JP2020067904A - Information processing apparatus and method of controlling the same, and program - Google Patents

Abstract

To provide a technology that appropriately controls an access to a storage unit that stores a program subjected to an inspection performed at the start-up of the apparatus.SOLUTION: At the start-up of an image forming apparatus, a microcomputer 321 of a controller 11 accesses a start-up ROM 303 (storage unit) and performs an inspection as to whether a program stored in the start-up ROM 303 is tampered. When determining that the program is not tampered through the inspection, the microcomputer 321 notifies a connection control unit 322 of an inspection result indicating that the program stored in the start-up ROM 303 is not tampered. In response to the notification of the inspection result from the microcomputer 321, the connection control unit 322 switches a connection destination of a signal line for an access to the start-up ROM 303 from the microcomputer 321 to a CPU 301 so as to allow an access to the start-up ROM 303 from the CPU 301.SELECTED DRAWING: Figure 2

Description

  The present invention relates to an information processing device, a control method thereof, and a program.

  2. Description of the Related Art In recent years, image forming apparatuses such as printing apparatuses and multifunction peripherals (MFPs) have provided users with a file server function and a mail transmission / reception function via a network. When the image forming apparatus is connected to the network, the apparatus may be illegally used due to illegal hacking, like the PC and the server apparatus.

  Japanese Unexamined Patent Application Publication No. 2004-242242 discloses a technique for verifying whether or not the software has been tampered with at the time of booting the device in order to prevent unauthorized use of the device due to unauthorized hacking in the image forming device. Verification of software tampering is performed by calculating a hash value of software, comparing the hash value with a master hash value, and based on the comparison result. Further, when the tampering of the software is detected, the tampered software and other software that uses the software cannot be used.

JP, 2009-301429, A

  As described above, in order to verify whether or not the software (program) stored in the storage device such as the ROM has been tampered with when the information processing device such as the image forming device is activated, a microcomputer including a CPU different from the main CPU is used. May be used. In such a case, it is necessary to appropriately control access to the storage device so that the main CPU does not execute the program before the verification of the program stored in the storage device is completed.

  The present invention has been made in view of the above problems. It is an object of the present invention to provide a technique for appropriately controlling access to a storage device that stores a program to be verified when the device is activated.

  An information processing apparatus according to an aspect of the present invention is configured to access a first control unit, a storage unit that stores a program executed by the first control unit, and access the storage unit when the information processing apparatus is activated. Second control means for verifying whether the program has been tampered with, and a connection for controlling connection of a signal line for access from each of the first control means and the second control means to the storage means. In response to notification from the second control means of a verification result indicating that the program stored in the storage means has not been tampered with, the first control means transfers to the storage means. The connection control means for switching the connection destination of the signal line from the second control means to the first control means so as to be accessible.

  According to the present invention, it is possible to appropriately control access to a storage device that stores a program to be verified when the device is started up.

FIG. 3 is a block diagram showing a system configuration example. FIG. 3 is a block diagram showing a configuration example of a controller of the image forming apparatus. FIG. 3 is a block diagram showing a configuration example of connection to a boot ROM. The flowchart which shows the procedure of a process by a microcomputer. 6 is a flowchart showing a procedure of processing by the connection control unit according to the first embodiment. 6 is a flowchart showing a procedure of processing by a connection control unit according to the second embodiment. The flowchart which shows the procedure of the process by the connection control part which concerns on 3rd Embodiment. The flowchart which shows the procedure of the process by the connection control part which concerns on 4th Embodiment. The flowchart which shows the procedure of the process by the connection control part which concerns on 5th Embodiment.

  Hereinafter, embodiments for carrying out the present invention will be described with reference to the drawings. Note that the following embodiments do not limit the invention according to the claims, and all combinations of the features described in the embodiments are not necessarily essential to the means for solving the invention.

[First Embodiment]
<Image forming device>
FIG. 1 is a block diagram showing a configuration example of a system including an image forming apparatus according to this embodiment. In the present embodiment, an example in which the present invention is applied to an image forming apparatus that forms an image will be described as an example of an information processing apparatus. The present invention can be applied to any information processing apparatus, for example, an information processing apparatus such as a printing apparatus, a reading apparatus, a copying machine, and a facsimile apparatus.

