Information processing apparatus, information processing method, program product, and information processing system

Abstract

The present technology relates to an information processing apparatus, an information processing method, a program, and an information processing system capable of securely transferring application data. The information processing apparatus includes a control unit that executes first software, second software, and third software, backs up data on the first software in the second software when a first authentication succeeds between the first software and the second software, and transfers the data backed up in the second software to the third software when a second authentication succeeds between the second software and the third software. For example, the technology can be applied to a smartphone.

Description

Technical Field

[0001] This technology relates to information processing equipment, information processing methods, programs, and information processing systems, and in particular to information processing equipment, information processing methods, programs, and information processing systems that enable the secure movement of data in software. Background Technology

[0002] Traditionally, it has been proposed that, in the case of updating the operating system, when the updater device is certified and the certification is successful, the new operating system is obtained from and installed on the updater device (see, for example, Patent Document 1).

[0003] Furthermore, for example, in the case of software updates, backup software can be used to move data from the previous software to the updated software. For instance, the backup software backs up the data from the previous software and then moves the backed-up data to the updated software after the update is complete.

[0004] Reference List

[0005] Patent documents

[0006] Patent Document 1: Japanese Patent Application Publication No. 2014-29688 Summary of the Invention

[0007] The problem to be solved by the present invention

[0008] However, if the backup software is malicious and counterfeit, there is a risk of eavesdropping or tampering with the data.

[0009] This technology was developed in view of the above circumstances and is intended to enable the secure movement of data within software.

[0010] Solution to the problem

[0011] An information processing apparatus according to a first aspect of the present technology includes a control unit that executes first software, second software, and third software, wherein the information processing apparatus: upon successful first authentication between the first software and the second software, backs up data in the first software to the second software; and upon successful second authentication between the second software and the third software, moves the backed-up data in the second software to the third software.

[0012] The information processing method according to a first aspect of the present technology includes: backing up data in the first software to the second software if a first authentication between the first software and the second software is successful; and moving the backed-up data in the second software to the third software if a second authentication between the second software and the third software is successful.

[0013] A procedure according to a first aspect of the present technology causes a computer to perform a process, the process comprising: backing up data in the first software to the second software if a first authentication between the first software and the second software is successful; and moving the backed-up data in the second software to the third software if a second authentication between the second software and the third software is successful.

[0014] The information processing system according to a second aspect of the present technology includes a first information processing device and a second information processing device, and the first information processing device includes a control unit that executes first software, second software and third software, and when the first software is updated to third software according to instructions from the second information processing device, when a first authentication between the first software and the second software is successful, data in the first software is backed up to the second software, and when a second authentication between the second software and the third software is successful, the backed-up data in the second software is moved to the third software.

[0015] In a first aspect of this technology, if a first authentication between the first software and the second software is successful, data in the first software is backed up to the second software, and if a second authentication between the second software and the third software is successful, the backed-up data in the second software is moved to the third software.

[0016] In a second aspect of this technology, when the first software is updated to the third software according to an instruction from the second information processing device, when the first authentication between the first software and the second software is successful, data in the first software is backed up to the second software, and when the second authentication between the second software and the third software is successful, the backed-up data in the second software is sent to the third software. Attached Figure Description

[0017] Figure 1 This is a block diagram illustrating a configuration example of an information processing system applying this technology.

[0018] Figure 2 It is a sequence diagram used to describe the process of updating a mini-program.

[0019] Figure 3 It is a sequence diagram used to describe the details of backup authentication.

[0020] Figure 4 It is a sequence diagram used to describe the details of the recovery authentication.

[0021] Figure 5 It is a diagram showing the state transitions of each mini-program.

[0022] Figure 6 This is a diagram showing an example of a computer configuration. Detailed Implementation

[0023] In the following sections, embodiments for implementing this technology will be described. The descriptions will proceed in the following order.

[0024] 1. Example

[0025] 2. Variation

[0026] 3. Other

[0027] <<1. Example>>

[0028] Reference Figures 1 to 5 The embodiments of this technology are described below.

[0029] <Configuration Example of Information Processing System 1>

[0030] Figure 1 This is a block diagram illustrating a configuration example of an information processing system 1 applying the present technology.

[0031] The information processing system 1 includes an information processing device 11 and a server 12.

[0032] Information processing device 11 includes, for example, smartphones, tablet terminals, personal computers, mobile phones, etc., and communicates with other information processing devices such as server 12 or performs various information processing tasks.

[0033] The information processing device 11 includes a device host 21, an embedded secure element (eSE) chip 22, and a contactless front-end (CLF) chip 23.

[0034] The host device 21 includes a processor such as a central processing unit (CPU), memory, etc., and controls the entire information processing device 11, performs various processes, communicates with the server 12, etc.

[0035] eSE chip 22 is a tamper-proof embedded chip that stores highly confidential data. Furthermore, eSE chip 22 executes software such as applet 31 and upgrade applet 32.

[0036] Mini Program 31 is an application software that includes a reservation function.

[0037] Upgraded Mini Program 32 is an application software that includes the following functions: when Mini Program 31 is updated (upgraded), it backs up the data stored in Mini Program 31 before the update (hereinafter referred to as internal data) and moves the data to Mini Program 31 after the update.

