Memory protection apparatus, memory protection system, memory protection method, and program

Abstract

To provide a memory protection apparatus capable of efficiently recovering a tree structure even if a counter is compressed.SOLUTION: Input means inputs information about a tree structure. Checksum acquisition means acquires a first checksum calculated by a first calculation method based on a leaf node counter compressed by sharing a portion of the counter among a plurality of leaf nodes and stored in a secure first area. Leaf node verification means compares a second checksum calculated by the first calculation method based on the leaf node counter with the first checksum to verify the checksum, and verifies a tag related to the leaf node. The leaf node verification means verifies whether or not the leaf node has been tampered with when a crash occurs in memory.SELECTED DRAWING: Figure 15

Description

[Technical Field]

[0001] The present disclosure relates to a memory protection device, a memory protection system, a memory protection method, and a program. [Background technology]

[0002] In recent years, with a variety of devices connected to networks, memory protection technology has become important, such as detecting tampering and concealing data stored in devices. In relation to this technology, Non-Patent Document 1 discloses a technology that can achieve crash consistency for memory protection in a tree structure in which the target memory is used as a leaf node and each node can be updated in parallel.

[0003] Furthermore, in order to reduce memory size, a technique has been proposed for compressing counters related to tree-structured nodes to reduce the data size of the counters. Non-Patent Document 2 discloses an example of a method for compressing counters related to tree-structured nodes. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Jianming Huang and Yu Hua, "Root Crash Consistency of SGX-style Integrity Trees in Secure Non-Volatile Memory Systems", 2023 IEEE International Symposium on High-Performance Computer Architecture (HPCA), URL: https: / / ieeexplore.ieee.org / document / 10071003 [Non-patent document 2] Gururaj Saileshwar, Prashant J. Nair, Prakash Ramrakhyani, Wendy Elsasser, Jose A. Joao and Moinuddin K. Qureshi, "Morphable Counters: Enabling Compact Integrity Trees For Low-Overhead Secure Memories", 2018 51st Annual IEEE / ACM International Symposium on Microarchitecture, URL: https: / / ieeexplore.ieee.org / document / 8574558 Summary of the Invention [Problem to be solved by the invention]

[0005] The technology disclosed in Non-Patent Document 1 cannot be applied when the counters for the nodes of the tree structure are compressed. Therefore, it is difficult for the technology disclosed in Non-Patent Document 1 to efficiently recover the tree structure when the counters are compressed. Therefore, it is desirable to efficiently recover a tree structure that can be updated in parallel for multiple nodes, even when the counters are compressed.

[0006] The object of the present disclosure has been made to solve such problems, and is to provide a memory protection device, a memory protection system, a memory protection method, and a program that can efficiently restore a tree structure in a configuration that uses a tree structure for memory protection, even if the counters are compressed. [Means for solving the problem]

[0007] The memory protection device according to the present disclosure includes an input means for inputting information relating to a tree structure configured to protect memory, the tree structure being capable of updating each node in the tree structure in parallel, the information including a counter that is updated at least each time the node information is updated; a checksum acquisition means for acquiring a first checksum, which is a leaf node counter relating to a leaf node in the tree structure, calculated by a first calculation method in which different checksums are calculated for different leaf node counters based on compressed leaf node counters in which a portion of the counter is shared among a plurality of the leaf nodes, and stored in a secure first area; and a leaf node verification means for calculating a second checksum based on the leaf node counter by the first calculation method, comparing the first checksum with the second checksum to verify the checksum, and verifying a tag relating to the leaf node, thereby verifying whether the leaf node has been tampered with when a memory crash occurs.

[0008] The memory protection system according to the present disclosure comprises: a memory structure initialization device that receives plain text for which tampering detection is desired as input and outputs a tree structure that is at least an initial tree structure configured to protect memory and that allows each node of the tree structure to be updated in parallel; a memory verification device that receives at least a storage location of plain text for which tampering is desired and the tree structure as input and verifies whether or not the memory corresponding to the storage location has been tampered with; a memory update device that receives at least a storage location of plain text for which tampering is desired to be updated, the update content, and the tree structure as input and outputs the updated tree structure or an error message indicating that tampering has been detected; and a memory protection device that performs processing to protect memory when a crash occurs in the memory, wherein the memory update device comprises a first input means for inputting information about the tree structure, the information including a counter that is updated at least each time information about a node is updated; and a leaf node counter that is a counter related to a leaf node in the tree structure and that is configured to update a plurality of the leaf nodes. The memory protection device has a checksum calculation means that calculates a first checksum using a first calculation method, which is a calculation method in which a different checksum is calculated for a different leaf node counter each time the leaf node is updated, based on a leaf node counter that has been compressed by sharing a portion of the counter among the nodes, and a checksum storage means that stores the first checksum in a secure first area.The memory protection device has a second input means that inputs information about the tree structure, a checksum acquisition means that acquires the first checksum stored in the first area, and a leaf node verification means that calculates a second checksum using the first calculation method based on the leaf node counter, compares the first checksum with the second checksum to verify the checksum, and verifies a tag related to the leaf node, thereby verifying whether the leaf node has been tampered with when a memory crash occurs.

[0009] The memory protection method of the present disclosure inputs information about a tree structure configured to protect memory, the tree structure being capable of updating each node in the tree structure in parallel, the information including a counter that is updated at least each time the node information is updated; acquires a first checksum calculated by a first calculation method, which is a leaf node counter related to a leaf node in the tree structure, and which is a calculation method in which different checksums are calculated for different leaf node counters based on compressed leaf node counters in which a portion of the counter is shared among multiple leaf nodes, and stored in a secure first area; calculates a second checksum based on the leaf node counter by the first calculation method, compares the first checksum with the second checksum to verify the checksum; and verifies a tag related to the leaf node, thereby verifying whether the leaf node has been tampered with when a memory crash occurs.

[0010] The program disclosed herein causes a computer to execute the following steps: inputting information about a tree structure configured to protect memory, the tree structure being capable of updating each node in the tree structure in parallel, the information including a counter that is updated at least each time the node information is updated; acquiring a first checksum calculated by a first calculation method, which is a leaf node counter related to a leaf node in the tree structure, and which is a calculation method in which different checksums are calculated for different leaf node counters based on compressed leaf node counters in which a portion of the counter is shared among multiple leaf nodes, and stored in a secure first area; calculating a second checksum based on the leaf node counter by the first calculation method, comparing the first checksum with the second checksum to verify the checksum, and verifying a tag related to the leaf node, thereby verifying whether the leaf node has been tampered with when a memory crash occurs. [Effects of the Invention]

[0011] According to the present disclosure, in a configuration that uses a tree structure for memory protection, it is possible to provide a memory protection device, a memory protection system, a memory protection method, and a program that can efficiently restore the tree structure even when the counter is compressed. [Brief explanation of the drawings]

[0012] [Figure 1] FIG. 10 is a diagram for explaining a Split Counter according to the present disclosure. [Figure 2] 1 is a block diagram illustrating an example configuration of a memory protection system according to the present disclosure. [Figure 3] 1 is a block diagram illustrating a configuration example of a memory structure initialization device according to the present disclosure. [Figure 4] 1 is a block diagram illustrating an example configuration of a memory verification device according to the present disclosure. [Figure 5] 1 is a block diagram illustrating a configuration example of a memory update device according to the present disclosure. [Figure 6] 1 is a block diagram illustrating an example configuration of a memory protection device according to the present disclosure. [Figure 7] 1 is a block diagram illustrating an example configuration of a memory protection device according to the present disclosure. [Figure 8] 1 is a block diagram illustrating an example configuration of a memory protection device according to the present disclosure. [Figure 9] 10 is a flowchart illustrating an example of a processing procedure of the memory structure initialization device according to the present disclosure. [Figure 10] 10 is a flowchart illustrating an example of a processing procedure of a memory verification device according to the present disclosure. [Figure 11] 10 is a flowchart illustrating an example of a processing procedure of a memory update device according to the present disclosure. [Figure 12] 10 is a flowchart illustrating an example of a processing procedure of a memory protection device according to the present disclosure. [Figure 13] FIG. 2 is a diagram illustrating an example of a tree structure configured by a memory protection system according to the present disclosure. [Figure 14] 10A and 10B are diagrams illustrating an example of a path generated by a tag verification unit in the memory verification device according to the present disclosure. [Figure 15] 1 is a diagram illustrating a configuration of a memory protection device according to the present disclosure. [Figure 16] 1 is a flowchart illustrating a memory protection method executed by a memory protection device according to the present disclosure. [Figure 17] 1 is a block diagram illustrating an example of a hardware configuration of a computing device capable of realizing an apparatus and system according to the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0013] (Outline of this embodiment) Prior to describing the present embodiment, an overview of the present embodiment will be described. Note that, although embodiments of the present disclosure will be described below, the following embodiments do not limit the invention according to the claims. Furthermore, not all combinations of features described in the embodiments are necessarily essential to the solution of the invention. Furthermore, the indexes (alphabetical letters) used in the following description are not necessarily common throughout this specification. Furthermore, the present embodiment will be described below using drawings, but please note that each drawing used in describing each embodiment does not apply only to that embodiment. In other words, each drawing can be applied to all embodiments.

[0014] With the increasing number of devices connected to the network, such as IoT (Internet of Things) devices, attacks on devices can potentially lead to larger-scale attacks by using the devices as springboards to launch attacks across the network. Therefore, memory protection technologies, such as tamper detection and concealment of data stored on devices, are important for maintaining the security of not only the devices themselves but also the networks connected to them.

[0015] In addition, the demand for non-volatile memory has been increasing in recent years, and memory protection technology is becoming even more important due to the increased possibility that memory is exposed to attacks even when power is cut off. Meanwhile, with the recent increase in memory capacity, memory protection technology is required to efficiently detect tampering only with the accessed portion when accessing a small portion of large data.

[0016] Furthermore, memory protection technology assumes two areas in memory: on-chip and off-chip. On-chip is a secure area. Therefore, it is impossible for an attacker to eavesdrop on or tamper with data stored on-chip. On the other hand, off-chip is an insecure area. Therefore, it is possible for an attacker to eavesdrop on or tamper with data stored off-chip. For example, on-chip is realized by memory in a CPU (Central Processing Unit), while off-chip is realized by a main memory device or auxiliary memory device. However, since the cost of realizing on-chip is overwhelmingly higher than that of off-chip, there is a challenge to detect tampering of a portion of large-scale data using fewer on-chip devices.

[0017] An example of a memory protection technology that solves this problem is the technology disclosed in Non-Patent Document 1. As described above, in the technology disclosed in Non-Patent Document 1, a tree structure is constructed in which the target memory is a leaf node for memory protection. Here, elemental technologies used in constructing the tree structure include a message authentication code (MAC) and authenticated encryption (AE).

[0018] Message Authentication Code (MAC) is a technology that uses a secret key shared in advance between two communicating parties to calculate an authentication tag for plaintext messages to detect tampering. Applying MAC to the communication channel makes it possible to detect unauthorized tampering of plaintext messages. In memory protection technology using a tree structure, storing the secret key on-chip and storing the plaintext message and authentication tag off-chip makes it possible to detect tampering of plaintext messages.

[0019] Authenticated encryption (AE) is a technology that encrypts plaintext messages and calculates authentication tags for tamper detection using a secret key shared in advance between two communicating parties. Applying authenticated encryption to a communication channel makes it possible to conceal the contents against eavesdropping and detect unauthorized tampering of ciphertext, resulting in strong protection of the communication contents. In memory protection technology using a tree structure, similar to MAC, the secret key is stored on-chip and the ciphertext and authentication tag are stored off-chip, thereby enabling the concealment of plaintext messages and the detection of tampering.

[0020] In a case where a tree structure in which each node can be updated in parallel is stored in a nonvolatile memory, the question is whether information on higher-level nodes other than the leaf nodes can be recovered if the memory crashes due to an unexpected power outage or the like. In other words, the question is whether crash consistency can be achieved. Here, "crash consistency" means that data before the crash can be restored when a crash occurs. If a crash occurs due to an attacker, the attacker can launch attacks (eavestruck, tampering, replay attacks, etc.) on off-chip data during the crash. Under such circumstances, consider a case where a crash occurs when information on a leaf node is updated and information on the higher-level nodes of the leaf node is updated accordingly, resulting in information on some higher-level nodes not being updated. In this case, it is difficult to determine whether the information that has not been updated is simply not updated or has been tampered with by an attack. Therefore, the information on the nodes that have not been updated and their related nodes is lost.

[0021] In contrast to this, the technology disclosed in Non-Patent Document 1 makes it possible to determine whether or not information in a leaf node has been tampered with when a crash occurs, as will be described later. Therefore, the technology disclosed in Non-Patent Document 1 can achieve crash consistency.

[0022] In a tree structure in which each node can be updated in parallel, the information for each node includes a counter that is updated every time the node is updated. As will be described later, the technology disclosed in Non-Patent Document 1 uses a simple up-counter that is incremented by +1 every time a node is updated to determine whether or not the information in a leaf node has been tampered with in the event of a crash.

[0023] Here, a method of compressing counters has been proposed to reduce the size of tree-structured off-chip data. By compressing counters to reduce the size of off-chip data, the amount of communication between memory and the CPU can be reduced, and processing can be sped up. Examples of counter compression methods include Split Counter and Morphable Counter, which is described in Non-Patent Document 2. In these counter compression methods, counters are compressed by sharing part of the counter among multiple nodes.

[0024] FIG. 1 is a diagram illustrating a Split Counter according to the present disclosure. FIG. 1 shows an example in which a portion of a counter is shared by eight nodes. For example, when the tree structure is an octree, a portion of the counter may be shared by eight leaf nodes whose parent nodes are the same. In the example of FIG. 1, the counter of each node has 64 bits, and the upper 56 bits are shared by the eight nodes. Note that in a Split Counter, the number of nodes that share a portion of a counter is not limited to eight. Also, the counter of each node is not limited to 64 bits. Also, the portion of the counter shared by multiple nodes is not limited to 56 bits.

