Data management system

Abstract

The data management system of the present invention accepts a status update request that specifies a target, and executes a status update process to update the status of the target specified in the status update request. The status update process includes a process of updating the first information and the second information in an ACID (atomicity, consistency, isolation, and durability) transactional manner, namely, transaction processing. The first information is a first object group (one or more first objects) for each target. The first object is data representing the status of the target. The second information is a second object group (one or more second objects) for each target. The transaction processing includes a first process and a second process, wherein the first process is to create, update, or clear the first object corresponding to the specified target, and the second process is to add a second object containing at least one of the content of the first process and the summary of the first object to the second object group corresponding to the specified target.

Description

Technical Field

[0001] The present invention generally relates to a data management technique. Background Art

[0002] When tamper detection is required for a data management system, it is considered to apply distributed ledger technology to the data management system. Blockchain is known as an example of a data management system that applies distributed ledger technology (e.g., Non-Patent Document 1).

[0003] Prior art literature

[0004] Non-patent literature

[0005] Non-Patent Document 1: https: / / bitcoin.org / bitcoin.pdf Summary of the Invention

[0006] Problems to be solved by the invention

[0007] There is a desire to manage data securely. Data is usually like Figure 1A As shown in the example, it is stored in the DB (database).

[0008] However, DBs do not have a mechanism to detect data tampering, so they may not be able to manage data securely in the event of a malicious attack.

[0009] Therefore, consider something like Figure 1B As illustrated, a method for securely managing data using blockchain is described.

[0010] However, blockchains cannot update or delete data due to their inherent tampering detection mechanisms, making it difficult to manage private data that requires deletion. Furthermore, blockchains have low searchability, making them inefficient for recording applications.

[0011] Therefore, consider something like Figure 1C As shown in the example, data is registered in DB 51 and the operation log of DB 51 (an example of processing content) is registered in blockchain 52, thereby achieving all the purposes of updating or clearing data, improving retrieval, and ensuring tamper detection (performing tamper detection).

[0012] However, DB 51 and blockchain 52 are independent data management systems. Therefore, consistency between DB 51 and blockchain 52 cannot be maintained. Specifically, if, for example, DB 51 is updated and its operation log is recorded in blockchain 52, blockchain 52 fails, there is a possibility that DB 51 has been updated but its operation log is not present in blockchain 52. Furthermore, DB 51 may be tampered with, and consistency between DB 51 and blockchain 52 may not be maintained, making it difficult to distinguish whether DB 51 has been tampered with or whether DB 51's operation log has not been recorded in blockchain 52.

[0013] Problems like the above may also occur when tampering detectability is guaranteed by technologies other than distributed ledger technology.

[0014] Technical means to solve the problem

[0015] The data management system of the present invention accepts a status update request that specifies a target, and executes a status update process to update the status of the target specified in the status update request. The status update process includes a process of updating the first information and the second information in an ACID (Atomicity, Consistency, Isolation, Durability) transactional manner, namely, transaction processing. The first information is the first object group for each target. The first object group is one or more first objects. The first object is data representing the status of the target. The second information is the second object group for each target. The second object group is one or more second objects. The transaction processing includes the first processing and the second processing, wherein the first processing is to create, update or clear the first object corresponding to the specified target, and the second processing is to add the second object containing at least one of the content of the first processing and the summary of the first object to the second object group corresponding to the specified target.

[0016] Effects of the Invention

[0017] In addition to achieving update or deletion of data, improvement of searchability, and guarantee of tamper detection, consistency between the first information and the second information can be maintained. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1A An example of a problem.

[0019] Figure 1B An example of a problem.

[0020] Figure 1C An example of a problem.

[0021] Figure 2 An outline of the embodiment is shown.

[0022] Figure 3 An example of the overall configuration of a system according to an embodiment is shown.

[0023] Figure 4 This section shows an example of the configuration of the client system and the node system.