[0038] Note that in the following text, when distinguishing between the pre-update mini-program 31 and the updated mini-program 31, the former is referred to as the old mini-program 31a, and the latter as the new mini-program 31b. Furthermore, in the following text, using the same reference numerals, instances of mini-program 31 and the upgraded mini-program 32 are referred to as mini-program instance 31 and upgraded mini-program instance 32, respectively. Similarly, using the same reference numerals, instances of the old mini-program 31a and the new mini-program 31b are referred to as old mini-program instance 31a and new mini-program instance 31b, respectively.

[0039] CLF chip 23 is a chip that includes near-field communication (NFC, near-field wireless communication) functionality. CLF chip 23 performs near-field wireless communication with other information processing devices and exchanges various software, data, commands, etc. CLF chip 23 provides received software, data, commands, etc. to eSE chip 22, or obtains software, data, commands, etc. to be sent from eSE chip 22.

[0040] Server 12 communicates with device host 21 of information processing device 11 via a network (not shown) or the like, and exchanges various software, data, commands, etc. For example, server 12 sends a package to device host 21 to update applet 31, or sends various instructions to device host 21, eSE chip 22, and CLF chip 23.

[0041] <Update processing for mini-program 31>

[0042] Next, we will refer to Figure 2 The sequence diagram in the diagram describes the process of updating the applet 31 performed by the information processing system 1.

[0043] Note that it is assumed that the internal state of the old mini-program 31a was set to the normal state before the update process was performed, and the internal state of the upgraded mini-program 32 was set to the initial state. See below for further details. Figure 5 Describe the internal states of the old mini-program 31a, the new mini-program 31b, and the upgraded mini-program 32.

[0044] In addition, it is assumed that the old mini-program instance 31a, the new mini-program instance 31b, and the upgraded mini-program instance 32 previously held a public key.

[0045] In step S1, the server 12 or the device host 21 sends a backup start trigger to the upgrade applet instance 32.

[0046] Note that the method used to issue commands (e.g., backup start trigger) from server 12 or device host 21 to upgrade applet instance 32 is arbitrary.

[0047] For example, server 12 can send a command to device host 21 to instruct upgrade applet instance 32, and device host 21 can forward the command to upgrade applet instance 32. Alternatively, server 12 can send a script (program) to device host 21 to instruct upgrade applet instance 32, and device host 21 can provide the command to upgrade applet instance 32 by executing the script. Or, device host 21 can provide the command to upgrade applet instance 32 by executing a previously stored script (program).

[0048] In step S2, before the backup process, the old mini-program instance 31a and the upgraded mini-program instance 32 perform backup authentication. (See later...) Figure 3 The details of backup authentication are described here, while an overview of backup authentication will be provided here.

[0049] First, the upgraded mini-program instance 32 sends a challenge message to the old mini-program instance 31a.

[0050] The old mini-program instance 31a generates an authentication value by using the received challenge message and the internally stored public key, and sends the authentication value to the upgraded mini-program instance 32.

[0051] By using the internally stored public key, the upgraded mini-program instance 32 verifies the authentication value received from the old mini-program instance 31a.

[0052] If the authentication value is determined to be abnormal, an error occurs in the backup authentication process, and backup authentication is stopped.

[0053] Meanwhile, if the authentication value is confirmed to be normal, the upgraded mini-program instance 32 generates an authentication value by using the authentication value received from the old mini-program instance 31a and the public key stored internally, and sends the authentication value to the old mini-program instance 31a.

[0054] By using the internally stored public key, the old mini-program instance 31a verifies the authentication value received from the upgraded mini-program instance 32.

[0055] If the authentication value is determined to be abnormal, an error occurs in the backup authentication process, and backup authentication is stopped.

[0056] Meanwhile, if the authentication value is confirmed to be normal, that is, if the backup authentication is successful, the process proceeds to step S3. In addition, the internal state of the old mini-program 31a changes from the normal state to the backup in progress state, and the internal state of the upgraded mini-program 32 changes from the initial state to the backup in progress state.

[0057] In step S3, the old mini-program instance 31a and the upgraded mini-program instance 32 are backed up. Specifically, the old mini-program instance 31a encrypts the internal data to be transmitted to the new mini-program instance 31b (hereinafter referred to as backup data) and sends the encrypted backup data to the upgraded mini-program instance 32. The upgraded mini-program instance 32 internally accumulates the received backup data.

[0058] Then, after the backup data is complete, the internal state of the old mini-program 31a changes from the backup in progress state to the backup complete state. Furthermore, the internal state of the upgraded mini-program 32 changes from the backup in progress state to the restore in progress state. Additionally, the upgraded mini-program instance 32 notifies the server 12 or device host 21 of the backup completion.

[0059] In step S4, the server 12 or device host 21 deletes the old applet instance 31a from the eSE chip 22. The eSE chip 22 notifies the server 12 or device host 21 that the deletion of the old applet instance 31a is complete.

