Update resource distribution system and update resource distribution method

Abstract

To enable secure distribution of an update resource.SOLUTION: An encryption server 11 generates a second encryption update resource by additional encryption by a first individual key to a first encryption update resource obtained by encrypting an update resource by a common key held by each of a plurality of IoT devices 21. A distribution server 13 distributes the second encryption update resource to an IoT device 21a, and the IoT device 21a decrypts the first encryption update resource by the first individual key, and decrypts the update resource by the common key held by itself. The first individual key is generated on the basis of identification information of the distribution server 13 and the IoT device 21a. The IoT device 21a generates a third encryption update information by additional encryption by a second individual key to the decrypted first encryption update resource and distributes it to an IoT device 21b. The second individual key is generated on the basis of identification information of the IoT devices 21a and 21b.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a technology for distributing update resources used for updating software. [Background technology]

[0002] BACKGROUND ART Techniques for updating software installed in devices used in IoT (Internet of Things) are known (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2018-41224 Summary of the Invention [Problem to be solved by the invention]

[0004] When distributing update resources used to update common software used by multiple devices, encryption using a common key is sometimes performed. However, if the devices are installed in unmanned factories or other locations where third parties can easily obtain the distributed update resources, there is a risk that the devices may be subject to attacks such as the installation of unauthorized software if the common key is leaked to a third party due to a vulnerability in the devices. [Means for solving the problem]

[0005] An update resource distribution system according to one embodiment includes a plurality of devices each having a common software installed therein, a distribution device that distributes update resources used for updating the software, and an encryption device that encrypts the update resources. The encryption device generates a first encrypted update resource by encrypting the update resource using a common key held by each of the plurality of devices. The encryption device also generates a second encrypted update resource by encrypting the first encrypted update resource using a first individual key generated based on identification information for the distribution device and first identification information for a first device that is one of the plurality of devices. The distribution device distributes the second encrypted update resource to the first device as the update resource. The first device decrypts the first encrypted update resource from the second encrypted update resource distributed by the distribution device using the first individual key generated based on first identification information, which is its own identification information, and identification information for the distribution device. The first device also decrypts the update resource from the first encrypted update resource using the common key held by itself. Furthermore, the first device generates a third encrypted update resource by encrypting the first encrypted update resource decrypted from the second encrypted update resource using a second individual key generated based on the first identification information and second identification information for the second device. The second device is one of multiple devices other than the first device. The first device then distributes the third encrypted update resource to the second device. [Effects of the Invention]

[0006] According to the above aspect, it is possible to securely distribute update resources. [Brief explanation of the drawings]

[0007] [Figure 1] 1 illustrates a configuration of an updated resource distribution system as an example of an embodiment. [Figure 2] FIG. 10 is a diagram illustrating an example of device configuration information data. [Figure 3A] 10 is a flowchart showing the processing content of a first example of device configuration information distribution processing. [Figure 3B]10 is a flowchart showing the processing content of a second example of device configuration information distribution processing. [Figure 4] FIG. 1 is a diagram illustrating an example of a configuration of an IoT device. [Figure 5] 1 is a diagram illustrating an example of the operation of distributing updated resources and updating software by a resource update distribution system. [Figure 6] FIG. 10 is a diagram showing an example of distribution plan data. [Figure 7] FIG. 10 is a diagram illustrating details of the encryption process performed by the encryption server. [Figure 8] FIG. 2 is a diagram illustrating an example of a data structure of a communication packet. [Figure 9] FIG. 10 is a diagram illustrating details of a decryption process performed by an update control application. [Figure 10] FIG. 10 is a diagram illustrating details of an additional encryption process performed by the update control application. [Figure 11] 10 is a flowchart showing a procedure of a process performed in a data center. [Figure 12] 10 is a flowchart showing the procedure of processing performed in an IoT device. [Figure 13] 10 is a flowchart showing the procedure of an update process. DETAILED DESCRIPTION OF THE INVENTION

[0008] Hereinafter, embodiments will be described in detail with reference to the drawings.

[0009] First, a description will be given of Fig. 1. Fig. 1 shows the configuration of a resource update distribution system as an example of an embodiment.

[0010] 1, a data center 10 is installed with a configuration management server 11, an encryption server 12, and a distribution server 13. A factory 20 is installed with IoT devices 21a, 21b, 21c, . . . , 21n.

[0011] The IoT devices 21a, 21b, 21c, ..., 21n are respectively connected to equipment 22a, 22b, 22c, ..., 22n installed in a factory 20. The IoT devices 21a, 21b, 21c, ..., 21n control the operation of the equipment 22a, 22b, 22c, ..., 22n, respectively. Common software for performing this operation control is installed in each of the IoT devices 21a, 21b, 21c, ..., 21n.

[0012] The configuration management server 11, the encryption server 12, the distribution server 13, and the IoT device 21a are connected to the Internet 30, and are able to exchange various types of data with one another. As shown in Fig. 1, the configuration management server 11, the encryption server 12, the distribution server 13, and the IoT device 21a may be connected to the Internet 30 using a VPN (Virtual Private Network).

[0013] The IoT devices 21a, 21b, 21c, ..., 21n are connected to a LAN (Local Area Network) 23 installed in the factory 20. In this embodiment, a wireless communication network is used as the LAN 23, but a wired network may also be used. The IoT device 21a has a gateway function that connects the Internet 30 and the LAN 23. Therefore, the configuration management server 11, the encryption server 12, and the distribution server 13 can exchange various types of data with each of the IoT devices 21a, 21b, 21c, ..., 21n via the Internet 30, the IoT device 21a, and the LAN 23.

[0014] In this embodiment, the resource update distribution system is composed of a configuration management server 11, an encryption server 12, a distribution server 13, and IoT devices 21a, 21b, 21c, ..., 21n. This resource update distribution system distributes update resources (e.g., firmware, programs, setting data files, etc.) used to update the common software described above in each of the IoT devices 21a, 21b, 21c, ..., 21n from the data center 10 to the factory 20. In the factory 20, each of the IoT devices 21a, 21b, 21c, ..., 21n receives the update resources and uses the received update resources to perform update processing for the common software described above that is installed on it.

[0015] The configuration management server (configuration management device) 11 is a device that manages information about each device that constitutes the resource update distribution system, and also manages the distribution route plan when distributing updated resources to each device.

[0016] The encryption server (encryption device) 12 is a device that encrypts update resources to be distributed.

[0017] The distribution server (distribution device) 13 is a device that distributes update resources.

[0018] The configuration management server 11, encryption server 12, and distribution server 13 are all computers serving as network server devices that include hardware resources such as a CPU, ROM, RAM, data storage device, and communication network interface. Although the configuration management server 11, encryption server 12, and distribution server 13 are shown in Fig. 1 as separate entities, they may each be configured as a single physical server that functions as a virtual server.

