WO2018207424A1

WO2018207424A1 - Message processing device, map management device, map company device, and automobile company device

Info

Publication number: WO2018207424A1
Application number: PCT/JP2018/006072
Authority: WO
Inventors: 佐藤　恒夫; 拓海森; 卓磨角谷
Original assignee: 三菱電機株式会社
Priority date: 2017-05-11
Filing date: 2018-02-20
Publication date: 2018-11-15
Also published as: JPWO2018207424A1

Abstract

In the present invention, a reception unit (129R) receives a delivered message. An extraction unit (121) extracts target data to be processed from the delivered message. A processing unit (124) generates processed data by processing the target data. A signature unit (125) generates a signature for combined data including the target data and the processed data. A message generation unit (126) generates a processed message including the combined data and the signature of the combined data. The delivery unit (129S) delivers the processed message.

Description

Message processing device, map management device, map company device and automobile company device

The present invention relates to a technique for distributing a message including data.

Patent Document 1 discloses “an electronic document exchange support method with an electronic signature and an information processing apparatus”.
In “Electronic signature exchange support method and information processing apparatus” in Patent Document 1, an electronic document creation apparatus creates an electronic document, the electronic document support apparatus normalizes the electronic document, calculates a digest value, The document creation device generates a signature based on the digest value.
As a result, the difference caused by the deviation of the normalization process by the mounting method that is different for each electronic document creation apparatus is eliminated.

JP 2006-157399 A

In the “electronic document exchange support method and information processing apparatus with electronic signature” in Patent Document 1, a new electronic document created by re-editing the created electronic document is an electronic document that is separate from the editing original electronic document. In order to be handled, a new electronic document signature is generated.
In addition, the editing source electronic document and the new electronic document cannot be associated with each other.
In addition, when the electronic document creation apparatus exists in an area away from the certificate authority, a safe delivery path must be provided in order to safely deliver the key from the certificate authority to the electronic document creation apparatus.

The object of the present invention is to enable delivery of processed data while guaranteeing the relationship between the data before processing and the data after processing.

The message processing device of the present invention
A reception unit for receiving delivery messages;
An extraction unit for extracting target data to be processed from the delivery message;
A processing unit that generates processing data by processing the target data;
A signature unit that generates a signature for the set data including the target data and the processed data;
A message generation unit configured to generate a processing message including the set data and a signature for the set data;

According to the present invention, processed data can be distributed while guaranteeing the relationship between data before processing (target data) and data after processing (processed data).

1 is a configuration diagram of a message distribution system 100 according to Embodiment 1. FIG. 1 is a configuration diagram of a message generation device 110 according to Embodiment 1. FIG. 1 is a configuration diagram of a message processing device 120 according to Embodiment 1. FIG. FIG. 3 is a configuration diagram of a message using device 130 according to the first embodiment. FIG. 3 is a schematic diagram of a message delivery method in the first embodiment. 4 is a flowchart of a message generation method in the first embodiment. 5 is a flowchart of a message processing method in the first embodiment. 5 is a flowchart of a message utilization method in the first embodiment. FIG. 10 is a schematic diagram of a message delivery method in the second embodiment. FIG. 10 is a schematic diagram of a message delivery method according to Embodiment 3. FIG. 6 is a configuration diagram of a message generation device 110 in a fourth embodiment. The block diagram of the message processing apparatus 120 in Embodiment 4. FIG. FIG. 10 is a schematic diagram of a message delivery method in a fourth embodiment. FIG. 10 is a schematic diagram of a message delivery method in a fourth embodiment. The hardware block diagram of the message production | generation apparatus 110 in embodiment. The hardware block diagram of the message processing apparatus 120 in embodiment. The hardware block diagram of the message utilization apparatus 130 in embodiment.

In the embodiment and the drawings, the same reference numerals are given to the same elements and corresponding elements. Description of elements having the same reference numerals will be omitted or simplified as appropriate. The arrows in the figure mainly indicate the flow of data or the flow of processing.

Embodiment 1 FIG.
The message distribution system 100 will be described with reference to FIGS.

*** Explanation of configuration ***
Based on FIG. 1, the structure of the message delivery system 100 is demonstrated.
The message distribution system 100 is a system for distributing messages.
The message distribution system 100 includes a message generating device 110, one or more message processing devices 120-n, and a message using device 130.
When the message processing device 120-n is not specified, each is referred to as a message processing device 120.

The message generation device 110 is a computer that generates a message including original data.
The one or more message processing devices 120-n are computers that generate messages including processed data obtained by processing original data.
The message using device 130 is a computer that uses the processed data.

Based on FIG. 2, the structure of the message production | generation apparatus 110 is demonstrated.
The message generation device 110 includes hardware such as a processor 911, a memory 912, an auxiliary storage device 913, and an input / output interface 914. These hardwares are connected to each other via signal lines.

The processor 911 is an IC (Integrated Circuit) that performs arithmetic processing, and controls other hardware. For example, the processor 911 is a CPU (Central Processing Unit).
The memory 912 is a volatile storage device. The memory 912 is also called a main storage device or a main memory. For example, the memory 912 is a RAM (Random Access Memory). Data stored in the memory 912 is stored in the auxiliary storage device 913 as necessary.
The auxiliary storage device 913 is a nonvolatile storage device. For example, the auxiliary storage device 913 is a ROM (Read Only Memory), an HDD (Hard Disk Drive), or a flash memory. Data stored in the auxiliary storage device 913 is loaded into the memory 912 as necessary.

The input / output interface 914 is a port to which an input device and an output device are connected. For example, the input / output interface 914 is a USB terminal, the input device is a keyboard, a mouse, and a receiver, and the output device is a display and a transmitter. USB is an abbreviation for Universal Serial Bus. A receiver and a transmitter are collectively referred to as a communication device.

The message generation device 110 includes software elements such as a data generation unit 111, a calculation unit 112, a signature unit 113, and a message generation unit 114. A software element is an element realized by software.

The auxiliary storage device 913 stores a message generation program for causing the computer to function as the data generation unit 111, the calculation unit 112, the signature unit 113, and the message generation unit 114. The message generation program is loaded into the memory 912 and executed by the processor 911.
Further, the auxiliary storage device 913 stores an OS (Operating System). At least a part of the OS is loaded into the memory 912 and executed by the processor 911.
That is, the processor 911 executes the message generation program while executing the OS.
Data obtained by executing the message generation program is stored in a storage device such as the memory 912, the auxiliary storage device 913, a register in the processor 911, or a cache memory in the processor 911.

