JP2019022073A - Device and program for information processing - Google Patents

Abstract

To provide an information processing device which can reduce a startup time, in comparison with a case of performing cipher communication between a CPU and a security chip, when reading an encrypted startup program in a storage medium at the startup of equipment.SOLUTION: Control means for the information processing device can perform cipher communication between the CPU and the security chip. When the security chip is used to decrypt the startup program in the storage medium, the control means controls to perform communication with the security chip not by the cipher communication.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an information processing apparatus and an information processing program.

  Patent Document 1 has an object to provide an information processing apparatus that can shorten the startup time. A disk that stores a startup target program and encrypted data; a BIOS that is executed at startup and starts the program; , TPM having a register connected to the BIOS via a low-speed bus and capable of storing the hash value of the program, Loader, Kernel, Rootfs executed as a program by the BIOS, and the hash value of the program and the hash value of the BIOS are stored in advance The BIOS includes a hash value calculation unit that calculates the hash value of the BIOS and the hash value of the program and stores the hash value in a register. The TPM stores the stored hash value and the hash value stored in the Blob. And if both match, the default value in the blob It is disclosed to decrypt the data.

JP 2009-129061 A

Security chips are used to build a reliable computing environment. Furthermore, in order to deal with reverse engineering attacks, cryptographic communication is performed between the CPU and the security chip.
However, the encryption communication requires encryption processing as compared with communication that is not encryption communication, and an inexpensive processing device is often used in the security chip. It takes time. On the other hand, in order to activate the device, it is necessary to use a security chip to read the encrypted activation program from the storage medium.
According to the present invention, when the encrypted activation program in the storage medium is read when the device is activated, the activation time can be shortened as compared with the case where encryption communication is performed between the CPU and the security chip. An object of the present invention is to provide an information processing apparatus and an information processing program.

The gist of the present invention for achieving the object lies in the inventions of the following items.
According to the first aspect of the present invention, encryption communication is possible between the CPU and the security chip, and when the security chip is used to decrypt the activation program in the storage medium, the security chip and the encryption communication are used. It is an information processing apparatus which has a control means which controls so that it may not communicate.

  According to a second aspect of the present invention, when the security chip is used to encrypt or decrypt information other than the startup program in the storage medium, the control means controls to perform cryptographic communication with the security chip. The information processing apparatus according to claim 1.

  A third aspect of the present invention is the information processing apparatus according to the second aspect, wherein the information other than the activation program includes customer information or a processing target, a processing result, or an intermediate processing result by the information processing apparatus.

  According to a fourth aspect of the present invention, the information processing apparatus is an image processing apparatus, and is used as the processing result or the intermediate processing result as an image, an image processing result, or an image processing target of image processing by the image processing apparatus. The information processing apparatus according to claim 3, wherein the information processing apparatus includes an intermediate processing result.

  The invention according to claim 5 is the information processing apparatus according to claim 1, wherein the storage medium is divided into a plurality of areas, and whether to perform encrypted communication is determined according to the areas. .

  A sixth aspect of the present invention is the information processing apparatus according to the fifth aspect, wherein a different encryption key is used for each area.

  In the invention of claim 7, when the control means targets an area in which the startup program is stored, the control means controls to perform communication other than encrypted communication, and when the target is to another area The information processing apparatus according to claim 5, wherein control is performed so as to perform encryption communication.

  In the invention according to claim 8, the control means reads from the other area while performing the decoding process of the activation program or while transferring the decrypted activation program to the main memory. The information processing apparatus according to claim 7, wherein encrypted communication for performing the communication is started.

  According to the ninth aspect of the present invention, when the computer is capable of encrypted communication between the CPU and the security chip and uses the security chip to decrypt the boot program in the storage medium, It is an information processing program for functioning as a control unit that controls to perform communication other than the encrypted communication.

  According to the information processing apparatus of claim 1, in reading the encrypted startup program in the storage medium when starting up the device, compared with the case of performing cryptographic communication between the CPU and the security chip, Startup time can be shortened.

  According to the information processing apparatus of the second aspect, when a security chip is used for encrypting or decrypting information other than the activation program in the storage medium, control can be performed so as to perform encrypted communication with the security chip. it can.

  According to the information processing apparatus of the third aspect, customer information or a processing target, a processing result, or an intermediate processing result by the information processing apparatus can be included as information other than the activation program.

