WO2018092289A1 - Dispositif de traitement d'informations - Google Patents

Dispositif de traitement d'informations Download PDF

Info

Publication number
WO2018092289A1
WO2018092289A1 PCT/JP2016/084386 JP2016084386W WO2018092289A1 WO 2018092289 A1 WO2018092289 A1 WO 2018092289A1 JP 2016084386 W JP2016084386 W JP 2016084386W WO 2018092289 A1 WO2018092289 A1 WO 2018092289A1
Authority
WO
WIPO (PCT)
Prior art keywords
program
update
information processing
processing apparatus
update file
Prior art date
Application number
PCT/JP2016/084386
Other languages
English (en)
Japanese (ja)
Inventor
嘉昭 植村
智恒 浜野
矢野　義博
篤浩 佐橋
Original Assignee
大日本印刷株式会社
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 大日本印刷株式会社 filed Critical 大日本印刷株式会社
Priority to JP2018550982A priority Critical patent/JP6741236B2/ja
Priority to PCT/JP2016/084386 priority patent/WO2018092289A1/fr
Publication of WO2018092289A1 publication Critical patent/WO2018092289A1/fr

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Definitions

  • the present invention relates to an information processing apparatus, and more particularly, to an information processing apparatus having a function of updating a program using an update file obtained from an external device.
  • General information processing devices realize various information processing functions by software.
  • the information processing apparatus incorporates an OS program and an application program, and also incorporates a program closely related to hardware called firmware. All of these programs can be rewritten by updating. Therefore, in many information processing apparatuses, new functions are added or bugs are corrected by updating the program (updating the contents of the program) as necessary.
  • Patent Document 1 a device driver or utility software program incorporated in a peripheral device such as a fax machine, a scanner, or a printer connected to a host computer is based on an instruction from the computer side.
  • a technique for performing update is disclosed.
  • Patent Document 2 discloses a technique for performing a batch update on a plurality of information processing apparatuses via the Internet.
  • Patent Document 3 discloses an information processing apparatus installed in a home.
  • a system is disclosed in which an update execution instruction is given using a mobile phone and efficient update is performed via the Internet.
  • an update to a program incorporated in an information processing apparatus is usually performed by obtaining an update file from an external apparatus connected via the network.
  • the information processing apparatus is connected to an external update server, and an update file necessary for the update is distributed from the update server to the information processing apparatus.
  • the update program included in is executed.
  • the update file is distributed by sending a distribution request from the information processing device to the update server (Pull type distribution).
  • the update server voluntarily distributes to the information processing device (Push).
  • Push the information processing device
  • an object of the present invention is to provide an information processing apparatus capable of updating in a secure environment.
  • an information processing apparatus including a CPU, a memory, and an external communication unit.
  • First OS program and second OS program to be executed by CPU in memory
  • first attribute application program to be executed by CPU under management of first OS program
  • second OS program A second attribute application program to be executed by the CPU
  • a hypervisor program for performing processing for causing the CPU to execute the first OS program and the second OS program in parallel
  • the first attribute application program includes a first management program for managing update processing
  • the second attribute application program includes a second management program for managing update processing.
  • the memory storage area is provided with a shared memory area that can be accessed both under the management of the first OS program and under the management of the second OS program,
  • the external communication means has a function of receiving an encrypted update file transmitted from an external device and encrypted using a predetermined encryption key under the management of the first OS program,
  • the first management program executes a process of writing the encrypted update file received by the external communication means into the shared memory area;
  • the second management program reads the encrypted update file written in the shared memory area, and decrypts the encrypted update file by using the encryption key or the encryption key related to the encryption key.
  • a decryption process to be generated is executed, and a process to write the generated decryption update file in a predetermined storage location is executed.
  • the first management program When the first management program receives an encrypted update file for executing an update process for the first OS program or the application program having the first attribute, the received encrypted update file is stored in the shared memory. Write to the area, The second management program generates a decrypted update file by decrypting the encrypted update file, and writes the decrypted update file in a predetermined storage location. The CPU executes an update program included in the decrypted update file, thereby performing update processing on the first OS program or the application program having the first attribute.
  • volatile memory and nonvolatile memory are built-in, Volatile memory is used as a work area when the CPU executes a program, The nonvolatile memory stores the first OS program, the second OS program, the first attribute application program, the second attribute application program, and the hypervisor program. It is.
  • the volatile memory has a shared memory area
  • the first management program executes a process of writing the encrypted update file to the shared memory area in the volatile memory
  • the second management program executes a process of writing the decryption update file to the shared memory area in the volatile memory
  • the CPU reads the update program contained in the decrypted update file from the volatile memory, and executes the update program to execute the update process.
  • a shared memory area is provided in the nonvolatile memory
  • the first management program executes a process of writing the encrypted update file to the shared memory area in the nonvolatile memory
  • the second management program executes a process of writing the decryption update file to the shared memory area in the nonvolatile memory
  • the CPU reads the update program included in the decrypted update file from the nonvolatile memory and executes it to perform the update process.
  • a shared memory area is provided in both the volatile memory and the nonvolatile memory
  • the first management program executes a process of writing the encrypted update file to the shared memory area in the volatile memory
  • the second management program executes a process of writing the decryption update file to the shared memory area in the nonvolatile memory
  • the CPU reads the update program included in the decrypted update file from the nonvolatile memory and executes it to perform the update process.
  • a seventh aspect of the present invention in the information processing apparatus according to the third aspect described above, Provide a shared memory area in volatile memory,
  • the information processing apparatus is equipped with a non-volatile external memory and has a function of writing and reading information to and from the external memory.
  • At least a part of the storage area of the external memory is a common access area that can be accessed both under the management of the first OS program and under the management of the second OS program.
  • the first management program executes a process of writing the encrypted update file to the shared memory area in the volatile memory
  • the second management program executes a process of writing the decryption update file to the common access area of the external memory
  • the CPU reads the update program included in the decrypted update file from the common access area of the external memory, and executes the update program to execute the update process.
  • the information processing apparatus in the information processing apparatus according to the third aspect described above, Provide a shared memory area in volatile memory,
  • the information processing apparatus is equipped with a non-volatile external memory and has a function of writing and reading information to and from the external memory under the control of the first OS program.
  • the first management program executes a process of writing the encrypted update file to the shared memory area in the volatile memory
  • the second management program executes a process of writing the decryption update file to the shared memory area in the volatile memory
  • the first management program reads the decryption update file written in the shared memory area in the volatile memory, and then executes a process of writing it to the external memory.
  • the CPU reads the update program included in the decrypted update file from the external memory and executes it to perform update processing.
  • identification information for specifying the information processing device or the user of the information processing device is recorded,
  • the external communication means has a function of receiving an encrypted update file encrypted using the encryption key generated using the identification information,
  • the second management program decrypts the encrypted update file using the encryption key generated using the identification information.
  • a first area and a second area are defined,
  • the first OS program and the application program with the first attribute can only access the first area, and the second OS program and the application program with the second attribute are in the first area and the second area. Access to both is possible.
