WO2020259285A1 - 图像形成装置及图像形成装置用安全控制系统 - Google Patents

图像形成装置及图像形成装置用安全控制系统 Download PDF

Info

Publication number
WO2020259285A1
WO2020259285A1 PCT/CN2020/095310 CN2020095310W WO2020259285A1 WO 2020259285 A1 WO2020259285 A1 WO 2020259285A1 CN 2020095310 W CN2020095310 W CN 2020095310W WO 2020259285 A1 WO2020259285 A1 WO 2020259285A1
Authority
WO
WIPO (PCT)
Prior art keywords
program
controller
verified
security chip
image forming
Prior art date
Application number
PCT/CN2020/095310
Other languages
English (en)
French (fr)
Inventor
尹爱国
覃祖料
张军
李海雄
胡智敏
Original Assignee
珠海奔图电子有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN201920996840.6U external-priority patent/CN210007764U/zh
Priority claimed from CN201921461567.3U external-priority patent/CN210804374U/zh
Priority claimed from CN201910832398.8A external-priority patent/CN110536042B/zh
Application filed by 珠海奔图电子有限公司 filed Critical 珠海奔图电子有限公司
Publication of WO2020259285A1 publication Critical patent/WO2020259285A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F13/00—Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units
    • G06F13/38—Information transfer, e.g. on bus
    • G06F13/40—Bus structure
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12—Protecting executable software
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N1/00—Scanning, transmission or reproduction of documents or the like, e.g. facsimile transmission; Details thereof
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N1/00—Scanning, transmission or reproduction of documents or the like, e.g. facsimile transmission; Details thereof
    • H04N1/44—Secrecy systems

