JP2020154601A - Information processing device and its control method, and program - Google Patents

Abstract

To solve the problem that a function assigned to an SOC does not correctly operate when one SOC starts up abnormally, even when another SOC starts up normally, when a control system controlling an MFP is controlled by a plurality of SOCs.SOLUTION: An information processing device comprises at least first control means and second control means. When the information processing device is activated, the first control means instructs to the second control means to execute detection processing of alteration of a boot program executed by the second control means. When the result of the detection processing executed by the second control means in response to the instruction indicates that there is no alteration, the second control means is activated by the first control means. When the result of the detection processing indicates that there is the alteration, the first control means transmits the boot program executed by the second control means to the second control means.SELECTED DRAWING: Figure 6

Description

The present invention relates to an information processing device, a control method thereof, and a program.

In recent years, it has become important to address the problem of tampering with the firmware in information devices by exploiting security vulnerabilities (security holes) in information devices connected to the network. In MFPs (Multifunction Peripherals, hereinafter referred to as "multifunction devices"), cloud services are being developed while connected to a network, and information security measures are required.

Secure boot has been introduced as part of the security measures for that information. Secure boot is a technology that prevents the execution of firmware that has not been digitally signed or has been digitally signed but has been tampered with by a third party when the information device is started. By detecting the rewriting (tampering) of the boot loader in this way, checking whether it has been tampered with, and then starting it, it is possible to make unauthorized operation by a program modified by a third party impossible. For example, Patent Document 1 proposes a device configuration and a control method for repairing the firmware when an abnormality is detected in the firmware of the CPU.

JP-A-2014-179047

However, since the above-mentioned conventional method only detects an abnormality in the firmware, it cannot cope with the case where the boot program used at the time of starting the CPU (hereinafter, at the time of booting) is tampered with. Therefore, if the boot program is tampered with, it may behave abnormally.

Further, when the control system that controls the MFP is controlled by a plurality of SOCs (System On Chips), even if one SOC starts up normally, if the other SOCs start up abnormally, the SOC will start up. Problems such as the function in charge (for example, the image scanning function of the MFP) not working properly may occur.

An object of the present invention is to solve at least one of the problems of the prior art.

An object of the present invention is to provide a technique for solving the above problems by enabling an information processing device provided with a plurality of control means to be activated only when the plurality of control means are normally started. There is.

In order to achieve the above object, the information processing apparatus according to one aspect of the present invention has the following configuration. That is,
An information processing device having at least a first control means and a second control means.
When the information processing device is activated, the first control means instructs the second control means to execute a tampering detection process of the boot program executed by the second control means.
When the result of the detection process executed by the second control means in response to the instruction indicates that there is no falsification, the first control means activates the second control means.
When the result of the detection process indicates that the detection process has been tampered with, the first control means transmits a boot program executed by the second control means to the second control means.

According to the present invention, in an information processing device including a plurality of control means, the device can be activated only when the plurality of control means are normally started. If a certain control means cannot be started safely, the boot program of the control means can be repaired and started safely.

Other features and advantages of the present invention will become apparent in the following description with reference to the accompanying drawings. In the attached drawings, the same or similar configurations are designated by the same reference numbers.

The accompanying drawings are included in the specification, form a part thereof, show an embodiment of the present invention, and are used together with the description to explain the principle of the present invention.
The block diagram explaining the hardware configuration of the multifunction device which concerns on Embodiment 1. FIG. The block diagram explaining the software module which the multifunction device which concerns on Embodiment 1 has. The figure explaining the activation sequence. FIG. 3 is a block diagram illustrating each control configuration of the controller, scanner, and printer of the multifunction device according to the first embodiment. System configuration diagram including a server connected to a multifunction device via a network. The flowchart explaining the control process by the main controller of the multifunction device which concerns on Embodiment 1. The flowchart explaining the process by the scanner controller which concerns on Embodiment 1. The flowchart explaining the control process by the main controller of the multifunction device which concerns on Embodiment 2. The flowchart explaining the processing by the server which concerns on Embodiment 2 of this invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. The following embodiments do not limit the invention according to the claims. Although a plurality of features are described in the embodiment, not all of the plurality of features are essential to the invention, and the plurality of features may be arbitrarily combined. Further, in the attached drawings, the same or similar configurations are designated by the same reference numbers, and duplicate description is omitted. In the following embodiment, an example of the information processing device according to the present invention will be described by taking a multifunction device as an example.

