Communication method, transmitter, and receiver

Abstract

To provide a communication method for accurately determining alteration of data with a simple configuration.SOLUTION: A communication method includes: a first step of performing communication between a control unit 100 and a medium processing device 200; a second step that is performed after the first step, the second step of calculating a hash value based on a random number and communication data located after the random number; a third step of transmitting the communication data, the hash value, and the random number from the control unit 100 to the medium processing device 200 through a first path; a fourth step of outputting the random number transmitted from the control unit 100, and a first time when the random number, the communication data, or the hash value is transmitted; and a fifth step of outputting the random number received by the medium processing device 200, and a second time when the random number, the communication data, or the hash value is received. The method further includes referring to the random number output from the control unit 100 and the first time and the random number output from the medium processing device 200 and the second time through a second path different from the first path, and when a result of the reference is a mismatch, determining that there is a fraud.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to a communication method, a transmitter and a receiver. [Background technology]

[0002] Conventionally, devices for detecting tampering have been known. For example, the Web page tampering detection system disclosed in Patent Document 1 periodically generates a hash value of Web page data stored in a public directory, and compares the generated hash value with the hash value in the timestamp token stored in the original storage directory. If the comparison and verification reveals a difference between the two hash values, it is determined that the Web page data has been tampered with. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2007-257348 A Summary of the Invention [Problem to be solved by the invention]

[0004] A time stamp token is a combination of a hash value of data, time information, and a digital signature, and is highly reliable, but requires a server device such as a time certification authority, which increases the system configuration and requires waiting for the processing time of the server device. [Means for solving the problem]

[0005] The communication method of the present disclosure is a communication method between a transmitter and a receiver, comprising a first step of communicating between the transmitter and the receiver, a second step performed after the first step of calculating a hash value based on a random number and communication data following the random number, a third step of transmitting the communication data, the hash value, and the random number from the transmitter to the receiver via a first route, a fourth step of outputting the random number and a first time when the transmitter transmitted the random number, the communication data, or the hash value, and a fourth step of outputting the random number received by the receiver and a second time when the random number, the communication data, or the hash value was received. and a fifth step of outputting a random number after the communication data in the third step, wherein the random number and the first time output by the transmitter and the random number and the second time output by the receiver are compared via a second route different from the first route, and if they do not match, the random number and the first time output by the receiver are judged to be fraudulent, if the time from the first step to the third step exceeds a threshold value, the random number and the second time output by the receiver are judged to be fraudulent, and if a hash value calculated by the receiver based on the random number and the communication data received from the transmitter and a hash value received in the third step do not match, the random number and the first time output by the receiver are judged to be fraudulent.

[0006] The transmitter of the present disclosure is a transmitter equipped with a communication interface that enables communication with a receiver via a first route, and a first processor that transmits communication data to the receiver via the communication interface, wherein the first processor executes the following steps: a first step of communicating with the receiver; a second step that is performed after the first step, of calculating a hash value based on a random number and the communication data following the random number; a third step of transmitting the communication data, the hash value, and the random number to the receiver via the communication interface in the order in which the random number is sent after the communication data; a fourth step of outputting the random number and a first time when the random number, the communication data, or the hash value was transmitted; and a fifth step of outputting the random number and the first time when the random number, the communication data, or the hash value was transmitted so that they can be referenced via a second route different from the first route against the random number and second time output by the receiver.

[0007] The receiver disclosed herein is a receiver equipped with a communication interface that enables communication with a transmitter via a first route, and a second processor that receives communication data from the transmitter via the communication interface, wherein the second processor executes the following steps: communicating with the transmitter; receiving the communication data, hash value, and random number transmitted from the transmitter via the communication interface in the order in which the random number is received after the communication data; and outputting the random number received by the receiver and a second time at which the random number, the communication data, or the hash value was received so that the random number and the first time output by the transmitter can be referenced via a second route different from the first route. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 shows the configuration of a media processing system according to a first embodiment. [Diagram 2] 5 is a flowchart showing the operation of the control device and media processing device under normal conditions. [Diagram 3] 4 shows data sent and received between a control device and a media processing device under normal conditions. [Figure 4] FIG. 13 shows data exchanged between a control device and a media processing device when attack case A is detected. [Diagram 5] FIG. 13 shows data exchanged between a control device and a media processing device when attack case B has occurred. [Figure 6] FIG. 13 shows data exchanged between a control device and a media processing device when attack case C is present. [Figure 7] 13 is a flowchart showing the operations of the control device, the media processing device, and the third party terminal in attack case C. [Figure 8] 13 is a flowchart showing the operations of a control device, a media processing device, and a third-party terminal in attack case D. [Figure 9] FIG. 13 shows data exchanged between a control device and a media processing device when attack case E has occurred. [Figure 10]13 is a flowchart showing the operations of the control device, media processing device, and third-party terminal in attack case E. [Figure 11] FIG. 13 shows data exchanged between a control device and a media processing device when attack case F is detected. [Figure 12] FIG. 13 is a diagram showing the system configuration of a media processing system according to a second embodiment. [Figure 13] FIG. 13 is a diagram showing the system configuration of a media processing system according to a third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] [System configuration of the first embodiment] FIG. 1 shows the configuration of a media processing system 1A according to the first embodiment. Media processing system 1A comprises a control device 100 and a media processing device 200, which are connected via a network NW. The control device 100 corresponds to a transmitter, and the media processing device 200 corresponds to a receiver. The network NW may be established using physical lines, or may be established using virtual lines such as a VPN (Virtual Private Network).

[0010] The media processing system 1A shown in Fig. 1 is configured to include one control device 100, but it may also be configured to include multiple control devices 100. Also, the media processing system 1A shown in Fig. 1 is configured to include one media processing device 200, but it may also be configured to include multiple media processing devices 200. In this case, the multiple media processing devices 200 make up one media processing unit.