Definitions

  • This application relates to the field of image forming technology, and in particular to an image forming apparatus and a security control system for the image forming apparatus.
  • image forming apparatuses are vulnerable to attacks by criminals (such as hackers).
  • a laser printer with fax function one of the many types of image forming devices
  • scanned or faxed data may carry user’s confidential data, even on the photosensitive drum, the core component of laser imaging. It may carry confidential data to be printed by the user; once the data is leaked, it will cause a lot of unnecessary troubles to the user; if it involves the office of a company or a government secret department, if the confidential data carried by the image forming device is leaked, May endanger the safety of the company or the government.
  • the prior art usually sets a security chip to monitor the operation of the controller (imaging controller) of the image forming apparatus, but there is currently no reliable solution that can well guarantee the security of the image forming apparatus processing information.
  • the embodiments of the present application provide an image forming apparatus and a security control system for the image forming apparatus, which can solve the problem that there is no reliable solution that can well guarantee the security of information processed by the image forming apparatus.
  • an image forming apparatus including:
  • a controller configured to control the image forming apparatus to perform an imaging operation
  • a security chip connected to the controller, and configured to monitor the operating activities of the controller
  • a memory connected to the security chip, configured to store a program to be verified, and the program to be verified is a program used for running the image forming apparatus;
  • the security chip performs security verification on the program to be verified, and when the result of the security check of the program to be verified by the security chip is not passed, the security chip controls the controller not to execute The program to be verified.
  • the program to be verified includes a startup program
  • the memory also stores security verification information
  • the security chip includes a startup controller
  • the startup controller is connected to The controller is connected and configured to first control the security chip to read the startup program and safety verification information stored in the memory, and perform security verification on the startup program through the safety verification information, After the safety check is passed, the controller is controlled to read the startup program to complete the startup of the controller.
  • the program to be verified includes a startup program
  • the memory also stores security verification information
  • the security chip includes a startup controller
  • the startup controller is connected to The controller is connected and configured to first control the security chip to read the startup program and safety verification information stored in the memory, and perform security verification on the startup program through the safety verification information, After the safety check is passed, the controller is controlled to read the startup program to complete the startup of the controller.
  • the startup controller is connected to the reset pin of the controller, and the startup controller is configured to, before the startup program passes the safety check, A reset enable signal is output to the reset pin of the controller, and after the startup program passes the safety check, a reset failure signal is output to the reset pin of the controller.
  • the image forming apparatus further includes a first isolation circuit and a second isolation circuit, the first isolation circuit is connected between the startup controller and the memory , The second isolation circuit is connected between the controller and the memory, and the first isolation circuit and the second isolation circuit share a bus interface to connect to the memory;
  • the security chip After the image forming apparatus is powered on, the security chip is activated first, the activation controller first controls the first isolation circuit to be turned on and the second isolation circuit to turn off, and the security chip reads the activation of the memory Program and safety verification information, and use the safety verification information to perform safety verification on the startup program. After the startup program passes the safety verification, the startup controller then controls the first isolation The circuit is disconnected and the second isolation circuit is turned on, and the controller reads the startup program of the memory to complete the startup.
  • the first isolation circuit includes a first switch, and the first end, the second end, and the third end of the first switch are connected to the security chip and the The activation controller is connected to the memory, and the activation controller controls the communication between the first terminal and the third terminal of the first switch by sending a preset electrical signal to the second terminal of the first switch On or off;
  • the second isolation circuit includes a second switch, and the first end, the second end, and the third end of the second switch are respectively connected to the controller, the activation controller, and the memory; the activation control The device controls the conduction or disconnection between the first terminal and the third terminal of the second switch by sending a preset electrical signal to the second terminal of the second switch.
  • the security chip is connected to the memory via a first communication bus, and the security chip is connected to a second pin of the controller via a second communication bus, After the image forming apparatus is powered on, the security chip reads the startup program stored in the memory through the first communication bus, performs a security check on the startup program, and updates the startup program It is sent to the controller via the second communication bus, so that the controller reads the startup program of the memory to complete the startup.
  • the image forming apparatus further includes a power supply module connected to the controller and configured to supply power to the controller;
  • the security chip is further configured to disconnect the connection between the power module and the controller when it is monitored that the controller does not meet the preset security condition.
  • the image forming apparatus further includes a fourth switch and a fifth switch, and the security chip and the controller are respectively connected to the first end of the fourth switch and The enable terminal is connected, the second terminal of the fourth switch is connected to the enable terminal of the fifth switch, and the first terminal and the second terminal of the fifth switch are respectively connected to the power module and the controller The power supply pin is connected.
  • the enable terminal of the fourth switch receives the enable valid signal, the first terminal and the second terminal of the fourth switch are conducted, and the security chip generates the enable invalid signal to The enable terminal of the fifth switch, the path between the first terminal and the second terminal of the fifth switch is disconnected;
  • the security chip After the startup program passes the security check, the security chip generates an enable valid signal, and sends the enable valid signal to the enable terminal of the fifth switch through the fourth switch, and the first The first terminal and the second terminal of the five switch are conducted, and the power module supplies power to the controller.
  • the image forming apparatus further includes a sixth switch, and the security chip and the controller are respectively connected to the first end and the enable end of the sixth switch , The second terminal of the sixth switch is connected to the enable terminal of the power module;
  • the enable terminal of the sixth switch receives the enable valid signal, the first terminal and the second terminal of the sixth switch are turned on, and the security chip generates the enable invalid signal to The enabling end of the power supply module;
  • the security chip After the startup program passes the security check, the security chip generates an enable valid signal to the enable terminal of the power module, and the power module supplies power to the controller.
  • the security chip is specifically configured to read the program to be verified stored in the memory after the image forming apparatus is powered on, and to check the The program to be verified performs safety verification and sends the program to be verified to the program loader to be verified corresponding to the controller, and the program loader to be verified starts to execute after receiving the program to be verified The program to be verified;
  • the security chip determines that the program to be verified does not meet the security requirements, and the controller is currently executing the program to be verified When the program is verified, the security chip controls the controller to stop executing the program to be verified.
  • the security chip performs a check on the read program to be verified during or after reading the program to be verified.
  • the program performs safety verification, and at the same time, the read program to be verified is sent to the program loader to be verified.
  • the security chip first performs a check on the read program to be verified during or after reading the program to be verified.
  • the verification program performs security verification, and when it is determined that the read program to be verified meets the safety requirements, the read program to be verified is sent to the program loader to be verified.
  • the program to be verified includes a startup program, if the security chip determines that the startup program does not meet the safety requirements, and the controller is currently executing the startup During the program, the security chip first controls the controller to stop executing the startup program, and then controls the controller to reset, so that the controller returns to the initial state; or, the security chip first controls the control The controller stops executing the startup program, and then controls the controller to power off.
  • the program to be verified includes at least one application, and if the security chip determines that the first application in the at least one application does not meet the security requirements, The security chip prohibits the controller from executing the first application program.
  • the present application provides a startup control system for an image forming apparatus.
  • the image forming apparatus includes a controller configured to control the image forming apparatus to perform imaging operations, including:
  • a security chip connected to the controller, and configured to monitor the operating activities of the controller
  • a memory connected to the security chip, and configured to store a program to be verified of the controller, the program to be verified is a program used by the image forming apparatus to run;
  • the security chip performs security verification on the program to be verified, and when the result of the security check of the program to be verified by the security chip is not passed, the security chip controls the controller not to execute The program to be verified.
  • the security chip is used to perform security verification on the program to be verified stored in the memory.
  • the security chip controls the controller to stop executing the program to be verified.
  • the verification program makes the operation process of the controller be monitored by the security chip, ensuring the safety of the image forming device during the operation process.
  • FIG. 1 is a schematic block diagram of an image forming apparatus according to an embodiment of the application
  • FIG. 2 is a schematic block diagram of an image forming apparatus according to another embodiment of this application.
  • FIG. 3 is a diagram of the connection relationship between components of an image forming apparatus according to an embodiment of the application.
  • FIG. 4 is a schematic block diagram of an image forming apparatus according to another embodiment of this application.
  • 5 to 10 are hardware block diagrams of image forming apparatuses provided by multiple different embodiments of the application.
  • FIG. 11 is a schematic block diagram of an image forming apparatus according to another embodiment of this application.
  • an embodiment of the present application provides an image forming apparatus, including:
  • the controller 1 is configured to control the image forming apparatus to perform an imaging operation
  • the security chip 2 connected to the controller 1, is configured to monitor the running activities of the controller 1;
  • the memory 3 is connected to the security chip 2 and is configured to store the program to be verified of the controller 1, and the program to be verified is a program used for the operation of the image forming apparatus;
  • the security chip 2 performs security verification on the program to be verified.
  • the security chip 2 controls the controller 1 not to execute the program to be verified.
  • the security chip 2 performs security verification on the program to be verified stored in the memory 3.
  • the security chip controls the controller to stop executing the program to be verified, so that the controller 1
  • the operation process is monitored by the security chip 2 to ensure the safety of the image forming device during operation.
  • the image forming apparatus means an apparatus that prints, for example, print data generated by a computer on a recording medium such as printing paper.
  • image forming apparatuses include, but are not limited to, copiers, printers, fax machines, scanners, and multifunctional peripherals that perform the above functions in a single device.
  • the controller 1 such as SoC (System on Chip, System on Chip), is configured to control the imaging processing operations of the image forming apparatus, and the SoC is used to perform processing operations related to data transmission and reception, command transmission and reception, and engine control.
  • SoC System on Chip, System on Chip
  • the engine mechanism executes commands for specific functions, such as LSU exposure parameters, pickup roller rotation parameters, etc.; in addition, for image forming devices with user authorization authentication or encryption/decryption processing functions, SoC is also set to perform user authorization authentication or encryption /Decryption processing function, and the interface unit in the image forming device can also receive print job data and print, scan, and fax commands from the drive device, or send scan, fax data, print, scan, fax status information, etc., and a security chip 2 Exchange predetermined security rules
  • the security chip 2 also known as the trusted computing monitoring module, is used to monitor the running activities of the controller 1 (SoC) in the image forming device; the trusted computing (Trusted Computing) in the security chip 2 is born for behavioral safety, It is widely used in computer and communication systems to improve the overall security of the system.
  • Information security includes four aspects: equipment security, data security, content security and behavior security; in order to further improve the behavioral security features of the image forming apparatus, this embodiment introduces a trusted computing function; the security chip 2 mentioned in this embodiment corresponds to The function module of the ”includes four functions: program (or module) startup/operation monitoring function (such as whitelist strategy), registration function, audit function, and upgrade monitoring function.
  • the security chip 2 is responsible for monitoring the image forming device operating system (such as The driver layer module of Linux system) and the application layer program responsible for monitoring the image forming device.
  • the security chip 2 only allows drivers and programs in the whitelist range to run, and the drivers and programs not in the whitelist range are not allowed to run; the security chip 2 will Recording or reporting security event behaviors that occur on the image forming device can realize comprehensive supervision of the driver layer and application layer of the image forming device, and can effectively prevent unsafe behaviors of application programs and device drivers of the controller 1.
  • NOR flash flash memory
  • NAND flash flash memory
  • EEPROM erasable programmable read-only memory
  • FRAM ferrroelectric memory
  • MRAM magnetic RAM
  • NVSRAM non-volatile static memory
  • the security chip 2 performs security verification on the program to be verified.
  • the security chip 2 fails the security check result of the verification program, the security chip 2 controls the controller 1 not to execute the program to be verified.
  • the security chip 2 controls the controller 1 not to execute the program to be verified; only when the security chip 2 passes the verification of the program to be verified, it is allowed
