JP7106845B2 - Terminal device and verification method - Google Patents

Description

The present invention relates to a terminal device and verification method.

2. Description of the Related Art In recent years, a system in which sensors or the like are installed at various locations to acquire environmental data, imaging data, and the like of the locations has become widespread. In such a system, data is transmitted and received between a terminal device equipped with a sensor and a server device that collects data via a communication network. A terminal device is equipped with a plurality of sensors as slaves and a control chip as a master for controlling the plurality of sensors. When data is transmitted from the server device to the sensor, the terminal device sets the sensor via the control chip. The sensor also transmits the detected data to the server device via the control chip. In other words, in the terminal device, data transmission/reception between the server device and the sensor is always performed via the control chip.
Therefore, when sensors are added or when control processing for sensors is frequently performed, the amount of data transmitted and received between the server device and the sensors increases, increasing the load on the control chip. As a countermeasure, it is conceivable that the server device and the sensor directly transmit data without going through the control chip.
In Patent Document 1, in a device provided with two or more processors that operate with different firmware programs, a technique is provided in which the respective firmware programs are updated while continuing the operation of the device while alternating the roles of master and slave between the processors. is disclosed.

JP 2016-103114 A

Transmission and reception of data over a communication network may be subject to malicious attacks such as falsification of data on the network. If the data transmitted by the server device is illegally falsified and the sensor acquires the falsified data, the sensor may be illegally controlled. Therefore, it is necessary to verify the validity of the data acquired by the sensor, but in most cases the sensor itself does not have a function to verify the validity of the data.

SUMMARY OF THE INVENTION The present invention has been made in view of such circumstances, and an object of the present invention is to provide a terminal device and a verification method capable of grasping whether or not the data is illegal while suppressing the processing load on the control chip. is to provide

To solve the above-described problems, one aspect of the present invention is a terminal device that communicates with a server device via a communication network , comprising: a master chip; a slave chip that communicates with a master chip; and a secure element. determining a destination of the received data, and if the destination is the slave chip, causing the secure element to verify the validity of the received data, and determining that the received data is valid based on the verification result. a data processing unit that transfers the received data to the slave chip, the secure element includes a second acquisition unit that acquires the received data from the master chip; and a verifying unit that verifies the validity of the received data acquired by the acquiring unit of and outputs a verification result indicating whether or not the received data is valid to the master chip .

According to the present invention, it is possible to grasp whether or not the data is illegal while reducing the processing load on the control chip.

1 is a system configuration diagram showing a configuration example of a processing system 1 of an embodiment; FIG. 1 is a block diagram showing a configuration example of a server device 10 according to an embodiment; FIG. 3 is a block diagram showing a configuration example of a control chip 32 of the embodiment; FIG. 3 is a block diagram showing a configuration example of a sensor module 34 of the embodiment; FIG. It is a block diagram which shows the structural example of SE40 of embodiment. 4 is a flowchart showing an operation example of the control chip 32 of the embodiment; 4 is a sequence chart showing an operation example of the processing system 1 of the embodiment; 4 is a sequence chart showing an operation example of the processing system 1 of the embodiment; 4 is a sequence chart showing an operation example of the processing system 1 of the embodiment;

A secure element, a terminal device, a server device, a verification method, and a program according to embodiments will be described below with reference to the drawings.

FIG. 1 is a system configuration diagram showing a configuration example of a processing system 1 according to an embodiment.
The processing system 1 includes, for example, a server device 10 and a terminal device 30 . The server device 10 and the terminal device 30 are communicably connected to each other via the communication network 20 .

The server device 10 acquires data from the terminal device 30 . The server device 10 accumulates data such as imaging data obtained from the terminal device 30, and provides various services such as displaying an image according to a user's operation based on the accumulated data.
The server device 10 also transmits data to the terminal device 30 . The data transmitted from the server device 10 to the terminal device 30 is data for controlling the terminal device 30, for example.

