JP7206769B2 - Electronic device and method of operation - Google Patents

Description

The present invention relates to an electronic device that operates by referring to information held in a non-rewritable storage medium, and an operating method.

Some electronic devices are equipped with electronic fuses. Electronic fuses can hold non-volatile bit information, and have the characteristic that once a bit is changed from 0 to 1, it cannot be changed again. For this reason, electronic fuses are used to hold information that should not be rewritten, such as product information and performance.

However, after writing the final product information, performance, etc. in the electronic fuse, there are cases where it is desired to change the written contents due to an unexpected technical change or the like.

Therefore, by preparing a virtual electronic fuse and specifying to read the value of the virtual electronic fuse, the value of the electronic fuse cannot be changed, but the value read by the device can be changed later. has been proposed (see, for example, Patent Document 1).

However, with the above technology, even if an electronic fuse fails or is tampered with, the failure or tampering cannot be detected from the bit information held by the electronic fuse, and the electronic fuse cannot be virtualized. Some electronic fuses hold information necessary to operate equipment, but if the electronic fuse cannot be virtualized, the information of the electronic fuse must be changed from the outside. In this case, there is a problem that the device cannot be operated when an abnormality such as failure or tampering occurs in the electronic fuse.

SUMMARY OF THE INVENTION It is an object of the present invention to provide an electronic device and an operation method that can operate equipment even if an abnormality such as failure or falsification of an electronic fuse occurs. .

In order to solve the above-described problems, in one embodiment of the invention, an electronic device that operates by referring to information held in a non-rewritable storage medium,
detection means for detecting an abnormality in the storage medium using information held by the storage medium;
determination means for determining whether or not to virtualize the storage medium based on the detection result of the detection means;
virtualization means for generating a virtual storage medium to be accessed instead of the storage medium when the electronic device operates when virtualization is determined;
and writing means for writing at least part of the normal information held by the storage medium during normal operation to the generated virtual storage medium.

According to the present invention, a device can be operated even if an abnormality occurs in a non-rewritable storage medium such as an electronic fuse.

1 is a diagram showing a configuration example of an image forming apparatus as an electronic device; FIG. FIG. 2 is a diagram showing an example of a hardware configuration and a software configuration of a control unit included in the image forming apparatus; 4A and 4B are diagrams for explaining the operation of the image forming apparatus; FIG. FIG. 4 is a diagram for explaining a first method of detecting an abnormality in an electronic fuse as a non-rewritable storage medium; FIG. 4 is a diagram showing an example of information held by electronic fuses and generated virtual electronic fuses; FIG. 5 is a diagram for explaining a second method of detecting an abnormality in an electronic fuse; 4 is a sequence diagram showing the flow of operations when the image forming apparatus is started; FIG.

FIG. 1 is a diagram showing a configuration example of an image forming apparatus as an electronic device. Here, the electronic device is described as an image forming apparatus, but the electronic device is not limited to the image forming apparatus, and may be a smart phone, a tablet terminal, an information processing device such as a PC, an imaging device such as a digital camera, a projector, or the like. projection device, an electronic blackboard, or the like. The image forming apparatus may be a printer, a copier, or the like, but will be described as an MFP (Multi-Function Peripheral) having multiple functions such as a printing function, a copying function, a facsimile function, and a scanning function.

The image forming apparatus includes a scanner 10 , an IPU (image processing unit) 11 , a plotter 12 , a control section 13 and a communication I/F 14 .

The scanner 10 includes a light source and an image pickup device, illuminates a document with light from the light source, receives transmitted or reflected light with the image pickup device, converts the light into an electrical signal, reads the document image, and outputs image data. . The IPU 11 performs image processing such as shading correction for removing density unevenness on the image data output from the scanner 10 . The plotter 12 prints the image data after image processing by the IPU 11 to generate printed matter. The plotter 12 may be an electrophotographic system or an inkjet system.

The control unit 13 controls the entire image forming apparatus, exchanges image data between units such as the scanner 10, the IPU 11, and the plotter 12, connects to the network via the communication I/F 14, communicate.

The hardware configuration and software configuration of the control unit 13 will be described with reference to FIG. The control unit 13 includes a CPU 20, a memory 21, an NVRAM 22, and an electronic fuse 23 as hardware. The CPU 20 executes each software and implements each function.

The software executed by the CPU 20 includes a boot loader 30 as an activation unit for activating the device, a kernel 31 as an execution unit for executing core operations of an OS (Operating System), a detection unit 32 as a module, a judgment It includes a section 33 , a virtualization section 34 and a writing section 35 . The detection unit 32, the determination unit 33, the virtualization unit 34, and the writing unit 35 are executed by the CPU 20 and function as detection means, determination means, virtualization means, and writing means. However, for ease of explanation, it is assumed that each functional unit executes each process. This also applies to the boot loader 30 and kernel 31 .