[0019] 1, for example, if factory 20 is operated unmanned, a third party may install a device in factory 20 that intercepts update resources distributed using LAN 23, and the installation may go unnoticed. If this occurs, it is conceivable that the third party may analyze the acquired update resources, develop malicious software based on the analysis results, invade LAN 23, and launch an attack on facilities 22a, 22b, 22c, ..., 22n.

[0020] In the embodiment to be described below, the devices constituting the resource update distribution system function as follows.

[0021] First, the encryption server 12 generates a first encrypted update resource by encrypting the update resource using a common key. This common key is stored in advance in each of the IoT devices 21a, 21b, 21c, ..., 21n.

[0022] The encryption server 12 also generates a second encrypted update resource by encrypting the first encrypted update resource using the first individual key. The encryption server 12 generates this first individual key based on identification information for the distribution server 13 and identification information (first identification information) for the IoT device 21a (first device) that provides a gateway function connecting the Internet 30 and the LAN 23.

[0023] The distribution server 13 distributes the second encrypted update resource generated by the encryption server 12 to the IoT device 21a installed in the factory 20.

[0024] The IoT device 21a receives the second encrypted update resource distributed from the distribution server 13 and uses the first individual key to decrypt the first encrypted update resource from the second encrypted update resource. The IoT device 21a generates the first individual key used to decrypt the second encrypted update resource based on its own identification information (first identification information) and identification information for the distribution server 13.

[0025] Furthermore, the IoT device 21a decrypts the update resource from the first encrypted update resource using the common key held by the IoT device 21a, i.e., the common key used to encrypt the update resource by the encryption server 12. The IoT device 21a updates the common software installed therein using the decrypted update resource.

[0026] Furthermore, the IoT device 21a generates a third encrypted update resource by encrypting the first encrypted update resource decrypted from the second encrypted update resource using a second individual key. The IoT device 21a generates the second individual key based on its own identification information and identification information (second identification information) of one of the IoT devices 21b, 21c, ..., 21n other than the IoT device 21a, for example, the IoT device 21b (second device).

[0027] Then, the IoT device 21a distributes the generated third encrypted update resource to the IoT device 21b.

[0028] Upon receiving the third encrypted update resource distributed from IoT device 21a, IoT device 21b uses the second individual key to decrypt the third encrypted update resource into the first encrypted update resource. IoT device 21b generates the second individual key used to decrypt the third encrypted update resource based on its own identification information (second identification information) and the identification information (first identification information) of IoT device 21a.

[0029] Furthermore, the IoT device 21b decrypts the update resource from the first encrypted update resource using the common key it holds, i.e., the common key used to encrypt the update resource by the encryption server 12. The IoT device 21b uses the decrypted update resource to update the common software installed therein.

[0030] Furthermore, the IoT device 21b generates a fourth encrypted update resource by encrypting the first encrypted update resource decrypted from the third encrypted update resource using a third individual key. The IoT device 21b generates the third individual key based on its own identification information and identification information (third identification information) of one of the IoT devices 21c, ..., 21n other than the IoT devices 21a and 21b, for example, the IoT device 21c (third device).

[0031] Then, the IoT device 21b distributes the generated fourth encrypted update resource to the IoT device 21c.

[0032] Thereafter, IoT devices 21c, ..., IoT device 21n each perform the same processing as that performed by IoT device 21b, thereby distributing updated resources to each of IoT devices 21a, 21b, 21c, ..., 21n installed in factory 20.

[0033] As described above, in the resource update distribution system of this embodiment, an update resource encrypted with a common key is additionally encrypted with an individual key generated based on the identification information of the device of the distribution source and the distribution destination, so that a so-called doubly encrypted update resource is distributed. This increases the difficulty of analyzing the distributed update resource, thereby improving the security of the distribution of the update resource.

[0034] Furthermore, each of the IoT devices 21a, 21b, 21c, ..., 21n can obtain a doubly encrypted update resource to be distributed simply by performing additional encryption on the update resource that has already been encrypted using the common key. This reduces the processing load of the encryption process for generating the update resource to be distributed on each of the IoT devices 21a, 21b, 21c, ..., 21n.

[0035] The resource update distribution system according to this embodiment will be described in further detail below.

[0036] 1, the character string "DC01" assigned to the data center 10 and the character string "FCT01" assigned to the factory 20 are location numbers serving as identification information for identifying the locations where the devices constituting the resource update distribution system are installed. The character strings "SV01," "SV02," and "SV03" assigned to the configuration management server 11, encryption server 12, and distribution server 13 are device IDs (Identifications) serving as identification information for the devices constituting the resource update distribution system. Furthermore, the character strings "DV01," "DV02," "DV03," ..., and "DV(n)" assigned to the IoT devices 21a, 21b, 21c, ..., 21n, respectively, are also device IDs for identifying the devices constituting the resource update distribution system.

[0037] In the following description, when there is no particular need to distinguish between them, the IoT devices 21a, 21b, 21c, . . . , 21n, which are multiple devices, may be collectively referred to as "IoT devices 21."

[0038] First, a method for collecting device information and distributing device configuration information in the resource update distribution system will be described.

[0039] The configuration management server 11 collects device information including identification information of each IoT device 21 and number information individually assigned to each IoT device 21. The configuration management server 11 also stores the device information collected from each IoT device 21 as device configuration information and distributes it to the IoT devices 21.

[0040] 2 shows an example of device configuration information data distributed by the configuration management server 11. The device configuration information is data in which a "location number," a "device ID," and a "production number" are linked together.

[0041] The "Location Number" field shows the location number indicating the installation location of each device that makes up the resource update distribution system, the "Device ID" field shows the device ID of each device that makes up the resource update distribution system, and the "Serial Number" field shows the serial number as number information individually assigned to each device that makes up the resource update distribution system.

[0042] 2, for example, the data "DC01," "SV01," and "AAAAAAAAaaaaaaaa" are stored in the fields of the record in the first row. This record indicates device information for the configuration management server 11, and indicates that it is installed in the data center 10 and has a serial number of "AAAAAAAAaaaaaaaa." Furthermore, for example, the data "FCT01," "DV02," and "IOT3210987654321" are stored in the fields of the record in the fifth row. This record indicates device information for the IoT device 21b, and indicates that it is installed in the factory 20 and has a serial number of "IOT3210987654321."

[0043] Here, the details of the process of collecting device information and distributing device configuration information will be described with reference to FIGS. 3A and 3B.

