] (Other Embodiments) Although information processing methods, etc., relating to one or more embodiments have been described above based on embodiments, this disclosure is not limited to these embodiments. Without departing from the spirit of this disclosure, various modifications that a person skilled in the art could conceive of may be applied to these embodiments, and forms constructed by combining components from different embodiments may also be included in this disclosure.

[0161] For example, the signature generated by the updated signature scheme in the above embodiment (the updated signature) may be used when the server and the device perform further authentication. For example, the updated signature may be used for authentication between the server and the device when the device's firmware is updated. This ensures, for example, a level of security equivalent to PQC for authentication between the server and the device. The automatic update determination device may automatically determine to update the signature (signature scheme) used for authentication between the server and the device, triggered by the determination to update the first signature scheme to the second signature scheme.

[0162] Furthermore, although the above embodiment describes an example having two BLs, 1stBL and 2ndBL, it is not limited to this, and may also have a 3tdBL stored in a rewritable memory area. In this case, 1stBL verifies 2ndBL, 2ndBL verifies 3rdBL, and 3rdBL verifies the firmware, but the signature scheme used by 2ndBL to verify 3rdBL and the signature scheme used by 3rdBL to verify the firmware may each be updated to a more secure signature scheme.

[0163] Furthermore, in the above embodiment, each component may be implemented by being composed of dedicated hardware or by executing a software program suitable for each component. Each component may also be implemented by a program execution unit such as a CPU or processor reading and executing a software program recorded on a recording medium such as a hard disk or semiconductor memory.

[0164] Furthermore, the order in which each step in the flowchart is performed is illustrative for the purpose of specifically illustrating this disclosure, and may be in a different order. Also, some of the above steps may be performed simultaneously (in parallel) with other steps, and some of the above steps may not be performed.

[0165] Furthermore, the division of functional blocks in the block diagram is just one example; multiple functional blocks can be implemented as a single functional block, a single functional block can be divided into multiple parts, or some functions can be moved to other functional blocks. In addition, the functions of multiple functional blocks with similar functions can be processed in parallel or time-sharing by a single piece of hardware or software.

[0166] Furthermore, the information processing device according to the above embodiment may be implemented as a single device or as a plurality of devices. When the information processing device is implemented as a plurality of devices, the components of the information processing device may be distributed among the plurality of devices in any manner. For example, this disclosure may be implemented by cloud computing or by edge computing. Also, when the information processing device is implemented as a plurality of devices, the method of communication between the plurality of devices is not particularly limited and may be wireless communication or wired communication. In addition, wireless communication and wired communication may be combined between the devices.

[0167] Furthermore, each component described in the above embodiments may be implemented as software, or typically as an integrated circuit (LSI). These may be individually integrated onto a single chip, or some or all of them may be integrated onto a single chip. Here, we refer to it as an LSI, but depending on the degree of integration, it may also be called an IC, system LSI, super LSI, or ultra LSI. Moreover, the method of integrated circuit implementation is not limited to LSIs; it may also be implemented using a dedicated circuit (a general-purpose circuit that executes a dedicated program) or a general-purpose processor. After LSI manufacturing, a programmable FPGA (Field Programmable Gate Array) or a reconfigurable processor that can reconfigure the connections or settings of circuit cells inside the LSI may be used. Furthermore, if an integrated circuit implementation technology that replaces LSIs emerges due to advances in semiconductor technology or other derived technologies, it is natural that the components may be integrated using that technology.

[0168] A system LSI is a highly functional LSI manufactured by integrating multiple processing units onto a single chip. Specifically, it is a computer system composed of a microprocessor, ROM, RAM, and other components. The ROM stores the computer program. The system LSI achieves its function by having the microprocessor operate according to the computer program.

[0169] Furthermore, one aspect of this disclosure may be a computer program that causes a computer to execute characteristic steps included in the information processing method shown in any of Figures 9 to 13.

[0170] This disclosure is useful for information processing devices, etc., that perform boot loader-related processing.