[0011] The control device 100 is a computer device that causes the media processing device 200 to create media M with data written to its recording side and an image printed on its label side. In other words, the control device 100 controls the media processing device 200 to cause the media processing device 200 to write data to the media M and print on the label side of the media M. The control device 100 shown in Fig. 1 is shown as a desktop computer, but it may also be a laptop or tablet type. The media M corresponds to a medium.

[0012] The media processing device 200 is a device that writes data to media M, such as CDs, DVDs, and BDs, and prints on the label side of media M, creating media M with data written on the recording side and images printed on the label side.

[0013] [Functional configuration of the control device] Next, the functional configuration of the control device 100 will be described.

[0014] The control device 100 includes a first control unit 150, a first network communication unit 110, an input unit 120, and a display unit .

[0015] The first control unit 150 includes a first storage unit 160 and a first processor 170 that executes a program such as a CPU or an MPU.

[0016] The first control unit 150 performs various processes through cooperation between hardware and software, such as the first processor 170 reading out the control program 161 and driver software 165, etc., stored in the first memory unit 160, and executing the processes.

[0017] Driver software 165 is installed in the control device 100. The first control unit 150 realizes various functions by the first processor 170 reading and executing the driver software 165.

[0018] The first storage unit 160 has a storage area for storing programs executed by the first processor 170 and data processed by the first processor 170. The first storage unit 160 stores a control program 161 executed by the first processor 170, setting data 163 including various setting values ​​related to the operation of the control device 100, driver software 165, and various other data. The first storage unit 160 has a nonvolatile storage area for nonvolatilely storing programs and data. The first storage unit 160 may also include a volatile storage area and constitute a work area for temporarily storing programs executed by the first processor 170 and data to be processed.

[0019] The first network communication unit 110 is composed of communications hardware that complies with a specific communications standard, and performs mutual data communication with the media processing device 200 under the control of the first control unit 150. Examples of communications hardware include hardware such as communications circuits, communications ports, communications boards, and communications connectors. The communications standard used between the first network communication unit 110 and the media processing device 200 may be a standard relating to wired communications or a standard relating to wireless communications. In this embodiment, the first network communication unit 110 performs data communication in accordance with the TCP / IP communications protocol. The first network communication unit 110 corresponds to a communications interface.

[0020] The input unit 120 includes input means such as an operation switch provided on the control device 100, a keyboard connected to the control device 100, a touch panel, etc., detects an operation on the input means by an operator who operates the control device 100, and outputs the operation to the first control unit 150. Based on the input from the input unit 120, the first control unit 150 executes a process corresponding to the operation on the input means.

[0021] The display unit 130 includes a display panel such as a liquid crystal display panel, and displays various information under the control of the first control unit 150. The display unit 130 corresponds to a display.

[0022] The first control unit 150 sends a job execution instruction to the media processing device 200. This execution instruction includes information to be used for printing, such as the number of media (M) to be executed and the print quality.

[0023] Furthermore, when the first control unit 150 receives a job ID from the media processing device 200, it generates Salt data. The Salt data corresponds to a random number. The Salt data is a random number generated by a cryptographic pseudorandom number generator or a random number generator that takes time to predict.

[0024] The first control unit 150 also generates a hash value. The first control unit 150 adds salt data to the beginning of the data to be sent to the media processing device 200 to be written to the media M, and calculates a hash value using the salt data and the data as arguments to be input to a hash function. Hereinafter, the data to be written to the media M will be referred to as write data. Write data corresponds to communications data.

[0025] After generating the salt data and hash value, the first control unit 150 sends the write data, the hash value, and the salt data to the media processing device 200. In this embodiment, the first control unit 150 transmits data to the media processing device 200 in the following order: write data, hash value, and salt data. The write data may be transmitted after the hash value, but the salt data is always transmitted last. If a malicious third party attempts to tamper with the write data or the like, the time it takes for the malicious third party to calculate a false hash value can be delayed by making it so that hash value calculation cannot begin until the salt has arrived.

[0026] [Media processing device configuration] The media processing device 200 includes a second control unit 250, a second network communication unit 210, a first media drive 221, a second media drive 223, a printing unit 230, and a transport unit 240.

[0027] The second control unit 250 is a computer device including a second memory unit 260 and a second processor 270 .

[0028] The second storage unit 260 has a storage area for storing programs executed by the second processor 270 and data processed by the second processor 270. The second storage unit 260 stores a control program 261 executed by the second processor 270 and setting data 263 including various setting values ​​related to the operation of the media processing device 200. The second storage unit 260 has a non-volatile storage area for non-volatilely storing programs and data. The second storage unit 260 may also have a volatile storage area and serve as a work area for temporarily storing programs executed by the second processor 270 and data to be processed.

[0029] The second network communication unit 210 is configured with communication hardware conforming to a predetermined communication standard, and performs data communication with the control device 100 under the control of the second control unit 250. Examples of communication hardware include hardware such as a communication circuit, a communication port, a communication board, and a communication connector. The communication standard used between the second network communication unit 210 and the control device 100 may be a standard related to wired communication or a standard related to wireless communication. In this embodiment, the second network communication unit 210 performs data communication according to the TCP / IP communication protocol. The second network communication unit 210 corresponds to a communication interface.

[0030] The data communication carried out between the first network communication unit 110 of the control device 100 and the second network communication unit 210 of the media processing device 200 via the network NW corresponds to the first path.

[0031] The first media drive 221 and the second media drive 223 are functional units that write data to the storage surface of the medium M. The first media drive 221 and the second media drive 223 write data to the medium M under the control of the second control unit 250.