[Embodiment 1]
FIG. 1 is a block diagram illustrating a hardware configuration of the multifunction device 100 according to the first embodiment.

The controller 110 has a hardware module for controlling the multifunction device 100. In the first embodiment, the controller 110 will be described as being configured as a semiconductor chip. The clock generation unit 103 generates a clock signal and supplies a clock signal (external clock) having a frequency suitable for each module of the multifunction device 100. In the first embodiment, the clock generation unit 103 supplies the clock signal 105 to the PLL (Phase Locked Loop) 123 in the controller 110. The frequency of the clock signal 105 can be changed by the clock control signal 107.

The clock control unit 121 controls the PLL 123 with the internal clock control signal 108. As a result, the PLL 123 multiplies the frequency of the clock signal 105 and supplies the frequency-multiplied clock signal to each module of the controller 110. The clock control unit 121 controls the PLL 123 to supply a clock (internal clock) having an optimum frequency to each module by changing the multiplication setting with respect to the PLL 123 when the controller 110 is started or operated. .. Further, the clock control unit 121 can gate the clock for each module to stop the supply of the clock signal.

The reset generation unit 104 is a semiconductor chip that resets and releases each module of the multifunction device 100 by generating and outputting a reset signal 106. Although only the reset signal 106 supplied to the controller 110 is shown in FIG. 1, it is assumed that it is also connected to modules such as the flash memory 145, the LED 147, the scanner 141, and the printer 142.

When the power of the multifunction device 100 is turned on, the reset state of the reset signal 106 is held for a certain period of time (for example, until the supply power supply voltage stabilizes), and then the reset signal 106 is released to release the reset of the controller 110. .. The state in which the reset signal 106 is asserted is the reset state, and the state in which the reset signal 106 is deasserted is the release state of the reset signal 106. When the reset of the controller 110 is released, the reset control unit 122 performs reset control of each module inside the controller 110. This reset control refers to the control that puts each module in the reset state or the reset release state when the controller 110 is started or operated.

The CPU 101 executes the software program of the multifunction device 100 and controls the entire device. The RAM 102 is a volatile random access memory used for temporarily storing programs and data when the CPU 101 controls the multifunction device 100. HDD 144 is a hard disk drive and stores some applications and various data. The HDD 144 stores a Java program 214 (FIG. 2) executed by the CPU 101. The Java program 214 will be described later (hereinafter, the same applies to the BIOS 210 and the like). The flash memory 145 stores fixed parameters and the like of the multifunction device 100. Further, the flash memory 145 stores the BIOS 210 (FIG. 2) executed by the CPU 101. Further, the flash memory 145 stores the loader 211 executed by the CPU 101, the kernel 212, and the Native program 213 (all of FIG. 2). The HDD 144 and the flash memory 145 may be the same storage module.

The CPU 111 executes a falsification detection software program that detects falsification of the software program executed by the CPU 101, and also shares a part with the CPU 101 to control a part of the multifunction device 100. The ROM 112 is a non-volatile read-only memory, and stores a tampering detection software program executed by the CPU 111, a public key described later, and the like. Further, the ROM 112 stores a boot program 209 executed by the CPU 111. Here, the ROM 112 is composed of a mask ROM configured by a logic circuit so as not to be rewritten from an external I / F, or an OTP (One Time Programmable) ROM that can be written only once at the time of manufacture. The RAM 113 is a volatile random access memory, and is used for storing programs and temporary data when the CPU 111 controls the multifunction device 100. The RAM 102 and the RAM 113 may be the same module.

