JP2005269501A - Time inspection system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a time inspection system capable of making effective an inspection result of time set in a computer, for a long period of time. <P>SOLUTION: The controller 101 of a time inspection device 100 performs processing of obtaining an offset being the time difference between its own and the time received via a communication portion 102 and set in the computer 200 a plurality of times on the basis of the time, and time inspection information including each of these offsets is created for each offset. Each hash value of the time inspection information is computed and set as time inspection information. A link hash is obtained by computing the hash value relating the pieces of the time inspection information in time series. This link hash is set as time inspection information, the time inspection information is stored in an inspection database 104 via a data management portion 103, and the time inspection information is transmitted to the computer 200 via the communication portion 102. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a time audit system for proving for a long time that a time audit result has not been falsified with respect to a computer on a network.

  In companies and public offices, it is sometimes necessary to describe the exact time when creating document data such as documents. For this purpose, an accurate time must be set in the computer for document preparation. As a method of confirming that the time set in the computer is correct, there is a method of receiving an audit by a standard time distributor. In this method, the standard time distributor performs an audit of the time of the computer of the company or the public office, and the company or the public office receives the audit result data with an electronic signature attached or encrypted from the standard time distributor. Based on the results of this audit, companies and government agencies prove that the correct time is set on their computers.

  However, in the conventional technology, since the encryption and the electronic signature itself are easily decrypted or falsified with the advancement of the technology, there is a problem that the reliability of the audit result data itself deteriorates over time. . For this reason, the expiration date that can prove that the time audit result has not been tampered with is at most about 5 years. After this, it is impossible to prove that the correct date and time has been set on the computer. The date of creation of the document data held by the government office could no longer be verified.

In addition, what is described in patent document 1 is known as a conventional time inspection system. The technique described in Patent Document 1 guarantees that the reference time written in the document data is not falsified by an electronic signature, and the audit result of the clock function of the computer to be solved by the present invention is effective for a long period of time. It does not solve problems that cannot be maintained.
JP 2002-185449 A

  The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a time audit system that can validate the audit result of the time set in the computer for a long period of time.

  SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problems. The invention of claim 1 is a system in which a plurality of computers including a first computer and a second computer transmit and receive data via a network. The first computer transmits a time transmission request to the second computer, receives time reply data from the second computer, and has a clock function of the second computer, a clock function of the second computer, Measuring the offset that is a time difference between the second computer, and generating time audit information that is an audit result of the clock function of the second computer based on the offset, measuring means for executing the offset measurement a plurality of times, and the time audit A hash value calculating means for calculating a hash value of the information and setting it in the time audit information, and a time audit information positioned before and after the time series. Link hash calculation means for performing hash calculation in association with each other, obtaining a link hash and setting the link hash in the time audit information, and transmission means for transmitting the time audit information to the second computer. The second computer receives the time transmission request from the first computer and transmits the time reply data to the first computer; and the time audit information from the first computer. A time audit system comprising: receiving means for receiving; and storage means for storing the time audit information in a storage area.

  The invention according to claim 2 is the time audit system according to claim 1, wherein the first computer has a hash value based on the link hash in the time audit information of the second computer. Sub-super-hash calculating means for obtaining a sub-super-hash by calculating a super-hash calculating means for obtaining a super-hash by calculating a hash value based on one or more sub-super-hashes, and storing the super-hash in a storage area A time audit report generating unit that stores and transmits a time audit report including the sub superhash and the super hash to the second computer, wherein the second computer includes the first computer The time audit report is received from the computer and stored in a storage area

  The invention according to claim 3 is the time audit system according to claim 2, wherein the second computer reads the time audit information from a storage area, calculates an earthquake sub superhash, and The super hash is calculated based on the super hash and the time audit report.

  According to a fourth aspect of the present invention, in a system in which a plurality of computers including a first computer and a second computer transmit and receive data via a network, the first computer includes the second computer. Processing for transmitting a time transmission request to the second computer, receiving time reply data from the second computer, and measuring a time difference between the clock function of the own computer and the clock function of the second computer a plurality of times, Processing for generating time audit information that is an audit result of the clock function of the second computer for each offset, calculating a hash value of the time audit information and setting the time audit information; Hash calculation is performed by associating time audit information that is located, a link hash is obtained, and the link hash is set in the time audit information And management, a program for executing a process of transmitting the time audit information to the second computer.

