Verification device, verification system, verification method, and verification program

Abstract

A storage unit (11) stores the size of a free area of a memory (21) in a target device (20) and software held in the memory (21). A generation unit (12a) generates a graph configured from a plurality of nodes in accordance with the size of the free area in the memory (21), and transmits the graph to the target device (20). A calculation unit (12b) calculates a hash value corresponding to each block in the software stored in the memory (21). A verification unit (12c) verifies whether tampering of the memory (21) in the target device (20) has occurred using the calculated hash value corresponding to the block, and a response returned using the graph calculated in response to a challenge specifying a node of the graph, and a hash value of the block returned in response to a challenge specifying the block.

Description

Technical Field

[0001] This invention relates to a verification device, a verification system, a verification method, and a verification procedure. Background Technology

[0002] In recent years, with the proliferation of the Internet of Things (IoT), detecting malware and software tampering in embedded devices and taking security measures has become crucial. On the other hand, from a cost perspective, it is difficult to integrate tamper-proof hardware into embedded systems, and their functionality is less expandable compared to general-purpose PCs such as servers. Therefore, whitelist-based detection technologies are expected to externally verify whether the software installed in a device has deviated from its intended correct state without using special hardware (Non-Patent Literature 1).

[0003] Reference List

[0004] Non-patent literature

[0005] Non-patent literature 1: A. Seshadri, A. Perrig, L. van Doorn, P. Khosla, "SWATT:SoftWare-based ATTestation for Embedded Devices", USA, IEEE Symposium onSecurity and Privacy, 2004. Proceedings, 2004, pp. 272-282

[0006] Non-patent literature 2: Ling Ren, Srinivas Devadas, "Proof of Space from Stacked Expanders", Theory of Cryptography Conference, Germany, 2016, pp. 262-285.

[0007] Non-patent literature 3: Stefan Dziembowski, Sebastian Faust, Vladimir Kolmogorov, Krzysztof Pietrzak, "Proofs of Space", Annual Cryptology Conference, Germany, 2015, pp. 585-605 Summary of the Invention

[0008] Technical issues

[0009] However, in conventional technologies, it can be difficult to verify from outside the device whether or not software tampering of the embedded device has occurred. For example, according to the technology described in Non-Patent Document 1, while it can be proven that the software area of ​​the device's memory has not been tampered with, it is difficult to prove that no unauthorized software has been added to the free area.

[0010] The present invention was made in view of the above circumstances, and the purpose of the present invention is to verify from outside the device whether there is tampering with the software of the embedded device.

[0011] Problem-solving methods

[0012] To solve the above problems and achieve the objective, the verification device according to the present invention is characterized in that the verification device comprises: a storage unit storing the size of a free area of ​​a memory of an object device and software stored in the memory; a generation unit generating a graph containing multiple nodes according to the size of the free area of ​​the memory of the object device, and sending the graph to the object device; a calculation unit calculating a hash value corresponding to each software block stored in the memory of the object device; and a verification unit using the calculated hash value corresponding to the block, a response to a challenge to a node of a specified graph returned from the object device using the graph, and a hash value corresponding to the block returned from the object device as a response to a challenge to the specified block, to verify whether there is any tampering with the memory of the object device.

[0013] Invention Effects

[0014] According to the present invention, it is easy to verify from outside the device whether there is any tampering with the software of the embedded device. Attached Figure Description

[0015] Figure 1 This is a schematic diagram illustrating the schematic construction of the verification system according to this embodiment.

[0016] Figure 2 This is a diagram used to illustrate the processing of the generation unit.

[0017] Figure 3 This is a diagram used to illustrate the overview of the verification process.

[0018] Figure 4 This is a sequence diagram illustrating the verification process.

[0019] Figure 5 This is a diagram showing an example of a computer performing a verification procedure. Detailed Implementation

[0020] In the following description, embodiments of the present invention will be described in detail with reference to the accompanying drawings. Note that the present invention is not limited to these embodiments. Furthermore, in the description of the drawings, the same parts are indicated by the same reference numerals.

