JP3979303B2 - History holding method and apparatus - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a technique for verifying data, and more particularly to a data verification technique suitable for general use in an information processing apparatus in which a large amount of continuous data, for example, data such as a usage history must be transmitted or retained safely. .
[0002]
[Prior art]
With the recent development of digital information processing technology and the information highway concept, the time is coming when all information is digitized and distributed and distributed through the network. Already, in the form of the Internet, personal computer communication, or CD-ROM, various information such as images, moving images, sounds, programs, etc. as well as character information have started to be distributed and distributed.
[0003]
However, since various kinds of digital information such as characters, images, moving images, sounds, programs, etc. do not have an entity unlike physical objects, they are worthless unless they are used. It has features such as being possible at cost. However, at present, since the consideration is paid for the possession, the information once owned by a certain person is restricted from being copied. This means that the ease of copying and the low cost, which should be the best features of digital information, are forcibly contained.
[0004]
In order to solve this, recently, digital information represented by a program is encrypted and distributed freely, and when used, a fee is paid, a decryption key for using the digital information is received, and the information is decrypted. Systems that can be used in the form of new products have also appeared. Alternatively, from the viewpoint that information has no value unless it is used, the use of information such as the software service system in Japanese Patent Publication No. 6-95302 and the information usage measuring device in Japanese Patent Application Laid-Open No. 7-21276 A technique for charging the fee is proposed.
[0005]
With these technologies, on information processing devices such as personal computers and workstations, users do not purchase and use software, such as programs, for free or at very low prices. However, when it is used, it is charged in the form of a usage fee according to the usage, for example, how many times it is used once.
[0006]
In order to charge for the use of information, the usage fee must be collected from each user according to the frequency of use. Alternatively, in some cases, the collected collected usage fees must be distributed to the side providing the information according to the usage frequency. For this purpose, it is necessary to record the usage history in the user's environment safely and to collect it safely.
[0007]
However, Japanese Patent Laid-Open No. 7-21276 discloses a usage meter as a function for recording a usage history, but does not mention how to actually collect the usage amount recorded there.
[0008]
As a method therefor, there is a method of recording the use history not in a storage device managed by the information processing device used by the user, for example, a hard disk device, but in a safe device independent of the storage device. For example, in Japanese Patent Publication No. 6-95302, a usage history is written in an IC card.
[0009]
Further, in the charging information transmission method disclosed in Japanese Patent Laid-Open No. 3-25605 and the charging information collection system disclosed in Japanese Patent Laid-Open No. 6-180762, charging information is collected through a network.
[0010]
[Problems to be solved by the invention]
In order to collect the history written in a secure device such as an IC card, there is a method of collecting it on a network, or collecting it directly by a collector who has a legitimate authority directly from the device. .
[0011]
However, in the method of collecting the history through the network, the safety of the billing information, that is, the billing information is tampered in the middle or the user creates illegal billing information and sends it to the security aspect. It was not considered at all. Therefore, although it can be applied in a certain reliable network such as in a company, there is a problem that it cannot be applied to the Internet in which an unspecified number of individuals participate.
[0012]
Therefore, in order to safely collect the history in the device such as the IC card, there is only a method in which the collecting person having the right authority directly collects the history directly from the device.
[0013]
However, it is possible to solve the above problems by using a cryptographic technique that has recently been researched, particularly a digital signature technique. That is, it is only necessary to enclose a secret key unique to the safety device and to sign it whenever data is extracted from the safety device. As a result, it is possible to confirm later that the data is correct by confirming an electronic signature attached to the data.
[0014]
As a digital signature, a technique using RSA (Rivest-Shamir-Adleman) encryption is widely known. However, a signature based on RSA encryption or another electronic signature generally requires a very large amount of calculation, and it usually takes a long time for one process. Therefore, when a large amount of continuous data has to be signed, or when the signature processing is performed on a computer with low calculation capability, this becomes a very big problem.
[0015]
When a device such as an IC card is used as a safety device for recording a usage history, generally, the calculation capability of a CPU that can be mounted on such an IC card is often low, and it takes a very long time to perform a large amount of calculations. There was a problem that it took. Alternatively, in order to increase the calculation time, there is a problem that an extremely high cost is required to increase the calculation capability.
[0016]
In addition, since the usage history data is generally long, there is a problem that recording capacity becomes a problem when all history data is recorded in a small device such as an IC card.
[0017]
The security of modern cryptographic technologies such as RSA encryption is originally based on the amount of calculations, and as the capacity of computers increases, the key length used for signatures and encryption increases accordingly. ing. Therefore, it is not a problem that will be solved if the computer capacity increases in the future, but a device that can only use a computer with a lower processing capacity than the computer with the maximum processing capacity in that era (for example, tokens used by individuals) ) Will always be an essential issue in the future.
[0018]
The present invention has been made in view of such circumstances, and an object of the present invention is to provide a method capable of generating data capable of verifying data at high speed even when placed in a device having low calculation capability. is there.
[0019]
That is, the entire usage history is not held in the IC card, but only the verification value obtained from the usage history is held in the IC card, and the main body of the usage history is stored on the information processing apparatus (such as a personal computer) managed by the user. I want to hold it.
[0020]
Referring to the conventional technique from the viewpoint of the verification value, there is a technique called DES-MAC, which is a technique used for data communication. MAC is an abbreviation for Message Authentication Code, and is a code having a certain length indicating that a message is complete (not tampered). It is used as an attachment to the original message. Since it is fatal that an error occurs in the middle of data communication, it is configured to detect that data has changed in the middle.
[0021]
Here, DES is an abbreviation for Data Encryption Standard, which is a block cipher algorithm having 64 bits as one block (Applied Cryptography pp265). CBC (CypherBlock Chain) mode (Applied Cryptography pp193, JIS-X5051) is a type of block cipher typified by DES, and does not encrypt individual blocks independently, but encrypts immediately before In this method, the exclusive OR of the block to be encrypted and the block to be encrypted is calculated and used as the input of DES. In this method, even when blocks having the same contents are encrypted, if the blocks encrypted so far are different, the encrypted results will be different.
[0022]
DES-MAC (see Applied Cryptography pp455 for CBC-MAC) is an application of the CBC mode in DES, and is intended to use the last obtained block as a verification value for the entire data stream.
[0023]
The configuration of the DES-MAC is shown in FIG. The upper part of the figure is a data stream to be transmitted, and each data stream is divided into blocks each having 64 bits. IV is an abbreviation for Initial Vector, and is an initial value generated by a random number. Like the DES-CBC mode, the divided blocks are chained through the DES encryptor and transmitted with IV at the head and the verification value of the data stream to be transmitted at the end. . The receiving side verifies whether or not the verification values obtained by performing the reverse process to this process are equal.
