Patent Description:
An information processing apparatus is known that detects software tampering (hereinafter referred to as tampering detection) and prohibits execution of software for which tampering is detected. For example, a sub central processing unit (CPU) performs verification of software to be executed by a main CPU, and the main CPU executes software that has been successfully verified. When the software is not successfully verified, execution of the software is prohibited.

In addition, some information processing apparatuses are equipped with a technology called adaptive supply voltage (ASV) in which a power-supply voltage is changed in accordance with variations from device to device (for example, from CPU to CPU) (<CIT>). For a fast device (a device capable of operating at a predetermined frequency even with a voltage lower than a predetermined voltage), an operation at the predetermined frequency is realized by applying the voltage lower than the predetermined voltage. As a result, power consumption can be reduced. In addition, for a slow device (a device that operates at a predetermined frequency only with a voltage higher than a predetermined voltage), an operation at the predetermined frequency is realized by applying the voltage higher than the predetermined voltage. Hereinafter setting of a voltage in accordance with variations from device to device will be referred to as ASV processing. <CIT> discloses verification of update software using mutual supervision of a protection module and an update module group. Further, <CIT> discloses hardware capable of adapting the clock frequency of cores of a processor in a time-efficient manner using a voltage regulator and a clock generator for each core. Further, <CIT> discloses a system which is tamper resistant based on encryption, and which is capable of decrypting data used for generally regulating the timing of clock frequencies and supply voltages during boot of CPUs on a chip, and <CIT> relates to a method and system for hardware security ensuring proper operating points of processors by matching voltage operation points and clock frequency operation points to reference values.

In a case where a device is a slow device, operation of the device may be unstable unless a voltage necessary for the device is input and then a clock signal having a predetermined frequency is input. Thus, until the voltage necessary for the device is input, a clock signal having a frequency lower than the predetermined frequency is input. After the voltage necessary for the device is input, the clock signal having the predetermined frequency is input to the device using, for example, a phase-locked loop circuit (hereinafter referred to as a PLL circuit).

As described above, due to ASV processing, until a voltage necessary for a device is input, a slow clock signal needs to be input in order to operate the device with certainty. Thus, tampering detection processing that is processing executed before the device operates and that is for software to be executed by the device is executed using the slow clock signal. As a result, the tampering detection processing takes a longer time.

The present invention provides an information processing apparatus capable of shortening a time required for tampering detection processing.

The present invention in its first aspect provides an information processing apparatus as specified in claims <NUM> to <NUM>.

The present invention in its second aspect provides a control method as specified in claim <NUM>.

In the following, embodiments of the present invention will be described in detail with reference to the drawings.

In the present embodiment, as an information processing apparatus, an image forming apparatus having a print function and a scan function will be described as an example.

<FIG> is a diagram of the overall configuration of an image forming apparatus.

To a network <NUM>, an image forming apparatus <NUM> and a personal computer (PC) <NUM> are connected such that communication is possible therebetween. In addition, a Web browser is installed on the PC <NUM>. The Web browser receives, as an input, a uniform resource locater (URL), receives a Web page from a Web server (not illustrated), and can display a Web page on an operation unit (not illustrated) of the PC <NUM>.

The image forming apparatus <NUM> is equipped with a Web server for causing the user to set various settings of the image forming apparatus <NUM> through the Web browser of the PC <NUM>. Upon input of an IP address or a host name of the image forming apparatus <NUM> in an address input field of the Web browser, the Web browser of the PC <NUM> receives a Web page for setting various settings from the image forming apparatus <NUM> and displays the Web page on a display unit. The user can set settings for the image forming apparatus <NUM> through the Web page for setting the various settings.

Next, the configuration of the image forming apparatus <NUM> will be described. The image forming apparatus <NUM> has a plurality of function units, a control unit <NUM>, an operation unit <NUM>, the printer unit <NUM>, the scanner unit <NUM>, and a power supply unit <NUM>.