  According to a fifth aspect of the present invention, in a system in which a plurality of computers including a first computer and a second computer transmit and receive data via a network, the second computer includes the first computer. Receiving the time transmission request from the first computer, transmitting the time reply data to the first computer, and receiving time audit information as a check result of its own clock function from the first computer and storing it in the storage area A program for executing the storing process.

  According to the first, second, and third aspects of the invention, the first computer calculates the link hash, and therefore generates a time audit result that is difficult to tamper with. For this reason, it is difficult for a malicious person to change the time audit result of the second computer, and it is possible to ensure that the time set in the second computer is accurate.

  According to the invention of claim 2, since the first computer generates a super hash based on a plurality of sub-super hashes, the malicious computer is malicious for falsification of the time audit result of the second computer. The person must also tamper with the sub-super-hash of the other computer, so that even if the composite technology of encryption progresses in the future, it becomes difficult to tamper with the time audit result of the second computer. There is an effect that it is possible to ensure that the time set in the second computer over a long period of time is accurate.

  According to the invention of claim 3, the administrator of the second computer can easily confirm that the time audit result of the second computer has not been tampered with.

FIG. 1 shows a configuration of a time audit system according to the present embodiment. The time audit apparatus 100 in this figure is a computer owned by a standard time distributor, and audits of the time set in the computer 200, the computer 200a, and the computer 200b owned by the company that is the customer are performed via the network. Do.
The control unit 101 of the time audit apparatus 100 is a control function of the time audit apparatus 100, and details will be described later. The communication unit 102 receives data from the outside and outputs it to the control unit 101, and transmits data to the outside in response to a request from the control unit 101. The audit database 104 stores audit results such as time audit information in the format shown in FIG.

  An ID (IDentifier) in the time audit information is an integer given in a sequential number in the order in which the time audit information is generated, and is identification information of the time audit information. The start time, the reception time, the transmission time, and the end time in the time audit information are data transmission / reception times between the time audit apparatus 100 and the computer 200. The offset in the time audit information is a deviation from the exact time set in the computer 200. The hash value in the time audit information is the result of hash calculation of ID, start time, reception time, transmission time, end time, and offset. By using this hash value, it is possible to check whether any of ID, start time, reception time, transmission time, end time, or offset has been tampered with. The link hash in the time audit information is a hash calculation result, and is obtained by calculation from the hash value of the time audit information and the link hash of the time audit information immediately before in the time series as shown in FIG. The link hash in the first time audit information is 1. By using this link hash, detection can be made by checking the link hash before and after the time audit information, such as when a malicious person intentionally deletes time audit information near a specific time of the computer 200.

The data management unit 103 inputs and outputs data from the audit database 104 based on a request from the control unit 101.
The control unit 201 of the computer 200 is a control function of the computer 200, and details will be described later. The communication unit 202 receives data from the outside and outputs the data to the control unit 201, and transmits the data to the outside in response to a request from the control unit 201. The audit result database 204 stores audit results and the like. The data management unit 203 accesses the audit result database 204 based on a request from the control unit 201. The computer 200a and the computer 200b are the same as the computer 200.

Next, the flow of processing in the present embodiment will be described with reference to the drawings.
In the description of the present embodiment, a case will be described in which the time auditing apparatus 100 owned by the standard time distributor in FIG. There are two types of time audit processing in the present embodiment: short-term certification audit processing corresponding to a short validity period of less than five years and long-term certification audit processing corresponding to a validity period of five years or more, Further, there are a check process for a short-term certification audit result and a check process for a long-term certification audit result, which are check processes of the results of these audit processes. Hereinafter, these four processes will be described.