[0024]
However, such a processing method is basically intended to transmit data by communication, and it is assumed that the sender holds the complete data for a short period of time, Attempting to apply it to a complete history collection creates problems. In other words, the history data is accumulated over a long period of time, and during that time, there is a possibility of being exposed to danger such as arbitrary management of the user or a system accident.
[0025]
First, the above method (DES-MAC) assumes that data blocks are continuously transmitted. That is, there is a lower layer for normal data transmission (TCP / IP: TCP layer in the transmission control protocol / Internet protocol), and the order of data blocks is guaranteed by that layer. Become.
[0026]
However, in the case of the usage history, if the usage history is placed under the management of the user, the order of the history cannot be guaranteed at that time. That is, the user can use the IC card by connecting it to a plurality of computers (for example, a desktop PC and a laptop PC) that can be used by the user. Considering that the usage history is recorded on the computer side, the usage history is distributed to a plurality of computers. Accordingly, the time order of the history distributed to a plurality of vehicles is lost.
[0027]
In the case of usage history, the temporal order is a very important factor. That is, the usage amount may be calculated later from a plurality of continuous usage histories. For example, in a simple example, the use time is calculated from the difference between the use start time and the use end time, or the difference in data length is calculated from the operation target data length at the start of use and the operation target data length at the end of use, This is the case of making it a usage amount.
[0028]
DES-MAC does not provide an essential solution to these problems.
[0029]
Furthermore, another problem when the usage history is placed under the user's management is that some of them may be lost intentionally or accidentally. In the case of DES-MAC, if a part of it is lost, verification becomes impossible. In DES-MAC, since it is assumed that the sender holds complete data only during communication, in such a case, retransmission may be performed. However, in the case of the usage history, since the loss of the history is essentially the loss of data, it cannot be restored. If the DES-MAC method is used as it is, even the remaining data cannot be verified.
[0030]
Furthermore, in a system that charges usage, it is essential to collect the history that is left at the user's hand. This is because if the history is not collected, there is a problem that the usage fee of the user cannot be calculated or the collected usage fee cannot be distributed to the information provider.
[0031]
Therefore, it is necessary to safely collect the usage history left at the user's hand. For that purpose, it is necessary to prevent the collection from being performed by a fake collection command or the like.
[0032]
Accordingly, an object of the present invention is to provide an apparatus capable of verifying a large amount of data at a high speed even when the calculation capacity is low and the storage capacity is small.
[0033]
Furthermore, a second object of the present invention is to provide a method capable of restoring the order even in an environment where the order of data is not preserved.
[0034]
Furthermore, a third object of the present invention is to provide a method capable of verifying remaining data even when a part of the data is lost.
[0035]
Furthermore, a fourth object of the present invention is to provide a method for safely controlling a data holding device from the outside.
[0036]
[Means for Solving the Problems]
In order to solve the above-described problem, the present invention specifically outputs data to the outside of the defense device without recording the data in the defense device in order to reduce the amount of data to be held. The small verification value of was kept in the defense device. In a specific configuration, verification is performed using a one-way function instead of an electronic signature so that data can be verified at high speed. In general, a hash function typified by MD5 has a result that a hash value of about three digits is faster when realized by software than an RSA encryption process. In particular, in order to make it possible to restore the order of history data, information capable of restoring the order is added to the history data. Furthermore, specifically, in order to control the defense device safely, a configuration in which a value obtained by adding the signature of the right person to the verification value held by the defense device is required. As a result, the verification value in the defense device is forcibly sent to the right person, and the execution of the verification is ensured.
[0037]
Further, the configuration of the present invention will be described. According to the present invention, in order to achieve the above-described object, in the history holding method, the history data group consisting of a plurality of continuous history data is protected from only one verification value that is sequentially calculated. When the verification value is output to the outside of the protected device, only the verification value is digitally signed.
[0038]
In this configuration, the calculation amount and the storage capacity can be suppressed.
[0039]
According to the present invention, in order to achieve the above-mentioned object, a data input means for inputting a plurality of continuous data to the history holding device, a data processing means for processing the data, The history value related to the data processing and the verification value held at that time are input, the verification value generation means for generating the verification value, and the verification value holding means for holding the generated verification value And a signature means for signing the verification value, and at least the verification value generation means, the verification value holding means, and the signature means are held in the protected apparatus.
[0040]
Even in this configuration, the calculation amount and the storage capacity can be suppressed.
[0041]
In this configuration, the calculation used for the verification value generating means can be a one-way function. Further, the format of the history data can be a set of a history data body and a verification value when the history data is processed. Further, counter means for counting each time data is processed can be further provided, and the history data format in the history data group can be composed of a counter value when the data is processed and a history body. Also, a signed verification value can be output in response to a user output request. Further, when the history holding device is composed of a single CPU and software, and the CPU load by the data processing means is low, the signature means appropriately creates and outputs a verification value signed to the verification value. Can do.
[0042]
In this configuration, the function of the data processing unit and the function of the data processing unit are stopped when the verification value is output, and the function of the data processing unit is stopped until a valid command is given from the outside. Means may be further provided. In addition, a stop condition holding means for stopping the function is provided, and when the condition described in the stop condition holding means is satisfied, the function stop means outputs a verification value with a signature that signs the verification value, The function may be stopped. In addition, there is a valid public key holding means for holding the public key of the external legitimate person, and the instruction that the function stopping means accepts to restore the function is an external legitimate person in the verification value output last. Is a digital signature, and when the function stopping unit receives an instruction, the signature is verified with the public key held in the valid public key holding unit, and the signed verification value is You may make it confirm whether it is equal to the verification value currently hold | maintained at the verification value holding means.
[0043]
Further, according to the present invention, in order to achieve the above-described object, the history verification apparatus includes a plurality of consecutive history data groups and a verification value with a signature in which a verification value calculated from these data groups is signed. The data group input from the data input means for inputting the signature, the signature verification means for verifying the signature of the input verification value with the signature, and the verification value of the input data group and the signature verified And verifying means for verifying that is correct.
[0044]
In this configuration, it is only necessary to perform signature verification on the signed verification value, so that the amount of calculation can be reduced.
[0045]
In this configuration, a pre-verification value storage unit for storing the verification value input last time may be provided, and the pre-verification value may be used when the verification unit performs verification. The calculation used for the verification means may be a one-way function. Further, the format of the history data can be a set of a history data body and a verification value when the history data is processed. Further, the history data format in the history data group may be constituted by a counter value when the data is processed and a history body.
