Starts up of modules of a second module group only when modules of a first group have been started up legitimately

An information processing method, comprising:

• storing modules of a first module group and certificates corresponding one-to-one thereto, the first module group corresponding to a first stakeholder, each certificate containing a first comparison value and a first cumulative comparison value, the first comparison value generated from a hash value of the corresponding module of the first module group, and the first cumulative comparison value generated from a cumulative hash value of the modules of the first module group;
• storing modules of a second module group and certificates corresponding one-to-one thereto, the second module group corresponding to a second stakeholder, each certificate containing a second comparison value and a second cumulative comparison value, the second comparison value generated from a hash value of the corresponding module of the second module group, and the second cumulative comparison value generated from a cumulative hash value of the modules of the second module group;
• verifying the legitimacy of each module of the first module group by comparing a hash value of the module with the first comparison value thereof, and starting up each module of the first module group that has been verified;
• and
• verifying, when the legitimacy of each module of the first module group is verified, the legitimacy of each module of the second module group by comparing a hash value of the module with the second comparison value thereof, and starting up the modules of the second module group that have been verified,
• the information processing method further comprising:
• holding a linkage certificate, the linkage certificate containing a third comparison value and a third cumulative comparison value, the third comparison value used for verification of the legitimacy of the head of the modules of the second module group, and the third cumulative comparison value generated from the cumulative hash value of the modules of the first module group, wherein
• when a module of the first module group is updated, a signature on the certificate of the module is verified, and the third cumulative comparison value in the linkage certificate is updated by using the first comparison value in the certificate of the module, and
• after starting up the modules of the first module group, the head of the modules of the second module group is started up only when the modules that have been started up are verified as legitimate by using the third cumulative value contained in the linkage certificate and the head of the modules of the second module group is verified as legitimate by using the third comparison contained in the linkage certificate.

A non-transitory computer readable recording medium having stored thereon a computer program, wherein when executed, the computer program causes a computer to execute a method comprising:

• a first step of storing modules of a first module group and certificates corresponding one-to-one thereto, the first module group corresponding to a first stakeholder, each certificate containing a first comparison value and a first cumulative comparison value, the first comparison value generated from a hash value of the corresponding module of the first module group, and the first cumulative comparison value generated from a cumulative hash value of the modules of the first module group;
• a second step of storing modules of a second module group and certificates corresponding one-to-one thereto, the second module group corresponding to a second stakeholder, each certificate containing a second comparison value and a second cumulative comparison value, the second comparison value generated from a hash value of the corresponding module of the second module group, and the second cumulative comparison value generated from a cumulative hash value of the modules of the second module group;
• a third step of verifying the legitimacy of each module of the first module group by comparing a hash value of the module with the first comparison value thereof, and starting up each module of the first module group that has been verified;
• and
• a fourth step of verifying, when the legitimacy of each module of the first module group is verified, the legitimacy of each module of the second module group by comparing a hash value of the module with the second comparison value thereof, and starting up the modules of the second module group that have been verified,
• the computer program further causing the computer to execute:
• a fifth step of holding a linkage certificate, the linkage certificate containing a third comparison value and a third cumulative comparison value, the third comparison value used for verification of the legitimacy of the head of the modules of the second module group, and the third cumulative comparison value generated from the cumulative hash value of the modules of the first module group, wherein
• in the third step, when a module of the first module group is updated, a signature on the certificate of the module is verified, and the third cumulative comparison value in the linkage certificate is updated by using the first comparison value in the certificate of the module, and
• in the third step, after the modules of the first module group is started up, the head of the modules of the second module group is started up only when the modules that have been started up are verified as legitimate by using the third cumulative value contained in the linkage certificate and the head of the modules of the second module group is verified as legitimate by using the third comparison contained in the linkage certificate.

An integrated circuit, comprising:

• a first storage unit storing modules of a first module group and certificates corresponding one-to-one thereto, the first module group corresponding to a first stakeholder, each certificate containing a first comparison value and a first cumulative comparison value, the first comparison value generated from a hash value of the corresponding module of the first module group, and the first cumulative comparison value generated from a cumulative hash value of the modules of the first module group;
• a second storage unit storing modules of a second module group and certificates corresponding one-to-one thereto, the second module group corresponding to a second stakeholder, each certificate containing a second comparison value and a second cumulative comparison value, the second comparison value generated from a hash value of the corresponding module of the second module group, and the second cumulative comparison value generated from a cumulative hash value of the modules of the second module group;
• a first control unit configured to verify the legitimacy of each module of the first module group by comparing a hash value of the module with the first comparison value thereof, and to start up each module of the first module group that has been verified;
• a second control unit configured to verify, when the first control unit verifies the legitimacy of each module of the first module group, the legitimacy of each module of the second module group by comparing a hash value of the module with the second comparison value thereof, and to start up the modules of the second module group that have been verified;
• and
• a holding unit holding a linkage certificate, the linkage certificate containing a third comparison value and a third cumulative comparison value, the third comparison value used for verification of the legitimacy of the head of the modules of the second module group, and the third cumulative comparison value generated from the cumulative hash value of the modules of the first module group, wherein
• when a module of the first module group is updated, the first control unit verifies a signature on the certificate of the module, and updates the third cumulative comparison value in the linkage certificate by using the first comparison value in the certificate of the module,
• after starting up the modules of the first module group, the first control unit starts up the head of the modules of the second module group only when the first control unit verifies that the modules that have been started up are legitimate by using the third cumulative value contained in the linkage certificate and that the head of the modules of the second module group is legitimate by using the third comparison contained in the linkage certificate, and
• the second control unit verifies the legitimacy of each module of the second module group and starts up the modules of the second module group.