The memory 912 functions as a storage unit 119M that stores data. However, another storage device may function as the storage unit 119M instead of the memory 912 or together with the memory 912.
The input / output interface 914 functions as a reception unit 119R that receives input. Further, the input / output interface 914 functions as a distribution unit 119S that distributes messages.

The message generation device 110 may include a plurality of processors that replace the processor 911. The plurality of processors share the role of the processor 911.

The message generation program can be stored in a computer-readable manner in a non-volatile storage medium such as a magnetic disk, an optical disk, or a flash memory. A non-volatile storage medium is a tangible medium that is not temporary.

Based on FIG. 3, the structure of the message processing apparatus 120 is demonstrated.
The message processing device 120 includes hardware such as a processor 921, a memory 922, an auxiliary storage device 923, and an input / output interface 924. These hardwares are connected to each other via signal lines.

The processor 921 is an IC that performs arithmetic processing, and controls other hardware. For example, the processor 921 is a CPU.
The memory 922 is a volatile storage device. The memory 922 is also called a main storage device or a main memory. For example, the memory 922 is a RAM. Data stored in the memory 922 is stored in the auxiliary storage device 923 as necessary.
The auxiliary storage device 923 is a nonvolatile storage device. For example, the auxiliary storage device 923 is a ROM, an HDD, or a flash memory. Data stored in the auxiliary storage device 923 is loaded into the memory 922 as necessary.

The input / output interface 924 is a port to which an input device and an output device are connected. For example, the input / output interface 924 is a USB terminal, the input device is a keyboard, a mouse, and a receiver, and the output device is a display and a transmitter.

The message processing device 120 includes software elements such as an extraction unit 121, a calculation unit 122, a verification unit 123, a processing unit 124, a signature unit 125, and a message generation unit 126.

The auxiliary storage device 923 stores a message processing program for causing the computer to function as the extraction unit 121, the calculation unit 122, the verification unit 123, the processing unit 124, the signature unit 125, and the message generation unit 126. The message processing program is loaded into the memory 922 and executed by the processor 921.
Further, the auxiliary storage device 923 stores an OS. At least a part of the OS is loaded into the memory 922 and executed by the processor 921.
That is, the processor 921 executes the message processing program while executing the OS.
Data obtained by executing the message processing program is stored in a storage device such as the memory 922, the auxiliary storage device 923, a register in the processor 921, or a cache memory in the processor 921.

The memory 922 functions as a storage unit 129M that stores data. However, another storage device may function as the storage unit 129M instead of the memory 922 or together with the memory 922.
The input / output interface 924 functions as a reception unit 129R that receives input. Further, the input / output interface 924 functions as a distribution unit 129S that distributes messages.

The message processing device 120 may include a plurality of processors that replace the processor 921. The plurality of processors share the role of the processor 921.

The message processing program can be stored in a computer-readable manner on a nonvolatile storage medium such as a magnetic disk, an optical disk, or a flash memory. A non-volatile storage medium is a tangible medium that is not temporary.

Based on FIG. 4, the structure of the message utilization apparatus 130 is demonstrated.
The message using device 130 includes hardware such as a processor 931, a memory 932, an auxiliary storage device 933, and an input / output interface 934. These hardwares are connected to each other via signal lines.

The processor 931 is an IC that performs arithmetic processing, and controls other hardware. For example, the processor 921 is a CPU.
The memory 932 is a volatile storage device. The memory 932 is also called a main storage device or a main memory. For example, the memory 932 is a RAM. Data stored in the memory 932 is saved in the auxiliary storage device 933 as necessary.
The auxiliary storage device 933 is a non-volatile storage device. For example, the auxiliary storage device 933 is a ROM, HDD, or flash memory. Data stored in the auxiliary storage device 933 is loaded into the memory 932 as necessary.

The input / output interface 934 is a port to which an input device and an output device are connected. For example, the input / output interface 934 is a USB terminal, the input device is a keyboard, a mouse, and a receiver, and the output device is a display and a transmitter.

The message generation device 110 includes software elements such as an extraction unit 131, a calculation unit 132, a verification unit 133, and a use unit 134.

The auxiliary storage device 933 stores a message use program for causing the computer to function as the extraction unit 131, the calculation unit 132, the verification unit 133, and the use unit 134. The message utilization program is loaded into the memory 932 and executed by the processor 931.
Further, the auxiliary storage device 933 stores an OS. At least a part of the OS is loaded into the memory 932 and executed by the processor 931.
That is, the processor 931 executes the message user program while executing the OS.
Data obtained by executing the message utilization program is stored in a storage device such as the memory 932, the auxiliary storage device 933, a register in the processor 931, or a cache memory in the processor 931.

The memory 932 functions as a storage unit 139M that stores data. However, another storage device may function as the storage unit 139M instead of the memory 932 or together with the memory 932.
The input / output interface 934 functions as a reception unit 139R that receives input.

The message using device 130 may include a plurality of processors that replace the processor 931. The plurality of processors share the role of the processor 931.

The message utilization program can be stored in a computer-readable manner in a non-volatile storage medium such as a magnetic disk, an optical disk, or a flash memory. A non-volatile storage medium is a tangible medium that is not temporary.

*** Explanation of operation ***
The operation of the message delivery system 100 corresponds to a message delivery method.
The operation of the message generation device 110 corresponds to a message generation method. The procedure of the message generation method corresponds to the procedure of the message generation program.
The operation of the message processing device 120 corresponds to a message processing method. The procedure of the message processing method corresponds to the procedure of the message processing program.
The operation of the message using device 130 corresponds to a message using method. Further, the procedure of the message use method corresponds to the procedure of the message use program.

A message delivery method will be described with reference to FIG.
The device 0 is a message generation device 110.
The device n is a message processing device 120-n. In the embodiment, n is an integer from 1 to 3.
The device U is a message using device 130.

Data 0 is data generated by the device 0.
The data n is data generated by the device n and is generated by processing the data (n−1).

Signature 0 is a signature for data 0.
The signature XY is a signature for the set data XY.
The set data XY is data including data X and data Y. Specifically, the set data XY is data composed of data X and data Y.
In the embodiment, X means n-1 and Y means n.

Secret key 0 is a secret key for device 0.
Certificate 0 is a certificate for device 0 and includes public key 0 corresponding to private key 0.
The secret key n is a secret key for the device n.
The certificate n is a certificate for the device n and includes a public key n for the private key n.