[0021] [Construction of the verification system]

[0022] Figure 1 This is a schematic diagram illustrating the schematic construction of the verification system according to this embodiment. For example... Figure 1 As shown, the verification system 1 includes a verification device 10 and a target device 20. The target device 20 is a software embedded device, such as an IoT device, that is the object of the verification process described later. Here, in this embodiment, programs and data are collectively referred to as software. Furthermore, the area in the memory 21 of the target device 20 where the software is stored is referred to as the software area.

[0023] The verification device 10 verifies, through a verification process described later, whether the software area of ​​the object device 20 has not been tampered with and whether unauthorized software has been added to the free area. Therefore, the verification device 10 can verify from outside the object device 20 whether the programs and data of the object device 20 have not been tampered with or whether unauthorized programs and data have been added; that is, it verifies whether software tampering of the object device 20 exists or not.

[0024] [Structure of the verification device]

[0025] Figure 1 This is a schematic diagram illustrating the schematic structure of the verification device according to this embodiment. Figure 1 As shown, the verification device 10 of this embodiment is implemented by a general-purpose computer such as a personal computer, and includes a storage unit 11, a control unit 12, and a communication control unit (not shown).

[0026] The storage unit 11 is implemented using a semiconductor storage element such as RAM (Random Access Memory) or flash memory, or a storage device such as a hard disk or optical disk. In the storage unit 11, the processing program for operating the verification device 10, data used during the execution of the processing program, etc., are pre-stored or temporarily stored each time the processing is executed. In this embodiment, the storage unit 11 stores the size of the free area of ​​the memory 21 of the target device 20 and the software stored in the memory 21.

[0027] The software includes a verification program, which is a program used to operate the object device 20, which is the object of the verification process described later. Furthermore, the software region is divided into arbitrary blocks by means of addresses, etc. Assume that data d(x) is stored in block x.

[0028] The communication control unit is implemented by a NIC (Network Interface Card) and controls the communication between external devices such as the target device 20 and the control unit 12 through communication lines such as LAN (Local Area Network) and the Internet.

[0029] The control unit 12 is implemented using a CPU (Central Processing Unit) or similar means, and executes processing programs stored in memory. Therefore, the control unit 12 serves as a generation unit 12a, a calculation unit 12b, and a verification unit 12c, such as... Figure 1 As shown. Note that each or part of these functional units may be implemented in different hardware. In addition, control unit 12 may include other functional units.

[0030] The generation unit generates a graph containing multiple nodes based on the size of the free area of ​​the memory 21 of the object device 20, and sends the graph to the object device 20.

[0031] First, we will describe the labeled graph of the directed acyclic graph G = (V, E). Here, V is the set of nodes contained in G, and E is the set of edges. The number of nodes in V is labeled as |V| = N, and each node is labeled with a value from 1 to N. Furthermore, the numerical values... (v) {1, 0} With each node v V is associated with. It is the size of the hash value.

[0032] Here, for the subset V' = {v1, ..., v n}, v i V defines (V') = {( (v1),..., (v) n Furthermore, the set of parent nodes of v is defined as follows: (v) = {v'|(v', v)} E}. In addition, a numerical value corresponding to each node is defined. (v) = H(v, (v, (v) Here, H is the hash function H:{1,0} {1,0} .

[0033] In this embodiment, the local stacking expander LG proposed in Non-Patent Document 2 （n, k, , ） It is used as a directed acyclic graph. A local stack expander is a graph with n (k+1) nodes, consisting of k+1 local bipartite expanders (LBGs) of a directed bipartite graph with n nodes. （n, , ） .

[0034] As is well known, local stack expanders can be used to construct graphs that require a certain amount or more storage capacity for computation at all nodes v. (v).

[0035] Next, we will refer to Figure 2 A verification method using a hash tree proposed in Non-Patent Document 1 is described. Figure 2 This is a diagram used to illustrate the processing of generation unit 12a. For example... Figure 2 As shown, generating a hash tree with N leaves results in a hash tree with (logN+1) levels. Assume there are no terminal nodes with output edges. If it is level 0, then Figure 2 The left end is the logNth level. The hash value corresponding to each node is the hash value concatenated with the hash value of the parent node.