[0044] 3A and 3B are flowcharts showing the processing contents of a first example and a second example of the device configuration information distribution processing, respectively. The flowchart in Fig. 3A shows the processing contents performed when an IoT device 21 is newly installed or when an IoT device 21 is replaced in the factory 20. On the other hand, the flowchart in Fig. 3B shows the processing contents performed when an IoT device 21 is removed from the factory 20.

[0045] First, the processing content of the first example will be explained.

[0046] 3A starts, in S111, a process is performed to newly install or replace the IoT device 21. This process is performed by a manager or the like of the factory 20.

[0047] Next, in S112, the IoT device 21 notifies the configuration management server 11 of its own device information (location number, device ID, serial number) that was newly installed by the installation or replacement process in S111.

[0048] Next, in S113, the configuration management server 11, which has received the device information of the newly installed IoT device 21, performs a process of updating the device configuration information by adding the received device information to the device configuration information. In the table illustrated in Fig. 2, the device configuration information is updated by adding a record corresponding to the content of the received device information.

[0049] Next, in S114, the configuration management server 11 distributes the device configuration information updated in S113 to the IoT device 21a having a gateway function. Upon receiving the device configuration information through this process, the IoT device 21a stores and saves the received device configuration information in its own storage area.

[0050] In S115, the IoT device 21a distributes the device configuration information received from the configuration management server 11 in S114 to each of the IoT devices 21b, 21c, ..., 21n. Upon receiving the distribution of the device configuration information through this process, the IoT devices 21b, 21c, ..., 21n store and save the received device configuration information in their own storage areas.

[0051] Thereafter, when the process of S115 is completed, the process of this first example ends.

[0052] In the process of S113, the encryption server 12 may encrypt the updated device configuration information using a common key held by the IoT device 21, and the configuration management server 11 may distribute the encrypted device configuration information. At this time, the IoT device 21a that receives the distributed encrypted device configuration information stores and saves the device configuration information decrypted using the common key held by itself in its own memory area. Furthermore, in the subsequent process of S114, the IoT devices 21b, 21c, ..., 21n that receive the encrypted device configuration information from the IoT device 21a store and save the device configuration information decrypted using the common key held by itself in their own memory area.

[0053] Next, the processing content of the second example will be explained.

[0054] 3B starts, in S121, a process of removing the IoT device 21 is performed. This process is performed by a manager of the factory 20 or the like.

[0055] Next, in S122, the configuration management server 11 performs a process of updating the device configuration information by deleting the device information of the removed IoT device 21. This process is performed by the configuration management server 11 in response to input of information (e.g., a device ID) identifying the removed IoT device 21 by, for example, an administrator of the factory 20. At this time, the configuration management server 11 may confirm the validity of the input information by, for example, checking whether or not there is a response to an inquiry made by the configuration management server 11 to the IoT device 21 identified by the input information.

[0056] Next, in S123, the configuration management server 11 distributes the device configuration information updated in S122 to the IoT device 21a having a gateway function. Then, in the following S124, the IoT device 21a distributes the device configuration information received from the configuration management server 11 in S123 to each of the IoT devices 21b, 21c, ..., 21n. The processes of S123 and S124 are similar to the processes of S114 and S115 in Fig. 9A described above, respectively, and therefore will not be described in detail.

[0057] Thereafter, when the process of S124 is completed, the process of this second example ends.

[0058] The collection of device information and the distribution of device configuration information are carried out as described above.

[0059] Next, a method for distributing updated resources in the resource update distribution system will be described.

[0060] First, an example of the configuration of the IoT device 21 will be described with reference to FIG.

[0061] The IoT device 21 includes a processor 40 and a boot memory 51 and a memory 52 as hardware resources 50.

[0062] The processor 40 controls each component of the IoT device 21, for example, by using the memory 52 to execute various software including the common software mentioned above, thereby enabling the provision of various functions possessed by the IoT device 21.

[0063] The boot memory 51 is a memory that stores the various software programs described above, and is, for example, a flash memory.

[0064] The memory 52 is a memory used as a working area when the processor 40 executes various software programs, and is, for example, a RAM (Random Access Memory).

[0065] The IoT device 21 also includes a hypervisor 60, which is a control program that virtualizes the hardware resources 50 and runs a normal OS 61 separately from a secure OS 62 that has stronger security than the normal OS 61. Note that "OS" is an abbreviation for operating system.

[0066] In this embodiment, the hypervisor 60 manages the storage area of ​​the memory 52 by dividing it into a normal memory area 52a, a shared memory area 52b, and a secure memory area 52c. The normal memory area 52a is an area that allows access from the normal OS 61 but prohibits access from the secure OS 62. In contrast, the secure memory area 52c is an area that allows access from the secure OS 62 but prohibits access from the normal OS 61. The shared memory area 52b is an area that allows access from both the normal OS 61 and the secure OS 62.

[0067] The common key and the device configuration information are both stored and held in the secure memory area 52c of the memory 52.

[0068] Furthermore, various application programs, such as an IoT device application 71, a VPN client 72, an update client 73, and an update control application 80, are installed in the IoT device 21.

[0069] The IoT device application 71 is an application that controls the operation of the facilities 22a, 22b, 22c, ..., 22n and controls communication between the IoT devices 21. In the IoT device 21a having a gateway function, the IoT device application 71 is executed to also execute processing for realizing the gateway function.

[0070] The VPN client 72 is an application executed to realize a VPN connection function. The IoT device 21a executes this VPN client 72 when using a VPN for communication between the configuration management server 11, the encryption server 12, and the distribution server 13 via the Internet 30.

[0071] The update client 73 manages and distributes the received update resources.

[0072] The update control application 80 performs processes such as decrypting encrypted update resources, additionally encrypting encrypted update resources, and generating individual keys to be used for additional encryption.

[0073] Of these applications, the IoT device application 71, the VPN client 72, and the update client 73 run on the normal OS 61, and the update control application 80 runs on the secure OS 62.

[0074] Next, an example of the operation of distributing updated resources and updating software by the resource update distribution system according to this embodiment will be described with reference to FIG.

[0075] The operation example in FIG. 5 shows a flow in which the update resource 1 is distributed from the data center 10 to the IoT device 21a and then further distributed from the IoT device 21a.

[0076] First, the operations of the configuration management server 11, encryption server 12, and distribution server 13 installed in the data center 10 will be described.

[0077] In the example of Fig. 5, a distribution plan 2 representing a plan of distribution routes between the distribution server 13 and the IoT device 21a and between the IoT devices 21 in distributing the update resource 1 is created in advance and stored in the configuration management server 11. Fig. 6 shows an example of data of this distribution plan 2.

[0078] In the table of FIG. 6, each piece of data, "location number," "encryption source," "distribution source," "distribution destination," and "applied resource number," is associated with each record.

