JP3905170B2 - Processing system and client device - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a security technology for information processing in an environment in which a large number of distributed computers are connected via a network, and in particular, in a multi-agent information processing by a mobile code, the mobile code is executed when the mobile code is executed. The present invention relates to a mobile code execution system that guarantees that unauthorized processing will not be performed.
[0002]
With the development of personal computers and the development of computer network technology, a large computer is used as the main host, and a terminal is hung from the central processing system that relies on the main host for all information processing. The mainstream is a client-server system in which a computer server using a plurality of supercomputers installed on a network and a database server using a computer having a large-scale storage device are appropriately selected to perform desired information processing. It is coming.
[0003]
Furthermore, as a technology trend of computer networks around the world, the Internet, which is a network of networks formed by connecting individual computer networks, is rapidly expanded by using open standards to overcome the boundaries of computers and communication media used. is doing. Not only in terms of scale, but also in terms of usage, it has expanded from experts to the general public, and the Internet has transcended existing frameworks such as companies and countries, and has become a computer network with a global spread. It continues to grow. In addition, intranets that limit the scope of use to a specific organization while taking over the flexibility and convenience of the Internet have recently become widespread.
[0004]
With the expansion of both the size and use of the Internet / Intranet, the relationship between the client and server has changed from a limited range of closed and fixed to everything existing on the network. It has become desirable to evolve into something that can be freely connected and used accordingly. This necessitated an interface that was not tied to available platforms. In addition, as the number of users increases from a limited number of specialists to the general public, a high-level service is provided so that different types of servers on multiple networks can be integrated and handled with a simple interface. Is now required. In order to meet these demands, attention has been paid to a multi-agent method in which an accessing agent realizes advanced information processing by exchanging messages with an agent managing each server.
[0005]
Also, with the widespread use of mobile devices, it is not necessary to respond to cases where the network is not always connected to the network, or to exchange messages with ready-made agents on the server side, but to send advanced agents and flexible information processing from here. For this purpose, a mobile code (mobile agent) system in which the agent itself moves on the network is regarded as a part of the multi-agent system.
[0006]
[Prior art]
The multi-agent system is implemented as follows.
That is, at least one engine (shell, interpreter, etc.) that manages the generation / extinction of agents and communication between agents is placed on each computer. Each agent is given an entity such as a process or a thread so as to function independently of each other and exchange messages with each other. Each agent entity may exist in the engine process or may be a process independent of the engine. Message exchange with an agent on another computer on the network uses TCP (Transmission Control Protocol) or UDP (User Datagram Protocol), etc., indirectly via the engine, or between agents using the engine as an intermediary. Done directly.
[0007]
In the mobile code system, the code of the agent to be executed is transmitted as a message from one computer, and the code is executed by the received computer. Therefore, in general, it is not implemented to directly execute the sent code on the computer system, and the engine executes an interpreter or byte code for executing the code. An implementation as a virtual machine is taken. This is done for the purpose of abstracting the multi-platform and ensuring the security of the computer system described later.
[0008]
In an environment where computers are distributed on a network, especially the Internet, which has a worldwide spread, as a flip side of its flexibility and convenience, who, what, where, by what means, what There are endless possibilities (risks) about what you can do and what you do and the consequences of the consequences. Therefore, it is necessary to restrict access by malicious or carelessness. To achieve this, at the network level, a firewall using an access control computer is installed at the entrance to a network within a limited range, and restrictions are placed on the type of communication destination network and communication protocol. Things have been done.
[0009]
In addition, at the multi-agent engine level, in order to limit the disclosure range and prevent the system from becoming inoperable due to excessive occupation, limit the range, amount, and occupation time of accessible resources, and to computer viruses and other systems In order to prevent unauthorized access, the computer system is always indirectly accessed, or code verification is performed before the mobile code is executed.