[0060] In step S5, the server 12 or device host 21 replaces the package. Specifically, the server 12 or device host 21 removes the package of the old applet 31a from the eSE chip 22 and loads the package of the new applet 31b onto the eSE chip 22. The eSE chip 22 notifies the server 12 or device host 21 that the package replacement is complete.

[0061] In step S6, the server 12 or device host 21 installs the new applet 31b by using the package of the new applet 31b loaded on the eSE chip 22. Using this arrangement, a new applet instance 31b is generated. Furthermore, the internal state of the new applet 31b is set to a recovery in progress state.

[0062] In step S7, before the recovery process, the new mini-program instance 31b and the upgraded mini-program instance 32 perform recovery authentication. (See later...) Figure 4 The previous section described the details of the authentication recovery process, while this section will provide an overview of the authentication recovery process.

[0063] Specifically, in the recovery authentication process, unlike the backup authentication, a challenge message is first sent from the upgraded mini-program instance 32 to the new mini-program instance 31b. Then, the new mini-program instance 31b and the upgraded mini-program instance 32 perform authentication processing in the opposite position to the old mini-program instance 31a and the upgraded mini-program instance 32 in the backup authentication.

[0064] Then, in the event of an error, stop the authentication recovery process.

[0065] Meanwhile, if the authentication is successfully restored, the process proceeds to step S8.

[0066] In step S8, the new mini-program instance 31b and the upgraded mini-program instance 32 are restored. That is, the upgraded mini-program instance 32 moves the accumulated backup data to the new mini-program instance 31b. Using this arrangement, the internal data of the old mini-program instance 31a is restored to the new mini-program instance 31b.

[0067] In step S9, server 12 or device host 21 deletes the accumulated backup data in upgrade applet instance 32. Afterwards, the internal state of upgrade applet 32 ​​transitions from the recovery in progress state to the initial state, and the internal state of new applet 31b transitions from the recovery in progress state to the normal state. Furthermore, upgrade applet instance 32 notifies server 12 or device host 21 that the deletion of backup data is complete.

[0068] After that, the process of updating mini-program 31 was completed.

[0069] <Details of Backup Verification and Backup Processing>

[0070] Next, we will refer to Figure 3 Using timing diagrams to describe Figure 2 Details of backup authentication in step S2 and backup processing in step S3.

[0071] Backup authentication is performed through a process, for example, conforming to ISO / IEC 9798-2 Three-pass authentication.

[0072] Specifically, the upgrade mini-program instance 32 triggers backup authentication by receiving a backup request from server 12 or device host 21. The backup request includes an identifier of the mini-program 31 to be updated and information indicating the version of the new mini-program 31.

[0073] The upgraded mini-program instance 32 sends a challenge message to the old mini-program instance 31a.

[0074] Note that the old mini-program instance 31a has three levels of internal modes, namely mode 0 to mode 2. These internal modes are set independently of the internal states described above.

[0075] Then, the old mini-program instance 31a only accepts the following messages in each internal mode, and returns an error and stops backup authentication when it receives any other message.

[0076] Mode 0: Challenge Message

[0077] Mode 1: Token BA

[0078] Note that this message mainly refers to commands exchanged within the eSE chip 22, while the external commands, which will be described later, are mainly commands issued from outside the eSE chip 22.

[0079] In addition, the backup process is only performed on the upgraded mini-program instance 32 when the internal mode is mode 2.

[0080] Therefore, if the internal mode is not mode 0, the old mini-program instance 31a does not accept the challenge message and returns an error to the upgraded mini-program instance 32. Using this arrangement, backup authentication is stopped.

[0081] Meanwhile, with the internal mode set to mode 0, the old mini-program instance 31a receives the challenge message. Using this arrangement, the old mini-program instance 31a transitions from mode 0 to mode 1.

[0082] Using the received challenge message and the internally stored public key, the old mini-program instance 31a uses the Advanced Encryption Standard (AES) algorithm to calculate the password-based MAC (CMAC) value (hereinafter referred to as the CMAC value). The old mini-program instance 31a generates a token AB that includes the CMAC value and information indicating the version of the old mini-program 31a (i.e., the version of the current mini-program 31), and sends the token AB to the upgraded mini-program instance 32.

[0083] Upgrade mini-program instance 32 verifies token AB. For example, by using the internally stored public key, upgrade mini-program instance 32 verifies the consistency of the CMAC value included in token AB.

[0084] In addition, the upgraded mini-program instance 32 verifies the consistency between the version of the old mini-program 31a included in token AB and the version of the new mini-program 31 included in the backup request. That is, the upgraded mini-program instance 32 verifies whether the version of the new mini-program 31 is newer than the version of the old mini-program 31a.

[0085] If the verification results indicate that token AB is abnormal or the version of the new mini-program 31 is abnormal (older than the version of the old mini-program 31a, or the same as the version of the old mini-program 31a), the upgraded mini-program instance 32 will stop backup authentication.

