JP2017111549A - Information processing device, information processing method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To detect alteration on the basis of meta-information on a file and restore an original file if alteration is detected.SOLUTION: A file name of an original file is stored in association with a hash value and meta-information on the original file. A hash value and meta-information on a verification object file are obtained, the stored hash value and meta-information are compared with the obtained hash value and meta-information, and thereby alteration of the verification object file is detected. If alteration is detected, the original file is transmitted.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an information processing apparatus, an information processing method, and a program.

  As a method of verifying the authenticity of a file, there is a method of verifying authenticity by calculating a hash value of an original file and storing it in a storage device and comparing it with a hash value of a target file.

  However, as a result of verifying the authenticity, even if it is detected that the image has been tampered with, there is no logical means for guaranteeing the authenticity of the restoration method.

  Japanese Patent Application Laid-Open No. 2004-133620 describes a mechanism that enables a restoration using a backup file stored in a storage device when hash values do not match as a restoration method.

Japanese Patent Laid-Open No. 2003-22009

  It is easy to change only the file name while keeping the same contents. Therefore, if the verification of authenticity is a method of comparing the file name with a hash value stored using the key as a key, there is a problem that the verification itself cannot be performed if the file name changes.

  Even if a backup file is stored in the storage device using the hash value itself as a key, the hash value changes when the file is tampered with, so that the backup file itself is not stored and can be restored. It will disappear.

  Accordingly, an object of the present invention is to provide a mechanism that can restore an original file when tampering is detected by using meta information of the file.

  The information processing apparatus according to the present invention includes a storage unit that stores the hash value and meta information of the original file in association with the file name of the original file, and an acquisition unit that acquires the hash value and meta information of the verification target file And a detection means for detecting falsification of the verification target file by comparing the hash value and meta information stored in the storage means with the hash value and meta information acquired by the acquisition means. It is characterized by.

  The information processing method of the present invention is an information processing method in an information processing apparatus that stores a hash value and meta information of an original file in association with a file name of the original file. Means for acquiring the hash value and meta information of the verification target file; and the stored hash value and meta information, and the hash value and meta information acquired by the detecting means of the information processing apparatus in the acquisition step. And a detection step of detecting falsification of the verification target file by comparing with the information.

  The program of the present invention is a program that can be executed in an information processing apparatus that stores the hash value and meta information of the original file in association with the file name of the original file, and verifies the information processing apparatus. The verification unit obtains the hash value and meta information of the target file by comparing the hash value and meta information stored in the storage unit with the hash value and meta information acquired by the acquisition unit. It is made to function as a detection means for detecting falsification of a target file.

  According to the present invention, it is possible to restore an original file when tampering is detected by using meta information of the file.

It is a system configuration figure showing the composition of the system of the present invention. It is a figure which shows the flow of the file and meta information of this invention. The figure which shows the hardware constitutions of the information processing apparatus 101, the original file registration terminal 102, and the file verification terminal 103. It is a flowchart which shows an example of registration and storage of the original file of this invention. It is a flowchart which shows an example of the verification method and restoration method of a file of this invention. It is a flowchart which shows an example of the processing method regarding the decompression | restoration of this invention. It is a figure which shows an example of the item of the database used by this invention. It is a figure which shows an example of the extension which can acquire meta-information by this invention. It is a figure which shows an example which defined the data position of the file handled as 2nd meta information by this invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
FIG. 1 is a diagram showing a system configuration of the present invention.

  The system according to the present invention includes an information processing apparatus 101, an original file registration terminal 102, and a file verification terminal 103.

  The original file registration terminal 102 and the information processing apparatus 101 can communicate with each other, and the file verification terminal 103 and the information processing apparatus 101 can communicate with each other. The original file registration terminal 102 and the file verification terminal 103 may or may not be able to communicate with each other.

  In this embodiment, the information processing apparatus 101 is described as calculating a hash value and acquiring meta information. However, these processes may be performed by the original file registration terminal 102 or the file verification terminal 103. .