<Short-term certification audit processing>
FIG. 2 shows the flow of the short-term certification audit process. First, the control unit 101 of the time audit apparatus 100 attempts to detect how much time delay is caused by passing through the network when data is transmitted to and received from the computer 200. For this purpose, the control unit 101 of the time audit apparatus 100 obtains the current time as the measurement start time, and transmits “delay confirmation” to the computer 200 via the communication unit 102. The control unit 201 of the computer 200 receives “delay confirmation” from the time audit device 100 via the communication unit 202 and transmits a “delay response” to the time audit device 100 via the communication unit 202. The control unit 101 of the time audit device 100 receives a “delay response” from the computer 200 via the communication unit 102, obtains the current time as the measurement end time, and subtracts the measurement start time from the measurement end time. When a data is transmitted / received between the computer 100 and the computer 200, a delay time caused by passing through the network is obtained. The control unit 101 repeats this process a predetermined number of times, calculates the average delay time, obtains a time Td that is a round trip delay time, and writes this in the storage area (step S01 in FIG. 2, step S01a in FIG. 2). .

  Next, the control unit 101 attempts to detect a deviation of the time set in the computer 200 from the time indicated by the clock function of the time audit device 100. FIG. 3 shows a signal transmission / reception procedure in this processing. The control unit 101 obtains the time indicated by the clock function of the time audit device 100, and stores it in the storage area as time T1 (step T01 in FIG. 3). Then, the control unit 101 transmits a time transmission request to the computer 200 via the communication unit 102.

  The control unit 201 of the computer 200 receives a time transmission request from the time audit apparatus 100 via the communication unit 202, obtains the time indicated by the clock function of the computer 200 (step T02 in FIG. 3), and sets this time as time T2. Store in the storage area. Then, the control unit 201 generates time reply data, which is data for reply to the time audit apparatus 100, reads the time T2 from the storage area, sets the time reply data, and immediately before sending the time reply data, the computer The time indicated by the timepiece function 200 is obtained (step T03 in FIG. 3), this is further written as time T3 in the time reply data, and the time reply data is transmitted to the time audit apparatus 100 via the communication unit 202.

  The control unit 101 of the time audit device 100 receives time reply data from the computer 200 via the communication unit 102, obtains the time indicated by the clock function of the time audit device 100, writes it in the storage area as time T4, T2 and T3 are obtained from the reply data, and these are also written in the storage area. Then, the control unit 101 reads T1, T2, T3, and T4 from the storage area, obtains ((T2-T1) + (T3-T4)) / 2, and the time indicated by the clock function of the computer 200. Then, an offset which is a difference from the time indicated by the clock function of the time audit device 100 is obtained (step S02 in FIG. 2, step S02a in FIG. 2).

  Next, the control unit 101 attempts to notify the computer 200 of time audit information including the offset calculated earlier. The control unit 101 generates an ID that is set in the time audit information. In addition, the control unit 101 reads T1, T2, T3, and T4 from the storage area to obtain a hash value to be set in the time audit information, T1 is a start time, T2 is a reception time, T3 is a transmission time, With T4 as the end time, T1 to T4 as shown in FIG. 4 and the offset calculated earlier, an integer representing each in seconds is obtained, and an ID, an integer representing T1 to T4, and an integer representing the offset are sequentially obtained. Concatenate to generate a large integer. The control unit 101 calculates a remainder obtained by dividing this large integer by a predetermined prime number to obtain a hash value (step S03 in FIG. 2).

  Next, the control unit 101 generates time audit information in the format shown in FIG. 5 from the ID, T1 to T4, the offset, and the hash value as shown in FIG. 5, and stores it in the storage area (FIG. 5). 2 step S04). The control unit 101 reads the time audit information from the storage area, attaches an electronic signature to indicate that this data is legitimate data transmitted by the time audit device 100, and is malicious during transmission to the computer 200. In order to prevent misuse of this data by a certain third party, encryption processing is performed with a predetermined secret key, and this data is transmitted to the computer 200 via the communication unit 102 (step S05 in FIG. 2).

  The control unit 201 of the computer 200 receives data from the time audit apparatus 100 via the communication unit 202, and performs a composite process on the data with a predetermined public key to obtain time audit information, which is given to the time audit information. The electronic signature is confirmed to be valid, and is written into the audit result database 204 via the data processing unit 203 (step S05a in FIG. 2). The time auditing apparatus 100 sequentially performs the same processing as the computer 200 for other customer computers such as the computer 200a and the computer 200b.