First, the certificate authority operates as follows.
The certificate authority generates a private key 0 and a certificate 0, distributes the private key 0 to the device 0, and distributes the certificate 0 to the device 1. The storage unit 119M of the device 0 stores the secret key 0, and the storage unit 129M of the device 1 stores the certificate 0.
The certificate authority generates a private key 1 and a certificate 1, distributes the private key 1 to the device 1, and distributes the certificate 1 to the device 2. The storage unit 129M of the device 1 stores the secret key 1, and the storage unit 129M of the device 2 stores the certificate 1.
The certificate authority generates a private key 2 and a certificate 2, distributes the private key 2 to the device 2, and distributes the certificate 2 to the device 3. The storage unit 129M of the device 2 stores the secret key 2, and the storage unit 129M of the device 3 stores the certificate 2.
The certificate authority generates a private key 3 and a certificate 3, distributes the private key 3 to the device 3, and distributes the certificate 3 to the device U. The storage unit 129M of the device 3 stores the secret key 3, and the storage unit 139M of the device U stores the certificate 3.
Each private key and each certificate shall be distributed by a secure route.
The certificate authority distributes the certificate for the certificate authority to each device. The certificate for the certificate authority includes a public key for the certificate authority. In each apparatus, the certificate for the certificate authority is used for verification of the certificates 0 to 3.

Next, the device 0 operates as follows. The operation of the device 0 will be described with reference to FIG.
In step S111, the data generation unit 111 generates data 0 (initial data).
Specifically, data 0 is generated as follows.
First, the accepting unit 119R accepts electronic information that is the source of data 0.
And the data generation part 111 produces | generates the data 0 by processing the received electronic information according to operation of the user 0. FIG. User 0 is a user who uses message generation device 110.

In step S112, the signature unit 113 generates a signature 0.
Specifically, signature 0 is generated as follows.
First, the calculation unit 112 calculates the digest value of the data 0 by executing the digest function with the data 0 as an input. A specific example of the digest function is a hash function called SHA-256.
Then, the signature unit 113 generates the signature 0 by encrypting the digest value of the data 0 using the secret key 0.

In step S113, the message generation unit 114 generates a message 0 (delivery message) using the data 0 and the signature 0.
Message 0 is a message including data 0 and signature 0.

In step S114, the distribution unit 119S distributes the message 0. Message 0 is delivered to device 1.

Next, the apparatus 1 operates as follows. The operation of the apparatus 1 will be described with reference to FIG.
In step S121, accepting unit 129R accepts message 0 (delivery message).

In step S122, the verification unit 123 verifies the signature 0.
Specifically, signature 0 is verified as follows.
First, the extraction unit 121 extracts data 0 (distributed data) and signature 0 from the message 0.
Next, the calculation unit 122 calculates the digest value of the data 0 by executing the digest function with the data 0 as an input.
Next, the verification unit 123 calculates the decrypted value of the signature 0 by decrypting the signature 0 using the public key 0.
Then, the verification unit 123 compares the digest value of data 0 with the decrypted value of signature 0.
When the digest value of data 0 matches the decrypted value of signature 0, verification of signature 0 is successful. If verification of signature 0 is successful, the authenticity and integrity of data 0 is ensured.
If verification of signature 0 is successful, the process proceeds to step S123.
If the verification of signature 0 fails, the subsequent processing is not performed.

In step S123, the processing unit 124 generates data 1 (processing data).
Specifically, data 1 is generated as follows.
First, the extraction unit 121 extracts data 0 (target data) from the message 0.
Then, the processing unit 124 generates the data 1 by processing the data 0 according to the operation of the user 1. User 1 is a user of device 1.

In step S124, the signature unit 125 generates a signature 01.
Specifically, the signature 01 is generated as follows.
First, the calculation unit 122 calculates the digest value of the set data 01 by executing the digest function with the set data 01 (data 0 and data 1) as input.
Then, the signature unit 125 generates the signature 01 by encrypting the digest value of the set data 01 using the secret key 1.
The signature 01 makes it possible to verify the authenticity and integrity of the tuple data 01. In other words, the signature 01 makes it possible to verify the authenticity and completeness of the set of data 0 and data 1.

In step S 125, the message generation unit 126 generates a message 1 (processing message) using the set data 01 and the signature 01.
Message 1 is a message including set data 01 and signature 01.

In step S126, the distribution unit 129S distributes the message 1. Message 1 is delivered to device 2.

Next, the device 2 operates as follows. The operation of the device 2 will be described with reference to FIG.
In step S121, accepting unit 129R accepts message 1 (delivery message).

In step S122, the verification unit 123 verifies the signature 01.
Specifically, the signature 01 is verified as follows.
First, the extraction unit 121 extracts the set data 01 (distribution data) and the signature 01 from the message 1.
Next, the calculation unit 122 calculates the digest value of the set data 01 by executing the digest function with the set data 01 as an input.
Next, the verification unit 123 calculates the decrypted value of the signature 01 by decrypting the signature 01 using the public key 1.
Then, the verification unit 123 compares the digest value of the set data 01 with the decrypted value of the signature 01.
If the digest value of the set data 01 matches the decrypted value of the signature 01, the signature 01 is successfully verified. If the verification of the signature 01 is successful, the authenticity and integrity of the set data 01 are ensured. That is, the authenticity and completeness of the set of data 0 and data 1 are ensured.
If verification of the signature 01 is successful, the process proceeds to step S123.
If the verification of the signature 01 fails, the subsequent processing is not performed.

In step S123, the processing unit 124 generates data 2 (processing data).
Specifically, data 2 is generated as follows.
First, the extraction unit 121 extracts data 1 (target data) from the message 1.
And the process part 124 produces | generates the data 2 by processing the data 1 according to operation of the user 2. FIG. User 2 is a user of device 2.

In step S124, the signature unit 125 generates the signature 12.
Specifically, the signature 12 is generated as follows.
First, the calculation unit 122 calculates the digest value of the set data 12 by executing the digest function with the set data 12 (data 1 and data 2) as input.
Then, the signature unit 125 generates the signature 12 by encrypting the digest value of the set data 12 using the secret key 2.
The signature 12 makes it possible to verify the authenticity and integrity of the tuple data 12.

In step S 125, the message generation unit 126 generates message 2 (processing message) using the set data 12 and the signature 12.
Message 2 is a message including set data 12 and signature 12.

In step S126, the distribution unit 129S distributes the message 2. Message 2 is delivered to device 3.

Next, the device 3 operates as follows. The operation of the device 3 will be described with reference to FIG.
In step S121, accepting unit 129R accepts message 2 (delivery message).