The terminal device 30 includes a communication module 31, a control chip 32, a sensor module 34 (sensor modules 34-1, . . . 34-N) (where N is any natural number), and an SE (Secure Element) 40. and
The communication module 31 receives data transmitted from the server device 10 or other communication devices to the terminal device 30 via the communication network 20 . The communication module 31 outputs the received data to the control chip 32 . The communication module 31 also transmits data acquired by the sensor module 34 to the server device 10 under the control of the control chip 32 .

The control chip 32 controls other functional units of the terminal device 30 (communication module 31, sensor module 34, and SE 40). The control chip 32 operates as a master side that controls other functional units when the functional units of the terminal device 30 operate in cooperation to realize the functions of the terminal device 30 . That is, the control chip 32 is an example of a "master chip." On the other hand, other functional units of the terminal device 30 operate as slaves controlled by the control chip 32 when the functional units of the terminal device 30 operate in cooperation to realize the functions of the terminal device 30. . That is, the communication module 31, the sensor module 34, and the SE 40 are examples of "slave chips."

The sensor module 34 is, for example, an imaging module having an imaging function. Sensor module 34 may be an environmental sensor that senses temperature and humidity. Also, the sensor module 34 may have a function of outputting data. For example, if the terminal device 30 is a smart home appliance, the sensor module 34 may output a signal to start or stop the home appliance or change its operating status according to instructions from the control chip 32 . When the terminal device 30 is a mobile terminal, the sensor module 34 may be a display for displaying images, a speaker for outputting sound, or the like.

SE 40 is a verification chip with verification or encryption functions. The SE 40 is called, for example, a secure IC chip, a secure chip, a secure IC, or the like. The SE 40 may have a robust structure and tamper resistance to protect information from malicious attacks from the outside. However, the SE 40 may be any IC chip having a verification function or an encryption function, and is not limited to a secure IC chip or the like. For example, SE 40 may be an IC chip with a cryptographic library.
Also, the SE 40 may be an IC card or a SIM card (Subscriber Identity Module Card) in which the SE 40 is mounted on a card material such as plastic. In this case, the SE 40 communicates with the terminal device 30 via the contact portion of the IC card or SIM card. The contact section has terminals for various signals necessary for the operation of the IC card or SIM card. Terminals for various signals are terminals for receiving power supply voltage, clock signal, and reset signal from the terminal device 30 and serial data input/output terminals for communicating with the terminal device 30 .

FIG. 2 is a block diagram showing a configuration example of the server device 10 of the embodiment.
The server device 10 includes a server communication section 11 , a server control section 12 and an output section 13 . The server communication unit 11 is connected to the communication network 20 and communicates with the terminal device 30 and other communication devices via the communication network 20 . The server control unit 12 causes the storage unit (not shown) of the server device 10 to store data acquired from the terminal device 30 or the like via the server communication unit 11 . The output unit 13 outputs information desired by the user from the information stored in the storage unit based on information input to an input unit (not shown) of the server device 10 by user's operation or the like.

The server control unit 12 also generates data to be transmitted to the terminal device 30 .
In this embodiment, the server control unit 12 transmits data including information indicating a destination (destination information) to the terminal device 30 . That is, the server control unit 12 determines whether the data to be transmitted to the terminal device 30 is data to be transmitted to the control chip 32 of the terminal device 30, data to be transmitted to the sensor module 34, and other data. It is transmitted including whether it is data to be transmitted to the functional part of . The server control unit 12 notifies the destination information by, for example, setting address information and an identification number corresponding to each function unit of the terminal device 30 in a specific portion of the data to be transmitted to the terminal device 30. .