[0079] The "applied resource number" field stores a number that is individually assigned to the updated resource for identifying the updated resource.

[0080] The "Location Number" field indicates the location number indicating the installation location of each device that constitutes the resource update distribution system. The "Encryption Source" field indicates the device ID of the server (encryption server 12) that performed encryption using a common key on the update resource identified by the "Applied Resource Number." The "Distribution Source" and "Distribution Destination" fields indicate the device IDs of the distribution source and destination devices (distribution server 13 or IoT device 21a) in the distribution of the update resource identified by the "Applied Resource Number," respectively, as route information for the distribution.

[0081] 6, for example, the data "FCT01," "SV02," "SV03," "DV01," and "NM0001" are stored in the fields of the record in the first row. This record represents a distribution route from the distribution server 13 to the IoT device 21a as a distribution plan in the factory 20 for an update resource identified by "NM0001" encrypted by the encryption server 12. Furthermore, for example, the data "FCT01," "SV02," "DV01," "DV02," and "NM0001" are stored in the fields of the record in the second row. This record represents a distribution route from the IoT device 21a to the IoT device 21b as a distribution plan in the factory 20 for an update resource identified by "NM0001" encrypted by the encryption server 12.

[0082] As described above, the distribution plan 2 is information that includes identification information of the respective devices that are the distribution source and destination of the updated resource 1 as distribution route information related to the distribution plan of the updated resource 1.

[0083] Returning to the explanation of Figure 5.

[0084] The encryption server 12 first encrypts the update resource 1. In this encryption, the encryption server 12 encrypts the update resource 1 including the distribution plan 2 using a common key held by each of the IoT devices 21, and generates an encrypted update resource 4 (first encrypted update resource). In Fig. 5, the white key 3 represents the common key.

[0085] Next, encryption server 12 performs additional encryption on encrypted update resource 4 to generate encrypted update resource 4a (second encrypted update resource). This additional encryption is performed using the first individual key. Note that in Figure 5, black key 5a represents the first individual key, and this additional encryption is indicated as "conversion."

[0086] In this way, the encryption server 12 performs two-stage encryption. The encryption process performed by the encryption server 12 will be further described with reference to FIG.

[0087] In this embodiment, the encryption server 12 employs the AES method, which is a widely known encryption method that uses a common key, and encrypts the update resource 1 (and the distribution plan 2) using the CTR mode of this AES method. Note that "AES" is an abbreviation for Advanced Encryption Standard, and "CTR mode" is an abbreviation for Counter Mode. AES in CTR mode first uses a common key to encrypt the value of a counter 91 shared between the distribution source and the distribution destination through AES processing 92, which is a predetermined encryption algorithm. Then, an exclusive OR 93 is taken between the value obtained as a result of this encryption and the plaintext (update resource 1) to generate ciphertext (encrypted update resource 4).

[0088] In this embodiment, the encryption server 12 may perform encryption using a different encryption method from the encryption using a common key (conversion 94) in order to increase the difficulty of a third party analyzing the encryption method. Here, in order to reduce the processing load for encryption and decryption using the first individual key, an encryption method with a lighter processing load than the AES method may be used. Classical encryption, such as substitution ciphers, is widely known as an encryption method with a lighter processing load.

[0089] In this embodiment, the encryption server 12 performs the transformation 94 by adding a numerical value that is the first individual key to the plaintext (encrypted update resource 4) to generate ciphertext (encrypted update resource 4a). The plaintext is decrypted by subtracting the numerical value that is the first individual key from the ciphertext. Alternatively, the encryption server 12 may perform the transformation 94 by multiplying the plaintext (encrypted update resource 4) by the numerical value that is the first individual key to generate ciphertext (encrypted update resource 4a). In this case, the plaintext is decrypted by dividing the ciphertext by the numerical value that is the first individual key.

[0090] Next, a method for generating the first individual key by the encryption server 12 will be described.

[0091] In this embodiment, the encryption server 12 generates a first individual key based on identification information of the device that encrypts the update resource 1 to generate the encrypted update resource 4, and the devices that are the source and destination of the distribution of the encrypted update resource 4 a. The encryption server 12 obtains this identification information from the distribution plan 2 stored in the configuration management server 11.

[0092] Refer to the record on the first line in the data example of distribution plan 2 shown in Figure 6. This record indicates that the device that encrypted update resource 1 (the "encryption source") has a device ID of "SV02," and that the "distribution source" and "distribution destination" of update resource 1 (encrypted update resource 4a) have device IDs of "SV03" and "DV01," respectively. After obtaining the data of this record as route information from configuration management server 11, encryption server 12 refers to the above-mentioned device configuration information stored in configuration management server 11 and obtains the serial numbers linked to these device IDs.

[0093] In the example data of the device configuration information shown in Fig. 2, the number of digits in the serial numbers linked to each device ID is not uniform. In this embodiment, the serial numbers are 16-digit fixed half-width alphanumeric information, and for serial numbers with fewer digits, the missing digits are filled with spaces (blank characters) to make them 16-digit information.

[0094] Next, the encryption server 12 generates a string by concatenating the serial numbers of the three acquired devices, for example, in the order of "encryption source," "distribution source," and "distribution destination." The encryption server 12 then calculates a hash value of the generated string and sets the resulting string as the first individual key. In this embodiment, the encryption server 12 uses HSA-256, which outputs a 256-bit hash value, as the hash function used to calculate this hash value. Note that "SHA" is an abbreviation for Secure Hash Algorithm.

[0095] The encryption server 12 may also acquire, from the distribution plan 2, the device IDs of the "distribution source" and "distribution destination" devices of the update resource 1 (encrypted update resource 4a) as route information, and generate a first individual key based on the device IDs of these two devices. That is, for example, the encryption server 12 may acquire the serial numbers linked to the device IDs of these two devices from the device configuration information of the configuration management server 11, and generate a character string by concatenating the acquired serial numbers in the order of the "distribution source" and "distribution destination" devices. Then, the encryption server 12 may calculate a hash value of the generated character string, and use the obtained character string as the first individual key.

[0096] Returning to the explanation of Figure 5.

[0097] The distribution server 13 distributes the encrypted update resource 4a generated by the encryption server 12 to the IoT device 21a (first device) via the Internet 30 in accordance with the distribution plan 2 stored in the configuration management server 11. As described above, the encrypted update resource 4a is the encrypted update resource 1 including the distribution plan 2, and therefore, by distributing the encrypted update resource 4a, the distribution plan 2 is also distributed together with the update resource 1.

[0098] An example of the data structure of the communication packet 100 used to distribute the encrypted update resource 4a will now be described with reference to FIG.

[0099] A communication packet 100 has a header section 101 and a data section 102 .