[0025] In the example of Figure 1, the major counter (Mctr) is part of the counter shared by multiple nodes (8 nodes). Also, the minor counter (mctr) is part of the counter for each node that is not shared by multiple nodes. mctr(i) is the minor counter for node i. Note that in the example of Figure 1, i = 1,...,8. The concatenation of the major counter Mctr and the minor counter mctr(i) is the local counter for node i. If the concatenation is represented as "||", the counter for node i (local counter) is represented as Mctr||mctr(i).

[0026] As described above, if the counter of each node has 64 bits and the upper 56 bits are shared by eight nodes, the major counter Mctr has 56 bits and the minor counter mctr(i) has 8 bits. Since the major counter Mctr is shared, the number of bits of data corresponding to the counters of the eight nodes is 56 + 8 * 8 = 120 bits. On the other hand, if the counters are simple up-counters that are not compressed, that is, if the counters are not split counters, the total number of bits of data corresponding to the counters of the eight nodes is 64 * 8 = 512 bits. Therefore, by using split counters as counters, the amount of data corresponding to the counters of multiple nodes can be reduced.

[0027] In Split Counter, when each node is updated, the minor counter for the node being updated is incremented by one. When one of the multiple nodes runs out of minor counters, that is, when the minor counter of one of the nodes reaches its maximum value (2^8 if the bit length of the minor counter is 8 bits), the major counter is incremented by one. In this case, the minor counters of all nodes are initialized (reset) to 0. This is called an "overflow."

[0028] Here, the technology disclosed in Non-Patent Document 1 uses a simple up-counter to determine whether leaf node information has been tampered with when a crash occurs. Therefore, as will be described later, the technology disclosed in Non-Patent Document 1 makes it difficult to efficiently recover a tree structure when the counter is compressed. In contrast, the system disclosed in this embodiment calculates a checksum S using a predetermined first calculation method based on the compressed leaf node counter (leaf node counter) and stores the checksum S in a secure first area. Then, when a memory crash occurs, the system disclosed in this embodiment verifies the leaf node using the checksum S stored in the first area. As a result, this embodiment makes it possible to efficiently recover a tree structure that can be updated in parallel for multiple nodes, even when the counter is compressed. This will be described in more detail later.

[0029] (First embodiment) Hereinafter, embodiments will be described with reference to the drawings. For clarity of explanation, the following description and drawings have been omitted and simplified as appropriate. In addition, in each drawing, the same elements are given the same reference numerals, and duplicate explanations are omitted as necessary. Note that the configuration of the first embodiment corresponds to an improved version of the configuration of Non-Patent Document 1 mentioned above.

[0030] In the first embodiment, an example will be described in which the tree structure configured in the memory protection system has a branch count of b and a depth of d. The depth of the root node is defined as 0, and the depth of the leaf node is defined as d. Therefore, the number of leaf nodes in the first embodiment is b^d. In this system, it is assumed that the number of nodes and the amount of data in each node are predetermined. Here, a "node" corresponds to each element that configures the tree structure. A "root node" is the node with the shallowest depth in the tree structure. A "leaf node" is the node with the deepest depth in the tree structure. Nodes other than the "root node" and "leaf nodes" are referred to as "intermediate nodes." Nodes above the leaf nodes (intermediate nodes and root node) are referred to as upper nodes. Below, an example in which the branch count b is 2 will be described as appropriate.

[0031] FIG. 2 is a block diagram showing an example configuration of a memory protection system 1 according to the present disclosure. The memory protection system 1 is, for example, a computer. Therefore, the memory protection system 1 functions as an information processing system. Note that the memory protection system 1 may implement each of the components shown in FIG. 2 by executing a software program on a central processing unit. Furthermore, each of the components implemented in the memory protection system 1 may be implemented as an individual device, a functional unit, or an electronic circuit. This also applies to other embodiments described below.

[0032] As shown in Figure 2, the memory protection system 1 includes a memory structure initialization device 10, a memory verification device 20, a memory update device 30, and a memory protection device 40. The memory structure initialization device 10, the memory verification device 20, the memory update device 30, and the memory protection device 40 may be physically integrated or may be separate. Furthermore, the components of each device, which will be described later with reference to Figures 3 to 8, may be realized by separate devices. The memory protection system 1 detects memory tampering and recovers the tree structure when a crash occurs.

[0033] FIG. 3 is a block diagram showing an example configuration of a memory structure initialization device 10 according to the present disclosure. FIG. 4 is a block diagram showing an example configuration of a memory verification device 20 according to the present disclosure. FIG. 5 is a block diagram showing an example configuration of a memory update device 30 according to the present disclosure. FIGS. 6 to 8 are block diagrams showing an example configuration of a memory protection device 40 according to the present disclosure. FIG. 9 is a flowchart showing an example processing procedure of the memory structure initialization device 10 according to the present disclosure. FIG. 10 is a flowchart showing an example processing procedure of the memory verification device 20 according to the present disclosure. FIG. 11 is a flowchart showing an example processing procedure of the memory update device 30 according to the present disclosure. FIG. 12 is a flowchart showing an example processing procedure of the memory protection device 40 according to the present disclosure. FIGS. 3 to 12 will be described later.

[0034] The memory protection system 1 detects and conceals memory tampering. In the memory protection system 1, a memory structure initialization device 10 receives plaintext (plaintext message) for which tampering detection is desired as input, and outputs an initial tree structure and a set of memory addresses for each node in the tree structure. Here, if the number of branches b of the tree structure is 2, the plaintext can be expressed as a combination of 2^d plaintext blocks. In other words, the following formula 1 holds: (Formula 1) M=M[1]||M[2]||···||M[2^d] Here, M denotes the plaintext, and M[k] denotes the kth plaintext block. As mentioned above, "||" denotes concatenation. One plaintext block is defined as Block bits.

[0035] The memory verification device 20 receives as input the storage location of the ciphertext (ciphertext block) to be checked for tampering, a tree structure, and the memory addresses of each node in the tree structure, and verifies whether the memory has been tampered with. The memory update device 30 receives as input the storage location of the ciphertext (ciphertext block) to be updated, the update details, the tree structure, and the memory addresses of each node in the tree structure. The memory update device 30 then outputs the updated tree structure or an error message indicating that tampering has been detected.

[0036] Fig. 13 is a diagram showing an example of a tree structure configured by the memory protection system 1 according to the present disclosure. Fig. 13 shows a tree structure in the case where the number of branches b = 2 and the depth d = 3. Note that Root, Inter, and Leaf will be described later.

[0037] Furthermore, the memory protection system 1 uses, as its elemental technologies, a message authentication code (MAC) with specific properties, as described below, and authenticated encryption (AE). Here, a basic MAC will be described. A MAC function MAC_K using a secret key K takes a nonce N and plaintext M as input, and outputs an authentication tag Tag. In other words, the memory protection system 1 performs the calculation expressed by the following equation 2. (Formula 2) MAC_K(N,M)=Tag

[0038] Furthermore, the memory protection system 1 calculates MAC_K(N', M') for the nonce N', plaintext M', and authentication tag Tag' to be verified, and verifies whether the calculation result matches Tag'. If they match, it is determined that the nonce N' and plaintext M' have not been tampered with, and if they do not match, it is determined that they have been tampered with. In other words, the memory protection system 1 performs the calculation expressed by the following equation 3. (Formula 3) MAC_K(N',M')=Tag'' The memory protection system 1 can determine that no tampering has occurred if Tag''=Tag', and that tampering has occurred if Tag''≠Tag'.

[0039] Furthermore, AE using private key K is defined by two functions: encryption function AE.Enc_K and decryption function AE.Dec_K, which is the counterpart of encryption function AE.Enc_K. AE.Enc_K takes nonce N and plaintext M as input, and outputs ciphertext C and authentication tag Tag. The encryption function can be written as equation 4 below. (Formula 4) AE.Enc_K(N,M)=(C,T)

[0040] AE.Dec_K takes three inputs: nonce N, ciphertext C, and authentication tag, and outputs the decrypted plaintext M if no tampering is detected, or an error message ⊥ if tampering is detected. This can be expressed as equation 5 below. (Formula 5) AE.Dec_K(N,C,T)=M (if no tampering is detected) AE.Dec_K(N,C,T)=⊥(if tampering is detected)

[0041] [Explanation of the configuration of the memory structure initialization device] The memory structure initialization device 10 according to the first embodiment includes a plaintext input unit 100, a memory address allocation unit 101, and a tag generation unit 102. The memory structure initialization device 10 according to the first embodiment also includes a leaf node generation unit 103, an intermediate node generation unit 104, a root node generation unit 105, a tree structure output unit 106, a memory address output unit 107, and a checksum storage area generation unit 110.

[0042] The plaintext input unit 100 functions as a plaintext input means. The memory address allocation unit 101 functions as a memory address allocation means. The tag generation unit 102 functions as a tag generation means. The leaf node generation unit 103 functions as a leaf node generation means. The intermediate node generation unit 104 functions as an intermediate node generation means. The root node generation unit 105 functions as a root node generation means. The tree structure output unit 106 functions as a tree structure output means. The memory address output unit 107 functions as a memory address output means. The checksum storage area generation unit 110 functions as a checksum storage area generation means.

[0043] The memory structure initialization device 10 is, for example, a computer. The memory structure initialization device 10 may implement each of the components shown in FIG. 3 by executing a software program in a central processing unit. Each of the components implemented in the memory structure initialization device 10 may be implemented as an individual device, a functional unit, or an electronic circuit. This also applies to other embodiments described later.

[0044] The plaintext input unit 100 accepts input of plaintext M to be protected. The plaintext input unit 100 outputs the accepted plaintext M to the tag generation unit 102. Here, the method by which the plaintext input unit 100 accepts input of plaintext M is not limited to a specific method. For example, the plaintext input unit 100 may be provided with a character input device such as a keyboard and accept a user operation to input plaintext M. Alternatively, the plaintext input unit 100 may receive plaintext M from another device.

[0045] The memory address allocation unit 101 allocates node-specific memory address information to each node in the tree structure. The memory address allocation unit 101 then outputs the memory address information to the tag generation unit 102 and the memory address output unit 107. Here, since the number of nodes and the amount of data in each node are predetermined, it is possible to allocate a memory address to each node before defining the content information of each node. Furthermore, by its nature, the memory address information is uniquely determined for each node. In other words, the memory address information is specific to each node. This makes it possible to prevent data swapping attacks between nodes.

[0046] Here, when 1<=i<=d, 1<=j_i<=2^{i}, the memory address assigned to the j_ith node at depth i is expressed as add(i,j_i).The memory address information assigned to all nodes in the tree structure is written as the memory address set Add as shown in the following equation 6. (Formula 6) Add=(add(0,1),add(1,1),add(1,2),add(2,1),add(2,2),...,add(d,2^{d-1}),add(d,2^d))

[0047] Here, "add(0,1)" corresponds to the memory address of the root node, and "add(d,1),...,add(d,2^d)" correspond to the memory addresses of multiple leaf nodes. The others correspond to the memory addresses of intermediate nodes.

[0048] Furthermore, when a memory address is written as add(a, b), a indicates the depth in the tree structure of the node to which that memory address is assigned. Furthermore, b indicates the order (ordinal number) of the node to which that memory address is assigned at depth a. This also applies to the tag notation Tag(a, b), which will be described later.

[0049] The tag generation unit 102 generates tags and ciphertext for tamper detection using the plaintext M output by the plaintext input unit 100, the memory address set Add output by the memory address allocation unit 101, and secret keys K_1 and K_2. It is assumed that MAC is used to generate tags for intermediate nodes and the root node, and authenticated encryption (AE) is used to encrypt the plaintext (leaf nodes) and generate tags.

[0050] First, the tag generating unit 102 generates data expressed by the following formula 7 as the ciphertext and tag to be used in the leaf node. (Formula 7) TagLeaf=((C[1],Tag(d,1)),(C[2],Tag(d,2)),···,(C[2^d],Tag(d,2^d))) (C[j_d],Tag(d,j_d))=AE.Enc_{K_1}(add(d,j_d)||ctr(d,j_d),M[j_d]) However, 1<=j_d<=2^d

[0051] Note that AE.Enc_{K_1}(·,·) represents the encryption function of AE. Furthermore, C[j_d] represents the j_dth ciphertext block. Furthermore, ctr(i,j_i) represents the counter value of the j_ith node at depth i. Therefore, ctr(d,j_d) represents the counter value of the j_dth leaf node at depth d. ctr(i,j_i) may be configured as a compressed counter, as illustrated in FIG. 1.

[0052] Next, the tag generation unit 102 generates data expressed by the following formula 8 as a tag to be used at the intermediate node. (Formula 8) TagInter=(Tag(1,1),...,Tag(d-1,2^{d-1})) Tag(i,j_i)=MAC_{K_2}((add(i,j_i)||ctr(i,j_i),ctr(i+1,2j_i-1)||ctr(i+1,2j_i)) where 1<=i<=d-1, 1<=j_i<=2^i

[0053] Next, the tag generating unit 102 generates data expressed by the following formula 9 as a tag to be used in the root node. (Formula 9) TagRoot=(Tag(0,1)) Tag(0,1)=MAC_{K_2}(add(0,1)||ctr(0,1),ctr(1,1)||ctr(1,2))

[0054] From Equation 7, Equation 8, and Equation 9, the tag corresponding to each node is as follows. That is, for leaf nodes, the tag corresponding to each node corresponds to the calculation result of AE, where the concatenation of the memory address of the node and the local counter value is used as the nonce, and the plaintext block corresponding to the node is used as the plaintext, and the nonce and plaintext are used as inputs. Also, a ciphertext block is output as the calculation result. Also, for nodes other than leaf nodes, the tag corresponding to each node corresponds to the calculation result of MAC, where the concatenation of the memory address of the node and the local counter value is used as the nonce, and the concatenation of the local counter values ​​of multiple child nodes is used as the plaintext, and the nonce and plaintext are used as inputs.