[0024] Figure 5 This section shows an example of the configuration of a Mutable Record Set and a Tamper-evident Record Set.

[0025] Figure 6 The following schematically shows an outline of the status update process.

[0026] Figure 7 A flow showing an example of processing performed in the embodiment. DETAILED DESCRIPTION

[0027] In the following description, an "interface device" includes one or more interfaces. The one or more interfaces can be one or more communication interface devices of the same type (e.g., one or more NICs (Network Interface Cards)) or two or more communication interface devices of different types (e.g., a NIC and an HBA (Host Bus Adapter)).

[0028] In the following description, a "storage device" includes one or more memories. Regarding the storage device, at least one memory may be a volatile memory. The storage device is primarily used during processing by the processor. In addition to memories, the storage device may also include one or more non-volatile storage devices (e.g., HDDs (Hard Disk Drives) or SSDs (Solid State Drives)).

[0029] In the following description, "processor" includes more than one processor. The at least one processor is typically a microprocessor such as a CPU (Central Processing Unit). Each of the at least one processor may be single-core or multi-core. A processor may include some or all of the hardware circuitry that performs processing.

[0030] In addition, in the following description, sometimes the processing is described with "program" as the subject, but the program is executed by the processor, thereby performing the prescribed processing while using a storage device (such as a memory) and / or an interface device (such as a communication port) as appropriate, so the subject of the processing may also be the processor. The processing described with the program as the subject may also be regarded as processing performed by a processor or a device having the processor. In addition, the processor may include a part or all of the hardware circuits that perform the processing (such as an FPGA (Field-Programmable Gate Array) or an ASIC (Application Specific Integrated Circuit)). The program can be installed from a program source to a device such as a computer. The program source may be, for example, a program distribution server or a recording medium that can be read by a computer (such as a non-temporary recording medium). In addition, in the following description, two or more programs may be implemented as one program, and one program may be implemented as two or more programs.

[0031] In addition, in the following description, the expression "yyy unit" is sometimes used to describe a function, and the function can be implemented by a processor executing one or more computer programs, or by one or more hardware circuits (such as FPGA or ASIC), or by a combination thereof. When a function is implemented by executing a program by a processor, the prescribed processing is performed while using a storage device and / or an interface device, etc. as appropriate, so the function can be regarded as at least a part of the processor. The processing described with the function as the subject can be regarded as processing performed by a processor or a device having the processor. The description of each function is an example, and multiple functions can be combined into one function, and one function can be divided into multiple functions.

[0032] In the following description, common symbols among reference symbols may be used when describing similar elements without distinguishing them from each other, and reference symbols may be used when distinguishing similar elements from each other.

[0033] In the following description, a "record" is a logical block of electronic data viewed from a program such as an application, specifically, an example of an object, which is data representing the state of a target. Examples of record data include key-value pairs and tuples.

[0034] In addition, in the following description, the following term definitions are used.

[0035] "Target" is any tangible or intangible object. For example, an account can be used as a "target" and the balance can be used as the target's status.

[0036] A "status update request" is a request for status update processing.

[0037] The "status update process" is a process for updating the status of an object.

[0038] "Mutable Record Set" is an example of the first information.

[0039] "Mutable record" is a record in a Mutable Record Set and is an example of the first object.

[0040] "Tamper-evident Record Set" is an example of the second information.

[0041] "Tamper-evident record" is a record in the Tamper-evident Record Set and is an example of the second object.

[0042] Next, one embodiment of the present invention will be described.

[0043] Figure 2 An outline of the embodiment is shown.

[0044] The data management system 10 receives a state update request specifying a target from the client program 134 and executes a state update process to update the state of the target specified in the state update request. This state update process includes ACID (Atomicity, Consistency, Isolation, Durability) transactional updates to the MutableRecordSet 201 and Tamper-evidentRecordSet 202, known as transactions.