[0010]
In addition, due to its mechanism, the Internet generally does not know what route it passes through, and there is a possibility that a malicious third party may impersonate the original party as eavesdropping / falsification of communication data on the route There is sex. In order to prevent this, technologies such as encryption of communication contents and digital signatures for ensuring that the other party applying encryption technology is not authenticated or altered are used. Specifically, there are Kerberos using private key encryption, PEM (Privacy-Enhanced Mail) using public key / private key encryption, PGP (Pretty Good Privacy), and the like.
[0011]
[Problems to be solved by the invention]
As mobile code itself becomes highly functional, protection as a target for securing intellectual property rights is required. In addition, mobile codes are sent to the network in a form accompanied by data, and by exchanging messages with multiple service servers on the network, data can be retrieved and processed one after another. obtain. In that case, since the service server on the network is not always reliable, it is necessary to prevent reading of data that is not necessary for data processing, and data obtained from one service server is kept secret from other service servers. It may be necessary.
[0012]
However, the conventional security technology aims to protect data and systems in the network from unauthorized external access and the like, and the protection relating to the mobile code to be transmitted is not sufficient. There was an engine that made the server providing the service one of the agents so that the contents of the mobile code could not be illegally peeked from the server, but verify that the engine really has the restriction function There was no means.
[0013]
[Means for Solving the Problems]
The present invention solves this problem by using the following processing system and client device.
(1) Consists of a client that requests processing and a server that includes an engine that executes processing requested by the client.
The server
A one-way function calculation unit that performs a calculation process using a one-way function with the engine code of the engine as an input;
In response to a verification instruction from the client, a verification agent agent means for returning the calculation result of the one-way function calculation unit to the client is provided,
The client
It is possible to perform calculation processing by the same one-way function as the one-way function calculation unit of the server,
Regarding the processing request to the server, the server sends a verification request for the engine code to the server, and then receives the calculation result from the server, and inputs the same data as the valid engine code of the server. A verification agent means for checking the calculation processing result by the one-way function and transmitting the processing request to the server if it matches,
A processing system characterized by that.
(2) an engine that executes a process requested by a client, a one-way function calculation unit that performs a calculation process using a one-way function with the engine code of the engine as an input, and according to a verification instruction from the client, A client device that requests processing to a server having a verification agent agent unit that returns a calculation result of a one-way function calculation unit to the client,
It is possible to perform calculation processing by the same one-way function as the one-way function calculation unit of the server,
Regarding the processing request to the server, the server sends a verification request for the engine code to the server, and then receives the calculation result from the server, and inputs the same data as the valid engine code of the server. A client apparatus comprising: verification agent means for checking the calculation processing result by the one-way function and transmitting the processing request to the server if they match.
(3) A client that requests processing and a server that includes an engine that performs processing requested by the client.
The server
A one-way function calculation unit that performs a calculation process using a one-way function with the engine code of the engine as an input;
In response to a decryption request to be described later, it is checked whether or not encrypted data to be described later can be decrypted by the calculation result of the one-way function calculation unit, and if it can be decrypted, the contents are executed by the engine. And a verification means,
The client
The processing request to the server includes data encrypted so that the server can decrypt it with the calculation result of the one-way function calculation unit for the valid engine code, and a decryption request thereof A decryption data transmission means for generating the decryption data and transmitting it to the server,
A processing system characterized by that.
[0014]
The engine has a management device for managing access to resources such as memory used by each agent so that other agents cannot access areas that are not explicitly permitted by each agent.
[0015]
FIG. 1 is a principle configuration diagram of the present invention.