[0086] Simultaneously, assuming that token AB is normal and the version of the new mini-program 31 is normal (newer than the version of the old mini-program 31a), the upgrade mini-program instance 32 calculates the CMAC value using the AES algorithm by using the CMAC value included in token AB and the internally stored public key. The upgrade mini-program instance 32 generates a token BA including the calculated CMAC value and information indicating the version of the new mini-program 31 included in the backup request, and sends token BA to the old mini-program instance 31a. Furthermore, the upgrade mini-program instance 32 sends an object for backup data transmission to the old mini-program instance 31a. This object is the program used to send backup data.

[0087] If the internal mode is not mode 1, the old mini-program instance 31a will not accept the token BA and will return an error to the upgraded mini-program instance 32. Using this arrangement, backup authentication is stopped.

[0088] Meanwhile, in the internal mode of Mode 1, the old mini-program instance 31a accepts the token BA. Then, the old mini-program instance 31a verifies the token BA. For example, by using the internally stored public key, the old mini-program instance 31a verifies the consistency of the CMAC value included in the token BA.

[0089] In addition, the old mini-program instance 31a verifies the consistency between its version and the version of the new mini-program 31 included in the token BA. That is, the old mini-program instance 31a verifies whether the version of the new mini-program 31 is newer than the version of the old mini-program instance 31a.

[0090] If the verification results indicate that the token BA is abnormal or the version of the new mini-program 31 is abnormal, the old mini-program instance 31a will stop backup authentication.

[0091] Meanwhile, after confirming that the token BA is normal and the version of the new mini program 31 is normal, the old mini program instance 31a is switched from mode 1 to mode 2, and the backup authentication is completed.

[0092] Then, the old mini-program instance 31a performs the backup process using the object provided by the upgraded mini-program instance 32 for sending backup data. Specifically, the old mini-program instance 31a encrypts the backup data and sends the encrypted backup data to the upgraded mini-program instance 32. The upgraded mini-program instance 32 internally accumulates the received encrypted backup data and sends a response message to the old mini-program instance 31a. After all backup data is complete, the old mini-program instance 31a returns from mode 2 to mode 0.

[0093] Therefore, if backup authentication is not performed according to the predetermined process, the internal mode of the old mini-program instance 31a will not be converted normally, and thus backup authentication will fail. Furthermore, backup processing is only performed using the object provided by the upgraded mini-program instance 32 for sending backup data if backup authentication is successful. Therefore, it is safe to back up the internal data of the old mini-program instance 31a to the upgraded mini-program instance 32.

[0094] <Details of Authentication Recovery and Recovery Process>

[0095] Next, we will refer to Figure 4 Using sequence diagrams to describe Figure 2 Details of the recovery authentication in step S7 and the recovery process in step S8.

[0096] Similar to backup certification, recovery certification is performed, for example, through a process conforming to ISO / IEC 9798-2 TECH certification.

[0097] With the backup data accumulated in the upgraded mini-program instance 32, the recovery authentication is triggered by installing a new mini-program 31b on the eSE chip 22 and generating a new mini-program instance 31b.

[0098] The new mini-program instance 31b sends a challenge message to the upgraded mini-program instance 32.

[0099] Note that, similar to the old mini-program instance 31a, the upgraded mini-program instance 32 has three levels of internal modes, namely mode 0 to mode 2. These internal modes are set independently of the aforementioned internal states.

[0100] Then, the upgraded mini-program instance 32 only accepts the following messages in each internal mode, and returns an error and ends the recovery authentication when it receives any other message.

[0101] Mode 0: Challenge Message

[0102] Mode 1: Token BA

[0103] Mode 2: Resume data retrieval request

[0104] Therefore, if the internal mode is not mode 0, the upgraded mini-program instance 32 does not accept the challenge message and returns an error to the new mini-program instance 31b. Using this arrangement, authentication recovery is stopped.

[0105] Meanwhile, when the internal mode is mode 0, the upgraded mini-program instance 32 accepts the challenge message and switches from mode 0 to mode 1.

[0106] Upgraded mini-program instance 32 calculates the CMAC value using the AES algorithm by using the received challenge message and the internally stored public key. Upgraded mini-program instance 32 generates a token AB that includes the calculated CMAC value and information indicating the version of the new mini-program 31 included in the backup request received during backup authentication, and sends token AB to the new mini-program instance 31b.

[0107] The new mini-program instance 31b verifies token AB. For example, by using an internally stored public key, the new mini-program instance 31b verifies the consistency of the CMAC value included in token AB.

[0108] In addition, the new mini-program instance 31b verifies the consistency between its version and the version of the new mini-program 31 included in token AB. That is, the upgraded mini-program instance 32 verifies whether its version matches the version of the new mini-program 31.

[0109] If the verification results indicate that token AB is abnormal or the version of the new mini-program 31 is abnormal (incompatible with the version of the new mini-program 31b), the new mini-program instance 31b will stop re-authentication.

[0110] Meanwhile, assuming that token AB is normal and the version of the new mini-program 31 is normal (matching the version of the new mini-program 31b), the new mini-program instance 31b calculates the CMAC value using the AES algorithm by using the CMAC value included in token AB and the internally stored public key. The new mini-program instance 31b generates token BA, which includes the calculated CMAC value and information indicating the version of the new mini-program instance 31b, and sends token BA to the upgrade mini-program instance 32.