Further, when transmitting data to the terminal device 30, the server device 10 transmits an authentication code (for example, MAC (Message Authentication Code)) together with the data. The authentication code is a predetermined code derived based on data, for example, derived based on a common cryptographic key (common key) predetermined between the server device 10 and the terminal device 30 and data. is a sign that When the data received by the terminal device 30 and the authentication code derived using the common key match the authentication code received by the terminal device 30, the data received by the terminal device 30 are generated by the server device 10 side. It can be determined that the data is the same as the data that has been transmitted and that the data has not been tampered with during communication, that is, the data is valid. On the other hand, if the authentication code derived on the terminal device 30 side and the authentication code received on the terminal device 30 side do not match, the data received by the terminal device 30 is illegal data that has been falsified on the way. It can be determined that

FIG. 3 is a block diagram showing a configuration example of the control chip 32 of the embodiment.
The control chip 32 includes a communication section 320 , a storage section 322 and a control section 324 .
The communication unit 320 communicates with the communication module 31, the sensor module 34, and the SE40. The communication unit 320 operates as a master side in communication with the communication module 31 and the like, for example. The communication unit 320 requests other functional units such as the communication module 31 to start communication, and performs communication with the functional units that respond to the request.
The communication unit 320 acquires data from other functional units such as the communication module 31 and stores the acquired data in an area (reception buffer) (not shown) for storing received data of the storage unit 322 . The communication unit 320 also outputs data acquired from other functional units such as the communication module 31 to the control unit 324 . Further, the communication unit 320 outputs the data stored in the area (transmission buffer) for storing the transmission data of the storage unit 322 to the communication module 31 and the like according to the instruction of the control unit 324 .

The storage unit 322 stores programs and data for executing various processes of the control chip 32 . The storage unit 322 includes a communication information storage unit 323, for example. The communication information storage unit 323 stores communication modes.
The communication mode is a mode indicating a data communication method in the terminal device 30 . Communication modes include at least two modes, a master mode and a slave mode.
In the master mode, the control chip 32 mainly controls other functional units. In the master mode, the control chip 32 interprets the content of all data transmitted from the server device 10 to the terminal device 30, and controls other functional units according to the interpreted content.
In the slave mode, part of the processing performed by the control chip 32 in the master mode is performed by other functional units. In the slave mode, the control chip 32 does not interpret the data transmitted from the server device 10 to other functional units (sensor module 34, etc.), and transmits the data to the other functional units at the destination. (sensor module 34, etc.).

The control unit 324 controls the control chip 32 in an integrated manner. The control unit 324 includes an acquisition unit 325 , a data processing unit 326 and an interrupt processing unit 327 .
The acquisition unit 325 acquires data transmitted from the server device 10 to the terminal device 30 via the communication module 31 and the communication unit 320 . The data processing unit 326 determines the transmission destination of the acquired data, and performs processing according to the determined transmission destination. Specifically, when the destination of the acquired data is the control chip 32, the data processing unit 326 processes the data in the master mode. In this case, the data processing unit 326 stores “0” in the communication mode of the communication information storage unit 323 . Further, when the destination of the acquired data is a functional unit other than the control chip 32 (for example, the sensor module 34), the data processing unit 326 processes the data in the slave mode. In this case, the data processing unit 326 stores “1” in the communication mode of the communication information storage unit 323 .

In the case of the master mode, the data processing unit 326 interprets the contents of the acquired data and makes settings based on the contents of the interpreted data. In master mode, the data indicates the content of control for the control chip 32 . In the master mode, the data processing unit 326 interprets the contents of control indicated by the data, and sets the control chip 32 according to the interpreted contents.

In the slave mode, the data processing unit 326 transfers the acquired data to the destination functional unit (for example, the sensor module 34) without interpreting the content of the acquired data. In the slave mode, the data indicates the contents of control for other functional units (eg, sensor module 34) other than the control chip 32. FIG. In the slave mode, the data processing unit 326 transfers the acquired data to the transmission destination without interpreting the content of control indicated in the data. When transferring data to the destination, the data processing unit 326 stores the acquired data in a transmission buffer (not shown) corresponding to the sensor module 34 of the storage unit 322 and instructs the communication unit 320 to transmit the data. . Since the data processing unit 326 does not interpret the contents of the data, the processing load on the control chip 32 can be reduced.