In FIG. 1, reference numeral 1 denotes an engine with an illegal read / rewrite prohibition function according to the present invention, and reference numeral 2 denotes a proxy verification apparatus for the engine according to the present invention. Reference numeral 3 denotes a client-side system that requests a service. Reference numeral 4 denotes a server-side engine that realizes the engine 1 with an illegal read / rewrite prohibition function. Reference numeral 5 denotes a resource such as a memory provided in the server side engine 4. Reference numeral 6 denotes an access management apparatus for managing access to the resource 5, 7 to 8 are agents operating using the resource 5, 7 is a server agent, and 8 and 8 'are other agents. Reference numerals 9 to 13 constitute a proxy verification apparatus 2 for verifying the legitimacy of the engine. Reference numeral 9 denotes a verification proxy agent operating on the server side engine 4. Reference numeral 10 denotes an interface unit in the engine. Reference numeral 11 denotes an engine code reading unit existing on primary storage or secondary storage outside the engine, 12 is a reading pattern storage unit for storing a pattern for designating an address of data read from the engine code, and 13 is an engine. This is a one-way function calculation unit that performs a function calculation using the engine code data read from the code reading unit 11 as an input and outputs a fixed-length integer value.
[0016]
The client side system 3 has the following two configurations. One is that an agent that verifies the validity of the server-side engine operates on the client-side engine. The other is that the mobile code itself has the encrypted original execution code and the brought-in data, and further verifies the validity of the engine and the encrypted code after the verification. There is a code of an agent for performing decoding and the like and executing the code. In either case, the server side engine code information is stored on the client side.
[0017]
The mobile code system transmits an execution code and bring-in data to be protected from unauthorized reading / rewriting to a computer on which a server to be used is operating. Therefore, the security of the mobile code must be ensured in the engine in which the mobile code is executed. However, in general, the server side engine 4 is not under the management of the client side system 3. Therefore, in the present invention, the server-side engine 4 is used that makes unauthorized reading and rewriting impossible, and from the client side, it is possible to verify whether the server-side engine is valid, The security of the mobile code sent from the client side is secured.
[0018]
The server-side engine 4 performs access management of resources 5 such as memory used by each agent during execution so that other agents cannot access areas that are not explicitly permitted by each agent. Inside. A server that provides a service implements the service as one of the agents. Then, it becomes impossible to read / write data other than those explicitly specified by the mobile code from each service of the server.
[0019]
On the server-side engine 4, a verification proxy agent 9 that operates as a proxy for verifying the validity of the engine 4 operates. The verification agent 9 is operated by the engine code reading unit 11 outside the engine and the one-way function calculation unit 13 via the interface unit 10 in the engine 4 according to the request message of the verification agent on the client side. Get an integer value that depends on the node and return that integer value to the client's validation agent. Here, the one-way function is also called a secure hash function / Messge Digest function, and specifically includes MD4, MD5, SHA, checksum CRC, and the like. The one-way function has the following properties.
[0020]
1. Outputs a fixed-length integer value by inputting an arbitrary byte string
2. Difficult to find inputs that give the same output
3. Difficult to define inverse function
When the engine code is rewritten to realize illegal processing, the integer value output by the one-way function is different from that in the original engine code, so that rewriting can be detected. Of course, the same value can be coincidentally, but if the integer value is sufficiently large, the probability is practically acceptable. In addition, since it is difficult to find an input that gives the same output, it is difficult to perform additional rewriting to match the rewritten engine code to avoid detection of rewriting. Here, from the viewpoint of security on the server side, what the server side provides to the client side is not limited as it is, but only a meaningless integer value. The integer value is meaningful only when the client knows the contents of the engine code. In other words, for the server side, verification is possible by providing a minimum amount of information.
[0021]
The client-side verification agent checks whether the integer value corresponding to the engine code is a correct value, and verifies that the server-side engine has not been rewritten, that is, is a valid engine.
[0022]
When an agent that verifies the validity of the server-side engine 4 is operating on the client-side engine, security is ensured by transmitting a mobile code only after the verification is completed.
[0023]
If the mobile code itself includes an agent code for verifying the validity of the server-side engine 4, the original execution code and the brought-in data are encrypted and used as the brought-in data. In this encryption, an integer value when a valid engine code is input to the one-way function can be decrypted using a key. When the mobile code first reaches the server-side engine 4, it exchanges messages with the server-side verification agent 9 to receive an integer value when the server-side engine is input to the one-way function. Using the integer value as a key, the encrypted original execution code and the brought-in data are decrypted, and the original agent is operated on the server-side engine 4 to ensure security.