[0046]
Further, according to the present invention, in order to achieve the above-mentioned object, the history storage device includes a data storage means for storing data, and a stop condition for holding a certain condition when the function is stopped. Holds the function, the function stop means for stopping the function when the condition held in the stop condition holding means is satisfied, and continues to stop the function until a valid command is given from the outside, and holds the secret key A private key holding means for applying the electronic signature to the data group held in the data holding means using the private key held in the private key holding means, and holding the signed electronic signature An electronic signature holding means for holding the public key of an external rightful person, and an instruction received by the function stopping means to restore the function is sent to the electronic signature holding means. An external legitimate person has given an electronic signature to the held electronic signature, and the signature is verified with the public key held in the legitimate public key holding means when the function stop means receives the command. In addition, it is checked whether the signed value is equal to the value held in the electronic signature holding means.
[0047]
In this configuration, a command signed by a legitimate person is sent only after the validity of the history is verified, and the stop state of the apparatus is released only after the legitimate command is verified. Therefore, there is no inconvenience that the service continues to be provided without collecting a valid history. In other words, collection of a valid history is ensured.
[0048]
In addition, a part of the present invention can be realized as a computer program product.
[0049]
The above described aspects of the invention and other aspects of the invention are set out in the claims, and will be described in detail below with reference to examples.
[0050]
BEST MODE FOR CARRYING OUT THE INVENTION
[First embodiment]
Examples of the present invention will be described below. First, the first embodiment will be described. In this embodiment and other embodiments described later, digital information such as encrypted programs and image information are generally used on an information processing apparatus such as a personal computer or a workstation, and the usage history at that time is used. Is recorded on an IC card (to be referred to as a token hereinafter) connected to the information processing apparatus at the timing of decoding the information, and the usage history is collected by the center. Of course, the present invention can be applied in addition to ensuring security of history data.
[0051]
FIG. 1 shows the overall configuration of this embodiment. In FIG. 1, there is an information processing apparatus 11 for using digital information, such as a personal computer or a workstation, in the user's environment, which decrypts encrypted information (or decrypts a key for decryption). ) And a token 12 for capturing the timing and recording the usage history is connected. For the connection between the token 12 and the information processing apparatus 11, any means capable of transmitting information, such as a PC card (PCMCIA: Personal Computer Memory Card Interface Association) interface, serial, parallel, infrared, etc., should be used. Can do. You may make it mount in the inside of the information processing apparatus 11. FIG.
[0052]
The information processing apparatus 11 of the user is connected to the collection apparatus 13 formed of an information processing apparatus such as a workstation or a large computer as necessary. The connection form may be a modem and a telephone line, or a network interface such as Ethernet. This connection is not always performed, and it is sufficient to perform the connection only when it is necessary to collect the use history from the information processing apparatus 11 of the user.
[0053]
FIG. 2 shows the configuration of the information processing apparatus 11 on the user side. The user information processing apparatus 11 may be a general personal computer or a workstation. The only difference is where the token 12 is connected. The information processing apparatus 11 implements a control unit 14, an information holding unit 15, a history holding unit 16, and a history transmission unit 17. Such a configuration can be realized, for example, by installing the program using the recording medium 11a on which the program is recorded.
[0054]
The control unit 14 performs the following processing while communicating with the token 12.
(1) The encrypted information stored in the information holding unit 15 is read out, passed to the token 12 for decryption, and the decrypted information is executed or processed.
(2) When the decrypted data is received, the usage history passed from the token 12 is received at the same time and stored in the history holding unit 16.
(3) In response to an instruction from the user, a “verification value output” command is issued to the token 12, and the verification value with the electronic signature as a result is passed to the history transmission unit 17.
[0055]
The information holding unit 15 stores data and information used by the user or encrypted data. Actually, it is composed of an external storage device such as a memory or a hard disk device.
[0056]
The history holding unit 16 stores the history passed from the token 12 through the control unit 14. Actually, it is composed of an external storage device such as a memory or a hard disk device. A specific configuration of the history will be described later.
[0057]
The history transmission unit 17 receives a command from the control unit 14, reads the history held in the history holding unit 16 together with the verification value passed from the control unit 14, and transmits it to the collection device 13 in the center. Actually, it is composed of a modem and a telephone line, or a network interface such as Ethernet. Alternatively, it may be stored temporarily in a device such as a floppy disk even if it is not a network, and the user may input it manually into the collection device 13 in the center.
[0058]
FIG. 3 shows the configuration of the token 12 on the user side. The token 12 is physically composed of a general MPU, a memory, and the like. The token 12 itself is contained in an attack counter container so as to withstand physical attacks from the outside, such as reading or destroying the contents of the memory. Since the attack container is a well-known technique (Japanese Patent No. 186353, Japanese Patent No. 1860463, Japanese Patent Laid-Open No. 3-100573, etc.), description thereof is omitted here. Note that the level of attack that can be chosen depends on the level of data security. In some cases, the attack posture may be weak.
[0059]
The token 12 is connected to the information processing apparatus 11 of the user, performs certain processing according to an instruction from the information processing apparatus 11, and returns the result. The token 12 includes a user secret key holding unit 18, a decrypting unit 19, a verification value generating unit 20, a verification value holding unit 21, a verification value output unit 22, a token secret key holding unit 23, an electronic signature unit 24, and the like. Each component of the token 12 will be described in detail later. The token 12 has the following functions.
[0060]
(1) Information decryption function and retention of usage history (1) Receive encrypted data from the information processing apparatus 11, decrypt it with the private key stored in the user private key storage unit 18, and process the decrypted data Return to device 11.
(2) At the same time as performing the decryption process, the header of the decrypted data is referred to, the information identifier described therein is referred to, and the identifier is returned to the information processing apparatus 11 as a usage history.
(3) Further, the usage history is also passed to the verification value generation unit 20, and the verification value generation unit 20 calculates the usage history and the verification value held in the verification value holding unit 21 at that time, The calculation result is stored in the verification value holding unit 21.
[0061]
{Circle around (2)} Verification Value Output Function Upon receiving an output request from the information processing apparatus 11, the verification value held in the verification value holding unit 21 is digitally signed and returned at that time. Thereafter, the data in the verification value holding unit 21 is erased.
[0062]
Hereinafter, each component of the token 12 will be described.
[0063]
In response to the decryption request from the information processing apparatus 11, the decryption unit 19 decrypts the received encrypted data using the user-specific secret key stored in the user secret key storage unit 18, and the result Is returned to the information processing apparatus 11 side as decoded data. At this time, the header of the decrypted data is read at the same time, and the information identifier described therein is returned to the information processing apparatus 11 side as a usage history, and also passed to the verification value generation unit 20 (in this example, the usage history is The information identifier of the information used is used).