  • the controller 1 executes the program to be verified; during the verification process, if the verification fails, the security chip 2 controls the controller 1 to continue not to execute the program to be verified.
  • the security chip can verify the program to be verified in sections.
  • the controller 1 is allowed to load part of the program to be verified, but this part of the program to be verified is not sufficient for control.
  • the device 1 is fully started or performs all image processing operations.
  • the security chip 2 controls the controller 1 to stop executing the program to be verified.
  • the program to be verified includes a startup program, and the memory also stores security verification information.
  • the security chip 2 includes a startup controller 21, the startup controller 21 and the controller 1 connected, configured to first control the security chip 2 read the startup program and safety verification information stored in the memory 3, and verify the safety of the startup program through the safety verification information, and then control after the safety verification is passed
  • the controller 1 reads the startup program to complete the startup of the controller 1.
  • this application sets up a startup controller 21 in the security chip 2.
  • the security chip 2 starts up first, and the startup controller 21 first controls the security chip 2 to read the startup program and the startup program stored in the memory 3 Safety check information, and use the safety check information to check the safety of the startup program. After the safety check passes, control the controller 1 to read the startup program to complete the startup of the controller 1, so that the controller 1 is started.
  • the process is monitored by the security chip 2 to ensure the security of the image forming device during operation.
  • the security chip 2 includes a startup controller 21 and other devices.
  • the other devices are configured to implement other functions of the security chip except the startup controller 21.
  • Other devices It may include, but is not limited to, a reading device for reading the startup program and safety verification information in the memory 3, a verification unit for verifying the read startup program according to the safety verification information, and a verification unit for performing verification
  • the controller 1 monitors various circuits/units, etc., and various communication modules, interface units, etc. related to communication.
  • the startup program includes startup boot files (such as boot files, uboot files) and operating system information (such as initializing DDR, initializing cache, initializing serial ports, initializing network cards), etc.
  • the security verification information includes but is not limited to a preset verification code. In other embodiments, the security verification information may also be stored in the security chip 2 in advance.
  • the process of performing safety verification on the startup program may be: the startup controller 21 reads the startup program, generates calculation verification information, and compares whether the calculation verification information and the safety verification information satisfy a predetermined relationship. , Output information about whether the safety check of the startup program has passed; for example, the startup controller 21 uses its own operation circuit or operation code to perform logical operations on the startup program (hereinafter also referred to as preset rules) to obtain operation verification information, and start The controller 21 further compares the operation verification information and the safety verification information through a logic comparison circuit or a logic comparison code, and determines whether the operation verification information and the safety verification information meet a predetermined relationship (for example, equal), and if so, it outputs If the safety check of the startup program passed the information, if not satisfied, output the information that the safety check of the startup program failed.
  • the startup controller 21 reads the startup program, generates calculation verification information, and compares whether the calculation verification information and the safety verification information satisfy a predetermined relationship. , Output information about whether the safety check of the startup program
  • the startup controller 21 is connected to the reset pin (Reset) of the controller 1, and the startup controller 21 is configured to reset to the controller 1 before the startup program passes the safety check
  • the pin outputs a reset enable signal, and after the startup program passes the safety check, a reset failure signal is output to the reset pin of the controller 1.
  • the security chip 2 is activated, and the activation controller 21 of the security chip 2 outputs a low-level signal to the reset pin (Reset) of the controller 1, and the reset pin of the controller 1
  • the pin is enabled at low level, so the controller 1 cannot be started in the reset state.
  • the security chip 2 reads the startup program and safety verification information of the memory 3, and uses the safety verification information to perform safety verification on the startup program.
  • the controller 21 is started. Then send a high-level signal to the reset pin of the controller 1 so that the controller 1 can be started to ensure the safety of the controller 1.
  • the verification code preset in the security verification information in this application can be directly stored in advance, or it can be verified in advance (for example, before leaving the factory) on the complete startup program according to preset rules and obtained
  • the verification result is used as safety verification information, and the safety verification information is stored.
  • safety verification is required (for example, when the use process after sale needs to be started)
  • the start controller 21 reads the start program and safety verification information according to the above requirements, and performs logical operations on the start program to obtain the calculation calibration Check the information, and then compare the operation check information with the safety check information. If they are consistent, the startup program is complete and has not been modified. If they are inconsistent, the startup program has been modified. At this time, if controller 1 reads And the execution of the startup program will have security risks, so the startup controller 21 of the security chip 2 does not allow the controller 1 to start, so as to ensure the safe operation of the controller 1.
  • the process of verifying the boot file can be: accumulate the boot file to obtain the corresponding accumulative checksum, and compare the obtained accumulative checksum with the saved preset. Set the safety verification information and compare them. The two are the same. This shows that the boot file is complete and unmodified and meets the safety conditions.
  • the image forming apparatus further includes a first isolation circuit 4 and a second isolation circuit 5.
  • the first isolation circuit 4 is connected between the startup controller 21 and the memory 3, and the second isolation circuit 5 is connected to the controller. Between 1 and memory 3, the first isolation circuit 4 and the second isolation circuit 5 share a bus interface to connect to the memory 3.
  • the security chip 2 is activated first, and the activation controller 21 first controls the first isolation circuit 4 is turned on and the second isolation circuit 5 is disconnected, the security chip 2 reads the security verification information and the startup program of the memory 3, and uses the security verification information to perform security verification on the startup program.
  • the startup controller 21 controls the first isolation circuit 4 to be disconnected and the second isolation circuit 5 to conduct, and the controller 1 reads the startup program of the memory 3 to complete the startup.
  • the startup controller 21 first controls the first isolation circuit 4 to be turned on and the second isolation circuit 5 to turn off.
  • the controller 21 is activated to control the disconnection of the first isolation circuit 4 and the conduction of the second isolation circuit 5, which can prevent the controller 1 from causing interference to the communication bus when the security chip 2 reads the information in the memory 3. And to prevent the security chip 2 from causing interference to the communication bus when the controller 1 reads the information in the memory 3, thus further improving the reliability of the image forming apparatus.
  • the communication bus is specifically an SPI (Serial Peripheral Interface) bus, and correspondingly, the bus interface is specifically an SPI bus interface.
  • SPI Serial Peripheral Interface
  • the SPI bus is a full-duplex synchronous serial interface standard with high transmission efficiency.
  • the SPI bus only allows a master device to start a protocol for synchronous communication with a slave device to complete data exchange.
  • the first isolation circuit 4 includes a first switch.
  • the first terminal (Y), the second terminal (EN), and the third terminal (Z) of the first switch are respectively connected to the security chip 2, the activation controller 21, and the memory 3.
  • the activation controller 21 controls the conduction or disconnection between the first terminal (Y) and the third terminal (Z) of the first switch by sending a preset electrical signal to the second terminal (EN) of the first switch.
  • the second isolation circuit 5 includes a second switch.
  • the first terminal (Y), the second terminal (EN) and the third terminal (Z) of the second switch are respectively connected to the controller 1, the activation controller 21 and the memory 3;
  • the controller 21 controls the conduction or disconnection between the first terminal (Y) and the third terminal (Z) of the second switch by sending a preset electrical signal to the second terminal of the second switch.
  • the first switch may be, but not limited to, MOS (metal-oxide-semiconductor, metal-oxide-semiconductor field effect transistor), triode, IGBT (Insulated Gate Bipolar Transistor, insulated gate bipolar transistor), etc.
  • MOS metal-oxide-semiconductor, metal-oxide-semiconductor field effect transistor
  • IGBT Insulated Gate Bipolar Transistor, insulated gate bipolar transistor
  • Any one of the switches, and the second switch can be, but is not limited to, any one of electronic switches such as MOS transistors and IGBTs.
  • the first switch and the second switch are N-type MOS transistors, and the preset electrical signal is a high-level signal.
  • the security chip 2 is configured to receive the firmware upgrade package (for the firmware upgrade package run by the security chip) in the boot state to upgrade the operating firmware of the memory 3, and the startup controller 21 is in The reset enable signal is output to the controller 1 in the boot state.
  • the firmware upgrade process of the security chip 2 is: the controller 1 receives the firmware upgrade package issued by the electronic device (for example, a personal computer) and sends the firmware The upgrade package is sent to the security chip 2 to upgrade the operating firmware of the security chip 2. Since the security chip 2 is activated prior to the controller 1, when the controller 1 is started, the security chip 2 has already entered the program running state from the boot state. In order to ensure that the controller 1 can work normally when the firmware of the security chip 2 is upgraded, Continuing as shown in FIG.
  • the image forming apparatus further includes an analog switch circuit 6, the analog switch circuit 6 includes a third switch, the first end (Y) of the third switch is connected to the start controller 21, and the third switch The second end (EN) of the switch is connected to the reset pin (Reset) of the controller 1, and the third end (Z) of the third switch is connected to the control pin (GPIO49) of the controller 1.
  • the controller 1 is also configured as Before sending the firmware upgrade package to the security chip 2, a preset electrical signal is sent to the third end of the third switch (for easy distinction, hereinafter referred to as the first preset electrical signal), so that the first end of the third switch (Y ) And the third terminal (Z) are disconnected, and the controller 21 is activated to disable the reset enable signal of the controller 1.
  • the third switch may be, but is not limited to, any one of electronic switches such as MOS transistors, triodes, IGBTs, etc.
  • the third switch is an N-type MOS transistor, and the first preset electrical signal is low. Level signal
  • the security chip 2 is connected to the memory 3 and the controller 1 through a communication bus, and the startup program is sent to the controller 1 through the security chip 2;
  • the pin (SPIM) of the security chip 2 is connected to the memory 3 through the first communication bus
  • the pin (SPIS) of the security chip 2 is connected to the pins (FCSPI) of the controller 1 through the second communication bus
  • the security chip 2 reads the startup program stored in the memory 3 through the first communication bus, performs safety verification on the startup program, and sends the startup program to the controller 1 through the second communication bus, So that the controller 1 reads the startup program of the memory 3 to complete the startup.
  • this application reads the startup program from the security chip 2 first, and then sends the startup program to the controller 1 through the security chip 2, without setting the first isolation circuit 5 and the second isolation circuit 6 in the first method.
  • the interference problem between the security chip 2 and the controller 1 is avoided, and therefore, the hardware cost of the image forming apparatus provided in the present application can be further reduced, while ensuring the reliability of the image forming apparatus.
  • the first communication bus and the second communication bus are specifically the SPI bus.
  • the SPI bus has been described above and will not be repeated here.
  • the security chip 2 After the security chip 2 reads the startup program or in the process of reading the startup program, the security chip 2 first performs a safety check on the read startup program, and determines that the read startup program meets the safety requirements After that, the read startup program is sent to the controller 1 for execution. For example, the security chip 2 first reads all the startup programs, and then performs safety verification on the startup programs. If the startup programs pass the verification, the startup programs are sent to the controller 1 for execution.
  • the startup program is divided into multiple partitions, and the security of each partition is checked in turn. Whenever one of the partitions is checked After the verification is passed, the partition that passed the verification is sent to the controller 1 for execution. If there is a partition that fails the security verification in the above process, the reading and verification of the startup program is stopped, and the If the startup program fails to verify the information, the control controller 1 stops executing the startup program.
  • the security chip 2 performs security verification on the read startup program during or after reading the startup program, and at the same time The read startup program is sent to the controller 1. If the security chip 2 finds that the startup program does not meet the safety conditions during the safety verification of the startup program, the controller 1 is controlled to stop running the startup program.
  • the process of the security chip 2 performing security verification on the startup program is the process of the security chip 2 performing static measurement on the controller 1.
  • the controller 1 starts and the security chip 2 starts to control Controller 1 performs dynamic measurement.
  • the specific dynamic measurement is to set the password confirmation link during the execution of the firmware of controller 1.
  • controller 1 will ask for the password from the security chip 2 and communicate with it.
  • the password in the firmware of the controller 1 is compared, and the controller 1 continues to execute the firmware when the two are the same.
  • the image forming apparatus further includes a power module 7, and the power module 7 is connected to the controller 1 and configured to supply power to the controller 1;
  • the security chip 2 is also configured to disconnect the power module 7 and the controller 1 when it is monitored that the controller 1 does not meet the preset security conditions.
  • this application monitors the controller by setting the security chip 2.
  • the connection between the power supply module 7 and the controller 1 is disconnected, so that the image forming apparatus is Being monitored by the security chip 2 ensures the security of the controller 1.
  • the power supply module 7 is used to output direct current.
  • the power supply module 7 may be a single power supply unit or a combination of multiple independent power supply units.
  • the power supply module 7 can not only supply power to the controller 1, but also supply power to the security chip 2 and other hardware modules in the image forming apparatus.