[0032] The printing unit 230 is a functional unit that prints images on the label side of the media M, and includes printing-related components such as a label printer 235 and an ink supply unit that supplies ink to the label printer 235. The printing unit 230 prints images on the label side of the media M under the control of the second control unit 250. The image printed on the label side includes Salt data and a time. This time is the time when the media processing device 200 received the write data, hash value, or Salt data from the control device 100.

[0033] The transport unit 240 transports the media M within the media processing device 200 under the control of the second control unit 250.

[0034] When the second control unit 250 receives an instruction to issue a job from the control unit 100, it generates a job ID that identifies communication between the control unit 100 and the media processing device 200. This job ID is also a random number generated by a cryptographic pseudorandom number generator or a random number generator that takes time to predict. The second control unit 250 transmits the generated job ID to the control unit 100.

[0035] Thereafter, when the second control unit 250 receives the write data, the hash value, and the Salt data from the control device 100, it adds the Salt data to the beginning of the write data, and calculates the hash value using the Salt data and the data as arguments for inputting to the hash function.

[0036] The second control unit 250 compares the calculated hash value with the hash value received from the control device 100 to determine whether the write data has been subjected to an attack such as tampering or substitution while it was being sent from the control device 100 to the media processing device 200.

[0037] The second control unit 250 also measures the time required from receiving the write data to receiving the hash value, and the time required from transmitting the generated job ID to the control device 100 to receiving the write data.

[0038] The second control unit 250 compares a first measured time, which is the time required from receiving the write data to receiving the hash value, with a first set time that is set in advance. If the first measured time is equal to or greater than the first set time, the second control unit 250 determines that at least one of the write data, the hash value, and the Salt data has been tampered with or replaced, and does not write the write data to the medium M. Alternatively, if the write data is in the middle of being written to the medium M, the second control unit 250 stops writing the write data.

[0039] Similarly, the second control unit 250 compares a second measured time, which is the time required from transmitting the job ID to the control device 100 to receiving the write data, with a second set time. If the second measured time is equal to or greater than the second set time, the second control unit 250 determines that at least one of the write data, the hash value, and the Salt data has been tampered with or replaced, and does not write the write data to the medium M. Alternatively, if the write data is in the middle of being written to the medium M, the second control unit 250 stops writing the write data.

[0040] Fig. 2 is a flow chart showing normal operation of the control device 100 and media processing device 200. Fig. 3 shows data exchanged between the control device 100 and media processing device 200 under normal conditions. FIG. 3 shows the data that is sent from the control device 100 to the media processing device 200, or from the media processing device 200 to the control device 100, and the step number at which this data is sent in the flowchart shown in FIG.

[0041] First, the control device 100 sends an issue instruction to the media processing device 200 to issue a job (step SA1). Step SA1 corresponds to the first step.

[0042] When the media processing device 200 receives a job issuance notification from the control device 100 (step SB1), it generates a job ID, which is identification information that identifies the job. The job ID is a random number generated by a cryptographic pseudorandom number generator or a random number generator that takes time to predict. The media processing device 200 transmits the generated job ID to the control device 100 (step SB2). Step SB2 also corresponds to the first step.

[0043] When the control device 100 receives the job ID from the media processing device 200 (step SA2), it generates Salt data (step SA3). The Salt data is a random number generated by a cryptographic pseudorandom number generator or a random number generator that takes time to predict.

[0044] When the control device 100 generates the salt data, it adds the generated salt data to the beginning of the write data, and calculates a hash value using the salt data and the write data as arguments to be input to a hash function (step SA4). Step SA4 corresponds to the second step.

[0045] Next, the control device 100 converts the data format of the write data to be written to the medium M into a specified data format such as Universal Disk Format (UDF) or ISO. The control device 100 combines the job ID received from the media processing device 200 in step SA2 and the write data whose data format has been converted, and sends this data to the media processing device 200 (step SA5). Step SA5 corresponds to the third step.

[0046] After sending the job ID to the control device 100, the media processing device 200 waits until it receives a data set from the control device 100. When the control device 100 starts sending the data set, the media processing device 200 receives the job ID and write data, which are the data set sent from the control device 100 (step SB3).

[0047] Next, the control device 100 sends the job ID and the hash value generated in step SA4 as a data set to the media processing device 200 (step SA6). Step SA6 corresponds to the third step.

[0048] When the media processing device 200 receives the job ID and hash value, which are data sets sent from the control device 100 (step SB4), it moves the storage area in which the write data received in step SB3 is stored (step SB5). The media processing device 200 moves the storage area for the write data and hash value to a storage area in which the values ​​of these data cannot be changed. For example, the media processing device 200 moves the write data and hash value to a storage area in a storage device, such as a hard disk drive, that does not have an interface that can be accessed from the outside.

[0049] Next, the control device 100 sends the job ID and the Salt data generated in step SA3 as a data set to the media processing device 200 (step SA7). Step SA7 corresponds to the third step. When the media processing device 200 receives the job ID and salt data, which are data sets sent from the control device 100 (step SB6), it starts calculating a hash value (step SB7). The media processing device 200 adds the salt data to the beginning of the write data, and calculates a hash value using the salt data and the write data as arguments input to a hash function (step SB7).

[0050] Furthermore, in parallel with the calculation of the hash value, the media processing device 200 executes the issuance process for the media M (step SB9). The media processing device 200 waits a waiting time so that the end of the issuance process for the media M in step SB9 ends later than the end of the hash value calculation in step SB7 (step SB8), and then waits to start the issuance process for the media M (step SB9).

[0051] This wait time is calculated based on the occupancy rate of the second processor 270 and the amount of write data. The issuance time for media M changes according to the magnification, which is the writing speed at which data is written to media M.