The power supply unit <NUM> supplies power to the control unit <NUM>, the operation unit <NUM>, the printer unit <NUM>, and the scanner unit <NUM>. The operation unit <NUM> has a liquid crystal display unit having a touch panel and a keyboard. In addition, the operation unit <NUM> has a power-saving button for causing the power state of the image forming apparatus <NUM> to switch to a sleep state. When the power-saving button is pressed in a standby state, the power state of the image forming apparatus <NUM> is switched to the sleep state, in which less power is consumed than in the standby state. In addition, when the power-saving button is pressed in the sleep state, the power state of the image forming apparatus <NUM> is switched to the standby state. As long as the sleep state described above is a sleep state in which power to the printer unit <NUM> or the scanner unit <NUM> is stopped, the sleep state may be a deep sleep state in which power to the control unit <NUM> is stopped. In addition, the sleep state may also be a sleep state in which power supply to the control unit <NUM> is not stopped.

In accordance with a print command received from the user, the printer unit <NUM> prints an image on a sheet using image data received by the control unit <NUM>. As a printing system for the printer unit <NUM>, an electrophotography system may be employed in which an image is printed by fixing toner on a sheet or an ink-jet system may also be employed in which an image is printed by discharging ink onto a sheet. In accordance with a scan command received from the user, the scanner unit <NUM> scans a document image and transmits image data of the scan image to the control unit <NUM>.

The control unit <NUM> has an application specific integrated circuit (ASIC) <NUM>. In addition, the control unit <NUM> has a read-only memory (ROM) <NUM> and a random access memory (RAM) <NUM>. The control unit <NUM> has a hard disk drive (HDD) <NUM>, an electrically erasable programmable read-only memory (EEPROM) <NUM>, and a network interface (I/F) <NUM>. In addition, the control unit <NUM> has a power supply control circuit <NUM>.

The control unit <NUM> executes various functions of the image forming apparatus <NUM>. The ASIC <NUM> reads out a control program stored in the ROM <NUM> or the HDD <NUM> and performs various types of control such as print control and scan control. The RAM <NUM> is a volatile memory and is a working memory used when the control program is executed. The HDD <NUM> is a storage medium such as a magnetic disk and stores, for example, the control program and image data. The EEPROM <NUM> is a nonvolatile memory and stores, for example, setting values to which reference is made when the control program is executed.

The network I/F <NUM> receives print data and various data from the PC <NUM> via the network <NUM>.

When receiving a switching request to the sleep state from, for example, the power-saving button, the power supply control circuit <NUM> stops power supply from the power supply unit (the power supply unit) <NUM> to the printer unit <NUM> and the scanner unit <NUM>. As a result, the image forming apparatus <NUM> switches to the sleep state. In addition, when receiving a request to return from the sleep state from, for example, the power-saving button, the power supply control circuit <NUM> performs control such that power is supplied from the power supply unit <NUM> to the printer unit <NUM> and the scanner unit <NUM>. Configuration of ASIC <NUM>.

<FIG> is a block diagram of the ASIC <NUM>.

The ASIC <NUM> has a main CPU (execution means) <NUM>, a storage unit <NUM> for storing boot data for the main CPU <NUM>, a sub-CPU (verification means) <NUM>, and a storage unit <NUM> for storing boot data for the sub-CPU <NUM>. In addition, the ASIC <NUM> has an input interface <NUM>, an output interface <NUM>, a data processing unit <NUM>, a phase locked loop (PLL) <NUM>, and a clock selecting unit (a signal selecting unit) <NUM>. In addition, the ASIC <NUM> has a process information storage unit (a retaining unit) <NUM>, a reset controller <NUM>, and a power supply terminal <NUM>. A clock signal output unit according to the present invention includes an oscillator <NUM>, the PLL <NUM>, and the clock selecting unit <NUM>.

The main CPU <NUM> controls devices inside the ASIC <NUM>. Basically, the main CPU <NUM> can operate using a clock signal having a frequency of <NUM> in a case where a power-supply voltage of <NUM> V is applied thereto. However, depending on device variations, there may be a case where the main CPU <NUM> is operable at <NUM> even when the power-supply voltage is less than <NUM> V, and there may also be a case where the main CPU <NUM> does not operate at <NUM> unless a power-supply voltage higher than <NUM> V is applied thereto.