In step S122, the verification unit 123 verifies the signature 12.
Specifically, the signature 12 is verified as follows.
First, the extraction unit 121 extracts the set data 12 (distribution data) and the signature 12 from the message 2.
Next, the calculation unit 122 calculates the digest value of the set data 12 by executing the digest function with the set data 12 as an input.
Next, the verification unit 123 calculates the decrypted value of the signature 12 by decrypting the signature 12 using the public key 2.
Then, the verification unit 123 compares the digest value of the set data 12 with the decrypted value of the signature 12.
If the digest value of the set data 12 matches the decrypted value of the signature 12, the verification of the signature 12 is successful. If the verification of the signature 12 is successful, the authenticity and integrity of the set data 12 are ensured. That is, the authenticity and completeness of the set of data 1 and data 2 are ensured.
If verification of the signature 12 is successful, the process proceeds to step S123.
When the verification of the signature 12 fails, the subsequent processing is not performed.

In step S123, the processing unit 124 generates data 3 (processing data).
Specifically, the data 3 is generated as follows.
First, the extraction unit 121 extracts data 2 (target data) from the message 2.
Then, the processing unit 124 generates the data 3 by processing the data 2 according to the operation of the user 3. User 3 is a user of device 3.

In step S 124, the signature unit 125 generates a signature 23.
Specifically, the signature 23 is generated as follows.
First, the calculation unit 122 calculates the digest value of the set data 23 by executing the digest function with the set data 23 (data 2 and data 3) as input.
Then, the signature unit 125 generates the signature 23 by encrypting the digest value of the set data 23 using the secret key 3.
The signature 23 makes it possible to verify the authenticity and integrity of the set data 23. That is, the signature 23 makes it possible to verify the authenticity and completeness of the set of data 2 and data 3.

In step S 125, the message generation unit 126 generates a message 3 (processing message) using the set data 23 and the signature 23.
Message 3 is a message including set data 23 and signature 23.

In step S126, the distribution unit 129S distributes the message 3. Message 3 is delivered to device U.

Next, the device U operates as follows. The operation of the device U will be described with reference to FIG.
In step S131, accepting unit 129R accepts message 3 (delivery message).

In step S132, the verification unit 123 verifies the signature 23.
Specifically, the signature 23 is verified as follows.
First, the extraction unit 131 extracts the set data 23 (distribution data) and the signature 23 from the message 3.
Next, the calculation unit 132 calculates the digest value of the set data 23 by executing the digest function with the set data 23 as an input.
Next, the verification unit 133 calculates the decrypted value of the signature 23 by decrypting the signature 23 using the public key 3.
Then, the verification unit 133 compares the digest value of the set data 23 with the decrypted value of the signature 23.
If the digest value of the set data 23 matches the decrypted value of the signature 23, the signature 23 has been successfully verified. If the verification of the signature 23 is successful, the authenticity and integrity of the set data 23 are ensured. That is, the authenticity and completeness of the set of data 2 and data 3 are ensured.
If the verification of the signature 23 is successful, the process proceeds to step S133.
When the verification of the signature 23 fails, the subsequent processing is not performed.

In step S 133, the use unit 134 uses the data 3.
Specifically, data 3 is used as follows.
First, the extraction unit 131 extracts data 3 (target data) from the message 3.
Then, the utilization unit 134 performs data processing using the data 3.

*** Example of Embodiment 1 ***
The message delivery system 100 can be applied to a system for delivering a dynamic map.
With the spread of satellite positioning technology, automatic driving using three-dimensional position information is being studied, and research and development for advanced map information technology (dynamic map) is being conducted.
The dynamic map includes static information, quasi-static information, quasi-dynamic information, dynamic information, and the like. In the dynamic map, information of each layer is linked.
The static information is information such as road surface information, lane information, and three-dimensional structure information.
The quasi-static information is information such as traffic regulation information, road construction information, and wide area weather information.
The quasi-dynamic information is information such as accident information, traffic jam information, and narrow area weather information.
The dynamic information is information such as surrounding vehicles, pedestrian information, and signal information.

The automatic driving dynamic map is mounted on an automatic driving vehicle or a car navigation device.
For example, the dynamic map for automatic driving is configured by adding application data dedicated to a map company and application data dedicated to an automobile company to base map information (static information).

The base map information is information generated based on measurement data obtained by the mobile measurement device. The map management device manages the base map information and provides the base map information to the map company device. The map company device is a device managed by the map company.
The map company device generates map company data by modifying part or all of the base map information acquired from the map management device, and provides the map company data to the car company device. The map company data is application data dedicated to the map company. The automobile company device is a device managed by the automobile company.
The automobile company apparatus generates automobile company data by modifying part or all of the map company data acquired from the map company apparatus, and provides the automobile company data to the autonomous driving vehicle. The automobile company data is application data dedicated to the automobile company.
The autonomous driving vehicle performs automatic driving based on the automobile company data acquired from the automobile company device.

The message delivery system 100 is applied to a system for delivering a dynamic map as follows.
The message delivery system 100 includes a message generation device 110 (device 0), two message processing devices 120 (device 1 and device 2), and a message utilization device 130 (device U).
The device 0 is a map management device. Data 0 is base map information.
The device 1 is a map company device. Data 1 is map company data.
Device 2 is an automobile company device. Data 2 is automobile company data.
Device U is an autonomous driving vehicle.

The map management device generates base map information, generates a signature 0 for the base map information, generates a message 0 including the base map information and the signature 0, and distributes the message 0 to the map company device.
The map company device receives message 0 and verifies signature 0. If the verification of the signature 0 fails, the map company device detects falsification of the base map information. If the verification of the signature 0 is successful, the map company device generates the map company data by processing the base map information, generates the signature 01 for the set data 01 including the base map information and the map company data, and sets the set Message 1 including data 01 and signature 01 is generated, and message 1 is distributed to the automobile company device.
The car company device receives the message 1 and verifies the signature 01. When verification of the signature 01 fails, the automobile company device detects falsification of the group data 01. When the verification of the signature 01 is successful, the automobile company device generates the automobile company data by processing the map company data, generates the signature 12 for the set data 12 including the map company data and the automobile company data, The message 2 including the data 12 and the signature 12 is generated, and the message 2 is distributed to the autonomous driving vehicle.
The autonomous vehicle receives message 2 and verifies signature 12. If verification of the signature 12 fails, the autonomous driving vehicle detects falsification of the set data 12. If the verification of the signature 12 is successful, the autonomous driving vehicle performs autonomous driving using the automobile company data.

