JP6779758B2 - Information processing equipment, information processing methods and programs - Google Patents

Description

The present invention relates to an information processing device, an information processing method and a program.

Computer resource division and virtualization technologies are widespread in order to prevent information leakage and falsification. For example, in the technology represented by ARM's TrustZone (registered trademark), computer resources can be separated into a secure area and a non-secure area at the hardware level even though the processor is a single processor. Then, a program operating in the non-secure area cannot directly access the data in the secure area. Therefore, even if malware operates in the non-secure area and attempts to eavesdrop or falsify the confidential data, if the confidential data is stored in the secure area, leakage or falsification can be prevented.
In addition, with virtualization technology, a program whose reliability cannot be determined is executed in a sandbox or virtual space to separate it from the actual system and enhance security.

JP-A-2010-134572

In the prior art, the information that a program in the non-security area can obtain from the security area is limited, and the data that can be accessed is also limited. Therefore, the development of programs in the non-secure area was restricted.
An object of the present invention is to relax restrictions on program development in a non-secure area while ensuring the confidentiality of data in a secure area.

The present invention has a processor having a non-secure area for operating a first processing means whose security has not been confirmed and a secure area for operating a second processing means for which security has been confirmed. The processing means controls access to the access area of the first processing means based on the authentication level added to the first processing means.

According to the present invention, it is possible to relax the restrictions on program development in the non-secure area while ensuring the confidentiality of the data in the secure area.

It is a figure which shows an example of the hardware configuration of an information processing apparatus. It is a figure which shows an example of the functional structure of the information processing apparatus of Embodiment 1. It is a flowchart which shows the determination process of the authentication level of Embodiment 1. It is a figure which shows an example of the functional structure of the information processing apparatus of Embodiment 2. It is a figure which shows an example of a bus protocol. It is a flowchart which shows the determination process of the authentication level of Embodiment 2.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

FIG. 1 is a diagram showing an example of a hardware configuration of the information processing device 10.
The processor 11 controls various devices connected to the system bus 14.
The ROM 12 stores a BIOS program and a boot program.
The RAM 13 is used as the main storage device of the processor 11.
The keyboard controller (KBC) 15 performs processing related to input of information and the like from a pointing device (PD) 109 such as a mouse and a keyboard (KB) 20.
The display control unit (CRTC) 16 has a video memory inside, draws the image data in the video memory according to an instruction from the processor 11, and outputs the image data drawn in the video memory to the CRT 21 as a video signal. Although CRT21 is illustrated as a display device in FIG. 1, the type of display device such as a liquid crystal display device does not matter.
The disk controller (DKC) 17 accesses the hard disk (HDD) 22.
The network interface card (NIC) 18 connects to a network and performs information communication via the network.
The HDD 22 stores OS programs, programs of various applications running on the OS, and the like. The HDD 22 is an example of a storage area.
In the above configuration, when the power of the information processing device 10 is turned on, the processor 11 reads the OS program from the HDD 22 into the RAM 13 according to the boot program stored in the ROM 12, and executes the process to perform the function of each device. Realize.
By executing the processing based on the program stored in the ROM 12 or the HDD 22 by the processor 11 of the information processing device 10, the functional configuration of the processor 11 of FIGS. 2 and 4 described later and the processing of the flowchart of FIG. 3 described later are realized. Will be done. Further, in the case of the second embodiment described later, the CPU or processor of the security device of the information processing device 10 executes the process based on the program stored in the memory of the security device, thereby executing the process based on the program of the security device of FIG. The functions of 302 and the processing of the flowchart of FIG. 6 described later are realized.

<Embodiment 1>
The information processing device 10 of the first embodiment is a method of limiting accessible devices by having a determination module in a secure area.
FIG. 2 is a diagram showing an example of the functional configuration of the information processing apparatus 10 of the first embodiment.
The pre-authentication unit 100 authenticates the program in advance. The pre-authentication unit 100 may be mounted on another device capable of communicating with the information processing device 10 via a network or the like, but in the present embodiment, it is assumed that the pre-authentication unit 100 is mounted on the information processing device 10. It should be noted that certification may be added in advance when creating a product program at a factory or the like. The pre-authentication unit 100 has a function of determining in advance whether or not the program satisfies the authentication level, and if the determination result is permission (a program satisfying the authentication level), the authentication level additional information 1012 is added to the program 1011. The method of applying for the certification level is not specified. For the authentication level additional information 1012, it is preferable to use a security-guaranteed certification means such as an electronic certificate, but in a security-guaranteed system, other means such as adding only the authentication level level information is used. You may.

