Information processing apparatus, software update method, and image processing apparatus

BACKGROUND OF THE INVENTION

1. Field of the Invention

0001The present invention relates to an information processing apparatus, a software update method, and an image processing apparatus, and more specifically to an information processing apparatus or an image processing apparatus having a primary module and a backup module, and a software update method of the information processing apparatus or the image processing apparatus.

2. Description of the Related Art

0002As security becomes increasingly critical, information processing apparatuses such as personal computers and image processing apparatuses such as Multi Function Peripherals (MFP) capable of encrypting information stored in the apparatuses to avoid wiretapping have become available lately. For example, Patent Document 1 describes a PC adopting the specifications of Trusted Computing Platform Alliance (TCPA) in which information is encrypted using a Trusted Platform Module (TPM). The TPM is realized in a chip directly mounted on, for example, a motherboard.

0003On the other hand, to respond to a failure, for example, a duplexing system has been employed in information processing apparatuses such as personal computers and image processing apparatuses such as MFPs. Furthermore, to respond to a bug, a security hole, addition or modification of functions, the programs have also been updated in information processing apparatuses such as personal computers and image processing apparatuses such as MFPs (see, for example, Patent Document 2).

0004Herein, a conventional method of encrypting and decrypting information using the TPM, and a program update (hereinafter referred to as "ROM update") are briefly described. <figref idref="f0001">FIG. 1</figref> shows an exemplary configuration of a conventional information processing apparatus. The information processing apparatus includes a CPU 1, a BIOS ROM 2, a disk 3, a non-volatile (NV) RAM 4, and a main memory 5 as the hardware configuration. The CPU 1, the BIOS ROM 2, the disk 3, the NVRAM 4, and the main memory 5 are connected to each other via a bus 6.

0005The BIOS ROM 2 stores a Basic Input/Output System (BIOS) 10 module. The disk 3 stores a loader 11, a kernel 12, and a root file system (Rootfs) 13 modules. The NVRAM 4 stores plain text data 14 that users use.

0006The root file system 13 manages a boot program 21, a ROM update flag control program 22, a blob decryption section 23, and an application 24 that are stored in the disk 3. It should be noted that each of the BIOS 10, the loader 11, the kernel 12, the root file system 13 modules and the like is loaded into the main memory 5 to be executed. In the following, the BIOS 10, the loader 11, the kernel 12, the root file system 13 modules and the like are described as processing subjects.

0007A boot sequence of the information processing apparatus in <figref idref="f0001">FIG. 1</figref> is described with reference to <figref idref="f0002">FIG. 2. FIG. 2</figref> is a sequence diagram showing the processes of the information processing apparatus being booted. In step S1, the BIOS 10 loads and boots the loader 11. In steps S3 through S5, the loader 11 loads and boots the kernel 12 and the root file system 13.

0008In step S6, the kernel 12 boots the boot program 21 in the root file system 13. In step S7, the boot program 21 boots the application 24 in the root file system 13. In step S8, the application 24 is now capable of writing data into the NVRAM 4 and reading, for example, plain data 14 in the NVRAM 4.

0009Next, a mechanism of the TPM is briefly described. In the following, an example where the loader 11 boots the kernel 12 is described.

0010<figref idref="f0003">FIG. 3</figref> is a diagram schematically showing a process of storing a hash value into the TPM 7. In step S11, the loader 11 loads the kernel 12 from the disk 3 into the main memory 5. In step S12, the TPM 7 stores, for example, a hash value into a Platform Configuration Register (PCR), the hash value being calculated based on a method of generating a fixed-length pseudo random number from an original document. In <figref idref="f0003">FIG. 3</figref>, a hash value "0x3a" is stored in a "PCR3". In step S13, the loader 11 boots the kernel 12.

0011In this manner, when the TPM 7 boots, for example, the BIOS 10, the loader 11, the kernel 12 and the root file system 13 modules, the TPM 7 stores hash values calculated from the modules in the PCRs.

0012<figref idref="f0004">FIG. 4</figref> is a drawing schematically showing a decrypting process of the information using the TPM 7. In the TPM 7, four hash values calculated from the corresponding modules are stored in "PCR1" through "PCR4". When the information is decrypted using the TPM 7, a Blob A 41 and a Blob B 42 each including at least one of the "PCR1" through "PCR4" data are used.