  • a corresponding hardware control circuit needs to be provided to satisfy that when the security chip 2 performs static measurement and/or dynamic measurement of the controller 1, the power supply control of the controller 1 is implemented to further ensure the processing of the image forming apparatus.
  • Information security
  • the power control of the controller 1 with respect to the security chip 2 in this application includes but is not limited to the following hardware implementation solutions:
  • the image forming device also includes a fourth switch 8 and a fifth switch 9, the pin (GPI 0x) of the security chip 2 and the pin (GPIOy) of the controller 1 and the fourth switch 8 respectively
  • the first terminal (Z) of the fourth switch 8 is connected to the enable terminal (EN)
  • the second terminal (Y) of the fourth switch 8 is connected to the enable terminal (EN) of the fifth switch 9
  • the first terminal ( Y) and the second end (Z) are respectively connected to the power supply pin (Power in) of the power supply module 7 and the controller 1.
  • the enable terminal (EN) of the fourth switch 8 receives the enable valid signal, and the first terminal (Z) of the fourth switch 8 and the The two terminals (Y) are turned on, and the pin (GPIOx) of the security chip 2 generates an enable invalid signal through the enable terminal (EN) of the fourth switch 8 to the fifth switch 9, and the first terminal of the fifth switch 9
  • the path between (Y) and the second end (Z) is disconnected, so that the power module 7 cannot supply power to the controller 1.
  • the pin (GPIOx) of the security chip 2 When the startup program passes the security check, the pin (GPIOx) of the security chip 2 generates an enable valid signal, and sends the enable valid signal to the enable terminal (EN) of the fifth switch 9 through the fourth switch 8.
  • the first terminal (Y) and the second terminal (Z) of the five switch 9 are turned on, and the power module 7 supplies power to the controller 1.
  • the fourth switch 8 and the fifth switch 9 are configured to be turned on when the enable terminal is connected to a high-level signal.
  • the image forming device includes a sixth switch 10, the pin (GPIOx) of the security chip 2 and the pin (GPIOy) of the controller 1 and the first end (Z) of the sixth switch 10, respectively And the enable terminal (EN) is connected, and the second terminal (Y) of the sixth switch 10 is connected with the enable terminal (EN) of the power module 7.
  • the enable terminal (EN) of the sixth switch 10 receives the enable valid signal, the first terminal (Z) and the second terminal (Y) of the sixth switch are turned on, and the pin of the security chip 2 (GPIOx) generates an enable invalid signal to the enable terminal (EN) of the power module 7.
  • the pin (GPIOx) of the security chip 2 When the startup program passes the security check, the pin (GPIOx) of the security chip 2 generates an enable signal to the enable terminal (EN) of the power module 7, and the power module 7 supplies power to the controller 1.
  • Solution 3 is basically the same as Solution 1. The difference is that the security chip 2 and controller 1 in Solution 1 are separately powered by the first power supply unit and the second power supply unit. In Solution 3, the security Chip 2 and controller 1 share part of the power supply (such as AB1, AB2, AB3...ABn in Figure 6, for easy distinction, hereinafter referred to as the shared power supply unit as the third power supply unit), where the third The output terminal of the power supply unit is connected to the power supply pin of the security chip 2 and also connected to the power supply pin of the controller 1 through the fifth switch 9.
  • the shared power supply unit such as AB1, AB2, AB3...ABn in Figure 6, for easy distinction, hereinafter referred to as the shared power supply unit as the third power supply unit
  • Scheme 4 is basically the same as Scheme 3. The difference lies in the following:
  • the third power supply unit (such as AB1, AB2 and AB2 in Fig. 7) supplies power to both the security chip 2 and the controller 1.
  • the power output of AB3...ABn) is controlled by a switch circuit (such as the fifth switch 9 in FIG. 7), and the second power supply unit (such as B1, The power output of B2, B3...Bn) is controlled by its own enable terminal (EN).
  • Scheme 5 is basically the same as Scheme 1, except that in this scheme, the power output of some of the second power supply units in the second power supply unit that supplies power to the controller 1 is provided by the second power supply unit itself.
  • the enable terminal (EN) is controlled, and another part of the second power supply unit is controlled by a switch circuit (such as the fifth switch 9 in FIG. 8).
  • the fifth switch 9 can be a one-way switch circuit or a multiple-way switch circuit.
  • the fifth switch 9 can be an integrated circuit, or can be constructed by discrete components.
  • the fifth switch 9 is a multi-channel switch circuit, which includes a plurality of first switch units a, and each first switch unit a is connected to a power supply unit and a power supply pin (Power in) of the controller 1 Meanwhile, it is used to control its corresponding power supply unit to supply power to the controller 1, and the number of power supply pins of the controller 1 can be one or more.
  • the first switch unit a is configured to be effective when the enable terminal is connected to a high-level signal. Therefore, the first switch unit a can use a PNP transistor as a switch.
  • the first switch unit a may also be configured to enable low-level signal enablement. If the first switch unit a is enabled for low-level signal enablement, the first switch unit a may also use a PMOS transistor as a switch.
  • the on and off of the multiple first switch units a can be controlled by an enable signal of the security chip 2, and the on and off of the multiple first switch units a can be controlled by an enable signal of the security chip 2 or by Each of the multiple enable signals of the security chip 2 is individually controlled.
  • the security chip 2 is further specifically configured to read the program to be verified stored in the memory 3 after the image forming apparatus is powered on, perform a security verification on the program to be verified, and perform a security verification on the program to be verified.
  • the program is sent to the program loader to be verified corresponding to the controller 1, and the program loader to be verified starts to execute the program to be verified after receiving the program to be verified;
  • the security chip 2 controls the control The device 1 stops executing the program to be verified.
  • the security verification of the program to be verified by the security chip 2 may be static and/or dynamic.
  • the security chip 2 reads the program to be verified stored in the memory 3 and prepares to send it to the controller 1 For example, after the program loader to be verified receives the program to be verified, the controller 1 starts to execute the program to be verified.
  • the present application uses the security chip 2 to perform security verification on the program to be executed by the controller 1.
  • the security chip 2 controls the controller 1 to stop executing the program to be verified, so that the controller 1 During the operation, the whole process is monitored by the security chip 2, which can ensure the security and reliability of the image forming device.
  • the present application sends the program to be executed by the controller 1 to the controller 1 through the security chip 2, without additional configuration of corresponding hardware circuits to enable the controller 1 and the security chip 2 to obtain the program to be verified from the memory 3 at the same time.
  • the circuit structure is further simplified and the cost is saved.
  • the program to be verified may include a startup program and an application program, and the number of the application program is at least one. In other embodiments, the program to be verified may also include only the startup program and the application program in the application program.
  • the security chip 2 is in communication with the memory 3 through the first communication bus for reading the program to be verified from the memory 3, and the security chip 2 communicates with the memory 3 through the second communication bus.
  • the communication connection of the controller 1 is used to send the read program to be verified to the built-in program loader of the controller 1 to be verified.
  • the security chip 2 performs security verification on the program to be verified and sends the program to be verified to the corresponding program loader to be verified, which may specifically include:
  • the security chip 2 performs security verification on the read program to be verified, and at the same time sends the read program to be verified to the Verify the program loader.
  • the security chip 2 may start to verify the program to be verified after reading all the programs to be verified, and send the program to be verified to the program loader to be verified while verifying; or In the process of reading the program to be verified, the security chip 2 performs security verification on the currently read program to be verified, and sends the currently read program to be verified to the program loader to be verified for execution, Or, every time the security chip 2 reads a part of the program to be verified (such as the Boot program), the security chip 2 performs security verification on the part of the program, and at the same time sends the part of the program to the program to be verified The loader then checks and executes other parts of the program (Uboot program, operating system program, etc.) in sequence.
  • the security chip 2 performs security verification on the currently read program to be verified, and sends the currently read program to be verified to the program loader to be verified for execution, Or, every time the security chip 2 reads a part of the program to be verified (such as the Boot program), the security chip 2 performs security verification on the
  • the security chip 2 may also perform security verification on the read program to be verified during the process of the program to be verified, and at the same time send the read program to be verified to the program loader to be verified ;
  • the Boot program is divided into many small sections, and each section is verified separately, and each section is sent to the program loader at the same time, because the program loader receives many small sections and cannot directly complete the current Boot The function corresponding to the program, so the program loader cannot directly complete the startup corresponding to the current Boot program, and it will not directly threaten the safety of the entire system; after the security chip 2 completes the verification of each small program, the program loader The entire Boot program has almost been received, and other programs to be verified are similar.
  • this application improves the running speed of the controller 1 by adopting the method of synchronous execution and verification when reading or verifying the program to be verified that the controller 1 needs to execute.
  • the program to be verified is the startup During the program, the startup speed of the image forming apparatus can be accelerated, thereby improving the user experience.
  • the security chip 2 performs security verification on the program to be verified and sends the program to be verified to the corresponding program to be verified in the controller 1.
  • Loaders can include:
  • the security chip 2 performs security verification on the read program to be verified.
  • the read program to be verified is sent to the program loader to be verified.
  • the security chip 2 may first read all the programs to be verified, and after all the programs to be verified pass the verification, then send all the programs to be verified to the program loader to be verified. If the verification fails, the program to be verified is no longer sent to the program loader to be verified.
  • the security chip 2 sequentially verifies part of the program to be verified in the verification program (for example, verifying the Boot program, Uboot program, operating system program, and application program in turn), when the part of the program to be verified is verified After passing the verification, the part of the program to be verified is sent to the program loader to be verified for execution, and then the next part of the program to be verified is read, verified, and executed.
  • the security chip 2 performs security verification on the read program to be verified, and at the same time sends the read program to be verified to the program loader to be verified, further, if the security chip 2 In the process of safety verification, when it is determined that the startup program or operating system program in the program to be verified does not meet the safety requirements, considering the operating status of the controller 1, the following situations may be included:
  • the security chip 2 first controls the controller 1 to stop executing the startup program or operating system program or application program, and then controls the controller 1 to reset, so that the controller 1 Back to the initial state; or, the security chip 2 first controls the controller 1 to stop executing the startup program or operating system program, and then controls the controller 1 to power off.
  • the controller 1 If the current controller 1 does not execute the startup program or the operating system program or the application program, the controller 1 is directly controlled to reset, so that the controller 1 returns to the initial state; or, the security chip 2 directly controls the controller 1 to power off.
  • the controller 1 when it is detected that the startup program to be executed by the controller 1 or the operating system program does not meet the safety requirements, the controller 1 is reset or powered off, which can ensure the safety of the image forming apparatus.
  • the security chip 2 if the security chip 2 determines that the first application in at least one application does not meet the security requirements, and the controller 1 is currently executing the application, the security chip 2 Send an error signal to control the controller 1 to stop executing the first application; if the security chip 2 determines that the first application in at least one application does not meet the security requirements, and the controller 1 is not currently executing the startup program, the security chip 2 does not The controller 1 is allowed to start the execution of the first application program.
  • the security chip 2 is connected to the reset terminal of the controller 1, and the security chip 2 resets the controller 1 by sending a reset enable signal to the reset terminal of the controller 1.
  • the image forming apparatus further includes a power switch (for example, the fifth switch 9 shown in FIG. 5 and FIG. 7-10), and the power switch is connected between the power supply module 7 and the controller 1. It is set to supply power to the controller 1, and the security chip 2 turns off the power switch and/or generates an enable invalid signal to the enable terminal of the power module to power off the controller 1.
  • a power switch for example, the fifth switch 9 shown in FIG. 5 and FIG. 7-10
  • this embodiment also provides an activation control system for an image forming apparatus (shown in a dashed box in FIG. 2), the image forming apparatus includes a controller 1 configured to control the image forming apparatus to perform imaging operations ,
  • the start control system includes:
  • the security chip 2 connected to the controller 1, is configured to monitor the running activities of the controller 1;
  • the memory 3 is connected to the security chip 2 and is configured to store the program to be verified of the controller 1, and the program to be verified is a program used for the operation of the image forming apparatus;
  • the security chip 2 performs security verification on the program to be verified.
  • the security chip 2 controls the controller 1 not to execute the program to be verified.
  • this embodiment also provides a security control system for an image forming apparatus.
  • the image forming apparatus includes a controller 1 configured to control the image forming apparatus to perform imaging operations.
  • the security control system includes: a security chip 2, and The controller 1 is connected to be configured to monitor the controller 1 safely; and the power module 7 is connected to the controller 1 and configured to supply power to the controller 1; wherein, the security chip 2 is also configured to monitor the controller 1 1 When the preset safety conditions are not met, disconnect the power supply module 7 and the controller 1.
  • the components/modules in the security control system are the same as those described in the above-mentioned image forming apparatus, and can also achieve the same technical effects, which will not be repeated here.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Multimedia (AREA)
  • General Engineering & Computer Science (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Technology Law (AREA)
  • Computer Security & Cryptography (AREA)
  • Facsimiles In General (AREA)

