JP2020057250A - Information processor, and control method and program therefor - Google Patents

Abstract

To provide an information processor, and a control method and a program therefor capable of starting an information processor in a short time while verifying a program during normal operation.SOLUTION: An information processor includes: verification means that, after the information processor is started, when start information indicates start of a first program, verifies the first program, and when the start information indicates start of a second program, verifies the second program; first starting means that, when the verification of the first program by the verification means is successful, if there is no start instruction of the second program, starts the first program; and restarting means that, when the verification of the first program by the verification means is successful, if there is a start instruction of the second program, records start information indicating restarting of the second program and restarts the information processor.SELECTED DRAWING: Figure 5

Description

  The present invention relates to an information processing apparatus, a control method for the information processing apparatus, and a program.

  Some information processing apparatuses and image forming apparatuses in recent years have a function of switching an OS (Operating System) to be started based on flag information or a specific input. With such a function, for example, when the OS for normal operation is damaged, the OS for recovery is started to recover the system for normal operation. In addition, some systems have a function of preventing a falsified malicious system from starting by verifying files and data constituting the system using an electronic signature or the like before starting the system. Here, as the number of verification targets increases, the number of calculation processes for verification increases, so that the time required for system startup tends to increase.

  Patent Literature 1 below discloses a technique of determining whether verification processing is necessary based on the presence or absence of a flag, and performing verification processing only when necessary.

International Publication No. 2009/013831

  When the verification process is performed on a plurality of targets such as the normal operation OS and the recovery OS, the time required for the verification process increases, so that the system boot time increases, and as a result, the user's waiting time increases. There are issues.

  An object of the present invention is to enable an information processing apparatus to be started in a short time while verifying a program during a normal operation.

  An information processing apparatus according to the present invention is an information processing apparatus, and after activation of the information processing apparatus, when activation information indicates activation of a first program, the information processing apparatus verifies the first program, Indicates the activation of the second program, a verification unit for verifying the second program, and if the verification of the first program by the verification unit succeeds, an instruction for starting the second program is issued. If not, first activation means for activating the first program, and if the verification of the first program by the verification means succeeds, if there is an instruction to activate the second program, A restart unit that records start information indicating the start of the second program and restarts the information processing apparatus.

  According to the present invention, at the time of normal operation, the information processing apparatus can be started up in a short time while verifying the program.

FIG. 2 is a block diagram illustrating a configuration example of an image forming apparatus. FIG. 3 is a diagram illustrating an example of data stored in an HDD. It is a flowchart which shows a starting process. 9 is a flowchart illustrating a BIOS verification process in the boot process. 9 is a flowchart illustrating a loader process in the startup process.

  Hereinafter, the best mode for carrying out the present invention will be described with reference to the drawings. The following embodiments do not limit the invention according to the claims, and all combinations of the features described in the embodiments are not necessarily essential for solving the invention.

  FIG. 1 is a diagram illustrating a hardware configuration example of an image forming apparatus 100 according to an embodiment of the present invention. The image forming apparatus 100 is an example of an information processing device. A central processing unit (hereinafter, referred to as a CPU) 101 executes a program for operating the image forming apparatus 100. The system bus 102 is a passage through which the CPU 101 accesses other units, and a passage through which other units access each other.

  A hard disk drive unit (hereinafter referred to as an HDD) 103 stores various programs, databases, and temporary storage files necessary for the operation of the image forming apparatus 100. The random access memory (hereinafter, referred to as RAM) 104 stores a program for the image forming apparatus 100 and stores a variable at the time of program operation and a storage area for data transferred from each unit by direct memory access (hereinafter, referred to as DMA). Have.

  The network controller 105 and the network controller I / F 106 control communication between the image forming apparatus 100 and other devices on the network. The USB host controller 107 and the USB host I / F 108 control communication between the image forming apparatus 100 and the USB device. The USB host I / F 108 is connected to a USB device using a USB cable. Some USB devices are directly connected without using a USB cable.