0013In the Blob A 41, a value "0x3a" is stored in the "PCR3". In the Blob B 42, values "0xe9"', "0x12", "0x3b", and "0x06" are stored in the "PCR1" through the "PCR4", respectively. In the TPM7, values "0xe9", "0x12", "0x3a", and "0x06" are stored in its "PCR1" through the "PCR4", respectively.

0014In case of Blob A 41, the same hash value is in the "PCR3" of the Blob A 41 and the "PCR3" of the TPM 7. Therefore, the TPM 7 permits taking the information from the Blob A 41. In case of Blob B 42, a hash value in the "PCR3" of the Blob A 41 is different from that in the "PCR3" of the TPM 7. Therefore, the TPM 7 does not permit taking the information from the Blob A 41. It should be noted that when "no setting" may be stored in, for example, the "PCR1", the "PCR2", and the "PCR4" in the Blob A 41, the TPM 7 does not use the register to determine whether to permit taking the information.

0015<figref idref="f0005">FIG. 5</figref> shows an exemplary configuration of an information processing apparatus having the TPM. The information processing apparatus in <figref idref="f0005">FIG. 5</figref> includes the CPU 1, the BIOS ROM 2, the disk 3, the NVRAM 4, the main memory 5, the TPM 7, and a Hard Disk Drive (HDD) 8 as the hardware configuration. The CPU 1, the BIOS ROM 2, the disk 3, the NVRAM 4, the main memory 5, the TPM 7, and a Hard Disk Drive (HDD) 8 are connected to each other via a bus 6.

0016The configuration of the information processing apparatus in <figref idref="f0005">FIG. 5</figref> is different from that in <figref idref="f0001">FIG. 1</figref> in that the information processing apparatus in <figref idref="f0005">FIG. 5</figref> further includes the TPM 7 and the HDD 8. Furthermore, the disk 3 stores a Blob 43 in addition to the configuration in <figref idref="f0001">FIG. 1</figref>. The Blob 43 includes an encrypted encryption key 51 for the NVRAM 4. The Blob 43 stores hash values each calculated from the BIOS 10, the loader 11, the kernel 12, and the root file system 13 in the "PCR1" through "PCR4", respectively.

0017The NVRAM 4 stores encrypted data 15 in addition to the plain text data 14. The HDD 8 stores encrypted data 16. The same reference numerals are used in the figure to describe those components that are identical to the components of <figref idref="f0001">FIG .1</figref> without repeated description. The description of the Blob having an encrypted encryption key of the HDD 8 is also omitted.

0018A boot sequence of the information processing apparatus in <figref idref="f0005">FIG. 5</figref> is described with reference to <figref idref="f0006">FIG. 6. FIG. 6</figref> is a sequence diagram showing exemplary processes of the information processing apparatus being booted. In step S21, the BIOS 10 loads the loader 11. In step S22, a hash value of the loader 11 is stored in a PCR of the TPM 7. In step S23, the BIOS 10 boots the loader 11.

0019In step S24, the loader 11 loads the kernel 12. In step S25, a hash value of the kernel 12 is stored in a PCR of the TPM 7. In step S26, the loader 11 loads the root file system 13. In step 27, a hash value of the root file system is stored in a PCR of the TPM 7.

0020In step S28, the loader 11 boots the kernel 12 and the root file system 13. In step S29, the kernel 12 boots the boot program 21 in the root file system 13. In steps 30 and 31, the boot program 21 boots the blob decryption section 23 and the application 24 in the root file system 13.

0021In step S32, the blob decryption section 23 acquires the encryption key 51 for the NVRAM 4 from inside the Blob 43. In step S33 by using the encryption key, the application is now capable of writing encrypted data into the NVRAM 4 and reading encrypted data 14 stored in the NVRAM 4.

0022Patent Document 1: Japanese Patent Application Publication No. <patcit id="pcit0001" dnum="JP2004282391A"><text>2004-282391</text></patcit>

0023Patent Document 2: Japanese Patent Application Publication No. <patcit id="pcit0002" dnum="JP2005196745A"><text>2005-196745</text></patcit>

0024However, in an information processing apparatus having a configuration as shown in <figref idref="f0005">FIG. 5</figref>, the following problem may occur during the ROM update. <figref idref="f0007">FIG. 7</figref> is a drawing schematically illustrating a problem having occurred during the ROM update. In an information processing apparatus having a configuration as shown in <figref idref="f0005">FIG. 5</figref>, when the BIOS 10 stored in the BIOS ROM 2 is replaced by a new BIOS 10a, the Blob 43 corresponding to the BIOS 10 is required to be updated to a Blob A 43a that corresponds to the BIOS 10a.