  According to the information processing apparatus of claim 4, when the information processing apparatus is an image processing apparatus, the processing result or the intermediate processing result is the image that is the object of the image processing by the image processing apparatus, the image processing result, or the image processing result. Intermediate processing results can be included.

  According to the information processing apparatus of the fifth aspect, the storage medium is divided into a plurality of areas, and it is possible to determine whether or not to perform cryptographic communication according to the areas.

  According to the information processing apparatus of the sixth aspect, even if the encryption key in the area where the activation program is stored is leaked, the other areas can be prevented from being affected.

  According to the information processing apparatus of the seventh aspect, when the area in which the startup program is stored is targeted, control is performed so that communication other than encrypted communication is performed, and when the other area is targeted, encryption is performed. It can be controlled to perform communication.

  According to the information processing apparatus of the eighth aspect, in order to read from another area while performing the decoding process of the activation program or while transferring the decrypted activation program to the main memory Encryption communication can be started.

  According to the information processing program of claim 9, when reading the encrypted startup program in the storage medium when starting up the device, compared with the case of performing cryptographic communication between the CPU and the security chip, Startup time can be shortened.

It is a conceptual module block diagram about the structural example of this Embodiment. It is explanatory drawing which shows the system configuration example using this Embodiment. It is a flowchart which shows the process example by this Embodiment. It is explanatory drawing which shows the example of a partition of a storage medium. It is explanatory drawing which shows the example of a data structure of a HDD encryption process table. It is a flowchart which shows the process example by this Embodiment.

First, before describing the present embodiment, the premise or an information processing apparatus using the present embodiment will be described. This description is intended to facilitate understanding of the present embodiment.
A TPM (Trusted Platform Module) security chip is used to enhance the security of the device. For example, a Windows (registered trademark) 10 machine is required to mount a TPM 2.0 TPM chip, and the following measures can be taken.
-Prevention of unauthorized access by encrypting data in the storage and protecting the encryption key (also referred to as a key or an encryption key, which may be a decryption key depending on the encryption method) in the TPM.
・ Prevents sending / receiving encrypted mail and wiretapping / spoofing.
-Protection of personal authentication and Windows logon information.
・ Prevents falsification of the program.

A startup CPU (Central Processing Unit) needs to receive an encryption key for decompression from the TPM security chip in order to decrypt the encrypted data stored in an HDD (Hard Disk Drive) or the like.
The bus interface between the TPM security chip and the activation CPU is composed of an independent bus interface that cannot be accessed from an external device. However, by performing hacking such as a bus probe, the encryption key must be decrypted unless encryption communication is performed. Is possible.
For this measure, a bus encryption specification called Transport Protection was formulated from the TPM 1.2 specification, and hacking measures such as a bus probe were introduced.
The TPM security chip is composed of an inexpensive CPU and a non-volatile memory. In order to perform this encrypted communication, it takes time to exchange encryption keys between the activation CPU and the TPM security chip.
An encrypted program is stored in the HDD, and it is necessary to release the encryption and transfer the program data from the HDD to the main memory as the first operation of activation. Here, a waiting time is generated and the activation time is long. turn into.