  Specifically, when transmitting a file to the information processing apparatus 101, the original file registration terminal 102 calculates a hash value of the file, and further extracts corresponding meta information from the extension of the file. Also, the file contents are extracted at appropriate positions (front and back) and length and encoded (characterized) to form second meta information. The information processing apparatus uses these information and the original file name as a hash value as a key. 101 is registered in the database on 101. A copy of the file is stored on the information processing apparatus 101.

  The file verification terminal 103 calculates the hash value of the target file to be verified by the same method as the original file registration terminal 102, and verifies whether the calculated hash value is registered in the database on the information processing apparatus 101. If it does not exist in the database on the information processing apparatus 101, the meta information and the second meta information of the target file are acquired by the same method as that of the original file registration terminal 102 described above. The obtained meta information is used as a database search key on the information processing apparatus 101 to verify the existence of the same meta information. If the meta information exists, it is determined that the target file has been tampered with and the original file exists on the information processing apparatus 101. The original is restored by copying the original file on the information processing apparatus 101 to the file verification terminal 103 from the original file name stored together with the meta information.

  FIG. 2 is a block diagram showing an example of the hardware configuration of the information processing apparatus 101, the original file registration terminal 102, and the file verification terminal 103 according to the embodiment of the present invention.

  As shown in FIG. 2, in the information processing apparatus 101, a CPU (Central Processing Unit) 201, a ROM (Read Only Memory) 202, a RAM (Random Access Memory) 203, a storage device 204, and an input controller 205 are connected via a system bus 200. , An audio input controller 206, a video controller 207, a memory controller 208, and a communication I / F controller 209 are connected.

  The CPU 201 comprehensively controls each device and controller connected to the system bus 200.

  The ROM 202 or the storage device 204 is a control program executed by the CPU 201 such as a basic input / output system (BIOS) or an operating system (OS), a computer-readable program for realizing this information processing method, and various necessary programs. Holds data (including data table).

  The RAM 203 functions as a main memory, work area, and the like for the CPU 201. The CPU 201 implements various operations by loading a program or the like necessary for executing the processing from the ROM 202 or the storage device 204 to the RAM 203 and executing the loaded program.

  The input controller 205 controls input from an input device such as a keyboard / touch panel 210. The input device is not limited to this, and may be a touch panel capable of detecting a position touched by a plurality of fingers, such as a mouse or a multi-touch screen.

  Various instructions can be performed when the user presses (touches with a finger or the like) in accordance with an icon, a cursor, or a button displayed on the touch panel.

  This input device is used to input a destination for a communication destination that can be used by various communication devices.

  The voice input controller 206 controls input from the microphone 211. Voice input from the microphone 211 can be recognized.

  The video controller 207 controls display on an external output device such as the display 212. The display includes a display of a notebook computer integrated with the main body. The external output device is not limited to a display, and may be a projector, for example. Further, for devices that can be received by the touch operation described above, it is also possible to receive input from the keyboard / touch panel 210.

  Note that the video controller 207 can control a video memory (VRAM) for display control, and a part of the RAM 203 can be used as a video memory area, or a dedicated video memory can be provided separately. Is possible.

  In the present invention, the first video memory area used for display when the user normally uses the information processing apparatus and the display overlaid on the display content of the first video memory area when a predetermined screen is displayed. A second video memory area used in The number of video memory areas is not limited to two, and a plurality of video memory areas can be provided as long as the resources of the information processing apparatus permit.

  The memory controller 208 controls access to the external memory 213. The external memory is connected via an adapter to an external storage device (hard disk), flexible disk (FD), or PCMCIA card slot that stores boot programs, various applications, font data, user files, editing files, and various data. A compact flash (registered trademark) memory or the like can be used.

  The communication I / F controller 209 is connected to and communicates with an external device via the network 214, and executes communication control processing in the network. For example, communication using TCP / IP, telephone lines such as ISDN, and communication using 3G lines of mobile phones are possible.