[0111] If the internal mode is not mode 1, the upgraded mini-program instance 32 will not accept the token BA and will return an error to the new mini-program instance 31b. Using this arrangement, recovery authentication will be stopped.

[0112] Meanwhile, in the case of internal mode 1, the upgrade mini-program instance 32 accepts the token BA. Then, the upgrade mini-program instance 32 verifies the token BA. For example, by using the internally stored public key, the upgrade mini-program instance 32 verifies the consistency of the CMAC value included in the token BA.

[0113] In addition, the upgraded mini-program instance 32 verifies the consistency between the version of the new mini-program 31b included in the token BA and the version of the new mini-program 31 included in the backup request. That is, the upgraded mini-program instance 32 verifies whether the version of the new mini-program 31b matches the version of the new mini-program 31 included in the backup request.

[0114] If the verification results indicate that the token BA is abnormal or the version of the new mini-program 31 is abnormal, the upgrade mini-program instance 32 will stop the recovery authentication.

[0115] Simultaneously, after confirming that the token BA is normal and the version of the new mini-program 31 is normal, the upgraded mini-program instance 32 switches from mode 1 to mode 2 and completes the recovery authentication. Furthermore, the upgraded mini-program instance 32 sends an object for retrieving recovery data to the new mini-program instance 31b. This object is a program used to retrieve the backup data (recovery data) accumulated in the upgraded mini-program instance 32.

[0116] The new mini-program instance 31b receives the object used to restore data retrieval. Then, the new mini-program instance 31b sends a data retrieval request to the upgraded mini-program instance 32 by using the data retrieval object provided by the upgraded mini-program instance 32.

[0117] When the internal mode is not mode 2, the upgraded mini-program instance 32 does not accept the object used to retrieve the recovery data and does not perform recovery processing.

[0118] Meanwhile, when the internal mode is mode 2, the upgraded mini-program instance 32 accepts the request to retrieve recovery data and sends the internally accumulated encrypted backup data (recovery data) to the new mini-program instance 31b.

[0119] Repeatedly request and exchange backup data (recovery data) for data retrieval until all backup data accumulated in the upgraded mini-program instance 32 is sent to the new mini-program instance 31b.

[0120] Then, after all backup data has been sent and the accumulated backup data has been deleted, the upgrade mini-program instance 32 returns from mode 2 to mode 0.

[0121] Therefore, if recovery authentication is not performed according to the predetermined process, the internal mode of the upgraded mini-program instance 32 will not be converted normally, and thus recovery authentication will fail. Furthermore, recovery processing is only performed using the object provided by the upgraded mini-program instance 32 for data recovery retrieval if recovery authentication is successful. Therefore, the backup data accumulated in the upgraded mini-program instance 32 can be safely moved to the new mini-program instance 31b.

[0122] <State transitions for each mini-program>

[0123] Next, we will refer to Figure 5 Describes the state transitions of the old mini-program 31a, the new mini-program 31b, and the upgraded mini-program 32 during the process of updating mini-program 31.

[0124] When the update process for mini-program 31 begins, the internal state of the old mini-program 31a is set to the normal state. In the normal state, the old mini-program instance 31a can perform normal processing. For example, the old mini-program instance 31a accepts all valid external commands and executes the processing corresponding to the accepted external commands.

[0125] Furthermore, when the update process for mini-program 31 begins, the internal state of the upgraded mini-program 32 is set to the initial state. In the initial state, the upgraded mini-program instance 32 is in a state where no backup data has been accumulated (a state where no data exists).

[0126] Next, after successful backup authentication between the old mini-program instance 31a and the upgraded mini-program instance 32, the internal state of the old mini-program 31a transitions from a normal state to a backup in progress state at the start of the backup process. In the backup in progress state, the old mini-program instance 31a and the upgraded mini-program instance 32 perform the backup process, and the process is restricted by external commands. Specifically, the old mini-program instance 31a only accepts selection commands, executes the processing corresponding to the selection commands, and does not accept other external commands. Selection commands are external commands that are always sent at the start of a new session (new processing).

[0127] Furthermore, when the upgraded mini-program instance 32 begins receiving backup data from the old mini-program instance 31a, the internal state of the upgraded mini-program 32 transitions from the initial state to the backup in progress state. In the backup in progress state, the upgraded mini-program instance 32 and the old mini-program 31a perform backup processing.

[0128] Next, after the backup process between the old mini-program 31a and the upgraded mini-program 32 is completed, the old mini-program 31a transitions from the backup in progress state to the backup complete state. In the backup complete state, the old mini-program instance 31a does not accept any external commands and does not perform any processing using external commands. That is, the old mini-program instance 31a prioritizes the processing that updates mini-program 31a and does not perform other processing. This arrangement prevents inconsistencies between the internal data of the old mini-program instance 31a and the backup data in the upgraded mini-program 32, such as when the old mini-program instance 31a performs other processing and updates its internal data.

[0129] In addition, after the backup process between the old mini-program instance 31a and the upgraded mini-program instance 32 is completed, the internal state of the upgraded mini-program 32 changes from the backup in progress state to the recovery in progress state.