Hereinafter, an example of a preferred embodiment for realizing the present invention will be described with reference to the drawings.
FIG. 1 shows a conceptual module configuration diagram of a configuration example of the present embodiment.
The module generally refers to components such as software (computer program) and hardware that can be logically separated. Therefore, the module in the present embodiment indicates not only a module in a computer program but also a module in a hardware configuration. Therefore, the present embodiment is a computer program for causing these modules to function (a program for causing a computer to execute each procedure, a program for causing a computer to function as each means, and a function for each computer. This also serves as an explanation of the program and system and method for realizing the above. However, for the sake of explanation, the words “store”, “store”, and equivalents thereof are used. However, when the embodiment is a computer program, these words are stored in a storage device or stored in memory. This means that control is performed so as to be stored in the apparatus. Modules may correspond to functions one-to-one, but in mounting, one module may be configured by one program, or a plurality of modules may be configured by one program, and conversely, one module May be composed of a plurality of programs. The plurality of modules may be executed by one computer, or one module may be executed by a plurality of computers in a distributed or parallel environment. Note that one module may include other modules. Hereinafter, “connection” is used not only for physical connection but also for logical connection (data exchange, instruction, reference relationship between data, etc.). “Predetermined” means that the process is determined before the target process, and not only before the process according to this embodiment starts but also after the process according to this embodiment starts. Also, if it is before the target processing, it is used in accordance with the situation / status at that time or with the intention to be decided according to the status / status up to that point. When there are a plurality of “predetermined values”, they may be different values, or two or more values (of course, including all values) may be the same. In addition, the description of “do B when A” is used to mean “determine whether or not A and do B when A”. However, the case where it is not necessary to determine whether or not A is excluded. In addition, when enumerating things such as “A, B, C”, etc., it is an enumerated list unless otherwise specified, and includes cases where only one of them is selected (for example, only A).
In addition, the system or device is configured by connecting a plurality of computers, hardware, devices, and the like by communication means such as a network (including one-to-one correspondence communication connection), etc., and one computer, hardware, device. The case where it implement | achieves by etc. is included. “Apparatus” and “system” are used as synonymous terms. Of course, the “system” does not include a social “mechanism” (social system) that is an artificial arrangement.
In addition, when performing a plurality of processes in each module or in each module, the target information is read from the storage device for each process, and the processing result is written to the storage device after performing the processing. is there. Therefore, description of reading from the storage device before processing and writing to the storage device after processing may be omitted. Here, the storage device may include a hard disk, a RAM (Random Access Memory), an external storage medium, a storage device via a communication line, a register in the CPU, and the like.

An information processing apparatus 190 according to the present embodiment includes an information processing module 100, a security chip 160, a storage medium 165, and a main memory 170. The information processing module 100 is built in the CPU (including execution as a program) and communicates with the security chip 160, the storage medium 165, and the main memory 170. As shown in FIG. 4, the communication processing module 105, the cryptographic processing module 125, and the processing module 140 are included.
The security chip 160 is connected to the communication processing module 105 of the information processing module 100. The security chip 160 includes, for example, a TPM security chip that conforms to the security specifications defined by TCG (Trusted Computing Group). Between the CPU (information processing module 100) and the security chip 160, it is possible to perform encrypted communication according to the encryption specification (TPM1.2) of Transport Protection. “Cryptographic communication” includes, for example, Transport Protection for data protection on a serial bus. It is also possible to perform communication other than encrypted communication.
The storage medium 165 is connected to the processing module 140 of the information processing module 100. The storage medium 165 only needs to store at least an encrypted startup program, and examples thereof include a hard disk and an SSD. In addition to the startup program, the storage medium 165 stores, for example, a customer information processing program, customer information data, a program for performing the functions of the information processing device 190, processing target data, intermediate result data, and the like. is there.
The main memory 170 is connected to the processing module 140 of the information processing module 100. The main memory 170 stores data and programs read from the storage medium 165, and is accessed when processing by the CPU (processing module 140) is performed. Data or a program is transferred from the storage medium 165 to the main memory 170. Further, since the data or program stored in the storage medium 165 is encrypted, a decryption process is required when transferring it to the main memory 170.

The information processing module 100 includes a communication processing module 105, a cryptographic processing module 125, and a processing module 140.
The communication processing module 105 includes an encryption communication module 110, a communication module 115, and a control module 120, and is connected to the encryption processing module 125 and the security chip 160. The communication processing module 105 performs communication with the security chip 160.
The cryptographic communication module 110 is connected to the control module 120. The cryptographic communication module 110 performs cryptographic communication between the CPU and the security chip 160 according to the control of the control module 120. As the encryption communication, for example, the above-described Transport Protection is available.
The communication module 115 is connected to the control module 120. The communication module 115 performs non-encrypted communication between the CPU and the security chip 160 according to the control of the control module 120.