The processor 101 is the same as the processor 11 of FIG. The level 1 access area 102 is, for example, the RAM 13 of FIG. The level n access area 103 having an access permission level lower than the level 1 access area 102 is, for example, the ROM 12 of FIG. Here, n is a natural number of 2 or more. The non-secure device 104 having no access permission level is, for example, the HDD 22 in FIG. The access permission level may be subdivided into two or more, and there may be a plurality of devices having the same permission level. FIG. 2 shows an example including one level n access area 103. The processor 101 has a non-secure area and a secure area, and the monitor 1013 operates in the secure area. The monitor 1013 is a mechanism that guarantees security in the secure area. The monitor 1013 has a determination module 1014. The determination module 1014 enables fine access control of the application area and the like related to the program 1011. The determination module 1014 selects a range of devices that can be accessed by the program (application realized by the processor 11 executing processing based on the program) from the authentication level addition information 1012 added to the program by the pre-authentication unit 100. Depending on the determined level, the program can access the access area. For example, if the program (application related to the program) has received the highest level 1 authentication, access to the level 1 access area 102, the lower level n access area 103, and the non-secure device 104 is permitted. Will be done. On the other hand, a program whose authentication level is level n authentication is prohibited from accessing the level 1 access area 102 whose access permission level is higher than the authentication level, and is permitted to access only the level n access area 103 and the non-secure device 104. To. Access control is controlled by the determination module 1014 in the monitor 1013. The determination module 1014 denies access to programs that do not meet the level. More specifically, the determination module 1014 controls access based on the authentication level added to the program related to the application and the access level of each of the plurality of access areas (102 to 104). That is, the determination module 1014 permits access to the access area accessible to the application among the plurality of access areas based on the authentication level of the program related to the application and the access level of each of the plurality of access areas. The level 1 access area 102 is an example of an access area in which an access level of level 1 is set. The level n access area 103 is an example of an access area in which an access level of level n is set.
The non-secure area of the processor 101 is an example of a non-secure area for operating the first processing means whose security has not been confirmed. Further, the secure area of the processor 101 is an example of a secure area for operating the second processing means for which security is confirmed. The application realized by the processor 101 executing the process based on the program 1011 or the program 1011 is an example of the first processing means. Further, the monitor 1013 or the determination module 1014 is an example of the second processing means.

FIG. 3 is a flowchart showing an example of the authentication level determination process.
In S201, the determination module 1014 acquires the pre-authenticated authentication level from the authentication level additional information 1012. For example, when authenticated by a digital certificate, the determination module 1014 acquires the authentication level from the certificate.
In S202, the determination module 1014 determines whether or not the acquired authentication level is 1. The determination module 1014 proceeds to S204 when it is determined that the authentication level is 1 (Yes in S202), and proceeds to S203 when it is determined that the authentication level is not 1 (No in S202).
In S204, the determination module 1014 permits access to a device having a permission level of level 1 or lower.
In S203, the determination module 1014 determines whether or not the authentication level is 2. The determination module 1014 proceeds to S205 when it is determined that the authentication level is 2 (Yes in S203), and proceeds to S206 when it is determined that the authentication level is not set (No in S203).
In S205, the determination module 1014 permits access to a device having a permission level of level 2 or lower. The determination module 1014 repeats the processes of S203, S205, etc. according to the subdivided authentication level and access permission level when the authentication level and access permission level are further subdivided.
In S206, the determination module 1014 permits access only to the non-secure device 104.
In S207, the determination module 1014 determines whether or not the program 1011 ends the process. When the determination module 1014 determines that the program 1011 finishes the process (Yes in S207), the determination module 1014 proceeds to S201 and starts the authentication level determination process again. When the determination module 1014 determines that the program 1011 does not end the process (No in S207), the determination module 1014 proceeds to S202, and access to the device is permitted until the program 1011 ends.

The range of information that can be accessed can be limited for each program by the function of the judgment module 1014. For example, in a non-secure area, access to an image is permitted, but access to an image originality guarantee function is denied. It can be set for each program being executed.

<Embodiment 2>
FIG. 4 is a diagram showing an example of the functional configuration of the information processing device 10 of the second embodiment.
The pre-authentication unit 300 authenticates the program in advance. The pre-authentication unit 300 may be mounted on another device capable of communicating with the information processing device 10 via a network or the like, but in the present embodiment, the pre-authentication unit 300 will be described assuming that it is mounted on the information processing device 10. The pre-authentication unit 300 has a function of determining in advance whether or not the program satisfies the authentication level, and if the determination result is permission (a program satisfying the authentication level), the authentication level additional information 3012 is added to the program 3011. The method of applying for the certification level is not specified. For the authentication level additional information 3012, for example, a security-guaranteed certification means such as an electronic certificate may be used, but in a security-guaranteed system, only the authentication level level information is added, or other means may be used. May be good.