[0100] When the encrypted update resource 4a is distributed by the communication packet 100, a resource update command 101a is set in the header section 101, and the encrypted update resource 4a is stored in the data section 102. The resource update command 101a is a specific data string that indicates that the communication packet 100 is for distributing the encrypted update resource 4a.

[0101] In addition, following the resource update command 101a, an encryption source ID 101b, a distribution source ID 101c, and a distribution destination ID 101d are set in the header section 101. These represent the device IDs of the encryption source, distribution source, and distribution destination devices for the encrypted update resource 4a stored in the data section 102.

[0102] Returning to the explanation of Figure 5.

[0103] In the IoT device 21a, when the communication packet 100 is received, the update client 73 on the normal OS 61 extracts the encrypted update resource 4a from the communication packet 100 and temporarily stores it in the normal memory area 52a of the memory 52. ​​Thereafter, the update client 73 moves the encrypted update resource 4a from the normal memory area 52a to the shared memory area 52b in order to pass the encrypted update resource 4a to the update control application 80 on the secure OS 62.

[0104] Next, the update control application 80 moves the encrypted update resource 4a stored in the shared memory area 52b to the secure memory area 52c, and then decrypts the encrypted update resource 4a to obtain the encrypted update resource 4. In Fig. 5, this decryption, i.e., the decryption performed using the first individual key (black key 5a), is indicated as "inverse conversion." The update control application 80 stores the encrypted update resource 4 obtained by this decryption in the secure memory area 52c.

[0105] Next, the update control application 80 uses the common key (white key 3) stored in the secure memory area 52c of the IoT device 21a to decrypt the encrypted update resource 4 into the update resource 1. The update resource 1 obtained by this decryption includes the distribution plan 2.

[0106] In this way, the update control application 80 performs two-stage decryption. The decryption process performed by the update control application 80 will be further described with reference to FIG.

[0107] As described above, in this embodiment, the encrypted update resource 4a generated by the encryption server 12 is generated by adding the numerical value that is the first individual key to the plaintext (encrypted update resource 4). Therefore, the update control application 80 first performs the inverse transformation 95 by subtracting the numerical value that is the first individual key from the encrypted update resource 4a to generate the encrypted update resource 4. Note that if the encrypted update resource 4a was generated by multiplying the numerical value that is the first individual key by the plaintext (encrypted update resource 4), the update control application 80 performs the inverse transformation 95 by dividing the encrypted update resource 4a by the numerical value that is the first individual key to generate the encrypted update resource 4.

[0108] The update control application 80 also generates a first individual key to be used in the inverse transformation 95. The method of this generation will be described below.

[0109] The update client 73 extracts the encryption source ID 101b, the distribution source ID 101c, and the distribution destination ID 101d from the header portion 101 of the received communication packet 100. The extracted encryption source ID 101b, the distribution source ID 101c, and the distribution destination ID 101d are passed to the update control application 80 by moving them to the storage area of ​​the memory 52 in the same way as the encrypted update resource 4a.

[0110] The update control application 80 refers to the device configuration information stored in the secure memory area 52c of the memory 52, and acquires the serial numbers associated with the encryption source ID 101b, the distribution source ID 101c, and the distribution destination ID 101d, respectively.

[0111] Next, the update control application 80, like the encryption server 12, generates a string by concatenating the serial numbers of the three acquired devices, for example, in the order of encryption source ID 101b, distribution source ID 101c, and distribution destination ID 101d.The update control application 80 then calculates a hash value of the generated string using the same hash function as used by the encryption server 12, and sets the obtained string as a first individual key.The encrypted update resource 4a is obtained by performing inverse transformation 95 on the encrypted update resource 4a using the first individual key generated in this way.

[0112] In addition, if the device information for the encryption source ID 101b, the distribution source ID 101c, and the distribution destination ID 101d is not included in the device configuration information, the update control application 80 may discard the encrypted update resource 4a that has been distributed from a security standpoint.

[0113] Furthermore, when the encryption server 12 generates the first individual key as described above based on the device IDs of the two devices that are the source and destination of the update resource 1, the update control application 80 also generates the first individual key in the same manner as the encryption server 12.

[0114] Next, the update control application 80 decrypts the encrypted update resource 4 into the update resource 1 using the common key stored in the secure memory area 52c.

[0115] As described above, the encrypted update resource 4 is generated by the encryption server 12 through encryption using the CTR mode of the AES system. The update control application 80 then generates the update resource 1 from the encrypted update resource 4 in accordance with the CTR mode of the AES system. That is, the update control application 80 first uses a common key to encrypt the value of a counter 91 shared between the source and destination through AES processing 92, which is a predetermined algorithm. Then, the application 80 decrypts the plaintext (update resource 1) by performing an exclusive OR 93 between the value obtained as a result of this encryption and the ciphertext (encrypted update resource 4).

[0116] Returning to the explanation of Figure 5.

[0117] The update resource 1 containing the distribution plan 2, which the update control application 80 decrypted from the encrypted update resource 4a as described above, is temporarily stored in the secure memory area 52c. The update control application 80 determines whether the software to be updated by the update resource 1 is executed on the secure OS 62 or the normal OS 61. If it is determined that the software to be updated is executed on the secure OS 62, the update control application 80 applies the update resource 1 to the software to be updated to update the software. On the other hand, if it is determined that the software to be updated is executed on the normal OS 61, the update control application 80 moves the update resource 1 from the secure memory area 52c to the shared memory area 52b. In this case, the update client 73 applies the update resource 1 stored in the shared memory area 52b to the software to be updated to update the software.

[0118] The update control application 80 copies the decrypted distribution plan 2 together with the update resource 1 from the secure memory area 52c to the shared memory area 52b so that it can be used by the update client 73 in the process described below.

[0119] Furthermore, in IoT device 21a, in parallel with the above-mentioned software update using update resource 1, distribution (re-distribution) of update resource 1 to other IoT devices 21b, 21c, ..., 21n is performed. For this purpose, first, update control application 80 performs additional encryption on encrypted update resource 4 stored in secure memory area 52c to generate encrypted update resource 4b (third encrypted update resource). This additional encryption is performed using a second individual key. Note that in FIG. 5, black key 5b represents the second individual key, and this additional encryption is indicated as "conversion."

[0120] The additional encryption process performed by the update control application 80 will be described in detail with reference to FIG.

[0121] The update control application 80 has already decrypted the encrypted update resource 4a into the encrypted update resource 4 through the first-stage decryption (inverse conversion 95) of the two-stage decryption described above. In this embodiment, by using this encrypted update resource 4 as a target for additional encryption processing, the IoT device 21a does not need to perform encryption processing to generate the encrypted update resource 4, thereby reducing the processing load on the IoT device 21a.