[0052] Next, the control device 100 causes the display unit 104 to display the Salt data and the time (step SA8). This time corresponds to the first time, and is the time when the transmission of the write data started in step SA5, the time when the transmission of the hash value started in step SA6, or the time when the transmission of the Salt data started in step SA7. This time may also be the time when the transmission of the write data is completed in step SA5, the time when the transmission of the hash value is completed in step SA6, or the time when the transmission of the Salt data is completed in step SA7. Step SA8 corresponds to the fourth step.

[0053] Furthermore, in the process of issuing media M in step SB9, the media processing device 200 records the salt data and the time on the label side of the media M. This time corresponds to the second time, and is the time when reception of the write data began in step SB3, the time when reception of the hash value began in step SB4, or the time when reception of the salt data began in step SB6. This time may also be the time when reception of the write data is completed in step SB3, the time when reception of the hash value is completed in step SB4, or the time when reception of the salt data is completed in step SB6. Step SB9 corresponds to the fifth step.

[0054] The operator compares the Salt data and time displayed on the display unit 104 of the control device 100 with the Salt data and time recorded on the label side of the medium M. This process corresponds to an inquiry via the second route, which is a route using human visual inspection. If there is a discrepancy in the salt data or a difference in time of more than a specified amount of time, the operator determines that the written data may have been tampered with or subjected to some kind of attack, and takes the specified action, such as stopping issuance.

[0055] Below, possible cases of attacks from malicious third parties and a method for detecting attacks on the media processing device 200 will be explained.

[0056] [Attack Case A] FIG. 4 shows data exchanged between the control device 100 and the media processing device 200 in attack case A. In FIG. A malicious third party may pose as a legitimate user and send to the media processing device 200 from outside false data that has been tampered with by using IP spoofing or other methods to disguise the sender.

[0057] In this case of attack, the third party does not obtain the Salt data. The media processing device 200 starts with the false data received from the malicious third party and appends the Salt data received from the control device 100 to calculate a hash value. The hash value calculated by the hash calculation differs from the hash value received from the control device 100. Because the hash values ​​do not match, the media processing device 200 determines that data has been tampered with or replaced, and stops issuing the media M. The media processing device 200 may also record a specified error mark on the label side of the media M, as shown in FIG. 4.

[0058] [Attack Case B] FIG. 5 shows data exchanged between the control device 100 and the media processing device 200 when attack case B has occurred. Attack case B is an attack in which a malicious third party interrupts the communication path between the control device 100 and the media processing device 200, discards the write data sent from the control device 100, and sends false data to the media processing device 200. A malicious third party interrupts the communication path between the control device 100 and media processing device 200 by an attack such as DNS (Domain Name System) cache poisoning. The terminal used by the third party is referred to as third party terminal 300. The third party then disables the encrypted communication between the control device 100 and media processing device 200 by an attack such as a Transport Layer Security (TLS) downgrade attack, and sends fake data to the media processing device 200.

[0059] In this attack case, the third party terminal 300 transmits the Salt data that the control device 100 has transmitted to the media processing device 200 without modification. For this reason, as in attack case A described above, the media processing device 200 starts with the fake data received from a malicious third party and appends the salt data received from the control device 100 to calculate a hash value. The hash value calculated by the hash calculation is different from the hash value received from the control device 100. If the hash value received from the control device 100 does not match the hash value calculated based on the salt data and write data received from the control device 100, the media processing device 200 determines that there is fraud. If the media processing device 200 determines that there is fraud, it determines that data has been tampered with or replaced, and stops issuing the media M. The media processing device 200 may also record a specified error mark on the label side of the media M, as shown in FIG. 5.

[0060] [Attack Case C] FIG. 6 shows data exchanged between the control device 100 and the media processing device 200 when attack case C is detected. 5, Figure 6 also illustrates an attack in which a malicious third party interrupts the communications path between the control device 100 and media processing device 200, discards write data sent by the control device 100, and sends false data to the media processing device 200. In particular, the attack shown in Figure 6 illustrates a case in which the third party waits until it receives salt data sent by the control device 100, and after receiving the salt data, calculates a hash value at the third party terminal 300 and transmits the hash value corresponding to the false data to the media processing device 200.

[0061] FIG. 7 is a flowchart showing the operations of the control device 100, the media processing device 200, and the third party terminal 300 in attack case C. In step SC1, the third party terminal 300 receives the job issuing instruction sent from the control device 100, and in step SC2, sends the received issuing instruction to the media processing device 200 as is. Next, in step SC3, the third party terminal 300 receives the job ID generated by the media processing device 200, and in step SC4, transmits the received job ID to the control device 100.

[0062] Next, in step SC5, the third party terminal 300 receives the job ID and the data set of writing data sent from the control device 100, and tampers with the writing data in the data set. The third party terminal 300 sends false data, which is the tampered writing data, to the media processing device 200.

[0063] Next, in step SC6, third party terminal 300 receives the data set of the job ID and the hash value transmitted from control device 100, and discards the received hash value.

[0064] Next, in step SC7, the third party terminal 300 receives the job ID and the data set of Salt data sent from the control device 100, adds the Salt data to the beginning of the fake data that it sent to the media processing device 200 in step SC8, and inputs the fake data with the Salt data added to the beginning as an argument to a hash function to calculate a hash value. This hash value is called the fake hash value.

[0065] Next, in step SC9, the third party terminal 300 transmits the calculated false hash value to the media processing device 200. In addition, in step SC10, the third party terminal 300 transmits the Salt data received in step SC7 to the media processing device 200.