[0055] In the first embodiment, the counter ctr(i,j_i) may be expressed in the form of a compressed counter as shown in FIG. 1. Here, the local counter in the leaf node is configured as a compressed counter as shown in FIG. 1. The leaf node counter may be compressed by sharing a portion of the counter among multiple leaf nodes having the same parent node. In this case, it may be expressed as ctr(d,j_d)=Mctr(i)||mctr(i,j). Here, i is the index of the parent node of the leaf node, i=1,...,b^(d-1). Also, j is the index of the leaf node whose parent node is node i, that is, the leaf node whose parent node is the same, j=1,...,b. Therefore, in the case of a binary tree structure, j=1,2.

[0056] Also, like leaf nodes, the local counters in intermediate nodes and root nodes may be configured as compressed counters as illustrated in Figure 1. Alternatively, unlike leaf nodes, the local counters in intermediate nodes and root nodes may not be compressed.

[0057] As shown in the example of Figure 13, when the depth d of the entire tree structure is d = 3, Equations 7, 8, and 9 are expressed as the following Equation 10. Here, i is the depth index, and j_i is the index (order; ordinal number) of the node at depth i. (Formula 10) For 0<=i<=3,1<=j_i<=2^i, (For 0<=i<=2) Tag(i,j_i)=MAC_{K_2}(add(i,j_i)||ctr(i,j_i),ctr(i+1,2j_i-1)||ctr(i+1,2j_i)) (For i=3) (C[j_i],Tag(i,j_i))=AE.Enc_{K_1}(add(i,j_i)||ctr(i,j_i),M[j_i])

[0058] The leaf node generation unit 103 generates leaf nodes in a tree structure using the ciphertext and tag set TagLeaf output by the tag generation unit 102. Here, since the depth i=d in the leaf nodes, 1<=j_d<=2^d holds. Then, the j_dth leaf node (leaf node information) is generated as shown in the following formula 11. (Formula 11) (ctr(d,j_d),C[j_d],Tag(d,j_d))

[0059] However, we define ctr(i,j_i) = 0^{CTR-1}||1 for all i,j_i. Here, CTR is the bit length of the local counter value stored in each node, and "0^{CTR-1}" represents a bit string consisting of CTR-1 concatenated 0s. We assume that the value of CTR is predetermined. If the local counter is compressed and expressed as ctr(i,j_i) = Mctr(i)||mctr(i,j), then |Mctr(i)||mctr(i,j)|=CTR. Note that |x| indicates the bit length of bit string x.

[0060] All leaf nodes are written as in the following formula 12. That is, the leaf node information indicates the information shown in formula 12. (Formula 12) Leaf=((ctr(d,1),C[1],Tag(d,1)),...,(ctr(d,2^d),C[2^d],Tag(d,2^d)))

[0061] As shown in FIG. 13, when the depth of the entire tree structure is d=3, each leaf node is expressed as in the following Expression 13. (Formula 13) Leaf=((ctr(3,1),C[1],Tag(3,1)),(ctr(3,2),C[2],Tag(3,2)),...,(ctr(3,8),C[8],Tag(3,8))) The leaf node generating unit 103 outputs the generated leaf node set Leaf to the tree structure output unit 106 .

[0062] The intermediate node generation unit 104 generates intermediate nodes in a tree structure using the tag set TagInter output by the tag generation unit 102. Here, in the intermediate nodes, 1<=i<=d-1, 1<=j_i<=2^i. Then, the j_i-th intermediate node (intermediate node information; upper node information) at depth i is generated as shown in the following formula 14. (Formula 14) (ctr(i,j_i),Tag(i,j_i)) Here, we define ctr(i,j_i)=0^{CTR-1}||1 for all i,j_i.

[0063] Moreover, all intermediate nodes are described as in the following formula 15. That is, the intermediate node information (upper node information) indicates the information shown in formula 15. (Formula 15) Inter=((ctr(1,1),Tag(1,1)),(ctr(1,2),Tag(1,2)),...,(ctr(d-1,2^{d-1}),Tag(d-1,2^{d-1})))

[0064] As shown in FIG. 13, when the depth of the entire tree structure is d=3, each intermediate node is expressed by the following equation 16. (Formula 16) Inter=((ctr(1,1),Tag(1,1)),(ctr(1,2),Tag(1,2)),...,(ctr(2,4),Tag(2,4))) Moreover, the intermediate node generating unit 104 outputs the generated intermediate node set Inter to the tree structure output unit 106 .

[0065] The root node generation unit 105 generates a root node of the tree structure using the tag TagRoot output by the tag generation unit 102. The root node is generated as shown in the following formula 17, where ctr(0,1)=0^{CTR-1}||1 is defined. (Formula 17) Root=(ctr(0,1),Tag(0,1)) Furthermore, the root node generating unit 105 outputs the generated root node Root to the tree structure output unit 106 .

[0066] The tree structure output unit 106 connects the leaf node set Leaf output by the leaf node generation unit 103, the intermediate node set Inter output by the intermediate node generation unit 104, and the root node Root output by the root node generation unit 105. The tree structure output unit 106 then outputs the connected data string as data indicating a tree structure (tree structure Tree) to a computer display, a printer, etc. The memory address output unit 107 outputs the memory address Add output by the memory address allocation unit 101 to a computer display, a printer, etc.

[0067] The checksum storage area generation unit 110 generates a checksum storage area (first area) that stores a checksum S used to verify a leaf node when a crash occurs. Here, the checksum storage area is provided on-chip. In other words, the checksum storage area is a secure area that cannot be attacked by an attacker. The checksum storage area can also be an area in which any changes to the stored data are immediately reflected.

[0068] [Memory verification device configuration] 4 is a block diagram showing an example configuration of a memory verification device 20 according to the present disclosure. The memory verification device 20 according to the first embodiment includes a tree structure input unit 200, a memory address input unit 201, a verification location input unit 202, a tag verification unit 203, and a verification result output unit 204.

[0069] The tree structure input unit 200 functions as a tree structure input means. The memory address input unit 201 functions as a memory address input means. The verification point input unit 202 functions as a verification point input means. The tag verification unit 203 functions as a tag verification means. The verification result output unit 204 functions as a verification result output means.

[0070] The memory verification device 20 is, for example, a computer. The memory verification device 20 may implement each of the components shown in FIG. 4 by executing a software program in a central processing unit. Each of the components implemented in the memory verification device 20 may be implemented as an individual device, a functional unit, or an electronic circuit. This also applies to other embodiments described below.

[0071] The tree structure input unit 200 receives input of a tree structure Tree for protecting a memory to be verified. Then, the tree structure input unit 200 outputs the tree structure Tree to the tag verification unit 203. Here, Tree is composed of a leaf node set Leaf, an intermediate node set Inter, and a root node Root. Tree may be a data string output by the tree structure output unit 106, in which the leaf node set Leaf, the intermediate node set Inter, and the root node Root are linked.

[0072] The memory address input unit 201 receives an input of a memory address set Add assigned to a tree structure for protecting a memory to be verified. Then, the memory address input unit 201 outputs the memory address set Add to the tag verification unit 203. When the number of branches is b=2, Add is written as in the following Expression 18. (Formula 18) Add=(add(0,1),add(1,1),add(1,2),add(2,1),add(2,2),...,add(d,2^d-1),add(d,2^d)) However, when 1<=i<=d, 1<=j_i<=2^{i}, the memory address of the j_ith node at depth i is represented as add(i,j_i).

[0073] The verification point input unit 202 accepts input of the verification point CheckNode in the memory. Then, the verification point input unit 202 outputs the verification point CheckNode to the tag verification unit 203. However, when the number of branches is b=2, CheckNode is a numerical value between 1 and 2^d, inclusive, and indicates that the verification point is the CheckNode-th leaf node. In other words, CheckNode indicates the position (order; ordinal number) of the leaf node corresponding to the verification point.

[0074] The tag verification unit 203 verifies whether the memory specified by CheckNode has been tampered with, using the tree structure Tree, the memory address set Add, the verification location CheckNode, and the secret keys K_1 and K_2. Then, the tag verification unit 203 outputs the verification result to the verification result output unit 204. First, the tag verification unit 203 generates a path Path from the CheckNode-th leaf node to the root node. Here, the path Path indicates the route of nodes from the leaf node to the root node, and is expressed by the following formula 19. (Formula 19) Path=((d,p_d),(d-1,p_{d-1}),(d-2,p_{d-2}),···,(1,p_1),(0,p_0))

[0075] Here, when 1<=i<=d, 1<=j_i<=2^{i}, each element (i, j_i) of Path represents the j_ith node at depth i. In other words, j_i indicates the ordinal number of the node at depth i. Note that when p_d=CheckNode and 0<=i<=d-1, p_i is defined by the following formula 20. (Formula 20) p_i=ceiling(p_{i+1} / 2) Here, ceiling(·) represents the ceiling function, and the value of p_0 is always 1.

[0076] 14 is a diagram illustrating an example of a path generated by the tag verification unit 203 in the memory verification device 20 according to the present disclosure. For example, when d=4 and CheckNode=10, the Path is as follows, as shown in FIG. Path=((4,10),(3,5),(2,3),(1,2),(0,1))

[0077] Next, the tag verification unit 203 calculates the following equation 21 using Add, which is the output of the memory address input unit 201, Tree, which is the output of the tree structure input unit 200, and the private key K_1. (Formula 21) AE.Dec_{K_1}(add(d,p_d)||ctr(d,p_d),C[p_d],Tag(d,p_d))

[0078] If the above calculation result is an error message ⊥, the tag verification unit 203 defines the verification result B as B=NCK, outputs B, and ends the process. Here, AE.Dec_{K_1}(·,·,·) is a decryption function of the method AE.Enc_{K_1} used in the tag generation unit 102 of the memory structure initialization device 10. Furthermore, NCK indicates that the information of the nodes related to the path has been tampered with.

[0079] On the other hand, if the above calculation result indicates that the plaintext M[p_d] has been correctly decrypted, that is, that the ciphertext C[p_d] has been correctly decrypted, the tag verification unit 203 then calculates the following equation 22 using the private key K_2. (Formula 22) PathTag'=(Tag'(d-1,p_{d-1}),...,Tag'(0,p_0)) Tag'(i,p_i)=MAC_{K_2}(add(i,p_i)||ctr(i,p_i),ctr(i+1,2p_i-1)||ctr(i+1,2p_i)) 0<=i<=d-1

[0080] However, MAC_{K_2}(·) is substantially the same as the MAC method used in the tag generation unit 102 of the memory structure initialization device 10 in the first embodiment, so a description thereof will be omitted. Tag'(i, p_i) is obtained by inputting the concatenation of the address of the node and the local counter into the nonce part of the input of the MAC function, and inputting the concatenation of two local counters of child nodes of the node into the plaintext part of the input of the MAC function.

[0081] Furthermore, the tag verifying unit 203 obtains a value expressed by the following formula 23 from the tree structure Tree that is the output of the tree structure input unit 200. (Formula 23) PathTag=(Tag(d-1,p_{d-1}),...,Tag(0,p_0))

[0082] Then, the tag verification unit 203 checks whether the PathTag' calculated by itself is equal to the PathTag acquired from the Tree. When 0<=i<=d-1, for all i, Tag'(i,p_i)=Tag(i,p_i) If the above holds, the tag verification unit 203 sets the verification result to ACK. ACK indicates that the information of the nodes involved in the path has not been tampered with. The verification result is denoted as B, and the fact that the verification result is ACK is denoted as B=ACK.

[0083] On the other hand, when 0<=i<=d, for some i, Tag'(i,pi)≠Tag(i,pi) If this holds, the tag verification unit 203 defines the verification result B as B=NCK.

[0084] The tag verification unit 203 outputs the verification result B. The verification result output unit 204 outputs the verification result B output by the tag verification unit 203 to a computer display, a printer, or the like.

[0085] [Memory update device configuration explanation] 5 is a block diagram showing an example configuration of a memory updating device 30 according to the present disclosure. The memory updating device 30 according to the first embodiment includes a tree structure input unit 300, a memory address input unit 301, an update location input unit 302, a memory verification unit 303, a counter updating unit 304, a tag updating unit 305, and an update result output unit 306. The memory updating device 30 according to the first embodiment further includes a checksum calculation unit 310 and a checksum storage unit 312.

[0086] The tree structure input unit 300 functions as a tree structure input means (first input means). The memory address input unit 301 functions as a memory address input means. The update location input unit 302 functions as an update location input means. The memory verification unit 303 functions as a memory verification means. The counter update unit 304 functions as a counter update means. The tag update unit 305 functions as a tag update means. The update result output unit 306 functions as an update result output means. The checksum calculation unit 310 functions as a checksum calculation means (checksum update means). The checksum storage unit 312 functions as a checksum storage means.

[0087] The memory update device 30 is, for example, a computer. The memory update device 30 may implement each of the components shown in FIG. 5 by executing a software program in a central processing unit. The components implemented in the memory update device 30 may also be implemented as individual devices, functional units, or electronic circuits. This also applies to other embodiments described below.

[0088] The tree structure input unit 300 receives input of a tree structure Tree for protecting the memory to be updated. Then, as indicated by the dashed-dotted lines in Fig. 5 , the tree structure input unit 300 outputs the tree structure Tree to the memory verification unit 303 and the counter update unit 304. Note that the Tree is composed of a leaf node set Leaf, an intermediate node set Inter, and a root node Root. Note that the function of the tree structure input unit 300 is substantially the same as the function of the tree structure input unit 200 in the memory verification device 20 according to the first embodiment, and therefore a description thereof will be omitted.

[0089] The memory address input unit 301 receives an input of a memory address set Add assigned to a tree structure for protecting a memory to be verified. Then, as indicated by the solid lines in Fig. 5, the memory address input unit 301 outputs the memory address set Add to the memory verification unit 303 and the tag update unit 305. Note that the function of the memory address input unit 301 is substantially the same as the function of the memory address input unit 201 in the memory verification device 20 according to the first embodiment, and therefore a description thereof will be omitted.