Memory 21 provides a work area when CPU 20 executes software. The memory 21 also provides a storage area used as a virtual electronic fuse (hereinafter referred to as a virtual electronic fuse) generated by the virtualization unit 34 . The NVRAM 22 is a non-volatile memory and stores data referred to when the detection unit 32 detects an abnormality in the electronic fuse 23 .

The electronic fuse 23 is a non-rewritable storage medium that can hold non-volatile bit information and that once the bit is changed from 0 to 1, it cannot be changed again. Holds device information (function/performance information) related to functions and performance.

The kernel 31 is activated by the boot loader 30 and reads and acquires function/performance information necessary for operating the device from the electronic fuse 23 . The kernel 31 then operates the device using the acquired function/performance information.

The boot loader 30 requests the determination unit 33 to determine whether or not to virtualize the electronic fuse 23 before starting the kernel 31 . When the determination unit 33 determines to virtualize, the boot loader 30 receives the determination result and requests the virtualization unit 34 to virtualize the electronic fuse 23 . After that, the boot loader 30 requests the writing unit 35 to write the restricted function/performance information into the virtual electronic fuse generated by virtualization. The restricted function/performance information is information on the function/performance information when the electronic fuse 23 is normal, that is, the function/performance information when there is no failure or tampering, and is information on the functions and performance required for the minimum operation. . Here, the information written to the virtual electronic fuse is limited function/performance information, but it is also possible to write function/performance information that enables normal operation. The restricted function/performance information can be held by the writing unit 35 .

The determination unit 33 requests the detection unit 32 to detect whether the electronic fuse 23 has an abnormality in order to determine whether or not to virtualize the electronic fuse 23 . Upon receiving the request, the detection unit 32 detects the presence or absence of an abnormality using the information held by the electronic fuse 23 and the data stored in the NVRAM 22 . An abnormality of the electronic fuse 23 is, for example, a failure of the electronic fuse 23, falsification of data written in the electronic fuse 23, or the like.

The detection unit 32 returns the presence/absence of abnormality to the judgment unit 33 as a detection result, and the judgment unit 33 judges whether or not to virtualize the electronic fuse 23 based on the detection result. Specifically, the determining unit 33 determines to virtualize the electronic fuse 23 upon receiving the result that there is an abnormality, and determines not to virtualize the electronic fuse 23 upon receiving the result that there is no abnormality.

The judgment unit 33 returns the judgment result to the boot loader 30 . The virtualization unit 34 receives a virtualization request from the boot loader 30, secures a certain storage area on the memory 21, and virtual electronic fuses 36 that the kernel 31 and the like refer to instead of the electronic fuses 23. , the virtual electronic fuse 36 is generated. The virtualization unit 34 can notify the boot loader 30 of the location of the storage area in which the virtual electronic fuse 36 is generated.

The writing unit 35 receives a write request from the bootloader 30 and writes the restricted function/performance information into the virtual electronic fuse 36 . The writing unit 35 can notify the boot loader 30 that writing has been completed.

The boot loader 30 activates the kernel 31 upon receiving the determination result that the electronic fuse 23 is not virtualized or upon receiving the restricted function/performance information written to the virtual electronic fuse 36 .

The kernel 31 accesses the electronic fuse 23, reads function/performance information from the electronic fuse 23 when the electronic fuse 23 is not virtualized, and operates the device using the read function/performance information. The kernel 31 tries to access the electronic fuse 23, but when the electronic fuse 23 is virtualized, it accesses the virtual electronic fuse 36, reads the restricted function/performance information from the virtual electronic fuse 36, and reads the restricted function/performance information. Use the information to operate the device.

With reference to FIG. 3, a conventional device having an electronic fuse is compared with the present device shown in FIG. 2, and differences therebetween will be described. A device equipped with a conventional electronic fuse reads function/performance information held in an electronic fuse such as a kernel as shown in FIG. and a memory 41 .

The memory 41 is a DRAM in the example shown in FIG. 3, to which the electronic fuse 23, registers of the CPU 20, etc. are mapped. The memory 41 has a virtual address space referenced by the kernel 31 and a physical address space for storing the addresses of the actual electronic fuses 23, registers, etc. Each physical address space has its own physical address area. Each virtual address area within the virtual address space is assigned to an address area. FIG. 3(a) shows mapped electronic fuse 23 region 42, register region 43, and remaining DRAM region 44. FIG.