[0045] In this embodiment, data management system 10 is a database, and the aforementioned transactions are transactions within the database. Furthermore, a system other than a database, such as a file system, can also be used as the data management system for storing Mutable Record Set 201 and Tamper-evident Record Set 202. In this case, Mutable Record Set 201 and Tamper-evident Record Set 202 are stored in a single data management system 10, and transactions are performed by that data management system 10. To maintain the consistency of Mutable Record Set 201 and Tamper-evident Record Set 202 and reduce the possibility of tampering, at least one of the following methods can be employed.

[0046] The manager of the Mutable Record Set 201 (eg, an organization such as a company or department) is different from the manager of the Tamper-evident Record Set 202 .

[0047] The Mutable Record Set 201 and the Tamper-evident Record Set 202 exist in geographically different locations.

[0048] Mutable Record Set 201 is a mutable record set for each object. A mutable record set consists of one or more mutable records. A mutable record is data indicating the state of an object.

[0049] Tamper-evident Record Set 202 is a tamper-evident record group for each target. A tamper-evident record group consists of one or more tamper-evident records. For each target, a tamper-evident record group can be equivalent to a ledger. For each target, a tamper-evident record group can be a time series of tamper-evident records. Tamper-evident record tampering detection can be performed using any method (e.g., detection using structure or detection using determinism). In this embodiment, detection using structure is used. Specifically, for example, in this embodiment, Tamper-evident Record Set 202 is a record group that forms a DAG (Directed Acyclic Graph).

[0050] A transaction includes a first process and a second process, wherein the first process is to create, update, or clear a mutable record corresponding to a specified target, and the second process is to append a tamper-evident record containing at least one of the content of the first process and the summary of the first object to the tamper-evidentrecord group corresponding to the above-mentioned specified target.

[0051] Hereinafter, this embodiment will be described in detail.

[0052] Figure 3 An example of the overall system configuration of this embodiment is shown.

[0053] One or more client systems 13A, 13B, ... are communicably connected to the server system 15 via a communication network 19. The server system 15 is composed of one or more node systems 1300A, 1300B, ... .

[0054] Client system 13 executes client program 134. Some client systems 13 (e.g., client system 13A) may also execute user program 124 in addition to client program 134, and some client systems 13 (e.g., client system 13B) may be connected to user system 12 executing user program 124 via communication network 14. User system 12 may be a user's computer (e.g., a personal computer). User program 124 may be a web browser or an application. Communication network 14 and communication network 19 may be integrated.

[0055] The data management system 10 includes a server program 154 executed in the node system 1300. The data management system 10 may include a client program 134 executed in the client systems 13A, 13B, ...

[0056] Figure 4 An example of the configuration of the client system 13 and the node system 1300 is shown.

[0057] The client system 13 includes one or more client computers 130 . The client system 13 may include only one client computer 130 , so one client computer 130 may be one client system 13 .

[0058] The client computer 130 includes an interface device 131 , a storage device 132 , and a processor 133 connected to these devices.

[0059] The interface device 131 is connected to the communication network 19 .

[0060] The storage device 132 stores the client program 134 and client management data 135. The client management data 135 is data managed by the client computer 130. For example, the client management data 135 includes a key 361. The key 361 is a user's key. When the client computer 130 is shared by multiple users (for example, when multiple user systems 12 are connected to the client computer 130 via the communication network 14), the key 361 is stored for each user. Furthermore, the user can be an individual or an organization (for example, a company or financial institution).

[0061] The processor 133 executes the client program 134. By executing the client program 134 in the processor 133, the issuing unit 411 that issues a status update request is realized.

[0062] The node system 1300 includes one or more server computers 150. The server system 15 may include one node system 1300, and the node system 1300 may include one server computer 150, so one server computer 150 may be the server system 15. Therefore, the data management system 10 may be a system including one server program 154 in one server computer 150, and further, may be a system including one client program 134 in one client computer 130.

[0063] The server computer 150 includes an interface device 151 , a storage device 152 , and a processor 153 connected to these devices.