  In the system of FIG. 1, the image forming apparatuses 10, 20, 30 and host computers (PCs) 40, 50 are communicably connected to each other via a LAN 60. It should be noted that any number of PCs and any number of image forming apparatuses can be connected to the LAN 60. Further, the image forming apparatuses 10, 20, 30 and the PCs 40, 50 may be communicatively connected to each other via a network other than LAN (for example, WAN, Internet, etc.).

  The PCs 40 and 50 can communicate with the image forming apparatuses 10, 20, and 30 via the LAN 60. For example, the PCs 40 and 50 can send a print job (print data) to each image forming apparatus. The PCs 40 and 50 can also acquire information indicating the state of each image forming apparatus.

  The image forming apparatuses 10, 20, and 30 are apparatuses having an image forming (printing) function, and may have the same configuration or different configurations. Further, the image forming apparatuses 10, 20, 30 may have additional functions such as a scan function and a facsimile (FAX) transmission function. In this embodiment, an image forming apparatus 10 having a print function and a scan function will be described.

  The image forming apparatus 10 includes a control unit (controller) 11, an operation unit 12, a scanner unit 13, and a printer unit 14. The controller 11 controls the operation of the entire image forming apparatus 10. The scanner unit 13 is an image input device, and the printer unit 14 is an image output device. The operation unit 12 functions as a user interface (UI).

  The scanner unit 13 optically reads an image of a document, generates image data corresponding to the image, and outputs the generated image data to the controller 11. The printer unit 14 forms an image on a sheet based on the image data input from the controller 11. The scanner unit 13 may include an automatic document feeder (ADF) that conveys documents one by one from the document tray to the reading position.

  The printer unit 14 forms (prints) an image on a recording medium such as a sheet based on the image data received from the controller 11. The image forming method of the printer unit 14 may be, for example, an electrophotographic method or an inkjet method.

<Controller>
FIG. 2 is a block diagram showing a configuration example of the controller 11 of the image forming apparatus 10. The controller 11 is electrically connected to the operation unit 12, the scanner unit 13, and the printer unit 14. Further, the controller 11 is communicatively connected to external devices such as the PCs 40 and 50 via a network such as the LAN 60. With such a connection, the image forming apparatus 10 is configured to be able to input and output image data and device information.

  The controller 11 includes a CPU 301, a RAM 302, a boot ROM (boot ROM) 303, a HDD (hard disk drive) 304, an operation unit I / F (interface) 305, and a LAN controller 306. The controller 11 includes an image processing unit 309, a scanner image processing unit 310, and a printer image processing unit 312 as devices connected to the image bus 308. The scanner image processing unit 310 is connected to the scanner unit 13 via the scanner I / F 311, and the printer image processing unit 312 is connected to the printer unit 14 via the scanner I / F 313. The image bus 308 is a transmission path for exchanging image data, and is composed of, for example, a PCI bus or an IEEE 1394 bus.

  The CPU 301 reads out and executes a program stored in the boot ROM 303 or the HDD 304 to control access to various devices and various processes performed inside the controller 11. The RAM 302 functions as a system work memory for the CPU 301 to operate and a memory for temporarily storing image data. The RAM 302 is composed of an SRAM that retains stored contents even after the power is turned off, and a DRAM that erases the stored contents when the power is turned off.

  The boot ROM 303 stores a program executed by the CPU 301, such as a boot program (boot program) for the image forming apparatus 10. The boot ROM 303 is used only when the image forming apparatus 10 is booted. The CPU 301 performs processing using a program stored in the boot ROM 303 when the image forming apparatus 10 is activated, and after activation of the image forming apparatus 10, shifts to processing using a program stored in the HDD 304. The HDD 304 can store various programs such as system software and various data of image data.

  The controller 11 further includes a microcomputer 321 and a connection controller 322. In the present embodiment, the boot ROM 303 is connected to the CPU 301 and the microcomputer 321 via an interface compatible with SPI (Serial Peripheral Interface). The connection control unit 322 controls connection of signal lines (signal lines 401, 411, and 412 in FIG. 3) for access from the CPU 301 and the microcomputer 321 to the boot ROM 303.