  Next, the control unit 101 of the time audit apparatus 100 sends the time audit information to the computer 200 when the computer 200 also ensures the long-term validity of the time audit information ("Yes" in step S06 in FIG. 2). After the transmission, the time audit information is read from the storage area, a link hash in the time audit information shown in FIG. 5 is generated (step S07 in FIG. 2), and the time audit information is written in the storage area.

  At this time, 1 is set for the link hash of the first time audit information. Further, the control unit 101 uses the link hash C of the second and subsequent time audit information in FIG. 5 as the link hash of the time audit information immediately before represented by C ′ and the hash of the time audit information represented by B. The remainder obtained by dividing the concatenated value by a predetermined prime number is calculated and set, and the time audit information is stored in the recording area. The control unit 101 reads the created time audit information from the storage area and writes it to the audit database 104 via the data management unit 103. The time auditing apparatus 100 is also the same as the time auditing information transmitted to the computer 200 when ensuring the long-term effectiveness for the time auditing information transmitted to the computer of another customer such as the computer 200a or the computer 200b. Perform the process.

  When the computer 200 does not ensure the validity of the time audit information for a long period of time (step S06 in FIG. 2 is “Yes”), the control unit 101 of the time audit apparatus 100 does not generate a link hash and performs short-term certification. The audit process is terminated.

<Check processing of audit results for short-term certification>
Now, the administrator of the computer 200 instructs the computer 200 to check this data in order to confirm that the time audit information stored in the audit result database 204 has not been altered or counterfeited by a malicious person. To do. The computer 200 performs processing in accordance with the processing flow shown in FIG.

  The control unit 201 of the computer 200 receives an instruction from the administrator, reads the latest time audit information from the audit result database 204 via the data management unit 203, and the control unit 201 receives the electronic signature added to the time audit information. It is confirmed that the data is valid, and it is confirmed that the data has not been tampered with and that the data is valid data transmitted by the time inspection device 100 (step S11 in FIG. 6). If there is no problem (“No” in step S12 in FIG. 6), “no problem” is displayed (step S13 in FIG. 6). The administrator confirms the display on the computer 200. When the control unit 201 detects that there is a problem from the confirmation result (step S12 in FIG. 6 is “Yes”), the control unit 201 determines that the time audit information may have been falsified or forged, The error is output and displayed on the display unit (step S14 in FIG. 6), and the administrator is warned.

<Long-term certification audit processing>
In the long-term certification audit process, a link hash for a predetermined period stored in the audit database 104 of the time audit apparatus 100 is used. Hereinafter, this predetermined period is referred to as a cycle.
The standard time distributor instructs the time audit apparatus 100 to generate a super hash that is data for ensuring the long-term validity of the time audit information for the computer of a customer including a company that owns the computer 200. . Thereafter, the time audit apparatus 100 performs processing in accordance with the processing flow of FIG. The control unit 101 of the time audit apparatus 100 receives an instruction from the standard time distributor and reads out the latest one cycle of time audit information of each customer's computer from the audit database 104 via the data management unit 103.

Next, the control unit 101 obtains one large integer by combining the link hashes of each time audit information in one cycle of time audit information for each customer, and divides this large integer by a predetermined prime number. The sub super hash which is a remainder is calculated (step U01 in FIG. 7). Here, FIG. 8 shows a calculation method in this processing. The time audit information time audit 801a for one cycle and the time audit information 801b for one cycle in FIG. 8 are time audit information for one cycle of each customer, and the time audit information 801a for one cycle, The link hash of the cycle time audit information 801b is located at the bottom of each tree. The top of the tree of the time audit information 801a for one cycle and the time audit information 801b for one cycle is a sub super hash of the time audit information for each cycle.
Further, in addition to using the highest level of the tree as the sub superhash as described above, the latest link hash may be used as the sub super hash.