Abstract

本申请提供了一种图像形成装置及图像形成装置用安全控制系统，图像形成装置包括控制器，被配置为控制图像形成装置执行成像操作；安全芯片，与控制器连接，被配置为对控制器的运行活动进行监控；存储器，与安全芯片连接，被配置为存储待校验程序，待校验程序为图像形成装置运行所用的程序；安全芯片对待校验程序进行安全校验，当安全芯片对待校验程序的安全性检验的结果为不通过时，安全芯片控制控制器不执行所述待校验程序。上述能够很好的保证图像形成装置处理信息的安全性。

Description

图像形成装置及图像形成装置用安全控制系统
本申请要求于2019年06月28日提交中国专利局、申请号为201920996840.6、申请名称为“一种图像形成装置、图像形成装置用启动控制系统”的中国专利申请的优先权，其部分内容通过引用结合在本申请中；要求于2019年09月04日提交中国专利局、申请号为201921461567.3、申请名称为“一种图像形成装置及图像形成装置用安全控制系统”的中国专利申请的优先权，其部分内容通过引用结合在本申请中；及要求于2019年09月04日提交中国专利局、申请号为201910832398.8、申请名称为“一种图像形成装置及其控制方法、存储介质”的中国专利申请的优先权，其部分内容通过引用结合在本申请中。
技术领域
本申请涉及图像形成技术领域，具体涉及一种图像形成装置及图像形成装置用安全控制系统。
背景技术
随着电子科学技术的进步，图像形成装置(Image forming apparatus)的发展也越来越成熟，但是作为一种计算机周边设备，图像形成装置容易受到不法分子(例如黑客)的攻击，以带有扫描和/或传真功能的激光打印机(图像形成装置多种类型中的一种)为例，扫描或者传真的数据都可能携带有用户的机密数据，甚至连激光成像中核心零部件感光鼓上，也可能携带有用户待打印的机密数据；这些数据一旦泄露，就会给用户带来很多不必要的麻烦；如果涉及公司或者政府机密部门的办公场合，如果图像形成装置携带的机密数据被泄露，还可能危及公司或者政府安全。目前，现有技术通常设置安全芯片对图像形成装置的控制器(成像控制器)运行进行监控，但目前并未出现可靠的方案能够很好的保证图像形成装置处理信息的安全性。
申请内容
本申请实施例提供一种图像形成装置及图像形成装置用安全控制系统，能够解决当前未出现可靠的方案能够很好的保证图像形成装置处理信息的安全性的问题。
第一方面，本申请提供一种图像形成装置，包括：
控制器，被配置为控制所述图像形成装置执行成像操作；
安全芯片，与所述控制器连接，被配置为对所述控制器的运行活动进行监控；
存储器，与所述安全芯片连接，被配置为存储待校验程序，所述待校验程序为所述图像形成装置运行所用的程序；
所述安全芯片对所述待校验程序进行安全校验，当所述安全芯片对所述待校验程序的安全性检验的结果为不通过时，所述安全芯片控制所述控制器不执行所述待校验程序。
结合第一方面，在一种优选的实施方式中，所述待校验程序包括启动程序，所述存储器还存储有安全校验信息，所述安全芯片包括启动控制器，所述启动控制器与所述控制器连接，被配置为先控制所述安全芯片读取所述存储器中存储的启动程序和安全校验信息，并通过所述安全校验信息对所述启动程序进行安全性校验，当安全性检验通过后，再控制所述控制器读取所述启动程序完成所述控制器的启动。
结合第一方面，在一种优选的实施方式中，所述待校验程序包括启动程序，所述存储器还存储有安全校验信息，所述安全芯片包括启动控制器，所述启动控制器与所述控制器连接，被配置为先控制所述安全芯片读取所述存储器中存储的启动程序和安全校验信息，并通过所述安全校验信息对所述启动程序进行安全性校验，当安全性检验通过后，再控制所述控制器读取所述启动程序完成所述控制器的启动。
结合第一方面，在一种优选的实施方式中，所述启动控制器与所述控制器的复位引脚连接，所述启动控制器被配置为在所述启动程序通过安全性校验之前，向所述控制器的复位引脚输出复位使能信号，以及在所述启动程序通过安全性校验后，向所述控制器的复位引脚输出复位失效信号。
结合第一方面，在一种优选的实施方式中，所述图像形成装置还包括第一隔离电路及第二隔离电路，所述第一隔离电路连接于所述启动控制器与所述存储器之间，所述第二隔离电路连接于所述控制器与所述存储器之间，所述第一隔离电路及所述第二隔离电路共用一总线接口与所述存储器连接；
所述图像形成装置上电后，所述安全芯片优先启动，所述启动控制器先控制所述第一隔离电路导通及第二隔离电路断开，所述安全芯片读取所述存储器的启动程序和安全校验信息，并通过所述安全校验信息对所述启动程序进行安全性校验，当所述启动程序通过安全性校验后，所述启动控制器再控制所述第一隔离电路断开及第二隔离电路导通，所述控制器读取所述存储器的启动程序完成启动。
结合第一方面，在一种优选的实施方式中，所述第一隔离电路包括第一开关，所述第一开关的第一端、第二端及第三端分别与所述安全芯片、所述启动控制器及所述存储器连接，所述启动控制器通过发送预设电信号至所述第一开关的第二端控制所述第一开关的第一端与所述第三端之间的导通或断开；
所述第二隔离电路包括第二开关，所述第二开关的第一端、第二端及第三端分别与所述控制器、所述启动控制器及所述存储器连接；所述启动控制器通过发送预设电信号至所述第二开关的第二端控制所述第二开关的第一端与所述第三端之间的导通或断开。
结合第一方面，在一种优选的实施方式中，所述安全芯片通过第一通讯总线与所述存储器连接，所述安全芯片通过第二通讯总线与所述控制器的第二引脚连接，当所述图像形成装置上电后，所述安全芯片通过所述第一通讯总线读取所述存储器内存储的所述启动程序，对所述启动程序进行安全性校验以及将所述启动程序通过第二通讯总线发送给所述控制器，以使得所述控制器读取所述存储器的启动程序完成启动。
结合第一方面，在一种优选的实施方式中，所述图像形成装置还包括电源模块，所述电源模块与所述控制器连接，被配置为向所述控制器供电；
其中，所述安全芯片还被配置为当监控到所述控制器不符合预设安全条件时，断开所述电源模块与所述控制器之间的连接。
结合第一方面，在一种优选的实施方式中，所述图像形成装置还包括第四开关及第五开关，所述安全芯片及所述控制器分别与所述第四开关的第一端及使能端连接，所述第四开关的第二端与所述第五开关的使能端连接，所述第五开关的第一端及第二端分别与所述电源模块及所述控制器的电源引脚连接。
所述图像形成装置上电后，所述第四开关的使能端接收使能有效信号，所述第四开关的第一端与第二端导通，所述安全芯片生成使能无效信号至所述第五开关的使能端，所述第五开关的第一端及第二端之间的通路断开；
当所述启动程序通过安全性校验后，所述安全芯片生成使能有效信号，并通过所述第四开关发送所述使能有效信号至所述第五开关的使能端，所述第五开关的第一端与第二端导通，所述电源模块为所述控制器供电。
结合第一方面，在一种优选的实施方式中，所述图像形成装置还包括第六开关，所述安全芯片及所述控制器分别与所述第六开关的第一端及使能端连接，所述第六开关的第二端与所述电源模块的使能端连接；
所述图像形成装置上电后，所述第六开关的使能端接收使能有效信号，所述第六开关的第一端与第二端导通，所述安全芯片生成使能无效信号至所述电源模块的使能端；
当所述启动程序通过安全性校验后，所述安全芯片生成使能有效信号至所述电源模块的使能端，所述电源模块为所述控制器供电。
结合第一方面，在一种优选的实施方式中，所述安全芯片具体被配置为当所述图像形成装置上电后，读取所述存储器内存储的所述待校验程序，对所述待校验程序进行安全校验以及将所述待校验程序发送给所述控制器对应的待校验程序加载器，所述待校验程序加载器接收到所述待校验程序后开始执行所述待校验程序；
其中，在所述安全芯片对所述待校验程序进行安全校验的过程中，若所述安全芯片确定所述待校验程序不符合安全要求，且当前所述控制器正在执行所述待校验程序时，所述安全芯片控制所述控制器停止执行所述待校验程序。
结合第一方面，在一种优选的实施方式中，所述安全芯片在读取所述待校验程序的过程中或者读取所述待校验程序完毕后，对已读取的待校验程序进行安全校验，同时将已读取的待校验程序发送给所述待校验程序加载器。
结合第一方面，在一种优选的实施方式中，所述安全芯片在读取所述待校验程序的过程中或者读取所述待校验程序完毕后，先对已读取的待校验程序进行安全校验，当确定出所述已读取的待校验程序符合安全要求后，才将所述已读取的待校验程序发送给所述待校验程序加载器。
结合第一方面，在一种优选的实施方式中，所述待校验程序包括启动程序，若所述安全芯片确定所述启动程序不符合安全要求，且当前所述控制器正在执行所述启动程序时，所述安全芯片先控制所述控制器停止执行所述启动程序，再控制所述控制器复位，以使得所述控制器回到初始状态；或者，所述安全芯片先控制所述控制器停止执行所述启动程序，再控制所述控制器断电。
结合第一方面，在一种优选的实施方式中，，所述待校验程序包括至少一个应用程序，若所述安全芯片确定所述至少一个应用程序中的第一应用程序不符合安全要求，所述安全芯片禁止所述控制器执行所述第一应用程序。
第二方面，本申请提供一种图像形成装置用启动控制系统，述图像形成装置包括被配置为控制所述图像形成装置执行成像操作的控制器，包括：
安全芯片，与所述控制器连接，被配置为对所述控制器的运行活动进行监控；及
存储器，与所述安全芯片连接，被配置为存储所述控制器的待校验程序，所述待校验程序为所述图像形成装置运行所用的程序；
所述安全芯片对所述待校验程序进行安全校验，当所述安全芯片对所述待校验程序的安全性检验的结果为不通过时，所述安全芯片控制所述控制器不执行所述待校验程序。
可以理解，通过安全芯片对存储器中存储的待校验程序进行安全校验，当所述控制器正在执行所述待校验程序时，所述安全芯片控制所述控制器停止执行所述待校验程序，使得控制器的运行过程受到安全芯片的监控，保证了图像形成装置在运行过程中的安全性。
附图说明
为了更清楚地说明本申请实施例的技术方案，下面将对实施例中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其它的附图。
图1为本申请一实施例提供的一种图像形成装置的示意性框图；
图2为本申请又一实施例提供的一种图像形成装置的示意性框图；
图3为本申请一实施例提供的一种图像形成装置的部件之间的连接关系图。
图4为本申请又一实施例提供的一种图像形成装置的的示意性框图。
图5～图10分别为本申请多个不同实施例提供的图像形成装置的硬件框图；
图11为本申请又一实施例提供的图像形成装置的示意性框图。
具体实施方式
为了更好的理解本申请的技术方案，下面结合附图对本申请实施例进行详细描述。
请参阅附图1，本申请实施例提供一种图像形成装置，包括：
控制器1，被配置为控制图像形成装置执行成像操作；
安全芯片2，与控制器1连接，被配置为对控制器1的运行活动进行监控；
存储器3，与安全芯片2连接，被配置为存储控制器1的待校验程序，待校验程序为图像形成装置运行所用的程序；
其中，安全芯片2对待校验程序进行安全校验，当安全芯片2对待校验程序的安全性检验的结果为不通过时，安全芯片2控制控制器1不执行待校验程序。
可以理解，通过安全芯片2对存储器3中存储的待校验程序进行安全校验，当控制器正在执行待校验程序时，安全芯片控制控制器停止执行待校验程序，使得控制器1的运行过程受到安全芯片2的监控，保证了图像形成装置在运行过程中的安全性。
具体地，图像形成装置表示在例如打印纸的记录介质上打印例如由计算机产生的打印数据的装置。图像形成装置的例子包括但不限于复印机、打印机、传真机、扫描仪以及在单个设备中执行以上功能的多功能外设。
在本实施方式中，控制器1，例如SoC(System on Chip，片上系统)，被配置为控制图像形成装置的成像处理操作，SoC用于执行数据收发、命令收发、引擎控制相关的处理操作，例如，如何通过应用程序调用接口单元(包括但不限于USB端口、有线网络端口、无线网络端口等)来收发数据、命令、状态等，还可以通过应用程序获得接收的打印参数，并解析为控制引擎机构执行特定功能的命令，例如，LSU曝光参数、拾纸辊转动参数等；另外，对于有用户权限认证或者加密/解密处理功能的图像形成装置，SoC还设置成能够执行用户权限认证或者加密/解密处理功能，而图像形成装置中的接口单元还能够接收来自驱动装置的打印作业数据和打印、扫描、传真命令，或者发送扫描、传真数据、打印、扫描、传真状态信息等，以及安全芯片2与外部安全监控服务器交换预定安全规则、日志等信息。
安全芯片2，又称可信计算监管模块，用于监控图像形成装置中控制器1(SoC)对应的运行活动；安全芯片2中的可信计算(Trusted Computing)，是为行为安全而生，广泛使用在计算机和通信系统中，以提高系统整体的安全性。信息安全包含四个方面：设备安全、数据安全、内容安全与行为安全；为进一步提升图像形成装置的行为安全特性，本实施例引入了可信计算功能；本实施例提及的安全芯片2对应的功能模块包括四种功能：程序(或模块)启动/运行监控功能(例如白名单策略)、注册功能、审计功能、升级监控功能，具体地，安全芯片2负责监管图像形成装置操作系统(例如Linux系统)的驱动层模块以及负责监管图像形成装置的应用层程序，安全芯片2只允许运行白名单范围内的驱动和程序，非白名单范围内的驱动和程序不允许运行；安全芯片2会记录或上报图像形成装置上发生的安全事件行为，这样可以实现对图像形成装置的驱动层和应用层进行全面监管，可以有效阻止控制器1的应用程序和设备驱动的不安全行为。