  The storage device 204 is a medium for permanently storing information, and the form is not limited to a storage device such as a hard disk. For example, a medium such as SSD (Solid State Drive) may be used.

  It can also be used as a temporary memory area during various processes performed by the communication terminal in the present embodiment.

  FIG. 3 is a diagram showing the flow of files and meta information. The original file is sent from the original file registration terminal 102 to the information processing apparatus 101 via the network 110. At that time, the information processing apparatus 101 stores the original file in the disk device, calculates the hash value, and acquires the meta information.

  The calculated hash value and meta information, and the file name of the stored original file are registered in the database.

  First, the verification target file is sent from the file verification terminal 103 to the information processing apparatus 101 via the network 110. Then, the hash value of the verification target file is calculated and the meta information is acquired on the information processing apparatus 101.

  When the hash value of the verification target file exists in the database 302, a result indicating that it is the same as the original is returned to the file verification terminal 103. If the hash value of the file to be verified does not exist in the database and the meta information of the file to be verified exists in the database, the result indicating that the original has been tampered with and the file name associated with the meta information in the database are acquired. Together with the stored file to the file verification terminal 103.

  When the hash value of the verification target file does not exist in the database 302 and the meta information of the verification target file does not exist in the database, a result that the verification target file does not exist in the information processing apparatus 101 is returned to the file verification terminal 103. .

  When the hash value of the verification target file does not exist in the database and a part of the meta information of the verification target file exists, a list of file names estimated to be the original file is returned to the file verification terminal 103.

  Next, the original file registration process will be described with reference to FIG.

  The process shown in the flowchart of FIG. 4 is a process in which the CPU 201 of the information processing apparatus 101 reads and executes a predetermined control program.

  In step S <b> 401, the CPU 201 of the information processing apparatus 101 receives and stores the original file transmitted from the original file registration terminal 102. At that time, the original file is stored without changing the file creation date and time. The file name is the same as the original file.

  In step S402, the CPU 201 of the information processing apparatus 101 calculates the hash value of the original file acquired in step S401, and stores the hash value and the file name in association with each other in the database.

  In step S403, the CPU 201 of the information processing apparatus 101 determines whether the extension of the original file received in step S401 is an extension registered in the extension table (FIG. 8).

  If it is a registered extension (step S403: YES), the process proceeds to step S404.

  If the extension is not registered (step S403: NO), the process proceeds to step S405.

  In step S404, the CPU 201 of the information processing apparatus 101 acquires meta information recorded in association with the extension of the original file from the extension table. Then, the acquired meta information is stored in association with the file name of the original file.

  In step S405, if the data size of the original file acquired in step S401 is less than the minimum file size registered in the table shown in FIG. 9, the CPU 201 of the information processing apparatus 101 encodes the content of the original file itself. The second meta information is registered in association with the file name.

  If it is larger than the minimum file size, the front and rear data of the file contents are read according to the definition contents of FIG. 9, encoded, and registered as second meta information in association with the file name.

Through the above processing, the original file data is registered in the information processing apparatus 101.
Next, the falsification verification process will be described with reference to FIG.

  5 is a process in which the CPU 201 of the information processing apparatus 101 reads and executes a predetermined control program.

  In step S <b> 501, the CPU 201 of the information processing apparatus 101 receives the verification target file transmitted from the file verification terminal 103.

  In step S502, the CPU 201 of the information processing apparatus 101 calculates the hash value of the verification target file received in step S501. Here, the method of calculating the hash value is the same as the method of calculating the hash value of the original file in step S402.

  In step S503, the CPU 201 of the information processing apparatus 101 searches the database using the hash value calculated in step S502 as a key.

  In step S504, the CPU 201 of the information processing apparatus 101 determines whether a file having the same hash value as the hash value calculated in step S502 exists as a result of the search in step S503.

  That is, the case where it exists means that the verification target file is not falsified and has the same content as the original file.

  The case where it does not exist means that the file has been altered or the original file has not been registered.

  If it exists (step S504: YES), the process proceeds to step S510.