[0064]
With this configuration, the user always needs access to the token 12 when using the information, and the usage history can be reliably recorded.
[0065]
Here, the encrypted data delivered from the information processing apparatus 11 side may be information obtained by encrypting the information itself, or may be obtained by encrypting a key for decrypting the encrypted information. In the latter case, the information body 11 is decrypted on the information processing apparatus 11 side.
[0066]
The user secret key holding unit 18 holds a user-specific secret key. Generally, the token 12 is distributed to the user in a form in which a unique key for each user is enclosed in advance by a token issuing center or the like. Therefore, the user secret key cannot be known by the user himself / herself.
[0067]
The verification value holding unit 21 holds only one verification value that is sequentially updated. The verification value is generally a value having a fixed length such as 16 bytes. Therefore, if the verification value is 16 bytes, it is composed of only a 16-byte memory. FIG. 4 shows a configuration example of the verification value.
[0068]
The verification value output unit 22 receives a verification value output request from the information processing apparatus 11 side, reads the verification value stored in the verification value holding unit 21 at that time, and returns it to the information processing apparatus 11 side. It has a function. At that time, the verification value output unit 22 calls the electronic signature unit 24 to apply the electronic signature to the verification value.
[0069]
The electronic signature unit 24 performs processing for applying an electronic signature to a given value using the private key held in the token private key holding unit 23 that holds the private key dedicated to the token. The token secret key holding unit 23 is a configuration unit that holds a signature secret key used when performing an electronic signature. An electronic signature technique such as an RSA signature can be used for these components, and since it is a conventional technique, a detailed description is omitted here.
[0070]
When the verification value generation unit 20 receives the usage history (in this case, the information identifier) from the decryption unit 19, the verification value generation unit 20 reads the verification value held in the verification value holding unit 21, and calculates the following from the usage history and the verification value: To calculate a new verification value.
[0071]
[Expression 1]
H = Hash (Usage + Hold)
Here, H is a new verification value, Hold is a current verification value, Usage is a usage history, Hash () is a one-way function, and MD5 or SHA (Secure Hash Algorithm) is actually used. The operation “+” in this operation may actually be added as a numerical value, and if the lengths are the same, an exclusive OR operation may be performed, or two data may be simply arranged in order. . Anyway, what is necessary is just to synthesize two values. The verification value generation unit 20 stores the new verification value calculated in this way in the verification value holding unit 21 (that is, overwrites the old value).
[0072]
The verification value output unit 22 receives an output request from the information processing apparatus 11, returns the verification value held in the verification value holding unit 21 at that time, and then initializes the verification value holding unit 21 to a predetermined value. So that Or you may make it clear simply.
[0073]
Next, the center collection device 13 will be described. The configuration of the collection device 13 is shown in FIG. In FIG. 5, the collection device 13 includes a history receiving unit 25, a history holding unit 26, a history verification unit 27, a token public key holding unit 28, a signature verification unit 29, and the like. The collection device 13 receives the history sent from the information processing device 11 of the user by the history receiving unit 25 and stores the contents in the history holding unit 26. The stored usage history is read by the history verification unit 27 to verify whether the history is correct, and the result is output to a manager on the center side.
[0074]
In general, the center then calculates the information usage fee according to the contents of the history, collects the fee from the user, and distributes the collected usage fee to the information provider according to the details of the information usage history. The process of doing. However, the description is omitted here because it is not directly related to the essence of the present invention.
[0075]
Hereinafter, each component of the collection device 13 will be described.
[0076]
The history receiving unit 25 receives history information sent from the information processing apparatus 11. Actually, it is constituted by a modem and a network interface such as a telephone line or Ethernet, or an external information input device such as a floppy disk device, like the history transmission unit 17 (FIG. 2) of the information processing apparatus 11. The usage history received by the history receiving unit 25 is stored in the history holding unit 26.
[0077]
Further, in order to verify whether the verification value sent from the information processing apparatus 11 is valid, the token public key holding unit 28 and the signature verification unit 29 are provided.
[0078]
When the history is transmitted from the information processing apparatus 11, the history receiving unit 25 receives the history. The received history is stored in the history holding unit 26 and passed to the signature verification unit 29. The signature verification unit 29 selects the public key of the token 12 connected to the information processing apparatus 11 that has transmitted the history from the plurality of token public keys stored in the token public key holding unit 28, and the public key To verify the history signature. The verification result is held together with the history stored in the history holding unit 26. If the verification result is false, the verification value may have been falsified or forged, so the following processing is not continued and a message to that effect is output to the administrator. Stop processing.
[0079]
If the signature is verified, the following processing is continued.
[0080]
The history holding unit 26 holds the usage history and the verification result passed from the history receiving unit 25. The history holding unit 26 is actually composed of a storage device such as a memory.
[0081]
The history verification unit 27 verifies the history held in the history holding unit 26 as follows.
(1) The transmitted history sequence is represented by ud ₁ , ud ₂ , ud ₃ . . . _Let ud _n be.
(2) Let the verification value attached at the end of the history be hud.
(3) If the initial value of the verification value is ihud, whether or not hu ′ as a result of calculation is equal to the received hud is examined according to the following calculation formula.
[0082]
[Expression 2]
hud ′ = Hash (ud _n + Hash (ud _n−1 +... Hash (ud ₂ + Hash (ud ₁ + ihud)).
hud =? hud '
(4) If they are equal, it is determined that they have not been tampered with, and if they are not equal, it has been determined that they have been tampered with, and the result is notified to the administrator of the collection device.
[0083]
Next, the format of information processed by each unit will be described.
[0084]
FIG. 6 shows a format of encrypted information to be decrypted by the token 12. (A) is a case where the information itself is encrypted with the user's private key. (B) decrypts the secret key used to encrypt the information body with the user-specific secret key first, and uses the information-specific secret key obtained as a result, This is a case where the main body is decrypted. In the case of (b), the information body may be decrypted not by the token 12 but by the information processing apparatus side. In addition, although an example using conventional encryption is described here, it goes without saying that public encryption may be used for these.
[0085]
Here, the information identifier is an information-specific identifier given when the center encrypts and distributes the information. The information identifier is managed by the center (for example, by having a database). When the information identifier is specified, it is possible to specify who created the information.