[0130] Simultaneously, while the backup is in progress, upon receiving a selection command, the old mini-program instance 31a cancels the update process for mini-program 31 and sends a message instructing the upgrade mini-program instance 32 to delete data. Furthermore, the internal state of the old mini-program 31a returns from the backup in progress state to the normal state, and the old mini-program instance 31a begins the session corresponding to the selection command. That is, when the old mini-program instance 31a, which is in the backup in progress state, is instructed to start a new session, the old mini-program instance 31a gives higher priority to the processing corresponding to the new session than to the update process for mini-program 31.

[0131] Furthermore, after receiving a data deletion message from the old mini-program instance 31a, the upgraded mini-program instance 32 deletes the internally accumulated backup data and stops updating the mini-program 31a. Then, the upgraded mini-program's internal state 32 returns to its initial state. This arrangement prevents inconsistencies between the old mini-program instance 31a's internal data and backup data from occurring, even if the old mini-program instance 31a performs processing corresponding to the new session and its internal data is updated.

[0132] Furthermore, upon completion of the backup, the old mini-program instance 31a and its package are removed from the eSE chip 22. Meanwhile, the package of the new mini-program 31b is loaded onto the SE chip 22. At this point, the internal state of the new mini-program 31b is set to its initial state. In this initial state, the new mini-program 31b is in a state prior to instantiation and therefore cannot perform processes such as updating internal data.

[0133] Then, when the new mini-program 31b is instantiated and data exists in the upgraded mini-program 32 (i.e., when the upgraded mini-program 32 has backed up the internal data of the old mini-program 31a), the internal state of the new mini-program 31b transitions from the initial state to the recovery in progress state. In the recovery in progress state, the new mini-program instance 31b does not accept any external commands and does not perform any processing using external commands. That is, the new mini-program instance 31b prioritizes the processing of updating mini-program 31a and does not perform other processing. This arrangement prevents the accumulation of data that is not present in the data backed up in the upgraded mini-program instance 32 in the new mini-program instance 31b, which could be caused by, for example, the new mini-program instance 31b performing other processing, thereby updating its internal data.

[0134] Furthermore, in the recovery process, if an error occurs during the update of mini-program 31 due to errors in the recovery authentication process, the internal state of the new mini-program 31b transitions to an error state. In the error state, similar to the recovery state, the new mini-program instance 31b does not accept any external commands and does not utilize external commands for processing.

[0135] Then, in the error state, the new mini-program instance 31b and its package are removed from the eSE chip 22. Additionally, the updated package of the new mini-program 31b is loaded onto the SE chip 22. Then, processing resumes from the instantiation of the new mini-program 31b.

[0136] Meanwhile, after the recovery process between the upgraded mini-program 32 and the new mini-program 31b is completed, the backup data in the upgraded mini-program instance 32 is deleted, and the internal state of the upgraded mini-program 32 returns from the recovery in progress state to the initial state. Furthermore, after the backup data in the upgraded mini-program 32 is deleted and thus no longer contains internal data, the internal state of the new mini-program 31b transitions from the recovery in progress state to a normal state similar to that of the old mini-program 31a.

[0137] Therefore, the states of the old mini-program 31a, the new mini-program 31b, and the upgraded mini-program 32 are managed jointly to prevent either the old mini-program instance 31a or the new mini-program instance 31b from performing processes other than the update process during the update of mini-program 31, thereby updating internal data. That is, while backup data has been accumulated in the upgraded mini-program instance 32, updates to the internal data of the old mini-program instance 31a or the new mini-program instance 31b are prevented. This arrangement prevents inconsistencies in the data before and after the update of mini-program 31.

[0138] <<2. Variation>>

[0139] Variations of the above embodiments of the present technology will be described below.

[0140] This technology is not limited to the examples above, and can be applied to various software updates such as operating systems or application software.

[0141] Furthermore, this technology can be applied not only to software updates but also to situations such as transferring data between different software programs, i.e., moving data from one software program to another. Please note that in this case, the data in the source software may or may not be deleted after the transfer.

[0142] Furthermore, the methods used for backup authentication and recovery authentication are not limited to those mentioned above, and other methods may be applied.

[0143] <<3. Others>>

[0144] <Computer Configuration Example>

[0145] The above series of processes can be performed either by hardware or by software. In the case where the processes are performed by software, the program included in the software is installed on the computer. Here, "computer" includes computers integrated into dedicated hardware, such as general-purpose personal computers capable of performing various functions by installing various programs.

[0146] Figure 6 This is a block diagram illustrating an example configuration of the computer hardware that performs the above series of processes through a program.

[0147] In computer 1000, central processing unit (CPU) 1001, read-only memory (ROM) 1002 and random access memory (RAM) 1003 are interconnected via bus 1004.

[0148] In addition, the input / output interface 1005 is connected to the bus 1004. The input unit 1006, output unit 1007, recording unit 1008, communication unit 1009 and driver 1010 are connected to the input / output interface 1005.