  The CPLD 109 reads the low-level / high-level status of the signal line on the board circuit via the CPU 101, and enables the CPU 101 to change the setting of the low-level / high-level status. The CPLD 109 is a programmable logic device, and makes it possible to control power off / on on the image forming apparatus 100. The General Purpose Input Output (hereinafter referred to as GPIO) exists inside the CPLD 109. The CPU 101 can turn off / on the power by changing the set value of the GPIO register.

  The display 111 displays an operation state of the image forming apparatus 100 so that a user or the like can check the operation state. The display controller 110 controls display on the display 111. The input unit 113 receives an instruction from the user to the image forming apparatus 100. The input unit controller 112 controls the input unit 113. The input unit 113 is, for example, a keyboard, a mouse, a numeric keypad, a cursor key, or a touch panel. When the input unit 113 is a touch panel, the input unit 113 is physically mounted on the surface of the display 111.

  The real-time clock (hereinafter, referred to as RTC) 114 has a clock function, an alarm function, a timer function, and the like of the image forming apparatus 100. The nonvolatile memory 115 is a rewritable memory. The non-volatile memory 115 stores a BIOS (Basic Input Output System) 121. Immediately after the start of energization, the CPU 101 starts processing of the BIOS 121. The nonvolatile memory 115 has a data area, and stores a public key and a special activation flag 120 used for signature verification processing described later.

  The scanner 117 is connected to the system bus 102 via the scanner I / F 116. The scanner 117 optically reads an image of a document and generates image data. The printer 119 is connected to the system bus 102 via the printer I / F 118. The printer 119 prints image data.

  FIG. 2 is a diagram illustrating data stored in the HDD 103. The HDD 103 stores two types of operating systems (hereinafter referred to as OS) 201 and 202 and a loader (Loader) 203, and has two types of storage areas 204 and 205. The OS 201 is an OS used for a normal operation purpose. The OS 202 is a recovery OS assuming update of the OS 201 or recovery at the time of damage. The loader 203 determines which of the OSs 201 and 202 to activate based on the presence of the input unit 113 and the flag information. The storage areas 204 and 205 store firmware for performing print processing and the like, setting files, and user data, respectively. The storage area 204 is an area used by the OS 201. The storage area 205 is an area used by the OS 202. In the storage areas 204 and 205, programs to be stored are different depending on the use, and the sizes of the storage areas are different. It should be noted that any of the above-mentioned data is provided with electronic signature information calculated and derived in advance, which is used as a judgment material in a verification process described later.

  FIG. 3 is a flowchart illustrating a startup process of the image forming apparatus 100. After the activation of the image forming apparatus 100, the image forming apparatus 100 performs the processing of the flowchart in FIG. Hereinafter, a control method of the image forming apparatus 100 will be described.

  First, in step S301, the CPU 101 reads the BIOS 121 stored on the nonvolatile memory 115, and performs the processing of the BIOS 121. The CPU 101 performs a signature verification process on the loader 203, the OS 201, and the OS 202 by the process of the BIOS 121, and determines whether there is any falsification based on the result. Details of step S301 will be described later with reference to FIG.

  Next, in step S302, the CPU 101 reads out the loader 203 on the HDD 103 by the process of the BIOS 121, and performs the process of the loader 203. The CPU 101 determines which of the OSs 201 and 202 is to be activated by the processing of the loader 203, and reads out one of the OSs 201 and 202 and the firmware or the like of the storage area 204 or 205 corresponding thereto based on the determination result. Details of step S302 will be described later with reference to FIG.

  Next, in step S303, the CPU 101 initializes each hardware block illustrated in FIG. 1 by the processing of the OS read in step S302, and sets the hardware block to a usable state.

  Next, in step S304, after the initialization of the hardware block is completed, the CPU 101 starts the activation processing of various firmware by the processing of the OS, and makes the function of the image forming apparatus 100 executable.

  FIG. 4 is a flowchart showing the processing of the BIOS 121 started by the CPU 101 in step S301 of FIG. In the present embodiment, an example will be described in which the BIOS 121 performs an OS and loader verification process. In the verification process, the signature verification process is performed using the public key stored on the nonvolatile memory 115. However, another method may be used. In the present embodiment, steps S402, S403, and S404 show an example in which verification is performed by the same method, but different methods may be used.