The storage unit <NUM> stores a program executed when the main CPU <NUM> boots up and various types of data used when the main CPU <NUM> boots up (hereinafter the program and various types of data are collectively referred to as boot data). The storage unit <NUM> is a read-only memory (ROM).

The sub-CPU <NUM> performs auxiliary control for the main CPU <NUM>.

The storage unit <NUM> stores a program executed when the sub-CPU <NUM> boots up and various types of data used when the sub-CPU <NUM> boots up. The storage unit <NUM> is a ROM.

In the present embodiment, when the image forming apparatus <NUM> is switched on (when the ASIC <NUM> is reset), the sub-CPU <NUM> boots up earlier than the main CPU <NUM>. That is, when the image forming apparatus <NUM> is switched on (when the ASIC <NUM> is reset), the sub-CPU <NUM> boots up using the boot data stored in the storage unit <NUM>, and performs verification of the boot data stored in the storage unit <NUM>. As a result of the verification of the boot data by the sub-CPU <NUM>, in a case where it is determined that the boot data to be executed by the main CPU <NUM> has not been tampered with, the main CPU <NUM> executes the boot program stored in the storage unit <NUM>.

The input interface (hereinafter referred to as I/F) <NUM> is an interface through which data is input from outside the ASIC <NUM>. The output interface <NUM> is an interface through which data is output to the outside.

The data processing unit <NUM> is a module that performs predetermined processing on data input from the input I/F <NUM>. For example, the data processing unit <NUM> receives image data and performs image processing (enlargement, reduction, correction, and the like) on the received image data.

The oscillator <NUM> supplies a clock signal to the ASIC <NUM>. The oscillator <NUM> supplies, for example, a clock signal having <NUM>. The PLL <NUM> is a circuit that converts the frequency of the clock signal supplied from the oscillator <NUM> into a desired frequency and outputs the resulting clock signal. The PLL <NUM> converts the frequency (<NUM>) of an input clock signal into, for example, a <NUM> clock signal, which has a <NUM> times higher frequency, and outputs the <NUM> clock signal.

The clock selecting unit (multiplexer (MUX)) <NUM> receives the clock signal supplied by the oscillator <NUM> and the clock signal supplied by the PLL <NUM>. The clock selecting unit <NUM> outputs either of the clock signal supplied by the oscillator <NUM> and the clock signal supplied by the PLL <NUM>. In the present embodiment, the clock selecting unit <NUM> outputs, in accordance with a command from the sub-CPU <NUM>, either of the clock signal supplied by the oscillator <NUM> and the clock signal supplied by the PLL <NUM>. The modules inside the ASIC <NUM> (the main CPU <NUM>, the sub-CPU <NUM>, the data processing unit <NUM>, and other circuits) perform data reception and transmission therebetween in relation to synchronization, and thus the clock signals input to the modules need to be synchronized to each other. In the present embodiment, the clock signals to be supplied to the modules branch from the clock signal output from the clock selecting unit <NUM>. As long as the phases of the clock signals input to the modules are synchronized with each other, the clock signals may have different frequencies.

The process information storage unit <NUM> stores process information (<NUM>-bit information) regarding the main CPU <NUM>. The process information storage unit <NUM> is a ROM.

The power supply control circuit <NUM> changes the voltage to be output by the power supply unit <NUM>. The power supply control circuit <NUM> changes the voltage to be output from the power supply unit <NUM>, on the basis of the process information stored in the process information storage unit <NUM>. The power supply unit <NUM> applies a voltage to the ASIC <NUM> via the power supply terminal <NUM>. The power supply unit <NUM> applies a predetermined voltage to the ASIC <NUM> on the basis of a voltage control signal output from the power supply control circuit <NUM>.