0025Unfortunately, in a conventional information processing apparatus, when an update process from the Blob A 43 to the Blob A 43a is interrupted due to some reason, the hash value stored in the "PCR1" of the TPM 7 may become different from the hash value stored in the "PCR1" of the Blob A 43a. A problem arises that when the hash value stored in the "PCR1" of the TPM 7 becomes different from the hash value stored in the "PCR1" of the Blob A 43a, in that the encryption key 51 for the NVRAM 4 cannot be taken from the Blob 43a, resulting in that the encrypted data stored in the NVRAM 4 cannot be decrypted.

0026This problem illustrated in <figref idref="f0007">FIG. 7</figref> can be solved when an information processing system has a configuration as shown in <figref idref="f0008">FIG. 8</figref>. The information processing apparatus in <figref idref="f0008">FIG. 8</figref> includes a primary system 81 and a backup system 82, constituting a duplex system. The primary system 81 includes the BIOS 10, the loader 11, the kernel 12, and the root file system 13. The backup system 82 includes the BIOS 10b, a loader 11b, a kernel 12b, and a root file system 13b.

0027It should be noted that the BIOS 10, the loader 11, the kernel 12, and the root file system 13 are included in primary modules, and the BIOS 10b, the loader 11b, the kernel 12b, and the root file system 13b are included in backup modules.

0028Typically, an information processing apparatus is booted sequentially in an order of the BIOS 10, the loader 11, the kernel 12, and the root file system 13. Hereinafter, a procedure of booting like this is referred to as a "boot path". In the example of <figref idref="f0008">FIG. 8</figref>, due to an error having occurred in the loader 11, the booth path becomes: BIOS 10 → loader 11b → kernel 12 → root file system 13.

0029That is, in an information processing apparatus having the backup system 82, when a module of the primary system has a problem, the same kind of module in the backup system 82 can usually be booted. A booth path can be changed by, for example, a ROM update flag control program.

0030Because of this structure, there is a problem that the same number of Blobs which is equal to the number of booth paths defined by the combination of the modules in the primary system 81 and the modules in the backup system 82 are required to be provide. <figref idref="f0009">FIG. 9</figref> is a drawing schematically illustrating a problem that may occur when information is encrypted and decrypted using the TPM in an information processing apparatus having a backup system.

0031Further, there is another problem in an information processing apparatus having a configuration as shown in <figref idref="f0009">FIG. 9</figref> that when the BIOS 10 stored in the BIOS ROM 2 is updated to the BIOS 10a, all of the plural Blobs corresponding to the BIOS 10 are required to be updated so as to correspond to the BIOS 10a. <figref idref="f0010">FIG. 10</figref> is a drawing schematically illustrating a problem occurring while information is encrypted and decrypted using the TPM, where the ROM update is executed in an information processing apparatus having a backup system.

0032As described, when a conventional system is arranged to employ a duplex system having both a primary system and a backup system, have a ROM update capability, and improve the security by adding both an encryption and a decryption capability of information by using the TPM 7, it takes a lot of effort to manage the Blobs 73.

SUMMARY OF THE INVENTION

0033The present invention is made in light of the problems and may provide an information processing apparatus, a method of software update, and an image processing apparatus capable of encrypting and decrypting information using values uniquely calculated from a booted primary module and a booted backup module with much easiness.

0034To solve the problems, according to a first aspect of the present invention, there is provided an information processing apparatus including one or more kinds of primary modules necessary to boot the apparatus and one or more kinds of backup modules to be used when the primary modules fail, so that the information processing apparatus is booted in a manner that when any kind of the primary modules fails, the same kind of backup module is used. The information processing apparatus includes a value storage unit storing values uniquely calculated from the one or more kinds of the primary modules or the backup modules used when the apparatus is booted, an encryption information storage unit storing information unique to the each kind of the primary or the backup modules, the information being encrypted based on a value calculated from the each kind of the primary modules or the backup modules, an information decryption unit decrypting the information unique to the each kind of the primary modules or the backup modules using the values in the value storage unit, the information being stored in the encryption information storage unit, and an encryption information update unit, when any of the primary modules or the backup modules is updated, encrypting the information unique to the each kind of the primary modules or the backup modules based on a value calculated from the each kind of the primary modules or the backup modules after the update, the information being stored in the encryption information storage unit.