[0149] Input unit 1006 includes input switches, buttons, microphones, image sensors, etc. Output unit 1007 includes displays, speakers, etc. Recording unit 1008 includes hard disks, non-volatile memory, etc. Communication unit 1009 includes network interfaces, etc. Driver 1010 drives removable media 1011 such as disks, optical disks, magneto-optical disks, or semiconductor memories.

[0150] In the computer 1000 configured as described above, the CPU 1001 loads, for example, the program recorded in the recording unit 1008 into the RAM 1003 via the input / output interface 1005 and the bus 1004 and executes the program to perform the series of processes described above.

[0151] The program executed by the computer 1000 (CPU 1001) can be provided, for example, by recording on a removable medium 1011 as a packaging medium. Alternatively, the program can be provided via a wired or wireless transmission medium such as a local area network, the Internet, or digital satellite broadcasting.

[0152] In computer 1000, a program can be installed on recording unit 1008 via input / output interface 1005 by attaching removable medium 1011 to drive 1010. Alternatively, the program can be received by communication unit 1009 via wired or wireless transmission medium and installed on recording unit 1008. Additionally, the program can be pre-installed on ROM 1002 or recording unit 1008.

[0153] Note that a program executed by a computer may be a program that is processed sequentially in the order described in this specification, or it may be a program that is processed in parallel, or it may be a program that needs to be processed at regular intervals, such as when a call is made.

[0154] Furthermore, in this specification, a system refers to a collection of multiple components (devices, modules (parts), etc.), regardless of whether all components are housed in the same housing. Therefore, multiple devices housed in separate housings and connected via a network, as well as a single device housing multiple modules in one housing, are both systems.

[0155] Furthermore, embodiments of this technology are not limited to the above embodiments, and various changes can be made without departing from the scope of this technology.

[0156] For example, this technology can have a cloud computing configuration, in which a function is shared and processed jointly by multiple devices via a network.

[0157] Furthermore, each step described in the flowchart above can be performed by a single device, or it can be performed by multiple devices sharing the same resources.

[0158] In addition, when a step includes multiple processes, these processes can be executed not only by one device but also by multiple devices sharing the execution.

[0159] <Configuration Combination Example>

[0160] This technology can have the following configurations.

[0161] (1) An information processing device, comprising:

[0162] The information processing device includes a control unit that executes the first software, the second software, and the third software.

[0163] If the first authentication between the first software and the second software is successful, the data in the first software will be backed up to the second software; and

[0164] If the second authentication between the second and third software is successful, the data backed up in the second software will be moved to the third software.

[0165] (2) The information processing device according to (1),

[0166] After successful first authentication, the first software transitions from the first state to the second state; and after the backup of the data to the second software is completed, the first software transitions from the second state to the third state.

[0167] (3) The information processing equipment according to (2),

[0168] The first state includes the state that accepts all valid external commands.

[0169] The second type of state includes states that accept only a portion of external commands, and

[0170] The third state includes a state that does not accept any external commands.

[0171] (4) The information processing device according to (2) or (3),

[0172] Specifically, when a second state indicates a different process than the currently executing process, the first software gives priority to the other process; and when a third state indicates a different process than the currently executing process, the first software gives priority to the currently executing process.

[0173] (5) The information processing equipment according to (4),

[0174] Wherein, if other processing is indicated in the second state, the first software returns to the first state and performs other processing, and

[0175] If the first software returns to the first state and performs other processing, the second software deletes the backed-up data.

[0176] (6) The information processing device according to (4) or (5),

[0177] The ongoing processes include updating the first software to the third software.

[0178] (7) The information processing apparatus according to any one of (1) to (6),

[0179] After acquiring all the data backed up in the second software, the third software transitions from the first state to the second state.

[0180] (8) The information processing device according to (7),

[0181] Specifically, after acquiring all the data backed up in the second software and deleting the data from the second software, the third software transitions from the first state to the second state.

[0182] (9) The information processing device according to (7) or (8),

[0183] The first state includes a state that does not accept any external commands, and

[0184] The second state includes the state that accepts all valid external commands.

[0185] (10) The information processing apparatus according to any one of (7) to (9),

[0186] Specifically, when the first state indicates a different process than the process currently being executed, the third software prioritizes the process currently being executed.

[0187] (11) The information processing device according to (10),

[0188] The ongoing processes include updating the first software to the third software.

[0189] (12) The information processing apparatus according to any one of (1) to (11),

[0190] In this process, the first software transmits data to the second software using a program provided by the second software for sending.

[0191] (13) The information processing device according to (12),

[0192] In the event that the first authentication is successful, the second software provides the program for sending to the first software.

[0193] (14) The information processing apparatus according to any one of (1) to (13),

[0194] The third software obtains data from the second software by using a program provided by the second software.

[0195] (15) The information processing device according to (14),

[0196] In the event of successful second authentication, the second software provides the program used for acquisition to the third software.

[0197] (16) The information processing apparatus according to any one of (1) to (15),

[0198] The first software was updated by the third software.

[0199] (17) The information processing apparatus according to any one of (1) to (16),

[0200] The first and third software include applications.

[0201] (18) An information processing method, comprising:

[0202] If the first authentication between the first software and the second software is successful, the data in the first software will be backed up to the second software; and

[0203] If the second authentication between the second and third software is successful, the data backed up in the second software will be moved to the third software.