存储器3，与控制器1及安全芯片2连接，或者单独与控制器1和安全芯片2中的安全芯片2连接，是一种非易失性存储器，例如NOR flash(闪存)、NAND flash(闪存)、EEPROM(可擦除的可编程只读存储器)、FRAM(铁电存储器)，MRAM(磁性RAM)和NVSRAM(非易失性静态存储器)等。
安全芯片2对待校验程序进行安全校验，当安全芯片2对待校验程序的安全性检验的结果为不通过时，安全芯片2控制控制器1不执行待校验程序。具体地，一种实施方式中：在安全芯片2对待校验程序执行检验过程中，安全芯片2控制控制器1不执行待校验程序；只有安全芯片2对待校验程序检验通过时，才允许控制器1执行待校验程序；校验过程中，如果出现检验不通过时，安全芯片2就控制控制器1继续不执行待校验程序。另一种实施方式中：安全芯片可以对待校验程序分段验证，在安全芯片2校验的过程中，允许控制器1加载部分待校验程序，但是这部分待校验程序不足以让控制器1完全启动或执行全部图像处理操作，当安全芯片2对应的安全性检验不通过时，安全芯片2控制控制器1停止执行待校验程序。这些不同的实施方式都属于本申请的保护范围。
如图2所示，在本申请一个或者多个实施例中，待校验程序包括启动程序，存储器还存储有安全校验信息，安全芯片2包括启动控制器21，启动控制器21与控制器1连接，被配置为先控制安全芯片2读取存储器3中存储的启动程序和安全校验信息，并通过安全校验信息对启动程序进行安全性校验，当安全性检验通过后，再控制控制器1读取启动程序完成控制器1的启动。
可以理解，本申请通过在安全芯片2中设置启动控制器21，当图像形成装置上电之后，安全芯片2先启动，启动控制器21先控制安全芯片2读取存储器3中存储的启动程序和安全校验信息，并通过安全校验信息对启动程序进行安全性校验，当安全性校验通过后，再控制控制器1读取启动程序完成控制器1的启动，使得控制器1的启动过程受到安全芯片2的监控，保证了图像形成装置在运行过程中的安全性。
需要知道的是，如图2所示，在本实施方式中，安全芯片2包括启动控制器21及其它器件，其它器件被配置为实现除启动控制器21以外的安全芯片的其它功能，其它器件可以包括但不限于用于对存储器3中的启动程序及安全校验信息进行读取的读取器件、根据安全校验信息对读取的启动程序进行校验的校验单元、用于实现对控制器1进行监控的各个电路/单元等及与通信相关的各个通信模块、接口单元等。
启动程序包括启动引导文件(例如boot文件、uboot文件)和操作系统信息(例如初始化DDR、初始化缓存、初始化串口、初始化网卡)等，安全校验信息包括但不限于一个预设的校验码。在其它实施方式中，安全校验信息也可以预先存储在安全芯片2内。
在本实施方式中，对启动程序进行安全性校验的过程可以为：启动控制器21读取启动程序，生成运算校验信息，通过比对运算校验信息和安全校验信息是否满足预定关系，输出启动程序的安全性校验是否通过的信息；例如启动控制器21通过自身的运算电路或者运算代码，对启动程序进行逻辑运算(下文也称预设规则)，得到运算校验信息，启动控制器21进一步通过逻辑比较电路或者逻辑比较代码，对运算校验信息和安全校验信息进行比较，判断运算校验信息和安全校验信息是否满足预定关系(例如相等)，如果满足，则输出启动程序的安全性校验通过的信息，如果不满足，输出启动程序的安全性校验不通过的信息。
请参阅附图3，可选地，启动控制器21与控制器1的复位引脚(Reset)连接，启动控制器21被配置为在启动程序通过安全性校验之前，向控制器1的复位引脚输出复位使能信号，以及在启动程序通过安全性校验后，向控制器1的复位引脚输出复位失效信号。
在本申请实施方式中，图像形成装置上电后，安全芯片2启动，安全芯片2的启动控制器21输出低电平信号至控制器1的复位引脚(Reset)，控制器1的复位引脚低电平使能，因此控制器1处于复位状态无法启动。在此过程中，安全芯片2通过读取存储器3的启动程序和安全校验信息，并通过安全校验信息对启动程序进行安全性校验，当对启动程序校验通过时，启动控制器21再发送高电平信号至控制器1的复位引脚，使得控制器1可以进行启动，以保证控制器1的安全性。
本申请中的安全校验信息中预设的校验码可以是直接提前存入的，也可以是预先(例如，在出厂之前)对完整的启动程序以预设规则进行校验并将得到的校验结果作为安全校验信息，并将该安全校验信息储存。当需要进行安全性校验时(例如，销售后的使用过程需要启动时)，启动控制器21按照上述要求，读取启动程序和安全校验信息，并对启动程序进行逻辑运算，得到运算校验信息，然后将运算校验信息和安全校验信息进行比对，若一致，说明启动程序是完整的未被修改过，若不一致，说明启动程序已被修改，此时若控制器1读取及执行该启动程序会有安全隐患，因此安全芯片2的启动控制器21不允许控制器1启动，以保证控制器1的安全运行。
以校验启动程序中的启动引导文件为例，校验启动引导文件的过程可以为：将启动引导文件进行累加处理，得到相应的累加校验和，将得到的累加校验和与保存的预设安全校验信息和进行对比，二者相同这说明启动引导文件是完整未被修改的，符合安全条件。
需要知道的是，图像形成装置上电之后，安全芯片2及控制器1均需要获取启动程序，其中，安全芯片2获取启动程序后对启动程序进行安全性校验，控制器1需要获取启动程序完成启动，因此，安全芯片2、控制器1及存储器3都需要挂接在同一条通讯总线上，而任意一条通讯总线最多只能挂接1个主设备。针对以上，本申请提供了以下两种实现方式，用以解决上述问题。
方式一：
请继续参阅附图3，图像形成装置还包括第一隔离电路4及第二隔离电路5，第一隔离电路4连接于启动控制器21与存储器3之间，第二隔离电路5连接于控制器1与存储器3之间，第一隔离电路4及第二隔离电路5共用一总线接口与存储器3连接；图像形成装置上电后，安全芯片2优先启动，启 动控制器21先控制第一隔离电路4导通及第二隔离电路5断开，安全芯片2读取存储器3的安全校验信息和启动程序，并使用安全校验信息对启动程序进行安全性校验，当启动程序通过安全性校验后，启动控制器21再控制第一隔离电路4断开及第二隔离电路5导通，控制器1读取存储器3的启动程序完成启动。
可以理解，由于一条通讯总线在任意时刻只能允许一个主设备接入，因此启动控制器21通过先控制第一隔离电路4导通及第二隔离电路5断开，当安全校验信息通过安全性校验后，启动控制器21再控制第一隔离电路4断开及第二隔离电路5导通，可以避免当安全芯片2读取存储器3的信息时，控制器1对通讯总线造成干扰，以及避免当控制器1读取存储器3的信息时，安全芯片2对通讯总线造成干扰，因此进一步提高图像形成装置的可靠性。
在本实施方式中，通讯总线具体为SPI(Serial Peripheral Interface，串行外设接口)总线，对应地，总线接口具体为SPI总线接口。SPI总线是一种全双工同步串行接口标准，传输效率高，SPI总线只允许一个主设备启动一个与从设备的同步通讯的协议，从而完成数据的交换。
进一步地，第一隔离电路4包括第一开关，第一开关的第一端(Y)、第二端(EN)及第三端(Z)分别与安全芯片2、启动控制器21及存储器3连接，启动控制器21通过发送预设电信号至第一开关的第二端(EN)控制第一开关的第一端(Y)与第三端(Z)之间的导通或断开。第二隔离电路5包括第二开关，第二开关的第一端(Y)、第二端(EN)及第三端(Z)分别与控制器1、启动控制器21及存储器3连接；启动控制器21通过发送预设电信号至第二开关的第二端控制第二开关的第一端(Y)与第三端(Z)之间的导通或断开。
可选地，第一开关可以为但不限于MOS(metal-oxide-semiconductor，金属-氧化物-半导体场效应晶体)管、三极管、IGBT(Insulated Gate Bipolar Transistor，绝缘栅双极型晶体管)等电子开关中的任意一种，第二开关可以为但不限于MOS三极管、IGBT等电子开关中的任意一种。
在本实施方式中，第一开关及第二开关为N型MOS管，预设电信号为高电平信号。
可选地，安全芯片2被配置为在引导状态才能接收固件升级包(用于被安全芯片所运行的固件升级包)来实现对其内的存储器3的运行固件进行升级，启动控制器21在引导状态时会向控制器1输出复位使能信号，在本实施方式中，安全芯片2进行固件升级的过程为：控制器1接收电子设备(例如个人计算机)下发的固件升级包并将固件升级包发送给安全芯片2，以实现对安全芯片2运行固件的升级。由于安全芯片2优先于控制器1启动，因此，当控制器1启动的时候安全芯片2已经由引导状态进入程序运行的状态，为了保证对安全芯片2固件进行升级时控制器1能正常工作，继续如附图2所示，优选的，图像形成装置还包括模拟开关电路6，模拟开关电路6包括第三开关，第三开关的第一端(Y)与启动控制器21连接，第三开关的第二端(EN)与控制器1的复位引脚(Reset)连接，第三开关的第三端(Z)与控制器1的控制引脚(GPIO49)连接，控制器1还被配置为在将固件升级包发送给安全芯片2之前，向第三开关的第三端发送预设电信号(为方便区分，下面称第一预设电信号)，使得第三开关的第一端(Y)及第三端(Z)断开，进而启动控制器21对控制器1复位使能信号失效。
可选地，第三开关可以为但不限于MOS管、三极管、IGBT等电子开关中的任意一种，在本实施方式中，第三开关为N型MOS管，第一预设电信号为低电平信号；
方式二：
安全芯片2与存储器3和控制器1分别通过通讯总线连接，通过安全芯片2将启动程序发送给控制器1；
请参阅附图4，安全芯片2的引脚(SPIM)通过第一通讯总线与存储器3连接，安全芯片2的引脚(SPIS)通过第二通讯总线与控制器1的引脚(FCSPI)连接，当图像形成装置上电后，安全芯片2通过第一通讯总线读取存储器3内存储的启动程序，对启动程序进行安全性校验以及将启动程序通过第二通讯总线发送给控制器1，以使得控制器1读取存储器3的启动程序完成启动。
可以理解，本申请通过先将安全芯片2读取启动程序，再通过安全芯片2将启动程序发送给控制器1，无需设置方式一中的第一隔离电路5及第二隔离电路6，同时可以避免安全芯片2与控制器1 相互之间的干扰问题，因此，可以进一步降低本申请提供的图像形成装置的硬件成本，同时保证图像形成装置的可靠性。
具体的，第一通讯总线及第二通讯总线具体为SPI总线，SPI总线上文已有说明，在此不再重复描述。
进一步地，安全芯片2读取启动程序后或者在读取启动程序的过程具体可以为：安全芯片2先对已读取的启动程序进行安全校验，确定出已读取的启动程序符合安全要求后，再将已读取的启动程序发送给控制器1执行。例如，安全芯片2先全部读取启动程序，然后对启动程序进行安全性校验，若启动程序通过校验，再将启动程序发送给控制器1执行。又例如，安全芯片2先读取部分启动程序(例如先读取boot文件)，先对读取的部分启动程序进行安全性校验，待该部分启动程序校验通过后，先将校验通过的该部分启动程序发送给控制器1执行，然后安全芯片2再依次进行启动程序其他部分的读取，直到全部的启动程序安全性校验完毕，若以上该过程中，若存在部分启动程序安全性校验未通过，则停止进行启动程序的读取及校验并生成启动程序未校验通过的信息，进而控制控制器1停止执行启动程序。又例如，安全芯片2先读取全部启动程序，待全部启动程序读取完毕后，将启动程序分割为多个分割体，依次对各个分割体进行安全性校验，每当其中一个分割体校验通过后，将校验通过的该分割体发送给控制器1执行，若以上该过程中，若存在分割体安全性校验未通过，则停止进行启动程序的读取及校验，并生成启动程序未校验通过的信息，控制控制器1停止执行启动程序。
更为优选地，在本申请一个或多个实施方式中，安全芯片2在读取启动程序的过程中或者读取启动程序完毕后，对已读取的启动程序进行安全性校验，同时将已读取的启动程序发送给控制器1，若安全芯片2在对启动程序进行安全性校验的过程中，发现启动程序不符合安全条件，则控制控制器1停止运行启动程序。
可以理解，通过在对启动程序进行安全性校验的同时，将启动程序发送给控制器1执行，若安全芯片2在对启动程序进行安全性校验的过程中，发现启动程序不符合安全条件，再控制控制器1停止运行启动程序，如此，可以大幅度的缩短控制器1的启动时间，解决安全性校验带来的控制器1启动慢的问题，因此，提高了图像形成装置的使用体验。
还需要知道的是，安全芯片2对启动程序进行安全性校验的过程为安全芯片2对控制器1进行静态度量的过程，当静态度量通过后，控制器1启动，安全芯片2开始对控制器1进行动态度量，动态度量具体为在控制器1的固件执行过程中设置密码确认环节，当控制器1的固件运行到密码确认环节的时候，控制器1会向安全芯片2索要密码并与控制器1的固件中的密码进行比对，二者相同控制器1才继续执行固件。
请继续参阅附图4，在本申请实施例中，图像形成装置还包括电源模块7，电源模块7与控制器1连接，被配置为向控制器1供电；
其中，安全芯片2还被配置为当监控到控制器1不符合预设安全条件时，断开电源模块7与控制器1之间的连接。