[0064] The interface device 151 is connected to the communication network 19 .

[0065] Storage device 152 stores server program 154 and server management data 155. Server management data 155 is data managed by server computer 150. For example, server management data 155 includes public key 461, Mutable Record Set 201, and Tamper-evident Record Set 202. Mutable Record Set 201 and Tamper-evident Record Set 202 are data stored in data management system 10 and can be distributed across one or more server computers 150.

[0066] Processor 153 executes server program 154. Execution of server program 154 by processor 153 implements a receiving unit 421 that receives status update requests and an executing unit 422 that executes status update processing to update the status of the target specified in the status update request. Server program 154 can function as, for example, a DBMS (Database Management System).

[0067] Figure 5 Shows a configuration example of the Mutable Record Set 201 and the Tamper-evident Record Set 202. Figure 5 In the figure, for simplicity of description, the parts of Mutable Record Set 201 and Tamper-evident Record Set 202 corresponding to one target (key "abc") are shown. However, as mentioned above, both mutable records and tamper-evident records exist for each target.

[0068] A mutable record has an F-output. F-output is the data stored by executing a function and represents the latest state of the target.

[0069] The tamper-evident record includes information such as key 501, age 502, C-input 503, C-output 504, Function 505F, Contract 505C, C-arg 506, nonce 507, Sig 508, Prev-HV 509, and HV 510.

[0070] Key 501 is the target ID. Age 502 indicates the generation of the target's state. Whenever the target's state is updated, a tamper-evident record with an incremented age 502 is added.

[0071] C-input 503 indicates the immediately preceding state of one or more targets, including the target. C-output 504 indicates the content of the processing performed by the execution of the function. For example, if the target is account A and the status update process involves a deposit of X yen from account A (an example of a target) to account B (an example of another target), the C-input 503 and C-output 504 in the tamper-evident record added by this status update process can be as follows.

[0072] C-input 503 represents the immediately preceding balance of each of account A and account B. (C-input 703 enables inter-target (tamper-evident record group) record chaining.)

[0073] C-output 504 indicates the processing content of depositing X yen from account A to account B.

[0074] Function 505F is a reference to a Function (or may be the Function itself). Function is the processing logic (eg, function) that operates the Mutable Record Set 201 .

[0075] Contract 505C is a reference to a contract (or may be the contract itself). Contract is the processing logic for operating the Tamper-evident Record Set 202.

[0076] Functions and contracts can be part of the processing logic of an application in data management system 10. Functions and contracts can be deployed on at least one of user system 12, client system 13, and server system 15. Each function and contract can be assigned an electronic signature. This electronic signature can be an electronic signature using the user's key 361.

[0077] In this embodiment, the processing logic for operating the Mutable Record Set 201 and the processing logic for operating the Tamper-evident Record Set 202 are independent processing logics, but these processing logics can also be defined as one processing logic.

[0078] C-arg 506 is an argument array (one or more arguments) used in the contract.

[0079] Nonce 507 is a nonce corresponding to the latest state of the target (C-output 504). Specifically, nonce 507 is a nonce associated with the state update request of the state update process that obtained the latest state.

[0080] Sig 508 is an electronic signature using the private key 361 of the user who issued the status update request. In this embodiment, Sig 508 is an electronic signature for the information set including Function 505F, Contract 505C, and C-arg 506. This information set may include other information such as nonce 507.

[0081] Prev-HV 509 is the same value as HV 510 of the target's immediately previous generation tamper-evident record (i.e., the parent tamper-evident record). In other words, the link between Prev-HV 509 and HV 510 in the parent tamper-evident record completes the record chain in the tamper-evident record group corresponding to the target.

[0082] HV 510 is a summary of the target tamper-evident record, for example, a hash value (cryptographically unlikely to cause collision) of at least a portion of information other than HV 510 (all information 501 to 509 in this embodiment).