  The control unit 101 stores the sub-superhash of the time audit information for each cycle in the storage area, and places the sub-superhash of the time audit information for each cycle at the bottom of the tree as shown in the tree 802 in FIG. These are combined to generate one large integer, and a super hash that is a remainder obtained by dividing the integer by a predetermined prime number is obtained (step U02 in FIG. 7). The control unit 101 generates identification information for the super hash, reads the sub super hash from the storage area, and displays the super hash, the identification information of the super hash, and the date and time when the super hash is calculated. Then, the data is written into the audit database 104 (step U03 in FIG. 7).

  Next, the control unit 101 determines the time audit report shown in FIG. 9 based on the latest one cycle of time audit information, super hash, super hash identification information, and sub super hash for each customer. Is generated (step U04 in FIG. 7). This time audit report includes the audit period, maximum offset, minimum offset, maximum network delay, minimum network delay, average offset, average network delay, and whether the results of the time audit are acceptable. , Information including the super hash, super hash identification information, a node hash in the middle of forming a super hash tree generated from the sub super hash, and whether or not the time audit information has been tampered with.

In creating the time audit report, the control unit 101 calculates the maximum offset, the minimum offset, and the average offset based on the time audit information for one cycle. The control unit 101 calculates the maximum network delay, the minimum network delay, and the average network delay based on the time Td calculated in the short-term certification audit process. Further, the control unit 101 determines whether or not the result of the time audit is acceptable depending on whether or not the average offset of each customer is within a predetermined time, and sets the determination result in the time audit report.
In addition, the control unit 101 checks the electronic signature of the time audit information in the latest one cycle of time audit information of each customer to confirm that it has not been tampered with, and further, in the time audit information for one cycle. Check the consistency between the hash value of each time audit information and the link hash to confirm that the individual data has not been tampered with, determine whether the time audit information has been tampered with, and audit the result of the judgment. Set to report.

  The control unit 101 transmits a time audit report corresponding to the computer 200 to the computer 200 via the communication unit 102 (step U05 in FIG. 7). The control unit 201 of the computer 200 receives this data from the time audit apparatus 100 via the communication unit 202 and writes it into the audit result database 204 via the data management unit 203. When the administrator of the computer 200 requests the display of the time audit report, the control unit 201 receives the request and reads the time audit report from the audit result database 204 via the data management unit 203. Output to display and display.

  In addition, the standard time distributor instructs the time audit apparatus 100 to display the calculated super hash in order to publish the super hash. The control unit 101 of the time audit apparatus 100 reads the super hash, the super hash identification information, and the date and time when the super hash is calculated from the audit database 104 via the data management unit 103, and outputs it to the display unit. indicate. The standard time distributor will publish the displayed superhash on newspapers and Internet homepages in order to publish the superhash. The administrator of the computer 200 refers to the newspaper and homepage publication, and the time audit report received by the computer 200 has the correct contents. From this, the fact that the time audit has been correctly performed will be described later. Confirm in the long-term certification audit result check process.

<Check process of audit results for long-term certification>
The administrator of the computer 200 instructs the computer 200 to check that the clock function of the computer 200 was set to the correct time today 10 years ago. Thereafter, the computer 200 performs this process according to the process flow of FIG. In response to this request, the control unit 201 of the computer 200 reads the time audit report of the date and time closest to today, 10 years ago, from the audit result database 204 via the data management unit 203, and also shows in the read time audit report. Is read from the audit result database 204 via the data management unit 203 (step V01 in FIG. 10). The control unit 201 calculates a sub super hash based on the read time audit information for one cycle (step V02 in FIG. 10). The control unit 201 calculates a super hash based on the sub super hash of the other customer in the time audit report and the sub super hash recalculated earlier (step V03 in FIG. 10), and displays this super hash. Is output and displayed (step V04 in FIG. 10). The administrator of the computer 200 compares the super hash published in a newspaper 10 years ago with the super hash displayed on the computer 200. If these are the same, the time audit report received by the computer 200 is correct. Since the time audit is correctly performed, it is recognized that the clock function of the computer 200 is set to the correct time today 10 years ago.