可以理解，本申请通过设置安全芯片2对控制器进行监控，当监控到控制器1不符合预设的安全条件时，断开电源模块7与控制器1之间的连接，使得图像形成装置全程受到安全芯片2的监控，保证了控制器1的安全性。
具体地，电源模块7用于输出直流电，在本申请一个或多个实施例中，电源模块7可以为单个电源单元，也可以是由多个独立的电源单元组合而成。电源模块7不仅可以为控制器1供电，还可以为安全芯片2供电以及图像形成装置中的其它硬件模块供电。
基于以上，本申请中需要设置对应的硬件控制电路，以满足安全芯片2在对控制器1进行静态度量及/或动态度量时，实现对控制器1的电源控制，以进一步保证图像形成装置处理信息的安全性。
进一步地，本申请针对安全芯片2对控制器1进行电源控制包括但不限于以下几种硬件实现方案：
方案一：请参阅附图5，图像形成装置还包括第四开关8及第五开关9，安全芯片2的引脚(GPI Ox)及控制器1的引脚(GPIOy)分别与第四开关8的第一端(Z)及使能端(EN)连接，第四开关8的第二端(Y)与第五开关9的使能端(EN)连接，第五开关9的第一端(Y)及第二端(Z)分别与电源模块7及控制器1的电源引脚(Power in)连接。
图像形成装置上电后(安全芯片2对启动程序进行安全性度量前)，第四开关8的使能端(EN)接收使能有效信号，第四开关8的第一端(Z)与第二端(Y)之间导通，安全芯片2的引脚(GPIOx)生成使能无效信号通过第四开关8至第五开关9的使能端(EN)，第五开关9的第一端(Y)及第二端(Z)之间的通路断开，使得电源模块7无法为控制器1供电。
当启动程序通过安全性校验后，安全芯片2的引脚(GPIOx)生成使能有效信号，并通过第四开关8发送使能有效信号至第五开关9的使能端(EN)，第五开关9的第一端(Y)及第二端(Z)导通，电源模块7为控制器1供电。
在本申请一个或者多个实施方式中，第四开关8及第五开关9被配置为使能端接高电平信号时导通。
方案二：请参阅附图6，图像形成装置包括第六开关10，安全芯片2的引脚(GPIOx)及控制器1的引脚(GPIOy)分别与第六开关10的第一端(Z)及使能端(EN)连接，第六开关10的第二端(Y)与电源模块7的使能端(EN)连接。
图像形成装置上电后，第六开关10的使能端(EN)接收使能有效信号，第六开关的第一端(Z)及第二端(Y)导通，安全芯片2的引脚(GPIOx)生成使能无效信号至电源模块7的使能端(EN)。
当启动程序通过安全性校验后，安全芯片2的引脚(GPIOx)生成使能有效信号至电源模块7的使能端(EN)，电源模块7为控制器1供电。
方案三：
请参阅附图7，方案三与方案一基本相同，不同之处在于：方案一中的安全芯片2及控制器1分别单独由第一电源单元及第二电源单元供电，在方案三中，安全芯片2及控制器1共用部分电源(如附图6中的AB1、AB2、AB3......ABn，为方便区分，下文称共用的电源为第三电源单元)供电，其中，第三电源单元的输出端既与安全芯片2的电源引脚连接，又通过第五开关9与控制器1的电源引脚连接。
方案四：
请参阅附图8，方案四与方案三基本相同，不同之处在于：本方案中既给安全芯片2供电又给控制器1供电的第三电源单元(如附图7中的AB1、AB2、AB3......ABn)的电能输出由开关电路(如附图7中的第五开关9)控制，而单独给控制器1供电的第二电源单元(如附图7中的B1、B2、B3......Bn)的电能输出由其自身的使能端(EN)控制。
方案五：
请参阅附图8，方案五与方案一与基本相同，不同之处在于：本方案中给控制器1供电的第二电源单元中的部分第二电源单元的电能输出由第二电源单元自身的使能端(EN)控制，另一部分第二电源单元由开关电路(如附图8中的第五开关9)控制。
方案六：
请参阅附图9，方案六与方案四与基本相同，不同之处在于：本方案中既给安全芯片2供电又给控制器1供电的第三电源单元(如附图9中的AB1、AB2、AB3......ABn)的电能输出由开关电路(如附图9中的第五开关9)控制，而单独给控制器1供电的第二电源单元(如附图9中的B1、B2、B3......Bn)中的一部分第二电源单元由其自身的使能端(EN)控制，另一部分第二电源单元由开关电路(如附图9中的第五开关9)控制。
需要说明的是，以上列举的方案仅为示例，本申请还包括其它多种实现方式，例如，安全芯片2及控制器1共用所有电源单元的方式等，还例如，不需要设置第一开关和第二开关，安全芯片2通过通讯总线分别存储器3和控制器1连接的方式，在此不一一赘述。
需要说明的是，第五开关9可以是一路开关电路，也可以是多路开关电路，当然，第五开关9可以是集成电路，也可以由分立元件搭建。在本实施方式中，第五开关9为多路开关电路，其包括多个第一开关单元a，每个第一开关单元a连接在一个电源单元与控制器1的电源引脚(Power in)之间，用于控制其对应的电源单元为控制器1供电，控制器1的电源引脚的数量为可以为1个或者多个。在本实施方式中，第一开关单元a被配置为使能端接高电平信号时有效，因此，第一开关单元a可以使用PNP三极管作为开关。
可选地，第一开关单元a还可以配置为低电平信号使能有效，若第一开关单元a为低电平信号使能有效，则第一开关单元a还可以使用PMOS管作为开关。多个第一开关单元a的导通与截止可以由安全芯片2的一路使能信号控制，多个第一开关单元a的导通与截止可以由安全芯片2的一路使能信号控制还可以由安全芯片2的多路使能信号中的每一路使能信号单独控制。
请参阅附图11，进一步地，安全芯片2具体被配置为：当图像形成装置上电后，读取存储器3内存储的待校验程序，对待校验程序进行安全校验以及将待校验程序发送给控制器1对应的待校验程序加载器，待校验程序加载器接收到待校验程序后开始执行待校验程序；
其中，在安全芯片2对待校验程序进行安全校验的过程中，若安全芯片2确定待校验程序不符合安全要求，且当前控制器1正在执行待校验程序时，安全芯片2控制控制器1停止执行待校验程序。
需要说明的是，安全芯片2对待校验程序进行安全校验可以是静态和/或动态的，例如，安全芯片2读取存储器3内存储的待校验程序，并准备发送给控制器1对应的待校验程序加载器；例如还可以是在待校验程序加载器接收到待校验程序后控制器1开始执行待校验程序。
可以理解，本申请通过安全芯片2对控制器1所要执行的程序进行安全校验，当待校验程序不符合安全要求时，安全芯片2控制控制器1停止执行待校验程序，使得控制器1在运行的过程中，全程受到安全芯片2的监控，能够很好的保证图像形成装置的安全性，可靠性好。同时，本申请通过安全芯片2将控制器1所要执行的程序发送给控制器1，无需额外配置对应的硬件电路来使得控制器1与安全芯片2能够同时从存储器3获取待校验程序，因此进一步简化了电路结构，节约了成本。
在本申请一个或多个实施方式中，待校验程序可以包括启动程序及应用程序，应用程序的数量为至少一个。在其它实施方式中，待校验程序还可以仅包括启动程序和应用程序中的应用程序。
请再次参阅附图4，在本申请实施例中，安全芯片2通过第一通讯总线与存储器3通讯连接，用于从存储器3内读取待校验程序，安全芯片2通过第二通讯总线与控制器1通讯连接，用于将读取的待校验程序发送给控制器1内置的待校验程序加载器。
进一步地，在本实施方式中，安全芯片2对待校验程序进行安全校验以及将待校验程序发送给控制器1对应的待校验程序加载器，具体可以包括：
安全芯片2在读取待校验程序的过程中或者读取待校验程序完毕后，对已读取的待校验程序进行安全校验，同时将已读取的待校验程序发送给待校验程序加载器。
可选地，安全芯片2可以是在读取全部待校验程序完毕后，再开始对待校验程序进行校验，且校验的同时将待校验程序发送给待校验程序加载器；或者，安全芯片2在读取待校验程序的过程中，对当前已读取的待校验程序进行安全校验，以及将当前读取的待校验程序发送给待校验程序加载器执行，或者，当安全芯片2每读取完待校验程序其中的部分程序(例如Boot程序)时，安全芯片2就对该部分程序进行安全性校验，同时将该部分程序发送给待校验程序加载器，接着再依次进行其它部分程序(Uboot程序、操作系统程序等)的校验及执行。
可选地，安全芯片2还可以是待校验程序的过程中，对已读取的待校验程序进行安全校验，同时将已读取的待校验程序发送给待校验程序加载器；进一步可选地，以Boot程序为例，将Boot程序分成很多小段，每小段分别进行校验，并且每小段同时发送给程序加载器，由于程序加载器接收到很多小段并不能直接完成当前Boot程序对应的功能，所以程序加载器还不能直接完成当前Boot程序对应的启动，也并不会直接威胁到整个系统的安全；在安全芯片2对每小段程序都完成校验后，这样程序加载器也几乎就接收完了整个Boot程序，其它的待校验程序也类似。
可以理解，本申请通过在读取或者校验控制器1需要执行的待校验程序时，采用执行与校验同步进行的方式，提高了控制器1运行的速度，当待校验程序为启动程序时，可以加快图像形成装置的启动速度，进而提高用户的使用体验。
其它实施方式中，在图像形成装置的运行速度或者启动速度要求不高的场景下，安全芯片2对待校验程序进行安全校验以及将待校验程序发送给控制器1对应的待校验程序加载器，可以包括：
安全芯片2在读取待校验程序的过程中或者读取待校验程序完毕后，先对已读取的待校验程序进行安全校验，当确定出已读取的待校验程序符合安全要求后，才将已读取的待校验程序发送给待校验程序加载器。
可选地，安全芯片2可以先读取全部待校验程序，待全部待校验程序校验通过后，再将全部待校验程序发送给待校验程序加载器，若待校验程序校验未通过，则不再将待校验程序发送给待校验程序加载器。或者，安全芯片2依次对待校验程序中的部分待校验程序(例如，依次对Boot程序、Uboot程序、操作系统程序及应用程序进行校验)进行校验，当该部分待校验程序校验通过后，再将该部分待校验程序发送给待校验程序加载器执行，然后再进行下个部分的待校验程序的读取、校验及执行。
针对于上文的安全芯片2对已读取的待校验程序进行安全校验，同时将已读取的待校验程序发送给待校验程序加载器的方式，进一步地，若安全芯片2在进行安全校验的过程中，确定待校验程序中的启动程序或者操作系统程序不符合安全要求时，考虑到控制器1的运行状态，可以包括以下情况：
若当前控制器1正在执行启动程序或者操作系统程序或应用程序，则安全芯片2先控制控制器1停止执行启动程序或者操作系统程序或应用程序，再控制控制器1复位，以使得控制器1回到初始状态；又或者是，安全芯片2先控制控制器1停止执行启动程序或者操作系统程序，再控制控制器1断电。
若当前控制器1未执行启动程序或者操作系统程序或应用程序，则直接控制控制器1复位，以使得控制器1回到初始状态；又或者是，安全芯片2直接控制控制器1断电。
可以理解，当检测到控制器1启动要执行的启动程序或者操作系统程序不符合安全要求时，控制控制器1复位或者断电，可以保证图像形成装置的安全性。
还需要说明的是，在本申请一个或多个实施例中，若安全芯片2确定至少一个应用程序中的第一应用程序不符合安全要求，且当前控制器1正在执行应用程序时，安全芯片2发送错误信号控制控制器1停止执行第一应用程序；若安全芯片2确定至少一个应用程序中的第一应用程序不符合安全要求，且当前控制器1未正在执行启动程序，安全芯片2不允许控制器1启动对第一应用程序的执行。
在一种实现方式中，安全芯片2与控制器1的复位端连接，安全芯片2通过向控制器1的复位端发送复位使能信号使得控制器1复位。
在另一种实现方式中，图像形成装置还包括电源开关(例如附图5、附图7-附图10中所示的第五开关9)，电源开关连接于电源模块7与控制器1之间，被设置于为控制器1供电，安全芯片2通过控制电源开关断开和/或生成使能无效信号至电源模块的使能端使得控制器1断电。
请参阅附图2，本实施例还提供一种图像形成装置用启动控制系统(图2中的虚线框所示)，该图像形成装置包括被配置为控制图像形成装置执行成像操作的控制器1，该启动控制系统包括：
安全芯片2，与控制器1连接，被配置为对控制器1的运行活动进行监控；及
存储器3，与安全芯片2连接，被配置为存储控制器1的待校验程序，待校验程序为图像形成装置运行所用的程序；
其中，安全芯片2对待校验程序进行安全校验，当安全芯片2对待校验程序的安全性检验的结果为不通过时，安全芯片2控制控制器1不执行待校验程序。
关于启动控制系统中各器件/模块与上述图像形成装置中的描述相同，而且也能实现相同的技术效果，在此不再赘述。
请参阅附图3，本实施例还提供一种图像形成装置用安全控制系统，图像形成装置包括被配置为控制图像形成装置执行成像操作的控制器1，安全控制系统包括：安全芯片2，与控制器1连接，被配置为对控制器1进行安全监控；及电源模块7，与控制器1连接，被配置为向控制器1供电；其中，安全芯片2还被配置为当监控到控制器1不符合预设安全条件时，断开电源模块7与控制器1之间的连接。
关于安全控制系统中各器件/模块与上述图像形成装置中的描述相同，而且也能实现相同的技术效果，在此不再赘述。
以上仅为本申请的较佳实施例而已，并不用以限制本申请，凡在本申请的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本申请保护的范围之内。

