Systems and methods for secure startup of arithmetic processing devices
The present disclosure generally relates to systems and methods for safe startup, comprising a control apparatus. The control apparatus includes a first arithmetic processing device for executing a first program, a second arithmetic processing device for executing a second program, and a storage device for storing the second program. The first arithmetic processing device is configured to: verify whether each of the first program and the second program has been falsified, acquire the second program from the storage device when the verification unit verifies that the first program is not falsified, and notify the second microcomputer of startup permission of the second program when the verification unit verifies that the second program is not falsified, wherein the second arithmetic processing device acquires the second program from the storage device and starts up the second program when a notification of the startup permission is issued.
1 . A control apparatus comprising:
a first arithmetic processing device for executing a first program, the first arithmetic processing device comprising a secure area having tamper resistance;
a second arithmetic processing device for executing a second program in accordance with one or more permissions from the first arithmetic processing device, the second arithmetic processing device comprising a one-time programmable (OTP) area in which rewriting of a program is not possible; and
a storage device for storing the second program,
wherein the first arithmetic processing device comprises one or more processors coupled with memory, configured to:
verify, via a verification unit of the first arithmetic processing device that is stored in the secure area, whether the first program has been falsified,
responsive to verifying that the first program has not been falsified, transmit a first notification to the second arithmetic processing device and acquire, via a first acquisition unit of the first arithmetic processing device, the second program from the storage device, the first notification comprising an acquisition permission for permitting the second arithmetic processing device to acquire the second program from the storage device,
verify, subsequent to acquiring the second program, whether the second program has been falsified, and
responsive to verifying that the second program has not been falsified, transmit a second notification to the second arithmetic processing device, the second notification comprising a startup permission for permitting the second arithmetic processing device to start up the second program, and
wherein the second arithmetic processing device:
(i) acquires, via a second acquisition unit of the second arithmetic processing device that is stored in the OTP area, responsive to receiving the first notification comprising the acquisition permission, the second program from the storage device subsequent to the first arithmetic processing device verifying the first program and before the first arithmetic processing device verifying the second program, and
(ii) starts up, via a startup execution unit of the second arithmetic processing device that is stored in the OTP area, the second program in response to receiving the second notification comprising the startup permission issued by the first arithmetic processing device.
2 . The control apparatus according to claim 1 , wherein the first arithmetic processing device is configured to transition the second arithmetic processing device to a standby state until the second notification of the startup permission is issued after the second arithmetic processing device acquires the second program.
3 . The control apparatus according to claim 1 , wherein
the secure area is an area in which rewriting of a program is possible, and
the first arithmetic processing device is configured to:
update an update target stored in the secure area with an update package,
verify whether the update package has been falsified, and
update the update target with the update package when verified that the update package has not been falsified.
4 . The control apparatus according to claim 1 , wherein the first arithmetic processing device is configured to:
notify the second arithmetic processing device of an acquisition permission for permitting the second arithmetic processing device to acquire the second program from the storage device, when verified that the first program has not been falsified, and
notify the second arithmetic processing device of the acquisition permission before notifying the second arithmetic processing device of the startup permission,
wherein the second arithmetic processing device acquires the second program from the storage device when a notification of the acquisition permission is issued.
5 . The control apparatus according to claim 4 , wherein the first arithmetic processing device is configured to transition the second arithmetic processing device to a standby state until the notification of the acquisition permission is issued after power is supplied to the control apparatus.
6 . The control apparatus according to claim 1 , wherein
the first arithmetic processing device comprises the secure area and a second OTP area in which rewriting of a program is not possible,
the storage device stores the first program and the second program, and
the first acquisition unit of the first arithmetic processing device is stored in the second OTP area of the first arithmetic processing device which acquires the first program from the storage device.