  If it does not exist (step S504: NO), the process proceeds to step S505.

  In step S510, the CPU 201 of the information processing apparatus 101 transmits to the file verification terminal 103 that the verification target file is the same as the original file (not tampered).

  In step S505, the CPU 201 of the information processing apparatus 101 performs processing for acquiring the meta information of the verification target file received in step S501 and searching the database using the meta information.

  Details of this processing will be described with reference to the flowchart of FIG.

  In step S506, the CPU 201 of the information processing apparatus 101 determines whether a file with matching meta information is found as a result of the search in step S505.

  If a file that matches all the meta information is found (step S506: YES), the process proceeds to step S511. That is, this is a case where it can be said that tampering has been detected since the meta information matches even though the hash values are different.

  When a file with all matching meta information is not found (step S506: NO), the process proceeds to step S507.

  In step S <b> 511, the CPU 201 of the information processing apparatus 101 transmits to the file verification terminal 103 an original file whose meta information matches the result that the verification target file has been falsified.

  In step S507, the CPU 201 of the information processing apparatus 101 determines whether there is a file that matches even one piece of meta information.

  If there is at least one file with the matching meta information (step S507: NO), the process proceeds to step S508.

  If even one file does not have the same meta information (step S507: YES), the process proceeds to step S512.

  In step S512, the CPU 201 of the information processing apparatus 101 transmits a result indicating that the verification target file is not registered in the database to the file verification terminal 103.

  In step S508, the CPU 201 of the information processing apparatus 101 creates a file name list of files whose meta information partially matches.

  In step S509, the CPU 201 of the information processing apparatus 101 transmits the file name list created in step S508 to the file verification terminal 103.

  Next, details of the processing in step S505 will be described with reference to FIG.

  In step S601, the CPU 201 of the information processing apparatus 101 determines whether the extension of the verification target file acquired in step S501 is an extension registered in the extension table illustrated in FIG.

  If the extension is registered (step S601: YES), the process proceeds to step S602.

  If the extension is not registered (step S601: NO), the process proceeds to step S603.

  In step S602, the CPU 201 of the information processing apparatus 101 acquires meta information associated with the extension of the verification target file.

  In step S603, if the data size of the verification target file is less than the minimum file size in FIG. 9, the CPU 201 of the information processing apparatus 101 encodes the file content itself in the same manner as in step S405 and obtains it as second meta information. To do.

  If the data size of the verification target file is larger than the minimum file size, the front and rear data of the file contents are read according to the definition contents of FIG. 9 and encoded by the same method as in S405 to obtain second meta information.

  In step S604, the CPU 201 of the information processing apparatus 101 searches the database based on the meta information and the second meta information acquired in steps S602 and S603.

  In step S605, the CPU 201 of the information processing apparatus 101 determines whether there is a file that completely matches the meta information and the second meta information as a result of the search in step S604.

When it exists, the process of this flowchart is complete | finished and it transfers to the process of step S506.
If not, the process proceeds to step S606.

  In step S606, the CPU 201 of the information processing apparatus 101 determines whether the search result in step S604 did not match the meta information and the second meta information at all. If the results do not match at all (step S606: YES), the process of this flowchart is terminated, and the process proceeds to step S506.

  In step S607, when part of the meta information or the second meta information matches, the CPU 201 of the information processing apparatus 101 extracts all the original file names associated with the matched meta information or the second meta information. Then, the process proceeds to step S506.

  FIG. 7 is a diagram illustrating data items registered in the database of the information processing apparatus 101. As shown in FIG. 7, hash value, file name, file type, file creation date, meta information 1,..., Meta information n, start data start position, second meta information (forward data), backward data start position, It consists of items such as second meta information (rear data).

  In the data table of FIG. 7, the hash value, file name, file type, and file creation date and time are registered in step S402. In S404, meta information 1,..., Meta information n are registered, and in S405, the start data start position, second meta information (forward data), backward data start position, and second meta information (rear data) are registered. .