  • An eleventh aspect of the present invention is the information processing apparatus according to the tenth aspect described above,
  • the encryption key used for the decryption process by the second management program or information used for generating the encryption key is stored in the second area of the nonvolatile memory.
  • the first management program or the second management program executes a process of writing the update program included in the decrypted update file into the storage location for storing the boot program that the information processing apparatus executes at startup ,
  • the CPU executes the update process by executing the update program at the time of startup.
  • the first management program or the second management program executes a process of writing the update program included in the decrypted update file to a storage location accessible under the management of the first OS program,
  • the CPU executes the update process by executing the update program under the control of the first OS program.
  • the application program of the first attribute includes a VPN opening application that performs processing for opening a VPN communication path with an external device,
  • the external communication means receives the encrypted update file via the VPN communication path.
  • the first management program is incorporated in the first OS program, or the second management program is incorporated in the second OS program, or both.
  • a computer program including both the first management program and the second management program in the information processing apparatus according to the first to fourteenth aspects described above is provided as an independent product. It is what you do.
  • a seventeenth aspect of the present invention is a home gateway apparatus including the information processing apparatus according to the first to fifteenth aspects described above.
  • two systems of OS programs are executed in parallel by the hypervisor program.
  • the encrypted update file transmitted from the external device is received and delivered under the management of the second OS program.
  • it is decrypted under the management of the second OS program, and a decrypted update file is created.
  • the decryption of the encrypted update file is performed not under the management of the first OS program but under the management of the second OS program, the execution under the management of the first OS program should be performed. Even if the environment is infected with malware, the decryption process of the encrypted update file can escape from the influence of the malware. For this reason, it becomes possible to update in a secure environment.
  • FIG. 3 is a block diagram showing some examples of a method for delivering an update file in the embodiment shown in FIG. 1 or FIG. 2.
  • FIG. 5 is a block diagram showing still another example of a method for delivering an update file in the embodiment shown in FIG. 1 or FIG. 2.
  • FIG. 5B is a flowchart showing a procedure of update processing in the embodiment shown in FIG.
  • FIG. 1 is a block diagram showing configurations of an information processing apparatus 100 and an external apparatus 200 according to a basic embodiment of the present invention.
  • the information processing apparatus 100 is an electronic device such as a personal computer, a smartphone, or a tablet terminal, and may be any apparatus as long as the CPU can perform an information processing function by executing a program.
  • a device such as a home gateway device that is not normally operated by the user may be used (see ⁇ 5 described later).
  • the information processing apparatus 100 includes a CPU 110, a memory 120, and an external communication unit 130.
  • a display device an input device such as a keyboard and a mouse, various sensors, and the like are provided as necessary, but only the components directly related to the configuration of the present invention are shown here. .
  • the first OS program Pa and the second OS program Pb to be executed by the CPU 110, and the first attribute application programs AP1, AP2 to be executed by the CPU 110 under the management of the first OS program Pa.
  • Ma a second attribute application program Mb that is executed by the CPU 110 under the control of the second OS program, and a hypervisor program that performs processing for causing the CPU 110 to execute the first OS program Pa and the second OS program Pb in parallel Ph is stored.
  • a general information processing apparatus with a built-in CPU can fulfill various processing functions by executing various application programs under the control of a specific OS program.
  • one information processing apparatus often incorporates a set of OS programs and application programs that operate under the management of the OS programs.
  • it is devised to incorporate and use a plurality of OS programs.
  • two sets of OS programs are installed in advance, one of them is selected and booted at startup, or a virtual machine is constructed under the operating environment of the first OS program, and the second OS
  • a method for emulating the operation of a program has been put into practical use.
  • the hypervisor program Ph is also a program prepared for operating a plurality of OS programs in one information processing apparatus, and has a function of directly operating on hardware, and the plurality of OS programs are used as guest OSs in parallel. It can be operated.
  • both the first OS program Pa and the second OS program Pb are installed as the guest OS of the hypervisor program Ph, and both OS programs are managed under the hypervisor program Ph. Pa and Pb can be activated at the same time.
  • the hypervisor program Ph used in the present invention is any program as long as it has a function of causing the CPU 110 to execute the first OS program Pa and the second OS program Pb in parallel. It doesn't matter.
  • a program for example, a product “FOXvisor” is sold by SELTECH Co., Ltd. (Shibuya-ku, Tokyo) (in this product, the hypervisor program Ph is incorporated in the same chip as the CPU 110).
  • the first attribute application programs AP1, AP2, and Ma operate under the management of the first OS program Pa, and the second attribute application program Mb manages the second OS program Pb. It is a program that runs below.
  • FIG. 1 shows an example in which applications AP1 and AP2 are installed as application programs having the first attribute.
  • the applications AP1 and AP2 are programs installed to cause the information processing apparatus 100 to perform the original information processing function.
  • a larger number of application programs are installed, but here, for convenience of explanation, only two sets of applications AP1 and AP2 are installed.
  • the first attribute application program includes the first management program Ma in addition to the apps AP1 and AP2, and the second attribute application program includes the second management program Mb.
  • These management programs Ma and Mb are dedicated application programs incorporated in order to execute secure update processing in the present invention.
  • the application program having the second attribute is configured only by the second management program Mb.
  • the hypervisor program Ph, the first management program Ma, the second OS program Pb, and the second attribute application are securely updated.
  • the additional program is incorporated for the purpose of executing the process and it is not necessary to execute the secure update process according to the present invention, it is not necessary to incorporate these additional programs in the first place.
  • the original function of the information processing apparatus 100 can be performed by the first OS program Pa and the applications AP1 and AP2 having the first attribute, and the additional program includes the first OS program Pa and the first OS program Pa. It can be said that it is a program introduced in order to perform update processing for the first attribute application AP1, AP2 in a secure environment.
  • the shared memory area 121 is an area that can be accessed both under the management of the first OS program Pa and under the management of the second OS program Pb. Therefore, the shared memory area 121 can be accessed by the first management program Ma that operates under the management of the first OS program Pa, and the second operation that operates under the management of the second OS program Pb. It is also possible to access the shared memory area 121 by the management program Mb.
  • the reason for setting such a shared memory area 121 is to exchange data between the first management program Ma and the second management program Mb, as will be described later.
  • the hypervisor program Ph has a function of controlling both the first OS program Pa and the second OS program Pb and controlling the parallel operation of both OS programs. Therefore, the shared memory area 121 can be set by the function of this hypervisor program Ph.
  • the external communication means 130 is a device that communicates with some device provided outside the information processing apparatus 100.
  • FIG. 1 shows an example in which communication with an update server as the external device 200 is performed for the convenience of describing the unique update processing according to the present invention.
  • the update server 200 plays a role of distributing an update file F1 necessary for performing update processing (program update processing) for the first OS program Pa and the application programs AP1 and AP2 in the information processing apparatus 100.
  • An update program is included in the update file F1, and a desired update process is performed by causing the CPU 110 to execute the update program.
  • Distribution of the update file F1 from the update server 200 to the information processing apparatus 100 may be performed in a format (Pull type distribution) in which a distribution request is sent from the information processing apparatus 100 to the update server 200, or voluntarily from the update server 200. Alternatively, it may be performed in a format that is distributed to the information processing apparatus 100 (Push distribution). On the information processing apparatus 100 side, the process of receiving the update file F1 is performed by the first management program Ma.