Also, in the slave mode, the data processing unit 326 causes the SE 40 to verify the validity of the acquired data. Specifically, the data processing unit 326 outputs the acquired data to the SE40. The data processing unit 326 stores the acquired data in a transmission buffer (not shown) corresponding to the SE40 of the storage unit 322, and instructs the communication unit 320 to transmit the data. Then, the data processing unit 326 acquires the verification result from the SE 40 via the communication unit 320, and outputs the data to the sensor module 34 when the verification result indicates that the data is valid. This makes it possible to transfer safe data whose validity is guaranteed to the sensor module 34 .

When having the SE 40 verify the validity of the data, the data processing unit 326 transfers the data to the sensor module 34 if the data is valid based on the verification result, and transfers the data to the sensor module 34 if the data is not valid. may be discarded. Since the data processing unit 326 discards the invalid data, it is possible to prevent the sensor module 34 from being illegally controlled by the invalid data.

In the above description, the data processing unit 326 verifies the validity of the data each time it acquires data from the acquisition unit 325, but the present invention is not limited to this. When the data processing unit 326 verifies the validity of the first data in a case such as when communication is continuously performed between the server device 10 and the terminal device 30, the data processing unit 326 determines that the data is valid. may omit the verification of subsequent data, assuming that the data is valid. A case where communication is continuously performed between the server device 10 and the terminal device 30 is, for example, a case where a series of data is divided into a plurality of data blocks and transmitted in order.

For example, when data is acquired from the acquisition unit 325, the data processing unit 326 determines whether the data is part of a data block of a series of data. If the acquired data is a data block, the data processing unit 326 determines whether it is the first data block. If the data block is not the first data block, the data processing unit 326 refers to the communication information storage unit 323, and if the communication mode stores "1", the data is sent to the sensor module 34 without verifying the data. Forward.

When an interrupt signal is output from the sensor module 34 or another functional unit, the interrupt processing unit 327 performs processing according to the interrupt signal. When the sensor module 34 acquires data exceeding a predetermined threshold value, the sensor module 34 may occasionally transmit data to the server device 10 . In such a case, the sensor module 34 outputs an interrupt signal to the control chip. The interrupt signal is notified to the interrupt processing unit 327 via the communication unit 320, for example. The interrupt processing unit 327 performs processing according to the notified interrupt signal.
For example, when the interrupt processing unit 327 acquires an interrupt signal indicating that data is to be transmitted from the sensor module 34 to the server device 10 , the interrupt processing unit 327 transmits a signal requesting data to the sensor module 34 via the communication unit 320 . output and acquire data from the sensor module 34 . The interrupt processing unit 327 outputs the acquired data to the data processing unit 326 .

FIG. 4 is a block diagram showing a configuration example of the sensor module 34 of the embodiment. The sensor module 34 includes a communication section 340 , a sensor control section 341 and a sensor section 342 .
The communication unit 340 communicates with the control chip 32 . The communication unit 340 operates as a slave side in communication with the control chip 32 . When receiving a communication request from the control chip 32, the communication unit 340 communicates with the control chip 32 in response to the request.
When receiving a request to transmit data from the control chip 32 , the communication unit 340 transmits data stored in a transmission data storage area (transmission buffer) of a storage unit (not shown) of the sensor module 34 to the control chip 32 . Send to

In addition, the communication unit 340 outputs an interrupt signal to the control chip 32 according to an instruction from the control chip 32, and causes the control chip 32 in response to the interrupt signal to request communication to the communication unit 340. 32.
The sensor control unit 341 controls the sensor module 34 in an integrated manner. The sensor control unit 341 acquires data from the control chip 32 via the communication unit 340, interprets the content of the acquired data, and performs settings according to the interpreted content. Further, the sensor control unit 341 causes the data acquired by the sensor unit 342 to be stored in the transmission buffer.
The sensor unit 342 acquires imaging data and the like. The sensor unit 342 outputs the acquired imaging data to the sensor control unit 341 .