The power supply control unit 120 is an IC (Integrated Circuit) that controls the power supply to each module of the controller 110. When the controller 110 (multifunction device 100) is started or operated, a predetermined electric power can be supplied to or stopped from each module unit. The scanner I / F control unit 131 controls the scanning of the original by the scanner 141. The printer I / F control unit 132 controls printing processing and the like by the printer 142. The panel control unit 133 controls the touch panel type operation panel 143 to display various information and receive input of instructions from the user. The HDD control unit 134 controls the HDD 144 to read and write data. For example, the image data stored in the RAM 102 can be stored in the HDD 144 via the system bus 109. The flash memory control unit 135 controls reading and writing data to and from the flash memory 145. The flash memory control unit 135 reads the program stored in the flash memory 145 and expands it to the RAM 113 via the system bus 109. The network I / F control unit 136 controls the transmission and reception of data with other devices and servers on the network 146. The external port control unit 137 is an input / output port control unit of the controller 110. For example, by controlling the output port, the LED 147 can be turned on as needed, and an abnormality in software or hardware can be transmitted to the outside. The image processing unit 138 is a processing unit that performs shading correction on the image data obtained by scanning the original with the scanner 141, and performs halftone processing and smoothing processing for outputting to the printer 142. The system bus 109 connects each module connected to the system bus 109 to each other. Control signals from the CPU 101 and the CPU 111 and data signals between the devices are transmitted and received via the system bus 109.

FIG. 2 is a block diagram illustrating a software module included in the multifunction device 100 according to the first embodiment. These softwares will be described as being executed by the CPU 101 or the CPU 111.

The communication management unit 207 controls the network I / F control unit 136 connected to the network 146, and transmits / receives data to / from the outside via the network 146. The UI control unit 203 receives the instruction content input to the operation panel 143 via the panel control unit 133, performs processing according to the input, and outputs a screen to the operation panel 143.

The boot program 209 is a program executed by the CPU 111 when the power of the multifunction device 100 is turned on, and executes a boot sequence for the controller 110 as a process related to booting. This boot program 209 has a BIOS tampering detection unit 201 that detects tampering with the BIOS 210. The BIOS 210 is a program executed by the CPU 101 after the boot program 209 is executed by the CPU 111, and has a loader tampering detection unit 202 that detects tampering with the loader 211 in addition to performing processing related to startup.

The loader 211 is a program executed by the CPU 101 after the processing of the BIOS 210 is completed, and has a kernel tampering detection unit 204 that detects kernel tampering in addition to performing processing related to booting. The kernel 212 is a program executed by the CPU 101 after the processing of the loader 211 is completed, and has a program tampering detection unit 205 that detects tampering with the Native program 213 in addition to performing processing related to startup.

The Native program 213 is a program executed by the CPU 101, and has a plurality of programs that provide each function in cooperation with the Java program 214 of the multifunction device 100. These plurality of programs include, for example, a program for controlling the scanner IF control unit 131 and the printer IF control unit 132, a start program, and the like. This boot program is called from the Native program 213 by the kernel 212 to perform the boot process. Further, the Native program 213 has a Java program tampering detection unit 206 that detects tampering with the Java program as one of the programs. The Java program 214 is a program executed by the CPU 101, and is a program that provides each function in cooperation with the Native program 213 of the multifunction device 100 (for example, a program that displays a screen on the operation panel 143).

Next, the activation sequence of the multifunction device will be described with reference to FIG.

FIG. 3A is a schematic start-up sequence diagram showing the order in which the multifunction devices are started without detecting falsification.

The boot program boots the BIOS, the BIOS boots the loader, the loader boots the kernel, and the kernel launches the boot program from within the Native program. Then, the Java program is started in the start program, and thereafter, the Native program and the Java program cooperate to provide each function of the multifunction device.