[0083] As described above, in Tamper-evident Record Set 202, record chains are implemented between C-inputs 503 in different tamper-evident record groups. Furthermore, record chains are implemented between tamper-evident records in the same tamper-evident record group (between Prev-HV 509 and HV 510). In this way, Tamper-evident Record Set 202 forms a DAG structure. In Tamper-evident Record Set 202, nodes are tamper-evident records, and edges represent relationships between tamper-evident records in one or more status update processes.

[0084] Figure 6 The status update process is schematically shown.

[0085] To simplify the description, we take a target (key "abc") as an example. In the following description, C-output i is the C-output of Age "i" (i is an integer from 0 to N). Similarly, the element "AAA" corresponding to Age "i" is expressed as "AAA i ”.

[0086] The contract and function are pre-deployed to the server system 15 (or a system external to the server system 15). Each contract and function is electronically signed. Therefore, tampering detection is possible for both contracts and functions. The status update request specifies a reference to the deployed contract and function.

[0087] Can be expressed as C-output i =Contract i (C-input i ,C-arg i ). That is, C-output i is using C-input i , and C-arg i To execute the contract i The resulting state. In the case of i = 0, C-output iIt is in an empty state, so it can detect tampering of C-output0. C-arg1 can use Sig1 to detect tampering, and it can also detect tampering of Cotarct1, so it can also detect tampering of C-output1 (tampering of Cotarct1's reference can be detected using Sig1, and tampering of Cotarct1 itself can be detected using the electronic signature for Cotarct1 itself). Similarly, to C-output i Tampering detection can be achieved for i=2~N.

[0088] Similarly, it can be expressed as F-outoput i =Function i (F-outoput i－1 ,F-arg i ,C-arg i ). C-arg i Contains HV_F-arg i (F-arg i hash value), using C-arg i To conduct F-arg i Detection of tampering.

[0089] Depending on the application, it can be expressed as C-output i =Contract i (C-arg i ), can also be expressed as F-outoput i =Function i (F-arg i ,C-arg i ). For example, C-output i A summary of the latest status of the target.

[0090] Like C-arg i and F-arg i The reason for separating the arguments is as follows. i Stored in tamper-evidentrecord, if C-arg i If data requiring erasure (eg, private data) is included in the data, the data requiring erasure is stored in a tamper-evident record. As a result, it is difficult to erase the data requiring erasure.

[0091] Therefore, the arguments are separated into C-arg i and F-arg i , and HV_F-arg i (F-argi The hash value of the C-arg i In this way, F-arg is detected i HV_F-arg i F-arg i An example of an overview.

[0092] Take i=3 as an example, refer to Figure 6 The status update process is described. Figure 6 tamper-evidentrecord i Prev-HV i With tamper-evident record i－1 HV i－1 same.

[0093] The issuing unit 411 (client program 134) issues the state update request 3 specifying the target, and the accepting unit 421 (server program 154) accepts the state update request 3. The state update request 3 includes a reference to Contract 3, C-arg3, a reference to Function 3, F-arg3, and Sig3.

[0094] Sig3 is the electronic signature for references to Contract3, C-arg3, and Function3. Therefore, Sig3 can be used to detect tampering of references to Contract3, C-arg3, and Function3. As mentioned above, F-arg3 does not have an electronic signature.

[0095] The execution unit 422 (server program 154) executes a state update process for updating the state of the target specified in the state update request 3. The state update process includes a first tampering detection process, a second tampering detection process, and a DB transaction process.

[0096] The first tampering detection process uses Sig3 to detect tampering of references to Contract3, C-arg3, and Function3. Since C-arg3 includes HV_F-arg3, the first tampering detection process includes detecting tampering of HV_F-arg3. If no tampering is detected in the first tampering detection process, the second tampering detection process is performed.

[0097] The second tampering detection process is a process of detecting tampering of F-arg3 using HV_F-arg3 in C-arg3. The second tampering detection process includes calculating a hash value of F-arg3 and comparing the calculated hash value with HV_F-arg3. iIf the calculated hash value is different from HV_F-arg3, F-arg is detected. i of tampering.