The processor 301 is the same as the processor 11 of FIG. The security device 302 includes a level 1 access area 3022, a level n access area 3023 having an access permission level lower than the level 1 access area 3022, and a non-secure device 3024 having no access permission level. The security device 302 also includes a determination module 3021. In FIG. 4, 303 is a security area and 304 is a non-security area. The security device 302 is, for example, the HDD 22 of FIG. The permission level may be subdivided into two or more, and there may be a plurality of devices having the same permission level. FIG. 4 shows an example in which one security device 302 has one level n access area 3023. The processor 301 has a non-secure area and a secure area, and the monitor 3013 operates in the secure area. The monitor 3013 is a mechanism that guarantees security in the secure area. The monitor 3013 has a determination module 3014 and a notification module 3015.

The combination of the determination module 3014, the notification module 3015, and the determination module 3021 enables fine access control of the application area and the like related to the program 3011. The determination module 3014 selects the range of devices that the program can access from the authentication level addition information 3012 added to the program by the pre-authentication unit 300. The notification module 3015 notifies the determination module 3021 of the authentication level of the program using the protocol shown in FIG. FIG. 5 shows an example of a bus protocol to which the processor 301 is connected. There are address channels 500, 502, 504, 510, 512 and data channels 501, 503, 511, 513. There is already a signal 5001 for notifying read / write, a signal 5002 for notifying data, and a signal for NS bit 5003 notifying whether the access is from the secure area or the non-secure area. In this embodiment, a method of notifying the access permission level without modifying the bus protocol and the processor is shown by using the signal shown in FIG. For example, the notification module 3015 defines signals 505 (read instruction), 506 (write instruction), and 507 (read instruction) as one access pattern for a specific address. When the notification module 3015 detects a pattern, the notification module 3015 superimposes the level information of the authentication level to be notified on the data 508 written by the write command 506. The special command of such a method conforms to the standard of the existing bus, and the function of this embodiment makes it possible to easily subdivide the access permission level without extending the bus protocol.

In the method described above, an overhead of access pattern notification occurs for each data access. Therefore, as a means for resolving the overhead, the notification module 3015 may provide the NS bit 5003 with the level information of the authentication level. The notification module 3015 selects a pattern that matches the level information of the authentication level to be notified from the level notification signal list 516. Then, the notification module 3015 notifies the selected signal by changing the signal level of the NS bit 5003 in the same address channel 510. For example, the notification module 3015 notifies as a level 1 notification 514 signal when notifying the authentication level 1, and as a level 2 notification 515 when not wanting to notify the authentication level 2. The information processing of the combination of the determination module 3014, the notification module 3015, and the determination module 3021 enables the following. Depending on the determined level, for example, an application related to the program having the highest level 1 authentication can access the level 1 access area 3022, the level n access area 3023 having a lower access permission level, and the non-secure device 3024. Is. Applications related to programs that have received level n authentication are prohibited from accessing the level 1 access area 3022, which has a higher access permission level than the authentication level, and are allowed access only to the level n access area 3023 and the non-secure device 3024. The access control shall be controlled by the determination module 3021 in the security device 302, and as described above, the access of the program that does not satisfy the level is denied.
The non-secure area of the processor 301 is an example of a non-secure area for operating the first processing means whose security has not been confirmed. Further, the secure area of the processor 301 is an example of a secure area for operating the second processing means for which security is confirmed. The application realized by the processor 301 executing the process based on the program 3011 or the program 3011 is an example of the first processing means. Further, the monitor 3013 or the notification module 3015 is an example of the second processing means. The determination module 3021 is an example of the control means. The level 1 access area 3022 is an example of an access area in which an access level of level 1 is set. The level n access area 3023 is an example of an access area in which an access level of level n is set.
By using the notification module 3015, it is possible to have a plurality of permission levels in the same slave. The notified authentication level is controlled by the information processing of the flowchart shown in FIG. 6 in the determination module 3021.