  The operation unit I / F 305 is an interface unit for connecting the system bus 307 and the operation unit 12. The operation unit I / F 305 receives image data for displaying an operation screen on the operation unit 12 via the system bus 307, and outputs the received image data to the operation unit 12. The operation unit I / F 305 also transmits the information output from the operation unit 12 to the CPU 301 via the system bus 307. The LAN controller 306 is a communication I / F that is connected to the LAN 60 and communicates with an external device via the LAN 60.

  The image processing unit 309 reads the image data stored in the RAM 302 and performs image processing such as compression, enlargement, reduction, or color adjustment on the read image data. The scanner image processing unit 310 corrects, processes, and edits image data received from the scanner unit 13 via the scanner I / F 311. The scanner image processing unit 310 determines the type of the scanned document (for example, a color document or a black-and-white document, and a text document or a photographic document) based on the received image data, and the determination result is used as attribute data in the image data. Add. The printer image processing unit 312 performs image processing on the image data output to the printer unit 14 via the printer I / F 313 by referring to the attribute data added to the image data. The printer image processing unit 312 outputs the image data after the image processing to the printer unit 14 via the printer I / F 313.

  The microcomputer 321 is a falsification verification microcomputer that accesses the boot ROM 303 and verifies whether the software (program) stored in the boot ROM has been falsified when the image forming apparatus 10 is booted. is there. If the microcomputer 321 determines through verification that the program stored in the boot ROM 303 has not been tampered with, it notifies the connection control unit 322 of the result of the determination and releases the reset state of the CPU 301 to cause Start operation. In this embodiment, as will be described later, the microcomputer 321 outputs a notification signal indicating the result of the determination that the program has not been tampered with to the connection control unit 332, and also sends the notification signal to the CPU 301 as a reset release signal. Output.

  In the image forming apparatus 10 of the present embodiment, the CPU 301 is an example of the first control unit, the microcomputer 321 is an example of the second control unit, and the boot ROM 303 is an example of a storage unit.

  FIG. 3 is a block diagram showing a configuration example of connection to the boot ROM 303. In this embodiment, the CPU 301, the boot ROM 303, the microcomputer 321, and the connection control unit 322 are connected to each other via signal lines 401 to 404, 411, 412, and 421 for exchanging SPI-compliant signals.

  The boot ROM 303 is connected to the connection control unit 322 via the signal line 401. The signal line 401 is a CS signal line used for transmitting a chip select signal (CS signal) conforming to SPI. The CS signal is a signal used for executing processing such as read / write on the boot ROM 303. By asserting the CS signal, the boot ROM 303 can be brought into a usable state (active state).

  A signal line 411 is provided between the connection control unit 322 and the CPU 301, and a signal line 412 is provided between the connection control unit 322 and the microcomputer 321. The signal line 411 is a CS signal line used for transmitting a CS signal from the CPU 301 to the boot ROM 303. The signal line 412 is a CS signal line used for transmitting a CS signal from the microcomputer 321 to the boot ROM 303.

  The connection control unit 322 controls the connection state between the signal line 401 and the signal lines 411 and 412. Specifically, the connection control unit 322 can switch the connection destination of the signal line 401 between the signal line 411 and the signal line 412. Further, the connection control unit 322 can also set the signal line 401 to an unconnected state in which it is not connected to any of the signal lines 411 and 412. In this way, the connection control unit 322 connects the signal line 401 (third signal line) to the signal line 411 (first signal line) corresponding to the CPU 301 and the signal line 412 (first signal line) corresponding to the microcomputer 321. (2 signal lines) is switched between a connected state and an unconnected state.

  When the signal line 411 and the signal line 401 are connected, the CS signal can be supplied from the CPU 301 to the boot ROM 303. When the signal line 412 and the signal line 401 are connected, the CS signal can be supplied from the microcomputer 321 to the boot ROM 303. The CS signal is a signal used when the CPU 301 and the microcomputer 321 access the boot ROM 303. In this way, the signal lines 401, 411, and 412 function as signal lines for accessing the boot ROM 303.

  As shown in FIG. 3, signal lines 402 to 404 are provided between each of the CPU 301 and the microcomputer 321 and the boot ROM 303. The signal lines 402 to 404 are signal lines for transmitting a clock signal, a data-in signal, and a data-out signal, respectively, as SPI-compliant signals.

