Information Processing Apparatus File Integrity Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing information processing technologies fail to ensure the integrity and authenticity of files during system updates, as they cannot effectively verify the integrity of files when the system is updated, unlike when it is launched.
Innovation Solution
An information processing apparatus that performs signature verification on update files using a unique value calculated based on the update file and ensures the integrity and authenticity of invocation files at system startup, utilizing Trusted Boot and Linux-IMA functions for verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature verification is performed on update files during system updates, then the integrity and authenticity of update files are ensured, but the system update process becomes more complex and time-consuming
Solution Approach 1:
The patent applies preliminary action by pre-calculating a unique value (hash) of the update file and pre-generating its signature before the actual system update process. This allows the verification mechanism to be prepared in advance, reducing the complexity and time of verification during the update execution phase.
Solution Approach 2:
The patent introduces an intermediary verification mechanism that uses a unique value (hash) as a mediator between the update file and the signature verification process. This intermediary layer simplifies the verification by breaking down the complex verification task into manageable steps: calculating hash, comparing with stored hash, and only then proceeding to signature verification if needed.
2Reliability
If signature verification is performed on update files, then unauthorized updates are prevented, but the update process takes longer to complete
Solution Approach 1:
The patent applies partial action by performing a quick hash verification first, and only performing the more time-consuming signature verification when the hash matches or when suspicion of tampering exists. This staged verification approach reduces the average time required while maintaining security.
Solution Approach 2:
By pre-calculating and storing the unique value (hash) of the update file before distribution, the system avoids the need to perform complex verification calculations during the update process, significantly reducing the time required while maintaining the prevention of unauthorized updates.
3Reliability
If integrity verification is performed on both update files and invocation files, then comprehensive security is achieved, but the verification process becomes more complex
Solution Approach 1:
The patent segments the verification process into two distinct parts: verification of update files (using unique values and signatures) and verification of invocation files (using traditional signature verification). This segmentation allows each verification process to be optimized independently and simplifies the overall complexity by clearly defining the scope and method for each verification type.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An information processing apparatus includes: first means for performing signature verification based on a value and a signature file to ensure integrity and authenticity of an update file to be used when a system is updated, the value being uniquely calculated based on the update file, and the signature file corresponding to the update file; and second means for ensuring the integrity and authenticity of an invocation file to be executed at startup of the system. After the first means causes the system to be updated using the update file for which the integrity and authenticity are ensured, the second means causes the system to be launched using the invocation file for which the integrity and authenticity are ensured, to ensure the integrity and authenticity of files that are used when the system is updated and at startup of the system.