  • the important point is that the update file F1 is not sent as it is, but is sent after being encrypted.
  • a predetermined encryption key K is prepared in the update server 200, and the update file F1 is encrypted using this encryption key K to generate an encrypted update file F2.
  • AES Advanced Encryption Standard
  • the encrypted update file F2 is transmitted from the update server 200 to the information processing apparatus 100.
  • the encrypted update file F2 transmitted in this way is received by the external communication means 130 of the information processing apparatus 100.
  • This reception process is performed by the first management program Ma as described above.
  • the first management program Ma executes a process of writing the encrypted update file F2 received by the external communication unit 130 into the shared memory area 121.
  • the arrows shown in FIG. 1 indicate the flow of such an encrypted update file F2.
  • the reception process of the encrypted update file F2 does not necessarily have to be performed by the first management program Ma, but may be performed by an arbitrary application program having the first attribute.
  • the application AP1 is a Web browser
  • the external communication unit 130 receives the encrypted update file F2 transmitted from the external device 200 and encrypted using the predetermined encryption key K under the management of the first OS program Pa. Will do.
  • the received encrypted update file F2 is written to the shared memory area 121 by the first management program Ma operating under the management of the first OS program Pa. Therefore, all the processes so far are executed under the management of the first OS program Pa.
  • system management is switched to the second OS program Pb by the function of the hypervisor program Ph.
  • the encrypted update file F2 written in the shared memory area 121 is read by the second management program Mb operating under the management of the second OS program Pb.
  • the second management program Mb has a function of decrypting the read encrypted update file using the encryption key K ′, executes a decryption process for generating the decryption update file F3, and further generates the generated decryption update.
  • a process of writing the file F3 to a predetermined storage location is executed.
  • the arrows shown in FIG. 1 indicate the flow of the encrypted update file F2 and the decrypted update file F3.
  • the decryption update file F3 is written so that the write destination of the decryption update file F3 is outside the information processing apparatus 100.
  • the decryption update file F3 is written inside the information processing apparatus 100. Or outside. Details of the write destination will be described in detail in Section 3 below.
  • the encryption key K ′ used for the decryption process executed by the second management program Mb is set to the same key as the encryption key K used for the encryption in the update server 200, and is the reverse of the encryption process. If the above process is performed, a decrypted update file F3 having the same contents as the original update file F1 is obtained, and correct decryption is performed. Therefore, if the CPU 110 executes the update program included in the decryption update file F3, a desired update process can be performed.
  • the encryption key K ′ used for the decryption process executed by the second management program Mb is not necessarily the same as the encryption key K used for the encryption process on the update server 200 side, and correct decryption is possible. Any key that has a specific relationship such that For example, in a public key cryptosystem, a pair of keys having a specific relationship is used, and what is encrypted with one key can be correctly decrypted with the other key. Therefore, when encryption processing based on the public key cryptosystem is executed on the update server 200 side, the encryption key K used for encryption and the encryption key K ′ used for decryption are a pair of corresponding keys in the public key cryptosystem. It only has to have a relationship.
  • the second management program Mb may perform decryption processing using an encryption key used for encryption processing on the update server 200 side or a predetermined encryption key related to the encryption key.
  • the broken line shown in FIG. 1 indicates that such a pair of encryption keys has a specific relationship.
  • the storage location of the second management program Mb and the storage location of the encryption key K ′ used for the decryption process by the second management program Mb are areas other than the shared memory area 121, as shown in the example of FIG. It is preferable to store in an area that can be accessed only under the management of the second OS program (a secure area that cannot be accessed under the management of the first OS program). Then, even if the area under the management of the first OS program Pa is infected with malware, the second management program Mb and the encryption key K ′ can be kept in a secure state.
  • An important feature of the information processing apparatus 100 according to the present invention is that an environment in which the first OS program Pa and the second OS program Pb are executed in parallel is built by incorporating the hypervisor program Ph. Therefore, normally, the application program AP1, AP2 having the first attribute can be executed under the management of the first OS program Pa, and the original function as the information processing apparatus 100 can be performed. On the other hand, when it becomes necessary to perform update processing on the first OS program Pa and the first attribute application programs AP1 and AP2, the second management program Mb is executed under the management of the second OS program Pb. The decryption process of the encrypted update file F2 can be performed.
  • the external communication means 130 communicates with various external devices. May be infected.
  • the update server 200 is a fake
  • the file F2 received by the external communication unit 130 is a fake file. In this way, even if malware is infected under the management of the first OS program Pa, there is a low possibility that the influence will reach the execution environment of the second OS program Pb, which is a different OS.
  • the execution environment of the second OS program Pb is maintained in an extremely secure state.
  • the feature of the present invention is that the decryption process of the encrypted update file F2 transmitted from the external device 200 is performed by using the fact that the execution environment of the second OS program Pb is maintained in a secure state.
  • the update is executed in a secure environment by executing it in the execution environment of the secure second OS program Pb.
  • an update file necessary for the update process on the external device 200 (update server) side F1 (a file containing a program for executing update processing) is encrypted to create an encrypted update file F2, which is transmitted to the information processing apparatus 100.
  • the encrypted update file F2 is received under the management of the first OS program Pa, and the received encrypted update file F2 is stored in the shared memory area 121 by the first management program Ma. Perform the writing process.
  • the first management program Ma sends the encrypted update file F2 to the shared memory area 121.
  • the process of writing to is completed, it can be notified to the second management program Mb.
  • the notification functions as a “decryption processing request” for the second management program Mb, and the second management program Mb receives the notification and then stores the encrypted update file F2 written in the shared memory area 121.
  • the decryption update file F3 is generated by performing the decryption process using the encryption key K ′, and the process of writing this in a predetermined storage location is performed.
  • the CPU 110 executes the update program included in the decryption update file F3 to thereby execute the application program AP1, AP2 having the first attribute or the first OS.
  • Update processing for the program Pa is executed under the management of the first OS program Pa or in the boot process.
  • the second management program Mb notifies the first management program Ma via the hypervisor program Ph.
  • the notification functions as a “decryption processing completion report” for the first management program Ma, and the first management program Ma that has received the notification is under the control of the first OS program Pa or in a boot process. Necessary processing is executed so that update processing using the decrypted update file F3 (the same content as the original update file F1) written in the storage location is executed.
  • the second management program Mb fails in the decryption process, the fact is reported to the first management program Ma via the hypervisor program Ph.
  • the first management program Ma performs some kind of error processing (for example, processing for presenting the user that the update has failed), and the update processing is stopped.
  • the decryption process of the encrypted update file F2 is performed under the management of the second OS program Pb (in other words, by the second management program Mb operating under the management of the second OS program Pb). Is very important to ensure the security of the update process.
  • the information processing apparatus 100 performs its original function by executing the application programs AP1 and AP2 having the first attribute under the management of the first OS program Pa. For this reason, the execution environment of the first OS program Pa may be infected with malware, and is placed in a non-secure area. On the other hand, the execution environment of the second OS program Pb is extremely unlikely to be infected with malware, and is placed in a secure area. In the present invention, since the decryption process of the encrypted update file F2 is executed in this secure area, it is possible to avoid the influence of malware as much as possible.