The control module 120 is connected to the cryptographic communication module 110 and the communication module 115. The control module 120 can perform cryptographic communication between the CPU and the security chip 160. When the security chip 160 is used to decrypt the activation program in the storage medium 165, the control module 120 performs cryptographic communication with the security chip 160. Control to perform non-communication. That is, when processing is performed by the activation processing module 145, communication with the security chip 160 is performed using the communication module 115.
In addition, when the security chip 160 is used to encrypt or decrypt information other than the activation program in the storage medium 165, the control module 120 controls to perform encrypted communication with the storage medium 165. Also good. That is, when processing other than the activation processing module 145 is performed, communication with the security chip 160 is performed using the cryptographic communication module 110. Here, as “information other than the activation program”, customer information or a processing target, a processing result, or an intermediate processing result by the information processing apparatus 190 may be included. That is, when processing by the customer information processing module 150 and the device processing module 155 is performed, communication with the security chip 160 is performed using the cryptographic communication module 110.
Further, when the information processing apparatus 190 is an image processing apparatus (an image processing apparatus 250 described later), as a processing result or an intermediate processing result, an image that is a target of image processing by the image processing apparatus, an image processing result, or an image processing result An intermediate processing result may be included.
Further, the storage medium 165 may be divided into a plurality of areas, and whether to perform encrypted communication with the security chip 160 may be determined according to the areas. A different encryption key may be used for each area. That is, the control module 120 uses the encryption key corresponding to the area in the storage medium 165 to control the encryption communication module 110 to perform encrypted communication.
In addition, when the control module 120 targets an area in the storage medium 165 where the startup program is stored, the control module 120 controls the communication module 115 to perform communication other than encrypted communication, and controls other areas. In the case of the target, the encryption communication module 110 may be used to control the encryption communication.
Further, the control module 120 reads from other areas in the storage medium 165 while performing the decryption process of the boot program or while transferring the decrypted boot program to the main memory 170. You may make it start the encryption communication for performing.

The encryption processing module 125 includes an encryption module 130 and a decryption module 135 and is connected to the communication processing module 105 and the processing module 140. The encryption processing module 125 performs encryption processing and decryption processing.
The encryption module 130 performs encryption processing using an encryption key when communicating with the security chip 160, the storage medium 165, and the main memory 170. An existing technique may be used for the encryption process. For example, public key cryptography may be used. The encryption key may be acquired from the security chip 160 via the communication processing module 105.
The decryption module 135 performs decryption processing using an encryption key when communicating with the security chip 160, the storage medium 165, and the main memory 170. The decryption process only needs to correspond to the encryption process of the encryption module 130, and an existing technique may be used. For example, public key cryptography may be used. The encryption key may be acquired from the security chip 160 via the communication processing module 105.

The processing module 140 includes an activation processing module 145, a customer information processing module 150, and a device processing module 155, and is connected to the cryptographic processing module 125, the storage medium 165, and the main memory 170. The processing module 140 performs processing for exhibiting the functions of the information processing apparatus 190.
The activation processing module 145 performs processing for activating the information processing apparatus 190. For this purpose, the activation program is read from the storage medium 165. However, since the activation program in the storage medium 165 is encrypted, it is necessary to decrypt it using the decryption module 135 and to extract the encryption key from the security chip 160.
The customer information processing module 150 performs processing related to the customer. For example, processing such as browsing and editing of an address book is performed. For this purpose, a customer information processing program and customer information are read from the storage medium 165. However, since the customer information processing program and customer information in the storage medium 165 are encrypted, it is necessary to decrypt them using the decryption module 135 and to extract the encryption key from the security chip 160.
The device processing module 155 performs processing for exhibiting the functions of the information processing apparatus 190. For example, when the information processing apparatus 190 is an image processing apparatus, there are printing processing (printing), image reading processing (scanning), fax processing, e-mail transmission processing, and the like. For that purpose, those programs and data are read from the storage medium 165. However, since the program and data in the storage medium 165 are encrypted, it is necessary to decrypt them using the decryption module 135, and it is necessary to take out the encryption key from the security chip 160.

FIG. 2 is an explanatory diagram showing a system configuration example using the present embodiment. The example shown in FIG. 2A shows an example of the hardware configuration.
The CPU 200 has an information processing module 100. As described above, it includes the execution of a program responsible for the function of the information processing module 100.
The security chip 160, the main memory 170, the CPU 200, the ROM 210, and the HDD 220 are connected via an internal bus 230, respectively. The storage medium 165 and the HDD 220 are connected.
Communication is performed between the CPU 200 and the main memory 170, the HDD 220, the ROM 210, and the security chip 160. Since the information (program, data) flowing through the internal bus 230 can be hacked by the bus probe described above, it is necessary to encrypt the information. Therefore, the encryption key is managed in the security chip 160. The communication between the CPU 200 and the security chip 160 is also performed by encrypted communication using Transport Protection. However, the encrypted communication takes time.