[0122] The update control application 80 generates the encrypted update resource 4b by performing a conversion 94 on the decrypted encrypted update resource 4 using the same encryption method as the encryption server 12, using a second individual key, and temporarily stores the encrypted update resource 4b in the secure memory area 52c. The update control application 80 also generates the second individual key used for additional encryption of the encrypted update resource 4.

[0123] The method by which the update control application 80 generates the second individual key is basically the same as the method by which the encryption server 12 generates the first individual key. That is, the update control application 80 generates the second individual key based on identification information of the device that encrypts the update resource 1 to generate the encrypted update resource 4, and of the respective devices that are the distribution source and distribution destination in the distribution of the encrypted update resource 4a. The update control application 80 obtains this identification information from the distribution plan 2 stored in the secure memory area 52c, i.e., the distribution plan 2 that was included in the update resource 1 obtained by decrypting the encrypted update resource 4a.

[0124] In the data example of distribution plan 2 shown in FIG. 6, the records in the second and third rows show the device ID of the IoT device 21a, "DV01," in the "Distributor" field. The "Destination" fields in these records show the device IDs "DV02" and "DV03," respectively. Therefore, this data example shows a plan in which the IoT device 21a distributes the update resource 1 to the IoT device 21b identified by "DV02" and the IoT device 21c identified by "DV03." In this case, the update control application 80 of the IoT device 21a generates a second individual key used to generate the encrypted update resource 4b to be distributed to the IoT device 21b, and a second individual key used to generate the encrypted update resource 4b to be distributed to the IoT device 21c. Since the methods for generating these second individual keys are the same, the method for generating the second individual key used to generate the encrypted update resource 4b to be distributed to the IoT device 21b will be described here.

[0125] In the data example of distribution plan 2 shown in FIG. 6, the record in the second row is referenced, in which the device ID of IoT device 21b is indicated in the "destination" field. This record indicates that the device ("encryption source") that encrypted update resource 1 has a device ID of "SV02," and that the "distribution source" and "distribution destination" of update resource 1 (encrypted update resource 4b) have device IDs of "DV01" and "DV02," respectively. The update control application 80 obtains the data of this record as route information from distribution plan 2 in secure memory area 52c, and then references the aforementioned device configuration information stored in secure memory area 52c. Then, the update control application 80 obtains the serial numbers associated with these device IDs from the device configuration information.

[0126] Next, the update control application 80 generates a string by concatenating the serial numbers of the three acquired devices, for example, in the order of "encryption source," "distribution source," and "distribution destination."The update control application 80 then calculates a hash value of the generated string, and sets the obtained string as the second individual key.In this embodiment, the update control application 80, like the encryption server 12, uses HSA-256 as the hash function used to calculate this hash value.

[0127] The update control application 80 may also acquire, from the distribution plan 2, the device IDs of the "distribution source" and "distribution destination" devices of the update resource 1 (encrypted update resource 4b) as route information, and generate a second individual key based on these two device IDs. That is, for example, the update control application 80 may acquire, from the device configuration information, the serial numbers linked to the device IDs of these two devices, and generate a character string by arranging and concatenating the acquired serial numbers of the two devices in the order of "distribution source" and "distribution destination." Then, the hash value of the generated character string may be calculated, and the obtained character string may be used as the second individual key.

[0128] Thereafter, the update control application 80 moves the encrypted update resource 4b, which was temporarily stored in the secure memory area 52c, to the shared memory area 52b to pass it to the update client 73 on the normal OS 61. The update client 73 moves the encrypted update resource 4b stored in the shared memory area 52b to the normal memory area 52a. Thereafter, the update client 73 distributes the encrypted update resource 4b to the IoT device 21b (second device) via the LAN 23 in accordance with the distribution plan 2 stored in the shared memory area 52b. The update client 73 distributes the encrypted update resource 4b using a communication packet 100, the data structure of which is illustrated in FIG. 8.

[0129] Upon receiving the encrypted update resource 4b, the IoT device 21b performs the same process on the encrypted update resource 4b as the IoT device 21a performs on the encrypted update resource 4a. Specifically, the IoT device 21b uses the second individual key to decrypt the encrypted update resource 4 from the encrypted update resource 4b, and then uses the common key it holds to decrypt the update resource 1, including the distribution plan 2, from the encrypted update resource 4. At this time, the IoT device 21b generates the second individual key based on the device IDs of the encryption source, distributor, and destination devices for the encrypted update resource 4b, which are included in the header 101 of the communication packet 100 used to distribute the encrypted update resource 4b. The IoT device 21b also applies the decrypted update resource 1 to the software to be updated, updating the software. Furthermore, the IoT device 21b identifies the destination device (third device) of the update resource 1 from the destination device ID indicated in the decrypted distribution plan 2. Then, the encrypted update resource 4 is additionally encrypted using the third individual key to generate an update resource (fourth encrypted update resource), which is then distributed to the destination device. At this time, the IoT device 21b generates the third individual key based on the device IDs of the encryption source, distribution source, and distribution destination devices indicated in the decrypted distribution plan 2. The same process is also performed in the devices (IoT devices 21c, ..., 21n) that receive the distribution of this fourth encrypted update resource.

[0130] In this manner, the resource update distribution system distributes the updated resource 1. The procedure for this distribution process will be described using a flowchart.

[0131] First, the procedure of the process performed in the data center 10 will be described with reference to the flowchart of FIG.

[0132] 11 starts, in S201, a distribution plan 2 is created and stored in the configuration management server 11, and in the following S202, an updated resource 1 is input to the encryption server 12. These processes are performed by the user of the resource update distribution system.

[0133] Next, in S203, the encryption server 12 obtains the distribution plan 2 from the configuration management server 11, and encrypts the update resource 1 including the obtained distribution plan 2 using the common key held by each IoT device 21 to obtain the encrypted update resource 4.

[0134] Next, in S204, the encryption server 12 performs a process of generating an individual key (first individual key) based on the distribution plan 2. This process obtains the device IDs of the "encryption source" and "distribution destination" in the record in which the device ID of the distribution server 13 is indicated as the "distribution source" in the distribution plan 2. Then, the serial numbers associated with the "encryption source," "distribution source," and "distribution destination" are obtained from the device configuration information stored in the configuration management server 11, and a character string is generated by arranging these serial numbers as described above. A hash value of this character string is calculated, and the obtained hash value becomes the individual key.

[0135] Next, in S205, the encryption server 12 performs the additional encryption described above on the encrypted update resource 4 obtained in the process of S203 using the individual key generated in the process of S204. This process generates the encrypted update resource 4a.