In S400, the determination module 3021 detects the negotiation of the address channel from the notification module 3015 via the bus.
Then, in S401, the determination module 3021 acquires the authentication level of the program 3011 from the bus access pattern or the NS bit pattern.
In S402, the determination module 3021 executes the level determination process according to the acquired authentication level.
In S403, the determination module 3021 determines whether or not the acquired authentication level is 1. The determination module 3021 proceeds to S404 when it is determined that the authentication level is 1 (Yes in S403), and proceeds to S405 when it is determined that the authentication level is not 1 (No in S403).
In S404, the determination module 3021 permits access to a device having a permission level of level 1 or lower.
In S405, the determination module 3021 determines whether or not the authentication level is 2. The determination module 3021 proceeds to S406 when it is determined that the authentication level is 2 (Yes in S405), and proceeds to S407 when it is determined that the authentication level is not set (No in S405).
In S406, the determination module 3021 permits access to a device having a permission level of level 2 or lower. The determination module 3021 repeats the processes of S405, S406, etc. according to the subdivided authentication level and access permission level when the authentication level and access permission level are further subdivided.
In S407, the determination module 3021 permits access only to the non-secure device 3024.
In S408, the determination module 3021 determines whether or not the data channel by the bus protocol is completed. When the determination module 3021 determines that the data channel by the bus protocol is completed (Yes in S408), the determination module 3021 proceeds to S400 and starts the authentication level determination process again. If the determination module 3021 determines that the data channel according to the bus protocol has not been completed (No in S408), the determination module 302 proceeds to S403, and access to the device is permitted until the data channel according to the bus protocol is completed.

The function of the determination module 3021 can limit the range of information that can be accessed for each program. For example, in a non-secure area, access to an image is permitted, but access to an image originality guarantee function is denied. It can be set for each program being executed.

<Other Embodiments>
The present invention supplies a system or device via a network or storage medium with a program that realizes one or more of the functions of the above embodiments. It can also be realized by a process in which one or more processors in the computer of the system or apparatus reads and executes a program. It can also be realized by a circuit (for example, ASIC) that realizes one or more functions.

Although the preferred embodiment of the present invention has been described in detail above, the present invention is not limited to the specific embodiment. For example, the determination modules 1014 and 3014, the notification module 3015, the determination module 3021, and the like may be mounted on the information processing apparatus 10 as hardware. The same applies to the pre-authentication units 100 and 300.
The information processing device 10 may be a printer, an MFP, or the like. Printers and MFPs are examples of image processing devices.

As described above, according to the processing of each of the above-described embodiments, it is possible to relax the restrictions on the program development in the non-secure area while ensuring the confidentiality of the data in the secure area.

10 Information processing device 11 Processor

Claims (11)

It has a processor having a non-secure area for operating a first processing means whose security has not been confirmed and a secure area for operating a second processing means whose security has been confirmed.
The second processing means is an information processing device that controls access to the access area of the first processing means based on the authentication level added to the first processing means. It also has multiple access areas with different access levels.
The second processing means is based on the authentication level added to the first processing means and the access level of each of the plurality of access areas, and the first processing means among the plurality of access areas. The information processing apparatus according to claim 1, wherein the information processing apparatus permits access to an access area accessible to the user. A processor having a non-secure area for operating the first processing means for which security has not been confirmed and a secure area for operating the second processing means for which security has been confirmed, and
Devices with multiple access areas with different access levels and
Have,
The second processing means notifies the device of the authentication level added to the first processing means.
The device is an information processing device having a control means for controlling access to an access area of the first processing means based on the notified authentication level. Based on the notified authentication level and each access level of the plurality of access areas, the control means accesses an access area accessible by the first processing means among the plurality of access areas. The information processing device according to claim 3, which is permitted. The processor and the device are connected via a bus.
The information processing device according to claim 3 or 4, wherein the second processing means notifies the device of the authentication level using the access pattern of the bus. The processor and the device are connected via a bus.
The information processing device according to claim 3 or 4, wherein the second processing means notifies the device of the authentication level using a pattern of NS bits. The information processing apparatus according to any one of claims 1 to 6, further comprising an authentication means for adding an authentication level to the first processing means. The information processing device according to any one of claims 1 to 7, wherein the information processing device is an image processing device. It is an information processing method executed by an information processing device.
It has a processor having a non-secure area for operating a first processing means whose security has not been confirmed and a secure area for operating a second processing means whose security has been confirmed.
An information processing method in which the second processing means controls access to an access area of the first processing means based on an authentication level added to the first processing means. It is an information processing method executed by an information processing device.
A processor having a non-secure area for operating the first processing means for which security has not been confirmed and a secure area for operating the second processing means for which security has been confirmed, and
Devices with multiple access areas with different access levels and
Have,
The second processing means notifies the device of the authentication level added to the first processing means.
An information processing method in which the device controls access to the access area of the first processing means based on the notified authentication level. A program for causing a computer to function as each means of the information processing apparatus according to any one of claims 1 to 8.

Images