  • the operation and effect unique to the present invention can be easily understood in view of the danger of performing decryption processing in a non-secure area (under the control of the first OS program Pa).
  • the execution environment of the first OS program Pa is infected with malware and the decryption process is performed under the management of the first OS program Pa
  • the received encrypted update file F2 is legitimate. Even if it is a file, it cannot be guaranteed that the decryption update file F3 obtained by the decryption process is a regular file. Therefore, it is very dangerous to execute the update program included in the decryption update file F3.
  • the decryption process is performed under the management of the second OS program Pb in a secure environment, if the encrypted update file F2 is a legitimate file, the decryption process is performed.
  • the decrypted update file F3 is also a regular file. Therefore, there is no danger in executing the update program included in the decrypted update file F3.
  • the present invention can achieve the effect of avoiding danger.
  • the intended site of the authorized update server 200 is intended to be accessed, if the execution environment of the first OS program Pa is infected with malware, it may be directed to a fake site. .
  • the encrypted update file F2 (false) received by the external communication unit 130 is a fake file.
  • the decryption process is performed under the management of the second OS program Pb in a secure environment
  • the execution environment of the first OS program Pa is infected with malware.
  • the encryption key K ′ is accessed in an area other than the shared memory area 121, that is, an area accessible only under the management of the second OS program (accessed under the management of the first OS program), as shown in the example of FIG. If it is stored in a secure area that cannot be protected, it is possible to prevent leakage to the outside due to the influence of malware.
  • the second OS program used during the update process in addition to the first OS program Pa necessary for executing the original function by using the hypervisor program Ph. Since a secure execution environment is built by incorporating Pb and the encrypted update file F2 is decrypted in this secure execution environment, there is a risk that a fake update program may be executed compared to the conventional device. It can be reduced, and updating in a secure environment becomes possible.
  • the second management program Mb is installed as the application program with the second attribute, but if necessary, another application program is installed as the application program with the second attribute. It does not matter if you use it. However, as the number and types of application programs with the second attribute increase, the possibility that the execution environment of the second OS program Pb is infected with malware increases. In practical terms, as the application program with the second attribute, As in the illustrated embodiment, it is preferable to install a minimum necessary program such as the second management program Mb.
  • the information processing apparatus 100 uses the hypervisor program Ph as a conventional apparatus that executes the first attribute application programs AP1, AP2, and the like under the first OS program Pa.
  • the second OS program Pb can be incorporated, and the first management program Ma and the second management program Mb having the functions described above can be installed.
  • Commercially available programs can be used as the OS programs Pa and Pb and the hypervisor program Ph. Therefore, in practice, if the first management program Ma and the second management program Mb are prepared, the present invention can be used. Implementation is possible.
  • the first management program Ma and the second management program Mb are prepared as programs independent of the OS programs Pa and Pb. Can be prepared as a function of the first OS program Pa by incorporating it into the first OS program Pa.
  • the second management program Pb can be incorporated into the second OS program Pb. Thus, it can be prepared as a function of the second OS program Pb.
  • FIG. 2 is a configuration of a more practical embodiment using a VPN (Virtual Private Network) communication path as a communication path between the information processing apparatus 100 and the external apparatus 200 in the basic embodiment shown in FIG. FIG.
  • VPN Virtual Private Network
  • the basic configuration of the system shown in FIG. 2 is almost the same as the basic configuration of the system shown in FIG. 1, but the transmission of the encrypted update file F2 from the external device 200 to the information processing device 100 is performed via the VPN communication path. What is done is different. Therefore, on the information processing apparatus 100 side, a VPN opening application VPN1 that performs a process of opening a VPN communication path with the external apparatus 200 is prepared as an application program of the first attribute (as application AP2 shown in FIG. 1). VPN opening application VPN1 is prepared), and on the external device side, a VPN opening application VPN2 for performing a process for opening a VPN communication path is prepared. Further, a VPN server 300 for managing and operating the VPN communication path is provided. Therefore, the illustrated VPN communication path is constructed by the cooperative work of the VPN server 300 and the VPN opening applications VPN1 and VPN2, and the external communication means 130 receives the encrypted update file F2 via this VPN communication path. Become.
  • the encrypted update file F2 is an encrypted file, and the risk of being tampered with during communication by an attack by a malicious person is reduced. By doing so, the risk can be further reduced and safe delivery can be performed. Since such a VPN construction method and the function of the VPN server 300 are already known techniques, a detailed description thereof will be omitted here.
  • FIG. 3 shows the first OS program Pa or the first installed in the information processing apparatus 100 using the update file F1 prepared in the external apparatus 200 (update server) in the embodiment shown in FIG. It is a flowchart which shows the procedure which performs the update process with respect to application program AP1, VPN1, etc. of 1 attribute. Reference numerals in parentheses attached to the right side of the block indicating each procedure indicate components involved in performing the procedure in the block.
  • step S1 authentication processing by the VPN server 300 is executed.
  • This process is a preparatory stage process for establishing a VPN communication path between the information processing apparatus 100 and the external apparatus 200.
  • the VPN server 300 is a server device
  • the information processing device 100, and the external device 200 are client devices
  • the processing in step S1 is information processing in which the VPN server 300 is the client device. It can be said that the device 100, the external device 200, and the user are authenticated as authentic.
  • the VPN server 300 causes the information processing apparatus 100 to And authenticating the user as a normal one, and similarly using the device certificate D2, the client certificate C2, and the client private key K2 prepared as data for the VPN opening application VPN2 in the external device 200, A process in which the VPN server 300 authenticates the external device 200 and its user as authentic ones is performed.
  • the VPN server 300 plays a role of managing the VPN communication path.
  • step S3 processing for encrypting the update file F1 to be transmitted to the information processing apparatus 100 is performed on the external apparatus 200 side.
  • FIG. 2 shows an example in which the encrypted update file F2 is generated by encrypting the update file F1 by an encryption process using the encryption key K.
  • step S4 the encrypted update file F2 is transmitted via the VPN communication path established in step S2 and received by the information processing apparatus 100. In this way, the encrypted update file F2 can be safely delivered by transmission / reception via the VPN communication path.
  • step S5 a process of writing the received encrypted update file F2 into the shared memory area 121 is performed by the first management program Ma in the information processing apparatus 100.
  • step S6 the second management program Mb is written.
  • a decryption process for reading the encrypted update file F2 from the shared memory area 121 and decrypting it using the encryption key K ′ is performed.
  • the decryption update file F3 obtained by this decryption process is written in a predetermined storage location in step S7.
  • the decryption update file F3 written in the storage location is executed by the CPU 110, and the target update process is completed.
  • steps S4 and S5 are performed under the control of the first OS program Pa, whereas the processes in steps S6 and S7 are more secure management of the second OS program Pb. Will be done below.
  • the location of the shared memory area 121 used in step S5, the storage location of the decrypted update file F3 in step S7, and the specific procedure of the update process in step S8 will be described with specific examples in ⁇ 3 below. To do.
  • each update file >>>
  • the encrypted update file F2 received by the external communication unit 130 is transferred via the shared memory area 121, and the decrypted update file F3 obtained by the decryption process is written to a predetermined storage location. After that, this is executed and the update process is performed.
  • these update files F2, F3 are shown with some examples. A specific delivery method will be described.
  • a volatile memory and a nonvolatile memory are used in combination.
  • the volatile memory is usually composed of a RAM, and is used as a work area when the CPU executes a program.
  • the nonvolatile memory is constituted by a flash memory or the like, and is used as a storage area for programs and data.