[0066] As described above, the third party terminal 300 waits until it receives the salt data from the control device 100 after sending the false data, which is the falsified write data, to the media processing device 200. After receiving the salt data, the third party terminal 300 calculates a false hash value and sends the calculated false hash value to the media processing device 200. As a result, the first time period from when the media processing device 200 receives the false data to when it receives the false hash value exceeds the first preset time, and becomes greater than the first preset time. The period between step SB3 and step SB4 in FIG. 7 becomes greater than the first preset time. As a result, the media processing device 200 determines that data has been falsified or replaced, and stops issuing the media M. The media processing device 200 may also record a specified error mark on the label side of the media M.

[0067] [Attack Case D] FIG. 8 is a flowchart showing the operations of the control device 100, the media processing device 200, and the third party terminal 300 in attack case D. Attack case D is an attack case similar to attack case C, except that the third-party terminal 300 receives the write data, hash value, and Salt data sent by the control device 100, and after completing calculation of the false data that has been tampered with and the false hash value, sends the false data, false hash value, and Salt data to the media processing device 200.

[0068] In this case of attack, the second measurement time, which is the time taken from when the media processing device 200 issues a job ID in response to an instruction to issue a job and transmits the issued job ID until it receives fake data that is the result of tampering with the write data, exceeds the second set time and becomes greater than the second set time. The time between step SB2 and step SB3 in FIG. 8 becomes greater than the second set time. The second set time corresponds to a threshold value. If the second measurement time, which is the time taken from when the media processing device 200 transmits the job ID included in the first step to the control device 100 until it receives the write data included in the third step, exceeds the second set time, which is the threshold value, it is determined to be fraudulent. If the media processing device 200 determines that fraud such as data tampering or replacement has occurred, it stops issuing media M. The media processing device 200 may also record a specified error mark on the label side of the media M.

[0069] [Attack Case E] FIG. 9 shows data exchanged between the control device 100 and the media processing device 200 when attack case E has occurred. FIG. 10 is a flowchart showing the operations of the control device 100, the media processing device 200, and the third party terminal 300 in attack case E.

[0070] Attack case D is an attack in which a malicious third party swaps the job ID, write data, and hash value. In the case of this attack, the time displayed on the display unit 104 of the control device 100 and the time recorded on the label side of the medium M will differ significantly. Therefore, an operator can detect an attack from a malicious third party by comparing the time displayed on the display unit 104 with the time recorded on the label side of the media M and confirming that there is a time discrepancy.

[0071] The operation of third party terminal 300 will be described with reference to the flow chart shown in FIG. Third party terminal 300 receives the job issuance instruction transmitted from control device 100 in step SC31. In step SC32, the third party terminal 300 generates a false job ID and transmits the generated job ID to the control device 100. This false job ID is referred to as a false job ID.

[0072] In step SC33, the third party terminal 300 receives the fake job ID and the data set of writing data transmitted from the control device 100, and tampers with the received writing data to generate fake data. Next, in step SC34, the third party terminal 300 receives the data set of the fake job ID and hash value transmitted from the control device 100, and discards this data set. Next, the third party terminal 300 receives the fake job ID and the data set of Salt data transmitted from the control device 100 in step SC35.

[0073] Next, in step SC36, the third party terminal 300 sends a command to the media processing device 200 to issue a job. Next, in step SC37, the third party terminal 300 receives the job ID generated by the media processing device 200.

[0074] Next, in step SC38, the third party terminal 300 adds the Salt data received from the control device 100 in step SC35 to the beginning of the fake data, inputs the fake data with the Salt data added to the beginning as an argument to a hash function, and calculates a hash value. This hash value is called a fake hash value.

[0075] Next, in step SC39, the third party terminal 300 sends the job ID and the data set of the fake data to the media processing device 200. Next, in step SC40, the third party terminal 300 transmits the job ID and the fake hash value to the media processing device 200. Next, in step SC41, the third party terminal 300 sends the job ID and Salt data to the media processing device 200.

[0076] For example, assume that the time displayed on the display 104 of the control device 100 is the time when the control device 100 started to send the write data in step SA5, and the time recorded on the medium M is the time when the media processing device 200 started to receive the fake data in step SB3. The third party terminal 300 needs to perform the processes in steps SC33 to SB39 between steps SA5 and SB3, and it takes time for the third party terminal 300 to send the Salt data to the media processing device 200. This causes a discrepancy between the time displayed on the display 104 and the time recorded on the label side of the medium M. If an operator can confirm that there is a discrepancy in the times, it becomes possible to detect an attack from a malicious third party.

[0077] [Attack Case F] FIG. 11 shows data exchanged between the control device 100 and the media processing device 200 when attack case F is detected. Attack F is an attack in which a malicious third party interrupts the communication path between the control device 100 and the media processing device 200 and replaces the write data, hash value, and Salt data.

[0078] A third-party terminal 300 operated by a malicious third party interrupts the communication path between the control device 100 and the media processing device 200 and steals the job ID and write data, which are data sets sent from the control device 100 to the media processing device 200 .

[0079] The third party terminal 300 tampers with the stolen writing data to generate false data, and then transmits the stolen job ID and the generated false data to the media processing device 200 as a data set.

[0080] The third party terminal 300 then steals the job ID and hash value, which are the data set sent from the control device 100 to the media processing device 200. The third party terminal 300 discards the fraudulently obtained hash value and transmits a false hash value to the media processing device 200.

[0081] The third party terminal 300 then steals the job ID and Salt data, which are a data set sent from the control device 100 to the media processing device 200 . The third party terminal 300 discards the stolen Salt data and transmits false Salt data to the media processing device 200.

[0082] The control device 100 causes the display unit 104 to display the Salt data and the transmission time of the Salt data. The media processing device 200 also records on the recording surface of the medium M the false Salt data received from the third party terminal 300 and the time at which the false Salt data was received. Therefore, by comparing the Salt data displayed on the display unit 104 with the false Salt data recorded on the recording surface of the medium M, the operator can know that the data has been tampered with.