FIG. 3B is a schematic diagram of a boot sequence showing the flow of processing in which the boot program 209 to the BIOS 210, the loader 211, the kernel 212, the Native program 213, and the Java program 214 each perform tampering detection. In the figure, the storage location of each program, the digital signature (hereinafter, simply referred to as "signature") and the storage location of the public key are also shown.

Here, the signature is, for example, a legitimate program (data string) converted into a hash value (message digest) by a predetermined hash function, and the hash value is encrypted with a private key corresponding to the public key. The hash value of a legitimate program is obtained by decrypting this encrypted hash value with a public key. Then, the program to be verified for falsification is converted into a hash value by the above-mentioned hash function. Then, these two hash values are compared. Then, if the two hash values are equal, it can be determined that the program to be verified has not been tampered with from the regular program. On the other hand, if the two hash values do not match, it can be determined that the program to be verified has been tampered with from the legitimate program.

The method of checking for falsification of the program to be verified by using the signature in this way is hereinafter referred to as "signature verification". Also, if the program has not been tampered with (the program to be verified is legitimate), it is said that the signature verification is successful, and if the program has been tampered with (the program to be verified is not legitimate), it is called successful. Called signature verification failed.

In the first embodiment, as a method of determining whether or not the program has been tampered with, a method using such a signature and a public key is adopted, but another method of determining whether or not the program has been tampered with may be used.

The ROM 112 includes a public key 300 for BIOS signature verification in addition to the boot program 209.

In addition to the BIOS 210, the loader 211, the kernel 212, the Native program 213, and the Java program 214, the flash memory 145 also includes the following. The encrypted BIOS signature 302, the loader verification public key 303, the encrypted loader signature 304, the kernel verification public key 305, the encrypted kernel signature 306, and the Native program verification public key 307. Further, the encrypted Native program signature 308, the Java program verification public key 309, and the encrypted Java program signature 310 are also stored in the flash memory 145. It is assumed that these public keys and signatures are given to the program in advance at the stage of manufacturing the multifunction device 100.

The tampering detection units 201, 202, 204, 205, 206 verify whether the program to be started next has been tampered with, and if the program has not been tampered with, start the program. In this way, the multifunction device 100 starts according to the start sequence in which the program tampering detection and the program start are sequentially performed.

As described above, falsification of the boot program of the controller 110 that manages the operation of the entire multifunction device is detected. In the first embodiment, not only the tampering of the boot program of the controller 110 is detected, but also each controller that controls the operation of the scanner 141 and the printer 142 will be described with an example of detecting the tampering of the boot program. In the following, for the sake of simplicity, only the tampering detection of the boot program that is started first by each program will be described.

FIG. 4 is a block diagram illustrating each control configuration of the controller 110, the scanner 141, and the printer 142 of the multifunction device 100 according to the first embodiment. In the controller 110, the display is omitted for those that do not need to be described here.

The controller 110 stores a plurality of the same boot programs in the ROM 112. When the CPU 111 detects tampering with the boot program, it detects tampering with the first boot program stored in a predetermined location. When it is detected that the first boot program has been tampered with, tampering is detected for the second boot program. If it is detected that the second boot program has not been tampered with, it is repaired by overwriting the first boot program with the second boot program.

As a result, the controller 110 can be started safely. In the embodiment, a control method that detects tampering with the boot program, repairs it with a second boot program if it has been tampered with, and causes the controller 110 to start up safely is called secure boot.

The scanner 141 includes a scanner controller 41 and a scanner engine 441. The scanner engine 441 is a part that actually reads a document and generates digital data. The scanner controller 41 is connected to the controller 110 via the scanner I / F control unit 131. Like the controller 110, the scanner controller 41 has two CPUs, a CPU 411 that controls the entire scanner controller 41 and a CPU 413 that detects tampering with the boot program for the scanner controller. The CPU 411 uses the RAM 412 to execute the boot program loaded from the non-volatile memory 414. The CPU 413 uses the RAM 415 to detect tampering with the boot program read from the non-volatile memory 414. The scanner control unit 416 connects the scanner controller 41 and the scanner engine 441 to receive digital data from the scanner engine 441 and exchange operation control signals of the scanner engine 441.