[0090] The update location input unit 302 accepts input of memory update information UpdateNode. Then, as indicated by the dotted line in FIG. 5, the update location input unit 302 outputs the memory update information UpdateNode to the memory verification unit 303 and the tag update unit 305. Here, the memory update information UpdateNode is information related to a node to be updated in the tree structure. Here, UpdateNode=(UpdateIndex, UpdateInfo). UpdateIndex is data indicating the leaf node corresponding to the update location. When the number of branches is b=2, UpdateIndex is a numerical value between 1 and 2^d, inclusive, and indicates that the update location is the UpdateIndex-th leaf node. In other words, UpdateIndex indicates the order (ordinal number) of the leaf node corresponding to the update location at depth d. UpdateInfo is data indicating the update content. UpdateInfo indicates information of the Block bit that updates the plaintext block M[UpdateIndex], which is information included in the UpdateIndex-th leaf.

[0091] The memory verification unit 303 verifies whether the memory specified by UpdateNode has been tampered with, using the tree structure Tree, the memory address set Add, the memory update information UpdateNode, and the secret keys K_1 and K_2. The processing performed by the memory verification unit 303 is the same as that performed by the tag verification unit 203 in the memory verification device 20 of the first embodiment, except for the output result. The tag verification unit 203 in the memory verification device 20 of the first embodiment outputs verification result B, but the memory verification unit 303 also outputs a path Path from the node in question to the root node along with verification result B. The memory verification unit 303 outputs verification result B to the counter update unit 304, the tag update unit 305, and the update result output unit 306. The memory verification unit 303 also outputs the path Path to the counter update unit 304 and the tag update unit 305.

[0092] Path is expressed as the following equation 24. (Formula 24) Path=((d,p_d),(d-1,p_{d-1}),(d-2,p_{d-2}),···,(1,p_1),(0,p_0)) Here, it is clear from the operation performed by the memory verification unit 303 that p_d=UpdateIndex.

[0093] The counter update unit 304 updates the information of the node specified by Path using the tree structure Tree, the verification result B, and the path Path. If B=ACK, the following process is performed. First, the counter update unit 304 updates the counter value of the node specified by Path. Here, in the first embodiment, at least each of the leaf node counters is configured as a compressed counter consisting of a major counter Mctr and a minor counter mctr, as described above with reference to FIG. 1. Therefore, the counter update unit 304 updates the counter mctr(d,p_d) of the leaf node (d,p_d) specified by Path as follows: mctr(d,p_d)=Mctr(i)||mctr(i,j). That is, if the minor counter mctr(i,j) is not the maximum value, that is, if mctr(i,j)<2^{ml}, the counter update unit 304 increments the minor counter mctr(i,j) by one. Note that ml is the bit length of the minor counter mctr. In the example of FIG. 1, ml=8.

[0094] On the other hand, if the minor counter mctr(i,j) is the maximum value, that is, if mctr(i,j)=2^{ml}, the counter update unit 304 increments the major counter Mctr(i) by one. Furthermore, the counter update unit 304 initializes all minor counters mctr(i,j') connected to Mctr(i) and sets mctr(i,j')=0^{ml}. In other words, the counter update unit 304 resets all minor counters mctr(i,j') associated with Mctr(i). That is, the counter update unit 304 initializes not only mctr(i,j) but also the minor counters mctr(i,j') of all leaf nodes whose parent node is the parent node (d-1,p_{d-1}) of the leaf node (d,p_d) to be updated. Note that 0^{ml} represents a bit string formed by connecting ml 0s. That is, when the minor counter mctr(i,j) for the leaf node to be updated is at its maximum value, the counter update unit 304 performs processing to deal with overflow. That is, the counter update unit 304 initializes (resets) the minor counters mctr of all leaf nodes whose parent node is the parent node of the leaf node to be updated. In other words, the counter update unit 304 initializes (resets) the minor counters mctr of all leaf nodes whose parent node is the same as the leaf node to be updated.

[0095] Furthermore, the counter updating unit 304 updates the counters of upper nodes other than leaf nodes among the nodes specified by Path as follows. If the counter of the upper node is a compressed counter like the leaf node counter, the counter updating unit 304 updates the counter of the upper node in the same manner as the leaf node counter described above. On the other hand, if the counter of the upper node is not a compressed counter, the counter updating unit 304 performs the calculation of the following equation 25 for the upper node. (Formula 25) ctr(i,p_i)←ctr(i,p_i)+1 Here, a←b indicates that a is updated with b. Then, counter update unit 304 outputs the tree structure NewTree' resulting from the update to tag update unit 305. On the other hand, if B=NCK, counter update unit 304 does not perform any processing and does not output anything.

[0096] Note that the leaf node counter Mctr(i)||mctr(i,j) is updated so as to monotonically increase as the leaf node (i,j_d) corresponding to this leaf node counter is updated. That is, as described above, as the leaf node (i,j_d) is updated, the minor counter mctr(i,j) monotonically increases until it reaches the maximum value 2^{ml}. Then, when the minor counter mctr(i,j) reaches the maximum value 2^{ml}, the major counter Mctr(i) is incremented. Here, in the leaf node counter Mctr(i)||mctr(i,j), the major counter Mctr has higher bits than the minor counter mctr. Therefore, if the value of the major counter Mctr increases, the value of the leaf node counter Mctr(i)||mctr(i,j) increases regardless of the value of the minor counter mctr. Therefore, even if there is an overflow, the leaf node counter Mctr(i)||mctr(i,j) monotonically increases as the leaf node (i,j_d) is updated. Note that the above also applies when the counters of nodes other than leaf nodes are composed of a major counter Mctr and a minor counter Mctr.

[0097] The tag update unit 305 updates the tag of the node specified by Path using the tree structure NewTree' of the update result, the memory address set Add, the memory update information UpdateNode, the verification result B, the path Path, and the private keys K_1 and K_2. If B=ACK, the tag update unit 305 performs the calculation of the following equation 26 for 0<=i<=d-1. (Formula 26) (C[p_d],Tag(d,p_d))←AE.Enc_{K_1}(add(d,p_d)||ctr(d,p_d),UpdateInfo) Tag(i,p_i)←MAC_{K_2}(add(i,p_i)||ctr(i,p_i),ctr(i+1,2p_i-1)||ctr(i+1,2p_i))

[0098] Note that AE.Enc_{K_1}(·,·) and MAC_{K_2}(·) are substantially the same as those used in the tag generation unit 102 of the memory structure initialization device 10 and the tag verification unit 203 of the memory verification device 20 in the first embodiment. The tag update unit 305 then outputs the tree structure NewTree resulting from the update. On the other hand, if B=NCK, the tag update unit 305 does not perform any processing and does not output anything.

[0099] The update result output unit 306 outputs the update result using the verification result B output by the memory verification unit 303 and the tree structure NewTree output by the tag update unit 305. If B=ACK, the update result output unit 306 outputs NewTree to a computer display, a printer, or the like. On the other hand, if B=NCK, the update result output unit 306 outputs the verification result B=NCK to a computer display, a printer, or the like.

[0100] The checksum calculation unit 310 calculates a checksum (first checksum) based on the leaf node counter. Here, the checksum calculation unit 310 calculates the checksum S by a first calculation method that is a calculation method in which different checksums are calculated for different leaf node counters. The checksum calculation unit 310 may also calculate the checksum S every time any of the leaf nodes is updated. In other words, the checksum calculation unit 310 may update the checksum S every time a leaf node is updated.

[0101] Here, the first calculation method may be a calculation method in which the checksum S monotonically increases or decreases as the leaf node counter is updated. In this case, the checksum S calculated each time the leaf node counter is updated will be different from the checksum calculated at any timing before the update. Therefore, when the leaf node is updated, the checksum can be updated so that it is not the same as the previously calculated value. This makes it possible to more appropriately verify the checksum in the memory protection device 40, which will be described later.

[0102] The first calculation method may be a calculation method using at least one of the four arithmetic operations. Here, the method of calculating the checksum using the four arithmetic operations is a simple calculation method that reduces the load on calculation resources compared to a method of calculating the checksum using cryptographic components such as authenticated encryption. Calculating the checksum S using such a simple calculation method allows the checksum S to be calculated efficiently.

[0103] For example, the first calculation method may be a calculation method that calculates the checksum S by adding up the leaf node counters. In this case, the first calculation method may be a calculation method that calculates the checksum S by adding up the total of all leaf node counters. In other words, the checksum calculation unit 310 may calculate the checksum S by adding up all the leaf node counters. In this case, the checksum calculation unit 310 calculates the checksum S by calculating the following equation 27. (Formula 27) S=Σ_{i=1,···,b^(d-1),j=1,···,b}Mctr(i)||mctr(i,j)

[0104] As mentioned above, b is the number of branches. Also, i is the index of the parent node of the leaf node, that is, the node at depth d-1. Also, j is the index of the leaf node whose parent node is the same parent node i. Also, Σ is an operator indicating summation.

[0105] The first calculation method may also be a calculation method that calculates the checksum S by multiplying the leaf node counters. That is, the checksum calculation unit 310 may calculate the checksum S by multiplying all the leaf node counters. In this case, the checksum calculation unit 310 calculates the checksum S by calculating the following equation 28. Note that Π is an operator indicating the total product (sum multiplication). Note that in this case, it is important to ensure that none of the leaf node counters take on the value 0. (Formula 28) S=Π_{i=1,···,b^(d-1),j=1,···,b}Mctr(i)||mctr(i,j)

[0106] The first calculation method may also be a calculation method that calculates the checksum S using the difference between leaf node counters. That is, the checksum calculation unit 310 may calculate the checksum S by subtracting all leaf node counters. In this case, the checksum calculation unit 310 calculates the checksum S by calculating the following equation 29. (Formula 29) S=-Σ_{i=1,···,b^(d-1),j=1,···,b}Mctr(i)||mctr(i,j)

[0107] The checksum storage unit 312 stores the checksum S calculated by the checksum calculation unit 310 in a checksum storage area. That is, the checksum storage unit 312 receives the updated checksum S as an input and stores the value of the checksum S in the checksum storage area. As described above, the checksum storage area is a secure area provided on-chip.

[0108] It should be noted that the checksum calculation unit 310 does not need to calculate the checksum S from scratch when a leaf node is updated. The checksum calculation unit 310 may calculate the checksum S after the leaf node counter is updated by inputting the leaf node counter before the update and the leaf node counter after the update, and updating the checksum S stored in the checksum storage area. In other words, the checksum calculation unit 310 may update the checksum S using the leaf node counter after the update. This allows the checksum S to be calculated efficiently when the leaf node counter is updated.

[0109] [Memory protection device configuration explanation] FIG. 6 is a block diagram showing an example configuration of the memory protection device 40. The memory protection device 40 has a leaf node verification unit 400 and a node recovery unit 440. The leaf node verification unit 400 functions as leaf node verification means. The node recovery unit 440 functions as node recovery means. With these components, the memory protection device 40 verifies whether or not a leaf node has been tampered with when a memory crash occurs, and if the verification is successful, constructs a new tree structure. This will be described in more detail later. Note that when the memory protection device 40 is operating, attacks on the memory by attackers may be prevented by methods such as disconnecting the network.

[0110] The memory protection device 40 is, for example, a computer. The memory protection device 40 may implement each of the components shown in FIG. 6 by executing a software program in a central processing unit. The components implemented in the memory protection device 40 may also be implemented as individual devices, functional units, or electronic circuits. This also applies to the other embodiments described below.

[0111] 6, the leaf node verification unit 400 and the node recovery unit 440 are provided in the same memory protection device 40, but the present invention is not limited to this configuration. The leaf node verification unit 400 and the node recovery unit 440 may be realized by separate devices. In this case, the function of the leaf node verification unit 400 may be realized by the leaf node verification device, and the function of the node recovery unit 440 may be realized by the node recovery device.

[0112] When a memory crash occurs, the leaf node verification unit 400 calculates a second checksum S' using a first calculation method based on the leaf node counter. The leaf node verification unit 400 verifies the checksum by comparing the first checksum S stored in the checksum storage area with the second checksum S'. The leaf node verification unit 400 also verifies tags related to the leaf nodes. In this way, the leaf node verification unit 400 verifies whether or not the leaf nodes have been tampered with when the memory crash occurs. This will be described in more detail later.

[0113] If the leaf node has not been tampered with, the node recovery unit 440 uses the leaf node counter to calculate the maximum value that the counter of the upper node could have taken before the crash, and calculates a tag for the upper node based on the maximum value. In this way, the node recovery unit 440 constructs a new tree structure. This will be described in detail later.

[0114] 7 is a block diagram showing an example configuration of a leaf node verification unit 400 according to the present disclosure. As shown in FIG. 7, the leaf node verification unit 400 includes a memory address input unit 402, a leaf node information input unit 404, a checksum acquisition unit 406, a checksum verification unit 410, a leaf node tag verification unit 420, and a leaf node information output unit 430.

[0115] The memory address input unit 402 functions as a memory address input means. The leaf node information input unit 404 functions as a leaf node information input means. The checksum acquisition unit 406 functions as a checksum acquisition means. The checksum verification unit 410 functions as a checksum verification means. The leaf node tag verification unit 420 functions as a leaf node tag verification means. The leaf node information output unit 430 functions as a leaf node information output means.

[0116] The memory address input unit 402 receives input of a memory address set Add assigned to a tree structure for protecting the memory to be verified. The memory address input unit 402 may receive input of the memory address set Add when a crash occurs in the memory. The memory address input unit 402 then outputs the memory address set Add to the leaf node tag verification unit 420. Note that the function of the memory address input unit 402 is substantially the same as the function of the memory address input unit 201 in the memory verification device 20 according to the first embodiment, and therefore a description thereof will be omitted.

[0117] The leaf node information input unit 404 accepts input of leaf node information Leaf. That is, the leaf node information input unit 404 accepts input of information on leaf nodes that may have been tampered with. The leaf node information input unit 404 may accept input of leaf node information Leaf when a memory crash occurs. As shown in the above-mentioned Equations 11 to 13, the leaf node information is information about each of multiple leaf nodes. The leaf node information includes a counter (leaf node counter), ciphertext, and tag (leaf node tag) for each leaf node. Furthermore, as described above, the leaf node counter is compressed by sharing a part of the counter (major counter Mctr) among multiple leaf nodes. The leaf node information input unit 404 outputs the leaf node information Leaf to the checksum verification unit 410, the leaf node tag verification unit 420, and the leaf node information output unit 430.