[0083] [Second embodiment] FIG. 12 is a diagram showing the system configuration of a media processing system 1B according to the second embodiment. In addition to the control device 100 and media processing device 200, a media processing system 1B of the second embodiment also includes a server device 400 and a test terminal 500.

[0084] The server device 400 is connected to the network NW together with the control device 100 and the media processing device 200 . In the above-described first embodiment, the control device 100 causes the display unit 104 included in the control device 100 to display the Salt data and the time. In the second embodiment, the control device 100 sends a data set of salt data and time to the server device 400. At this time, the control device 100 sends the user ID that identifies the operator, device identification information that identifies the media processing device 200 that sent the write data and generated the media M, and other information to the server device 400 along with the salt data and time. In this second embodiment, a case will be described in which a data set including the user ID that identifies the operator, salt data, and time is sent to the server device 400. Furthermore, in the second embodiment, the control device 100 transmits a user ID that identifies the operator to the media processing device 200 when transmitting write data, hash values, Salt data, and the like to the media processing device 200, or before transmitting these data.

[0085] When the media processing device 200 of the second embodiment records Salt data and a time on the recording surface of media M, it also records the user ID in addition to the Salt data and the time. The media processing device 200 of the second embodiment also records on the recording surface of the medium M a two-dimensional or one-dimensional code that includes the user ID, Salt data, and time information.

[0086] The inspection terminal 500 is connected to the network NW by wire or wirelessly. In the configuration of media processing system 1B shown in FIG. 12, test terminal 500 is wirelessly connected to network NW.

[0087] The inspection terminal 500 includes a reading device capable of reading a two-dimensional code or a one-dimensional code. Alternatively, the inspection terminal 500 may be configured so that a reading device is externally connected to the inspection terminal 500. The inspection terminal 500 reads the two-dimensional code or one-dimensional code recorded on the recording surface of the medium M using a reading device, and obtains the user ID, Salt data, and time information contained in the read data.

[0088] Next, the inspection terminal 500 downloads the Salt data and time information corresponding to the acquired user ID from the server device 400. The inspection terminal 500 compares the downloaded Salt data and time with the Salt data and time included in the read two-dimensional code or one-dimensional code. The inspection terminal 500 determines whether the Salt data match and whether the time difference is within a preset range. If the Salt data do not match, or if the time difference is not within a preset range, the test terminal 500 displays a warning on the display unit provided in the test terminal 500. Furthermore, when the Salt data match and the time difference is within a preset range, the test terminal 500 causes a display unit included in the test terminal 500 to display that the data match.

[0089] In addition, the test terminal 500 may transmit to the server device 400 information on the user ID, Salt data, and time, which are included in the data obtained by reading the two-dimensional code or one-dimensional code. The server device 400 acquires a data set including a user ID that matches the user ID received from the test terminal 500, from among the data sets received from the control device 100.

[0090] The server device 400 compares the Salt data and time included in the acquired data set with the Salt data and time received from the inspection terminal 500. The server device 400 determines whether the salt data match and the time difference is within a preset range. If the salt data match and the time difference is within a preset range, the server device 400 transmits a notification to the test terminal 500 that the data match. If the salt data do not match or the time difference is not within a preset range, the server device 400 transmits a notification to the test terminal 500 that the data do not match.

[0091] [Third embodiment] FIG. 13 is a diagram showing the system configuration of a media processing system 1C according to the third embodiment. A media processing system 1C of the third embodiment includes a time stamp server 600 in addition to a control device 100 and a media processing device 200. The time stamp server 600 corresponds to an external server.

[0092] Media processing system 1C of the third embodiment determines whether the security of communications using time stamp server 600 can be ensured. Determining whether the security of communications can be ensured corresponds to, for example, control device 100 determining whether data communication with time stamp server 600 is possible. If the control device 100 and media processing device 200 are able to communicate data with the timestamp server 600, they do not operate in accordance with the flowchart shown in Figure 2, but instead send write data from the control device 100 to the media processing device 200 using a timestamp token obtained from the timestamp server 600. If the control device 100 and media processing device 200 are not able to communicate data with the timestamp server 600, they communicate in accordance with the flowchart shown in Figure 2.

[0093] The operation when the control device 100 and the media processing device 200 are capable of data communication with the timestamp server 600 will be described. First, the control device 100 calculates a hash value. The control device 100 calculates the hash value using the write data as an argument to be input to a hash function. After calculating the hash value, the control device 100 transmits the calculated hash value to the timestamp server 600.

[0094] When the time stamp server 600 receives the hash value from the control device 100, it generates a time stamp token by combining the received hash value with time information from a time source that is traceable to international standard time. The time stamp token is time certification information to which an electronic signature is added to prove that the time stamp was indeed issued by the time stamp server 600, and is signed with the private key of the time stamp server 600.

[0095] The time stamp server 600 transmits the generated time stamp token to the control device 100. The control device 100 transmits the write data and the time stamp token received from the time stamp server 600 to the media processing device 200.

[0096] Upon receiving the write data and the timestamp token, the media processing device 200 recalculates the hash value. The media processing device 200 calculates the hash value using the received write data as an argument that is input to the hash function.

[0097] The media processing device 200 uses the calculated hash value and the timestamp token to verify whether the written data has been tampered with.

[0098] If the media processing device 200 determines that the write data has not been tampered with, it writes the write data to the media M. Furthermore, if the media processing device 200 determines that the written data has been tampered with, it discards the written data.