FIG. 5 is a block diagram showing a configuration example of the SE 40 of the embodiment. As shown in FIG. 5 , SE 40 includes communication section 400 , control section 410 and storage section 420 .
Each unit shown in FIG. 2 is implemented using hardware of the SE 40 . The hardware of the SE 40 includes, for example, a UART (Universal Asynchronous Receiver Transmitter), a CPU, a ROM (Read Only Memory), a RAM (Random Access Memory), and an EEPROM (Electrically Erasable Programmable ROM). Connected via an internal bus.

The communication unit 400 is implemented by, for example, a UART, a CPU, and programs stored in a ROM, and performs communication between the control chips 32 . The communication unit 400 operates as a slave side in communication with the control chip 32 . The communication unit 400 receives commands from the control chip 32 and transmits responses to the commands to the control chip 32 . The communication unit 400 stores the received data received from the control chip 32 in the received data storage unit 421 of the storage unit 420 . The communication unit 400 also transmits the transmission data stored in the transmission data storage unit 423 of the storage unit 420 to the control chip 32 .

Control unit 410 is implemented by, for example, a CPU, RAM, ROM, or EEPROM, and controls SE 40 in a centralized manner. Control unit 410 includes command processing unit 411 , acquisition unit 412 , and verification unit 413 .
The command processing unit 411 interprets commands included in the data received by the terminal device 30 and controls each unit corresponding to various processes in the SE 40 .
The acquisition unit 412 acquires reception data of the terminal device 30 . Acquisition unit 412 outputs the acquired reception data to verification unit 413 .

Verification unit 413 verifies the validity of received data. The verification unit 413 determines that the received data is valid when the data transmitted from the server device 10 to the terminal device 30 has not been tampered with before being received by the terminal device 30 . The verification unit 413 determines that the received data is valid when the data received by the terminal device 30 is data from a device assumed as a communication destination such as the server device 10 .
Verification section 413 derives an authentication code based on the data of the data portion included in the received data and the common key stored in verification information storage section 422 . The verification unit 413 verifies the validity of the received data by comparing the derived authentication code with the authentication code included in the received data. The verification unit 413 causes the transmission data storage unit 423 to store the verification result obtained by verifying the validity of the received data as a response to the command.

It should be noted that the verification unit 413 only needs to verify the validity of the data, and is not limited to the verification method using the authentication code described above. The verification unit 413 may verify the validity of the received data by using, for example, a one-way hash function (MD5, SHA1, SHA2, etc.), an encryption key such as a common key or a public key, The authentication code encrypted with the public key on the server device 10 side may be decrypted by the verification unit 413 on the terminal device 30 side using the private key to verify the validity of the data.

The storage unit 420 is configured by, for example, an EEPROM, and stores programs, data, etc. of the control unit 410 . Storage unit 420 includes reception data storage unit 421 , verification information storage unit 422 , and transmission data storage unit 423 . Received data storage unit 421 stores data received via communication unit 400 . The verification information storage unit 422 stores information used in verification processing, such as a common key and an encryption key such as a public key. Transmission data storage unit 423 stores data transmitted from SE 40 via communication unit 400 .

FIG. 6 is a flow chart showing an operation example of the control chip 32 of the embodiment. The flowchart of FIG. 6 shows an operation example of the control chip 32 when data is transmitted from the server device 10 to the terminal device 30 .