[0036] Here, the function Open(c) is the following function. That is, assuming the set of nodes reachable from node v is... (v), and the set of nodes with input edges from node v is (v) = v'(v, v') E. Open(c) is a function that satisfies the following equation (1) when selecting node c at level logN, where i = 1, ...

[0037] [Mathematical Functions 1]

[0038] For Open(c): i = 1, ..., logN, this function returns all functions that satisfy the following relation. :v II(c) and ( ) II(c) (1)

[0039] In other words, this Open(c) returns... Figure 2 The hash value of the shaded node is a function that calculates the child nodes that are unreachable by c but reachable by c (i.e., nodes at the end of the graph). The function required to generate the hash value of ).

[0040] In the processing described later, when the verification device 10 sends a challenge C(c) to the target device 20 for node c... When c), object device 20 returns Open(c) and (c) as a response to question C. In this case, for all c C, if the hash value H of the parent node (( If (c) matches the hash value of c and H(Open(c)) matches, then it can be guaranteed with a high probability that the object device 20 correctly calculates the value corresponding to the N nodes v. (v).

[0041] Then, generation unit 12a generates a local bisection expander LBG with n nodes. （n, , ） And send it to object device 20. Here, Figure 3 This is a diagram used to illustrate an overview of the verification process. For example... Figure 3 As shown, the verification device 10 of this embodiment expands LGB in a space of size n in the free area of ​​the memory 21 of the target device 20 through a verification program. （n, , ） Then, the verification device 10 uses the Open function corresponding to the node in the graph to prove that the free area in the memory 21 of the object device 20 is definitely free.

[0042] In addition, in calculating LBG （n, , ） In the processing of the hash value, the verification device 10 randomly selects block x of the software region and uses the cascade hash value calculated by the data d(x) of the reference block x to verify whether the software region of the memory 21 of the object device 20 has been tampered with.

[0043] Specifically, generation unit 12a first generates a local binary expander LBG with n nodes. （n, , ） And send it to object device 20.

[0044] As will be described later, in object device 20, a space of size n in the free region of memory 21 is reserved for verification processing, and based on the received LBG （n, , ） To write the hash value.

[0045] Return to Figure 1 The description is as follows. The computing unit 12b calculates the hash value corresponding to each software block stored in the memory 21 of the object device 20. Specifically, the computing unit 12b calculates values ​​such as H(Open(c1)), z(c2), etc., which are used for each of the processes that will be repeated k times by the verification unit 12c, as will be described later.

[0046] In addition, the verification unit 12c uses the calculated hash value corresponding to the block, the response to the challenge to the node of the specified graph calculated from the graph returned by the object device 20, and the hash value corresponding to the block returned by the object device 20 as the response to the challenge to the specified block to verify whether there is any tampering with the memory 21 of the object device 20.

[0047] Verification unit 12c verifies whether the response calculated from the usage graph returned from object device 20 is consistent with all challenges and whether the calculated hash value corresponding to the block matches the hash value returned from object device 20 corresponding to the block.

[0048] The verification unit 12c also uses a concatenated hash value with a predetermined number of random numbers as the hash value corresponding to the block.

[0049] Specifically, the verification unit 12c sends a challenge C = {C1, c2, L} to the target device 20. Here, C1 is a challenge for a free area of ​​memory 21 and specifies node c1 of the generated graph. C1. Furthermore, c2 is a challenge to the software region of memory 21, and randomly assigns blocks. Additionally, L is the number of random numbers to be generated when randomly assigning blocks (i.e., information specifying the number of blocks to be assigned).

[0050] Verification unit 12c receives Open(c1) and from object device 20 (c1) as for all c1 C1's question and C1's response.

[0051] Additionally, verification unit 12c receives the concatenated hash value z(c2) = H(d(r1), ..., d(r2)) from object device 20. L This is R(c2) as a response to the question c2. Here, R(c2) = {r1, ..., r} L} is a sequence of L random numbers generated by a pseudo-random number generation function.