[0118] The checksum acquisition unit 406 acquires the checksum S (first checksum) stored in the checksum storage area (first area). The checksum acquisition unit 406 may acquire the checksum S when a crash occurs in the memory. Here, as described above, the checksum S stored in the checksum storage area is calculated by the first calculation method based on the leaf node counter. The checksum acquisition unit 406 outputs the acquired checksum S to the checksum verification unit 410.

[0119] The checksum verification unit 410 verifies the checksum. The checksum verification unit 410 may verify the checksum when a crash occurs in the memory. Specifically, the checksum verification unit 410 calculates a checksum S' using the leaf node information Leaf output from the leaf node information input unit 404. More specifically, the checksum verification unit 410 calculates a second checksum S' using a first calculation method based on the leaf node counter included in the leaf node information Leaf. Here, the first calculation method is the same as the first calculation method used by the checksum calculation unit 310. In other words, the checksum verification unit 410 calculates the second checksum S' using the same calculation method as the first calculation method used in calculating the checksum S in the checksum calculation unit 310.

[0120] Furthermore, the checksum verification unit 410 compares the first checksum S acquired from the checksum storage area by the checksum acquisition unit 406 with the calculated second checksum S'. That is, the checksum verification unit 410 verifies whether the second checksum S' matches the first checksum S. If the first checksum S and the second checksum S' match, the checksum verification unit 410 determines that the checksum verification has been successful. In this case, the checksum verification unit 410 outputs the verification result Bc=OK, indicating that the checksum verification has been successful, to the leaf node information output unit 430.

[0121] On the other hand, if the first checksum S and the second checksum S' do not match, the checksum verification unit 410 determines that the checksum verification has failed, that is, that the leaf node counter has been tampered with. In this case, the checksum verification unit 410 outputs the verification result Bc=NG, indicating that the checksum verification has failed, to the leaf node information output unit 430.

[0122] The leaf node tag verification unit 420 verifies leaf node tags. The leaf node tag verification unit 420 may verify leaf node tags when a memory crash occurs. Specifically, the leaf node tag verification unit 420 verifies whether the leaf node information Leaf output from the leaf node information input unit 404 has been tampered with, using the authenticated encryption AE. The leaf node tag verification unit 420 verifies whether each leaf node has been tampered with, using the memory address set Add, the leaf node information Leaf, and the secret key K_1. Specifically, the leaf node tag verification unit 420 calculates the following equation 30 for all leaf nodes (d, j_d). However, when the number of branches is b, j_d=1,...,b^d. When b=2, j_d=1,...,2^d. (Formula 30) AE.Dec_{K_1}(add(d,j_d)||ctr(d,j_d),C[j_d],Tag(d,j_d))

[0123] If the above calculation result for any leaf node is an error message ⊥, the leaf node tag verification unit 420 outputs the verification result Bt=NG to the leaf node information output unit 430. Note that the verification result Bt=NG indicates that tampering has occurred at any leaf node. Here, AE.Dec_{K_1}(·,·,·) is the decryption function of the method AE.Enc_{K_1} used in the tag generation unit 102 of the memory structure initialization device 10.

[0124] On the other hand, if the above calculation results indicate that plaintext M[j_d] has been output for all leaf nodes, the leaf node tag verification unit 420 outputs the verification result Bt=OK to the leaf node information output unit 430. That is, if the ciphertext C[j_d] has been correctly decrypted for all leaf nodes, the leaf node tag verification unit 420 outputs the verification result Bt=OK to the leaf node information output unit 430. In other words, if the verification using authenticated encryption is successful for all leaf nodes, the leaf node tag verification unit 420 outputs the verification result Bt=OK to the leaf node information output unit 430. Note that a verification result of Bt=OK indicates that no tampering has occurred in any of the leaf nodes.

[0125] The leaf node information output unit 430 outputs leaf node information Leaf when both the verification result Bc from the checksum verification unit 410 and the verification result Bt from the leaf node tag verification unit 420 indicate OK. In other words, the leaf node information output unit 430 outputs leaf node information Leaf that has been determined to have not been tampered with. On the other hand, when at least one of the verification result Bc from the checksum verification unit 410 and the verification result Bt from the leaf node tag verification unit 420 indicates NG, the leaf node information output unit 430 outputs a message indicating that the leaf node has been tampered with.

[0126] Here, the reason for verifying both the checksum and the leaf node tag will be explained. First, assume that when a crash occurs, an attacker tampered with the leaf node counters by rolling forward. In this case, if the checksum calculation method is the method shown in Equation 27 above, the attacker can increment one leaf node counter and decrement another leaf node counter, thereby causing the checksum to be verified as OK. In other words, the attacker can intentionally make the value of checksum S' calculated by checksum verification unit 410 match the value of checksum S stored in the checksum storage area.

[0127] On the other hand, it is highly likely that the attacker does not know the ciphertext and tag corresponding to the counter that has advanced due to roll forward. Therefore, it is highly likely that the verification result of the tag by the leaf node tag verification unit 420 will be NG. Therefore, when roll forward tampering is performed on the leaf node counter by an attacker, the memory protection device 40 can appropriately determine that tampering has occurred.

[0128] Next, suppose that when a crash occurs, an attacker tampered with the leaf node counter by rolling it back. In this case, the attacker may know the ciphertext and tag corresponding to the counter returned by the rollback. Therefore, the attacker can intentionally cause the tag verification using authentication encryption to be OK. In other words, the attacker can intentionally cause the calculation result of the above equation 30 by the leaf node tag verification unit 420 to be the decrypted plaintext for all leaf nodes.

[0129] On the other hand, if the checksum calculation method is the method shown in Equation 27 above, an attacker decrements the leaf node counter. In this case, the value of checksum S' calculated by checksum verification unit 410 corresponds to the result of decrementing the leaf node counter, and is therefore highly likely to differ from the value of checksum S stored in the checksum storage area. Therefore, the checksum verification result by checksum verification unit 410 is highly likely to be NG. Therefore, when rollback tampering is performed on the leaf node counter by an attacker, memory protection device 40 can appropriately determine that tampering has occurred.

[0130] Fig. 8 is a block diagram showing an example configuration of the node recovery unit 440 according to the present disclosure. As shown in Fig. 8, the node recovery unit 440 has a leaf node information input unit 442, a memory address input unit 444, a counter recovery unit 450, a tag generation unit 460, a tree structure output unit 470, and a memory address output unit 480. Note that when the leaf node verification unit 400 determines that a leaf node has been tampered with, the node recovery unit 440 does not need to perform processing to newly construct a tree structure, as will be described later.

[0131] The leaf node information input unit 442 functions as a leaf node information input means. The memory address input unit 444 functions as a memory address input means. The counter recovery unit 450 functions as a counter recovery means. The tag generation unit 460 functions as a tag generation means. The tree structure output unit 470 functions as a tree structure output means. The memory address output unit 480 functions as a memory address output means.

[0132] If the leaf node counter is a compressed counter, the minor counters mctr of all leaf nodes are reset when an overflow occurs, and the value of the leaf node counter may no longer match the number of updates of the leaf node. Therefore, it is difficult to use the leaf node counter to restore the counter of the upper node to the state it was in when the crash occurred. Therefore, in order to continue operating the tree structure, the node recovery unit 440 constructs a new tree structure using untampered leaf node counters, as described below. Note that an attacker may know information about the nodes before the crash, so rolling back the counter from the value at the time of the crash may result in an attack by the attacker (such as a replay attack). Therefore, the node recovery unit 440 constructs a new tree structure by using untampered leaf node counters to calculate the maximum value that could be obtained before the crash.

[0133] The leaf node information input unit 442 receives input of leaf node information Leaf output from the leaf node verification unit 400. That is, the leaf node information input unit 442 receives input of leaf node information Leaf that was determined not to have been tampered with by the leaf node verification unit 400 when a crash occurred. As described above, the leaf node information Leaf includes a counter (leaf node counter), ciphertext, and tag (leaf node tag) related to the leaf node. Also, as described above, the leaf node counter is compressed by sharing part of the counter among multiple leaf nodes. The leaf node information input unit 442 outputs the leaf node information Leaf to the counter recovery unit 450 and the tree structure output unit 470.

[0134] The memory address input unit 444 receives input of a memory address set Add assigned to a tree structure for protecting a memory to be recovered. The memory address input unit 444 may receive input of the memory address set Add if the leaf node verification unit 400 determines that no tampering has occurred when a crash occurs. The memory address input unit 444 then outputs the memory address set Add to the tag generation unit 460 and the memory address output unit 480. Note that the function of the memory address input unit 444 is substantially the same as the function of the memory address input unit 201 in the memory verification device 20 according to the first embodiment, and therefore a description thereof will be omitted.

[0135] The counter recovery unit 450 recovers the counters of upper nodes (intermediate nodes and root node) other than leaf nodes using the leaf node information Leaf output from the leaf node information input unit 404. That is, the counter recovery unit 450 recovers the counters of upper nodes (intermediate nodes and root node) other than leaf nodes using the leaf node counters included in the leaf node information Leaf. Specifically, the counter recovery unit 450 calculates the maximum value that the counters of the upper nodes could have taken before crashing. That is, the counter recovery unit 450 calculates the maximum value that the update count of the upper nodes could have taken using the leaf node counters included in the leaf node information Leaf.

[0136] As mentioned above, let the number of branches in the tree structure be b, and the bit length of the minor counter mctr be ml. In this case, each node at depth d-1 is the parent node of b leaf nodes. If the index of the parent node of a leaf node is i (i=1, ,b^(d-1)), then the counter (leaf node counter) of leaf node j (j=1, ,b) whose parent node is parent node i is expressed as Mctr(i)||mctr(i,j).

[0137] Here, the maximum number of updates for a parent node i of a leaf node is defined as u_max(i). In other words, parent node i was updated at most u_max(i) times before it crashed. Considering that the number of updates for parent node i is the sum of the number of updates for its child leaf nodes, the maximum number of updates for parent node i can be found by calculating the maximum of the total number of updates for the leaf nodes.

[0138] Here, the number of updates for the leaf node k that has overflowed since the minor counter mctr was last reset until it overflows is 2^{ml}, which is the maximum value of the minor counter mctr. The maximum number of updates for the leaf nodes other than leaf node k since the minor counter mctr was reset until leaf node k overflows is 2^{ml}-1, which is one less than the maximum value of the minor counter mctr. Therefore, the number of updates for all leaf nodes other than leaf node k since the minor counter mctr was reset until leaf node k overflows is 2^{ml}-1. In this case, the maximum total number of updates for b leaf nodes from the time an overflow occurs until the next overflow occurs is (2^{ml}-1)(b-1)+2^{ml}. The total number of updates for the leaf nodes since the previous overflow occurs is Σ_{j=1, ,b}mctr(i,j). Therefore, u_max(i) is expressed by the following equation 31. (Formula 31) u_max(i)=Mctr(i)((2^{ml}-1)(b-1)+2^{ml})+Σ_{j=1,...,b}mctr(i,j)

[0139] The counter recovery unit 450 calculates the maximum counter value that could be taken before the crash for each node at depth d-1, i.e., the parent node i (i=1,...,b^(d-1)) of the leaf node, using u_max(i) expressed by the above equation 31. Here, if the counter of the parent node i of the leaf node is not a compressed counter such as a split counter, the counter recovery unit 450 sets the counter of the parent node i of the leaf node to u_max(i).

[0140] On the other hand, if the counter of the parent node i of the leaf node is a split counter, consider the parent node of the parent node i of the leaf node, that is, node h (h=1,...,b^(d-2)) at depth d-2. In this case, the counter of the parent node i' (i'=1,...,b) of the leaf node, which has node h as its parent node, shares the major counter pMctr. If the minor counter of each parent node i' of the leaf node is pmctr(i'), then the counter of the parent node i' of the leaf node is expressed as pMctr||pmctr(i').

[0141] At this time, the major counter pMctr is expressed by the following equation 32 using u_max(i). (Formula 32) pMctr=Σ_{i'=1,...,b}floor(u_max(i') / (2^{ml})) where floor(·) denotes the floor function, where floor(u_max(i') / (2^{ml})) corresponds to the number of times an overflow occurs for each node i'.

[0142] Furthermore, the minor counter pmctr(i') of the parent node i' of the leaf node is expressed by the following equation 33. (Formula 33) pmctr(i')=u_max(i') mod 2^{ml}

[0143] That is, the counter recovery unit 450 calculates the counter of the parent node i' (i'=1, , b) of the leaf node by calculating pMctr∥pmctr(i') using Equation 32 and Equation 33. The counter recovery unit 450 also calculates counters for nodes higher than the parent node i' of the leaf node (intermediate nodes and root node) in the same manner as above. The counter recovery unit 450 outputs the set ctr of recovered counters for the higher nodes (intermediate nodes and root node) of the leaf node to the tag generation unit 460.

[0144] The tag generation unit 460 generates tags for the upper nodes (intermediate nodes and root node) using the set ctr of recovered counters for the upper nodes. The tag generation unit 460 generates tags for the intermediate nodes and root node in substantially the same manner as the tag generation unit 102 of the memory structure initialization device 10 according to the first embodiment. That is, the tag generation unit 460 generates tags for the intermediate nodes TagInter by calculating the MAC function shown in the above equation 8 using the recovered counters and memory address set Add for the intermediate nodes. The tag generation unit 460 also generates tags for the root node TagRoot by calculating the MAC function shown in the above equation 9 using the recovered counters and memory address set Add for the root node. The tag generation unit 460 outputs the set TagInter of tags for the intermediate nodes and the tag TagRoot of the root node to the tree structure output unit 470. The tag generation unit 460 also outputs the set ctr of recovered counters for the upper nodes to the tree structure output unit 470.