In an information processing apparatus, in an apparatus that needs to maintain high security, encryption keys are exchanged by encryption in accordance with the specifications of Transport Protection. However, if you want to prioritize the startup time, you can divide the partition according to required functions such as the program storage area in the storage medium 165, the customer information storage area, the print data expansion area, etc., and encrypt with separate encryption keys. I do.
Since the program storage area in the storage medium 165 needs to be accessed at the first activation, in the exchange of the encryption key between the CPU 200 and the security chip 160, the encryption key is acquired without performing the encrypted communication, The encryption of the data in the storage medium 165 is released and the data is transferred to the main memory 170.
For other areas, the encryption key is obtained from the security chip 160 through the transport protection while the decryption of the activation program or data and the transfer of the data to the main memory 170 are performed. By doing so, the startup time can be shortened.

In the example shown in FIG. 2B, the present embodiment is provided in the image processing apparatus 250 (the image processing apparatus 250 as the information processing apparatus 190). The image processing apparatus 250 has a CPU board 260. On the CPU board 260, a CPU 200, a security chip 160, a main memory 170, a ROM 210, an HDD 220, and an internal bus 230 are mounted.
When the image processing apparatus 250 is turned on, the activation program is read from the storage medium 165. However, since the encryption communication is not performed between the CPU 200 and the security chip 160, the startup is started earlier than when the encryption communication is performed. (The image processing apparatus 250 becomes usable). In addition, for customer information (for example, address book information) and image data that require high-level security measures, encryption communication is performed between the CPU 200 and the security chip 160. In particular, it is efficient to perform encrypted communication between the CPU 200 and the security chip 160 during the decryption of the activation program.

FIG. 3 is a flowchart showing an example of processing according to this embodiment.
In step S302, it is determined whether or not the activation program is read from the storage medium 165. If the activation program is read from the storage medium 165, the process proceeds to step S304. Otherwise, the process proceeds to step S314. For example, when the power is turned on, the process proceeds to step S304.
In step S304, an encryption key is acquired by general communication (non-encryption communication) with the security chip 160.
In step S306, the encrypted startup program is read from the partition 410 of the storage medium 165.
In step S308, the activation program is decrypted with the obtained encryption key.
In step S310, the decrypted activation program is transferred to the main memory 170.
In step S312, the activation program is executed.
In step S314, customer / image processing is performed. Detailed processing in step S314 will be described later using the flowchart shown in the example of FIG.

FIG. 4 is an explanatory diagram showing an example of a partition of the storage medium 165. For example, the storage medium 165 is divided into three application-specific partitions (partition 410, partition 420, partition 430), the partition 410 stores an encrypted startup program, and the partition 420 stores encrypted customer information. The customer information processing program and data are stored, and the image processing program and data are stored in the partition 430.
The HDD encryption processing table 500 associates an encryption key with each partition, and also associates a communication method between the CPU 200 and the security chip 160. FIG. 5 is an explanatory diagram showing an example of the data structure of the HDD encryption processing table 500. The HDD encryption processing table 500 has a partition column 510, an encryption key column 520, and a communication column 530. The partition column 510 stores information (partition ID) for uniquely identifying a partition according to the present embodiment. The encryption key column 520 stores the encryption key in the partition. The communication column 530 stores information on whether the communication between the CPU 200 and the security chip 160 for acquiring the encryption key of the partition is general communication or encryption communication. In this example, the partition A storing the activation program can be decrypted with the encryption key Ka, and general communication is performed between the CPU 200 and the security chip 160. In the other partitions (partition B, partition C), the respective encryption keys are associated with each other, indicating that encryption communication is performed between the CPU 200 and the security chip 160. The HDD encryption processing table 500 is stored in the security chip 160. In addition, a table including the partition column 510 and the communication column 530 may be stored in the communication processing module 105.

FIG. 6 is a flowchart showing a processing example (processing example of step S314) according to the present embodiment.
In step S602, it is determined whether the activation program is being decoded or transferred to the main memory 170. If the activation program is being decoded or transferred to the main memory 170, the process proceeds to step S604. In other cases, the process stands by until the activation program is being decrypted or transferred to the main memory 170.
In step S604, the CPU 200 acquires an encryption key by encrypted communication with the security chip 160.
In step S606, the encrypted customer information is read from the partition 420 of the storage medium 165.
In step S608, the customer information is decrypted with the acquired encryption key.
In step S610, customer processing is performed using the decrypted customer information.