[0052] In other words, verification unit 12c receives {Open(c1), (c1), z(c2)} are responses to the challenge C.

[0053] Then, verification unit 12c targets all c. C verification: H (( (c))) whether it matches the hash value of c, whether H(Open(c)) matches, and whether the cascaded hash value z(c2) matches the value calculated by the computing unit 12b. When they all match, the verification unit 12c guarantees with a high probability that the free area is reliably free and the software area has not been tampered with, that is, the memory 21 of the object device 20 has not been tampered with.

[0054] Verification unit 12c repeats the above process k times. As described above, verification device 10 uses a graph with n (k+1) nodes to perform the verification process.

[0055] Note that the generation unit 12a generates a graph such that the product of the number of nodes and the size of the hash value corresponding to each node is close to the size of the free area of ​​the memory 21 of the object device 20 within a predetermined range.

[0056] For example, if = - 2 If it is close enough to 1, it can be proven that a capacity with a sufficiently large free area was used. The region n is thus free, so it can be proven that unauthorized software was not added to the free region. However, it is well known that the number d of input edges per node increases with... It grows exponentially, approaching 1. The size of the region that verification device 10 can prove is a trade-off with the computational cost dnk of LBG, and can, for example, be 0.7 < < 0.9.

[0057] [Object Device]

[0058] The object device 20 includes a memory 21, a control unit 22, and a communication control unit (not shown).

[0059] The memory 21 is implemented using a semiconductor storage element such as RAM (Random Access Memory) or flash memory, or a storage device such as a hard disk or optical disk. In the memory 21, the processing program for operating the target device 20, data used during the execution of the processing program, etc., are pre-stored or temporarily stored each time processing is performed. In this embodiment, a verification program for operating the target device 20 is stored in the software area of ​​the memory 21.

[0060] The communication control unit is implemented through a NIC (Network Interface Card) and controls the communication between external devices such as the verification device 10 and the control unit 22 through communication lines such as a LAN (Local Area Network) or the Internet.

[0061] The control unit 22 is implemented using a CPU (Central Processing Unit), NP (Network Processor), FPGA (Field Programmable Gate Array), etc., and executes processing programs stored in memory. In this embodiment, the control unit 22 functions as both the storage unit 22a and the response unit 22b by executing a verification program.

[0062] The storage unit 22a stores the calculated hash value corresponding to each node of the graph received from the verification device 10 in the free area of ​​the memory 21. Specifically, when the storage unit 22a receives a local binary expander LBG with n nodes... （n, , ） At that time, a space of size n in the free region of memory 21 is reserved for verification processing, and based on the received LBG （n, , ） To write the hash value.

[0063] When the response unit 22b receives a challenge from the verification device 10 for a node of a specified graph and a block of software stored in memory, the response unit 22b responds to the verification device 10 with a response calculated using the stored hash value corresponding to the node and the calculated hash value corresponding to the block.

[0064] Furthermore, when the response unit 22b receives a challenge for a specified block from the verification device 10, if a number of random numbers is further specified, the response unit 22b returns the cascaded hash value calculated using the further specified number of random numbers as the hash value corresponding to the block.

[0065] Specifically, when a challenge C = {C1, c2, L} is received from the verification device 10, the response unit 22b responds to all c1. C1 computes Open(c1) and (c1).

[0066] Additionally, the random number sequence R(c2) = {r1, ..., r L The hash value z(c2) is generated using challenge c2 as the seed for the pseudo-random number generation function. Then, response unit 22b calculates the concatenated hash value z(c2) = H(d(r1), ..., d(r2)).L )).

[0067] Then, response unit 22b returns res = {Open(c1),} to verification device 10. (c1), z(c2)} serve as responses to the challenge. The object device 20 and the verification device 10 repeat the above process k times. Therefore, as described above, the verification device 10 verifies whether there is any tampering with the memory 21 of the object device 20.

[0068] [Verification Processing]

[0069] Next, refer to Figure 4 The verification process performed by the verification apparatus 10 according to this embodiment is described. Figure 4 This is a sequence diagram illustrating the verification process. For example, Figure 4 The sequence begins at the moment the user inputs the instruction to start.

