Control system having download function

• US 20040107237A1
• Filed: 07/21/2003
• Published: 06/03/2004
• Est. Priority Date: 01/19/2001
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Kashiwada, Takeshi
• Granted Patent: US 7,313,704 B2
• Time in Patent Office: Days
• US Class Current: 709/200
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/82 Protecting input, output or interconnection devices
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57

Abstract

A control system having a download function includes a first storage area for storing execution program data for executing a control function in a rewritable status, a second storage area for storing a download module containing fresh pieces of update target execution program data and module identifying information, a first control unit for receiving the download module encrypted by an encryption key generated from the same program data as the execution program data stored in the first storage element and from the module identifying information, and storing the received download module in the second storage element, and a second control unit for decrypting the download module by an encryption key generated from data in the execution program data in the first storage area and from data of the download module in the second storage area and replacing, when a storage start address, a data length and a check digit that are encrypted in the download module are decrypted into valid values in a plain text, the execution program data in the first storage area with the fresh execution program data decrypted.

Claims

1. A control system having a download function, comprising:

a first storage element storing execution program data for executing a control function in a rewritable status;

a second storage element storing a download module containing fresh pieces of update target execution program data and module identifying information;

a first control unit receiving the download module encrypted by an encryption key generated from the same program data as the execution program data stored in said first storage element and from the module identifying information, and storing the received download module in said second storage element; and

a second control unit decrypting the download module by an encryption key generated from data in the execution program data in said first storage element and from data of the download module in said second storage element and replacing, when a storage start address, a data length and a check digit that are encrypted in the download module are decrypted into valid values in a plain text, the execution program data in said first storage element with the fresh execution program data decrypted.

2. A control system having a download function according to claim 1, further comprising a third control unit making the download module receivable that contains the fresh execution program data for only a predetermined fixed period of time after starting the download function.

3. A control system having a download function according to claim 2, further comprising a fourth control unit making the download module receivable that contains the fresh execution program data by restarting the download function when receiving a specified reset command in a state of being unable to receive the download module.

4. A control system having a download function according to claim 2 or 3, further comprising a third storage element storing a loader executed first when starting the download function, storing the download module in said second storage element and executing the execution program data for the control function that are stored in said first storage element.

5. A control system having a download function according to claim 4, further comprising a fifth control unit making the execution program data in said first storage element executable by the loader when a check digit value obtained as a result of calculation based on all pieces of data in the execution program data in said first storage element, is coincident with data in a specified address in the execution program data in said first storage element.

6. A control system having a download function according to claim 5, further comprising a sixth control unit storing the execution program data, executable and stored in said first storage element, in said third storage element stored with the loader, and restoring the control function by storing said first storage element with the loader'"'"'s own execution program data in said third storage element when judging that the execution program data can not be executed as a result of checking the execution program data in said first storage element upon a startup of the loader.

7. A control system having a download function according to claim 5, further comprising a seventh control unit enabling the fresh execution program data to be stored by initializing said first storage element into a known status when judging that the execution program data can not be executed as a result of checking the execution program data in said first storage element upon a startup of the loader.

8. A control system having a download function according to claim 6, further comprising an eighth control unit setting a queuing time till the loader'"'"'s own execution program data are stored in said first storage element, and restricting a repetition of initializing said first storage element by the loader and storing said second storage element with the download module containing unlawful execution program data.

9. A control system having a download function according to claim 7, further comprising a ninth control unit setting a queuing time till said first storage element is initialized by the loader, and restricting a repetition of initializing said first storage element by the loader and storing said second storage element with the download module containing unlawful execution program data.

10. A control system having a download function according to claim 1, wherein the download module is structured of a fixed-length header field stored with the module identifying information containing at least a module name, a module creation date, a module version number and a storage start address, and at least one data field stored with a block length and data having a length corresponding to this block length, and

there is encrypted a block having the data field containing an actual data length corresponding to the execution program data, a storage start address, the execution program data, pad data for adjusting a data length to a cipherable length and a check digit generated from the above data.

11. A control system having a download function according to claim 10, wherein the download module is decrypted by an encryption key generated from the data in the execution program data in said first storage element and from the data in the module identifying information of the download module in said second storage element.

12. A download control method comprising:

storing a first storage element with execution program data for executing a control function in a rewritable status;

storing a second storage element with a download module containing fresh pieces of update target execution program data and module identifying information;

receiving the download module encrypted by an encryption key generated from the same program data as the execution program data stored in said first storage element and from the module identifying information, and storing the received download module in said second storage element; and

decrypting the download module by an encryption key generated from data in the execution program data in said first storage element and from data of the download module in said second storage element and replacing, when a storage start address, a data length and a check digit that are encrypted in the download module are decrypted into valid values in a plain text, the execution program data in said first storage element with the fresh execution program data decrypted.

13. A download control method according to claim 12, further comprising making the download module receivable that contains the fresh execution program data for only a predetermined fixed period of time after starting the download function.

14. A download control method according to claim 13, further comprising making the download module receivable that contains the fresh execution program data by restarting the download function when receiving a specified reset command in a state of being unable to receive the download module.

15. A download control method according to claim 13 or 14, further comprising executing first a loader stored in third storage element, executing the download function by this loader, and executing the execution program data for the control function that are stored in said first storage element when it is normally ended to make the download module receivable by the download function.

16. A download control method according to claim 15, further comprising making the execution program data in said first storage element executable by the loader when a check digit value obtained as a result of calculation based on all pieces of data in the execution program data in said first storage element, is coincident with data in a specified address in the execution program data in said first storage element.

17. A download control method according to claim 16, further comprising:

storing the execution program data, executable and stored in said first storage element, in said third storage element stored with the loader; and

restoring the control function by storing said first storage element with the loader'"'"'s own execution program data in said third storage element when judging that the execution program data can not be executed as a result of checking the execution program data in said first storage element upon a startup of the loader.

18. A download control method according to claim 16, further comprising enabling the fresh execution program data to be stored by initializing said first storage element into a known status when judging that the execution program data can not be executed as a result of checking the execution program data in said first storage element upon a startup of the loader.

19. A download control method according to claim 17, further comprising setting a queuing time till the loader'"'"'s own execution program data are stored in said first storage element, and restricting a repetition of initializing said first storage element by the loader and storing said second storage element with the download module containing unlawful execution program data.

20. A download control method according to claim 18, further comprising setting a queuing time till said first storage element is initialized by the loader, and restricting a repetition of initializing said first storage element by the loader and storing said second storage element with the download module containing unlawful execution program data.

21. A download control method according to claim 12, wherein the download module is structured of a fixed-length header field stored with the module identifying information containing at least a module name, a module creation date, a module version number and a storage start address, and at least one data field stored with a block length and data having a length corresponding to this block length, and

there is encrypted a block having the data field containing an actual data length corresponding to the execution program data, a storage start address, the execution program data, pad data for adjusting a data length to a cipherable length and a check digit generated from the above data.

22. A download control method according to claim 21, wherein the download module is decrypted by an encryption key generated from the data in the execution program data in said first storage element and from the data in the module identifying information of the download module in said second storage element.