[0086]
FIG. 7 shows a usage history format. (A) is a use history recorded in the information processing apparatus 11 in this embodiment, and is a column of information identifiers (of information decrypted with tokens) used. (B) is a usage history sent from the information processing apparatus 11 to the center, and is different only in that the verification value held by the token and the token signature for the verification value are attached at the end of (a).
[0087]
Each usage history is composed only of information identifiers used in this embodiment, but this may include arbitrary data such as time of use, user identifier, usage amount, usage amount, etc. Good. That is, when various information is left as a history (generally, it is common to leave various information in the history), the individual history becomes long, and the present invention is effective.
[0088]
Next, processing in the information processing apparatus 11 and the token 12 will be described with reference to FIGS. FIG. 8 shows the flow of processing when there is an information use request from the user in the control unit 14 of the information processing apparatus 11. FIG. 9 is a process when the control history is issued from the user in the control unit 14. FIG. 10 shows processing when the decryption unit 19 of the token 12 receives a decryption request for encrypted information from the information processing apparatus 11. FIG. 11 shows the processing of the verification value generation unit 20 of the token 12 called from the decryption unit 19 of the token 12. FIG. 12 shows processing when the verification value output unit 22 of the token 12 receives a verification value output request from the information processing apparatus 11.
[0089]
As shown in FIG. 8, when there is a request for information use from the user, the control unit 14 of the information processing apparatus 11 proceeds as follows. First, it is determined whether the target information is encrypted (S11). If it is not encrypted, the information is processed as it is (S15). When it is encrypted, a decryption request is issued to the token 12 and the target information is delivered (S12). At this time, if an error is returned from the token 12, an error message “the token history is full” is issued and the processing is terminated (S13, S16). If no error is returned, the usage history that has been overlooked from the token 12 is recorded in a recording device such as a disk (S14). Then, the target information is processed (S15).
[0090]
As shown in FIG. 9, when there is a usage history collection command from the user, the control unit 14 of the information processing apparatus 11 proceeds as follows. First, it is determined whether the target information is encrypted (S21). If it is not encrypted, the information is processed as it is (S24). When it is encrypted, a decryption request is issued to the token 12 and the target information is delivered (S22). The usage history returned from the token 12 is recorded in a recording device such as a disk (S23). Thereafter, the target information is processed (S24).
[0091]
As shown in FIG. 10, when the decryption unit 19 of the token 12 receives a decryption request for encrypted information from the information processing apparatus 11, the process proceeds as follows. First, the user secret key Ku is extracted from the user secret key holding unit 18 (S31). The encrypted data is decrypted with the user secret key Ku and the decrypted data is stored (S32). The information identifier is read with reference to the header of the decoded data, and the verification value generation unit 20 is called using this identifier as an argument to execute the verification value generation processing (see S33, S34, FIG. 11). Thereafter, the decrypted data and the identifier are returned to the information processing apparatus 11 (S35).
[0092]
As shown in FIG. 11, when the verification value generation unit 20 of the token 12 is called from the decryption unit 19 of the token 12, the process proceeds as follows. First, a verification value is extracted from the verification value holding unit 21 (S41). A hash calculation is performed on the information identifier and the verification value, and the calculation result is stored in the verification value holding unit 21 as a new verification value (S42, S43).
[0093]
As shown in FIG. 12, when the verification value output unit 22 of the token 12 receives a verification value output request from the information processing apparatus 11, the processing proceeds as follows. First, the verification value stored in the verification value holding unit 21 is read (S51). Thereafter, the stored contents of the verification value holding unit 21 are initialized (S52). The electronic signature unit 24 is called by using the read verification value as an argument, and the verification value is signed (S53). A signature is added after the verification value and output (S54).
[0094]
This is the end of the description of the first embodiment.
[0095]
When the user authentication apparatus and method disclosed in Japanese Patent Application No. 8-62076 is used in combination with the present invention, the modulus n in the calculation of the modular exponent is changed for each access ticket to be issued. n can be used as an information identifier. That is, in the user authentication method disclosed in Japanese Patent Application No. 8-62076, an access ticket (auxiliary information for authentication) is received from the outside, and the access ticket and user identification information are used for certification, for example, decryption of encrypted data. ing. The modulus n used at this time is used as an information identifier. In this case, the modulus n is not extracted after being decrypted by the decryption device inside the token, but is given from the outside together with the information to be decrypted.
[0096]
With this configuration, the capacity of the verification value holding unit 21 that must be prepared inside the token 12 can be minimized, and the production cost of the token 12 can be reduced.
[0097]
[Second Embodiment]
Next, a second embodiment of the present invention will be described. The embodiment described here is obtained by adding some functions to the first embodiment. The functions and effects are listed below.
[0098]
(1) The token 12 outputs a verification value to stop the function, and when the message is received from the center, the function is restored.
[0099]
When the verification value is output to the outside or when a certain time has elapsed using the clock function, the token 12 outputs the verification value at that time and stops to prompt the user to collect the history. (Or autonomously stop and request a verification value). In order to restore the function of the token 12, the user has to send a history and a verification value to the center for confirmation and receive a message for restoring the function from the center. It is assumed that the function recovery message issued by the center has an electronic signature attached to the verification value sent from the user.
[0100]
(2) The verification value at the time when the usage history is processed is also output as the history.
[0101]
In addition to the information identifier, the contents of the usage history include the verification value when the history is generated. As a result, the continuity of individual histories can be checked later, and it is not necessary to strictly manage the history (order) on the information processing apparatus side.
[0102]
(3) The old verification value is held on the center side.
[0103]
In the embodiments so far, the verification value inside the token is initialized by the output request from the user. However, the function can be made unnecessary by holding the previous verification value of the user on the collection device side of the center.
[0104]
FIG. 13 shows the configuration of the token 12 in this embodiment. In FIG. 13, portions corresponding to those in FIG. 3 are denoted by corresponding reference numerals, and detailed description thereof is omitted. In this figure, a token 12 includes a user secret key holding unit 18, a decrypting unit 19, a verification value generating unit 20, a verification value holding unit 21, a token secret key holding unit 23, an electronic signature unit 24, a control unit 30, and a history generating unit. 31, a counting unit 32, a center public key holding unit 33, a signature verification unit 34, and the like. In addition, you may provide the clock part 35 as needed.
[0105]
In the present embodiment, all communication with the information processing apparatus 11 is configured to be performed via the control unit 30, and the control unit 30 appropriately calls another processing unit in response to a request from the information processing apparatus 11 and performs processing. Do.