[0070] First, in the verification device 10, the generation unit 12a generates a graph containing multiple nodes based on the size of the free area of ​​the memory 21 of the object device 20, and sends the graph to the object device 20 (step S1).

[0071] In object device 20, storage unit 22a calculates the hash value corresponding to each node of the graph received from verification device 10 and stores the hash value in the free area of ​​memory 21 (step S2).

[0072] Next, in the verification device 10, the verification unit 12c sends a challenge to the node of the specified graph and the block of software stored in the memory to the object device 20 (step S3).

[0073] In the object device 20 that receives the challenge, the response unit 22b uses graph calculation to respond to the challenge to the specified node, and calculates the hash value corresponding to the block as the response to the challenge to the specified block. Furthermore, the response unit 22b returns the calculated response to the verification device 10 (step S4).

[0074] In the verification device 10 that receives the response, the verification unit 12c verifies whether there is any tampering with the memory 21 of the target device 20 (step S5). Specifically, the verification unit 12c verifies whether the response to a challenge to a specified node matches all challenges. In addition, the verification unit 12c verifies whether the response to a challenge to a specified block matches the hash value corresponding to that block calculated by the calculation unit 12b. The verification unit 12c repeats steps S1 to S5 k times.

[0075] For example, when all of them match, the verification unit 12c determines that the free area of ​​the memory 21 of the object device 20 is reliably free and the software area has not been tampered with, that is, the memory 21 of the object device 20 has not been tampered with.

[0076] Furthermore, the verification unit 12c displays the verification results and outputs them to an output unit (not shown), such as a display. Thus, a series of verification processes are completed.

[0077] As described above, in the verification apparatus 10 of this embodiment, the storage unit 11 stores the size of the free area of ​​the memory of the target device 20 and the software stored in the memory. Furthermore, the generation unit 12a generates a graph containing multiple nodes based on the size of the free area of ​​the memory 21 of the target device 20, and sends the graph to the target device 20. Additionally, the calculation unit 12b calculates a hash value corresponding to each software block stored in the memory 21 of the target device 20. Furthermore, the verification unit 12c uses the hash value corresponding to the block, the response to a challenge to a node of a specified graph calculated from the graph returned by the target device 20, and the hash value corresponding to the block returned by the target device 20 as a response to a challenge to the specified block, to verify whether tampering of the memory 21 of the target device 20 has occurred.

[0078] Verification unit 12c verifies that the response calculated from the usage graph returned from object device 20 is consistent with all challenges and whether the calculated hash value corresponding to the block matches the hash value returned from object device 20 corresponding to the block.

[0079] Therefore, the verification device 10 can prove with high accuracy that the free area is reliably free by utilizing a region with a predetermined capacity or larger within the free area of ​​the memory 21, which includes the volatile memory of the target device 20. Furthermore, the verification device 10 can detect the presence or absence of tampering with the software area by referring to data in the software area. In particular, the verification device 10 can detect with high probability when either or both of tampering with the software area of ​​the memory 21 or unauthorized software being added to the free area occur. Therefore, the verification device 10 can simultaneously verify the presence or absence of tampering with the software area, or whether the free area is reliably free. As described above, according to the verification device 10, the presence or absence of software tampering with the embedded device can be verified from outside the target device 20.

[0080] Furthermore, the generation unit 12a generates a graph such that the product of the number of nodes and the size of the hash value corresponding to each node is close to the size of the free area of ​​the memory of the object device 20 within a predetermined range. Therefore, the verification device 10 can verify with higher accuracy whether the free area of ​​the object device 20 is reliably free.

[0081] Furthermore, in the object device 20, the storage unit 22a stores the calculated hash values ​​corresponding to each node of the graph received from the verification device 10 in a free area of ​​the memory 21. Additionally, when the response unit 22b receives a challenge from the verification device 10 specifying a node of the graph and a block of software stored in the memory, the response unit 22b responds to the verification device 10 with a response calculated using the stored hash values ​​corresponding to that node of the graph and the calculated hash values ​​corresponding to that block.