[0098] The transaction processing of the DB includes the processing of performing ACID transactional updates on the Mutable Record Set 201 and the Tamper-evident Record Set 202 , and specifically includes the following processing.

[0099] Execution of Function3, i.e., using F-arg3 to create, read, update, or delete the mutable record corresponding to the target specified in Status Update Request3.

[0100] Contract 3 is executed, that is, a new tamper-evident record is created using C-arg3 and appended to Tamper-evident Record Set 202. (During Contract 3 execution, a tamper-evident record can be read instead of or in addition to creating Tamper-evident Record Set 202.) The appended tamper-evident record includes a reference to Contract 3, C-arg3, a reference to Function 3, Sig3, Prev-HV3 (the same hash value as HV2), and HV3 (a hash value of the information set including a reference to Contract 3, C-arg3, a reference to Function 3, Sig3, and Prev-HV3).

[0101] Figure 7 A flow showing an example of processing performed in the embodiment.

[0102] The issuing unit 411 (client program 134) creates a contract i Reference, C-arg i 、Function i Reference, F-arg i and Sig i Status update request i (S701). Sig i It is for Contract i Reference, C-arg i and Function iThe electronic signature of the reference is created using the user's key 361.

[0103] The issuing unit 411 sends the status update request generated in S701 i (S702).

[0104] The receiving unit 421 (server program 154) receives the status update request i (S711) The execution unit 422 (server program 154) performs the first tampering detection process (S712). The first tampering detection process is to use the state update request i Sig i To detect status update requests i Contract i Reference, C-arg i and Function i In this process, the user's public key 461 can be used. In the case where tampering is detected in S712 (S712: Yes), for example, the execution unit 422 returns an error as a response to the status update request. i Response and end the processing.

[0105] If no tampering is detected in S712 (S712: No), the execution unit 422 performs the second tampering detection process (S713). The second tampering detection process is to calculate F-arg i The hash value and the calculated hash value with C-arg i HV_F-arg within i Compare and detect F-arg i When F-arg is detected i In the case of tampering (S713: Yes), for example, the execution unit 422 abandons the transaction (S718).

[0106] F-arg not detected in S713 i If the database is tampered with (S713: No), the execution unit 422 starts the transaction processing of the DB (S714). For example, the execution unit 422 executes Begin.

[0107] The execution unit 422 executes Function i (S715). i During the execution of i To create, read, update, or delete mutable records.

[0108] The execution unit 422 executes the Contract i(S716). i During the execution of the C-arg i To create a new tamper-evident record and append the new tamper-evident record to the Tamper-evident Record Set 202 (read can also be performed instead of create).

[0109] The execution unit 422 ends the transaction processing (S717). For example, the execution unit 422 executes Commit.

[0110] exist Figure 7 In the description of , at least one of the following can be adopted.

[0111] At least one of the first tampering detection process and the second tampering detection process may be performed during the period from the start to the end of the transaction.

[0112] Contract i The execution can precede the Function i is carried out for the execution of .

[0113] · Expressions other than Begin and Commit can be used to indicate the start and end of a transaction.

[0114] Status update request i and tamper-evident record i In the HV_F-arg i Can be in C-arg i In addition to Sig i In addition, there may be a i electronic signature.

[0115] As described above, according to this embodiment, Mutable Record Set 201 and Tamper-evident Record Set 202 are updated using ACID transactions. This allows for data updates and deletions, improved retrieval, and guaranteed tamper detection, while also maintaining consistency between Mutable Record Set 201 and Tamper-evident Record Set 202.

[0116] Furthermore, according to this embodiment, the state represented by the cleared mutable record (e.g., private data requested to be cleared) is difficult to restore from either Mutable Record Set 201 or Tamper-evident Record Set 202. This is because the cleared mutable record does not exist in Mutable Record Set 201, and although Tamper-evident Record Set 202 contains the hash value of F-arg, namely HV_F-arg, it is difficult to determine F-arg based on HV_F-arg.