The reset controller <NUM> outputs a reset signal to the modules inside the ASIC <NUM>. When the image forming apparatus <NUM> is switched on (when the ASIC <NUM> is reset), the reset controller <NUM> cancels reset of the sub-CPU <NUM> and the storage unit <NUM>. Next, in accordance with a command from the sub-CPU <NUM>, the reset controller <NUM> cancels reset of the main CPU <NUM>.

The ASIC <NUM> is operable in two operation modes, which are a slow-speed operation mode and a high-speed operation mode. In the slow-speed operation mode, the clock selecting unit <NUM> selects and outputs, in accordance with a command from the sub-CPU <NUM>, the clock signal input from the oscillator <NUM>. As illustrated in <FIG>, the output clock signal is used as a clock signal for operating the main CPU <NUM>, the sub-CPU <NUM>, and the data processing unit <NUM>. In addition, although not illustrated in <FIG>, the clock signal is input to circuits other than those described above.

In <FIG>, the clock signal output from the clock selecting unit <NUM> is directly supplied to the modules; however, a clock signal whose frequency has been reduced by using, for example, a frequency divider circuit may also be supplied to the modules.

In the high-speed operation mode, the clock selecting unit <NUM> selects and outputs, in accordance with a command from the sub-CPU <NUM>, the clock signal input from the PLL <NUM>. As illustrated in <FIG>, the output clock signal is used as a clock signal for operating the main CPU <NUM>, the sub-CPU <NUM>, and the data processing unit <NUM>. In addition, although not illustrated in <FIG>, the clock signal is input to circuits other than those described above.

<FIG> is a flowchart illustrating processing executed by the sub-CPU <NUM>.

When the image forming apparatus is switched on by the user (S301), a reset signal is input to the ASIC <NUM>. When the ASIC <NUM> is reset, the ASIC <NUM> enters the slow-speed operation mode on the basis of initial settings. The clock signal (<NUM>) output from the oscillator <NUM> is input to the sub-CPU <NUM> (S302). The reset controller <NUM> cancels reset of the sub-CPU <NUM> and the storage unit <NUM> using a hardware sequence. As a result, the sub-CPU <NUM> executes the boot data stored in the storage unit <NUM> (S303).

The booted sub-CPU <NUM> sets settings such that the PLL <NUM> outputs a <NUM> clock signal. As a result, the PLL <NUM> causes a <NUM> clock signal to oscillate (S304).

Thereafter, the sub-CPU <NUM> sets various parameters such that the data processing unit <NUM> executes predetermined processing (S305). The sub-CPU <NUM> then determines whether a lock-up time for the PLL <NUM> has elapsed (S306). A lock-up time is a time required for the PLL <NUM> to cause a signal having a predetermined frequency (in this case, <NUM>) to stably oscillate.

In a case where it is determined that the lock-up time has elapsed (Yes in S306), the sub-CPU <NUM> switches the output of the clock selecting unit <NUM> from the clock signal output from the oscillator <NUM> to the clock signal output from the PLL <NUM> (S307). As a result, the ASIC <NUM> enters the high-speed operation mode.

In the present embodiment, the sub-CPU <NUM> then performs verification of the boot data for the main CPU <NUM> (S308). For example, the sub-CPU <NUM> compares a correct value prestored in the storage unit <NUM> with a hash value of the boot data stored in the storage unit <NUM>. In a case where the correct value matches the hash value of the boot data, the sub-CPU <NUM> determines that the boot data has not been tampered with, and in a case where the correct value does not match the hash value of the boot data, the sub-CPU <NUM> determines that the boot data has been tampered with. Note that the boot-data tampering detection method will be described in detail with reference to <FIG> and <FIG>.

In a case where it is determined that the boot data has been tampered with (Yes in S309), the main CPU <NUM> does not execute the boot data, and the sub-CPU <NUM> notifies the user and the administrator that tampering has occurred (S310). As the notification method, for example, an unillustrated light-emitting diode (LED) (light output means) may be lit up or a sound notification may be used.