  • the memory 120 in the embodiment shown in FIGS. 1 and 2 actually includes a volatile memory (RAM) and a nonvolatile memory (flash memory).
  • the volatile memory (RAM) is used as a work area when the CPU 110 executes various programs
  • the nonvolatile memory (flash memory) is a first OS program Pa, a second OS program Pb, a first attribute.
  • Application programs AP1, AP2, Ma, second attribute application program Mb, and hypervisor program Ph are used as storage areas.
  • the shared memory area 121 can be provided in a volatile memory (RAM) area or a non-volatile memory (flash memory) area.
  • the storage location for writing the decryption update file F3 can be provided in a volatile memory (RAM) area or in a non-volatile memory area (flash memory).
  • RAM volatile memory
  • flash memory non-volatile memory
  • FIG. 4 is a block diagram showing some examples of a method for delivering an update file in the embodiment shown in FIG. 1 or FIG.
  • the encrypted update file F2 and the decryption update file F3 are transferred (under the management of the first OS program Pa and under the management of the second OS program Pb). Between them).
  • FIG. 4A is a block diagram showing an example in which a shared memory area 122 is provided in the volatile memory (RAM) of the memory 120, and this shared memory area 122 is used as a storage location for writing the decrypted update file F3. It is.
  • the first management program Ma executes a process of writing the received encrypted update file F2 to the shared memory area 122 in the volatile memory.
  • the second management program Mb reads and decrypts the encrypted update file F2 from the shared memory area 122.
  • the second management program Mb reads the obtained decryption update file F3.
  • a process of writing to the shared memory area 122 in the volatile memory is executed.
  • the CPU 110 Since the decryption update file F3 used for the update process is written in the shared memory area 122 in the volatile memory, the CPU 110 reads the update program included in the decryption update file F3 from the volatile memory, By executing this, update processing is performed. Since the shared memory area 122 is an area in the volatile memory (RAM), the information is written to when the information processing apparatus 100 is turned off or the contents of the volatile memory are initialized by restarting. Since the decrypted update file F3 is lost, the update process cannot be performed.
  • RAM volatile memory
  • a shared memory area 123 is provided in the nonvolatile memory (flash memory) of the memory 120, and this shared memory area 123 is used as a storage location for writing the decryption update file F3.
  • the first management program Ma executes a process of writing the received encrypted update file F2 into the shared memory area 123 in the nonvolatile memory.
  • the second management program Mb reads and decrypts the encrypted update file F2 from the shared memory area 123.
  • the second management program Mb reads the obtained decryption update file F3. Then, a process of writing to the shared memory area 123 in the nonvolatile memory is executed.
  • the CPU 110 Since the decryption update file F3 used for the update process is written in the shared memory area 123 in the nonvolatile memory, the CPU 110 reads the update program included in the decryption update file F3 from the nonvolatile memory, By executing this, update processing is performed. Since the shared memory area 123 is an area in the non-volatile memory (flash memory), the information processing apparatus 100 is turned off or the contents of the volatile memory (RAM) are initialized by restarting. However, the decryption update file F3 written therein is not lost. Therefore, the embodiment shown in FIG. 4B is an embodiment suitable not only for updating the application program but also for updating the OS program.
  • FIG. 4C is a block diagram showing an example in which the shared memory area 124 is provided so as to extend over both the volatile memory (RAM) 124a and the nonvolatile memory (flash memory) 124b of the memory 120. is there.
  • the shared memory area 124a in the volatile memory (RAM) is used as the delivery location of the encrypted update file F2
  • the nonvolatile memory (flash memory) is used as the storage location for writing the decrypted update file F3. ) Is used.
  • step S5 in FIG. 3 the first management program Ma executes a process of writing the received encrypted update file F2 into the shared memory area 124a in the volatile memory (RAM). .
  • step S6 the second management program Mb reads and decrypts the encrypted update file F2 from the shared memory area 124a.
  • step S7 the second management program Mb reads the obtained decryption update file F3. Then, a process of writing to the shared memory area 124b in the nonvolatile memory is executed.
  • the decryption update file F3 used for the update process is written in the shared memory area 124b in the nonvolatile memory. Therefore, the CPU 110 uses the decryption update file from the nonvolatile memory.
  • the update program included in F3 is read out and executed to execute update processing. Since the shared memory area 124b is an area in the nonvolatile memory (flash memory), the information processing apparatus 100 is turned off, or the contents of the volatile memory (RAM) are initialized by restarting. However, the decryption update file F3 written therein is not lost.
  • the embodiment shown in FIG. 4C is also an embodiment suitable not only for updating the application program but also for updating the OS program, similarly to the embodiment shown in FIG. 4B.
  • reading / writing data from / to the volatile memory (RAM) can be performed at a higher speed than reading / writing data from / to the nonvolatile memory (flash memory).
  • 4 (c) is advantageous in that the embodiment shown in FIG. 4 (c) can be faster than the embodiment shown in FIG. 4 (b).
  • all of the three embodiments shown in FIG. 4 use the built-in memory 120 of the information processing apparatus 100 to transfer the encrypted update file F2 and the decrypted update file F3 (under the control of the first OS program Pa).
  • the transfer location of the update file is not necessarily the internal memory 120 of the information processing apparatus 100, but the external memory is the transfer location. You can use it.
  • FIG. 5A shows that a shared memory area 122 provided in a volatile memory (RAM) in the built-in memory 120 is used as a delivery location of the encrypted update file F2, and a non-volatile property is used as a delivery location of the decryption update file F3.
  • FIG. 5A shows the Example using the external memory 400 of FIG.
  • the information processing apparatus 100 is indicated by a broken-line block for convenience of explanation (the same applies to FIG. 5B).
  • the information processing apparatus 100 includes various components in addition to the memory 120, but these components are not shown here.
  • the external memory 400 is not an internal component of the information processing apparatus 100 as illustrated outside the information processing apparatus 100 in the figure, but is a non-volatile memory externally attached to the information processing apparatus 100 as necessary.
  • a flash memory so-called USB memory
  • USB memory can be attached to the information processing apparatus 100 according to the USB standard.
  • the information processing apparatus 100 has a function of attaching and reading information to and from the external memory 400 by mounting the nonvolatile external memory 400. Further, at least a part of the storage area of the external memory 400 constitutes a common access area 410 that can be accessed both under the management of the first OS program Pa and under the management of the second OS program Pb. Yes.
  • the common access area 410 is a kind of “shared memory area” in that it is a memory area accessible from both OS programs Pa and Pb. However, in the embodiment shown in FIG. Of the memory areas accessible from both OS programs Pa and Pb, the area provided in the built-in memory 120 of the information processing apparatus 100 is called a “shared memory area”, and the area provided in the external memory 400 is “ This is called a “common access area”.
  • a shared memory area 122 is provided in the volatile memory (RAM) of the built-in memory 120 of the information processing apparatus 100.
  • the shared memory area 122 is used as a delivery location for the encrypted update file F2
  • the common access area 410 in the external memory 400 is used as a delivery location for the decryption update file F3.
  • step S5 in FIG. 3 the first management program Ma writes the received encrypted update file F2 to the shared memory area 122 in the volatile memory (RAM).
  • step S6 the second management program Mb reads and decrypts the encrypted update file F2 from the shared memory area 122.
  • step S7 the second management program Mb reads the obtained decryption update file F3. Then, a process of writing to the common access area 410 in the external memory 400 is executed.
  • the CPU 110 decrypts from the common access area 410.
  • the update process included in the update file F3 is read out and executed to execute update processing. Since the common access area 410 is an area in the non-volatile external memory 400 (for example, a USB memory), it is written even if the information processing apparatus 100 is turned off or restarted. The decrypted update file F3 is not lost.
  • the embodiment shown in FIG. 5A is also suitable for updating the OS program as well as updating the application program, similar to the embodiment shown in FIGS. 4B and 4C. It will be an example.
  • the encrypted update file F2 is transferred via the shared memory area 122 in the volatile memory (RAM), the writing process and the reading process of the encrypted update file F2 can be speeded up.
  • FIG. 5 (b) employs a technique common to the embodiment of FIG. 5 (a) described above in that the decrypted update file F3 used for the final update process is written to the nonvolatile external memory 400.