[0099] Each of the above-described embodiments merely shows one aspect of the present invention, and any modification and application is possible within the scope of the present invention. For example, the functional units of the control device 100 and media processing device 200 shown in Figure 1 show functional configurations, and there are no particular limitations on the specific implementation form. In other words, it is not necessary to implement hardware that corresponds to each functional unit individually, and it is of course possible to implement a configuration in which one or more processors execute a program to realize the functions of multiple functional units. Furthermore, some of the functions realized by software in the above embodiments may be realized by hardware, and some of the functions realized by hardware may be realized by software.

[0100] 2, 7, 8, and 10 are divided according to the main processing content to make the processing of the control device 100 and media processing device 200 easier to understand. The present invention is not limited to the manner in which the processing units are divided or the names given to them in the flowcharts of FIGS. 2, 7, 8, and 10. Furthermore, the processing of the control device 100 and media processing device 200 can be divided into even more processing units depending on the processing content, or one processing unit can be divided so that it includes even more processes. Furthermore, the order of processing in the above flowcharts is not limited to the example shown in the figures.

[0101] Furthermore, in the first and second embodiments, the case has been described where the media processing device is made up of a single device 200, but the device may be made up of multiple media processing devices 200. In this case, the multiple media processing devices 200 can be considered as a single media processing unit, and can function as a device that has multiple data writing units and multiple printing units, just like the media processing device 200.

[0102] Furthermore, if the control device 100 and media processing device 200 are connected to the network NW via a wired connection, it is preferable that the control device 100 and media processing device 200 are connected via a switching hub. If the control device 100 and media processing device 200 are connected to the network NW via a wireless connection, it is preferable that communications be encrypted using WPA2 or similar. It is also preferable that communications between the control device 100 and media processing device 200 and N are double or triple encrypted using IPSec, SSH tunneling, TLS, or similar.

[0103] Furthermore, in the first and second embodiments described above, a hash value is used to verify whether or not the write data has been tampered with, but a timestamp may also be used.

[0104] The above description also illustrates an example of an inquiry via the second path in which the control device 100 displays the salt data and time on the display unit 130 and the media processing device 200 records the salt data and time on the recording surface of the media M. As another example, a printer may be connected to the control device 100 and the printer may print the salt data and time. The control device 100 may record the salt data and time on a USB memory stick or a floppy disk, and the media processing device 200 may make an inquiry using the salt data and time recorded on a storage medium such as a USB memory stick carried by the user and display the results. Conversely, the media processing device 200 may record the salt data and time on a USB memory stick or a floppy disk, and the control device 100 may make an inquiry using the salt data and time recorded on a USB memory stick or a floppy disk carried by the user and display the results. In other words, an inquiry via the second path may be made via a path different from the first path, and there are no limitations on the type of path or where the inquiry is made. In addition, in the third embodiment, if the situation is such that the security of communication can be ensured using a method that uses an external server, then communication is performed using that method, and if the situation is such that the security of communication cannot be ensured using a method that uses an external server, then communication is performed using the method of the above-mentioned first or second embodiment. The method of using an external server is not limited to the above-mentioned, and the type of external server is not limited to a timestamp server.

[0105] [Summary of this disclosure] The following is a summary of this disclosure. (Appendix 1) A communication method between a transmitter and a receiver, comprising: a first step of communicating between the transmitter and the receiver; a second step, which is performed after the first step, of calculating a hash value based on a random number and communication data following the random number; a third step of transmitting the communication data, the hash value, and the random number from the transmitter to the receiver via a first route; a fourth step of outputting the random number and a first time when the random number, the communication data, or the hash value was transmitted by the transmitter; and a fourth step of outputting the random number received by the receiver and a second time when the random number, the communication data, or the hash value was received. and a fifth step of transmitting the random number after the communication data in the third step, checking the random number and the first time output by the transmitter and the random number and the second time output by the receiver via a second route different from the first route and determining the presence of an inconsistency, determining the presence of an inconsistency if the time from the first step to the third step exceeds a threshold value, and determining the presence of an inconsistency if a hash value calculated by the receiver based on the random number and the communication data received from the transmitter and the hash value received in the third step do not match.

[0106] Thereby, in a third step, the communication data, the hash value, and the random number are transmitted from the transmitter to the receiver via the first route. In a fourth step, the random number and the first time when the random number, the communication data, or the hash value was transmitted are output, and in a fifth step, the random number received by the receiver and the second time when the random number, the communication data, or the hash value was received are output. The random number and the first time output by the transmitter are compared with the random number and the second time output by the receiver via a second route different from the first route, and if they do not match, it is determined to be fraudulent. In addition, if the time from the first step to the third step exceeds a threshold, the receiver determines that the data is fraudulent. Furthermore, if the hash value received by the receiver in the third step does not match the hash value calculated based on the random number and communication data received from the transmitter, the receiver determines that the data is fraudulent. This makes it possible to accurately determine whether data has been tampered with.

[0107] (Appendix 2) 2. The communication method according to claim 1, wherein the fourth and fifth steps are steps of outputting by displaying on a display or printing on a medium.

[0108] As a result, the random number and the first time, or the random number and the second time, are displayed on the display, and the random number and the second time, or the random number and the first time, are printed on the medium. Therefore, the operator can easily compare the random number and the first time with the random number and the second time.

[0109] (Appendix 3) 2. The communication method according to claim 1, wherein the first route is a route using TCP / IP, and the second route is a route using human visual inspection.

[0110] As a result, the communication data, the hash value, and the random number are transmitted from the transmitter to the receiver via a route using TCP / IP. Also, it is possible to determine by visual inspection by a human whether the random number and the first time output by the transmitter match the random number and the second time output by the receiver.