[0106]
The control unit 30 holds the operation state of the token 12 therein, and there are two operation states, a normal mode and a stop mode. In the normal mode, the token 12 performs a decryption process as described in the first embodiment in response to a decryption request from the information processing apparatus 11 and returns the result. On the other hand, the decryption request processing is not accepted in the stop mode. In the stop mode, basically, only the function restart request (verification value with center signature) is accepted, and if the request is valid, the stop mode is canceled and the normal mode is entered. In addition, a process of outputting a verification value signed to the verification value held in the verification value holding unit 21 at that time may be accepted.
[0107]
The transition from the normal mode to the stop mode depends on, for example, the number of times the decoding process is performed. The counting unit 32 in FIG. 13 holds the number of times the decoding process has been performed. For example, when the number of times exceeds a predetermined number of times (for example, 100 times), a message that “the time limit has passed” is returned to the information processing apparatus 11 side, and the mode is shifted to the stop mode.
[0108]
In the case of having a clock as a configuration, it may be performed based on the previous stop time information held in the control unit 30. That is, when there is a request from the information processing device, the control unit compares the previous stop time held in the control unit with the current time, and a predetermined time (for example, one month) has elapsed. If it is, the message “Expiration date has passed” is returned to the information processing apparatus 11 side, and the mode is shifted to the stop mode.
[0109]
Next, the processing of the control unit 30 of the token 12 will be described in detail with reference to FIGS. In addition, the part shown with the dotted line in FIGS. 14-16 means not the process of the control part 30, but the process of a related component.
[0110]
In FIG. 14, any one of a decryption request, a verification value output request, and a function resumption request is input from the information processing apparatus 11 to the control unit 30 of the token 12. First, it is determined whether or not the mode of the control unit 30 is the stop mode (S61). When not in the stop mode, the count value of the counting unit 32 is read, and it is determined whether or not the count value exceeds a reference value, for example, 100 (S62, S63). If it does not exceed 100, the process proceeds to node B in FIG. If it exceeds 100, a signed verification value is output. That is, the value stored in the verification value holding unit 21 is read, and a verification value with a signature is generated and received by the electronic signature unit 24 (S64, S65). Thereafter, a verification value with a signature and a message “shift to stop mode” are returned to the information processing apparatus 11 (S66). Then, the count value of the counting unit 32 is cleared and the mode is shifted to the stop mode (S67, S68).
[0111]
In step S61, when the control unit 30 is in the stop mode, it is determined whether the received request is a decryption request, a verification value output request, or a function resumption request (S69, S70, S71). If the request is a decryption request, a message “currently in stop mode” is returned to the information processing apparatus 11, and the process ends (S72). When the request is a verification value output request, the verification value stored in the verification value holding unit 21 is read, and a verification value with a signature is generated and received by the electronic signature unit 24 (S73, S74). Thereafter, the signed verification value is returned to the information processing apparatus 11 and the process is terminated (S75). When the function restart request is made, the process proceeds to the function restart process of the node A in FIG. If the received request is neither a decryption request, a verification value output request, or a function restart request, an error is returned to the information processing apparatus 11 and the process is terminated (S76).
[0112]
FIG. 15 shows the function restart process. In FIG. 15, first, the received verification value with the center signature is passed to the signature verification unit 24 to verify the validity of the signature (S77). If the signature is correct, the passed verification value is compared with the verification value stored in the verification value holding unit 21 to check whether or not they match (S78 to S80). If they match, the mode of the control unit is shifted from the stop mode to the normal mode, and a “function restart” message is returned to the information processing apparatus 11 (S81, S82). If the signature is not correct in step S78, a message “signature is not correct” is returned to the information processing apparatus 11 and the process is terminated (S83). If the verification values do not match in step S80, a message “verification value is incorrect” is returned to the information processing apparatus 11 and the process is terminated (S84).
[0113]
FIG. 16 shows processing when the count value does not exceed a threshold value, for example, 100. In FIG. 16, it is first checked whether the request is a decryption request (S85). In the case of a decryption request, the passed data is sent to the decryption unit 19 (S88). The decoding unit 19 performs decoding (S89 to S93). If the request is not a decryption request, it is determined whether the request is a verification value request (S86). If the request is a verification value request, the process proceeds to node C in FIG. 14 and a verification value output process is performed. If it is not a verification value output request in step S86, an error is returned to the information processing apparatus 11 and the process is terminated (S87).
[0114]
This is the end of the description of the processing of the control unit 30 of the token 12.
[0115]
In this example, even when there is a verification value request from the information processing apparatus 11 side, the mode is shifted to the stop mode (from step S86 in FIG. 16 to node C in FIG. 14). It doesn't matter. For example, in response to a verification value request in the normal mode, the verification value may be updated and a value signed with the verification value held at that time may be returned (this advantage will be described in the description of this embodiment). I will mention it at the end).
[0116]
The decryption unit 19 and the user secret key storage unit 18 have the same functions as in the first embodiment.
[0117]
As shown in FIG. 16, the history generation unit 31 generates three sets of the information identifier passed from the decoding unit 19 and the current verification value, and performs processing to pass it to the control unit 30 as a usage history.
[0118]
The verification value generation unit 20 applies the history ud passed from the history generation unit 31 to the history ud.
[0119]
[Equation 3]
Hu = Hash (ud)
The hash value is calculated and stored in the verification value holding unit 21. The verification value holding unit 21 holds the verification value at that time.
[0120]
Similar to the first embodiment, the electronic signature unit 24 performs processing for applying an electronic signature to a given value using the private key held in the private key holding unit 23 that holds the private key dedicated to the token. I do. In the present embodiment, a signature verification unit 34 is further provided to perform a process of verifying whether the signature passed using the center public key held in the center public key holding unit 33 is the center signature. . Basically, an electronic signature technique such as an RSA signature can be used for these components, and since it is a well-known technique, a detailed description is omitted here.
[0121]
The configuration of the information processing apparatus 11 in this embodiment is shown in FIG. In FIG. 17, parts corresponding to those in FIG. In this figure, the configuration is basically the same as that of the first embodiment, but since the token enters the stop mode at a certain point in the information processing apparatus 11 of the present embodiment, in order to restart it. Must send a history to the center and send a resume message for it. Therefore, there is a difference in that there is a signed verification value receiving unit 36 that receives a verification value with a signature from the center. Moreover, the structure of the history held in the history holding unit 16 is different.
[0122]
FIG. 18 shows the configuration of the center collection device 13 in this embodiment. 18, parts corresponding to those in FIG. In this figure, as compared with the configuration of the first embodiment, when the validity of the history is verified, the verification value with the signature of the center has to be sent to the information processing apparatus 11, so that this is done. , That is, a center secret key holding unit 37, an electronic signature unit 38, and a signed verification value transmission unit 39 are added. Moreover, since the structure of the utilization log | history sent from the information processing apparatus 11 side differs, the log | history processed in a collection center naturally also differs.