  • the shared memory area 122 provided in the volatile memory (RAM) in the built-in memory 120 is used as a delivery location for the encrypted update file F2, and also used as a delivery location for the decryption update file F3. 400 is used as a save location for the decryption update file F3 written in the shared memory area 122.
  • the embodiment shown in FIG. 5B is a modification for solving the problems of the embodiment shown in FIG. 4A. That is, in the embodiment shown in FIG. 4A, the decrypted update file F3 used for the final update process is written in the shared memory area 122 in the volatile memory (RAM). When is turned off or the contents of the volatile memory are initialized by restarting, the decrypted update file F3 written therein is lost.
  • RAM volatile memory
  • the decryption update file F3 written in the shared memory area 122 in the volatile memory (RAM) is written to the nonvolatile external memory 400 by the first management program Ma. Then, a measure is taken to save the decryption update file F3 so as not to be lost. Therefore, similar to the embodiment of FIG. 5 (a), it can be used not only for updating the application program but also for updating the OS program.
  • a shared memory area 122 is provided in the volatile memory (RAM) of the built-in memory 120.
  • the information processing apparatus 100 indicated by the broken-line block in the figure has a non-volatile external memory 400 (for example, a USB memory) attached to the external memory 400 under the management of the first OS program Pa.
  • a non-volatile external memory 400 for example, a USB memory
  • the common access area 410 is set as in the embodiment shown in FIG. There is no need to provide it.
  • the update processing procedure in the embodiment shown in FIG. 5 (b) is almost the same as that in the embodiment shown in FIG. 4 (a). That is, first, the first management program Ma executes a process of writing the received encrypted update file F2 to the shared memory area 122 in the volatile memory, and then the second management program Mb The encrypted update file F2 is read from the area 122 and decrypted, and the obtained decrypted update file F3 is written into the shared memory area 122 in the volatile memory.
  • the update process is executed using the decrypted update file F3 in the shared memory area 122.
  • the first management program Ma reads the decryption update file F3 written in the shared memory area 122 in the volatile memory (RAM) and then writes it in the nonvolatile external memory 400 (for example, a USB memory). Execute the process. Therefore, the CPU 110 reads the update program included in the decrypted update file F3 from the external memory 400 and executes the update program to execute the update process.
  • the decryption update file F3 written in the non-volatile external memory 400 (for example, a USB memory) is not lost even if the information processing apparatus 100 is turned off or restarted. Therefore, the embodiment shown in FIG. 5B is also an embodiment suitable not only for updating the application program but also for updating the OS program.
  • FIG. 6 is a flowchart showing the procedure of the update process in the embodiment shown in FIG.
  • the procedure from steps S1 to S6 is exactly the same as the procedure from steps S1 to S6 in the flowchart of FIG.
  • step S6 the decryption process is performed on the encrypted update file F2, and the decrypted update file F3 is generated.
  • the generated decryption update file F3 is written into the shared memory area 122 in the volatile memory.
  • This writing process is executed by the second management program Mb.
  • the fact is notified to the first management program Ma via the hypervisor program Ph. This notification functions as a “write request to the external memory” for the first management program Ma.
  • the first management program Ma After receiving the notification, the first management program Ma reads the decryption update file F3 written in the shared memory area 122 and performs a process of writing it in the nonvolatile external memory 400.
  • the procedure of step S7b in the flowchart of FIG. 6 is the procedure of this writing process.
  • step S8 the update program included in the decryption update file F3 written in the external memory 400 is executed, and the update process is completed.
  • the first management program Ma (example of FIG. 5 (b)) or the second management program Mb (FIG. 4 (a), (b), (c), FIG. 5 (a)
  • the decrypted update file F3 (that is, the update file F1) can be executed under the management of the first OS program Pa.
  • the decryption update file F3 is stored in the shared memory area 122 in the volatile memory (RAM) as in the embodiment shown in FIG.
  • the application programs AP1 and AP2 can be updated.
  • the first management program Ma can be updated in the same manner.
  • the second management program Mb can be updated by the same method.
  • the OS program cannot be updated while the OS program is operating, it is usually necessary to restart the system. Since the data in the volatile memory (RAM) is usually initialized when the system is restarted, the shared memory in the volatile memory (RAM) as in the embodiment shown in FIG.
  • the decryption update file F3 written in the area 122 is lost. Therefore, when updating a general OS program, the decryption update file F3 is stored in a non-volatile manner as in the embodiments shown in FIGS. 4B, 4C, 5A, and 5B. What is necessary is just to write in memory.
  • the update program included in the decryption update file F3 is written in a storage location (so-called boot sector) for storing a boot program that is executed when the information processing apparatus 100 is started up.
  • the CPU 110 can perform an OS program update process by performing a boot process for executing the update program written in the boot sector at the time of startup.
  • Firmware can also be updated by a similar method.
  • the decryption update file is stored in the boot sector in the shared memory area 123 or 124b provided in the nonvolatile memory. What is necessary is just to write the update program contained in F3. Then, in the process of restarting the first OS program Pa, the update program can be executed, and the updated first OS program Pa can be started.
  • which OS to select at the time of restart can be specified by the setting of the hypervisor program.
  • the first is selected at the time of restart. If the OS program Pa is set to be selected, there will be no trouble. Of course, if it is set to select the second OS program Pb at the time of restart, it is possible to update the second OS program Pb.
  • the encryption key K ′ related to the encryption key K used for the encryption process on the update server 200 side is used.
  • the encryption key K ′ may be the same key as the encryption key K, or may be a pair of keys having a specific relationship used in the public key cryptosystem.
  • a modification in which the same encryption keys K and K ′ are generated using the identification information UID will be described with reference to the block diagram of FIG.
  • the information processing apparatus 100 is indicated by a broken-line block, but this indicates that the constituent elements drawn in the block are some constituent elements in the information processing apparatus 100. Because. Further, in FIG. 7, the processing contents of the program and data used for the program are shown in the blocks indicating the individual programs.
  • the information processing apparatus 100 is installed with a second management program Mb and a VPN opening application program VPN1, and the external apparatus 200 (update server) has an external apparatus management program Mc and a VPN opening application program.
  • VPN2 is installed. As described in ⁇ 2, the programs VPN1 and VPN2 work in cooperation with the VPN server 300 to open a VPN communication path between the information processing apparatus 100 and the external apparatus 200.
  • the program VPN1 uses the device certificate D1, the client certificate C1, and the client private key K1 to open a VPN communication path
  • the program VPN2 contains the device certificate D2, the server certificate C2, and the server private key.
  • a VPN communication path establishment process is performed using K2.
  • the specific VPN communication channel establishment processing procedure is as described in ⁇ 2.
  • the external device management program Mc is a program that plays a role equivalent to that of the external device 200 of FIG. 1, and encrypts the update file F1 using the encryption key K to generate an encrypted update file F2, which is then transmitted via VPN communication.
  • the information is transmitted to the information processing apparatus 100 via the path.
  • the encryption key K is generated using the identification information UID.
  • the identification information UID (User Identifier) is information recorded in a nonvolatile memory built in the information processing apparatus 100 that is the transmission destination of the encrypted update file F2, and is the information processing apparatus 100 or the information processing apparatus. This is information for identifying 100 users. Specifically, unique identification information assigned to the information processing apparatus 100 (for example, a serial number assigned to the CPU 110), account information given to the user, or the like can be used as the identification information UID.
  • the identification information UID is recorded in a nonvolatile memory built in the information processing apparatus 100 and also on the external apparatus 200 side.
  • the external device management program Mc may be determined in advance. For example, it is possible to use an algorithm that uses a hash value obtained by applying a predetermined hash function to data constituting the UID as an encryption key K.
  • the second management program Mb installed in the information processing apparatus 100 also has a function of generating the encryption key K ′ based on the identification information UID using the same encryption key generation algorithm.