First, the control chip 32 determines whether or not the communication unit 320 has received data from the server device 10 via the communication module 31 (step S100).
When receiving data from the server device 10, the control chip 32 causes the data processing unit 326 to determine whether to process the data in master mode or slave mode (step S101). The control chip 32 obtains the data received from the server device 10 by the obtaining unit 325, and refers to the destination information provided at a specific location of the data obtained by the data processing unit 326, thereby determining the destination of the data. judge. The data processing unit 326 determines to process the data in the master mode when the control chip 32 is indicated in the destination information. The data processing unit 326 determines to process the data in the slave mode when the destination information indicates a functional unit other than the control chip 32 (sensor module 34, etc.).
If the control chip 32 determines to process the data in the slave mode, it transfers the data to the SE 40 (step S102). SE 40 verifies the validity of data received from control chip 32 . The SE 40 transmits to the control chip 32 the result of verifying the correctness of the data.
The control chip 32 acquires the verification result from the SE 40 via the communication unit 320 using the acquisition unit 325 (step S103). The data processing unit 326 determines whether the data is valid based on the verification result (step S104). When determining that the data is valid, the data processing unit 326 outputs the data to the destination (for example, the sensor module 34) (step S105). On the other hand, when the data processing unit 326 determines that the data is not valid, it discards the data (step S107).
On the other hand, when the control chip 32 determines in step S101 to process the data in the master mode, it interprets the content of the data and performs control according to the interpreted content (step S106).

FIG. 7 is a sequence chart showing an operation example of the processing system 1 of the embodiment. The sequence chart of FIG. 7 shows an operation example of the processing system 1 when data is transmitted from the server device 10 to the terminal device 30 . Although the communication module 31 is omitted in the sequence chart of FIG. 7, the communication module 31 actually intervenes in communication between the server device 10 and the control chip 32 .

First, the server device 10 creates data to be transmitted to the terminal device 30 (step S301). The server device 10 creates data to be transmitted to the terminal device 30 including destination information.
Next, the server device 10 creates an authentication code using the data and the common key (step S302). The server device 10 transmits the data and the authentication code to the terminal device 30 (step S303).
The control chip 32 receives data transmitted from the server device 10 to the terminal device 30 (step S304). The control chip 32 transfers the received data to the SE 40 (step S305). SE 40 verifies the validity of the transferred data (step S306). The SE 40 outputs the verification result to the control chip 32 (step S307). Based on the verification result received from the verification chip, the control chip 32 sets the communication mode to the slave mode when the data is determined to be valid (step S308). The control chip 32 transfers the data to the sensor module 34 (step S309).

8 and 9 are sequence charts showing other operation examples of the processing system 1 of the embodiment. The sequence charts of FIGS. 8 and 9 show another operation example of the processing system 1 when data is transmitted from the terminal device 30 to the server device 10. FIG. Although the communication module 31 is omitted in the sequence charts of FIGS. 8 and 9, the communication module 31 actually intervenes in the communication between the server device 10 and the control chip 32 .
The sequence charts of FIGS. 8 and 9 show an example of transmitting data from the sensor module 34 to the server device 10 by outputting an interrupt signal from the sensor module 34 to the control chip 32. .

First, the processing shown in the sequence chart of FIG. 8 will be described. The sensor module 34 acquires data (step S401). When transmitting the acquired data to the server device 10, the sensor module 34 outputs an interrupt signal to the control chip 32 (step S402).
The control chip 32 acquires an interrupt signal from the sensor module 34 (step S403), and transmits a communication request requesting communication to the server (step S404).
The server device 10 creates an authentication code together with response data to the communication request (step S405). The server device 10 transmits the response data and the authentication code to the terminal device 30 (step S406).

The control chip 32 receives the data (step S407). The control chip 32 transfers the received data to the SE 40 (step S408). SE 40 verifies the validity of the transferred data (step S409). The SE 40 outputs the verification result to the control chip 32 (step S410). The control chip 32 sets the communication mode to the slave mode when it is determined that the data is valid based on the verification result received from the verification chip (step S411). The control chip 32 notifies the server device 10 that the mode change for setting the communication mode to the slave mode has been completed (step S412).

Next, the processing shown in the sequence chart of FIG. 9 will be described. FIG. 9 shows data for requesting processing from the server device 10 to the sensor module 34 after the processing corresponding to the sequence chart shown in FIG. 8 is performed and the communication mode is switched to the slave mode (in FIG. data) is transmitted.