The printer 142 has a printer controller 42 and a printer engine 442. The printer engine 442 receives the digital data and actually forms an image on the paper. The printer controller 42 is connected to the controller 110 via the printer I / F control unit 132. Like the controller 110, the printer controller 42 has two CPUs, a CPU 421 that controls the entire printer controller 42 and a CPU 423 that detects tampering with the boot program for the printer controller. The CPU 421 uses the RAM 422 to execute the boot program loaded from the non-volatile memory 424. The CPU 423 uses the RAM 425 to detect tampering with the boot program read from the non-volatile memory 424. The printer control unit 426 connects the printer controller 42 and the printer engine 442, transmits digital data to the printer engine 442, and exchanges operation control signals of the printer engine 442.

Here, only one boot program is stored in the non-volatile memory 414 of the scanner controller 41 and the non-volatile memory 424 of the printer controller. This is because the capacity of each memory can be reduced by limiting the number of stored programs, and the cost of the entire multifunction device 100 can be reduced.

On the other hand, in the multifunction device 100 having such a configuration, if the boot program stored in each non-volatile memory of the scanner controller 41 or the printer controller 42 is tampered with, there is a high possibility that the scanner 141 or the printer 142 cannot operate correctly. .. Therefore, if the boot program has been tampered with, the scanner operation and the printer operation cannot be performed, so that some functions are suspended or the entire multifunction device 100 is suspended.

Even in such a case, a method for repairing the boot program and starting it safely will be described below with reference to FIGS. 5, 6 and 7. The controller 110 is referred to as a main controller for the sake of simplicity.

FIG. 5 is a system configuration diagram including a server 500 connected to the multifunction device 100 via a network.

In FIG. 5, since the main controller 110 resets and releases the scanner controller 41, it is necessary to start up first. Further, it is assumed that the main controller 110 stores a plurality of boot programs in the ROM 112 and is safely started by the secure boot control.

FIG. 6 is a flowchart illustrating a control process by the main controller 110 of the multifunction device 100 according to the first embodiment, and the process shown in this flowchart is executed by the CPU 101 or the CPU 111. Which control is performed by which CPU will be described each time.

First, in S601, the CPU 111 detects tampering with the boot program for the main controller 110. Next, the process proceeds to S602 to start the CPU 101 to execute various programs, and thereafter, the main controller 110 is safely operated by the CPU 101.

Proceeding to the next S603, the CPU 101 transmits a notification instructing the scanner controller 41 to start tampering detection. At this time, the scanner controller 41 is in the reset state, and the reset control unit (not shown) activates only the CPU 413 of the scanner controller 41 by the start notification of the tampering detection. In this way, the CPU 413 starts the tampering detection operation of the boot program stored in the non-volatile memory 414. At this time, the CPU 411 of the scanner controller 41 is still in the reset state. Next, proceed to S604 and wait for a completion notification indicating that the scanner controller 41 has not detected tampering, or whether a notification indicating that the scanner controller 41 has detected tampering with the boot program in S605 has arrived. ..

FIG. 7 is a flowchart illustrating processing by the scanner controller 41 according to the first embodiment, which is executed by the internal CPU 413 unless otherwise specified. Next, the operation of the scanner controller 41 will be described with reference to the flowchart of FIG. 7.

This process is started when the reset of the CPU 413 is released in the scanner controller 41 and the execution of the falsification detection process by the scanner controller 41 is instructed in S603 of FIG. First, in S701, the CPU 413 reads the boot program stored at the predetermined address of the non-volatile memory 414, and detects tampering with the boot program. Next, the process proceeds to S702, and the CPU 413 determines whether or not the boot program has been tampered with. If the CPU 413 determines in S702 that the boot program has not been tampered with, the process proceeds to S710, and the CPU 413 notifies the main controller 110 that the boot program has not been tampered with, and ends this process. This notification is received by the main controller 110 in S604 of FIG.