As a result, the system 40 refers to the virtual address of the electronic fuse 23 when accessing the electronic fuse. By referring to the converted physical address, the electronic fuse 23 is accessed.

Since the electronic fuse 23 holds the function/performance information, the system 40 can access the electronic fuse 23 to read the function/performance information and operate the device.

However, if the electronic fuse 23 fails or is tampered with, the stored information is changed, and the changed information is different from the function and performance information of the device. It will not work properly.

In this regard, in the device shown in FIG. 3B, the electronic fuse 23 is virtualized to generate a virtual electronic fuse 36 on the area 44 of the DRAM. Then, the virtual address area of the electronic fuse 23 referenced by the kernel 31 is assigned to the physical address area of the DRAM that generated the virtual electronic fuse 36 .

As a result, when the system 40 accesses the electronic fuse 23, the virtual address of the electronic fuse 23 is referred to, but is converted to the physical address area of the DRAM by the memory management unit. It will access the virtual electronic fuse 36 above.

Therefore, even if the electronic fuse 23 is damaged or tampered with, the information necessary for operating the device can be read from the virtual electronic fuse 36 and the device can be operated.

The configuration of the image forming apparatus is as described above. A first method for detecting the presence or absence of failure or falsification from the function/performance information held by the electronic fuse 23 will be described with reference to FIG. The first method uses a checksum, which is one of the methods for confirming the reliability of data. Checksum is a method of dividing data into blocks, calculating the sum of each block, comparing the sum with a pre-determined sum, and detecting whether or not there is a failure or tampering based on whether they match.

Specifically, since the electronic fuse 23 holds continuous bit data, it divides the continuous bit data at regular intervals. In the example shown in FIG. 4, bit data "1001001001010110" consisting of 0s and 1s is divided into two data of 8 bits each, "10010010" and "01010110".

Then, find the sum of "10010010" and "01010110". The sum in this case is "11101000". This is stored in NVRAM 22, which is a non-volatile memory, as data (failure/falsification detection data) when the electronic fuse 23 is normal.

Assume that the data held by the electronic fuse 23 is changed to, for example, "1001001000010110" due to a failure or tampering. That is, assume that the 10th bit from the top is changed from 1 to 0. In this case, when divided into two data of 8 bits each, they are "10010010" and "00010110", and the sum is "10101000". Comparing this sum "10101000" with the sum "11101000" stored in the NVRAM 22 reveals that the values are different, and it can be detected that the value of the electronic fuse 23 has changed.

Thus, in the first method, the value stored in the NVRAM 22 is compared with the value stored in the NVRAM 22, and if they match, it is detected that there is no failure or tampering with the electronic fuse 23, and if they do not match, it means that there is a failure or tampering. can be detected. Note that the first method cannot distinguish between failure and tampering.

Incidentally, the storage of values in the NVRAM 22 can be carried out during the device manufacturing process. In the manufacturing process, the function/performance information of the device is written into the electronic fuse 23, and the checksum value is stored in the NVRAM 22 after confirming that the writing has been performed normally.

Here, FIG. 5 shows an example of information held by the electronic fuse 23 and information held by the virtual electronic fuse 36 . The electronic fuse 23 holds performance information such as DRAM operating frequency and CPU operating frequency, and function information such as scanner function, facsimile function, and network function. The electronic fuse 23 also holds mode information, and the normal mode is a mode in which all of the scanner function, facsimile function, and network function can be used.

If the electronic fuse 23 fails or is tampered with, it will suffice if the minimum operation is possible. Information is stored. In the example shown in FIG. 5, the functions that require connection with the outside are the facsimile function and the network function, and the virtual electronic fuse 36 has "none" for these functions. A mode in which some of the functions are restricted in this way is a restricted mode.

Here, as the minimum function/performance information, an example of eliminating functions that require connection with the outside is given, but the information is not limited to this. Therefore, only the print function or the like may be used as the minimum function for the image forming apparatus to operate.

Next, with reference to FIG. 6, a second method for detecting the presence or absence of failure or tampering from the function/performance information held by the electronic fuse 23 will be described. A second method is to use a hash function to calculate a value representing data, compare it with a pre-calculated value, and detect whether there is a failure or falsification based on whether they match. A hash function is a function that returns a fixed value for an input. In the second method, a hash function is applied to data to obtain a hash value representing the data.

The input is data represented by a plurality of bits of the electronic fuse 23, and the calculated hash value is compared with the pre-calculated hash value as failure/falsification detection data stored in the NVRAM 22, Whether or not there is a match is used to detect whether there is a failure or tampering. The input data is individual data such as the CPU operating frequency, not the data including everything from the CPU operating frequency to the mode, etc., as in the first method.