The server device 10 creates processing request data for the sensor module 34 (step S413). The server device 10 transmits the processing request data to the terminal device 30 (step S414).
The control chip 32 receives the processing request data (step S415). The control chip 32 outputs the received processing request data to the SE 40 without interpreting the data (step S416). The SE 40 verifies the validity of the processing request data obtained from the control chip 32 (step S417). The SE 40 outputs the verification result to the control chip 32 (step S418).

The control chip 32 outputs the processing request data to the sensor module 34 when it is determined that the data is valid based on the verification result received from the SE 40 (step S420). The sensor module 34 executes processing based on the processing request data acquired from the control chip 32 (step S421). The sensor module 34 outputs to the control chip 32 data indicating the processing result of the executed processing (step S422).
The control chip 32 outputs the data indicating the processing result obtained from the sensor module 34 to the SE 40 without interpreting the data (step S424). The SE 40 performs data processing such as encrypting the data indicating the processing result obtained from the control chip 32 and/or adding a signature (step S425). The SE 40 outputs the data that has undergone data processing such as encryption to the control chip 32 (step S426).
The control chip 32 acquires data that has undergone data processing such as encryption from the SE 40 (step S427), and transmits the acquired data to the server device 10 (step S428).

As described above, the SE 40 of the embodiment is connectable to the terminal device 30 that communicates with the server device 10 via the communication network 20. an acquisition unit 412 that acquires received data that is the sensor module 34 (an example of a “slave chip”) from the control chip 32 (an example of a “master chip”) of the terminal device 30; and a verification unit 413 that verifies validity and outputs a verification result indicating whether or not the data is valid to the control chip 32 . Thereby, the SE 40 of the embodiment can verify the validity of the data that the control chip 32 transfers to the sensor module 34 and output the verified result. Therefore, the control chip 32 can transfer the data whose validity has been verified to the sensor module 34 without interpreting the content of the data. It is possible to grasp whether

Further, in SE40 of the embodiment, the acquisition unit 412 acquires transmission data to be transmitted to the server device 10, which is output from the sensor module 34 to the control chip 32. FIG. Thereby, the SE 40 of the embodiment can verify the correctness of the data output from the sensor module 34 and output the verified result. Therefore, the control chip 32 can transmit to the server device 10 data whose validity has been verified with respect to the data output from the sensor module 34, and the server device 10 can transmit incorrect data. It is possible to suppress

Further, the terminal device 30 of the embodiment is a terminal device 30 that communicates with the server device 10 via the communication network 20, and is based on the control chip 32 and the instruction from the control chip 32. The control chip 32 includes an acquisition unit 325 that acquires reception data received by the terminal device 30, and a transmission destination of the reception data based on the reception data. If the destination is the sensor module 34, the SE 40 verifies the validity of the received data. and a data processing unit 326 for transferring to. As a result, the terminal device 30 according to the embodiment transmits data received from the server device 10 whose destination is not the control chip 32 to the sensor module 34 when it is determined that the data is valid. can be transferred to Therefore, the terminal device 30 can grasp whether or not the data is unauthorized. In addition, the control chip 32 can cause the SE 40 to verify the validity of the data, and can transfer the content of the data to the sensor module 34 without interpreting it, thus reducing the processing load of the control chip. becomes possible.

Further, the server device 10 of the embodiment is a server device 10 that communicates with the terminal device 30 via the communication network 20, and the data to be transmitted to the terminal device 30 is The data is transmitted including destination information indicating whether or not it is data to be transmitted, and an authentication code (an example of a "predetermined code derived based on data"). Thereby, the server device 10 of the embodiment can notify the terminal device 30 whether or not the destination of the data transmitted to the terminal device 30 is the control chip 32 . Therefore, the terminal device 30 can respond according to the destination. For example, the terminal device 30 distributes the processing for realizing the functions of the terminal device 30 more than the case where the control chip 32 interprets all the data by causing the functional unit of the transmission destination to interpret the data. , and the processing of the control chip 32 can be reduced. In addition, since the validity of data can be verified according to the destination of the data, only data judged to be valid will be output to functional units that can be attacked by inputting invalid data. It is possible to grasp whether or not the data is illegal.