[0145] The tree structure output unit 470 receives leaf node information Leaf determined to be tamper-free, a set of recovered counters ctr of upper nodes, a set of tags TagInter of intermediate nodes, and a tag TagRoot of the root node. The tree structure output unit 470 then uses this information to construct a new tree structure. Specifically, the tree structure output unit 470 generates information Inter of all intermediate nodes as shown in the above formula 15 from the pair of counter and tag of each intermediate node, similar to the intermediate node generation unit 104 of the memory structure initialization device 10 according to the first embodiment. The tree structure output unit 470 also generates information Root of the root node as shown in the above formula 17 from the pair of counter and tag of the root node, similar to the root node generation unit 105 of the memory structure initialization device 10 according to the first embodiment. The tree structure output unit 470 then connects Leaf, Inter, and Root, similar to the tree structure output unit 106 of the memory structure initialization device 10 according to the first embodiment. Then, tree structure output unit 470 outputs the linked data string as data indicating a tree structure (tree structure Tree) to a computer display, a printer, etc. Memory address output unit 480 outputs the memory address Add output from memory address input unit 444 to a computer display, a printer, etc.

[0146] [Explanation of operation] 9 is a flowchart showing the operation (memory structure initialization method) of the memory structure initialization device 10 according to the present disclosure. In step S11, the plaintext input unit 100 accepts input of plaintext M to be protected. In step S12, the memory address allocation unit 101 allocates a memory address to each node in the tree structure and generates a memory address set Add. In step S13, the tag generation unit 102 uses the plaintext M and the memory address set Add to generate a tag set (TagLeaf, TagInter, TagRoot) for tamper detection.

[0147] In step S14, the leaf node generation unit 103 generates a leaf node set Leaf of a tree structure using the tag set TagLeaf output by the tag generation unit 102. In step S15, the intermediate node generation unit 104 generates an intermediate node set Inter of a tree structure using the tag set TagInter output by the tag generation unit 102. In step S16, the root node generation unit 105 generates a root node Root of the tree structure using the tag TagRoot output by the tag generation unit 102.

[0148] In step S17, the tree structure output unit 106 connects the leaf node set Leaf, the intermediate node set Inter, and the root node Root, and outputs the connected data string indicating the tree structure to a computer display, a printer, or the like. In addition, the memory address output unit 107 outputs the memory address Add output by the memory address assignment unit 101 to a computer display, a printer, or the like. In step S18, the checksum storage area generation unit 110 generates a checksum storage area (first area) on-chip. After step S18, the memory structure initialization device 10 ends the processing of FIG. 9.

[0149] 10 is a flowchart showing the operation (memory verification method) of the memory verification device 20 according to the present disclosure. In step S21, the tree structure input unit 200 receives input of a tree structure Tree for protecting the memory to be verified. The Tree is composed of a leaf node set Leaf, an intermediate node set Inter, and a root node Root. The memory address input unit 201 also receives input of a memory address set Add assigned to the tree structure for protecting the memory to be verified. The verification point input unit 202 also receives input of a verification point CheckNode of the memory.

[0150] In step S22, the tag verification unit 203 verifies the tag of each node using the tree structure Tree, the memory address set Add, and the verification location CheckNode. As a result, the tag verification unit 203 verifies whether the memory specified by CheckNode has been tampered with. Furthermore, the tag verification unit 203 determines acceptance (ACK) or non-acceptance (NCK) and outputs a verification result B. In step S23, the verification result output unit 204 outputs the verification result B to a computer display, a printer, or the like. After step S23, the memory verification device 20 ends the processing of FIG. 10.

[0151] 11 is a flowchart showing the operation (memory update method) of the memory update device 30 according to the present disclosure. In step S31, the tree structure input unit 300 receives input of a tree structure Tree for protecting the memory to be updated. Note that Tree is composed of a leaf node set Leaf, an intermediate node set Inter, and a root node Root. Furthermore, the memory address input unit 301 receives input of a memory address set Add assigned to the tree structure for protecting the memory to be verified. Furthermore, the update location input unit 302 receives input of memory update information UpdateNode. Note that the update information UpdateNode is defined as (UpdateIndex, UpdateInfo).

[0152] In step S32, the memory verification unit 303 verifies whether the memory specified by UpdateNode has been tampered with, using the tree structure Tree, the memory address set Add, and the memory update information UpdateNode. Furthermore, the memory verification unit 303 determines acceptance (ACK) or non-acceptance (NCK) and outputs the verification result B. The memory verification unit 303 then outputs the verification result B and the path Path used for memory verification. If B=ACK, i.e., memory tampering is not detected (S32: B=ACK (accepted)), the process proceeds to step S34. If B=NCK, i.e., memory tampering is detected (S32: B=NCK (not accepted)), the process proceeds to step S33.

[0153] In step S33, the update result output unit 306 outputs the verification result B output by the memory verification unit 303 to a computer display, a printer, etc. After step S33, the memory update device 30 ends the processing of FIG.

[0154] In step S34, counter update unit 304 updates the counter of the node specified by Path using Tree output by tree structure input unit 300 and path Path output by memory verification unit 303, and outputs tree structure NewTree' as the update result. In step S35, tag update unit 305 updates the tag of the node specified by Path using tree structure NewTree', memory address set Add, and memory update information UpdateNode. Then, tag update unit 305 outputs tree structure NewTree as the update result.

[0155] In step S36, the update result output unit 306 outputs the tree structure NewTree output by the tag update unit 305. In step S37, the checksum calculation unit 310 calculates the checksum S by the first calculation method using the updated leaf node counter. In addition, the checksum storage unit 312 stores the checksum S calculated by the checksum calculation unit 310 in the checksum storage area. After step S37, the memory update device 30 ends the processing of FIG. 11.

[0156] FIG. 12 is a flowchart showing the operation (memory protection method) of the memory protection device 40 according to the present disclosure. The flow shown in FIG. 12 may be executed when a crash occurs. In step S102, the memory address input unit 402 receives input of a memory address set Add assigned to a tree structure for protecting the memory to be verified. In addition, the leaf node information input unit 404 receives input of leaf node information Leaf. Note that the leaf node information Leaf is information on leaf nodes that may have been tampered with. In step S110, the checksum acquisition unit 406 acquires the checksum S (first checksum) stored in the checksum storage area.

[0157] In step S122, the checksum verification unit 410 verifies the checksum. That is, the checksum verification unit 410 calculates a checksum S' using the leaf node information Leaf according to a first calculation method. The checksum verification unit 410 also verifies the checksum by comparing the first checksum S acquired in S110 with the calculated second checksum S'. The checksum verification unit 410 then outputs a verification result Bc. In step S124, the leaf node tag verification unit 420 verifies the leaf node tag as described above. The leaf node tag verification unit 420 then outputs a verification result Bt.

[0158] In step S130, the leaf node tag verification unit 420 (leaf node information output unit 430) determines whether the checksum verification result Bc and the leaf node tag verification result Bt both indicate OK. If at least one of the checksum verification result Bc and the leaf node tag verification result Bt indicates NG (NO in S130), in step S132, the leaf node information output unit 430 outputs a message indicating that the leaf node has been tampered with.

[0159] On the other hand, if both the checksum verification result Bc and the leaf node tag verification result Bt indicate OK (YES in S130), in step S140, the counter recovery unit 450 recovers the counters of the upper nodes (intermediate nodes and root node). That is, the counter recovery unit 450 recovers the counters of the upper nodes other than the leaf nodes, as described above, using the leaf node counters included in the verified leaf node information Leaf. In step S142, the tag generation unit 460 generates tags for the upper nodes using the recovered counters of the upper nodes. In step S144, the tree structure output unit 470 outputs the newly constructed tree structure. In addition, the memory address output unit 480 outputs the memory address Add.

[0160] [Effect description] The technology disclosed in Non-Patent Document 1 achieves crash consistency by the method described below. That is, as described above, the technology disclosed in Non-Patent Document 1 uses a simple up-counter that is incremented by +1 every time a node is updated in a tree structure in which each node can be updated in parallel, to determine whether or not information in a leaf node has been tampered with in the event of a crash.

[0161] Specifically, in a tree structure, when a leaf node is updated, all nodes on the path from that leaf node to the root node are updated. Therefore, unless tampering has occurred, the counter of the root node should be the sum of the local counters of the leaf nodes. Furthermore, since the information of the root node is stored on-chip, which is a secure area, the counter of the root node cannot be tampered with by an attacker. Therefore, the technology disclosed in Non-Patent Document 1 calculates the sum of the counters of the leaf nodes when a crash occurs and determines whether the calculation result matches the counter of the root node stored on-chip. If the sum of the counters of the leaf nodes does not match the counter of the root node, it is determined that the counter of the leaf node has been tampered with. In this way, it is possible to determine whether the counter of the leaf node has been tampered with.

[0162] As described above, in the technology disclosed in Non-Patent Document 1, the counter of a node is a simple up-counter that is incremented by +1 each time the node is updated. When such a counter is used, as described above, unless tampering has occurred, the counter of the root node is the sum of the local counters of the leaf nodes. In contrast, when a compressed counter is used as the counter of a node, as described above, if a node is updated and the value of the minor counter McTR exceeds the maximum value, an overflow occurs and the minor counter McTR is reset. Therefore, regardless of whether an attack has occurred, the sum of the local counters of the leaf nodes may not match the counter of the root node. Therefore, the technology disclosed in Non-Patent Document 1 cannot be applied to cases where a compressed counter is used as the counter of a node.

[0163] In contrast, the memory protection system 1 according to the present disclosure is configured to calculate a first checksum S using a calculation method that calculates different checksums for different leaf node counters and store the first checksum S in a secure area (first area). The memory protection system 1 according to the present disclosure is also configured to, when a crash occurs, obtain the first checksum S from the first area and calculate a second checksum S' based on the leaf node counter. The memory protection system 1 according to the present disclosure is then configured to verify the checksums by comparing the first checksum S with the second checksum S' and verify the tags related to the leaf nodes. In this manner, the memory protection system 1 according to the present disclosure is configured to verify whether or not a leaf node has been tampered with when a memory crash occurs. Therefore, in a configuration that uses a tree structure for memory protection, the memory protection system 1 according to the present disclosure can appropriately verify whether or not a leaf node has been tampered with when a crash occurs, even if the counters are compressed. The memory protection system 1 according to the present disclosure can also recover the tree structure if the leaf node has not been tampered with. Therefore, in a configuration that uses a tree structure for memory protection, the memory protection system 1 according to the present disclosure can efficiently recover the tree structure even if the counters are compressed.

[0164] Furthermore, the memory protection system 1 according to the present disclosure is configured to construct a new tree structure if no tampering has been performed on the leaf nodes. Specifically, the memory protection system 1 according to the present disclosure uses the leaf node counter to calculate the maximum value that the counter of an upper node, which is a node other than the leaf node in the tree structure, could have taken before the crash. The memory protection system 1 according to the present disclosure then constructs a new tree structure by calculating tags for the upper nodes (intermediate nodes and the root node) based on the maximum value. This configuration allows the tree structure to be properly restored even if the leaf node counter is compressed.

[0165] (Modification of the first embodiment) In the first embodiment described above, an example of a memory protection system that uses authenticated encryption (AE) to verify memory and encrypt input plaintext to conceal it has been described, but the present disclosure is not limited to this configuration. The memory protection system 1 according to the present disclosure may also be configured to detect memory tampering using MAC. In this case, the memory protection system 1 according to the present disclosure may also be configured as follows.

[0166] The tag generation unit 102 of the memory structure initialization device 10 generates a tag for tamper detection using the plaintext M output by the plaintext input unit 100, the memory address set Add output by the memory address allocation unit 101, and the secret key K. The above-mentioned MAC function is used for tag generation. First, the tag generation unit 102 generates data expressed by the following equation 34 as a tag to be used in a leaf node. (Formula 34) TagLeaf=((M[1],Tag(d,1)),(M[2],Tag(d,2)),···,(M[2^d],Tag(d,2^d))) Tag(d,j_d)=MAC_K(add(d,j_d)||ctr(d,j_d),M[j_d]) However, 1<=j_d<=2^d

[0167] Next, the tag generation unit 102 generates data expressed by the following formula 35 as a tag to be used at the intermediate node. (Formula 35) TagInter=(Tag(1,1),...,Tag(d-1,2^{d-1})) Tag(i,j_i)=MAC_K(add(i,j_i)||ctr(i,j_i),ctr(i+1,2j_i-1)||ctr(i+1,2j_i)) where 1<=i<=d-1, 1<=j_i<=2^i

[0168] Next, the tag generating unit 102 generates data expressed by the following formula 36 as a tag to be used in the root node. (Formula 36) TagRoot=(Tag(0,1)) Tag(0,1)=MAC_K(add(0,1)||ctr(0,1),ctr(1,1)||ctr(1,2))

[0169] From Equation 34, Equation 35, and Equation 36, the tags corresponding to each node are as follows. That is, for leaf nodes, the tag corresponding to each node corresponds to the calculation result of a MAC in which the concatenation of the memory address of the node and the local counter value is used as the nonce, and the plaintext block corresponding to the node is used as the plaintext, and the nonce and plaintext are used as inputs. Also, for nodes other than leaf nodes, the tag corresponding to each node corresponds to the calculation result of a MAC in which the concatenation of the memory address of the node and the local counter value is used as the nonce, and the concatenation of the local counter values ​​of multiple child nodes is used as the plaintext, and the nonce and plaintext are used as inputs.

[0170] When the depth d of the entire tree structure is d=3, the tag corresponding to each node is expressed by the following formula 37. Here, i is the depth index, and j_i is the index (order; ordinal number) of the node at depth i. (Formula 37) For 0<=i<=3,1<=j_i<=2^i, (For 0<=i<=2) Tag(i,j_i)=MAC_K(add(i,j_i)||ctr(i,j_i),ctr(i+1,2j_i-1)||ctr(i+1,2j_i)) (For i=3) Tag(i,j_i)=MAC_K(add(i,j_i)||ctr(i,j_i),M[j_i])

[0171] Then, the tag generation unit 102 outputs the tag set TagLeaf to the leaf node generation unit 103. The tag generation unit 102 also outputs the tag set TagInter to the intermediate node generation unit 104. The tag generation unit 102 also outputs the tag set TagRoot to the root node generation unit 105.