[0123]
FIG. 19 shows a configuration of usage history held in each unit.
(A) is a usage history recorded in the history holding unit 16 of the information processing apparatus 11. The contents of each history have a configuration of a pair of an information identifier as shown in (c) and a verification value held in the token at that time.
[0124]
When the history is sent from the information processing apparatus 11 to the center, a verification value with the signature of the token 12 is given at the end of the history column (b). The signed verification value is output when the token 12 stops functioning, and the token 12 has an electronic signature on the verification value at that time (d).
[0125]
The center uses the signed verification value (d) for history verification. As a result of the verification, if it is determined to be valid, a value obtained by applying the electronic signature to the verification value attached last as a message for resuming the function of the token 12 is sent to the information processing apparatus 11. . That is (e).
[0126]
Next, processing of the collection device 13 will be described. When the history is transmitted from the information processing apparatus 11, the history receiving unit 25 receives the history. The received history is stored in the history holding unit 26 and passed to the signature verification unit 29. The signature verification unit 29 selects the public key of the token 12 connected to the information processing apparatus 11 that has transmitted the history from the plurality of token public keys stored in the token public key holding unit 28, and the public key To verify the history signature. The verification result is held together with the history stored in the history holding unit 26.
[0127]
When the history reception is completed, the history verification unit 27 starts to operate. The history verification unit 27 refers to the history just received and refers to the verification result of the signature attached thereto. If the signature verification result is not valid, no further processing is performed. If the verification result attached to the history is valid, it is further verified whether the content of the history is valid.
[0128]
The verification process of the contents of the history is performed as follows.
(1) Assume that the sent history column is as follows.
(Id ₁ , hu ₀ ), (id ₂ , hu ₁ ), (id ₃ , hu ₂ ),. . . , (Id _n , hu _n-1 ), sign (hu _n )
Here, it is assumed that id is an information identifier, hu is a verification value when the history is generated, and sign () is a token signature.
(2) The verification value when the token was sent last time is searched from the history holding unit, and it is set as Hold.
(3) The verification value hu ₀ is taken out from the first history (ID ₁ , hu ₀ ) of the sent usage history, and it is confirmed whether or not it is equal to Hold.
(4) Next, Hash (id ₁ , hu ₀ ) is calculated, and it is confirmed whether or not it becomes hu ₁ .
(5) below in the same manner ascertain the end of the verification value hu _n.
(6) If all inspections are passed, it is determined that the usage history is valid.
[0129]
Only when it is determined that the history is correct as a result of the verification process, the last verification value hun is sent to the electronic signature unit, and the electronic signature is applied with the secret key of the center. Then, the verification value with the signature of the center is sent back to the information processing apparatus that has sent the history.
[0130]
With the configuration described above, the token stops functioning at a certain point in time, and thus the user of the information processing apparatus must send a valid history to the center in order to resume the token function. Accordingly, it is possible to prompt the user to collect the history.
[0131]
In addition, since the last verification value is recorded on the center side, even if a part of the correct history sent from the token has been destroyed for some reason, the verification is simply unsuccessful. The data held on the side does not change. Therefore, in this case, if the token re-sends the history, the verification is normally performed.
[0132]
Also, in this embodiment, by configuring the token to output the verification value autonomously, even when some history is broken (lost) when verifying the history on the collection device side Most of the other parts can be made verifiable.
[0133]
That is, not only when the user requests a verification value as described above, but also when the token load is low, the token autonomously signs the verification value held at that time, When the history is verified on the collection device side, even if a part of the history is broken (lost), it is possible to verify most of the other parts.
[0134]
In this case, the usage history sent to the center is configured as shown in FIG. 20, for example. At this time, it is assumed that the history 25 is lost on the information processing apparatus side due to some accident.
[0135]
In the case of a usage history having only the last verification value as shown above, the history 26 and later can be verified, but the contents of the history 1 to the history 24 are not lost. Cannot be verified as valid.
[0136]
By inserting a verification value with a signature in the middle, in the case of this example, if the history 25 is lost, only the history 24 becomes unverifiable, and the remaining history can be verified. It becomes. That is, the history 1 to the history 10 are signed with the verification value 1, the history 11 to the history 23 are signed with the verification value 2, the history 25 to the history 36 are signed with the verification value 3, and the history 37 to the history 57. This is because each can be verified by the signed verification value 4.
[0137]
In this way, by inserting verification values with signatures at appropriate intervals into the history, even if a part of the history is lost, it becomes possible to verify the majority of the remaining history. is there.
[0138]
In order to realize this, a device for determining whether or not the load is low is provided in the control unit inside the token, and when the token load is low, a verification value with a signature may be generated autonomously. .
[0139]
Further, the verification value with the signature may be output in response to a request from the information processing apparatus, that is, the user even if the token is not autonomously performed. For this purpose, the processing is performed not to branch the node C in FIG. 16 to the node C (step S64) in FIG. 14 but to update the verification value to generate a signed verification value and return it to the information processing apparatus 11. Change it.
[0140]
Further, by providing the token with a clock function, time information can be obtained as a usage history. As a result, the collection center can know not only the history of which information was used, but also the time of use. The clock unit is a normal clock function, and only has a function of holding the date and time and outputting the current time according to the request. In order to include the time in the history, it is only necessary to combine the time information with the information identifier described above. In addition, if the clock function is provided, it is possible to set “the time elapsed since the previous stop” as the condition for shifting to the stop mode described above.
[0141]
Furthermore, in this embodiment, the verification value held at that time is added to the history output to the outside, but this is provided with a counter unit inside the token, and each time the history is output, a counter is provided. The counter value may be output instead of the verification value when the history is output to the outside. In that case, the part that becomes the input of the hash function in the description so far is the usage history and the value of the counter held at that time.
[0142]
As described above, according to the above-described embodiment, in order to reduce the amount of data to be retained, the data is not stored in the defense device, but output to the outside of the defense device. Instead, a verification value with a small amount of data is used. Are stored in the defense device. Therefore, the storage capacity and required processing capacity of the defense device can be suppressed. Since the verification value is sent to the outside with a signature, falsification can be prevented and data verification can be performed reliably. In addition, in order to make it possible to restore the order of the data, by adding information for order restoration to the data, even if the data is stored in a distributed manner, the order is restored to facilitate verification. be able to. Further, when the defense device receives the value obtained by attaching the legitimate signature to the data held by the defense device, the related processing can be continuously executed. The data held inside must be sent to a legitimate person, received a signature, and returned. Therefore, the data to be verified is inevitably sent to the legitimate person, and the data to be verified can be reliably collected. Further, if the verification value with signature is frequently output, even if a part of the data is damaged, it is possible to surely verify many other data.