  The clock signal is a signal for supplying a clock to the boot ROM 303. A clock is supplied from the CPU 301 or the microcomputer 321 to the boot ROM 303 using the clock signal. The data-in signal is a signal for inputting data to the boot ROM 303. Data is input from the CPU 301 or the microcomputer 321 to the boot ROM 303 using the data-in signal. The data-out signal is a signal for outputting data from the boot ROM 303. Data is output from the boot ROM 303 to the CPU 301 or the microcomputer 321 using the data-out signal.

  In this way, the signal line 402 functions as a signal line for supplying a clock to the boot ROM 303. The signal line 403 functions as a signal line for inputting data to the boot ROM 303. The signal line 404 functions as a signal line for outputting data from the boot ROM 303.

  A signal line 421 is provided between each of the CPU 301 and the microcomputer 321 and the connection control unit 322. The signal line 421 is used to transmit a notification signal for notifying the connection control unit 322 from the microcomputer 321 of the verification result of the program stored in the boot ROM 303 by the microcomputer 321. The connection control unit 322 switches the above-mentioned connection state of the CS signal lines (that is, the signal lines 401, 411, 412) according to the notification signal from the microcomputer 321.

  The image forming apparatus 10 of this embodiment has a configuration in which the connection control unit 322 connects the signal line 412 for the microcomputer 321 and the signal line 401 by default when the power is turned on. The connection control unit 322 switches the connection state of the signal line for the CS signal in accordance with the notification signal indicating that the program stored in the boot ROM 303 has not been tampered with. Specifically, the connection control unit 322 connects the signal line connection state of the signal line 412 for the microcomputer 321 and the signal line 401 to the signal line 411 for the CPU 301 and the signal line 401. Switch to state.

  The signal line 421 connects the microcomputer 321, the connection control unit 322, and the CPU 301. Therefore, the notification signal output from the microcomputer 321 is supplied to the CPU 301 as well as the connection control unit 322 via the signal line 421. In the present embodiment, the notification signal supplied to the CPU 301 via the signal line 421 functions as a reset release signal for the CPU 301.

  The microcomputer 321 verifies whether the program stored in the boot ROM 303 has been tampered with. Only when the microcomputer 321 determines that the program has not been tampered with, the connection control unit 322 connects the signal line 411 for the CPU 301 and the signal line 401 by using the above notification signal, and the reset state of the CPU 301. To cancel. As a result, the CPU 301 can execute access to the boot ROM 303 by using the CS signal, and the CPU 301 can be booted by using the untampered program stored in the boot ROM 303. Will be possible.

  A control bus 422 is further provided between the CPU 301 and the connection control unit 322. The control bus 422 is used for communication between the CPU 301 and the connection control unit 322. The connection control unit 322 can also switch the connection state of the CS signal signal lines 401, 411, and 412 according to an instruction received from the CPU 301 via the control bus 422.

<Processing of microcomputer>
FIG. 4 is a flowchart showing a procedure of processing by the microcomputer 321 according to this embodiment. First, in step S <b> 401, the microcomputer 321 proceeds to step S <b> 402 when the image forming apparatus 10 is started from the power-off state and the microcomputer 321 is powered on.

  In step S402, the microcomputer 321 performs the startup process using the ROM held therein or the dedicated ROM provided outside. Upon completion of the startup process, the microcomputer 321 advances the process to S403.

  In S403, the microcomputer 321 starts a verification process for verifying whether the program stored in the boot ROM 303 has been tampered with, and advances the process to S404. Here, the microcomputer 321 accesses the boot ROM 303 using the CS signal via the signal lines 412 and 401 connected by the connection control unit 322. As a result, the microcomputer 321 reads the program from the boot ROM 303 and performs verification processing as to whether or not the read program has been tampered with. In S404, the microcomputer 321 determines whether or not the verification processing is completed, and when the verification processing is completed, advances the processing to S405.

  In step S405, the microcomputer 321 determines whether the program has been tampered with according to the verification result of the program stored in the boot ROM 303. If the microcomputer 321 determines that the program stored in the boot ROM 303 has been tampered with (detects tampering with the program), it ends the process. On the other hand, if the microcomputer 321 determines that the program stored in the boot ROM 303 has not been tampered with (the tampering of the program was not detected), the process proceeds to S406.