[0172] The leaf node generation unit 103 generates leaf nodes in a tree structure using the tag set TagLeaf output by the tag generation unit 102. Here, since the depth i=d in the leaf nodes, 1<=j_d<=2^d holds. Then, the j_dth leaf node is generated as shown in the following formula 38. (Formula 38) (ctr(d,j_d),M[j_d],Tag(d,j_d))

[0173] Also, all leaf nodes are written as in the following Expression 39. (Formula 39) Leaf=((ctr(d,1),M[1],Tag(d,1)),((ctr(d,2),M[2],Tag(d,2)),...,(ctr(d,2^d),M[2^d],Tag(d,2^d))) Furthermore, the leaf node generating unit 103 outputs the generated leaf node set Leaf to the tree structure output unit 106 .

[0174] In the above-described modified example, the memory verification device 20 receives as input the storage location of the plaintext (plaintext block) to be checked for tampering, the tree structure, and the memory address of each node in the tree structure, and verifies whether the memory corresponding to the storage location has been tampered with. The tag verification unit 203 of the memory verification device 20 according to the modified example verifies whether the memory specified by CheckNode has been tampered with, using the tree structure Tree, the memory address set Add, the verification location CheckNode, and the private key K. The tag verification unit 203 then outputs the verification result to the verification result output unit 204.

[0175] Specifically, first, the tag verification unit 203 generates a path Path from the CheckNode-th leaf node to the root node. Here, the path Path is data indicating the route of nodes from the leaf node to the root node. The path Path is expressed by the following Expression 40. (Formula 40) Path=((d,p_d),(d-1,p_{d-1}),(d-2,p_{d-2}),···,(1,p_1),(0,p_0))

[0176] Here, when 0<=i<=d, 1<=j_i<=2^{i}, each element (i, j_i) of Path represents the j_ith node at depth i. In other words, j_i indicates the ordinal number of the node at depth i. Note that when p_d=CheckNode and 0<=i<=d-1, p_i is defined by the following formula 41. (Formula 41) p_i=ceiling(p_{i+1} / 2) where ceiling(·) represents the ceiling function, and the value of p_0 is always 1.

[0177] Next, the tag verification unit 203 calculates the following equation 42 using Add, which is the output of the memory address input unit 201, the tree structure Tree, which is the output of the tree structure input unit 200, and the private key K. (Formula 42) PathTag'=(Tag'(d,p_d),Tag'(d-1,p_{d-1}),···,Tag'(0,p_0)) Tag'(d,p_d)=MAC_K(add(d,p_d)||ctr(d,p_d),M[p_d]) Tag'(i,p_i)=MAC_K(add(i,p_i)||ctr(i,p_i),ctr(i+1,2p_i-1)||ctr(i+1,2p_i)) where 0<=i<=d-1

[0178] Here, MAC_K is substantially the same as the method used in the tag generation unit 102 of the memory structure initialization device 10 in the modified example of the first embodiment, and therefore a description thereof will be omitted. Tag'(i, p_i) is obtained by inputting the concatenation of the address of the node and the local counter into the nonce part of the input of the MAC function, and inputting the concatenation of two local counters of child nodes of the node into the plaintext part of the input of the MAC function.

[0179] Next, the tag verifying unit 203 obtains the value expressed by the following formula 43 from the tree structure Tree that is the output of the tree structure input unit 200. (Formula 43) PathTag=(Tag(d,p_d),Tag(d-1,p_{d-1}),···,Tag(0,p_0))

[0180] Then, the tag verification unit 203 checks whether the PathTag' calculated by itself is equal to the PathTag acquired from the Tree. When 0<=i<=d, for all i, Tag'(i,p_i)=Tag(i,p_i) If the above holds, the tag verification unit 203 sets the verification result to ACK. The verification result is denoted as B, and the fact that the verification result is ACK is denoted as B=ACK.

[0181] On the other hand, when 0<=i<=d, for some i, Tag'(i,pi)≠Tag(i,pi) If the above holds, the tag verification unit 203 sets the verification result to NCK. Furthermore, the fact that the verification result is NCK is expressed as B=NCK.

[0182] In the above-described modified example, the memory updating device 30 receives as input the storage location of the plaintext (plaintext block) to be updated, the update content, the tree structure, and the memory address of each node in the tree structure. The memory updating device 30 then outputs the updated tree structure or an error message indicating that tampering has been detected.

[0183] The memory verification unit 303 according to the modified example verifies whether the memory specified by UpdateNode has been tampered with, using a tree structure Tree, a memory address set Add, memory update information UpdateNode, and a secret key K. That is, the memory verification unit 303 verifies whether the node corresponding to the path related to the leaf node specified by UpdateNode has been tampered with. The processing performed by the memory verification unit 303 is substantially the same as the processing performed by the tag verification unit 203 in the memory verification device 20 of the first embodiment, but the output result is different. The tag verification unit 203 in the memory verification device 20 of the first embodiment outputs a verification result B, but the memory verification unit 303 also outputs a path Path from the node in question to the root node along with the verification result B.

[0184] The tag update unit 305 according to the modified example updates the tag of the node specified by Path using the tree structure NewTree' of the update result, the memory address set Add, the memory update information UpdateNode, the verification result B, the path Path, and the private key K. If B=ACK, the tag update unit 305 performs the calculation of the following equation 44 for 0<=i<=d-1. (Formula 44) Tag(d,p_d)←MAC_K(add(d,p_d)||ctr(d,p_d),UpdateInfo) Tag(i,p_i)←MAC_K(add(i,p_i)||ctr(i,p_i),ctr(i+1,2p_i-1)||ctr(i+1,2p_i))

[0185] MAC_K is the same as the method used in the tag generation unit 102 of the memory structure initialization device 10 in the modified example of the first embodiment and the tag verification unit 203 of the memory verification device 20 in the modified example of the first embodiment. Tag(i, p_i) is obtained by inputting the concatenation of the address of the node and the local counter into the nonce part of the input of the MAC function, and inputting the concatenation of two local counters of child nodes of the node into the plaintext part of the input of the MAC function.

[0186] Furthermore, the leaf node tag verification unit 420 of the memory protection device 40 according to the above-described modified example verifies, using MAC, whether the leaf node information Leaf output from the leaf node information input unit 404 has been tampered with. The leaf node tag verification unit 420 verifies whether each leaf node has been tampered with, using the memory address set Add, the leaf node information Leaf, and the secret key K. Specifically, the leaf node tag verification unit 420 calculates the following equation 45 for all leaf nodes (d, j_d). (Formula 45) Tag'(d,j_d)=MAC_K(add(d,j_d)||ctr(d,j_d),M[j_d])

[0187] Then, the leaf node tag verification unit 420 checks whether the Tag' calculated by itself is equal to the tag of the leaf node acquired from Leaf. Tag'(d,j_d)=Tag(d,j_d) If this is true, the leaf node tag validator 420 sets the validation result Bt to OK.

[0188] On the other hand, for any leaf node, Tag'(d,j_d)≠Tag(d,j_d) If the above holds, the leaf node tag validator 420 sets the verification result Bt to NG.

[0189] In the above-described modified example, components other than those described above are substantially similar to those of the first embodiment, and therefore description thereof will be omitted. The above-described modified example also achieves substantially the same effects as those achieved by the first embodiment.

[0190] (Second embodiment) Next, a second embodiment will be described, which corresponds to the outline of the first embodiment.

[0191] FIG. 15 is a diagram showing the configuration of a memory protection device 50 according to the present disclosure. The memory protection device 50 shown in FIG. 15 corresponds to the memory protection device 40 described above. The memory protection device 50 has an input unit 502, a checksum acquisition unit 504, and a leaf node verification unit 506. The input unit 502 functions as an input means (second input means). The checksum acquisition unit 504 functions as a checksum acquisition means. The leaf node verification unit 506 functions as a leaf node verification means.

[0192] The input unit 502 can be realized by substantially the same functions as those of the above-described leaf node information input unit 404. The checksum acquisition unit 504 can be realized by substantially the same functions as those of the above-described checksum acquisition unit 406. The leaf node verification unit 506 can be realized by substantially the same functions as those of the above-described checksum verification unit 410 and leaf node tag verification unit 420.

[0193] 16 is a flowchart showing a memory protection method executed by the memory protection device 50 according to the present disclosure. In step S202, the input unit 502 inputs information about a tree structure configured to protect memory, the tree structure being capable of updating each node in parallel. The input unit 502 inputs information including at least a counter that is updated each time node information is updated. The information about the tree structure includes leaf node information including the counter, ciphertext, and tag of the leaf node.

[0194] In step S204, the checksum acquisition unit 504 acquires a first checksum calculated by a first calculation method based on the compressed leaf node counter and stored in a secure first area. As described above, the leaf node counter is compressed by sharing a portion of the counter among multiple leaf nodes. Also, as described above, the first calculation method is a calculation method in which different checksums are calculated for different leaf node counters.

[0195] In step S206, the leaf node verification unit 506 verifies whether or not the leaf node has been tampered with when a memory crash occurred. The leaf node verification unit 506 calculates a second checksum using a first calculation method based on the leaf node counter. The leaf node verification unit 506 then compares the first checksum with the second checksum to verify the checksum. The leaf node verification unit 506 also verifies tags related to the leaf node. Through these verifications, the leaf node verification unit 506 verifies whether or not the leaf node has been tampered with when a memory crash occurred.

[0196] The memory protection device 50 according to the present disclosure can appropriately verify whether or not a leaf node has been tampered with when a crash occurs, even if the counter is compressed in a configuration that uses a tree structure for memory protection. Furthermore, the memory protection device 50 according to the present disclosure can recover the tree structure if the leaf node has not been tampered with. Therefore, the memory protection device 50 according to the present disclosure can efficiently recover the tree structure, even if the counter is compressed in a configuration that uses a tree structure for memory protection.

[0197] (Example of hardware configuration) An example of the configuration of hardware resources for realizing the devices and systems according to the above-described embodiments using one calculation processing device (information processing device, computer) will be described. However, the devices according to the embodiments (authentication encryption device and authentication decryption device) may be realized physically or functionally using at least two calculation processing devices. Furthermore, the devices according to the embodiments may be realized as dedicated devices or general-purpose information processing devices.

[0198] FIG. 17 is a block diagram schematically illustrating an example of the hardware configuration of a calculation processing device capable of realizing an apparatus and system according to the present disclosure. The calculation processing device 1000 includes a CPU 1001, a volatile storage device 1002, a disk 1003, a non-volatile recording medium 1004, and a communication IF (Interface) 1007. Therefore, it can be said that the apparatus according to each embodiment includes the CPU 1001, the volatile storage device 1002, the disk 1003, the non-volatile recording medium 1004, and the communication IF 1007. The calculation processing device 1000 may be connectable to an input device 1005 and an output device 1006. The calculation processing device 1000 may also include the input device 1005 and the output device 1006. Furthermore, the calculation processing device 1000 can transmit and receive information to and from other calculation processing devices and communication devices via the communication IF 1007.

[0199] The nonvolatile recording medium 1004 is a computer-readable medium, such as a compact disc or a digital versatile disc. The nonvolatile recording medium 1004 may also be a USB (Universal Serial Bus) memory, a solid state drive, or the like. The nonvolatile recording medium 1004 stores the program and allows portability without requiring a power supply. The nonvolatile recording medium 1004 is not limited to the above-mentioned medium. The program may also be supplied via the communication IF 1007 and a communication network instead of the nonvolatile recording medium 1004.

[0200] The volatile storage device 1002 is computer-readable and can temporarily store data. The volatile storage device 1002 is a memory such as a dynamic random access memory (DRAM) or a static random access memory (SRAM).

[0201] That is, when executing a software program (computer program: hereinafter simply referred to as "program") stored on disk 1003, CPU 1001 copies the program to volatile storage device 1002 and executes arithmetic processing. CPU 1001 reads data required to execute the program from volatile storage device 1002. When display is required, CPU 1001 displays the output result on output device 1006. When a program is input from outside, CPU 1001 acquires the program from input device 1005. CPU 1001 interprets and executes programs corresponding to the functions (processing) of each component shown in FIGS. 2 to 8 and 15 described above. CPU 1001 executes the processing described in each of the above-mentioned embodiments. In other words, the functions of each component shown in FIGS. 2 to 8 and 15 described above can be realized by CPU 1001 executing a program stored on disk 1003 or volatile storage device 1002.

[0202] That is, each of the embodiments can be realized by the above-described programs. Furthermore, each of the embodiments can be realized by a computer-readable non-volatile recording medium on which the above-described programs are recorded.

[0203] (Variation) The present invention is not limited to the above-described embodiment, and can be modified as appropriate without departing from the spirit of the invention. For example, in the above-described flowchart, the order of each process (step) can be modified as appropriate. Furthermore, one or more of the multiple processes (steps) may be omitted.

[0204] For example, in Fig. 12, if the verification result of S122 is verification NG, the process of S124 may be omitted and the process flow may proceed to S132. Also, in Fig. 12, the process of S124 may be executed before the process of S122. In this case, if the verification result of S124 is verification NG, the process of S122 may be omitted and the process flow may proceed to S132. Also, in Fig. 12, the process of S124 may be executed in parallel with the process of S122. In this case, if the verification result of either S122 or S124 is verification NG, the process of the other may be omitted and the process flow may proceed to S132.

[0205] Although the present disclosure has been described above with reference to the embodiments, the present disclosure is not limited to the above-described embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure. Furthermore, each embodiment can be combined with other embodiments as appropriate.

[0206] Each drawing is merely an example for describing one or more embodiments. Each drawing may relate not only to one particular embodiment, but also to one or more other embodiments. As will be understood by those skilled in the art, various features or steps described with reference to any one drawing can be combined with features or steps shown in one or more other drawings to create, for example, an embodiment not explicitly shown or described. Not all features or steps shown in any one drawing are necessary to describe an exemplary embodiment, and some features or steps may be omitted. The order of steps described in any drawing may be changed as appropriate.