Assume that the CPU operating frequency is expressed by 2 bits, with "01" being 400 MHz, "10" being 800 MHz, and "11" being 1200 MHz. In the second method, the input data is "10", a hash function is applied to "10" to obtain a hash value "1d39", and this is stored in NVRAM22.

After that, it is assumed that the CPU operating frequency is changed to "11" of 1200MHz by falsification so as to improve the performance. Since the tampered data is "11", the hash value obtained by applying the hash function to "11" is "3f52". Since this value is different from the hash value stored in the NVRAM 22, it can be detected that the hash values do not match and that there is a failure or falsification.

Also, if the calculated hash value is "3f52", it will return "3f52", which is a fixed value for the input of "11" for the CPU operating frequency, so it will be judged as tampering and a value other than "3f52" will be returned. , it can be determined as a failure. Therefore, in the second method, it is also possible to distinguish between failure and tampering. In addition, since a hash value is obtained for each data such as the DRAM operating frequency as well as the CPU operating frequency and compared with the data in the NVRAM 22, it is possible to detect failures and tampering.

It should be noted that, like the CPU operating frequency and the presence/absence of functions described above, if the value is such that the performance of the device is improved or the function restriction is lifted, it can be determined as malicious tampering.

Further, failure and tampering are discriminated as described above, and in case of failure, only a part of the failed electronic fuse 23 is virtualized, and the virtual electronic fuse 36 generated by virtualization corresponds to the failed part. By storing the information of the normal state, it is possible to ensure the security of using the electronic fuse 23 as much as possible, and to perform the same operation as before the failure. Further, in the case of falsification, it is possible to deal with malicious falsification by storing normal information with limited functions in the generated virtual electronic fuse 36 .

These methods are only examples, and any known method can be used as long as the information held by the electronic fuse 23 can be used to detect failure or tampering with the electronic fuse 23. is.

With the above-described method, the presence or absence of failure or tampering with the electronic fuse 23 is detected when the device is started up. By storing the same information as the normal information or information with limited functions etc. in the virtual electronic fuse 36 generated by virtualization, and referring to the information held by the virtual electronic fuse 36, the device can be operated. It can work normally.

The flow of operations when the image forming apparatus is started will be described with reference to FIG. When the power button of the image forming apparatus is pressed to start the apparatus, the boot loader 30 is started. The activated boot loader 30 requests the determination unit 33 to determine whether virtualization of the electronic fuse 23 is necessary (S1 in FIG. 7).

The determination unit 33 requests the detection unit 32 to detect failure/falsification of the electronic fuse 23 in order to determine whether virtualization is necessary (S2 in FIG. 7). The detection unit 32 requests the NVRAM 22 to acquire failure/tampering detection data (S3 in FIG. 7), and requests the electronic fuse 23 to acquire information held by the electronic fuse 23 (S4 in FIG. 7). ).

The detection unit 32 uses the acquired failure/falsification detection data, the information held by the electronic fuse 23, and the above-described first or second method to confirm whether the information held by the electronic fuse 23 has been rewritten. , failure or tampering is detected (S5 in FIG. 7). Then, the detection unit 32 returns the detection result to the determination unit 33 (S6 in FIG. 7).

The determination unit 33 determines whether or not to virtualize the electronic fuse 23 based on the detection result received from the detection unit 32 . The determination unit 33 determines to perform virtualization when the detection result indicates that there is a failure or tampering, and determines not to perform virtualization when the result indicates that there is no failure or tampering. Then, the judgment unit 33 returns the judgment result to the boot loader 30 (S7 in FIG. 7).

The boot loader 30 starts the kernel 31 when the judgment result received from the judging unit 33 indicates that virtualization is not to be performed (S8 in FIG. 7). The kernel 31 reads the function/performance information from the electronic fuse 23 (S9 in FIG. 7) and acquires it as the value of the electronic fuse 23 (S10 in FIG. 7). The kernel 31 operates the device based on the obtained values.

On the other hand, if the determination result received from the determination unit 33 indicates virtualization, the boot loader 30 instructs the virtualization unit 34 to execute virtualization (S11 in FIG. 7). The virtualization unit 34 receives the instruction and generates the virtual electronic fuse 36 (S12 in FIG. 7). A virtual electronic fuse 36 is created on the DRAM. The virtualization unit 34 notifies the boot loader 30 that the virtual electronic fuse 36 has been generated and its location.