  • the identification information UID recorded in the information processing apparatus 100 and the identification information UID recorded in the external apparatus 200 are the same, and the encryption key is generated using the same encryption key generation algorithm.
  • the encryption key K ′ generated on the information processing apparatus 100 side is the same key as the encryption key K generated on the external apparatus 200 side.
  • the encrypted update file F2 transmitted from the external apparatus 200 via the VPN communication path is received by the external communication means 130 in the information processing apparatus 100 and shared from the first management program Ma.
  • the data is delivered to the second management program Mb via the memory area 121.
  • the second management program Mb uses the same algorithm as the encryption key generation algorithm used by the external device management program Mc to use the encryption key K ′. (The same key as the encryption key K) is created.
  • decryption update file F3 (same as update file F1) is obtained by performing decryption processing on encrypted update file F2 using this encryption key K ′.
  • the device certificate D1, the client certificate C1, and the client private key K1 that the VPN opening application program VPN1 uses for the VPN channel establishment process also function as identification information for specifying the information processing apparatus 100 or its user. It is also possible to generate the secret key K ′ by using these pieces of information as identification information UID.
  • the information processing apparatus 100 incorporates the first OS program Pa and the second OS program Pb using the function of the hypervisor program Ph. Then, under the management of the first OS program Pa, various processes for performing the original processing function of the information processing apparatus 100 are executed by the application program having the first attribute. On the other hand, under the management of the second OS program Pb, the decryption process of the encrypted update file F2 is executed by the second management program Mb which is the application program having the second attribute.
  • the reason why the decryption process of the encrypted update file F2 is purposely performed under the management of the second OS program Pb is to perform the decryption process in a secure environment. That is, the basic concept of the present invention is that the execution environment of the second OS program Pb in which the decryption process of the encrypted update file F2 is executed even when the execution environment of the first OS program Pa is adversely affected by malware. Is in a secure state.
  • the execution environment (secure environment) of the second OS program Pb is not affected by the execution environment (non-secure environment) of the first OS program Pa as much as possible. Therefore, in practice, the following access rights are set for the memory area accessible under the management of the first OS program Pa and the memory area accessible under the management of the second OS program Pb. preferable.
  • FIG. 8 is a diagram showing a memory space of a nonvolatile memory (flash memory) built in the information processing apparatus 100.
  • a first area A1 (white area in the figure) and a second area A2 (hatched area in the figure) are defined as shown.
  • the entire memory space is divided into two areas A1 and A2. Then, the following access rights are set for these areas A1 and A2.
  • the first OS program Pa and the application program AP1, AP2, Ma having the first attribute can only access the first area A1, and access to the second area A2 is prohibited.
  • the first OS program Pa and the first attribute application programs AP1, AP2, Ma recognize that the first area A1 is the entire memory space of the built-in nonvolatile memory. You only have to set it.
  • the program itself constituting the first OS program Pa and the first attribute application programs AP1, AP2, Ma is stored in the first area A1, and each of these programs Pa, AP1 is stored. , AP2, Ma also records the first attribute data used in the first area A1.
  • the shared memory area used as the delivery location of the encrypted update file F2 and the decryption update file F3 is provided in the built-in nonvolatile memory, the shared memory area is also the first area A1. Keep it inside.
  • the second OS program Pa and the application program Mb having the second attribute are allowed to access both the first area A1 and the second area A2.
  • the second OS program Pa and the application program Mb having the second attribute can access the entire memory space of the built-in nonvolatile memory.
  • the program itself constituting the hypervisor program Ph, the second OS program Pb, and the second attribute application program Mb (second management program) is stored in the second area A2.
  • the second attribute data used by each of the programs Ph, Pb, and Mb is also recorded in the second area A2.
  • the second attribute data includes the encryption key K ′ used for the decryption process by the second management program Mb or the identification information UID used for generating the encryption key K ′.
  • FIG. 8 shows an example in which the hypervisor program Ph is stored in the flash memory
  • the hypervisor program Ph may be stored in the ROM (for example, in the above-described product “FOXvisor”).
  • the hypervisor program Ph is stored in the ROM of the same chip as the CPU 110).
  • the access right as described above is set, for the first OS program Pa and the application program AP1, AP2, Ma having the first attribute, the first area A1 is the entire memory space, and the second area A2 (hatched area in the figure) is an area where even its existence cannot be recognized. Therefore, even if the information processing apparatus 100 is operated under the control of the first OS program Pa and is infected with malware by being attacked by a malicious person, the influence of the malware is first. It is possible to prevent the second region A2 from being affected by staying within the region A1.
  • the second OS program Pa and the second attribute application program Mb can access not only the second area A2 but also the first area A1.
  • the second management program Mb needs to access the first area A1 because it accesses the shared memory area for delivery of the encrypted update file F2 and the decryption update file F3. It is only a case, and it is very unlikely that the second area A2 is affected by the access to the shared memory area.
  • the possibility that the second OS program Pb and the application Mb having the second attribute are affected by malware is very low.
  • the possibility that the encryption key K ′ and the identification information UID, which are data of the second attribute, are affected by malware is very low.
  • the first area A1 is a non-secure area
  • the second area A2 functions as a secure area. Then, the decryption process of the encrypted update file F2 by the second management program Mb is executed in this secure area. Therefore, according to the present invention, it is possible to update in a secure environment.
  • the home gateway device serves as an intermediary between the public network and the home network, and is an information processing device for home use that has functions for exchanging telephone and fax signals in addition to the functions of a general broadband router. is there.
  • This home gateway device is also an information processing device including a CPU, a memory, and external communication means, and can perform its function by executing a predetermined OS program or application program. Therefore, it will be necessary to update each program after installation, but since it is a home-use information processing device, it is difficult to take advanced security measures, and it is feared that malware damage will occur frequently during the update .
  • FIG. 9 is a block diagram showing an embodiment in which the information processing apparatus according to the present invention is used as a home gateway apparatus.
  • the information processing apparatus according to the present invention is used as the home gateway apparatus 100.
  • the home gateway device 100 plays a role of mediating various devices such as sensors, surveillance cameras, personal computers, TVs, recording devices, lighting, smart meters, and the like connected to the home network and the Internet.
  • the information processing apparatus is used as the home gateway apparatus 100, as shown in the figure, it is connected to the update server 200 functioning as an external apparatus via the Internet, and a built-in OS program or application program Can be updated. Moreover, according to the present invention, it is possible to perform the update in a secure environment, and the risk of being damaged by malware during the update can be reduced.
  • the present invention can be widely used in an information processing apparatus that includes a CPU, a memory, and external communication means, and performs a program update process using an update file received from an external apparatus. Specifically, it can also be used for electronic devices such as personal computers, smartphones, tablet terminals, and devices such as home gateway devices.
  • Information processing device (home gateway device) 110: CPU 120: Memory 121: Shared memory area 122: Shared memory area (area in volatile memory) 123: Shared memory area (area in nonvolatile memory) 124: Shared memory area (area in volatile and non-volatile memory) 124a: Shared memory area (area in volatile memory) 124b: shared memory area (area in nonvolatile memory) 130: External communication means 200: External device (update server) 300: VPN server 400: External memory (nonvolatile memory) 410: common access area A1: first area A2: second area AP1, AP2: application program C1: first attribute C1: client certificate C2: server certificate D1: device certificate D2: device certificate F1: update File F2: Encryption update file F3: Decryption update file K, K ′: Encryption key K1: Client secret key K2: Server secret key Ma: First management program (application program having the first attribute) Mb: second management program (second-attribute application program