[0136] Next, in S206, the distribution server 13 obtains the distribution plan 2 from the configuration management server 11 and also obtains the encrypted update resource 4a generated in the processing of S205 from the encryption server 12, and distributes the obtained encrypted update resource 4a in accordance with the distribution plan 2. This processing obtains the device IDs of the "encryption source" and "distribution destination" in the record of the route information in which the device ID of the distribution server 13 is indicated as the "distribution source" in the distribution plan 2. Then, the encrypted update resource 4a is placed in the data section 102 of the communication packet 100, which has the device IDs of the "encryption source," "distribution destination," and "distribution source" indicated in the header section 101, and is transmitted to the IoT device 21a, which is the "distribution destination."

[0137] Then, in S207, the configuration management server 11 performs a process of acquiring from the distribution server 13 a notification of the result of the software update using the update resource 1, which notification is sent from each of the IoT devices 21 to the distribution server 13. Then, in the following S208, the configuration management server 11 performs a process of displaying the acquired update result on a display device (not shown) connected to the configuration management server 11, and then the processing procedure in FIG. 11 ends.

[0138] Next, the procedure of the process performed by each IoT device 21 that receives the encrypted update resource 1 (encrypted update resource 4a, 4b, . . . ) will be described with reference to the flowchart of FIG.

[0139] In this explanation, the processing procedure will be described as being performed by the IoT device 21a that has received the encrypted update resource 4a. The other IoT devices 21b, 21c, ..., 21n also perform processing in a similar manner.

[0140] The processing of Figure 12 begins after the update client 73 extracts the encrypted update resource 4a from the communication packet 100 containing the encrypted update resource 4a that has been delivered to the IoT device 21a and stores it in the normal memory area 52a of the memory 52.

[0141] First, in S211, the update client 73 performs a process of moving the encrypted update resource 4a from the normal memory area 52a to the shared memory area 52b.

[0142] Next, in S212, the update control application 80 performs a process of generating an individual key (a first individual key in the IoT device 21a) based on the information indicated in the header section 101 of the communication packet 100. Through this process, the serial numbers associated with the encryption source ID 101b, the distribution source ID 101c, and the distribution destination ID 101d indicated in the header section 101 of the communication packet 100 acquired by the update client 73 are acquired from the device configuration information. Next, a character string is generated by arranging these serial numbers as described above. A hash value of this character string is then calculated, and the obtained hash value becomes the individual key.

[0143] Next, in S213, the update control application 80 performs a process of decrypting the encrypted update resource 4 from the encrypted update resource 4a using the individual key generated in the process of S212.

[0144] Next, in S214, the update control application 80 performs a process of decrypting the update resource 1 including the distribution plan 2 from the encrypted update resource 4 decrypted in the process of S213 using the common key held by itself.

[0145] Next, update processing is performed in S215. The update processing is processing in which the update resource 1 decrypted in the processing of S214 is applied to the software to be updated, and the details of this processing will be described later.

[0146] Next, in S216, the update control application 80 performs processing to determine whether the distribution route in which the application itself is indicated as the distribution source is included in the distribution plan 2 decrypted in the processing of S214. In this determination processing, if it is determined that the distribution route in which the application itself is indicated as the distribution source is included (if the determination result is YES), the processing proceeds to S127. On the other hand, if it is determined that the distribution route in which the application itself is indicated as the distribution source is not included (if the determination result is NO), the processing procedure in Fig. 12 ends.

[0147] When there are multiple distribution routes in which the distribution plan 2 indicates itself as the distribution source, the processes from S217 to S219 are performed for each of the multiple distribution routes.

[0148] First, in S217, the update control application 80 performs processing to generate an individual key (a second individual key in the IoT device 21a) based on the distribution plan 2 decrypted in the processing of S214. This processing obtains the device IDs of the "encryption source" and "distribution destination" in the record of the route information in which the device's own device ID is indicated as the "distribution source" in the distribution plan 2. Then, the serial numbers associated with the "encryption source," "distribution source," and "distribution destination" are obtained from the device configuration information, and a character string is generated by arranging these serial numbers as described above. A hash value is calculated for this character string, and the obtained hash value becomes the individual key.

[0149] Next, in S218, the update control application 80 performs the additional encryption described above on the encrypted update resource 4 obtained by the decryption process in S213, using the individual key generated in the process in S204. In the IoT device 21a, the additional encryption in this process generates the encrypted update resource 4b.

[0150] Next, in S219, the update client 73 distributes the encrypted update resource 1 obtained in the process of S218 (encrypted update resource 4b in the IoT device 21a) in accordance with the distribution plan 2 decrypted in the process of S214. This process acquires the device IDs of the "encryption source" and "distribution destination" in the record of the route information in which the update client 73 is indicated as the "distribution source" in the distribution plan 2. The update resource 1 encrypted by the update control application 80 is then placed in the data section 102 of the communication packet 100, which indicates in the header section 101 the device IDs of the "distribution source" (that is, the update client 73), the "encryption source," and the "distribution destination," and is then transmitted to the "distribution destination."

[0151] When the process of S219 is completed, the process procedure of FIG. 12 ends.

[0152] Next, the procedure of the update process, which is the process of S215 in FIG. 12, will be described with reference to the flowchart in FIG.

[0153] When the update process starts, first, in S221, the update control application 80 performs a process of determining whether the software to be updated using the update resource 1 decrypted in the process of S214 of Fig. 12 is to be executed on the secure OS 62. In this determination process, if it is determined that the software to be updated is to be executed on the secure OS 62 (if the determination result is YES), the process proceeds to S222. On the other hand, in this determination process, if it is determined that the software to be updated is to be executed on the normal OS 61 (if the determination result is NO), the process proceeds to S224.

[0154] In S222, the update control application 80 applies the update resource 1 to the software to be updated, thereby updating the software. Then, in the following S223, the update control application 80 notifies the update client 73 of information indicating the result of the update in S222 (update success or update failure), and then the process proceeds to S227.

[0155] 12 and held in the secure memory area 52c, is copied to the shared memory area 52b by the update control application 80. Then, in the following S225, a request is made to the update client 73 to update the software to be updated that is executed on the normal OS 61.

[0156] Next, in S226, the update client 73 that received the request in the process of S225 applies the update resource 1 held in the shared memory area 52b to the software to be updated, thereby updating the software.

[0157] Next, in S227, the update control application 80 performs a process to determine whether application of the update resource 1 to all software that is the target of the update has been completed. In this determination process, if it is determined that application of the update resource 1 to all software that is the target of the update has been completed (if the determination result is YES), the process proceeds to S228. On the other hand, in this determination process, if it is determined that there is software that is the target of the update but to which the update resource 1 has not been applied (if the determination result is NO), the process returns to S221, and a process is performed to apply the update resource 1 to the unapplied software to update it.