On the other hand, if the CPU 413 determines in S702 that the boot program has been tampered with, the process proceeds to S703 and the CPU 413 notifies the main controller 110 that the boot program has been tampered with. This is received by the main controller 110 in S605 of FIG. Then, in S704, the CPU 413 waits for the reception of the boot program transmitted from the main controller 110 in S608 of FIG.

Next, in the flowchart of FIG. 6, the CPU 101 of the main controller 110 determines in S605 whether or not it has received a notification from the scanner controller 41 that the boot program has been tampered with, and when it receives a notification that the tampering has been detected, S606. If not, proceed to S604.

In S606, the CPU 101 creates the boot program identification information based on the notification that the tampering of the boot program has been detected. The boot program identification information includes information on which scanner controller the boot program tampering occurred. The first embodiment shows, for example, that the notification from the scanner controller 41 is the boot program of the scan controller 41, and if a plurality of scanner controllers are connected, it is the boot program of the scanner controller.

Next, the process proceeds to S607, and the CPU 101 reads and acquires the corresponding boot program stored in advance in the predetermined location of the HDD 144 based on the identification information of the boot program created in S606. At this time, the location information and the data length information of the boot program stored in advance in the HDD 144 are prepared in the program executed by the CPU 101 in association with the boot program identification information. Therefore, the CPU 101 refers to these to acquire the boot program for the scanner controller 41 from the HDD 144. Then, the process proceeds to S608, and the CPU 101 transmits the boot program acquired in S608 to the scanner controller 41. After that, in S609, the CPU 101 waits for the scanner controller 41 to receive the verification result of whether or not the transmitted boot program has been tampered with, and when it receives the notification that it has not been tampered with, proceeds to S611 and proceeds to the scanner controller 41. Allows the startup of and ends this process. On the other hand, if the verification result is not received, the process proceeds to S610, it is determined whether or not the verification result that the boot program transmitted in S608 has been tampered with has been received, and if such a verification result is not received, the process proceeds to S609. When the verification result that the transmitted boot program has been tampered with is received in S610, the process proceeds to S612, error processing is performed, and this processing is terminated.

Next, in the flowchart of FIG. 7, the CPU 413 of the scanner controller 41 determines in S704 and in S608 of FIG. 6 whether or not the boot program transmitted from the main controller 110 has been received. Then, when the boot program is received, the process proceeds to S705, and the CPU 412 performs the tampering detection process of the boot program in the same manner as in S701. Then, the process proceeds to S706, and the CPU 413 determines whether or not the boot program has been tampered with. Repair the boot program. The repair of the boot program is to overwrite the boot program of the non-volatile memory 414 determined to have been tampered with in S702 with the boot program received in S704. Next, in S708, the CPU 413 notifies the main controller 110 of the completion of the tampering detection, and the boot program tampering detection operation control on the scan controller 41 side ends. On the other hand, the process proceeds to S706, and when the CPU 413 determines that the boot program has been tampered with, the process proceeds to S709, and the CPU 413 executes an error process and ends this process.

Next, in the flowchart of FIG. 6, when the CPU 101 of the main controller 110 receives the notification in S609 that the boot program transmitted from the scanner controller 41 in S708 of FIG. 7 has not been tampered with, the process proceeds to S611. In S611, the CPU 101 determines that the tampering detection process of the scanner controller 41 is completed, releases the reset of the CPU 411 of the scanner controller 41, and the scanner controller 41 starts up safely.

If it is determined in S706 that the boot program acquired in S705 has been tampered with, an error state occurs in S709, and the scanner controller 41 notifies the main controller 110 of the error. In this case, although not shown in FIG. 6, the main controller determines that the HDD 144 is being used illegally, prohibits access to the HDD 144, and displays an error on the operation panel 143, and the multifunction device 100 You may notify the user that the is not available.

As described above, according to the first embodiment, the main controller, the scanner controller, and the HDD connected to the main controller are used to execute the secure boot control of the boot program used at the time of booting, and the multifunction device starts up safely. It becomes possible.