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Quality & Reliability (AREA)
  • Stored Programmes (AREA)

Abstract

Selon l'invention, afin d'exécuter une mise à jour dans un environnement sécurisé, un programme d'hyperviseur (Ph) est installé dans un dispositif de traitement d'informations (100) et le dispositif de traitement d'informations (100) est amené à exécuter un premier système d'exploitation (OS) et un second système d'exploitation en parallèle. Une application d'une première attribution est normalement exécutée sous la gestion du premier système d'exploitation. Pour une mise à jour du premier système d'exploitation ou une mise à jour de l'application de la première attribution, un fichier de mise à jour crypté (F2) est reçu d'un serveur de mise à jour (200), est écrit dans une région de mémoire partagée (121) au moyen d'un premier programme de gestion (Ma) et est fourni à un second programme de gestion (Mb). Le second programme de gestion (Mb) décrypte le fichier de mise à jour crypté (F2) sous la gestion du second système d'exploitation fournissant un environnement sécurisé et écrit un fichier de mise à jour décrypté (F3) dans une zone de stockage prédéterminée (une mémoire interne ou une mémoire externe). Par la suite, un processus de mise à jour est exécuté à l'aide du fichier de mise à jour décrypté (F3) sous la gestion du premier système d'exploitation.
PCT/JP2016/084386 2016-11-21 2016-11-21 Dispositif de traitement d'informations WO2018092289A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
JP2018550982A JP6741236B2 (ja) 2016-11-21 2016-11-21 情報処理装置
PCT/JP2016/084386 WO2018092289A1 (fr) 2016-11-21 2016-11-21 Dispositif de traitement d'informations

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/JP2016/084386 WO2018092289A1 (fr) 2016-11-21 2016-11-21 Dispositif de traitement d'informations

Publications (1)

Publication Number Publication Date
WO2018092289A1 true WO2018092289A1 (fr) 2018-05-24

Family

ID=62145355

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2016/084386 WO2018092289A1 (fr) 2016-11-21 2016-11-21 Dispositif de traitement d'informations

Country Status (2)

Country Link
JP (1) JP6741236B2 (fr)
WO (1) WO2018092289A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2022506633A (ja) * 2018-11-09 2022-01-17 ホアウェイ・テクノロジーズ・カンパニー・リミテッド 無線アップグレード方法および関連装置

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2011118873A (ja) * 2009-11-30 2011-06-16 Intel Corp 自動化されたモジュール型のセキュアな起動ファームウェアの更新
JP2014503101A (ja) * 2011-01-19 2014-02-06 インターナショナル・ビジネス・マシーンズ・コーポレーション コードを更新および認証するための方法およびシステム、プログラムの完全性を試験する方法およびシステム

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2011118873A (ja) * 2009-11-30 2011-06-16 Intel Corp 自動化されたモジュール型のセキュアな起動ファームウェアの更新
JP2014503101A (ja) * 2011-01-19 2014-02-06 インターナショナル・ビジネス・マシーンズ・コーポレーション コードを更新および認証するための方法およびシステム、プログラムの完全性を試験する方法およびシステム

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2022506633A (ja) * 2018-11-09 2022-01-17 ホアウェイ・テクノロジーズ・カンパニー・リミテッド 無線アップグレード方法および関連装置
US11947673B2 (en) 2018-11-09 2024-04-02 Huawei Technologies Co., Ltd. Over-the-air upgrade method and related apparatus

Also Published As

Publication number Publication date
JPWO2018092289A1 (ja) 2019-10-10
JP6741236B2 (ja) 2020-08-19

Similar Documents

Publication Publication Date Title
KR102434444B1 (ko) 가상 트러스트 컴퓨팅 베이스를 이용한 기기 보안성 검증 방법 및 장치
CN109858265B (zh) 一种加密方法、装置及相关设备
CN108810894B (zh) 终端授权方法、装置、计算机设备和存储介质
TWI598814B (zh) 用於管理及診斷配備有統一可延伸韌體介面（ｕｅｆｉ）相容韌體的計算裝置之系統與方法
EP2913956B1 (fr) Procédé et appareil de commande de la gestion pour machines virtuelles
US9768951B2 (en) Symmetric keying and chain of trust
JP5497171B2 (ja) セキュア仮想マシンを提供するためのシステムおよび方法
US8291480B2 (en) Trusting an unverified code image in a computing device
Chen et al. {cTPM}: A cloud {TPM} for {Cross-Device} trusted applications
WO2019218919A1 (fr) Procédé et appareil de gestion de clé privée dans un scénario de chaîne de blocs, et système
CN107077567B (zh) 标识计算设备上的安全边界
JP2010537270A (ja) 暗黙型自己インストールセキュリティ環境のための仮想トークン
US10045212B2 (en) Method and apparatus for providing provably secure user input/output
US10747885B2 (en) Technologies for pre-boot biometric authentication
US20190318078A1 (en) Application security authentication method, terminal and storage medium
WO2022126644A1 (fr) Dispositif de protection de modèle, procédé, et dispositif informatique
JP2017041145A (ja) プロセッサ及びプロセッサシステム
US20150047001A1 (en) Application program execution device
CN114296873B (zh) 一种虚拟机镜像保护方法、相关器件、芯片及电子设备
EP3221996B1 (fr) Gestion de clés symétriques et chaîne de confiance
JP6517435B2 (ja) アプリケーションを管理する方法
CN112182669A (zh) 用于存储所要保护的数据记录的系统和方法
WO2018092289A1 (fr) Dispositif de traitement d'informations
KR101711024B1 (ko) 부정조작방지 장치 접근 방법 및 그 방법을 채용한 단말 장치
US10824766B2 (en) Technologies for authenticated USB device policy enforcement

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16921787

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2018550982

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16921787

Country of ref document: EP

Kind code of ref document: A1