  FIG. 8 is an example of a list of extensions from which meta information can be acquired, and is an example of a data table stored in the database of the information processing apparatus 101.

  In association with the extension, an item of meta information acquired from the file with the extension is registered.

FIG. 9 shows an example of the position where the content of the file acquired as the second meta information is acquired, and is a data table stored in the database in units of extensions.

  Moreover, the program in this invention is a program which makes a computer perform the process of FIGS. The program in the present invention may be a program for each process in FIGS.

  As described above, a recording medium that records a program that implements the functions of the above-described embodiments is supplied to a system or apparatus, and a computer (or CPU or MPU) of the system or apparatus stores the program stored in the recording medium. It goes without saying that the object of the present invention can also be achieved by reading and executing.

  In this case, the program itself read from the recording medium realizes the novel function of the present invention, and the recording medium recording the program constitutes the present invention.

  As a recording medium for supplying the program, for example, a flexible disk, hard disk, optical disk, magneto-optical disk, CD-ROM, CD-R, DVD-ROM, magnetic tape, nonvolatile memory card, ROM, EEPROM, silicon A disk or the like can be used.

  Further, by executing the program read by the computer, not only the functions of the above-described embodiments are realized, but also an OS (operating system) operating on the computer based on an instruction of the program is actually It goes without saying that a case where the function of the above-described embodiment is realized by performing part or all of the processing and the processing is included.

  Furthermore, after the program read from the recording medium is written to the memory provided in the function expansion board inserted into the computer or the function expansion unit connected to the computer, the function expansion board is based on the instructions of the program code. It goes without saying that the case where the CPU or the like provided in the function expansion unit performs part or all of the actual processing and the functions of the above-described embodiments are realized by the processing.

  The present invention may be applied to a system constituted by a plurality of devices or an apparatus constituted by a single device. Needless to say, the present invention can be applied to a case where the present invention is achieved by supplying a program to a system or apparatus. In this case, by reading a recording medium storing a program for achieving the present invention into the system or apparatus, the system or apparatus can enjoy the effects of the present invention.

  Furthermore, by downloading and reading a program for achieving the present invention from a server, database, etc. on a network using a communication program, the system or apparatus can enjoy the effects of the present invention. In addition, all the structures which combined each embodiment mentioned above and its modification are also included in this invention.

101 Information processing apparatus 102 Original file registration terminal 103 File verification terminal 110 Network

Claims (6)

Storage means for storing the hash value and meta information of the original file in association with the file name of the original file;
An acquisition means for acquiring a hash value and meta information of a file to be verified;
Detecting means for detecting falsification of the verification target file by comparing the hash value and meta information stored in the storage means with the hash value and meta information acquired by the acquiring means;
An information processing apparatus comprising:   2. The information processing apparatus according to claim 1, further comprising notification means for notifying a file name of an original file that is a source of the verification target file when tampering is detected by the detection means.   The information processing apparatus according to claim 1, further comprising: a transmission unit configured to transmit an original file that is a source of the verification target file when the detection unit detects falsification.   The file name of the original file in which the hash value stored in the storage unit is different from the hash value acquired by the acquisition unit, and the meta information stored in the storage unit and the meta information acquired by the acquisition unit match. The information processing apparatus according to any one of claims 1 to 3, further comprising a file name notifying unit for notifying. An information processing method in an information processing apparatus that stores a hash value and meta information of an original file in association with a file name of the original file,
An acquisition step in which the acquisition unit of the information processing apparatus acquires a hash value and meta information of a verification target file;
A detection step in which the detection means of the information processing device detects the alteration of the verification target file by comparing the stored hash value and meta information with the hash value and meta information acquired in the acquisition step; ,
An information processing method comprising: A program that can be executed in an information processing apparatus that stores a hash value and meta information of an original file in association with the file name of the original file,
The information processing apparatus;
An acquisition means for acquiring a hash value and meta information of a file to be verified;
A program that functions as a detection unit that detects falsification of the verification target file by comparing the stored hash value and meta information with the hash value and meta information acquired by the acquisition unit.

Images