In the first embodiment, in order to simplify the explanation, the scanner controller 41 is described to perform the secure boot control of the boot program, but it goes without saying that the print controller 42 can also perform the same secure boot control. Further, the configuration / control may be such that secure boot control can be performed by both the scanner controller 41 and the print controller 42.

[Embodiment 2]
A second embodiment in which the location for acquiring the boot program for the scanner controller is different from that of the first embodiment will be described with reference to FIGS. 5, 7, 8 and 9.

FIG. 8 is a flowchart illustrating a control process by the main controller 110 of the multifunction device 100 according to the second embodiment, and the process shown in this flowchart is executed by the CPU 101 or the CPU 111. Which control is performed by which CPU will be described each time. Note that, in FIG. 8, the same processing as in FIG. 6 described above is designated by the same reference numerals, and the description thereof will be omitted.

FIG. 9 is a flowchart illustrating processing by the server 500 according to the second embodiment. When the scanner controller 41 receives the notification that the boot program has been tampered with in S605 of FIG. 8, the process proceeds to S606, and the boot program identification information is created based on the notification of the boot program tampering detection. The boot program identification information includes information on which scanner controller the boot program has been tampered with. In the second embodiment, for example, if it is from the scanner controller 41, the identification information indicates the boot program of the scan controller 41, and if a plurality of scanner controllers are connected, it is the boot program of the scanner controller that has detected the alteration. Show that.

Next, the process proceeds to S801, and the CPU 101 transmits the identification information of the created boot program to the server 500. At this time, the server 500 and the main controller 110 are connected by a network 146, but since the main controller 110 has already been started safely, the server 500 is booted by a secure communication method such as SSL communication. The program identification information is transmitted.

It is assumed that the server 500 stores the boot program associated with the acquired boot program identification information in the storage means. For example, the boot program for the scanner controller 41 is stored for the identification information of the boot program created by the factor of the scanner controller 41. Further, the boot program for the printer controller 42 is stored in the identification information of the boot program created by the factor of the printer controller 42. Further, the server 500 may be configured to store various boot programs of a multifunction device of a model different from the multifunction device 100 described in the second embodiment, and the boot program identification information caused by the multifunction device 100 is different. It is different from the identification information of the boot program of the multifunction device of the model. Therefore, based on the identification information of each boot program, one boot program stored in association with the identification information can be specified.

FIG. 9 is a flowchart illustrating processing by the server 500 according to the second embodiment of the present invention.

The server 500 determines in S901 whether or not the boot program is inquired from the multifunction device 100. Here, when the identification information of the boot program is received from the multifunction device 100, the transition to S902 occurs. In S902, the server 500 analyzes the received identification information of the boot program, and determines that the device has been transmitted from the multifunction device 100, the type of the boot program, and the like. As a result, the target boot program is uniquely identified. Next, the process proceeds to S903, and the server 500 reads the corresponding boot program from a storage means (not shown) connected to the server 500. Then, the process proceeds to S904, and the server 500 transmits the read boot program to the multifunction device 100 via the network 146. Also at this time, it is assumed that the transmission is performed by a secure communication method such as SSL communication.

As a result, in the flowchart of FIG. 8, during this period, the main controller 110 is cooking in S802 until the boot program for the scanner controller 41 is transmitted from the server 500. Then, when the CPU 101 receives the boot program for the scanner controller 41 from the server 500, it proceeds from S802 to S608, and transmits the received boot program to the scanner controller 41. After that, in S609, the verification result of whether the tampering detection of the boot program from the scanner controller 41 is completed, or in S610, the transmitted boot program has been tampered with is awaited.

Since the processing of the scanner controller 41 in this case is the same as that of the first embodiment, the description thereof will be omitted.

As described above, according to the second embodiment, the secure boot control of the boot program used at the time of booting is executed by using the main controller, the scanner controller, and the server connected via the network, and the multifunction device stands safely. It will be possible to raise it.