[0204] (19) A program that causes a computer to perform a process, said process comprising:

[0205] If the first authentication between the first software and the second software is successful, the data in the first software will be backed up to the second software; and

[0206] If the second authentication between the second and third software is successful, the data backed up in the second software will be moved to the third software.

[0207] (20) An information processing system, comprising:

[0208] First information processing equipment; and

[0209] Second information processing equipment,

[0210] Specifically, when the first authentication between the first software and the second software is successful, the first information processing device backs up the data in the first software to the second software; and when the second authentication between the second software and the third software obtained from the second information processing device is successful, the first information processing device moves the backed-up data in the second software to the third software.

[0211] Note that the effects described in this article are merely examples, and the effects of this technique are not limited to these. Additional effects can also be obtained.

[0212] Reference Symbol List

[0213] 11. Information processing equipment

[0214] 12 servers

[0215] 21. Device Host

[0216] 22 eSE chips

[0217] 23 CLF chips

[0218] 31 Mini Programs, Mini Program Examples

[0219] 31a Old Mini Programs, Examples of Old Mini Programs

[0220] 31b New Mini Programs, Examples of New Mini Programs

[0221] 32 Upgrade your mini-program, examples of mini-program upgrades

Claims

1. An information processing device, comprising: The information processing device includes a control unit that executes the first software, the second software, and the third software. If the first authentication between the first software and the second software is successful, the data in the first software will be backed up to the second software; as well as If the second authentication between the second and third software is successful, the data backed up in the second software will be moved to the third software. After successful initial authentication, the first software transitions from state one to state two; and after the data backup to the second software is complete, the first software transitions from state two to state three. The first state includes the state that accepts all valid external commands. The second type of state includes states that accept only a portion of external commands, and The third state includes a state that does not accept any external commands.

2. The information processing device according to claim 1, in, When a different process is indicated in the second state than the process currently being executed, the first software gives priority to the other process; and when a different process is indicated in the third state than the process currently being executed, the first software gives priority to the process currently being executed.

3. The information processing device according to claim 2, in, If other processing is indicated in the second state, the first software returns to the first state and performs the other processing. If the first software returns to the first state and performs other processing, the second software deletes the backed-up data.

4. The information processing device according to claim 2, in, The ongoing processes include updating the first software to the third software.

5. The information processing device according to claim 1, in, After acquiring all the data backed up in the second software, the third software transitions from the first state to the second state.

6. The information processing device according to claim 5, in, After acquiring all the data backed up in the second software and deleting the data from the second software, the third software transitions from the first state to the second state.

7. The information processing device according to claim 5, in, The first state includes a state that does not accept any external commands, and The second state includes the state that accepts all valid external commands.

8. The information processing device according to claim 5, in, When the first state indicates a different process than the one currently being executed, the third software prioritizes the currently executing process.

9. The information processing device according to claim 8, in, The ongoing processes include updating the first software to the third software.

10. The information processing device according to claim 1, in, The first software transmits data to the second software using a program provided by the second software for sending.

11. The information processing device according to claim 10, in, If the first authentication is successful, the second software provides the program for sending to the first software.

12. The information processing device according to claim 1, in, The third software obtains data from the second software using a program provided by the second software.

13. The information processing device according to claim 12, in, If the second authentication is successful, the second software provides the program used for acquisition to the third software.

14. The information processing device according to claim 1, in, The first software was updated by the third software.

15. The information processing device according to claim 1, in, The first and third software include applications.

16. An information processing method, comprising: If the first authentication between the first software and the second software is successful, the data in the first software will be backed up to the second software; as well as If the second authentication between the second and third software is successful, the data backed up in the second software will be moved to the third software. After successful initial authentication, the first software transitions from state one to state two; and after the data backup to the second software is complete, the first software transitions from state two to state three. The first state includes the state that accepts all valid external commands. The second type of state includes states that accept only a portion of external commands, and The third state includes a state that does not accept any external commands.

17. A program product that causes a computer to perform processing, said processing comprising: If the first authentication between the first software and the second software is successful, the data in the first software will be backed up to the second software; as well as If the second authentication between the second and third software is successful, the data backed up in the second software will be moved to the third software. After successful initial authentication, the first software transitions from state one to state two; and after the data backup to the second software is complete, the first software transitions from state two to state three. The first state includes the state that accepts all valid external commands. The second type of state includes states that accept only a portion of external commands, and The third state includes a state that does not accept any external commands.

18. An information processing system, comprising: First information processing equipment; as well as Second information processing equipment, Specifically, when the first authentication between the first software and the second software is successful, the first information processing device backs up the data in the first software to the second software; and when the second authentication between the second software and the third software obtained from the second information processing device is successful, the first information processing device moves the backed-up data in the second software to the third software. After successful initial authentication, the first software transitions from state one to state two; and after the data backup to the second software is complete, the first software transitions from state two to state three. The first state includes the state that accepts all valid external commands. The second type of state includes states that accept only a portion of external commands, and The third state includes a state that does not accept any external commands.

Images