  First, in step S401, the CPU 101 checks whether or not the special activation flag 120 is recorded in the nonvolatile memory 115. The special start flag 120 is start information. At the initial stage, the special activation flag 120 is not recorded. The recording process of the special activation flag 120 will be described later with reference to FIG. If the special start flag 120 is recorded (Yes in S401), the CPU 101 determines that the user has instructed the start of the recovery OS 202 because the special start flag 120 indicates the start of the recovery OS 202. Proceed to S402. On the other hand, when the special start flag 120 is not recorded (No in S401), the user does not instruct the start of the recovery OS 202 because the special start flag 120 indicates the start of the normal operation OS 201. And the process proceeds to step S403.

  In step S402, the CPU 101 performs a signature verification process on the recovery OS 202 on the HDD 103, and proceeds to step S404. The recovery OS 202 is a program executed by the CPU 101. In step S403, the CPU 101 performs a signature verification process on the normal operation OS 201 on the HDD 103, and proceeds to step S404. The normal operation OS 201 is a program executed by the CPU 101.

  In step S404, the CPU 101 performs a signature verification process on the loader 203 on the HDD 103. The loader 203 is a program executed by the CPU 101. Next, in step S405, if the verification has failed (NG) in either of the verification of the OS 201 or 202 and the verification of the loader 203 (Yes in S405), the process proceeds to step S406. . On the other hand, if the verification of either the OS 201 or 202 or the verification of the loader 203 is successful (OK) (NO in S405), the CPU 101 proceeds to step S407.

  In step S406, the CPU 101 determines that tampering has been performed, notifies the error by displaying an error on the display 111, and stops the startup processing. In step S407, the CPU 101 determines to continue the startup processing, loads the loader 203 from the HDD 103 to the RAM 104, and starts the loader 203.

  FIG. 5 is a flowchart showing the processing of the loader 203 started by the CPU 101 in step S302 of FIG. If the verification result is OK in step S405 in FIG. 4, the processing in the flowchart in FIG. 5 is performed.

  First, in step S501, the CPU 101 checks whether or not the special activation flag 120 is recorded in the nonvolatile memory 115. When the special activation flag 120 is recorded (Yes in S501), the CPU 101 proceeds to step S502. On the other hand, when the special activation flag 120 is not recorded (No in S501), the CPU 101 proceeds to step S504.

  In step S502, the CPU 101 determines that the recovery OS 202 has been verified to be normal by the processing in FIG. 4, and deletes the special startup flag 120 in the nonvolatile memory 115. That is, the CPU 101 records the start information indicating the start of the normal operation OS 201. This prevents the recovery OS 202 from being activated even when there is no user instruction. Next, in step S503, the CPU 101 loads the recovery OS 202 on the HDD 103 into the RAM 104 and activates the recovery OS 202.

  In step S <b> 504, the CPU 101 determines that the normal operation OS 201 has been verified to be normal by the processing in FIG. 4, and checks whether the user has issued an instruction to start the recovery OS 202. For example, when the CPU 101 detects the operation of pressing the special key from the input unit 113, the CPU 101 determines that the user has issued an instruction to start the recovery OS 202. If there is an instruction from the user to activate the recovery OS 202 (Yes in S504), the CPU 101 proceeds to step S505. On the other hand, when there is no instruction from the user to start the recovery OS 202 (No in S504), the CPU 101 proceeds to step S507.

  In step S505, the CPU 101 records the special startup flag 120 in the nonvolatile memory 115 in order to verify the unverified recovery OS 202. Thereby, the determination result of step S401 in FIG. 4 can be changed, and the CPU 101 can instruct the BIOS 121 to verify the recovery OS 202. Next, in step S506, the CPU 101 restarts the image forming apparatus 100 to restart the process from the BIOS 121. As a result, the CPU 101 can restart the boot process from step S301 in FIG. 3, verify the recovery OS 202 in the BIOS 121 as described above, and can boot the recovery OS 202 in step S503.

  In step S507, the CPU 101 loads the normal operation OS 201 from the HDD 103 to the RAM 104, and starts the normal operation OS 201.

