Patent ID: 8510544

Claim:
An information processing apparatus, comprising: a first storage unit storing modules of a first module group and certificates corresponding one-to-one thereto, the first module group corresponding to a first stakeholder, each certificate containing a first comparison value and a first cumulative comparison value, the first comparison value generated from a hash value of the corresponding module of the first module group, and the first cumulative comparison value generated from a cumulative hash value of the modules of the first module group; a second storage unit storing modules of a second module group and certificates corresponding one-to-one thereto, the second module group corresponding to a second stakeholder, each certificate containing a second comparison value and a second cumulative comparison value, the second comparison value generated from a hash value of the corresponding module of the second module group, and the second cumulative comparison value generated from a cumulative hash value of the modules of the second module group; a first control unit configured to verify the legitimacy of each module of the first module group by comparing a hash value of the module with the first comparison value thereof, and to start up each module of the first module group that has been verified; a second control unit configured to verify, when the first control unit verifies the legitimacy of each module of the first module group, the legitimacy of each module of the second module group by comparing a hash value of the module with the second comparison value thereof, and to start up the modules of the second module group that have been verified; and a holding unit holding a linkage certificate, the linkage certificate containing a third comparison value and a third cumulative comparison value, the third comparison value used for verification of the legitimacy of the head of the modules of the second module group, and the third cumulative comparison value generated from the cumulative hash value of the modules of the first module group, wherein when a module of the first module group is updated, the first control unit verifies a signature on the certificate of the module, and updates the third cumulative comparison value in the linkage certificate by using the first comparison value in the certificate of the module, after starting up the modules of the first module group, the first control unit starts up the head of the modules of the second module group only when the first control unit verifies that the modules that have been started up are legitimate by using the third cumulative value contained in the linkage certificate and that the head of the modules of the second module group is legitimate by using the third comparison contained in the linkage certificate, and the second control unit verifies the legitimacy of each module of the second module group and starts up the modules of the second module group.