In step S612, it is determined whether image processing is necessary. If image processing is necessary, the process proceeds to step S614; otherwise, the process ends (step S699). If it is the image processing apparatus 250, since image processing is necessary, the process proceeds to step S614.
In step S614, an encryption key is acquired by encrypted communication with the security chip 160.
In step S616, it is determined whether the image is read from or written to the storage medium 165. If the image is read, the process proceeds to step S618. If the image is written, the process proceeds to step S624.
In step S618, the encrypted image is read from the partition 430 of the storage medium 165.
In step S620, the image is decrypted with the acquired encryption key.
In step S622, image processing is performed on the decoded image.
In step S624, image processing is performed.
In step S626, the image is encrypted with the acquired encryption key.
In step S628, the encrypted image is written in the partition 430 of the storage medium 165.

The program described above may be provided by being stored in a recording medium, or the program may be provided by communication means. In that case, for example, the above-described program may be regarded as an invention of a “computer-readable recording medium recording the program”.
The “computer-readable recording medium on which a program is recorded” refers to a computer-readable recording medium on which a program is recorded, which is used for program installation, execution, program distribution, and the like.
The recording medium is, for example, a digital versatile disc (DVD), which is a standard established by the DVD Forum, such as “DVD-R, DVD-RW, DVD-RAM,” and DVD + RW. Standard “DVD + R, DVD + RW, etc.”, compact disc (CD), read-only memory (CD-ROM), CD recordable (CD-R), CD rewritable (CD-RW), Blu-ray disc ( Blu-ray (registered trademark) Disc), magneto-optical disk (MO), flexible disk (FD), magnetic tape, hard disk, read-only memory (ROM), electrically erasable and rewritable read-only memory (EEPROM (registered trademark)) )), Flash memory, Random access memory (RAM) SD (Secure Digital) memory card and the like.
Then, the whole or a part of the program may be recorded on the recording medium for storage or distribution. Also, by communication, for example, a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a wired network used for the Internet, an intranet, an extranet, or a wireless communication It may be transmitted using a transmission medium such as a network or a combination of these, or may be carried on a carrier wave.
Furthermore, the program may be a part or all of another program, or may be recorded on a recording medium together with a separate program. Moreover, it may be divided and recorded on a plurality of recording media. Further, it may be recorded in any manner as long as it can be restored, such as compression or encryption.

DESCRIPTION OF SYMBOLS 100 ... Information processing module 105 ... Communication processing module 110 ... Encryption communication module 115 ... Communication module 120 ... Control module 125 ... Encryption processing module 130 ... Encryption module 135 ... Decryption module 140 ... Processing module 145 ... Startup processing module 150 ... Customer information Processing module 155 ... Device processing module 160 ... Security chip 165 ... Storage medium 170 ... Main memory 190 ... Information processing device 200 ... CPU
210 ... ROM
220 ... HDD
230 ... Internal bus 250 ... Image processing device 260 ... CPU board

Claims (9)

When encryption communication is possible between the CPU and the security chip, and the security chip is used to decrypt the activation program in the storage medium, communication other than the encryption communication is performed with the security chip. An information processing apparatus having control means for controlling. 2. The control unit according to claim 1, wherein when the security chip is used to encrypt or decrypt information other than the startup program in the storage medium, the control unit performs control to perform cryptographic communication with the security chip. Information processing device. The information processing apparatus according to claim 2, wherein information other than the activation program includes customer information or a processing target, a processing result, or an intermediate processing result by the information processing apparatus. The information processing apparatus is an image processing apparatus, and includes an image that is a target of image processing by the image processing apparatus, an image processing result, or an intermediate processing result for image processing as the processing result or the intermediate processing result. Item 4. The information processing device according to Item 3. The storage medium is divided into a plurality of areas,
The information processing apparatus according to claim 1, wherein whether to perform encrypted communication is determined according to the area. The information processing apparatus according to claim 5, wherein a different encryption key is used for each area. The control means includes
When targeting the area where the startup program is stored, control to perform communication that is not encrypted communication,
The information processing apparatus according to claim 5, wherein control is performed so that encrypted communication is performed when another area is targeted. The control means performs encrypted communication for reading from the other area while performing the decryption process of the activation program or while transferring the decrypted activation program to the main memory. The information processing apparatus according to claim 7. Computer
When encryption communication is possible between the CPU and the security chip, and the security chip is used to decrypt the activation program in the storage medium, communication other than the encryption communication is performed with the security chip. An information processing program for functioning as a control means for controlling.

Images