In a case where it is determined that the boot data has not been tampered with (No in S309), the sub-CPU <NUM> switches the output of the clock selecting unit <NUM> from the clock signal output from the PLL <NUM> to the clock signal output from the oscillator <NUM> (S311). As a result, the ASIC <NUM> enters the slow-speed operation mode.

The sub-CPU <NUM> then cancels reset of the main CPU <NUM> and other circuits (S312). As a result, the main CPU <NUM> starts to boot up.

<FIG> is a flowchart illustrating processing executed by the main CPU <NUM>.

When reset of the main CPU <NUM> is canceled (S401), the main CPU <NUM> starts operating using the clock signal output from the oscillator <NUM> (S402). The main CPU <NUM> executes the boot data stored in the storage unit <NUM> (S403). The boot data has been verified and it is determined that the boot data has not been tampered with. In the present embodiment, the main CPU <NUM> executes ASV processing (S404). Details of the ASV processing will be described with reference to <FIG>, <FIG>, and <FIG>.

When the ASV processing ends, the main CPU <NUM> sets settings such that the PLL <NUM> outputs a <NUM> clock signal (S405). Thereafter, the main CPU <NUM> determines whether the lock-up time for the PLL <NUM> has elapsed (S406). In a case where it is determined that the lock-up time for the PLL <NUM> has elapsed (Yes in S406), the main CPU <NUM> switches the output of the clock selecting unit <NUM> from the clock signal output from the oscillator <NUM> to the clock signal output from the PLL <NUM> (S407). As a result, the ASIC <NUM> enters the high-speed operation mode. Thereafter, the main CPU <NUM> controls data processing performed at the data processing unit <NUM>.

At the time when the ASIC <NUM> enters the high-speed operation mode, the settings for various types of data processing to be executed at the data processing unit <NUM> are set as various settings for the ASIC <NUM>. In addition, the power-supply voltage to the main CPU <NUM> is changed to a voltage suitable for processing to be performed by the main CPU <NUM>, and thus the main CPU <NUM> can execute various types of data processing.

In accordance with the flowchart above, before the main CPU <NUM> performs the ASV processing, the sub-CPU <NUM> can perform the tampering detection processing using the high frequency clock signal output from the PLL <NUM>, and thus tampering detection processing can be completed in a short time. In addition, after the sub-CPU <NUM> ends the tampering detection processing, the clock signal supplied to the main CPU <NUM> is switched to the low frequency clock signal from the oscillator <NUM>, and thus the main CPU <NUM> can perform the ASV processing.

Next, the details of the tampering detection processing for a boot program in S308 of <FIG> will be described. <FIG> is a diagram illustrating details of blocks related to the verification of the boot program.

The storage unit <NUM> stores boot data <NUM> for the main CPU <NUM>. When reset of the main CPU <NUM> is canceled, the main CPU <NUM> reads and executes the boot data <NUM> for the main CPU <NUM> stored in the storage unit <NUM>. As a result, the main CPU <NUM> starts to boot up. The storage unit <NUM> stores boot data <NUM> for the sub-CPU <NUM>. When reset of the sub-CPU <NUM> is canceled, the sub-CPU <NUM> reads and executes the boot data <NUM> for the sub-CPU <NUM> stored in the storage unit <NUM>. As a result, the sub-CPU <NUM> starts to boot up.

In addition, the storage unit <NUM> stores comparison data (a correct value) that is to be compared with the boot data <NUM> to be executed by the main CPU <NUM>.

<FIG> is a diagram illustrating a flowchart for a boot program verification method.

The sub-CPU <NUM> reads a predetermined amount of data (for example, <NUM> kB) from the first data of the boot data <NUM> for the main CPU <NUM> stored in the storage unit <NUM> (S601). The read data is stored in a buffer memory of the sub-CPU <NUM>. The sub-CPU <NUM> reads comparison data <NUM> as much as the data read from the storage unit <NUM> (S602). The sub-CPU <NUM> then compares the boot data <NUM> for the main CPU <NUM> stored in the buffer memory with the comparison data <NUM> (S603). As a result of the comparison, in a case where the boot data <NUM> differs from the comparison data <NUM> (No in S604), the sub-CPU <NUM> determines that the boot data <NUM> has been tampered with (S605).