0035Further, to solve the problems, according to a second aspect of the present invention, there is provided an image processing apparatus including one or more kinds of primary modules necessary to boot the apparatus, one or more kinds of backup modules to be used when the primary modules fail, a plotter section and scanner section so that the plotter and the scanner sections are booted in a manner that when any kind of the primary modules fails, the same kind of backup module is used. The image processing apparatus includes a value storage unit storing values uniquely calculated from the one or more kinds of the primary modules or the backup modules used when the apparatus is booted, an encryption information storage unit storing information unique to the each kind of the primary or the backup modules, the information being encrypted based on a value calculated from the each kind of the primary modules or the backup modules, an information decryption unit decrypting the information unique to the each kind of the primary modules or the backup modules using the values in the value storage unit, the information being stored in the encryption information storage unit, and an encryption information update unit, when any of the primary modules or the backup modules is updated, encrypting the information unique to the each kind of the primary modules or the backup modules based on a value calculated from the each kind of the primary modules or the backup modules after the update, the information being stored in the encryption information storage unit.

0036It should be noted that any method, apparatus, system, computer program, recording medium, data structure including a constitutional element, an expression, or any combination of the present invention may be included in embodiments of the present invention.

0037According to an embodiment of the present invention, there is provided an information processing apparatus, a method of software update, and an image processing apparatus capable of encrypting and decrypting information using values uniquely calculated from a booted primary module and a booted backup module with less efforts.

BRIEF DESCRIPTION OF THE DRAWINGS

0038Other objects, features, and advantages of the present invention will be apparent from the following detailed description when read in conjunction with the accompanying drawings, in which: <ul id="ul0001" list-style="none" compact="compact"><li><figref idref="f0001">FIG. 1</figref> is a drawing showing an exemplary configuration of a conventional information processing apparatus;</li><li><figref idref="f0002">FIG. 2</figref> is a sequence diagram showing an exemplary process of the information processing apparatus when the information processing apparatus is booted;</li><li><figref idref="f0003">FIG. 3</figref> is a drawing showing a process of storing a hash value in the TPM;</li><li><figref idref="f0004">FIG. 4</figref> is a drawing schematically showing a process of decrypting information using the TPM;</li><li><figref idref="f0005">FIG. 5</figref> is a drawing showing an exemplary configuration of a conventional information processing apparatus including the TPM;</li><li><figref idref="f0006">FIG. 6</figref> is a sequence diagram showing an exemplary process of the information processing apparatus when the information processing apparatus is booted;</li><li><figref idref="f0007">FIG. 7</figref> is a drawing schematically showing a problem having occurred during a ROM update process;</li><li><figref idref="f0008">FIG. 8</figref> is a drawing schematically showing a duplex system including a primary system and a backup system;</li><li><figref idref="f0009">FIG. 9</figref> is a drawing schematically showing a problem occurring when information is encrypted and decrypted using the TPM in a conventional information processing apparatus including the TPM;</li><li><figref idref="f0010">FIG. 10</figref> is a drawing schematically showing a problem occurring when ROM is updated while information is encrypted and decrypted using the TPM in a conventional information processing apparatus including the TPM;</li><li><figref idref="f0011">FIG. 11</figref> is a drawing showing an exemplary configuration of an information processing apparatus according to an embodiment of the present invention;</li><li><figref idref="f0012">FIG. 12</figref> is a drawing showing an exemplary module configuration of the disk of the information processing apparatus;</li><li><figref idref="f0013">FIG. 13</figref> is a drawing showing an exemplary module configuration in a root file system in the disk;</li><li><figref idref="f0014">FIG. 14</figref> is a sequence diagram showing a process of the information processing apparatus when the information processing apparatus is booted;</li><li><figref idref="f0015">FIG. 15</figref> is a diagram schematically showing a process of a ROM update;</li><li><figref idref="f0016">FIG. 16</figref> is a drawing schematically showing a process of an encryption key update;</li><li><figref idref="f0017">FIG. 17</figref> is a drawing showing another module configuration of the disk in the information processing apparatus;</li><li><figref idref="f0018">FIG. 18</figref> is a drawing showing an exemplary module configuration of the disk in the information processing apparatus according to an embodiment of the present invention;</li><li><figref idref="f0019">FIG. 19</figref> is a drawing showing information stored in the NVRAM of the information processing apparatus;</li><li><figref idref="f0019">FIG. 20</figref> is a drawing showing information stored in the HDD of the information processing apparatus; and</li><li><figref idref="f0020">FIGS. 21</figref> and <figref idref="f0021">22</figref> are drawings schematically showing a process of decrypting encrypted information in the NVRAM when the disk has crashed.</li></ul>