As described above, the embodiments of the present invention have been described in detail with reference to the drawings, but the specific configuration is not limited to these embodiments, and includes design changes and the like within a scope not departing from the gist of the present invention. It is. For example, in the long-term certification audit result check process, the computer 200 displays the recalculated superhash on its own display unit, and the administrator of the computer 200 confirms that the superhash is correct. 200 may receive the corresponding super hash from the time audit apparatus 100 via the network, and may compare and display the result. As a result, the time authenticator is not bothered to confirm the super hash.
Further, in the present embodiment, the time audit between the time audit apparatus 100 owned by the standard time distributor and the computer 200 owned by the company has been described. You may apply between time distribution companies.

It is a block diagram of the time audit system in an embodiment of the invention. It is a flowchart of the time audit system in the embodiment of the present invention. It is a figure showing the procedure of the measurement of the communication delay time of the time audit system in embodiment of this invention. It is a figure showing the process of the integer generation of the time audit system in embodiment of this invention. It is a figure showing the structure of the data of the time audit system in embodiment of this invention, and the process of a hash process. It is a flowchart of the time audit system in the embodiment of the present invention. It is a flowchart of the time audit system in the embodiment of the present invention. It is a figure showing the production | generation process of the super hash of the time audit system in embodiment of this invention. It is a figure showing the time audit report of the time audit system in embodiment of this invention. It is a flowchart of the time audit system in the embodiment of the present invention.

Explanation of symbols

100 ... Time audit device (first computer)
DESCRIPTION OF SYMBOLS 101 ... Control part 102 ... Communication part 103 ... Data management part 104 ... Audit database 200, 200a, 200b ... Computer (2nd computer)
201 ... Control unit 202 ... Communication unit 203 ... Data management unit 204 ... Audit result database 801a, 801b ... Time audit information for one cycle 802 ... Tree

Claims (5)

In a system in which a plurality of computers including a first computer and a second computer transmit and receive data via a network,
The first computer is
Transmitting a time transmission request to the second computer, receiving time reply data from the second computer, and measuring an offset that is a time difference between the clock function of the second computer and the clock function of the second computer; Measuring means for performing the measurement of the offset multiple times;
Hash value calculation means for generating time audit information that is an audit result of the clock function of the second computer based on the offset, calculating a hash value of the time audit information, and setting the time audit information in the time audit information;
Link hash calculation means for associating time audit information located before and after on the time series to perform hash calculation, obtaining a link hash and setting the link hash in the time audit information;
Transmitting means for transmitting the time audit information to the second computer,
The second computer is
Response means for receiving the time transmission request from the first computer and transmitting the time reply data to the first computer;
Receiving means for receiving the time audit information from the first computer;
And a storage means for storing the time audit information in a storage area. The first computer is
Sub super hash calculation means for calculating a hash value based on the link hash in the time audit information of the second computer to obtain a sub super hash;
A super hash calculation means for performing a hash calculation based on a plurality of sub super hashes to obtain a super hash;
A time audit report generating means for storing the super hash in a storage area, and transmitting a time audit report including the sub super hash and the super hash to the second computer;
The time audit system according to claim 1, wherein the second computer receives the time audit report from the first computer and stores it in a storage area.   The second computer reads the time audit information from a storage area, calculates a sub super hash of an earthquake, and calculates the super hash based on the sub super hash and the time audit report. The time audit system according to claim 2. In a system in which a plurality of computers including a first computer and a second computer transmit and receive data via a network,
In the first computer,
Sends a time transmission request to the second computer, receives time reply data from the second computer, and measures an offset, which is a time difference between its own clock function and the clock function of the second computer, a plurality of times Processing to
Processing for generating time audit information that is an audit result of the clock function of the second computer for each offset, calculating a hash value of the time audit information, and setting the time audit information;
A process of associating time audit information positioned before and after on the time series to perform a hash calculation, obtaining a link hash and setting the link hash in the time audit information;
Processing for transmitting the time audit information to the second computer;
A program for running In a system in which a plurality of computers including a first computer and a second computer transmit and receive data via a network,
In the second computer,
Receiving the time transmission request from the first computer and transmitting the time reply data to the first computer;
Processing for receiving time audit information as a check result of its own clock function from the first computer and storing it in a storage area;
A program for running

Images