*** Effects of Embodiment 1 ***
In the first embodiment, a signature is set for a set of pre-processing data (target data) and post-processing data (processing data).
Therefore, tracing back from the signature 23 in the order of the signature 12, signature 01, and signature 0, it can be confirmed under the reliability of the certificate authority that the original data of the data 3 is the data 0.
Further, there is an effect that the integrity of data 0, data 1, data 2 and data 3 can be confirmed by signature 0, signature 01, signature 12 and signature 23.

Embodiment 2. FIG.
With respect to the form in which the digest value of the target data is included in the set data instead of the target data, differences from the first embodiment will be mainly described based on FIG.

*** Explanation of configuration ***
The configurations of message distribution system 100, message generation device 110, message processing device 120, and message utilization device 130 are the same as those in the first embodiment.

*** Explanation of operation ***
The message delivery method will be described based on FIG.
The device 0 is a message generation device 110.
The device n is a message processing device 120-n.
The device U is a message using device 130.

The digest value 0 is a digest value of data 0.
The digest value n is a digest value of the data n.

Signature 0 is a signature for data 0.
The signature XY is a signature for the set data XY.
The set data XY is data including a digest value X and data Y. Specifically, the set data XY is data composed of a digest value X and data Y.

Next, the device 0 operates as follows. The operation of the device 0 will be described with reference to FIG.
In step S111, the data generation unit 111 generates data 0 (initial data).
Specifically, data 0 is generated as follows.
First, the accepting unit 119R accepts electronic information that is the source of data 0.
And the data generation part 111 produces | generates the data 0 by processing the received electronic information according to operation of the user 0. FIG.

In step S112, the signature unit 113 generates a signature 0.
Specifically, signature 0 is generated as follows.
First, the calculation unit 112 calculates the digest value of the data 0 by executing the digest function with the data 0 as an input.
Then, the signature unit 113 generates the signature 0 by encrypting the digest value of the data 0 using the secret key 0.

In step S123, the processing unit 124 generates data 1 (processing data).
Specifically, data 1 is generated as follows.
First, the extraction unit 121 extracts data 0 (target data) from the message 0.
Then, the processing unit 124 generates the data 1 by processing the data 0 according to the operation of the user 1.

In step S124, the signature unit 125 generates a signature 01.
Specifically, the signature 01 is generated as follows.
First, the calculation unit 122 calculates a digest value 0 by executing a digest function with data 0 (target data) as an input.
Next, the calculation unit 122 calculates the digest value of the set data 01 by executing the digest function with the set data 01 (digest value 0 and data 1) as input.
Then, the signature unit 125 generates the signature 01 by encrypting the digest value of the set data 01 using the secret key 1.
The signature 01 makes it possible to verify the authenticity and integrity of the tuple data 01. In other words, the signature 01 makes it possible to verify the authenticity and completeness of the set of data 0 and data 1.

In step S123, the processing unit 124 generates data 2 (processing data).
Specifically, data 2 is generated as follows.
First, the extraction unit 121 extracts data 1 (target data) from the message 1.
And the process part 124 produces | generates the data 2 by processing the data 1 according to operation of the user 2. FIG.

In step S124, the signature unit 125 generates the signature 12.
Specifically, the signature 12 is generated as follows.
First, the calculation unit 122 calculates a digest value 1 by executing a digest function with data 1 (target data) as an input.
Next, the calculation unit 122 calculates the digest value of the set data 12 by executing the digest function with the set data 12 (digest value 1 and data 2) as input.
Then, the signature unit 125 generates the signature 12 by encrypting the digest value of the set data 12 using the secret key 2.
The signature 12 makes it possible to verify the authenticity and integrity of the tuple data 12. That is, the signature 12 makes it possible to verify the authenticity and integrity of the data 1 and data 2 pair.

In step S123, the processing unit 124 generates data 3 (processing data).
Specifically, the data 3 is generated as follows.
First, the extraction unit 121 extracts data 2 (target data) from the message 2.
Then, the processing unit 124 generates the data 3 by processing the data 2 according to the operation of the user 3.

In step S 124, the signature unit 125 generates a signature 23.
Specifically, the signature 23 is generated as follows.
First, the calculation unit 122 calculates a digest value 2 by executing a digest function with data 2 (target data) as an input.
Next, the calculation unit 122 calculates the digest value of the set data 23 by executing the digest function with the set data 23 (digest value 2 and data 3) as input.
Then, the signature unit 125 generates the signature 23 by encrypting the digest value of the set data 23 using the secret key 3.
The signature 23 makes it possible to verify the authenticity and integrity of the set data 23. That is, the signature 23 makes it possible to verify the authenticity and integrity of the data 2 and data 3 pair.

*** Example of Embodiment 2 ***
The message delivery system 100 can be applied to a system for delivering a dynamic map.

The map management device generates base map information, generates a signature 0 for the base map information, generates a message 0 including the base map information and the signature 0, and distributes the message 0 to the map company device.
The map company device receives message 0 and verifies signature 0. If the verification of the signature 0 fails, the map company device detects falsification of the base map information. When the verification of the signature 0 is successful, the map company device generates the map company data by processing the base map information, and calculates the digest value 0 of the base map information. Then, the map company device generates a signature 01 for the set data 01 including the digest value 0 and the map company data, generates a message 1 including the set data 01 and the signature 01, and sends the message 1 to the car company device. Delivered to.
The car company device receives the message 1 and verifies the signature 01. When verification of the signature 01 fails, the automobile company device detects falsification of the group data 01. If the verification of the signature 01 is successful, the car company device generates car company data by processing the map company data, and calculates a digest value 1 of the map company data. Then, the automobile company device generates a signature 12 for the set data 12 including the digest value 1 and the automobile company data, generates a message 2 including the set data 12 and the signature 12, and sends the message 2 to the autonomous driving vehicle. Delivered to.
The autonomous vehicle receives message 2 and verifies signature 12. If verification of the signature 12 fails, the autonomous driving vehicle detects falsification of the set data 12. If the verification of the signature 12 is successful, the autonomous driving vehicle performs autonomous driving using the automobile company data.

*** Effects of Embodiment 2 ***
In the second embodiment, a signature is set for a set of a digest value of data before processing (target data) and data after processing (processing data).
Therefore, tracing back from the signature 23 in the order of the signature 12, signature 01, and signature 0, it can be confirmed under the reliability of the certificate authority that the original data of the data 3 is the data 0.
Further, the integrity of data 0, data 1, data 2 and data 3 can be confirmed by signature 0, signature 01, signature 12 and signature 23 via digest value 0, digest value 1 and digest value 2. . The integrity of the data 3 can be confirmed by the signature 23.