[0024]
Next, an engine validity verification method using the read pattern and the one-way function in the configuration of FIG. 1 will be described with reference to FIGS.
FIG. 2A shows an example of an engine code represented by a plurality of bytes. FIG. 2B shows an example of a read pattern given to such an engine code. The read pattern has the number of bits corresponding to the number of bytes of the engine code, and the sequential bit position is associated with the sequential byte data of the engine code. Therefore, when the engine code is stored in a byte-structured memory, each bit of the read pattern corresponds to a sequential address in the memory.
[0025]
The read pattern is generated based on, for example, a random number. As shown in FIG. 2B, the read pattern is such that only the byte data at the address corresponding to the bit position having the value “1” is read from the memory, and a small number depending on the read pattern is read from the engine code. Extract data.
[0026]
FIG. 3 shows the function of the one-way function. Data read according to the read pattern in FIG. 2 is input to a one-way function and converted into a fixed-length output integer having a value depending on the input data.
[0027]
As shown in FIG. 4, the engine code of the server side engine to be verified is also held on the client side. On the client side, a read pattern is generated, data is extracted from the engine code held by itself, and input to a one-way function to create a client-side output integer. On the other hand, data is extracted from the engine code executed on the server side using the same read pattern, and a server-side output integer is created by a one-way function. The client-side output integer and server-side output integer obtained in this way are compared, and if a match is obtained as shown, the server-side engine is determined to be valid.
[0028]
On the other hand, as shown in FIG. 5, when a part of the server side engine code is rewritten for the purpose of illegal processing, the client side output obtained even if the same processing as in FIG. 4 is performed. The integer and the server-side output integer do not match, and it is determined that the server-side engine code is invalid.
[0029]
DETAILED DESCRIPTION OF THE INVENTION
FIG. 6 is an explanatory diagram showing the execution of mobile code and mobile code on the Internet to which the present invention is applicable. As shown in the figure, a mobile code transmitted from a computer engine moves between computer engines distributed on the Internet, and processes necessary data while exchanging messages with sequential server agents.
[0030]
FIG. 7 is an explanatory diagram showing a configuration example of a system in which a verification agent operates in a client-side engine. In FIG. 7, elements common to the components in the system shown in FIG. 1 are denoted by the same reference numerals. The elements newly shown in FIG. 7 are 14 to 16, 14 is an engine of the client side system, 15 is a verification agent operating on the engine 14, and 16 is a mobile code transmitted from the engine 14.
[0031]
Instead of reading all of the engine code, only the data at the address specified by the read pattern in the engine code is read. Therefore, it is possible to improve the level of security as follows by arbitrarily designating the read pattern at the time of a verification request from the verification agent 15 operating on the engine 14 on the client side.
[0032]
In other words, since it is necessary for the server side to read the engine code and calculate a one-way function for each verification request from the client side, it is impossible to use a legitimate engine at first and an unauthorized engine from the next. . Even if a third party eavesdrops on the contents of the message exchange for engine verification between the client and the server, if the same read pattern is not used again, there is only a meaningless pattern / number pair. Further, as a secondary effect, it is not necessary to read out all of the engine code, so that the time cost for verification can be reduced.
[0033]
There are two methods of using this read pattern: when the verification is performed on the client side engine and when the verification is performed on the server side engine, the effectiveness does not change in either case.
[0034]
The operation when the verification of FIG. 7 is performed on the engine on the client side will be described with reference to the control flow of FIG.