  In step S406, the microcomputer 321 uses the notification signal on the signal line 421 to notify the connection control unit 322 of the verification result of the program, and ends the process. As described above, the connection control unit 322 switches the connection state of the signal line for the CS signal according to this notification signal. This notification signal is also used as a reset release signal for the CPU 301.

<Process of connection control unit>
FIG. 5 is a flowchart showing a procedure of processing executed by the connection control unit 322 according to this embodiment. First, in S501, the connection control unit 322 advances the processing to S502 when the image forming apparatus 10 is activated from the power-off state and the connection control unit 322 is powered on.

  In step S502, the connection control unit 322 electrically connects the microcomputer 321 and the boot ROM 303 by connecting the signal line 401 and the signal line 412 (connecting the CS signal line) to each other via the CS signal line. . As a result, the microcomputer 321 can access the boot ROM 303 using the CS signal via the signal lines 412 and 401, read the program from the boot ROM 303, and perform verification processing of the read program. It will be possible.

  When the power of the image forming apparatus 10 is turned on, the CS signal line for the CPU 301 is not electrically connected to the boot ROM 303 by the process of S502 (that is, the signal line 411 and the signal line 401 are not connected). State). Thereby, even if a malicious user forcibly releases the reset state of the CPU 301, for example, it is possible to prevent the CPU 301 from reading a boot program whose verification by the microcomputer 321 is not completed from the boot ROM 303 and executing the boot program. .

  After that, in step S503, the connection control unit 322 determines whether the notification signal input from the microcomputer 321 via the signal line 421 is at the H (high) level, and the notification signal is changed from the L (low) level to the H (high) level. When the level is switched, the process proceeds to S504.

  For example, the microcomputer 321 outputs the L-level notification signal by default, and when determining that the program stored in the boot ROM 303 has not been tampered with, switches the output level of the notification signal from the L level to the H level. Accordingly, the connection control unit 322 connects the signal line 401 and the signal line 412 (the CS signal line between the microcomputer 321 and the boot ROM 303) as long as the notification signal input via the signal line 421 is at the L level. Connection). It should be noted that the logic of the notification signal may be inverted from the logic described above, that is, when the tampering of the program is not detected, it may be associated with the L level instead of the H level.

  In this way, when the connection control unit 322 receives the notification signal indicating that the program stored in the boot ROM 303 has not been tampered with from the microcomputer 321 via the signal line 421, the process proceeds to S504. In step S <b> 504, the connection control unit 322 switches the connection of the CS signal line to the boot ROM 303 from the microcomputer 321 to the CPU 301. That is, the connection control unit 322 switches the connection destination of the signal line 401 for the boot ROM 303 from the signal line 412 to the signal line 411. When the switching of the connection of the CS signal line is completed, the connection control unit 322 ends the process.

  In this example, the H-level notification signal also functions as a reset release signal to the CPU 301. When the H-level notification signal is input to the CPU 301 via the signal line 421, the reset state of the CPU 301 is released. Further, by switching the connection of the CS signal line in S504, the CPU 301 can access the boot ROM 303 using the CS signal via the CS signal line (signal lines 411 and 411). When the access to the boot ROM 303 becomes possible, the CPU 301 boots using a program that has not been tampered with and is stored in the boot ROM 303.

  As described above, in the present embodiment, when the image forming apparatus 10 is activated, the microcomputer 321 accesses the activation ROM 303 and verifies whether the program stored in the activation ROM has been tampered with. I do. When the microcomputer 321 determines through verification that the program has not been tampered with, it notifies the connection control unit 322 of a verification result indicating that the program stored in the boot ROM 303 has not been tampered with. In response to the notification of the verification result from the microcomputer 321, the connection control unit 322 determines the connection destination of the CS signal line for accessing the boot ROM 303 by the microcomputer 321 so that the CPU 301 can access the boot ROM 303. To CPU 301. When the access to the boot ROM 303 becomes possible, the CPU 301 accesses the boot ROM 303 via the signal lines 411 and 401 and boots by executing the program stored in the boot ROM 303.

