Divided integrity verification using memory segment protection

1. An information processing apparatus comprising:

a first memory in which firmware is stored; and

a processor programmed to:

at a time of activating the information processing apparatus, assign a first access right to a verification target region of the first memory, the first access right causing, upon the verification target region being accessed, a violation of an access right of the first memory;

detect an access to the first memory;

check whether the access to the first memory violates the first access right;

upon detecting that the access to the first memory violates the first access right, perform an integrity check with respect to the verification target region of the first memory; and

update the first access right corresponding to the verification target region, to which the integrity check has been performed.

2. The information processing apparatus according to claim 1 , wherein the processor is programmed to determine whether the access to the first memory that violates the first access right invokes the integrity check with respect to the verification target region based on security processing information including at least information indicating a range of the verification target region of the first memory and information regarding the access to the first memory that violates the first access right.

3. The information processing apparatus according to claim 1 , wherein

at the time of activating the information processing apparatus, the first access right common to a memory space including a plurality of verification target regions is assigned, and

the processor is programmed to update only the first access right corresponding to the verification target region, to which the integrity check has been performed, of the memory space including the plurality of verification target regions.

4. The information processing apparatus according to claim 3 , wherein the processor is configured to add a region having a new access right corresponding to the verification target region, to which the integrity check has been performed, thereby updating the first access right corresponding to the verification target region.

5. The information processing apparatus according to claim 3 , wherein the processor is configured to switch the first access right assigned to the verification target region, to which the integrity check has been performed, from disabled to enabled, thereby updating the first access right corresponding to the verification target region.

6. The information processing apparatus according to claim 1 , further comprising:

a second memory that is unupdatable from the processor, and in which an initial execution program to be executed first by the processor at the time of activating the information processing apparatus is stored, wherein

the processor is programmed by a secure program included in the firmware to perform the integrity check with respect to the verification target, and

the secure program is subjected to an integrity check by the processor programmed to execute the initial execution program prior to execution of the secure program.

7. The information processing apparatus according to claim 1 , wherein the processor is programmed to perform the integrity check with respect to the verification target region of a memory space of the first memory in which the firmware is stored.

8. The information processing apparatus according to claim 1 , wherein

the first memory includes a first memory space in which the firmware is stored and a second memory space to which at least a part of data of the firmware is to be loaded,

the processor is programmed to load data of the verification target region, to which the integrity check is to be performed, from the first memory space to the second memory space, and

the processor is programmed to perform the integrity check with respect to the verification target region of the second memory space.

9. The information processing apparatus according to claim 1 , wherein the processor is programmed to:

upon detecting that the access to the first memory that violates the first access right invokes cryptographic processing with respect to a predetermined target region, perform the cryptographic processing with respect to the target region, and

update the first access right corresponding to the predetermined target region to which the cryptographic processing has been performed.

10. The information processing apparatus according to claim 1 , wherein the processor includes a plurality of processor cores including a first processor core and a second processor core, the second processor core being configured to specialize in processing of the integrity check.

11. The information processing apparatus according to claim 1 , wherein the processor is programmed to:

set an advance verification generation rule with respect to the verification target region, and

perform the integrity check with respect to the verification target region, when the advance verification generation rule is satisfied even if the access to the first memory does not violate the first access right.

12. The information processing apparatus according to claim 11 , wherein, in a case where the integrity check to the verification target region according to the advance verification generation rule has failed, the processor is programmed to perform an operation to inhibit access to the verification target region.

13. The information processing apparatus according to claim 1 , the processor is programmed to;

reset a region to which an access right has been set, and

secure a region to which a new access right can be set.

14. The information processing apparatus according to claim 1 , wherein the information processing apparatus communicates with a host via an interface and accesses the first memory in response to a request from the host.

15. A computer program product comprising a non-transitory computer-readable medium, wherein a computer program included in the medium causes a computer including a first memory in which firmware is stored, to execute:

as an initial setting, assigning a first access right to a verification target region of the first memory, the first access right causing, upon the verification target region being accessed, a violation of an access right of the first memory;

detecting an access to the first memory;

checking whether the access to the first memory violates the first access right;

upon detecting that the access to the first memory violates the first access right, performing an integrity check with respect to the verification target region of the first memory; and

updating the first right corresponding to the verification target region, to which the integrity check has been performed.