In the system configuration of FIG. 7, a verification agent 15 that verifies the validity of the server-side engine is operated on the client-side engine 14, and before the mobile code is transmitted to the engine 4 on which the server to be used operates. Then, verify the legitimacy of the engine at the other end. First, an engine verification request message is transmitted from the client-side verification agent 15 to the server-side verification agent 9 (1). Here, when the read pattern is used, the pattern is also transmitted. The server-side verification agent 9 obtains an integer value depending on the engine code in the engine code reading unit 11 and the one-way function calculation unit 13 outside the engine via the interface unit 10 in the engine 4, and the integer value Is returned to the verification agent on the client side (2). The advantage of this system configuration is that it is not necessary to transmit (3) the mobile code 16 until the verification of the partner engine is completed, thereby reducing the chances of unauthorized reading and rewriting during transmission and at the transmission destination. is there. Another advantage is that there are few restrictions on the resources used when creating a verification agent.
[0035]
In this way, when the verification agent 15 for verifying the validity of the server-side engine is operated on the client-side engine 14 to exchange messages for engine verification with the server-side verification agent 9. In exchange of these messages, mutual authentication, electronic signature of the message, and encryption may be performed. Then, after verifying the authenticity of the verification request message from the client side, the verification agent on the server side starts the verification procedure to prevent leakage of unnecessary information, and false verification request messages are frequently used due to malicious intent. It is possible to avoid an engine overload state on the server side when is transmitted. In addition, since the client side confirms the authenticity of the integer value message for verification from the server side, it is possible to prevent the verification from being disturbed by a third party's false or falsified message transmission.
[0036]
Next, the case where the verification agent is operated on the engine on the server side will be described.
FIG. 9 shows an example of a mobile code transmitted from the client side to the engine on which the server to be used is operating in this case. The mobile code is composed of an execution code portion and a bring-in code portion.
[0037]
The execution code portion stores engine verification agent code that verifies the validity of the engine, decrypts the encrypted code after verification, and executes the code. In the bring-in data portion, an encrypted original execution code and its bring-in data are stored. The encryption is performed so that an integer value obtained by inputting the engine code into the one-way function can be decrypted as a key. When the mobile code reaches the server side engine, the engine verification agent is activated. As shown in the control flow in FIG. 10, the engine verification agent first transmits a verification request message to the verification proxy agent. Here, when the read pattern is used, the pattern is also transmitted. The verification agent 9 obtains an integer value depending on the engine code in the engine code reading unit and the one-way function calculation unit outside the engine via the interface unit 10 in the engine, and returns the integer value to the verification agent. Using the integer value as a key, the verification agent decrypts the execution code of the agent to be started on this engine in the bring-in data and the bring-in data, and starts up on this engine. The advantage of this system configuration is that since the exchange of messages for verification is performed locally on the server-side engine, there is a low possibility that unauthorized reading or rewriting will be performed by a third party.
[0038]
In this way, when the verification agent is operated on the server-side engine, the original execution code and its execution code are sent as bring-in data of the mobile code to be transmitted from the client side to the engine on which the server to be used is operating. In the case of a system in which data is encrypted and stored and decrypted using the integer value obtained by inputting the engine code obtained from the verification agent as a one-way function as a key, the server A unique key is added for each encryption. When the public key is used for encryption and the data obtained from the server is newly brought into the data, as shown in FIG. 11, the public key encryption of the client or the server that needs to use the data in the middle is used. Perform the encryption used. The advantage of this method is that when multiple servers are used while the mobile code is moving, the risk of reading and rewriting the execution code and data other than the predetermined server and client itself is further reduced. It is.
[0039]
Furthermore, as shown in FIG. 12, it can be set as the structure which adds the self-verification apparatus 17 of an engine to the server side. In this case, the self-verification device 17 periodically obtains an integer value depending on the engine code in the engine code reading unit 11 and the one-way function calculation unit 13 outside the engine during the startup and operation of the server engine. Self-verification of engine code rewriting is performed by comparing with correct values. The advantage of this method is that by performing self-verification on the server side, unauthorized reading / rewriting of the mobile code on the client side can be prevented in advance, thereby maintaining the trust of the server.