  According to this embodiment, immediately after the power of the image forming apparatus 10 is turned on, the CS signal line between the microcomputer 321 and the boot ROM 303 is connected, while the CS signal line between the CPU 301 and the boot ROM 303 is connected. Is disconnected. This can prevent the CPU 301 from starting the operation by executing the boot program before the verification of whether the boot program stored in the boot ROM 303 has been tampered with.

  Further, the connection control unit 322 connects the CS signal lines so as to connect the CS signal lines between the CPU 301 and the boot ROM 303 after the microcomputer 321 completes the verification process of the program stored in the boot ROM 303. Switch. As a result, the CPU 301 can be booted using the unaltered boot program stored in the boot ROM 303.

[Second Embodiment]
In the second embodiment, an example in which the connection control unit 322 controls the connection state of the CS signal line between the CPU 301 and the boot ROM 303 after the boot of the CPU 301 is completed will be described. It should be noted that description of portions common to the first embodiment will be omitted.

  FIG. 6 is a flowchart showing a procedure of processing executed by the connection control unit 322 according to this embodiment. The processing of S601 to S604 is the same as the processing of S501 to S504 in the first embodiment. In the present embodiment, when the connection control unit 322 switches the connection of the CS signal line to the boot ROM 303 from the microcomputer 321 to the CPU 301 in S604, the process proceeds to S605.

  In step S605, the connection control unit 322 determines whether the activation of the CPU 301 is completed. The connection control unit 322 is configured to be able to receive the activation completion notification from the CPU 301 via the control bus 422. When the boot process using the boot program stored in the boot ROM 303 is completed, the CPU 301 transmits a boot completion notification to the connection control unit 322 via the control bus 422. When the connection control unit 322 receives the activation completion notification from the CPU 301, the connection control unit 322 determines that the activation of the CPU 301 is completed, and advances the processing to S606.

  In step S606, the connection control unit 322 disconnects the connection of the CS signal line to the boot ROM 303, thereby setting the connection state of the CS signal line between the CPU 301 and the boot ROM 303 to the unconnected state. This makes it possible to prevent the CPU 301 from accessing the boot ROM 303.

  As described above, in the present embodiment, the connection control unit 322 sets the signal line 401 to the unconnected state in which neither the CPU 301 nor the microcomputer 321 is connected when the activation of the CPU 301 is completed. As a result, it is possible to prevent the programs in the boot ROM 303 from being illegally rewritten due to unauthorized access from the CPU 301 to the boot ROM 303 by a malicious user while the CPU 301 is operating normally. become.

[Third Embodiment]
In the third embodiment, an example in which the connection control unit 322 controls the connection state of the CS signal line between the CPU 301 and the startup ROM 303 without requiring notification from the CPU 301 after the startup of the CPU 301 is completed explain. Note that description of portions that are common to the first and second embodiments will be omitted.

  FIG. 7 is a flowchart showing a procedure of processing executed by the connection control unit 322 according to this embodiment. The processing of S701 to S704 is the same as the processing of S501 to S504 in the first embodiment. In this embodiment, when the connection control unit 322 switches the connection of the CS signal line to the boot ROM 303 from the microcomputer 321 to the CPU 301 in S704, the process proceeds to S705.

  In step S705, the connection control unit 322 initializes the timer used to determine whether the activation of the CPU 301 is completed. The connection control unit 322 of the present embodiment internally holds a timer capable of measuring a time longer than the time required for the activation processing of the CPU 301.

  Next, in step S706, the connection control unit 322 starts time counting by a timer. After the start of the time counting, in S707, the connection control unit 322 determines whether or not a predetermined time has elapsed since the timer started counting, and when the predetermined time has elapsed, the process proceeds to S708. This predetermined time is set to a time longer than the time required to complete the activation of the CPU 301.

  In S708, the connection control unit 322 disconnects the connection of the CS signal line to the boot ROM 303, as in S606, to bring the connection state of the CS signal line between the CPU 301 and the boot ROM 303 into the unconnected state. . This makes it possible to prevent the CPU 301 from accessing the boot ROM 303.