[0207] The above-mentioned program includes a set of instructions (or software code) that, when loaded into a computer, causes the computer to perform one or more functions described in the embodiments. The program may be stored in a non-transitory computer-readable medium or a tangible storage medium. By way of example and not limitation, computer-readable media or tangible storage media include random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD) or other memory technologies, CD-ROM, digital versatile disk (DVD), Blu-ray® disk or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device. The program may also be transmitted on a transitory computer-readable medium or communication medium. By way of example and not limitation, transitory computer-readable media or communication media include electrical, optical, acoustic, or other forms of propagated signals.

[0208] A part or all of the above-described embodiments can be described as, but not limited to, the following supplementary notes. (Appendix 1) an input means for inputting information about a tree structure configured to protect memory, the tree structure being capable of updating each node in parallel, the information including a counter that is updated at least each time information about a node is updated; a checksum acquisition means for acquiring a first checksum calculated by a first calculation method, which is a leaf node counter related to a leaf node in the tree structure, and which is a calculation method in which different checksums are calculated for different leaf node counters based on compressed leaf node counters in which a portion of the counter is shared among a plurality of the leaf nodes, and which is stored in a secure first area; a leaf node verification means for verifying whether or not the leaf node has been tampered with when a memory crash occurs by calculating a second checksum by the first calculation method based on the leaf node counter, comparing the first checksum with the second checksum to verify the checksum, and verifying a tag related to the leaf node; A memory protection device comprising: (Appendix 2) The leaf node counter is updated so as to monotonically increase as the leaf node corresponding to the leaf node counter is updated. 2. The memory protection device of claim 1. (Appendix 3) the first calculation method is a calculation method in which the checksum is monotonically increasing or monotonically decreasing as the leaf node counter is updated; 3. The memory protection device of claim 2. (Appendix 4) The first calculation method is a calculation method using at least one of the four arithmetic operations. 4. The memory protection device of claim 3. (Appendix 5) the first calculation method is a calculation method for calculating a checksum by adding up the leaf node counters; 5. The memory protection device of claim 4. (Appendix 6) A portion of the leaf node counter is shared by all leaf nodes that have the same parent node, The first calculation method is a calculation method for calculating a checksum by summing up all of the leaf node counters. 6. The memory protection device of claim 5. (Appendix 7) a node recovery means for, when the leaf node has not been tampered with, using the leaf node counter, calculating the maximum value of the counter of an upper node, which is a node other than the leaf node in the tree structure, that could have taken on before the crash, and calculating a tag related to the upper node based on the maximum value, thereby newly constructing the tree structure; 2. The memory protection device of claim 1, further comprising: (Appendix 8) a memory structure initialization device that receives plaintext for which tampering detection is desired as input, and outputs a tree structure that is at least an initial state tree structure configured to protect the memory, and that allows each node of the tree structure to be updated in parallel; a memory verification device that receives as input at least a storage location of plaintext to be checked for tampering and a tree structure, and verifies whether or not a memory corresponding to the storage location has been tampered with; a memory updating device that receives as input at least the storage location of the plaintext to be updated, the update content, and the tree structure, and outputs the updated tree structure or an error message indicating that tampering has been detected; a memory protection device that performs processing to protect the memory when a crash occurs to the memory; and The memory update device includes: a first input means for inputting information about the tree structure, the information including at least a counter that is updated each time information about a node is updated; a checksum calculation means for calculating a first checksum by a first calculation method, which is a calculation method in which a different checksum is calculated for a different leaf node counter each time the leaf node is updated, based on a leaf node counter that is a counter related to a leaf node in the tree structure and that is compressed by sharing a part of the counter among a plurality of the leaf nodes; a checksum storage means for storing the first checksum in a secure first area; and The memory protection device includes: a second input means for inputting information about the tree structure; a checksum acquisition means for acquiring a first checksum stored in the first area; a leaf node verification means for verifying whether or not the leaf node has been tampered with when a memory crash occurs by calculating a second checksum by the first calculation method based on the leaf node counter, comparing the first checksum with the second checksum to verify the checksum, and verifying a tag related to the leaf node; having Memory protection system. (Appendix 9) inputting information about a tree structure configured to protect memory, in which each node of the tree structure can be updated in parallel, the information including at least a counter that is updated each time information about a node is updated; a first checksum calculated by a first calculation method, which is a calculation method in which different checksums are calculated for different leaf node counters based on leaf node counters that are compressed by sharing a portion of the counter among a plurality of the leaf nodes, and stored in a secure first area; calculating a second checksum by the first calculation method based on the leaf node counter, comparing the first checksum with the second checksum to verify the checksum, and verifying a tag related to the leaf node to verify whether or not the leaf node has been tampered with when a memory crash occurs; Memory protection methods. (Appendix 10) The leaf node counter is updated so as to monotonically increase as the leaf node corresponding to the leaf node counter is updated. 10. The memory protection method of claim 9. (Appendix 11) the first calculation method is a calculation method in which the checksum is monotonically increasing or monotonically decreasing as the leaf node counter is updated; 11. The memory protection method of claim 10. (Appendix 12) The first calculation method is a calculation method using at least one of the four arithmetic operations. 12. The memory protection method of claim 11. (Appendix 13) the first calculation method is a calculation method for calculating a checksum by adding up the leaf node counters; 13. The memory protection method of claim 12. (Appendix 14) A portion of the leaf node counter is shared by all leaf nodes that have the same parent node, The first calculation method is a calculation method for calculating a checksum by summing up all of the leaf node counters. 14. The memory protection method of claim 13. (Appendix 15) If the leaf node has not been tampered with, the leaf node counter is used to calculate the maximum value that a counter of an upper node, which is a node other than the leaf node in the tree structure, could have taken before the crash, and a tag related to the upper node is calculated based on the maximum value, thereby newly constructing the tree structure. 10. The memory protection method of claim 9. (Appendix 16) inputting information about a tree structure configured to protect memory, the tree structure being capable of updating each node in parallel, the information including at least a counter that is updated each time information about a node is updated; a step of acquiring a first checksum calculated by a first calculation method, the first checksum being a leaf node counter related to a leaf node in the tree structure, the first checksum being calculated by a first calculation method being a calculation method in which different checksums are calculated for different leaf node counters based on compressed leaf node counters by sharing a portion of the counter among a plurality of the leaf nodes, and the first checksum being stored in a secure first area; calculating a second checksum based on the leaf node counter using the first calculation method, comparing the first checksum with the second checksum to verify the checksum, and verifying a tag related to the leaf node to verify whether the leaf node has been tampered with when a memory crash occurs; A program that causes a computer to execute the following.

[0209] Some or all of the elements (e.g., configurations and functions) described in Supplementary Notes 2 to 7 that are dependent on Supplementary Note 1 may also be dependent on Supplementary Notes 8 and 16 in the same dependency relationship as Supplementary Notes 2 to 7. Some or all of the elements described in any Supplementary Note may be applied to various hardware, software, recording means for recording software, systems, and methods. [Explanation of symbols]

[0210] 1. Memory Protection System 10 Memory structure initialization device 20 Memory Verification Device 30 Memory update device 40 Memory Protection Device 50 Memory Protection Device 100 Plaintext input section 101 Memory address allocation unit 102 Tag Generation Unit 103 Leaf node generation unit 104 Intermediate node generation unit 105 Root node generation unit 106 Tree structure output unit 107 Memory address output section 110 Checksum storage area generator 200 Tree structure input section 201 Memory address input section 202 Verification point input section 203 Tag Verification Unit 204 Verification result output section 300 Tree structure input unit 301 Memory address input section 302 Update input section 303 Memory Verification Department 304 Counter Update Unit 305 Tag Update Section 306 Update result output section 310 Checksum calculation unit 312 Checksum storage section 400 Leaf Node Verification Unit 402 Memory address input section 404 Leaf node information input section 406 Checksum Acquisition Unit 410 Checksum Verification Unit 420 Leaf Node Tag Verification Unit 430 Leaf node information output unit 440 Node Recovery Unit 442 Leaf node information input section 444 Memory address input section 450 Counter Recovery Unit 460 Tag Generation Unit 470 Tree structure output unit 480 Memory address output section 502 Input section 504 Checksum Acquisition Unit 506 Leaf Node Verification Unit

Claims

1. an input means for inputting information about a tree structure configured to protect memory, the tree structure being capable of updating each node in parallel, the information including a counter that is updated at least each time information about a node is updated; a checksum acquisition means for acquiring a first checksum calculated by a first calculation method, which is a leaf node counter related to a leaf node in the tree structure, and which is a calculation method in which different checksums are calculated for different leaf node counters based on compressed leaf node counters in which a portion of the counter is shared among a plurality of the leaf nodes, and which is stored in a secure first area; a leaf node verification means for verifying whether or not the leaf node has been tampered with when a memory crash occurs by calculating a second checksum by the first calculation method based on the leaf node counter, comparing the first checksum with the second checksum to verify the checksum, and verifying a tag related to the leaf node; A memory protection device comprising:

2. The leaf node counter is updated so as to monotonically increase as the leaf node corresponding to the leaf node counter is updated.

2. The memory protection device of claim 1.

3. the first calculation method is a calculation method in which the checksum is monotonically increasing or monotonically decreasing as the leaf node counter is updated; 3. The memory protection device of claim 2.

4. the first calculation method is a calculation method using at least one of the four arithmetic operations; 4. The memory protection device of claim 3.

5. the first calculation method is a calculation method for calculating a checksum by adding up the leaf node counters; 5. The memory protection device of claim 4.

6. A portion of the leaf node counter is shared by all leaf nodes that have the same parent node, the first calculation method is a calculation method for calculating a checksum by summing up all of the leaf node counters; 6. The memory protection device of claim 5.

7. a node recovery means for, when the leaf node has not been tampered with, using the leaf node counter, calculating the maximum value of the counter of an upper node, which is a node other than the leaf node in the tree structure, that could have taken on before the crash, and calculating a tag related to the upper node based on the maximum value, thereby newly constructing the tree structure; 10. The memory protection device of claim 1, further comprising:

8. a memory structure initialization device that receives plaintext for which tampering detection is desired as input, and outputs a tree structure that is at least an initial state tree structure configured to protect the memory, and that allows each node of the tree structure to be updated in parallel; a memory verification device that receives as input at least a storage location of plaintext to be checked for tampering and a tree structure, and verifies whether or not a memory corresponding to the storage location has been tampered with; a memory updating device that receives as input at least the storage location of the plaintext to be updated, the update content, and the tree structure, and outputs the updated tree structure or an error message indicating that tampering has been detected; a memory protection device that performs processing to protect the memory when a crash occurs to the memory; and The memory update device includes: a first input means for inputting information about the tree structure, the information including at least a counter that is updated each time information about a node is updated; a checksum calculation means for calculating a first checksum by a first calculation method, which is a calculation method in which a different checksum is calculated for a different leaf node counter each time the leaf node is updated, based on a leaf node counter that is a counter related to a leaf node in the tree structure and that is compressed by sharing a part of the counter among a plurality of the leaf nodes; and a checksum storage means for storing the first checksum in a secure first area; and The memory protection device includes: a second input means for inputting information about the tree structure; a checksum acquisition unit for acquiring a first checksum stored in the first area; a leaf node verification means for verifying whether or not the leaf node has been tampered with when a memory crash occurs by calculating a second checksum by the first calculation method based on the leaf node counter, comparing the first checksum with the second checksum to verify the checksum, and verifying a tag related to the leaf node; having Memory protection system.

9. inputting information about a tree structure configured to protect memory, in which each node of the tree structure can be updated in parallel, the information including at least a counter that is updated each time information about a node is updated; a first checksum is calculated by a first calculation method, the first checksum being a leaf node counter related to a leaf node in the tree structure, the first checksum being calculated by a first calculation method being a calculation method in which different checksums are calculated for different leaf node counters based on compressed leaf node counters in which a portion of the counter is shared among a plurality of the leaf nodes, and the first checksum is stored in a secure first area; calculating a second checksum by the first calculation method based on the leaf node counter, comparing the first checksum with the second checksum to verify the checksum, and verifying a tag related to the leaf node to verify whether or not the leaf node has been tampered with when a memory crash occurs; Memory protection methods.

10. The leaf node counter is updated so as to monotonically increase as the leaf node corresponding to the leaf node counter is updated.

10. The memory protection method of claim 9.

11. the first calculation method is a calculation method in which the checksum is monotonically increasing or monotonically decreasing as the leaf node counter is updated; The memory protection method of claim 10.

12. the first calculation method is a calculation method using at least one of the four arithmetic operations; The memory protection method of claim 11.

13. the first calculation method is a calculation method for calculating a checksum by adding up the leaf node counters; 13. The memory protection method of claim 12.

14. A portion of the leaf node counter is shared by all leaf nodes that have the same parent node, the first calculation method is a calculation method for calculating a checksum by summing up all of the leaf node counters; 14. The memory protection method of claim 13.

15. If the leaf node has not been tampered with, the leaf node counter is used to calculate the maximum value that a counter of an upper node, which is a node other than the leaf node in the tree structure, could have taken before the crash, and a tag related to the upper node is calculated based on the maximum value, thereby newly constructing the tree structure.

10. The memory protection method of claim 9.

16. inputting information about a tree structure configured to protect memory, the tree structure being capable of updating each node in parallel, the information including at least a counter that is updated each time information about a node is updated; a step of acquiring a first checksum calculated by a first calculation method, the first checksum being a leaf node counter related to a leaf node in the tree structure, the first checksum being calculated by a first calculation method in which different checksums are calculated for different leaf node counters based on compressed leaf node counters in which a portion of the counter is shared among a plurality of the leaf nodes, and the first checksum being stored in a secure first area; calculating a second checksum by the first calculation method based on the leaf node counter, comparing the first checksum with the second checksum to verify the checksum, and verifying a tag related to the leaf node to verify whether the leaf node has been tampered with when a memory crash occurs; A program that causes a computer to execute the following.

Images