Claims (15)

  1. 一种图像形成装置，其特征在于，包括：
    控制器，被配置为控制所述图像形成装置执行成像操作；
    安全芯片，与所述控制器连接，被配置为对所述控制器的运行活动进行监控；
    存储器，与所述安全芯片连接，被配置为存储待校验程序，所述待校验程序为所述图像形成装置运行所用的程序；
    当所述安全芯片对所述待校验程序的安全性检验的结果为不通过时，所述安全芯片控制所述控制器不执行所述待校验程序。
  2. 根据权利要求1所述的图像形成装置，其特征在于，所述待校验程序包括启动程序，所述存储器还存储有安全校验信息，所述安全芯片包括启动控制器，所述启动控制器与所述控制器连接，被配置为先控制所述安全芯片读取所述存储器中存储的启动程序和安全校验信息，并通过所述安全校验信息对所述启动程序进行安全性校验，当安全性检验通过后，再控制所述控制器读取所述启动程序完成所述控制器的启动。
  3. 根据权利要求2所述的图像形成装置，其特征在于，所述启动控制器与所述控制器的复位引脚连接，所述启动控制器被配置为在所述启动程序通过安全性校验之前，向所述控制器的复位引脚输出复位使能信号，以及在所述启动程序通过安全性校验后，向所述控制器的复位引脚输出复位失效信号。
  4. 根据权利要求2所述的图像形成装置，其特征在于，所述图像形成装置还包括第一隔离电路及第二隔离电路，所述第一隔离电路连接于所述启动控制器与所述存储器之间，所述第二隔离电路连接于所述控制器与所述存储器之间，所述第一隔离电路及所述第二隔离电路共用一总线接口与所述存储器连接；
    所述图像形成装置上电后，所述安全芯片优先启动，所述启动控制器先控制所述第一隔离电路导通及第二隔离电路断开，所述安全芯片读取所述存储器的启动程序和安全校验信息，并通过所述安全校验信息对所述启动程序进行安全性校验，当所述启动程序通过安全性校验后，所述启动控制器再控制所述第一隔离电路断开及第二隔离电路导通，所述控制器读取所述存储器的启动程序完成启动。
  5. 根据权利要求4所述的图像形成装置，其特征在于，所述第一隔离电路包括第一开关，所述第一开关的第一端、第二端及第三端分别与所述安全芯片、所述启动控制器及所述存储器连接，所述启动控制器通过发送预设电信号至所述第一开关的第二端控制所述第一开关的第一端与所述第三端之间的导通或断开；
    所述第二隔离电路包括第二开关，所述第二开关的第一端、第二端及第三端分别与所述控制器、所述启动控制器及所述存储器连接；所述启动控制器通过发送预设电信号至所述第二开关的第二端控制所述第二开关的第一端与所述第三端之间的导通或断开。
  6. 如权利要求1或2所述的图像形成装置，其特征在于，所述安全芯片通过第一通讯总线与所述存储器连接，所述安全芯片通过第二通讯总线与所述控制器的第二引脚连接，当所述图像形成装置上电后，所述安全芯片通过所述第一通讯总线读取所述存储器内存储的所述启动程序，对所述启动程序进行安全性校验以及将所述启动程序通过第二通讯总线发送给所述控制器，以使得所述控制器读取所述存储器的启动程序完成启动。
  7. 根据权利要求1或2所述的图像形成装置，其特征在于，所述图像形成装置还包括电源模块，所述电源模块与所述控制器连接，被配置为向所述控制器供电；
    其中，所述安全芯片还被配置为当监控到所述控制器不符合预设安全条件时，断开所述电源模块与所述控制器之间的连接。
  8. 根据权利要求7所述的图像形成装置，其特征在于，所述图像形成装置还包括第四开关及第五开关，所述安全芯片及所述控制器分别与所述第四开关的第一端及使能端连接，所述第四 开关的第二端与所述第五开关的使能端连接，所述第五开关的第一端及第二端分别与所述电源模块及所述控制器的电源引脚连接。
    所述图像形成装置上电后，所述第四开关的使能端接收使能有效信号，所述第四开关的第一端与第二端导通，所述安全芯片生成使能无效信号至所述第五开关的使能端，所述第五开关的第一端及第二端之间的通路断开；
    当所述启动程序通过安全性校验后，所述安全芯片生成使能有效信号，并通过所述第四开关发送所述使能有效信号至所述第五开关的使能端，所述第五开关的第一端与第二端导通，所述电源模块为所述控制器供电。
  9. 根据权利要求7所述的图像形成装置，其特征在于，所述图像形成装置还包括第六开关，所述安全芯片及所述控制器分别与所述第六开关的第一端及使能端连接，所述第六开关的第二端与所述电源模块的使能端连接；
    所述图像形成装置上电后，所述第六开关的使能端接收使能有效信号，所述第六开关的第一端与第二端导通，所述安全芯片生成使能无效信号至所述电源模块的使能端；
    当所述启动程序通过安全性校验后，所述安全芯片生成使能有效信号至所述电源模块的使能端，所述电源模块为所述控制器供电。
  10. 根据权利要求1所述的图像形成装置，其特征在于，所述安全芯片具体被配置为当所述图像形成装置上电后，读取所述存储器内存储的所述待校验程序，对所述待校验程序进行安全校验以及将所述待校验程序发送给所述控制器对应的待校验程序加载器，所述待校验程序加载器接收到所述待校验程序后开始执行所述待校验程序；
    其中，在所述安全芯片对所述待校验程序进行安全校验的过程中，若所述安全芯片确定所述待校验程序不符合安全要求，且当前所述控制器正在执行所述待校验程序时，所述安全芯片控制所述控制器停止执行所述待校验程序。
  11. 如权利要求10所述的图像形成装置，其特征在于，所述安全芯片在读取所述待校验程序的过程中或者读取所述待校验程序完毕后，对已读取的待校验程序进行安全校验，同时将已读取的待校验程序发送给所述待校验程序加载器。
  12. 如权利要求10所述的图像形成装置，其特征在于，所述安全芯片在读取所述待校验程序的过程中或者读取所述待校验程序完毕后，先对已读取的待校验程序进行安全校验，当确定出所述已读取的待校验程序符合安全要求后，才将所述已读取的待校验程序发送给所述待校验程序加载器。
  13. 根据权利要求10或11所述的图像形成装置，其特征在于，所述待校验程序包括启动程序，若所述安全芯片确定所述启动程序不符合安全要求，且当前所述控制器正在执行所述启动程序时，所述安全芯片先控制所述控制器停止执行所述启动程序，再控制所述控制器复位，以使得所述控制器回到初始状态；或者，所述安全芯片先控制所述控制器停止执行所述启动程序，再控制所述控制器断电。
  14. 根据权利要求10或11所述的图像形成装置，所述待校验程序包括至少一个应用程序，若所述安全芯片确定所述至少一个应用程序中的第一应用程序不符合安全要求，所述安全芯片禁止所述控制器执行所述第一应用程序。
  15. 一种图像形成装置用启动控制系统，所述图像形成装置包括被配置为控制所述图像形成装置执行成像操作的控制器，其特征在于，包括：
    安全芯片，与所述控制器连接，被配置为对所述控制器的运行活动进行监控；及
    存储器，与所述安全芯片连接，被配置为存储所述控制器的待校验程序，所述待校验程序为所述图像形成装置运行所用的程序；
    所述安全芯片对所述待校验程序进行安全校验，当所述控制器正在执行所述待校验程序时，所述安全芯片控制所述控制器停止执行所述待校验程序。
PCT/CN2020/095310 2019-06-28 2020-06-10 图像形成装置及图像形成装置用安全控制系统 WO2020259285A1 (zh)

Applications Claiming Priority (6)

Application Number Priority Date Filing Date Title
CN201920996840.6U CN210007764U (zh) 2019-06-28 2019-06-28 一种图像形成装置、图像形成装置用启动控制系统
CN201920996840.6 2019-06-28
CN201910832398.8 2019-09-04
CN201921461567.3U CN210804374U (zh) 2019-09-04 2019-09-04 一种图像形成装置及图像形成装置用安全控制系统
CN201921461567.3 2019-09-04
CN201910832398.8A CN110536042B (zh) 2019-09-04 2019-09-04 图像形成装置及其控制方法、存储介质

Publications (1)

Publication Number Publication Date
WO2020259285A1 true WO2020259285A1 (zh) 2020-12-30

Family

ID=74060023

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/095310 WO2020259285A1 (zh) 2019-06-28 2020-06-10 图像形成装置及图像形成装置用安全控制系统

Country Status (1)

Country Link
WO (1) WO2020259285A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200287991A1 (en) * 2011-02-23 2020-09-10 Lookout, Inc. Monitoring a computing device to automatically obtain data in response to detecting background activity

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN201063694Y (zh) * 2007-02-14 2008-05-21 上海瑞达安全集成电路有限公司 一种信息处理与转换设备
CN101247449A (zh) * 2007-02-14 2008-08-20 上海瑞达安全集成电路有限公司 一种具有信息安全系统的信息处理与转换设备
CN103186434A (zh) * 2011-12-31 2013-07-03 国民技术股份有限公司 恢复基本输入输出系统的方法及系统
CN108229132A (zh) * 2017-12-27 2018-06-29 北京和利时系统工程有限公司 一种安全启动方法和装置、终端
WO2019062993A1 (zh) * 2017-09-30 2019-04-04 华为技术有限公司 安全启动方法、装置及终端设备
CN110536042A (zh) * 2019-09-04 2019-12-03 珠海奔图电子有限公司 图像形成装置及其控制方法、存储介质
CN210007764U (zh) * 2019-06-28 2020-01-31 珠海奔图电子有限公司 一种图像形成装置、图像形成装置用启动控制系统

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN201063694Y (zh) * 2007-02-14 2008-05-21 上海瑞达安全集成电路有限公司 一种信息处理与转换设备
CN101247449A (zh) * 2007-02-14 2008-08-20 上海瑞达安全集成电路有限公司 一种具有信息安全系统的信息处理与转换设备
CN103186434A (zh) * 2011-12-31 2013-07-03 国民技术股份有限公司 恢复基本输入输出系统的方法及系统
WO2019062993A1 (zh) * 2017-09-30 2019-04-04 华为技术有限公司 安全启动方法、装置及终端设备
CN108229132A (zh) * 2017-12-27 2018-06-29 北京和利时系统工程有限公司 一种安全启动方法和装置、终端
CN210007764U (zh) * 2019-06-28 2020-01-31 珠海奔图电子有限公司 一种图像形成装置、图像形成装置用启动控制系统
CN110536042A (zh) * 2019-09-04 2019-12-03 珠海奔图电子有限公司 图像形成装置及其控制方法、存储介质

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200287991A1 (en) * 2011-02-23 2020-09-10 Lookout, Inc. Monitoring a computing device to automatically obtain data in response to detecting background activity
US11720652B2 (en) * 2011-02-23 2023-08-08 Lookout, Inc. Monitoring a computing device to automatically obtain data in response to detecting background activity

Similar Documents

Publication Publication Date Title
US8862803B2 (en) Mediating communciation of a univeral serial bus device
US10878098B2 (en) System on chip to perform a secure boot, an image forming apparatus using the same, and method thereof
EP2741228B1 (en) System on chip to perform a secure boot, an image forming apparatus using the same, and method thereof
CN110536042B (zh) 图像形成装置及其控制方法、存储介质
EP1944712B1 (en) Methods and apparatus for protecting data
US8272002B2 (en) Method and system for implementing an external trusted platform module
CN102063591B (zh) 基于可信平台的平台配置寄存器参考值的更新方法
CN210007764U (zh) 一种图像形成装置、图像形成装置用启动控制系统
CN113168474A (zh) 固件的安全验证
US11263350B2 (en) Cryptographic apparatus and self-test method of cryptographic apparatus
CN114817105B (zh) 设备枚举的方法、装置、计算机设备以及存储介质
CN111786820B (zh) 固件更新方法、装置及网络设备
WO2022143429A1 (zh) 计算机系统、可信功能组件及运行方法
CN111614859B (zh) 图像形成装置及其安全控制方法、存储介质
JP2007310688A (ja) マイクロコンピュータおよびそのソフトウェア改竄防止方法
WO2020259285A1 (zh) 图像形成装置及图像形成装置用安全控制系统
CN210804374U (zh) 一种图像形成装置及图像形成装置用安全控制系统
CN112445444A (zh) 图像形成装置及安全控制系统
CN111783120A (zh) 一种数据的交互方法、计算设备、bmc芯片及电子设备
US11960737B2 (en) Self-deploying encrypted hard disk, deployment method thereof, self-deploying encrypted hard disk system and boot method thereof
CN113515414B (zh) 数据处理系统和非暂态机器可读介质
RU2811751C2 (ru) Устройство формирования изображения и система управления его безопасностью
CN117932623B (zh) 一种操作系统安全引导方法及系统
US20220100860A1 (en) Secure collection and communication of computing device working data
CN118550646A (zh) 一种安全虚拟机度量方法、相关设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20832589

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2021138201

Country of ref document: RU

122 Ep: pct application non-entry in european phase

Ref document number: 20832589

Country of ref document: EP

Kind code of ref document: A1