[0158] Next, in S228, the update control application 80 performs a process of notifying the update client 73 of the completion of the software update performed using the update resource 1.

[0159] Next, in S229, the update client 73 that received the notification in S228 notifies the configuration management server 11 via the distribution server 13 of the results of the software update performed using the update resource 1. Through this process, the update result notified from the update control application 80 in the process of S223 and the update result performed by the update client 73 in the process of S225 (update success or update failure) are notified together to the configuration management server 11. When the configuration management server 11 receives this notification in the process of S207 in Fig. 11 described above, the acquired update result is displayed in the subsequent process of S208.

[0160] When the process of S229 is completed, the process procedure of FIG. 13 ends.

[0161] By performing each process in the resource update distribution system according to the above procedure, secure distribution of updated resources is realized.

[0162] While the disclosed embodiments and their advantages have been described in detail above, those skilled in the art may make various modifications, additions, and omissions without departing from the scope of the invention as clearly set forth in the claims. [Explanation of symbols]

[0163] 1 Update resources 2. Distribution Plan 3 White Keys 4, 4a, 4b Encrypted update resources 5a, 5b black keys 10 Data Centers 11 Configuration Management Server 12 Encryption Server 13 Distribution Server 20 Factories 21, 21a, 21b, 21c, 21n IoT devices 22a, 22b, 22c, 22n equipment 30 Internet 40 processors 50 Hardware Resources 51 Boot Memory 52 memory 52a Normal memory area 52b Shared memory area 52c Secure Memory Region 60 Hypervisor 61 Normal OS 62 Secure OS 71 IoT device applications 72 VPN clients 73 Update Client 80 Update Control Application 91 Counter 92 AES Processing 93 Exclusive OR 94 Conversion 95 Inverse Transformation 100 communication packets 101 Header section 101a Resource Update Command 101b Cipher source ID 101c Source ID 101d Delivery ID 102 Data Section

Claims

1. An update resource distribution system including a plurality of devices each having a common software installed therein, a distribution device that distributes update resources used to update the software, and an encryption device that encrypts the update resources, The encryption device generating a first encrypted update resource by encrypting the update resource using a common key held by each of the plurality of devices; generating a second encrypted update resource by encrypting the first encrypted update resource using a first individual key generated based on identification information for the distribution device and first identification information for a first device that is one of the plurality of devices; the distribution device distributes the second encrypted update resource to the first device as the update resource; The first device comprises: decrypting the first encrypted update resource from the second encrypted update resource distributed by the distribution device using the first individual key generated based on the first identification information, which is the identification information of the device itself, and identification information about the distribution device; decrypting the update resource from the first encrypted update resource using the common key held by the generating a third encrypted update resource by encrypting the first encrypted update resource decrypted from the second encrypted update resource using a second individual key generated based on the first identification information and second identification information of a second device that is one of the plurality of devices excluding the first device; delivering the third encryption update resource to the second device; An updated resource distribution system.

2. The second device includes: decrypting the first encrypted update resource from the third encrypted update resource distributed by the first device using the second individual key generated based on the second identification information that is its own identification information and the first identification information about the first device; decrypting the update resource from the first encrypted update resource using the common key held by the decryption device; 2. The updated resource distribution system according to claim 1.

3. The second device includes: generating a fourth encrypted update resource by encrypting the first encrypted update resource decrypted from the third encrypted update resource using a third individual key generated based on third identification information for a third device that is one of the plurality of devices excluding the first device; delivering the fourth encrypted update resource to the third device; 3. The updated resource distribution system according to claim 2.

4. the distribution device distributes to the first device a distribution plan for the distribution of the updated resource among the plurality of devices, the distribution plan including identification information for each of a distribution source and a distribution destination of the updated resource as distribution route information relating to the plan; the second device is a device identified by identification information of the distribution destination in route information in which the first identification information is indicated as the distribution source among the route information included in the distribution plan, 4. The updated resource distribution system according to claim 3.

5. the encryption device generates the first encrypted update resource by encrypting the update resource including the distribution plan using the common key; the distribution device distributes the distribution plan to the first device by distributing the second encrypted update resource; the first device decrypts the distribution plan together with the update resource from the first encrypted update resource using the common key held by the first device; 5. The updated resource distribution system according to claim 4.

6. The first device distributes the distribution plan to the second device; the third device is a device identified by the identification information of the distribution destination in the route information included in the distribution plan in which the second identification information is indicated as the distribution source, 5. The updated resource distribution system according to claim 4.

7. the encryption device generates the first encrypted update resource by encrypting the update resource including the distribution plan using the common key; the distribution device distributes the distribution plan to the first device by distributing the second encrypted update resource; the first device distributes the distribution plan to the second device by distributing the third encrypted update resource; the second device decrypts the distribution plan together with the update resource from the first encrypted update resource using the common key held by the second device; 6. The updated resource distribution system according to claim 5.

8. a configuration management device that collects device information including identification information of each of the plurality of devices and number information individually assigned to each of the plurality of devices, and distributes the device information collected from each of the plurality of devices to the plurality of devices as device configuration information; The first device comprises: generating the second individual key using the number information about itself and the number information about the second device acquired from the device configuration information based on the second identification information; Distributing the first identification information to the second device as information on a distributor of the third encrypted update resource; The second device includes: acquiring the number information about the first device from the device configuration information based on the first identification information distributed from the first device; generating the second individual key using the number information about itself and the number information about the first device acquired from the device configuration information; 2. The updated resource distribution system according to claim 1.

9. An update resource distribution system as described in any one of claims 1 to 8, characterized in that the encryption performed in generating the first encrypted update resource and the encryption performed in generating the second encrypted update resource are encryptions using different encryption methods.

10. An update resource distribution system including a plurality of devices each having a common software installed therein, a distribution device that distributes update resources used to update the software, and an encryption device that encrypts the update resources, The encryption device generating a first encrypted update resource by encrypting the update resource using a common key held by each of the plurality of devices; generating a second encrypted update resource by encrypting the first encrypted update resource using a first individual key generated based on identification information for the distribution device and first identification information for a first device that is one of the plurality of devices; the distribution device distributes the second encrypted update resource to the first device as the update resource; The first device comprises: decrypting the first encrypted update resource from the second encrypted update resource distributed by the distribution device using the first individual key generated based on the first identification information, which is the identification information of the device itself, and identification information about the distribution device; decrypting the update resource from the first encrypted update resource using the common key held by the generating a third encrypted update resource by encrypting the first encrypted update resource decrypted from the second encrypted update resource using a second individual key generated based on the first identification information and second identification information of a second device that is one of the plurality of devices excluding the first device; delivering the third encryption update resource to the second device; 1. A method for distributing updated resources, comprising:

Images