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

0039Next, best modes for carrying out the invention are described with reference to exemplary embodiments of the present invention and accompanying drawings. In the embodiments, an information processing apparatus such as a personal computer is described. However, the embodiment is not limited to such an information processing apparatus, and may be carried out in, for example, an image processing apparatus such as a Multi Function Peripheral (MFP).

[Embodiment 1]

0040<figref idref="f0011">FIG. 11</figref> shows an exemplary configuration of an information processing apparatus according to an embodiment of the present invention. The information processing apparatus in <figref idref="f0011">FIG. 11</figref> includes a CPU 1, a BIOS ROM 2, a disk 3, an NVRAM 4, a main memory 5, a TPM 7, and a HDD 8 as a hardware configuration. The CPU 1, the BIOS ROM 2, the disk 3, the NVRAM 4, the main memory 5, the TPM 7, and the HDD 8 are connected to each other via the bus 6.

0041The BIOS ROM 2 includes a BIOS 10 as a primary module and a BIOS 10b as a backup module. The NVRAM 4 stores plain text data 14 and encrypted data 15 that a user uses. The HDD 8 stores encrypted data 16.

0042<figref idref="f0012">FIG. 12</figref> shows an exemplary configuration of modules stored in the disk 3. In <figref idref="f0012">FIG. 12</figref>, the disk 3 includes a loader 11, a kernel 12, and a root file system 13 as primary modules; a loader 11b, a kernel 12b, and a root file system 13b as backup modules; Blobs 60a through 60h; and an encrypted encryption key 62 for the NVRAM 4.

0043The Blob 60a includes an encrypted key "A". The Blob 60b includes an encrypted key "B". The Blob 60c includes an encrypted key "C". The Blob 60d includes an encrypted key "D". The Blob 60e includes an encrypted key "A". The Blob 60f includes an encrypted key "B". The Blob 60g includes an encrypted key "C". The Blob 60h includes an encrypted key "D".

0044As a result, the Blob 60a and the Blob 60e have the same key "A", the Blob 60b and the Blob 60f have the same key "B", the Blob 60c and the Blob 60g have the same key "C", and the Blob 60d and the Blob 60h have the same key "D".

0045Further, hash values calculated based on a calculation method of generating a fixed-length pseudo random number from the BIOS 10 and 10b are stored into each "PCR1" of the Blobs 60a and 60e, respectively. In the same manner, the hash values calculated from the loader 11 and 11b are stored into each "PCR2" of the Blobs 60b and 60f, respectively. The hash values calculated from the kernel 12 and 12b are stored into each "PCR3" of the Blobs 60c and 60g, respectively. The hash values calculated from the root file system 13 and 13b are stored into each "PCR4" of the Blobs 60d and 60h, respectively.

0046With the configuration where Blobs 60a through 60h are provided as shown in <figref idref="f0012">FIG. 12</figref>, the keys A through D can be obtained when either primary modules or backup modules are booted in the boot path. Further, in the configuration where eight Blobs 60a through 60h are provided as shown in <figref idref="f0012">FIG. 12</figref>, the keys A through D can be obtained in any possible boot. The encryption key 62 for the NVRAM 4 is encrypted using the keys "A" through "D".

0047<figref idref="f0013">FIG. 13</figref> shows an exemplary module configuration of the root files systems 13 and 13b in <figref idref="f0012">FIG. 12</figref>. The module configuration of the root file systems 13 and the module configuration of the root file systems 13b are identical. An explanation of the root files systems 13 is described below, and an explanation of the root files systems 13b is omitted.