In contrast, as a result of the comparison, in a case where the boot data <NUM> matches the comparison data <NUM> (Yes in S604), the sub-CPU <NUM> determines that the boot data <NUM> has not been tampered with (S606).

In the present embodiment, the boot data <NUM> for the main CPU <NUM> itself is compared with the comparison data <NUM>. However, a hash value of the boot data <NUM> for the main CPU <NUM> is calculated, and the verification of the boot data <NUM> may also be performed by comparing the hash value with the prestored correct value.

In addition, in the present embodiment, the verification of part of the boot data <NUM> (<NUM> kB) is performed; however, the verification of all the boot data <NUM> may also be performed.

Next, details of the ASV processing in S404 of <FIG> will be described. <FIG> is a diagram illustrating details of blocks related to the ASV processing.

The process information storage unit <NUM> stores process information regarding the main CPU <NUM>. The process information storage unit <NUM> is a ROM. In the present embodiment, the process for the main CPU <NUM> is classified into eight stages from slow to fast, <NUM>-bit data is stored as information regarding the process in the process information storage unit <NUM>.

<FIG> is a diagram illustrating details of the information stored in the process information storage unit <NUM>. As illustrated in <FIG>, a typical process is set to "<NUM>", and is represented as <NUM>-bit data "<NUM>". The slowest process is set to "<NUM>", and is represented as <NUM>-bit data "<NUM>". Moreover, the fastest process is set to "<NUM>", and is represented as <NUM>-bit data "<NUM>".

Returning to <FIG>, the power supply control circuit <NUM> receives, from the main CPU <NUM>, the process information stored in the process information storage unit <NUM>. On the basis of the received process information, the power supply control circuit <NUM> outputs a control signal for changing the voltage to be output from the power supply unit <NUM>. The main CPU <NUM> outputs the <NUM>-bit data to the power supply control circuit <NUM>. The ASIC <NUM> and the power supply control circuit <NUM> are connected by a serial bus. An I2C (I-squared-C) I/F unit <NUM> of the ASIC <NUM> and an I2C I/F unit <NUM> of the power supply control circuit <NUM> perform communication using the I2C protocol.

A data processing unit <NUM> of the power supply control circuit <NUM> outputs, as a <NUM>-bit control signal, <NUM>-bit process information input via the I2C I/F unit <NUM> to the power supply unit <NUM>. When the image forming apparatus <NUM> is switched on, the power supply unit <NUM> outputs a typical voltage, that is, a voltage of <NUM> V in the present embodiment. Thereafter, the power supply unit <NUM> applies a predetermined voltage to the power supply terminal <NUM> on the basis of the control signal input from the power supply control circuit <NUM>. For example, as illustrated in <FIG>, in a case where the main CPU <NUM> is a typical chip, the <NUM>-bit data output from the process information storage unit <NUM> is "<NUM>". The power-supply voltage applied to the main CPU <NUM> is <NUM> V. In addition, in a case where the main CPU <NUM> performs the slowest process, the <NUM>-bit data output from the process information storage unit <NUM> is "<NUM>". The power-supply voltage applied to the main CPU <NUM> is <NUM> V (see <FIG>). In addition, in a case where the main CPU <NUM> performs the fastest process, the <NUM>-bit data output from the process information storage unit <NUM> is "<NUM>". The power-supply voltage applied to the main CPU <NUM> is <NUM> V (see <FIG>).

<FIG> is a flowchart illustrating details of the ASV processing.

The main CPU <NUM> reads process information recorded in three bits from the process information storage unit <NUM> (S901). In the present embodiment, the process information regarding the main CPU <NUM> and recorded in three bits is read by reading out data at a specific address of the process information storage unit <NUM>. The main CPU <NUM> outputs the <NUM>-bit process information to the power supply control circuit <NUM> (S902). In the present embodiment, the main CPU <NUM> transmits the process information in accordance with the I2C protocol.