[0040]
【The invention's effect】
According to the present invention, when the mobile code is executed, only the part specified by the explicit description in the mobile code is disclosed to the server among the data (including the execution code) of the mobile code. This is guaranteed by the mobile code execution engine itself used in the server, and the guarantee can be confirmed on the client side. Therefore, when sending a mobile code, it is possible for a destination server to disclose only necessary information in the mobile code to the other server regarding the operation of that server. A part of the mobile code may be disclosed to individual servers, such as a collection of information and a series of data processing operations consisting of multiple steps. The mobile code can be used safely when the information acquired from each server needs to be kept secret from other servers.
[Brief description of the drawings]
FIG. 1 is a diagram illustrating the basic configuration of the present invention.
FIG. 2 is an explanatory diagram of engine validity verification processing (part 1) according to the present invention;
FIG. 3 is an explanatory diagram of engine validity verification processing (part 2) according to the present invention.
FIG. 4 is an explanatory diagram of engine validity verification processing (part 3) according to the present invention;
FIG. 5 is an explanatory diagram of engine validity verification processing (part 4) according to the present invention;
FIG. 6 is an explanatory diagram showing execution of a multi-agent system and a mobile code on the Internet.
FIG. 7 is an explanatory diagram showing a configuration example of a system in which a verification agent operates in a client-side engine.
FIG. 8 is a control flow of a system for operating a verification agent on a client-side engine.
FIG. 9 is an explanatory diagram of a mobile code of a system for operating a verification agent on a server-side engine.
FIG. 10 is a diagram showing a control flow of a system for operating a verification engine on a server-side engine.
FIG. 11 is an explanatory diagram showing a configuration example of a mobile code.
FIG. 12 is an explanatory diagram showing a configuration example in which a self-verification device is added to an engine.
[Explanation of symbols]
1: Engine with illegal read / rewrite prohibition function
2: Agency for verification of engine correctness
3: Client side system
4: Server-side engine
5: Resources
6: Access management device
7: Server agent
8: Agent
9: Verification agent
10: Interface section
11: Engine code reading unit
12: Read pattern storage unit
13: One-way function calculator

Claims (3)

It consists of a client that requests processing and a server that has an engine that executes the processing requested by the client.
The server
A one-way function calculation unit that performs a calculation process using a one-way function with the engine code of the engine as an input;
In response to a verification instruction from the client, a verification agent agent means for returning the calculation result of the one-way function calculation unit to the client is provided,
The client
It is possible to perform calculation processing by the same one-way function as the one-way function calculation unit of the server,
Regarding the processing request to the server, the server sends a verification request for the engine code to the server, and then receives the calculation result from the server, and inputs the same data as the valid engine code of the server. A verification agent means for verifying the calculation processing result by the one-way function and transmitting the processing request to the server if it matches,
A processing system characterized by that. An engine that executes processing requested by the client, a one-way function calculation unit that performs calculation processing by a one-way function using the engine code of the engine as an input,
A client device that requests processing to a server having verification agent means that returns a calculation result of the one-way function calculation unit to the client in response to a verification instruction from the client,
It is possible to perform calculation processing by the same one-way function as the one-way function calculation unit of the server,
Regarding the processing request to the server, the server sends a verification request for the engine code to the server, and then receives the calculation result from the server, and inputs the same data as the valid engine code of the server. A verification agent means for verifying the calculation result by the one-way function and transmitting the processing request to the server if it matches,
A client device. It consists of a client that requests processing and a server that has an engine that performs the processing requested by the client.
The server
A one-way function calculation unit that performs a calculation process using a one-way function with the engine code of the engine as an input;
In response to a decryption request to be described later, it is checked whether or not encrypted data to be described later can be decrypted by the calculation result of the one-way function calculation unit. And a verification means,
The client
The processing request to the server includes data encrypted so that the server can decrypt the content with the calculation result of the one-way function calculation unit for the valid engine code, and a decryption request thereof A decryption data transmission means for generating the decryption data and transmitting the decryption data to the server,
A processing system characterized by that.

Images