  According to this embodiment, the connection control unit 322 can disconnect the connection of the CS signal line between the CPU 301 and the boot ROM 303 after the startup of the CPU 301 is completed, without requiring notification from the CPU 301. . As a result, it is possible to prevent the programs in the boot ROM 303 from being illegally rewritten due to unauthorized access from the CPU 301 to the boot ROM 303 by a malicious user while the CPU 301 is operating normally. become.

[Fourth Embodiment]
In the fourth embodiment, an example in which the connection control unit 322 detects an unauthorized access from the CPU 301 to the boot ROM 303 by monitoring the CS signal from the CPU 301 while the CPU 301 is operating after booting will be described. . Note that description of portions that are common to the first to third embodiments will be omitted.

  FIG. 8 is a flowchart showing a procedure of processing executed by the connection control unit 322 according to this embodiment. The processing of S801 to S806 is the same as the processing of S601 to S606 in the second embodiment. In the present embodiment, when the connection control unit 322 disconnects the connection of the CS signal line to the boot ROM 303 in S806, the process proceeds to S807.

  In step S <b> 807, the connection control unit 322 monitors the CS signal output from the CPU 301 to the signal line 411 to monitor whether the CPU 301 accesses the boot ROM 303 using the CS signal. When the connection control unit 322 detects the access using the CS signal from the CPU 301 by monitoring the CS signal, the process advances to S808.

  In step S808, the connection control unit 322 notifies the CPU 301 of detection of an access abnormality with respect to the boot ROM 303, and ends the processing. Here, access from the CPU 301 to the boot ROM 303 is normally performed only when the image forming apparatus 10 is booted. Nevertheless, if the CPU 301 accesses the boot ROM 303 after booting using the boot program stored in the boot ROM 303, it is possible that a malicious user has performed access. Therefore, in the present embodiment, the CPU 301 is notified of the occurrence of such an access abnormality. The CPU 301 may display on the operation unit 12 the occurrence of the access abnormality to the boot ROM 303 based on the notified information.

  As described above, according to the present embodiment, when an unauthorized access from the CPU 301 to the boot ROM 303 occurs by a malicious user while the CPU 301 is operating normally, such an access abnormality is detected. Can notify the occurrence. Thereby, it is possible to prevent the program in the boot ROM 303 from being illegally rewritten, and it is also possible to notify that there is an attack on the device.

[Fifth Embodiment]
In the fifth embodiment, an example will be described in which the CPU 301 can access the boot ROM 303 in order to update the program (software) in the boot ROM 303 while the CPU 301 is operating after boot. Note that description of portions that are common to the first to fourth embodiments will be omitted.

  FIG. 9 is a flowchart showing a procedure of processing executed by the connection control unit 322 according to this embodiment. The processing of S901 to S906 is the same as the processing of S601 to S606 in the second embodiment. In the present embodiment, when the connection control unit 322 disconnects the connection of the CS signal line to the boot ROM 303 in S906, the process proceeds to S809.

  In step S <b> 907, the connection control unit 322 determines whether the CS signal line connection instruction has been received from the CPU 301 via the control bus 422. Upon receiving the connection instruction from the CPU 301, the connection control unit 322 advances the process to S908. In step S908, the connection control unit 322 connects the unconnected CS signal line between the boot ROM 303 and the CPU 301, and ends the processing. Specifically, the connection control unit 322 connects the signal line 401 and the signal line 411. This allows the CPU 301 to access the boot ROM 303 using the CS signal via the signal lines 412 and 401, and update the program in the boot ROM 303.

  According to the present embodiment, similarly to the above-described embodiments, in the state where the CPU 301 is normally operating, the program in the boot ROM 303 is illegally rewritten due to the unauthorized access from the CPU 301 to the boot ROM 303. Can be prevented. Further, it becomes possible to change the connection state of the signal line from the CPU 301 as needed and update the program in the boot ROM 303.

[Other Embodiments]
The above-described first to fifth embodiments can be combined as appropriate. The present invention can also be applied to a system including a plurality of devices (eg, computer, interface device, reader, printer, etc.).

  The present invention supplies a program that realizes one or more functions of the above-described embodiments to a system or apparatus via a network or a storage medium, and one or more processors in a computer of the system or apparatus read and execute the program. It can also be realized by the processing. It can also be realized by a circuit (for example, ASIC) that realizes one or more functions.