[0143]
【The invention's effect】
As described above, according to the present invention, it is possible to remarkably reduce the amount of verification value data necessary for verifying the history later and the amount of calculation required for generating the verification value.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a first embodiment of the present invention as a whole.
2 is a block diagram showing a configuration of the information processing apparatus 11 of FIG.
FIG. 3 is a block diagram showing a configuration of a token 12 in FIG.
4 is a diagram for explaining a verification value holding unit 21 in FIG. 3; FIG.
FIG. 5 is a block diagram showing a configuration of the collection device 13 of FIG.
FIG. 6 is a diagram for explaining information decrypted in a token 12;
FIG. 7 is a diagram illustrating a configuration of a usage history.
FIG. 8 is a flowchart illustrating processing of the control unit 14 of the information processing apparatus 11 when there is a request for use of information from a user.
FIG. 9 is a flowchart for explaining processing of the control unit 14 of the information processing apparatus 11 when there is a usage history collection command from a user.
10 is a flowchart for explaining processing when the decryption unit 19 of the token 12 receives a decryption request for encrypted information from the information processing apparatus 11. FIG.
FIG. 11 is a flowchart for explaining processing of the verification value generation unit 20 of the token 12 called from the decryption unit 19 of the token 12;
12 is a flowchart for explaining processing when the verification value output unit 22 of the token 12 receives a verification value output request from the information processing apparatus 11. FIG.
FIG. 13 is a block diagram illustrating a configuration of a token 12 according to the second embodiment.
14 is a flowchart for explaining processing of the token 12 in FIG. 13;
15 is a flowchart for explaining processing of the token 12 in FIG. 13;
16 is a flowchart for explaining processing of the token 12 of FIG.
FIG. 17 is a block diagram illustrating functional blocks implemented in the information processing apparatus 11 according to the second embodiment;
FIG. 18 is a block diagram illustrating a configuration of a collection device 13 according to a second embodiment.
FIG. 19 is a diagram illustrating the configuration of a usage history according to the second embodiment.
FIG. 20 is a diagram illustrating another configuration of the usage history according to the second embodiment.
FIG. 21 is a diagram for explaining a related technique.
[Explanation of symbols]
11 Information processing device 12 Token 13 Collection device 14 Control unit 15 of information processing device 11 Information holding unit 16 of information processing device 11 History holding unit 17 of information processing device 11 History transmission unit 18 of information processing device 11 User secret of token 12 Key holding unit 19 Token 12 decrypting unit 20 Token 12 verification value generating unit 21 Token 12 verification value holding unit 22 Token 12 verification value output unit 23 Token 12 token private key holding unit 24 Token 12 electronic signature unit 25 History receiving unit 26 of the collection device 13 History holding unit 27 of the collection device 13 History verification unit 28 of the collection device 13 Token public key holding unit 29 of the collection device 13 Signature verification unit of the collection device 13

Claims (14)

Respect in connection with the internal operation of the defended device history data group including a plurality of successive historical data generated in the apparatus, the only only verification values are the protection device to be sequentially calculated held in, the history data group is stored in the external of the defended device, the verification value when outputting to the outside of the protection device, are then facilities a digital signature only to the verification value, further The new unique verification value was used to generate the previous unique verification value from the previous unique verification value held at that time and the historical data generated in the device at that time. A history holding method characterized by generating history data and previous history data without referring to the history data . Data input means for inputting a plurality of continuous data;
Data processing means for processing the data;
Using the history data related to the processing of the data and the verification value held at that time as input , refer to the history data used to generate the previous verification value held at that time and previous history data. A verification value generation means for generating a new verification value without
Verification value holding means for holding the generated verification value;
Holds a signature means for applying a signature to the verification value in the defense by the apparatus, the history data used for generating the verification value is the defense to hold the outside of the defended device The history holding device is characterized in that it is not held inside the device.   The history holding apparatus according to claim 2, wherein the calculation used for the verification value generating means is a one-way function.   4. The history holding device according to claim 2, wherein the format of the history data is a set of a history data body and a verification value when the history data is processed.   5. The history holding according to claim 2, further comprising a counter means for counting each time data is processed, wherein the history data format in the history data group includes a counter value when the data is processed and a history body. apparatus.   6. The history holding device according to claim 2, wherein the signed verification value is output in response to a user output request.   The history holding device is constituted by a single CPU and software, and when the load on the CPU by the data processing means is low, the signature unit creates and outputs a verification value appropriately signing the verification value. 4. The history holding device according to 4, 5 or 6. Data processing means;
The function to stop time by the data processing means which outputs the verification value, claim 2 and 3 until a legitimate instruction is given from the outside, further comprising a function stopping means for stopping the function of the data processing means, The history holding device according to 4, 5, 6 or 7. Having a stop condition holding means for stopping the function, and when the condition described in the stop condition holding means is satisfied, the function stop means outputs a verification value with a signature signed to the verification value, history holding apparatus as claimed in claim 8, wherein the stop.   It has a valid public key holding means for holding the public key of the external legitimate person. The signature is verified, and the signature is verified with the public key held in the valid public key holding means when the function stopping means receives the command, and the signed verification value is the verification value 10. The history holding device according to claim 8, wherein the history holding device checks whether or not the verification value held in the holding means is equal. With respect to a plurality of continuous history data groups generated in the device in relation to the internal operation of the protected device, a history data group between the previous breakpoint and the breakpoint at each arbitrary breakpoint Without referring to the history data used to generate the previous verification value and previous history data from the previous verification value and the history data group between the previous breakpoint and the breakpoint. and Lud over data input means to enter sign the calculated verification value is a signed validation value that has been subjected,
Verification value storage means for storing the verification value input last time;
And the signature verification means you verify the signature of the input the signed validation value,
A new verification is performed without referring to the previous data group of the target history data group from the input history data group between the previous break point and the previous verification value and the previous verification value. generate a value, the verification value thus generated, and compares the validated verification value of the signature, and verification means you verify that the data group you entered is correct when both verification value matches A history verification device characterized by comprising: The calculation using the verification means is a one-way function 11. Symbol mounting history verification device. Format of the historical data, historical data body and history verifying apparatus as claimed in claim 11 or 12, wherein the set in which the verification value when processing the historical data. Form of historical data in the historical data group, claim 11, 12 or the history verification apparatus according 13 consisting of a counter value and history body when processing the data.

Images