In the first embodiment, in order to simplify the explanation, the scanner controller 41 is described to perform the secure boot control of the boot program, but it goes without saying that the print controller 42 can also perform the same secure boot control. Further, the configuration / control may be such that secure boot control can be performed by both the scanner controller 41 and the print controller 42.

If the boot program stored in the HDD has been tampered with as in the first embodiment, it is highly likely that there is no boot program that can be safely booted by the multifunction device. Therefore, the second embodiment provides a configuration in which a boot program stored in a server with higher security is received and started more safely.

(Other embodiments)
The present invention supplies a program that realizes one or more functions of the above-described embodiment to a system or device via a network or storage medium, and one or more processors in the computer of the system or device reads and executes the program. It can also be realized by the processing to be performed. It can also be realized by a circuit (for example, ASIC) that realizes one or more functions.

The present invention is not limited to the above embodiments, and various modifications and modifications can be made without departing from the spirit and scope of the present invention. Therefore, in order to make the scope of the present invention public, the following claims are attached.

41 ... Scanner controller, 42 ... Printer controller, 100 ... Multifunction device, 101, 111 ... CPU (controller), 110 ... Controller, 414, 424 ... Non-volatile memory

Claims (11)

An information processing device having at least a first control means and a second control means.
When the information processing device is activated, the first control means instructs the second control means to execute a tampering detection process of the boot program executed by the second control means.
When the result of the detection process executed by the second control means in response to the instruction indicates that there is no falsification, the first control means activates the second control means.
When the result of the detection process indicates that the detection process has been tampered with, the first control means is an information processing device that transmits a boot program executed by the second control means to the second control means. The first control means further activates the second control means by the first control means when the result of the tampering detection process of the boot program transmitted to the second control means indicates that there is no tampering, and the detection The information processing apparatus according to claim 1, wherein if the result of the processing indicates that the processing has been tampered with, the error processing is executed. The second control means has a first storage means that non-volatilely stores the boot program executed by the second control means.
The information processing device according to claim 1, wherein the second control means executes a falsification detection process of the boot program stored in the first storage means in response to the instruction. The first control means has a second storage means that non-volatilely stores the boot program executed by the second control means.
When the result of the detection process indicates that the detection process has been tampered with, the first control means transmits the boot program read from the second storage means and executed by the second control means to the second control means. The information processing apparatus according to claim 1. When the result of the detection process indicates that the detection process has been tampered with, the first control means receives a boot program executed by the second control means received from a server connected to the information processing apparatus via the network. The information processing apparatus according to claim 1, wherein the information processing device is transmitted to a control means. When the result of the detection process indicates that the detection process has been tampered with, the first control means generates identification information of the boot program executed by the second control means, and controls the boot program corresponding to the identification information in the second control. The information processing apparatus according to any one of claims 1 to 5, wherein the information processing apparatus is transmitted to a means. The first control means has a non-volatile memory that cannot be written, which stores a program for causing the first control means to execute a process performed on the second control means. The information processing device according to any one item. When the first control means transmits a boot program executed by the second control means to the second control means when the result of the detection process indicates that the boot program has been tampered with, the second control means further causes the boot program. The information processing apparatus according to any one of claims 1 to 7, wherein the falsification detection process of the above is executed. A control method for controlling an information processing device having at least a first control means and a second control means.
When the information processing apparatus is activated, the first control means instructs the second control means to execute a process of detecting falsification of a boot program executed by the second control means.
When the result of the detection process executed by the second control means in response to the instruction indicates that there is no tampering, the first control means has a step of activating the second control means.
When the result of the detection process indicates that the detection process has been tampered with, the first control means has a step of transmitting a boot program executed by the second control means to the second control means.
A control method characterized by having. When the first control means transmits a boot program executed by the second control means to the second control means when the result of the detection process indicates that the detection process has been tampered with in the transmission step, the second control means The control method according to claim 9, further comprising a step of detecting falsification of the boot program. A program for causing a computer to execute each step of the control method according to claim 9 or 10.

Images