[0117] Furthermore, according to this embodiment, the status update request i There is no F-arg i Electronic signature, but C-arg i Contains HV_F-arg i And there are C-arg i Sig i , so it can detect F-arg i of tampering.

[0118] Although one embodiment has been described above, these are examples for explaining the present invention and are not intended to limit the scope of the present invention to these embodiments. The present invention can also be implemented in various other forms.

[0119] Explanation of symbols

[0120] 10…data management system.

Claims

1. A data management system, characterized in that: have: an accepting unit that accepts a status update request specifying a target; and an execution unit configured to execute a state update process for updating the state of the target specified in the state update request; The state update process includes ACID transactional update of the first information and the second information, i.e., transaction processing, where ACID refers to atomicity, consistency, isolation, and persistence. The first information is a first target object group, The first object group is one or more first objects, The first object is data representing the state of the target. The second information is a second target object group, The second object group is one or more second objects, The transaction processing includes the first processing and the second processing, The first process is to create, update or clear a first object corresponding to the designated target. The second process is to add a second object including at least one of the content of the first process and the outline of the first object to a second object group corresponding to the designated target. The status update request includes: The one or more arguments used in the first process are the first argument group; The summary of the first index group is the index group summary; and an electronic signature for the primer set summary; The execution unit performs a first tampering detection process and a second tampering detection process, The first tampering detection process is to detect whether the index group summary has been tampered with using the electronic signature. The second tampering detection process is to detect whether the first index group has been tampered with using the index group profile when no tampering has been detected in the first tampering detection process. The summary is a hash value.

2. The data management system according to claim 1, characterized in that: The first information and the second information are information contained in a database. The transaction processing is the transaction processing of the database.

3. A data management method, characterized in that: The data management system accepts status update requests with specified targets, The status update request includes: One or more arguments used in the first process is the first argument group; The summary of the first index group is the index group summary; and an electronic signature for the primer set summary; The first process is to create, update or clear a first object corresponding to the designated target. The data management system performs a first tampering detection process to detect whether the index group summary has been tampered with using the electronic signature. The data management system performs a second tampering detection process for detecting whether or not the first index group has been tampered with using the index group profile when no tampering has been detected in the first tampering detection process. The data management system executes a status update process to update the status of the target specified in the status update request, The state update process includes ACID transactional update of the first information and the second information, i.e., transaction processing, where ACID refers to atomicity, consistency, isolation, and persistence. The first information is a first target object group, The first object group is one or more first objects, The first object is data representing the state of the target. The second information is a second target object group, The second object group is one or more second objects, The transaction processing includes the first processing and the second processing, The second process is to add a second object including at least one of the content of the first process and the outline of the first object to a second object group corresponding to the designated target. The summary is a hash value.

4. A computer program, characterized in that Instruct the computer to perform the following actions: Accepts status update requests with a specified target. The status update request includes: One or more arguments used in the first process is the first argument group; The summary of the first index group is the index group summary; and an electronic signature for the primer set summary; The first process is to create, update or clear a first object corresponding to the designated target. performing a first tampering detection process of detecting whether or not the index group summary has been tampered with using the electronic signature, performing a second tampering detection process of detecting whether or not the first index group has been tampered with using the index group profile when no tampering has been detected in the first tampering detection process; Executing a status update process to update the status of the target specified in the status update request; The state update process includes ACID transactional update of the first information and the second information, i.e., transaction processing, where ACID refers to atomicity, consistency, isolation, and persistence. The first information is a first target object group, The first object group is one or more first objects, The first object is data representing the state of the target. The second information is a second target object group, The second object group is one or more second objects, The transaction processing includes the first processing and the second processing, The second process is to add a second object including at least one of the content of the first process and the outline of the first object to a second object group corresponding to the designated target. The summary is a hash value.

Images