[0111] (Appendix 4) 4. The communication method according to any one of claims 1 to 3, further comprising determining whether or not security of communication using an external server can be ensured, and if security can be ensured, ensuring security of communication using the external server and not performing steps 1 to 5, and if security cannot be ensured, performing steps 1 to 5.

[0112] As a result, if the security of communication using an external server can be ensured, it is possible to determine whether data has been tampered with through communication using an external server without performing steps 1 to 5. On the other hand, if the security of communication using an external server cannot be ensured, it is possible to determine whether data has been tampered with by performing steps 1 to 5.

[0113] (Appendix 5) A transmitter comprising a communication interface that enables communication with a receiver over a first path, and a first processor that transmits communication data to the receiver via the communication interface, wherein the first processor executes the following steps: a first step of communicating with the receiver; a second step that is performed after the first step, of calculating a hash value based on a random number and the communication data following the random number; a third step of transmitting the communication data, the hash value, and the random number to the receiver via the communication interface in the order in which the random number is sent after the communication data; a fourth step of outputting the random number and a first time when the random number, the communication data, or the hash value was transmitted; and a fifth step of outputting the random number and the first time when the random number, the communication data, or the hash value was transmitted so that the random number and the second time output by the receiver can be referenced over a second path different from the first path.

[0114] Thereby, in a third step, the communication data, the hash value, and the random number are transmitted from the transmitter to the receiver via a first route, and in a fourth step, the random number and the first time when the random number, the communication data, or the hash value were transmitted are output. Then, in a fifth step, the random number and the first time when the random number, the communication data, or the hash value were transmitted are output via a second route different from the first route so that they can be referenced to the random number and the second time output by the receiver. This makes it possible to accurately determine whether or not data has been tampered with.

[0115] (Appendix 6) A receiver comprising a communication interface that enables communication with a transmitter over a first route, and a second processor that receives communication data from the transmitter via the communication interface, wherein the second processor executes the following steps: communicating with the transmitter; receiving the communication data, hash value, and random number transmitted from the transmitter via the communication interface in an order in which the random number is received after the communication data; and outputting the random number received by the receiver and a second time at which the random number, the communication data, or the hash value was received so that the random number and the first time output by the transmitter can be referenced over a second route different from the first route.

[0116] As a result, the receiver receives the communication data, the hash value, and the random number from the transmitter via the communication interface in the order of receiving the random number after the communication data. Also, the receiver outputs the random number and the second time at which the random number, the communication data, or the hash value was received, so that the random number and the first time output by the transmitter can be referenced via a second route different from the first route. This makes it possible to accurately determine whether data has been tampered with. [Explanation of symbols]

[0117] Reference Signs List 1A, 1B, 1C...media processing system, 100...control device, 110...first network communication unit, 120...input unit, 150...first control unit, 160...first memory unit, 161...control program, 163...setting data, 165...driver software, 170...first processor, 200...media processing device, 210...second network communication unit, 221...first media drive, 223...second media drive, 230...printing unit, 235...label printer, 240...conveyor unit, 250...second control unit, 260...second memory unit, 261...control program, 263...setting data, 270...second processor, 300...third-party terminal, 400...server device, 500...inspection terminal, 600...time stamp server, NW...network.

Claims

1. 1. A method of communication between a transmitter and a receiver, comprising: a first step of communicating between the transmitter and the receiver; a second step, which is performed after the first step, of calculating a hash value based on the random number and communication data following the random number; a third step of transmitting the communication data, the hash value, and the random number from the transmitter to the receiver via a first route; a fourth step of outputting the random number and a first time when the random number, the communication data, or the hash value was transmitted by the transmitter; a fifth step of outputting the random number received by the receiver and a second time when the random number, the communication data, or the hash value was received; In the third step, the random number is transmitted after the communication data; checking the random number and the first time output by the transmitter and the random number and the second time output by the receiver via a second route different from the first route, and determining that the random number and the second time are fraudulent if they do not match; If the time from the first step to the third step exceeds a threshold, the receiver determines that the detection is fraudulent; A communication method in which if a hash value calculated by the receiver based on the random number and the communication data received from the transmitter does not match the hash value received in the third step, the communication data is determined to be fraudulent.

2. 2. The communication method according to claim 1, wherein the fourth and fifth steps are steps of outputting the information by displaying it on a display or by printing it on a medium.

3. 2. The communication method according to claim 1, wherein the first route is a route using TCP / IP, and the second route is a route using visual inspection by a human.

4. Determine whether the security of communications using external servers can be ensured, 4. The communication method according to claim 1, further comprising: ensuring the security of communication using the external server when security can be ensured; and not performing the first to fifth steps; and performing the first to fifth steps when security cannot be ensured.

5. a communications interface for enabling communication with the receiver over a first path; a first processor for transmitting communication data to a receiver via the communication interface, The first processor, a first step of communicating with the receiver; a second step, which is performed after the first step, of calculating a hash value based on the random number and communication data following the random number; a third step of transmitting the communication data, the hash value, and the random number to the receiver via the communication interface in a sequence in which the random number is sent after the communication data; a fourth step of outputting the random number and a first time when the random number, the communication data, or the hash value was transmitted; a fifth step of outputting the random number and a first time when the random number, the communication data, or the hash value was transmitted so that the random number and the second time output by the receiver can be referenced via a second route different from the first route; Run the transmitter.

6. a communication interface for enabling communication with the transmitter over a first path; a second processor for receiving communication data from a transmitter via the communication interface, The second processor, communicating with the transmitter; receiving the communication data, the hash value, and the random number transmitted from a transmitter via the communication interface in a sequence in which the random number is received after the communication data; outputting the random number received by the receiver and a second time at which the random number, the communication data, or the hash value was received, in such a manner that the random number and the first time output by the transmitter can be referenced via a second route different from the first route; A receiver that runs.

Images