Furthermore, since the message is constructed using the digest value, there is an effect of reducing the communication amount of the delivery route.

Embodiment 3 FIG.
With respect to the form in which the digest value of the distribution data is included in the set data instead of the target data, differences from the first embodiment will be mainly described based on FIG.

Signature 0 is a signature for data 0.
The digest value 0 is a digest value of data 0.

The signature XY is a signature for the set data XY.
The digest value XY is a digest value of the set data XY.
The set data XY is data including a digest value X and data Y. Specifically, the set data XY is data composed of a digest value X and data Y.

In step S124, the signature unit 125 generates the signature 12.
Specifically, the signature 12 is generated as follows.
First, the calculation unit 122 calculates the digest value 01 by executing the digest function with the set data 01 (distribution data) as an input.
Next, the calculation unit 122 calculates the digest value of the set data 012 by executing the digest function with the set data 012 (digest value 01 and data 2) as input.
Then, the signature unit 125 generates a signature 012 by encrypting the digest value of the set data 012 using the secret key 2.
The signature 012 makes it possible to verify the authenticity and integrity of the tuple data 012. That is, the signature 012 makes it possible to verify the authenticity and integrity of the data set from data 0 to data 2.

In step S 125, the message generation unit 126 generates a message 2 (processing message) using the set data 012 and the signature 012.
Message 2 is a message including set data 012 and signature 012.

In step S122, the verification unit 123 verifies the signature 012.
Specifically, the signature 012 is verified as follows.
First, the extraction unit 121 extracts the set data 012 (delivery data) and the signature 12 from the message 2.
Next, the calculation unit 122 calculates the digest value of the set data 012 by executing the digest function with the set data 012 as an input.
Next, the verification unit 123 calculates the decrypted value of the signature 012 by decrypting the signature 012 using the public key 2.
Then, the verification unit 123 compares the digest value of the set data 012 with the decrypted value of the signature 012.
If the digest value of the set data 012 matches the decrypted value of the signature 012, the signature 012 has been successfully verified. If the verification of the signature 012 is successful, the authenticity and integrity of the set data 012 are ensured. That is, the authenticity and completeness of the data set from data 0 to data 2 is ensured.
If the verification of the signature 012 is successful, the process proceeds to step S123.
If the verification of the signature 012 fails, the subsequent processing is not performed.

In step S124, the signature unit 125 generates a signature 0123.
Specifically, the signature 0123 is generated as follows.
First, the calculation unit 122 calculates a digest value 012 by executing a digest function with the set data 012 (distribution data) as an input.
Next, the calculation unit 122 calculates the digest value of the set data 0123 by executing the digest function with the set data 0123 (digest value 012 and data 3) as input.
Then, the signature unit 125 generates a signature 0123 by encrypting the digest value of the set data 0123 using the secret key 3.
The signature 0123 makes it possible to verify the authenticity and integrity of the tuple data 0123. In other words, the signature 0123 makes it possible to verify the authenticity and integrity of the data set from data 0 to data 3.

In step S125, the message generation unit 126 generates message 3 (processing message) using the set data 0123 and the signature 0123.
Message 3 is a message including set data 0123 and signature 0123.

In step S132, the verification unit 123 verifies the signature 0123.
Specifically, the signature 0123 is verified as follows.
First, the extraction unit 131 extracts the set data 0123 (delivery data) and the signature 0123 from the message 3.
Next, the calculation unit 132 calculates the digest value of the set data 0123 by executing the digest function with the set data 0123 as an input.
Next, the verification unit 133 calculates the decryption value of the signature 0123 by decrypting the signature 0123 using the public key 3.
Then, the verification unit 133 compares the digest value of the set data 0123 with the decrypted value of the signature 0123.
When the digest value of the set data 0123 matches the decrypted value of the signature 0123, the verification of the signature 0123 is successful. When the verification of the signature 0123 is successful, the authenticity and completeness of the set data 0123 are ensured. That is, the authenticity and completeness of the data set from data 0 to data 3 is ensured.
If verification of the signature 0123 is successful, the process proceeds to step S133.
When the verification of the signature 0123 fails, the subsequent processing is not performed.

*** Example of Embodiment 3 ***
The message delivery system 100 can be applied to a system for delivering a dynamic map.

The map management device generates base map information, generates a signature 0 for the base map information, generates a message 0 including the base map information and the signature 0, and distributes the message 0 to the map company device.
The map company device receives message 0 and verifies signature 0. If the verification of the signature 0 fails, the map company device detects falsification of the base map information. When the verification of the signature 0 is successful, the map company device generates the map company data by processing the base map information, and calculates the digest value 0 of the base map information. Then, the map company device generates a signature 01 for the set data 01 including the digest value 0 and the map company data, generates a message 1 including the set data 01 and the signature 01, and sends the message 1 to the car company device. Delivered to.
The car company device receives the message 1 and verifies the signature 01. When verification of the signature 01 fails, the automobile company device detects falsification of the group data 01. When the verification of the signature 01 is successful, the car company device processes the car company data to generate car company data, and calculates the digest value 01 of the set data 01. Then, the automobile company device generates a signature 012 for the set data 012 including the digest value 01 and the automobile company data, generates a message 2 including the set data 012 and the signature 012, and sends the message 2 to the autonomous driving vehicle. Delivered to.
The autonomous vehicle receives message 2 and verifies signature 012. When the verification of the signature 012 fails, the autonomous driving vehicle detects falsification of the set data 012. If the verification of the signature 012 is successful, the autonomous driving vehicle performs autonomous driving using the automobile company data.

*** Effects of Embodiment 3 ***
In the third embodiment, a signature is signed for a set of a digest value of distribution data and processed data (target data).
Therefore, the digest value along the route in which the data is processed is included in the message, and it can be confirmed under the reliability of the certificate authority that the original data of data 3 is data 0.
Specifically, based on the signature 0123, the data before processing of data 3 is data 2, the data before processing of data 2 is data 1, and the data before processing of data 1 is processed by the signature 0123. It can be confirmed that the data is 0. Further, it can be confirmed from the signature 012 that the data before processing of data 2 is data 1 and the data before processing of data 1 is data 0 by going back the data path.
Further, the integrity of data 0, data 1, data 2 and data 3 is confirmed by signature 0, signature 01, signature 012 and signature 0123 via digest value 0, digest value 01, digest value 012 and digest value 0123. can do. The integrity of data 3 can be confirmed by signature 0123.