[0082] Therefore, the verification device 10 can verify whether or not the memory 21 of the object device 20 has been tampered with.

[0083] Furthermore, when the verification unit 12c of the verification device 10 sends a challenge to the target device 20 for a specified block, the verification unit 12c further specifies the number of random numbers. In this case, the response unit 22b of the target device 20 returns a concatenated hash value calculated using the further specified number of random numbers as the hash value corresponding to that block. This enables verification with higher accuracy of whether or not software regions have been tampered with.

[0084] It is worth noting that the verification device 10 searches the software region kL times. At this point, it detects a software region of size m. The probability that m is tampered with is (1- ) kL .if = (1 / kL), then when kL is large enough, this probability is e. -kL Therefore, if kL is large enough, the probability of missing tampering of software regions will decrease exponentially.

[0085] Furthermore, in the above embodiment, the computational complexity of the object device 20 is k(2n-1+L+dn), and the computational complexity of the verification device 10 is k(|C1|logn+L). When kL is sufficiently large, the computational complexity of both the verification device 10 and the object device 20 is kL.

[0086] [program]

[0087] A program can also be created in which the processing performed by the verification device 10 according to the above embodiments is described in a computer-executable language. As one embodiment, the verification device 10 can be implemented by installing a verification program for performing the above verification processing as packaged software or online software on a desired computer. For example, an information processing device can be used as the verification device 10 by having it execute the verification program. In this context, the information processing device includes desktop or laptop personal computers. Additionally, the information processing device includes mobile communication terminals such as smartphones, mobile phones, or PHS (Personal Handheld Phone Systems) and tablet terminals such as PDAs (Personal Digital Assistants). Furthermore, the functionality of the verification device 10 can be implemented in a cloud server.

[0088] Figure 5 This is a diagram illustrating an example of a computer performing a verification procedure. Computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected via a bus 1080.

[0089] Memory 1010 includes ROM (Read-Only Memory) 1011 and RAM 1012. ROM 1011 stores, for example, a boot program such as BIOS (Basic Input / Output System). Hard disk drive interface 1030 is connected to hard disk drive 1031. Disk drive interface 1040 is connected to disk drive 1041. Removable storage media such as disks or optical discs are inserted into disk drive 1041. For example, mouse 1051 and keyboard 1052 are connected to serial port interface 1050. For example, monitor 1061 is connected to video adapter 1060.

[0090] Here, the hard disk drive 1031 stores, for example, an OS 1091, an application 1092, a program module 1093, and program data 1094. Each piece of information described in the above embodiments is stored, for example, in the hard disk drive 1031 or the memory 1010.

[0091] Furthermore, a verification program, such as program module 1093, is stored in hard disk drive 1031, which describes instructions to be executed by computer 1000. Specifically, program module 1093 describing each process performed by the verification device 10 described in the above embodiments is stored in hard disk drive 1031.

[0092] Furthermore, the data used for verifying the information processing of the program is stored as program data 1094 in, for example, a hard disk drive 1031. Then, the CPU 1020 reads the program module 1093 and program data 1094 stored in the hard disk drive 1031 into the RAM 1012 as needed, and executes the aforementioned processes.

[0093] It is worth noting that the program module 1093 and program data 1094 related to the verification program are not limited to being stored in the hard disk drive 1031, but can be stored, for example, in a removable storage medium and read by the CPU 1020 via the disk drive 1041, etc. Alternatively, the program module 1093 and program data 1094 related to the verification program can be stored in another computer connected via a network such as a LAN or WAN (wide area network) and read by the CPU 1020 via the network interface 1070.

[0094] The embodiments of the present invention have been described above, but the present invention is not limited to the specification and drawings that constitute a part of the disclosure of the present invention. That is, all other embodiments, examples, operating techniques, etc., performed by those skilled in the art based on these embodiments are included within the scope of the present invention.