0048The root file system 13 manages a boot program 21, a ROM update flag control program 22, a blob decryption section 23, an application 24, a blob update program 25, and an encryption key update program 26 that are stored in the disk 3.

0049The boot program 21 boots the application 24 in the root file system 13. The ROM update flag control program 22 controls the boot path defining a boot flow. The blob decryption section 23 acquires the keys "A" through "D" from the Blobs 60a through 60h using the TPM 7. The blob update program 25 controls the update of the Blobs 60a through 60h. The encryption key update program 26 controls the update of the encryption key 62 for the NVRAM 4.

0050Referring back to <figref idref="f0011">FIG. 11</figref>, when each kind of the primary or backup modules of the BIOS 10 or the BIOS 10b, the loader 11 or the loader 11b, the kernel 12 or the kernel 12b, and the root file system 13 or the root file system 13b is booted, the hash values of the modules used for the boot are accordingly stored in the "PCR1" through "PCR4", respectively, of the TPM 7.

0051That is, the hash value calculated from the BIOS 10 or 10b is stored in the "PCR1" of the TPM 7; the hash value calculated from the loader 11 or 11b is stored in the "PCR2" of the TPM 7; the hash value calculated from the kernel 12 or 12b is stored in the "PCR3" of the TPM 7; and the hash value calculated from the root file system 13 or 13b is stored in the "PCR4" of the TPM 7.

0052The modules including the BIOS 10 and 10b, the loader 11 and 11b, the kernel 12 and 12b, and the root file system 13 and 13b are loaded into the main memory by the CPU 1 and executed. In the following descriptions, the modules including the BIOS 10 and 10b, the loader 11 and 11b, the kernel 12 and 12b, and the root file system 13 and 13b are described as processing subjects, for explanation purposes.

0053Next, a boot sequence of the information processing apparatus in <figref idref="f0011">FIG. 11</figref> is described with reference to <figref idref="f0014">FIG. 14. FIG. 14</figref> is a sequence diagram showing an exemplary booting process of the information processing apparatus according to an embodiment of the present invention. It is assumed that the hash value of the BIOS 10 is already stored in the "PCR1" of the TPM7 before step S41 in <figref idref="f0014">FIG. 14</figref>.

0054In step S41, BIOS loads the loader 11. In step S42, the hash value of the loader 11 is stored in the "PCR2" of the TPM 7. In step S43, the BIOS boots the loader 11.

0055In step S44, the loader 11 loads the kernel 12. In step S45, the hash value of the kernel 12 is stored in the "PCR3" of the TPM 7. In step S46, the loader loads the root file system 13. In step S47, the hash value of the root file system 13 is stored in the "PCR4" of the TPM 7.

0056In step S48, the loader 11 boots the kernel 12 and the root file system 13. In step S49, the kernel 12 boots the boot program 21 in the root file system 13. In steps S50 and S51, the boot program 21 boots the blob decryption section 23 and the application 24, respectively, in the root file system 13.

0057In step S52, the blob decryption section 23 acquires the keys "A" through "D" from the blobs 60a through 60d, respectively, using the TPM 7. In step S53, the blob decryption section 23 decrypts the encrypted encryption key 62 for the NVRAM 4 using the acquired keys "A" through "D". In step S54, the application is now capable of writing encrypted data 15 into the NVRAM 4 and reading encrypted data in the NVRAM 4 using the decrypted encryption key 62.

0058In the following, a specific process of ROM update and encryption key update in the information processing apparatus in <figref idref="f0011">FIG. 11</figref> is described.

(ROM UPDATE)

0059<figref idref="f0015">FIG. 15</figref> is a diagram schematically showing a process of the ROM update. <figref idref="f0015">FIG. 15</figref> shows an example where the kernel 12 is updated to a new kernel 12a. First, the ROM update flag control program 22 changes the boot path indicating the procedure of the boot from BIOS 10 → loader 11 → kernel 12 → root file system 13 to BIOS 10 → loader 11 → kernel 12b → root file system 13. Then by rebooting the information processing apparatus, the BIOS 10, the loader 11, the kernel 12b, and the root file system 13 are booted accordingly.