The power supply control circuit <NUM> receives the <NUM>-bit process information input from the ASIC <NUM>. The data processing unit <NUM> outputs a control signal for changing the output voltage of the power supply unit <NUM> to the power supply unit <NUM> (S903). The power supply unit <NUM> is provided with a <NUM>-bit input terminal for controlling the output voltage. The power supply unit <NUM> adjusts, on the basis of the control signal input to the input terminal, the power-supply voltage to be applied to the main CPU <NUM> (S904).

The relationship between the <NUM>-bit control signal and the power-supply voltage output from the power supply unit <NUM> is illustrated in <FIG>. In a case where the <NUM>-bit data is "<NUM>", the power supply unit <NUM> outputs <NUM> V to the main CPU <NUM>. In addition, in a case where the <NUM>-bit data is "<NUM>", the power supply unit <NUM> outputs <NUM> V to the main CPU <NUM>.

In the embodiment described above, the clock selecting unit <NUM> outputs either the clock signal supplied from the oscillator <NUM> or the clock signal supplied from the PLL <NUM>. The clock selecting unit <NUM> may receive three or more clock signals having different frequencies and may output any one of the clock signals.

For example, the clock selecting unit <NUM> outputs a <NUM> clock signal to the sub-CPU <NUM> when the sub-CPU <NUM> performs verification of the boot data, and outputs a <NUM> clock signal to the main CPU <NUM> when the main CPU <NUM> performs the ASV processing. The clock selecting unit <NUM> then outputs a <NUM> clock signal to the main CPU <NUM> when the ASV processing is completed. As long as the frequency of the clock signal output from the clock selecting unit <NUM> is high, then low, and then high, the frequencies are not limited to <NUM> and <NUM>. The frequency of the clock signal at the time when the verification of the boot data is performed does not have to be the same as the frequency of the clock signal after the ASV processing is completed.

Embodiments of the present invention can also be realized by a computer of a system or apparatus that reads out and executes computer executable instructions (e.g., one or more programs) recorded on a storage medium (which may also be referred to more fully as a 'non-transitory computer-readable storage medium') to perform the functions of one or more of the above-described embodiments and/or that includes one or more circuits (e.g., application specific integrated circuit (ASIC)) for performing the functions of one or more of the above-described embodiments, and by a method performed by the computer of the system or apparatus by, for example, reading out and executing the computer executable instructions from the storage medium to perform the functions of one or more of the above-described embodiments and/or controlling the one or more circuits to perform the functions of one or more of the above-described embodiments.

Claim 1:
An information processing apparatus comprising:
a main CPU as an execution means (<NUM>) configured to execute predetermined software (<NUM>);
a sub-CPU as a verification means (<NUM>) configured to perform verification of the predetermined software (<NUM>),
wherein the predetermined software is a program and data (<NUM>) used when the execution means (<NUM>) boots up;
power supply means (<NUM>) configured to output a voltage to the execution means (<NUM>);
retaining means (<NUM>) configured to retain information corresponding to a voltage to be applied to the execution means (<NUM>), wherein the execution means (<NUM>) sets the voltage to be output by the power supply means (<NUM>) on the basis of the information retained by the retaining means (<NUM>); and
clock signal output means (<NUM>, <NUM>, <NUM>) configured to output a clock signal having a first frequency to the verification means (<NUM>) at least during verification processing of the predetermined software performed by the verification means (<NUM>), and output a clock signal having a second frequency lower than the first frequency to the execution means (<NUM>) at least during execution of the predetermined software by the execution means and during setting processing of the voltage to be output by the power supply means (<NUM>) performed by the execution means (<NUM>),
wherein in a case where the predetermined software is successfully verified by the verification means (<NUM>), the clock signal output means (<NUM>, <NUM>, <NUM>) is configured to output the clock signal having the second frequency to the execution means which is configured to execute the predetermined software and then the setting processing of the voltage, and the clock signal output means is configured to output, after the voltage to be output by the power supply means (<NUM>) is set by the execution means (<NUM>), a clock signal having a third frequency higher than the second frequency to the execution means.