  As described above, by the processing in FIGS. 4 and 5, the CPU 101 can suppress the increase in the verification time to one OS by omitting the verification processing of the recovery OS 202 during normal use. On the other hand, even when the recovery OS 202 is instructed by the user, the robustness is maintained because the recovery OS 202 is verified, although the restart is interposed.

  The image forming apparatus 100 can reduce the delay of the startup time of the normal startup by the normal operation OS 201. Further, the image forming apparatus 100 incorporates the verification processing program only into the BIOS 121 and does not need to be incorporated into the loader 203, so that an increase in the usage of the HDD 103 of the loader 203 can be suppressed.

  When there is no special startup flag 120, the CPU 101 does not verify the recovery OS 202 but only the normal operation OS 201, thereby shortening the startup time of the image forming apparatus 100.

  When the user presses the special key, the CPU 101 records the special activation flag 120 and restarts the image forming apparatus 100. After the restart, the CPU 101 verifies the recovery OS 202 because the special startup flag 120 is recorded, erases the special startup flag 120, and starts the recovery OS 202.

(Other embodiments)
The present invention supplies a program that realizes one or more functions of the above-described embodiments to a system or an apparatus via a network or a storage medium, and one or more processors in a computer of the system or the apparatus read and execute the program. This processing can be realized. Further, it can be realized by a circuit (for example, an ASIC) that realizes one or more functions.

  It should be noted that each of the above-described embodiments is merely an example of a concrete example for carrying out the present invention, and the technical scope of the present invention should not be interpreted in a limited manner. That is, the present invention can be implemented in various forms without departing from the technical idea or the main features.

REFERENCE SIGNS LIST 100 image forming apparatus, 101 CPU, 103 HDD, 120 special startup flag, 121 BIOS, 201, 202 OS, 203 loader

Claims (11)

An information processing device,
After the information processing apparatus is activated, if the activation information indicates the activation of the first program, the first program is verified. If the activation information indicates the activation of the second program, the second program is validated. Verification means for verifying the program of
When the verification of the first program by the verification unit succeeds, when there is no instruction to start the second program, a first activation unit that activates the first program;
When the verification of the first program by the verification means is successful, and when there is a start instruction of the second program, start information indicating the start of the second program is recorded, and the information processing apparatus is An information processing apparatus, comprising: restart means for restarting.   2. The information processing apparatus according to claim 1, further comprising a second activation unit that activates the second program when the verification of the second program by the verification unit is successful.   When the verification of the second program by the verification unit succeeds, the second activation unit records activation information indicating activation of the first program, and activates the second program. The information processing apparatus according to claim 2, wherein   4. The information processing apparatus according to claim 1, further comprising a notification unit that notifies an error when the verification of the first program by the verification unit fails. 5.   The verification unit verifies the first program if the activation information indicating the activation of the second program is not recorded after the activation, and records the activation information indicating the activation of the second program. The information processing apparatus according to claim 1, wherein the verification of the second program is performed when the verification is performed. The first program is a first operating system,
The information processing apparatus according to claim 1, wherein the second program is a second operating system. The verification means verifies the loader,
When the verification of the first operating system and the loader by the verification unit succeeds, or when the verification of the second operating system and the loader by the verification unit succeeds, a third activation that activates the loader. 7. The information processing apparatus according to claim 6, further comprising a unit.   8. The information processing apparatus according to claim 7, wherein the first activation unit and the second activation unit are processes of the loader activated by a central processing unit.   9. The information processing apparatus according to claim 8, wherein the verification unit is a process of a BIOS started by the central processing unit. A method for controlling an information processing device, comprising:
The verification means verifies the first program when the activation information indicates the activation of the first program after the activation of the information processing apparatus, and verifies the activation of the first program when the activation information indicates the activation of the second program. Comprises a verification step of verifying a second program;
A first activating step for activating the first program if the first activating means succeeds in the verification of the first program in the verifying step and if there is no instruction to activate the second program; When,
When the verification of the first program is successful in the verification step by the restart unit, if there is an instruction to start the second program, the start information indicating the start of the second program is recorded, And a restarting step of restarting the information processing apparatus.   A program for causing a computer to function as each unit of the information processing apparatus according to claim 1.

Images