Embodiment 4 FIG.
With respect to the form in which each message processing device 120 generates a pair of a secret key and a public key, differences from Embodiments 1 to 3 will be mainly described with reference to FIGS. 11 to 14.

*** Explanation of configuration ***
Based on FIG. 11, the structure of the message production | generation apparatus 110 is demonstrated.
The message generation device 110 further includes an authentication unit 115 as a software element.
The message generation program further causes the computer to function as the authentication unit 115.

Based on FIG. 12, the structure of the message processing apparatus 120 is demonstrated.
The message processing device 120 further includes a key generation unit 127 as a software element.
The message processing program further causes the computer to function as the key generation unit 127.

The configuration of the message using device 130 is the same as that of the first embodiment.

*** Explanation of operation ***
The operation of the message delivery system 100 will be described based on FIG.
The device 0 is a message generation device 110.
The device n is a message processing device 120-n.
The device U is a message using device 130.

CA stands for Certification Authority. That is, the main CA is a main certificate authority and the sub CA is a sub certificate authority. The sub CAn is a sub certificate authority in the device n. The primary certificate authority is a certificate authority that authenticates the secondary certificate authority. The sub certificate authority is a certificate authority that receives authentication from the main certificate authority.
The device 0 functions as a main CA. Specifically, the authentication unit 115 of the device 0 functions as a main CA.
The device n functions as a sub CAn. Specifically, the key generation unit 127 of the device n functions as a sub CAn.

First, the main CA and the sub CAn operate as follows.
The main CA generates a private key 0 and a certificate 0 and distributes the certificate 0 to each of the devices n and U. The storage unit 119M of the device 0 stores the secret key 0, the storage unit 129M of the device n stores the certificate 0, and the storage unit 139M of the device U stores the certificate 0. Private key 0 is stored securely, and certificate 0 is distributed over a secure path.
The sub CAn generates a private key n and a certificate n and sends the certificate n to the main CA. The main CA receives the certificate n, generates a signature for the public key n, and sends the signed certificate n to the sub CAn. Then, the sub CAn receives the signed certificate n. In the signed certificate n, the signature of the main CA with respect to the public key n is embedded. The storage unit 129M of the device n stores a secret key n and a public key n with a signature.
The sub CA 1 distributes the signed certificate 1 to the device 2. The storage unit 129M of the device 2 stores the certificate 1 with a signature.
The sub CA 2 distributes the signed certificate 2 to the device 3. The storage unit 129M of the device 3 stores the certificate 2 with a signature.
The sub CA 3 distributes the signed certificate 3 to the device U. The storage unit 139M of the device U stores the signed certificate 3.
In each device, the private key n and the signed public key n are securely stored.
Each device verifies the signed certificate n using the public key 0 included in the certificate 0.

*** Supplement of Embodiment 4 ***
In FIG. 13, as in the second embodiment, a mode has been described in which the digest value of the target data is included in the set data instead of the target data.
However, as in the third embodiment, the fourth embodiment may include a form in which the digest value of the distribution data is included in the set data instead of the target data (see FIG. 14).

*** Example of Embodiment 4 ***
The message delivery system 100 can be applied to a system for delivering a dynamic map.

*** Effects of Embodiment 4 ***
In the fourth embodiment, a sub CA is provided under the authentication of the main CA.
Therefore, it is possible to construct a system avoiding the risks associated with the distribution of the secret key. In addition, the load on the main CA accompanying the distribution of the key pair can be reduced.

The sub CA can freely generate a key pair.
Therefore, the organization to which each device belongs can perform detailed operations according to its own service category. For example, each organization can generate a key pair for each distribution destination when there are multiple distribution destinations of the generated data, or generate a key pair for each data when there are multiple types of generated data. Data management according to the service category and management for integrity check can be performed.

*** Supplement to the embodiment ***
Message distribution may be either communication distribution or manual distribution.
That is, the message may be communicated between the devices via the network, or may be input / output to each device manually.

The message processing device 120 may be composed of a plurality of computers.
For example, the message processing device 120 in the fourth embodiment may be composed of a first computer and a second computer. The first computer implements an extraction unit 121, a calculation unit 122, a verification unit 123, a processing unit 124, a signature unit 125, and a message generation unit 126. The second computer implements a key generation unit 127.

Based on FIG. 15, the hardware configuration of the message generation device 110 will be described.
The message generation device 110 includes a processing circuit 991.
The processing circuit 991 is hardware that implements the data generation unit 111, the calculation unit 112, the signature unit 113, the message generation unit 114, the authentication unit 115, and the storage unit 119M.
The processing circuit 991 may be dedicated hardware or a processor 911 that executes a program stored in the memory 912.

When the processing circuit 991 is dedicated hardware, the processing circuit 991 is, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination thereof.
ASIC is an abbreviation for Application Specific Integrated Circuit, and FPGA is an abbreviation for Field Programmable Gate Array.
The message generation device 110 may include a plurality of processing circuits that replace the processing circuit 991. The plurality of processing circuits share the role of the processing circuit 991.

In the processing circuit 991, some functions may be realized by dedicated hardware, and the remaining functions may be realized by software or firmware.

Thus, the processing circuit 991 can be realized by hardware, software, firmware, or a combination thereof.

Based on FIG. 16, the hardware configuration of the message processing device 120 will be described.
The message processing device 120 includes a processing circuit 992.
The processing circuit 992 is hardware that implements the extraction unit 121, the calculation unit 122, the verification unit 123, the processing unit 124, the signature unit 125, the message generation unit 126, the key generation unit 127, and the storage unit 129M.
The processing circuit 992 may be dedicated hardware or a processor 921 that executes a program stored in the memory 922.

When the processing circuit 992 is dedicated hardware, the processing circuit 992 is, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination thereof.
The message processing device 120 may include a plurality of processing circuits replacing the processing circuit 992. The plurality of processing circuits share the role of the processing circuit 992.

In the processing circuit 992, some functions may be realized by dedicated hardware, and the remaining functions may be realized by software or firmware.

Thus, the processing circuit 992 can be realized by hardware, software, firmware, or a combination thereof.

Based on FIG. 17, the hardware configuration of the message using device 130 will be described.
The message using device 130 includes a processing circuit 993.
The processing circuit 993 is hardware that implements the extraction unit 131, the calculation unit 132, the verification unit 133, the use unit 134, and the storage unit 139M.
The processing circuit 993 may be dedicated hardware or a processor 921 that executes a program stored in the memory 932.