The boot loader 30 receives the notification that the virtual electronic fuse 36 has been generated, and requests the writing unit 35 to write the restricted function/performance information into the virtual electronic fuse 36 (S13 in FIG. 7). Bootloader 30 advertises the location of virtual electronic fuse 36 upon request. The writing unit 35 receives this request and writes the restricted function/performance information to the virtual electronic fuse 36 (S14 in FIG. 7). The writing unit 35 notifies the boot loader 30 that the writing of the restricted function/performance information to the virtual electronic fuse 36 is completed.

The boot loader 30 activates the kernel 31 upon completion of writing the restricted function/performance information (S15 in FIG. 7). The kernel 31 accesses the electronic fuse 23 by referring to the virtual address of the electronic fuse 23 . At this time, since the virtual address of the electronic fuse 23 is assigned to the physical address of the DRAM where the virtual electronic fuse 36 exists, the virtual electronic fuse 36 is accessed and the restricted function/performance information is read (FIG. 7). S16). The kernel 31 acquires the restricted function/performance information as a virtualized value by this reading (S17 in FIG. 7). The kernel 31 operates the device based on the obtained values.

As described above, even if the electronic fuse 23 fails or is tampered with, the electronic fuse 23 is virtualized, the minimum information necessary for the operation of the device is written in the virtual electronic fuse 36, and the virtual electronic fuse 36 holds the information. Since the information is referenced, the device can be operated at a minimum.

The present invention has thus far been described in terms of the above-described embodiments as electronic devices and methods of operation. However, the present invention is not limited to the above-described embodiments, and can be modified within the scope of those skilled in the art, such as other embodiments, additions, changes, deletions, etc. . Moreover, as long as the functions and effects of the present invention are exhibited in any aspect, they are included in the scope of the present invention.

10... Scanner 11... IPU
12... Plotter 13... Control unit 14... Communication I/F
20 CPU
21 memory 22 NVRAM
23... Electronic fuse 30... Boot loader 31... Kernel 32... Detection unit 33... Judgment unit 34... Virtualization unit 35... Writing unit 36... Virtual electronic fuse

Japanese Patent Publication No. 2010-518540

Claims (5)

An electronic device that operates by referring to information held in a non-rewritable storage medium,
detection means for detecting an abnormality of the non-rewritable storage medium using the information held by the non-rewritable storage medium;
determination means for determining whether or not to virtualize the non-rewritable storage medium based on the detection result of the detection means;
virtualization means for generating a virtual storage medium to be accessed instead of the non-rewritable storage medium when the electronic device operates when virtualization is determined;
writing means for writing at least a part of normal-time information held by the non-rewritable storage medium in a normal state to the generated virtual storage medium ;
storage means for storing detection information for detecting an abnormality in the non-rewritable storage medium;
including
the abnormality is a failure of the non-rewritable storage medium or falsification of information held by the storage medium;
The detection means converts the information into a value corresponding to the information, compares the value with the value of the detection information stored in the storage means, and detects that there is an abnormality in the non-rewritable storage medium when they do not match. and, depending on whether the converted value is a predetermined value, it is determined whether it is a failure or tampering . The detection means is capable of detecting whether or not there is an abnormality in a part of the non-rewritable storage medium using part of the information,
2. The method according to claim 1 , wherein, when said determining means determines to virtualize a part of said non-rewritable storage medium , said writing means writes a part of said normal time information corresponding to said virtual storage medium. Electronic device as described. 3. The virtualization means allocates a virtual address area allocated to a physical address area of the storage medium to access the non - rewritable storage medium to a physical address area of the virtual storage medium. The electronic device described in . The electronic device is an image forming apparatus that operates using at least part of the information held by the non-rewritable storage medium or the normal information held by the virtual storage medium to form an image. The electronic device according to any one of claims 1-3 . A method of operating an electronic device that operates by referring to information held in a non-rewritable storage medium, wherein the electronic device stores detection information for detecting an abnormality in the non-rewritable storage medium. including
detecting an abnormality in the non-rewritable storage medium using the information held by the non-rewritable storage medium;
determining whether or not to virtualize the non-rewritable storage medium based on the detection result;
if virtualization is determined, generating a virtual storage medium to be accessed instead of the non-rewritable storage medium when the electronic device operates;
and writing at least part of normal time information held by said non-rewritable storage medium in normal time to said generated virtual storage medium ;
the abnormality is a failure of the non-rewritable storage medium or falsification of information held by the storage medium;
In the detecting step, the information is converted into a value corresponding to the information, compared with the value of the information for detection stored in the storage means, and if they do not match, it is determined that there is an abnormality in the non-rewritable storage medium. A method of operation for determining failure or tampering according to whether the detected and converted value is a predetermined value .

Images