[0095] List of reference numerals

[0096] 1. Verification System

[0097] 10. Verification Device

[0098] 11 storage units

[0099] 12 Control Units

[0100] 12a Generation Unit

[0101] 12b Computing Unit

[0102] 12c verification unit

[0103] 20 Object Devices

[0104] 21. Memory

[0105] 22 Control Unit

[0106] 22a Storage Unit

[0107] 22b Response Unit

Claims

1. A verification device, characterized by, The verification device includes: A storage unit that stores the size of a free area of ​​the memory of the object device and the software stored in the memory; A generation unit generates a graph containing multiple nodes based on the size of the free area of ​​the memory of the object device, and sends the graph to the object device. A computing unit calculates a hash value corresponding to each software block stored in the memory of the object device; and The verification unit verifies the existence or non-existence of tampering with the memory of the object device by verifying whether the response to a challenge to a node of the specified graph, calculated using the graph and returned from the object device, matches all challenges, and whether the calculated hash value corresponding to the software block matches the hash value corresponding to the software block returned from the object device as a response to a challenge to the specified software block.

2. The authentication device of claim 1, wherein, The generation unit generates the graph such that the product of the number of nodes and the size of the hash value corresponding to each node is close to the size of the free area of ​​the memory of the object device within a predetermined range.

3. The authentication apparatus according to claim 1, characterized by The verification unit also uses a cascaded hash value with a predetermined number of random numbers as the hash value corresponding to the software block.

4. A verification system, the verification system comprising a verification device and an object device, characterized in that, The verification device includes: A storage unit that stores the size of the free area of ​​the object device's memory and the software stored in the memory; A generation unit generates a graph containing multiple nodes based on the size of the free area of ​​the memory of the object device, and sends the graph to the object device. A computing unit calculates a hash value corresponding to each software block stored in the memory of the object device; and The verification unit verifies the existence or non-existence of tampering with the memory of the object device by: verifying whether the response to a challenge to a node of the specified graph, calculated using the graph and returned from the object device, matches all challenges; and verifying whether the calculated hash value corresponding to the software block matches the hash value corresponding to the software block returned from the object device as a response to a challenge to the specified software block. The object device includes: A storage unit that stores the calculated hash value corresponding to each node of the graph received from the verification device in the free area of ​​the memory; and The response unit, when receiving a challenge from the verification device specifying a node of the graph and a software block of software stored in the memory, responds to the verification device with a response calculated using the stored hash value corresponding to the node of the graph and a calculated hash value corresponding to the software block.

5. The verification system according to claim 4, characterized in that, When the verification unit sends a challenge specifying the software block to the target device, the verification unit further specifies the number of random numbers, and The response unit returns a cascaded hash value calculated using a further specified number of random numbers as the hash value corresponding to the software block.

6. A verification method executed by a verification device, the verification device including a storage unit that stores a size of a free area of a memory of a target device and software held in the memory, characterized by, The verification method includes the following steps: The generation step involves generating a graph containing multiple nodes based on the size of the free area of ​​the memory of the object device, and sending the graph to the object device. The calculation step calculates a hash value corresponding to each software block stored in the memory of the object device; and The verification step verifies the existence or non-existence of tampering with the memory of the object device by verifying whether the response to a challenge to a node of the specified graph, calculated using the graph and returned from the object device, matches all challenges, and whether the calculated hash value corresponding to the software block matches the hash value corresponding to the software block returned from the object device as a response to a challenge to the specified software block.

7. A computer-readable medium storing instructions that, when executed by at least one processor, cause the at least one processor to perform the following steps: A reference is made to a storage unit, which stores the size of a free area of ​​the memory of the object device and the software stored in the memory; The generation step involves generating a graph containing multiple nodes based on the size of the free area of ​​the memory of the object device, and sending the graph to the object device. A calculation step, wherein the calculation step calculates a hash value corresponding to each software block stored in the memory of the object device; as well as The verification step verifies the existence or non-existence of tampering with the memory of the object device by verifying whether the response to a challenge to a node of the specified graph, calculated using the graph and returned from the object device, matches all challenges, and whether the calculated hash value corresponding to the software block matches the hash value corresponding to the software block returned from the object device as a response to a challenge to the specified software block.

Images