When the processing circuit 993 is dedicated hardware, the processing circuit 993 is, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination thereof.
The message utilization device 130 may include a plurality of processing circuits that replace the processing circuit 993. The plurality of processing circuits share the role of the processing circuit 993.

In the processing circuit 993, some functions may be realized by dedicated hardware, and the remaining functions may be realized by software or firmware.

Thus, the processing circuit 993 can be realized by hardware, software, firmware, or a combination thereof.

The embodiment is an example of a preferred embodiment and is not intended to limit the technical scope of the present invention. The embodiment may be implemented partially or in combination with other embodiments. The procedure described using the flowchart and the like may be changed as appropriate.

100 message distribution system, 110 message generation device, 111 data generation unit, 112 calculation unit, 113 signature unit, 114 message generation unit, 115 authentication unit, 119M storage unit, 119R reception unit, 119S distribution unit, 120 message processing device, 121 Extraction unit, 122 calculation unit, 123 verification unit, 124 processing unit, 125 signature unit, 126 message generation unit, 127 key generation unit, 129M storage unit, 129R reception unit, 129S delivery unit, 130 message using device, 131 extraction unit, 132 calculation unit, 133 verification unit, 134 use unit, 139M storage unit, 139R reception unit, 911 processor, 912 memory, 913 auxiliary storage device, 914 input / output interface, 921 processor, 922 memo , 923 an auxiliary storage device, 924 output interface, 931 a processor, 932 a memory, 933 an auxiliary storage device, 934 output interface, 991,992,993 processing circuit.

Claims

A reception unit for receiving delivery messages;
An extraction unit for extracting target data to be processed from the delivery message;
A processing unit that generates processing data by processing the target data;
A signature unit that generates a signature for the set data including the target data and the processed data;
A message processing device comprising: a message generation unit that generates a processed message including the set data and a signature for the set data.
A reception unit for receiving delivery messages;
An extraction unit for extracting target data to be processed from the delivery message;
A processing unit that generates processing data by processing the target data;
A calculation unit for calculating a digest value of the target data;
A signature unit for generating a signature for the set data including the digest value of the target data and the processed data;
A message processing device comprising: a message generation unit that generates a processed message including the set data and a signature for the set data.
A reception unit for receiving delivery messages;
An extraction unit for extracting target data to be processed from the delivery message;
A processing unit that generates processing data by processing the target data;
A calculation unit that calculates a digest value of distribution data that is data included in the distribution message and includes the target data;
A signature unit that generates a signature for the set data including the digest value of the distribution data and the processed data;
A message processing device comprising: a message generation unit that generates a processed message including the set data and a signature for the set data.
The delivery message includes delivery data including the target data and a signature for the delivery data,
The message processing device includes a verification unit that verifies a signature for the distribution data,
The message processing device according to any one of claims 1 to 3, wherein the processing unit generates the processed data when verification of a signature on the distribution data is successful.
The message processing device according to any one of claims 1 to 4, further comprising a distribution unit that distributes the processed message.
The message processing device includes a key generation unit that generates a public key distributed to a distribution destination of the processed message and a secret key corresponding to the public key,
The message processing device according to claim 1, wherein the signature unit generates a signature for the set data using the generated secret key.
7. The message processing apparatus according to claim 1, wherein the message processing apparatus is configured by a plurality of computers.
A message generation unit that generates a distribution message that is a message distributed to a map company device and includes a base map information;
The map company device generates map company data by processing the base map information, generates a signature for the set data including the base map information and the map company data, and the set data and the set data A map management device that generates a processing message that includes a signature for the.
A message generation unit that generates a distribution message that is a message distributed to a map company device and includes a base map information;
The map company device generates map company data by processing the base map information, calculates a digest value of the base map information, and includes a digest value of the base map information and the map company data A map management apparatus for generating a signature for data and generating a processing message including the set data and a signature for the set data.
The map management apparatus according to claim 8 or 9, further comprising a key generation unit that generates a public key distributed to a delivery destination of the processed message and a secret key corresponding to the public key.
A reception unit for receiving a delivery message including the base map information;
An extraction unit for extracting the base map information from the delivery message;
A processing unit for generating map company data by processing the base map information;
A signature unit that generates a signature for the set data including the base map information and the map company data;
A map company device comprising a message generation unit that generates a processing message including the set data and a signature for the set data.
A reception unit for receiving a delivery message including the base map information;
An extraction unit for extracting the base map information from the delivery message;
A processing unit for generating map company data by processing the base map information;
A calculation unit for calculating a digest value of the base map information;
A signature unit that generates a signature for the set data including the digest value of the base map information and the map company data;
A map company device comprising a message generation unit that generates a processing message including the set data and a signature for the set data.
The map company device includes a key generation unit that generates a public key distributed to a delivery destination of the processed message and a secret key corresponding to the public key,
The map company device according to claim 11 or 12, wherein the signature unit generates a signature for the set data using the generated secret key.
A reception unit for receiving a delivery message including map company data generated by processing the base map information;
An extraction unit for extracting the map company data from the delivery message;
A processing unit for generating automobile company data by processing the map company data;
A signature unit for generating a signature for the set data including the map company data and the car company data;
An automobile company apparatus comprising: a message generation unit that generates a processing message including the set data and a signature for the set data.
A reception unit for receiving a delivery message including map company data generated by processing the base map information;
An extraction unit for extracting the map company data from the delivery message;
A processing unit for generating automobile company data by processing the map company data;
A calculation unit for calculating a digest value of the map company data;
A signature unit that generates a signature for the set data including the digest value of the map company data and the automobile company data;
An automobile company apparatus comprising: a message generation unit that generates a processing message including the set data and a signature for the set data.
A reception unit that receives a distribution message including distribution data including a digest value of the base map information and map company data generated by processing the base map information;
An extraction unit for extracting the map company data from the delivery message;
A processing unit for generating automobile company data by processing the map company data;
A calculation unit for calculating a digest value of the distribution data;
A signature unit that generates a signature for the set data including the digest value of the distribution data and the automobile company data;
An automobile company apparatus comprising: a message generation unit that generates a processing message including the set data and a signature for the set data.
The automobile company apparatus includes a key generation unit that generates a public key distributed to a delivery destination of the processed message and a secret key corresponding to the public key,
The automobile company device according to any one of claims 14 to 16, wherein the signature unit generates a signature for the set data by using a generated secret key.