[0171] 1 Information Processing System 10 Equipment 20 Server 100 Storage Device 101 Firmware Storage Unit 101a Firmware 101b Second Public Key 101c Signature of Second Public Key 102 2nd Bootloader Program Storage Unit 102a 2nd Bootloader 102b Signature of First Public Key 103, 302, 404, 503, 604, 704 Receiving Unit 104 ROM 104a 1st Bootloader 104b First Public Key 200, 600 Automatic Update Judgment Device 201, 601 Automatic Update Judgment Algorithm Storage Unit 202, 602 Automatic Update Judgment Algorithm Processing Unit (Judgment Unit) 203, 603 Rollback Judgment Unit 204 Receiving Unit (Processing Unit) 205, 303, 405, 504, 605, 705 Transmitting Unit 300 External Information Storage Device 301 External Information Storage Unit 400 Firmware Update Device 401 Firmware Generation Unit 402 Public Key Addition Unit 403 Signature Addition Unit 500 2nd Bootloader Update Device 501 2nd Bootloader Verification Function Generation Unit 502 2nd Bootloader Generation Unit 700 Cryptographic Device 701 Key / Signature Storage Unit 702 Key Generation Unit 703 Signature Generation Unit

Claims

1. An information processing method to be executed by an information processing device comprising: a first storage unit that stores a first boot loader and a first public key in a non-rewritable storage area; and a second storage unit that stores a second boot loader which is the target of verification of the first boot loader, firmware which is the target of verification of the second boot loader, a second public key corresponding to the firmware, and a first signature of the second public key in a rewritable storage area, wherein the information processing method determines, based on predetermined information, whether or not to update the signature scheme of the first signature used by the second boot loader to verify the firmware to a second signature scheme which is more secure than the first signature scheme; and if it is determined that the first signature scheme should be updated to the second signature scheme, the information processing method executes a process to update the signature scheme of the first signature from the first signature scheme to the second signature scheme.

2. The information processing method according to claim 1, wherein, in determining whether or not to update the first signature method to the second signature method, the timing for updating the first signature method to the second signature method is determined based on the predetermined information, and the process is performed based on the timing.

3. The information processing method according to claim 1 or 2, in determining whether or not to update the first signature method to the second signature method, the method determines the second signature method from among a plurality of signature methods that are more secure than the first signature method, based on the predetermined information.

4. The information processing method according to claim 3, wherein the process receives a third public key and a second signature generated based on the second signature scheme, and updates the second public key and the first signature corresponding to the firmware stored in the second storage unit with the third public key and the second signature.

5. The information processing method according to claim 1 or 2, which, after updating from the first signature method to the second signature method, causes a malfunction in the system including the information processing device, a decrease in interoperability between the device on which the information processing device is installed and other devices, and a compromise of the second signature method, to revert the signature method back to the first signature method before the update.

6. The information processing method according to claim 1 or 2, wherein the predetermined information includes at least one of: first information indicating the expiration date of the signature scheme; second information including the status of the compromise of the signature scheme or a recommended cryptographic scheme; third information indicating the performance of the device on which the information processing device is installed or how to use the device; and fourth information indicating security requirements related to the signature scheme.

7. The information processing method according to claim 1 or 2, wherein the first signature scheme is a signature scheme that does not support PQC (Post-Quantum Cryptography), and the second signature scheme is a signature scheme that supports PQC.

8. An information processing device comprising: a first storage unit that stores a first boot loader and a first public key in a non-rewritable storage area; and a second storage unit that stores a second boot loader which is the target of verification of the first boot loader, firmware which is the target of verification of the second boot loader, a second public key corresponding to the firmware, and a first signature of the second public key in a rewritable storage area, wherein the information processing device comprises: a determination unit that determines, based on predetermined information, whether or not to update the signature scheme of the first signature used by the second boot loader to verify the firmware to a second signature scheme which is more secure than the first signature scheme; and a processing unit that, if it is determined to update the first signature scheme to the second signature scheme, executes a process to update the signature scheme of the first signature from the first signature scheme to the second signature scheme.

9. A program for causing a computer to execute the information processing method described in claim 1 or 2.

Images