  10, 20, 30: Image forming device, 11: Controller, 12: Operation unit, 13: Scanner unit, 14: Printer unit, 301: CPU, 302: RAM, 303: Startup ROM, 304: HDD, 321: Microcomputer 322: Connection control unit

Claims (13)

An information processing device,
First control means,
Storage means for storing a program executed by the first control means,
Second control means for accessing the storage means and verifying whether the program has been tampered with when the information processing apparatus is activated;
Connection control means for controlling connection of a signal line for access from each of the first control means and the second control means to the storage means, wherein the program stored in the storage means has been tampered with. The connection destination of the signal line is changed from the second control means so that the first control means can access the storage means in response to the notification of the verification result indicating that there is no such change from the second control means. Switching to the first control means, the connection control means,
An information processing device comprising: The first control means is started by executing the program stored in the storage means when the connection destination of the signal line is switched from the second control means to the first control means,
The connection control means, when the activation of the first control means is completed, sets the signal line to an unconnected state in which it is not connected to either the first control means or the second control means. The information processing device according to claim 1. The connection control unit connects the signal line to the second control unit when the information processing apparatus is activated, and determines the connection destination of the signal line according to the notification indicating the verification result from the second control unit. The information processing apparatus according to claim 1 or 2, wherein the second control means is switched to the first control means. When the second control unit determines that the program stored in the storage unit has not been tampered with by the verification, a notification signal indicating a result of the determination is sent to the connection control unit and the first control unit. Output,
The connection control means switches the connection destination of the signal line from the second control means to the first control means according to the notification signal from the second control means,
The information processing apparatus according to any one of claims 1 to 3, wherein the first control unit is released from the reset state by inputting the notification signal from the second control unit. . The information processing apparatus according to claim 4, wherein when the reset state is released, the first control unit accesses the storage unit via the signal line to execute the program. The connection control means, when a predetermined time elapses after switching the connection destination of the signal line from the second control means to the first control means, changes the signal line to the first control means and the second control means. The information processing apparatus according to claim 2, wherein the information processing apparatus is set to an unconnected state in which the information processing apparatus is not connected to any of the above. The connection control means corresponds to a state in which a third signal line between the storage means and the connection control means is connected to a first signal line corresponding to the first control means, and the second control means. 7. Switching between a state of being connected to a second signal line and an unconnected state of being not connected to either the first signal line or the second signal line, according to any one of claims 1 to 6. The information processing device according to item 1. When the connection control means detects a signal output from the first control means to the first signal line in the unconnected state, the connection control means notifies the first control means that an access abnormality has occurred to the storage means. The information processing apparatus according to claim 7, wherein: A control bus for communication between the first control means and the connection control means is provided between the first control means and the connection control means,
When the connection control means receives the connection instruction of the signal line from the first control means via the control bus in the unconnected state, the connection control means causes the first control means of the program stored in the storage means to operate. The information processing apparatus according to claim 7, wherein the first signal line and the third signal line are connected to each other so that the information can be updated. The connection control means controls connection of a signal line for transmitting an SPI-compliant chip select signal output from the first control means and the second control means to the storage means. The information processing apparatus according to any one of claims 1 to 9. Between each of the first control means and the second control means and the storage means, a signal line for accessing the storage means, a signal line for supplying a clock to the storage means, and A signal line for inputting data to the storage means and a signal line for outputting data from the storage means are provided,
The information processing apparatus according to any one of claims 1 to 10, wherein the connection control unit controls connection of a signal line for access to the storage unit. A control method for an information processing apparatus, comprising: a first control means and a second control means; and a storage means in which a program executed by the first control means is stored,
A verification step in which the second control means, when the information processing apparatus is activated, accesses the storage means and verifies whether or not the program has been tampered with;
The connection control means is a control step of controlling connection of a signal line for access from each of the first control means and the second control means to the storage means, and the program stored in the storage means In response to the fact that the verification result indicating that is not tampered with is notified from the second control means, the connection destination of the signal line is changed to the first so that the first control means can access the storage means. The control step of switching from two control means to the first control means;
A method for controlling an information processing device, comprising:   A program for causing a computer to execute each step of the control method of the information processing apparatus according to claim 12.

Images