0060In step S61, the kernel 12 is replaced by the new kernel 12b. In step S62, the blob decryption section 23 acquires the key "C" from the Blob 60c using the TPM 7 in the same manner as described above.

0061In step S63, the blob update program 25 generates a hash value calculated from the new kernel 12a. In step S64, the blob update program 25 generates a new Blob 60i including the generated hash value. In step S65, the blob update program 25 replaces the Blob 60c by the generated Blob 60i. Then, the ROM update flag control program 22 restores the boot path to BIOS 10 → loader 11 → kernel 12 → root file system 13.

0062During the process of the ROM update shown in <figref idref="f0015">FIG. 15</figref>, even when the update process from the Blob 60c to the Blob 60i is interrupted for some reason, since the same key "C" is stored in the Blob 60g, the key "C" can be acquired from the Blob 60g. As a result, the encrypted encryption key 62 for the NVRAM 4 can be decrypted by using the acquired keys "A" through "D", and accordingly, the encrypted data in the NVRAM 4 can be decrypted.

(Encryption key update)

0063<figref idref="f0016">FIG. 16</figref> is a diagram schematically showing a process of the encryption key update. In step S71, the encryption key update program 26 creates a backup copy of the encrypted data 15 in the NVRAM 4 and stores the created backup copy in the disk 3. In step S72, the blob decryption section 23 acquires the keys "A" through "D" from the Blobs 60a through 60d, respectively, corresponding to the boot path. In step S73, the encryption key update program 26 encrypts an encryption key 62a for the NVRAM 4 using the acquired keys "A" through "D", and stores the encrypted encryption key 62a in the disk 3.

0064In step S74, the blob decryption section 23 decrypts the encrypted encryption key 62 using the keys "A" through "D", and acquires the decrypted encryption key 62. In step S75, the encryption key update program 26 decrypts the encrypted data 15 stored in the NVRAM 4 using the decrypted encryption key 62. In step S76, the encryption key update program 26 encrypts the decrypted encrypted data 15 again using the new encryption key 62a for the NVRAM 4.

0065In step S77, the encryption key update program 26 deletes the encrypted data 15 stored in the disk 3 as a backup copy in step S71. In step S78, the encryption key update program 26 further deletes the encrypted encryption key 62 for the NVRAM 4 stored in the disk 3.

0066During the above process of the encryption key update shown in <figref idref="f0016">FIG. 16</figref>, even when the update from the encryption key 62 to the new encryption key 62a is interrupted, since the copy of the encrypted data 15 is stored in the disk 3 as a backup, it is possible to perform the process of the encryption key update again.

(Another configuration of the disk 3)

0067<figref idref="f0017">FIG. 17</figref> shows another exemplary module configuration in the disk 3. The disk 3 in <figref idref="f0017">FIG. 17</figref> includes primary modules of the loader 11, the kernel 12, and the root file system 13; backup modules of the loader 11b, the kernel 12b, the root file system 13b; and Blobs 60a through 60c, 60e through 60g, 60j, and 60k.

0068The Blob 60a includes the encrypted key "A". The Blob 60b includes the encrypted key "B". The Blob 60c includes the encrypted key "C". The Blob 60e includes the encrypted key "A". The Blob 60f includes the encrypted key "B". The Blob 60g includes the encrypted key "C". The Blob 60j includes the encrypted encryption key 62 for the NVRAM4, the encryption key 62 being encrypted using the keys "A" through "C". The Blob 60k includes the encrypted encryption key 62 for the NVRAM4, the encryption key 62 being encrypted using the keys "A" through "C".

0069That is, the module configuration in <figref idref="f0017">FIG. 17</figref> is different from that in <figref idref="f0012">FIG. 12</figref> in that, unlike the Blobs 60d and 60h, the Blobs 60j and 60k have the encrypted encryption key 62 for the NVRAM4 encrypted by using the keys "A" through "C". Because of this configuration, for example, the blob decryption section 23 acquires the keys "A" through "C" and the encrypted encryption key 62 for the NVRAM 4 from the Blobs 60a through 60c and 60j, respectively, and decrypts the acquired encrypted encryption key 62 for the NVRAM 4 using the acquired keys "A" through "C". As a result, the encrypted data 15 in the NVRAM 4 can be decrypted.

