Secure boot terminal, secure boot method, secure boot program, recording medium, and integrated circuit

A secure boot method used in a secure boot terminal for booting a plurality of software modules in a predetermined boot order, the secure boot method comprising:

• storing a digital certificate for each software module of the plurality of software modules, the digital certificate, for each respective software module of the plurality of software modules, including (i) a target digest value calculated as a digest value of the respective software module, and (ii) a target cumulative value of target digest values of other software modules, of the plurality of software modules, booted prior to the respective software module;
• with respect to each respective software module of the plurality of software modules, verifying, for a subsequent software module in the predetermined boot order, a validity of other software modules of the plurality of software modules booted prior to the subsequent software module, the validity of the other software modules booted prior to the subsequent software module being verified by comparing (i) an actual cumulative value obtained by a cumulative calculation of digest values of the other software modules booted prior to the subsequent software module and (ii) the target cumulative value included in a digital certificate corresponding to the subsequent software module;
• updating one software module of the plurality of software modules and the digital certificate corresponding to the one software module;
• storing, for each respective software module of the plurality of software modules, an alternate cumulative value obtained by a cumulative calculation of the target digest values of the other software modules booted prior to the respective software module, the cumulative calculation of the target digest values of the other software modules booted prior to the respective software module being made using, for each of the other software modules booted prior to the respective software module, (i) when the digital certificate of the other software module has been updated, the target digest value included in the digital certificate of the other software module prior to the updating of the digital certificate, and (ii) when the digital certificate of the other software module has not been updated, the target digest value included in the digital certificate of the other software module;
• and
• with respect to each respective software module of the plurality of software modules, (i) when the verification of the validity by said verification is successful, booting the subsequent software module of the plurality of software modules, and (ii) when the verification of the validity by said verification fails, comparing the alternate cumulative value corresponding to the subsequent software module with the target cumulative value included in the digital certificate corresponding to the subsequent software module, and when the compared alternate cumulative and target cumulative values match, booting the subsequent software module.

A non-transitory computer-readable recording medium having a secure boot program recorded thereon, the secure boot program for being used in a secure boot terminal for booting a plurality of software modules in a predetermined boot order, the secure boot program causing a computer to execute a method comprising:

• storing a digital certificate for each software module of the plurality of software modules, the digital certificate, for each respective software module of the plurality of software modules, including (i) a target digest value calculated as a digest value of the respective software module, and (ii) a target cumulative value of target digest values of other software modules, of the plurality of software modules, booted prior to the respective software module;
• with respect to each respective software module of the plurality of software modules, verifying, for a subsequent software module in the predetermined boot order, a validity of other software modules of the plurality of software modules booted prior to the subsequent software module, the validity of the other software modules booted prior to the subsequent software module being verified by comparing (i) an actual cumulative value obtained by a cumulative calculation of digest values of the other software modules booted prior to the subsequent software module, and (ii) the target cumulative value included in a digital certificate corresponding to the subsequent software module;
• updating one software module of the plurality of software modules and the digital certificate corresponding to the one software module;
• storing, for each respective software module of the plurality of software modules, an alternate cumulative value obtained by a cumulative calculation of the target digest values of the other software modules booted prior to the respective software module, the cumulative calculation of the target digest values of the other software modules booted prior to the respective software module being made using, for each of the other software modules booted prior to the respective software module, (i) when the digital certificate of the other software module has been updated, the target digest value included in the digital certificate of the other software module prior to the updating of the digital certificate, and (ii) when the digital certificate of the other software module has not been updated, the target digest value included in the digital certificate of the other software module;
• and
• with respect to each respective software module of the plurality of software modules, (i) when the verification of the validity by said verification is successful, booting the subsequent software module of the plurality of software modules, and (ii) when the verification of the validity by said verification fails, comparing the alternate cumulative value corresponding to the subsequent software module with the target cumulative value included in the digital certificate corresponding to the subsequent software module, and when the compared alternate cumulative and target cumulative values match, booting the subsequent software module.

An integrated circuit for booting a plurality of software modules in a predetermined boot order, the integrated circuit comprising:

• a first storage unit for storing a digital certificate for each software module of the plurality of software modules, the digital certificate, for each respective software module of the plurality of software modules, including (i) a target digest value calculated as a digest value of the respective software module, and (ii) a target cumulative value of target digest values of other software modules, of the plurality of software modules, booted prior to the respective software module;
• a verification unit that, with respect to each respective software module of the plurality of software modules, verifies, for a subsequent software module in the predetermined boot order, a validity of other software modules of the plurality of software modules booted prior to the subsequent software module, the validity of the other software modules booted prior to the subsequent software module being verified by comparing (i) an actual cumulative value obtained by a cumulative calculation of digest values of the other software modules booted prior to the subsequent software module, and (ii) the target cumulative value included in the digital certificate corresponding to the subsequent software module;
• an update unit that updates one software module of the plurality of software modules and the digital certificate corresponding to the one software module;
• a second storage unit for storing, for each respective software module of the plurality of software modules, an alternate cumulative value obtained by a cumulative calculation of the target digest values of the other software modules booted prior to the respective software module, the cumulative calculation of the target digest values of the other software modules booted prior to the respective software module being made using, for each of the other software modules booted prior to the respective software module, (i) when the digital certificate of the other software module has been updated, the target digest value included in the digital certificate of the other software module prior to the updating of the digital certificate, and (ii) when the digital certificate of the other software module has not been updated, the target digest value included in the digital certificate of the other software module;
• and
• a boot control unit that, with respect to each respective software module of the plurality of software modules, (i) when the verification of the validity performed by the verification unit is successful, boots the subsequent software module of the plurality of software modules, and (ii) when the verification of the validity performed by the verification unit fails, compares the alternate cumulative value corresponding to the subsequent software module with the target cumulative value included in the digital certificate corresponding to the subsequent software module, and when the compared alternate cumulative and target cumulative values match, the boot control unit boots the subsequent software module.