A program for realizing all or part of the functions of the SE 40, the terminal device 30, and the server device 10 in the present invention is recorded on a computer-readable recording medium, and the program recorded on this recording medium is transferred to the computer system. The processing may be performed by loading and executing the .
It should be noted that the "computer system" referred to here includes hardware such as an OS and peripheral devices.
Also, the "computer system" includes a WWW system provided with a home page providing environment (or display environment). The term "computer-readable recording medium" refers to portable media such as flexible discs, magneto-optical discs, ROMs and CD-ROMs, and storage devices such as hard discs incorporated in computer systems. In addition, "computer-readable recording medium" means a volatile memory (RAM) inside a computer system that acts as a server or client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. , includes those that hold the program for a certain period of time.

Further, the above program may be transmitted from a computer system storing this program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in a transmission medium. Here, the "transmission medium" for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. Further, the program may be for realizing part of the functions described above. Further, it may be a so-called difference file (difference program) that can realize the above-described functions in combination with a program already recorded in the computer system.

While several embodiments of the invention have been described, these embodiments have been presented by way of example and are not intended to limit the scope of the invention. These embodiments can be implemented in various other forms, and various omissions, replacements, and modifications can be made without departing from the scope of the invention. These embodiments and their modifications are included in the scope and spirit of the invention, as well as the scope of the invention described in the claims and equivalents thereof.

DESCRIPTION OF SYMBOLS 1... Processing system 10... Server apparatus 12... Server control part 20... Communication network 30... Terminal device 325... Acquisition part 326... Data processing part 323... Communication information storage part 40... SE 412... Acquisition unit 413 . . . Verification unit.

Claims (5)

A terminal device that communicates with a server device via a communication network,
a master chip;
a slave chip that communicates with the master chip based on instructions from the master chip;
a secure element;
The master chip is
a first acquisition unit for acquiring reception data received by the terminal device; determining a transmission destination of the reception data based on the reception data; a data processing unit that verifies the validity of the received data and transfers the received data to the slave chip when the received data is determined to be valid based on the verification result;
The secure element is
a second acquisition unit that acquires the received data from the master chip;
a verification unit that verifies validity of the received data acquired by the second acquisition unit and outputs a verification result indicating whether or not the received data is valid to the master chip. Terminal equipment. The terminal device according to claim 1 , wherein the data processing unit causes the secure element to determine whether the received data is valid based on an authentication code included in the received data. the first acquiring unit acquires an authentication code from the server device when acquiring transmission data output from the slave chip to the master chip and to be transmitted to the server device;
The data processing unit causes the secure element to determine whether the received data is valid based on the authentication code acquired from the server device, and if the authentication code is determined to be valid, the transmission 3. The terminal device according to claim 1 , wherein data is transmitted to said server device. The first acquisition unit sequentially acquires data blocks obtained by dividing a series of data from the server device,
The data processing unit causes the secure element to determine whether or not the leading block is valid based on an authentication code included in the leading block, which is the first data block of the series of data. is determined to be valid, of the series of data, the data block other than the leading block is transferred to the slave chip without having the secure element verify the validity thereof. The terminal device according to any one of claims 1 to 3 . A terminal device that communicates with a server device via a communication network, the terminal device comprising a master chip, a slave chip that communicates with the master chip based on instructions from the master chip, and a secure element. A verification method for performing
a step in which a first acquisition unit of the master chip acquires reception data received by the terminal device;
The data processing unit of the master chip determines a transmission destination of the reception data based on the reception data, and causes the secure element to verify the validity of the reception data when the transmission destination is the slave chip. transferring the received data to the slave chip if the received data is determined to be valid based on the verification result;
a second acquisition unit of the secure element acquiring the received data from the master chip;
a verification unit of the secure element verifying the validity of the received data acquired by the second acquisition unit, and outputting a verification result indicating whether or not the received data is valid to the master chip;
A verification method with

Images