[Embodiment 2]

0070In the information processing apparatus in above embodiment, should the disk 3 crash, since the encryption key 62 for the NVRAM 4 is to be lost, the encrypted data 15 in the NVRAM 4 can no longer be decrypted. To solve this problem, in an information processing apparatus according to this embodiment 2, a mechanism may be provided that permits decrypting the encrypted data 15 in the NVRAM 4 even when the disk 3 crashes.

0071In the information processing apparatus in this embodiment 2, the module configuration of the disk 3 and the information stored in the NVRAM 4 and the HDD 8 are different from those in embodiment 1. <figref idref="f0018">FIG. 18</figref> shows an exemplary module configuration of the disk 3 in this embodiment. The disk 3 in <figref idref="f0018">FIG. 18</figref> includes the primary modules of the loader 11, the kernel 12, the root file system 13, and the root file system 13; backup modules of the loader 11b, the kernel 12b, the root file system 13b; Blobs 60a through 60d and 601; and the encrypted encryption key 62 for the NVRAM 4. It should be noted that in the information processing apparatus in this embodiment 2, the ROM update for the backup modules of the loader 11b, the kernel 12b, the root file system 13b is not to be performed after the shipment.

0072The Blob 60a includes the encrypted key "A". The Blob 60b includes the encrypted key "B". The Blob 60c includes the encrypted key "C". The Blob 60d includes the encrypted key "D". The Blob 601 includes the encrypted encryption key 62 for the NVRAM 4.

0073In this configuration, the encryption key 62 for the NVRAM 4 can be decrypted and obtained using the keys "A" through "D" from the Blobs 60a through 60d, respectively, and can be obtained from the Blob 601 corresponding to the boot path of BIOS 10b → loader 11b → kernel 12b → root file system 13b.

0074Further, in the information processing apparatus in this embodiment 2, the Blob 601 is stored in the NVRAM 4 and the HDD 8 as shown in <figref idref="f0019">FIGS. 19 and 20</figref> so as to respond to the crash of the disk 3. <figref idref="f0019">FIGS. 19 and 20</figref> show the configuration of the information stored in the NVRAM 4 and the HDD 8, respectively.

0075<figref idref="f0020">FIGS. 21</figref> and <figref idref="f0021">22</figref> are drawings showing a process of decrypting the encrypted data 15 in the NVRAM 4. In step S81, primary modules of the loader 11, the kernel 12, the root file system 13, and the backup modules of the loader 11b, the kernel 12b, the root file system 13b are installed in the disk 3.

0076In step S82, the ROM update flag control program 22 turns ON a backup flag 71 in the encrypted data 15 in the NVRAM 4. In step S83, the information processing apparatus reboots in a backup mode.

0077In step S84, the information processing apparatus boots the loader 11b, the kernel 12b, the root file system 13b (backup mode). In step S85, the blob update program 25 creates a copy of the Blob 601 stored in the NVRAM 4 and stores the created copy in the disk 3. In step S86, the blob update program creates new keys "A" through "D".

0078In step S87, the blob update program 25 creates Blobs 80a through 80d including the keys "A" through "D", respectively. In step S88, the blob update program 25 stores the created blobs 80a through 80d in the disk 3. In step S89, the blob decryption section 23 acquires the encryption key 62 from the Blob 601 stored in the NVRAM 4.

0079In step S90, the encryption key update program 26 encrypts the encryption key 62 using the keys "A" through "D" and stores the encrypted encryption key 62 in the disk 3. In step S91, the ROM update flag control program 22 turns OFF the backup flag 71 in the encrypted data 15 in the NVRAM 4.

0080In the process shown in <figref idref="f0020">FIGS. 21</figref> and <figref idref="f0021">22</figref>, even when the disk 3 crashes, the encryption key 62 can be acquired from the Blob 601 stored in the NVRAM 4, the Blob 601 corresponding to the boot path of BIOS 10b → loader 11b → kernel 12b → root file system 13b. As a result, the encrypted data 15 in the NVRAM 4 can be decrypted.

0081It should be noted that the terms "value storage unit", "encryption information storage units", "information decryption unit", and "encryption information update unit" described in claims herein correspond to the TPM 7, the Blobs 60a through 601, the blob decryption section 23, and the blob update program 25, respectively.