Information processing system, information processing method, and program set

Abstract

This enhances data confidentiality while reducing the risk of data loss in the event of a failure. [Solution] The first secure server encrypts the data encryption key with a unique key specific to the first secure server and stores it, generates a first ciphertext by encrypting the data encryption key with a first shared key and sends it to the second secure server, generates and stores a second ciphertext by encrypting the deposited data with the data encryption key, outputs a copy of the second ciphertext, the second secure server decrypts the received first ciphertext with the first shared key to extract the data encryption key, generates and stores a third ciphertext by encrypting the extracted data encryption key with a private key, and deletes the private key from the second secure server.

Description

[Technical Field]

[0001] This invention relates to an information processing system, an information processing method, and a program set. [Background technology]

[0002] Recently, Trusted Execution Environment (TEE), an example of a secure execution environment using hardware mechanisms, has been attracting attention as a data protection mechanism.

[0003] A TEE (Terminal Entity) is hardware-intensively designed to prevent unauthorized access to data handled within the execution environment. It is used in a way where the data owner encrypts the data and sends it to an external TEE, the data is decrypted within the TEE, the desired processing is performed, and the results are sent to the data user (or data owner).

[0004] Many TEEs ensure a high level of security by encrypting and storing data in memory or other storage devices using a private key (also called a unique key) specific to that TEE.

[0005] As background technology for this field, there is Japanese Patent Publication No. 2024-121874 (Patent Document 1). This publication describes a storage system comprising: a first storage connected to a server on which an application is running; a data protection storage that acquires backups of the first storage; and a monitoring server that monitors the data protection storage, wherein the monitoring server comprises: a backup execution unit that acquires backups of data from the first storage to the data protection storage; a write data volume monitoring unit that determines an abnormality when the amount of data written to the data protection storage by the backup execution unit when acquiring backups exceeds a predetermined amount; and an alert output unit that outputs an alert when the write data volume monitoring unit determines an abnormality (see abstract). [Prior art documents] [Patent Documents]

[0006] [Patent Document 1] Japanese Patent Publication No. 2024-121874 [Overview of the project] [Problems that the invention aims to solve]

[0007] However, if a secure server stores encrypted data encrypted using the aforementioned unique key, there is a risk that the secure server may fail due to a malfunction of a component, a fire, or a natural disaster, rendering the unique key unusable. If the unique key becomes unusable, even if the stored encrypted data can be retrieved, it cannot be decrypted, effectively resulting in the loss of the data.

[0008] While the technology described in Patent Document 1 performs data backup, Patent Document 1 does not describe a method for dealing with cases where a failure occurs in a secure server that stores highly confidential encrypted data encrypted using the aforementioned unique key.

[0009] Therefore, one aspect of the present invention enhances data confidentiality while reducing the risk of data loss in the event of a failure. [Means for solving the problem]

[0010] In order to solve the problem described above, one aspect of the present invention adopts the following configuration. An information processing system comprising a first secure server and a second secure server, wherein the first secure server holds deposit target data, a data encryption key, a first shared key, and a unique key unique to the first secure server, the second secure server holds a secret key and the first shared key, the first secure server encrypts the data encryption key with the unique key and stores the encrypted data encryption key in the first secure server, generates a first ciphertext obtained by encrypting the data encryption key with the first shared key and transmits the first ciphertext to the second secure server, generates a second ciphertext obtained by encrypting the deposit target data with the data encryption key and stores the second ciphertext in the first secure server, and outputs duplicated data of the second ciphertext, the second secure server decrypts the first ciphertext received from the first secure server with the first shared key to extract the data encryption key, generates a third ciphertext obtained by encrypting the extracted data encryption key with the secret key and stores the third ciphertext in the second secure server, and erases the secret key from the second secure server. [Effects of the Invention]

[0011] According to one aspect of the present invention, it is possible to reduce the risk of data loss when a failure occurs while improving the confidentiality of data.

[0012] Problems, configurations and effects other than those described above will be clarified by the following description of embodiments. [Brief Description of the Drawings]

[0013] [Figure 1] FIG. 1 is a block diagram showing a configuration example of a secure data backup system in Embodiment 1. [Figure 2] FIG. 2 is a block diagram showing a configuration example of a data owner terminal in Embodiment 1. [Figure 3] FIG. 3 is a block diagram showing a configuration example of a secure server in Embodiment 1. [Figure 4] FIG. 4 is a block diagram showing a configuration example of a data storage server in Embodiment 1. [Figure 5] This is a sequence diagram showing an example of the data deposit process to the first secure server in Example 1. [Figure 6] This is a sequence diagram showing an example of the private key deposit process to the second secure server in Example 1. [Figure 7] This is a sequence diagram showing an example of the data encryption and storage process in Example 1. [Figure 8] This sequence diagram shows an example of the data recovery process when the first secure server becomes unavailable in Example 1. [Modes for carrying out the invention]

[0014] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In this embodiment, the same components will be denoted by the same reference numerals in principle, and repeated descriptions will be omitted. It should be noted that this embodiment is merely one example for realizing the present invention and does not limit the technical scope of the present invention. [Examples]

[0015] <System Configuration> Figure 1 is a block diagram showing an example configuration of a secure data backup system in Example 1. The secure data backup system includes, for example, a data holder terminal 200, a first secure server 300-1, a second secure server 300-2, and a data storage server 500, all connected via a network 100 such as the Internet. Hereinafter, the first secure server 300-1 and the second secure server 300-2 may be collectively referred to simply as the secure server 300.

[0016] The data holder terminal 200 holds the data to be deposited, deposits the data to the first secure server 300-1, and the first secure server 300-1 encrypts and stores the data. Hereinafter, the data to be deposited will also be referred to as data S.

[0017] The data storage server 500 stores a copy of the encrypted data S. The first secure server 300-1 stores the decryption key used to encrypt the data S, and also deposits the decryption key with the second secure server 300-2, which then encrypts and stores the decryption key.

[0018] While the first secure server 300-1 is operating normally, the data holder terminal 200 can deposit additional data with the first secure server 300-1, retrieve deposited data from the first secure server 300-1, or request the first secure server 300-1 to perform specific processing on the deposited data.

[0019] If a failure occurs in the first secure server 300-1, the data holder terminal 200 requests the second secure server 300-2 to restore the deposited data, and the data is restored by the second secure server 300-2 and the data storage server 500.

[0020] <Example configuration of data holder terminal 200> Figure 2 is a block diagram showing an example configuration of a data holder terminal 200. The data holder terminal 200 is composed of a computer including an input device 201, an output device 202, a communication device 203, a CPU (Central Processing Unit) 210, a memory 215, and an auxiliary storage device 220, which are connected to each other by internal communication lines such as a bus.

[0021] The CPU210 is an example of a processor and executes the program stored in memory215. While the CPU210 and GPU (Graphics Processing Unit) are examples of processors, other semiconductor devices may also be used as long as they perform the required processing.

[0022] Memory 215 includes non-volatile memory elements such as ROM (Read Only Memory) and volatile memory elements such as RAM (Random Access Memory). ROM stores immutable programs (e.g., BIOS (Basic Input / Output System)). RAM is a high-speed, volatile memory element such as DRAM (Dynamic Random Access Memory) and temporarily stores programs executed by the CPU 210 and data used during program execution.

[0023] The auxiliary storage device 220 is a high-capacity, non-volatile storage device such as a magnetic storage device (HDD (Hard Disk Drive)) or flash memory (SSD (Solid State Drive)), and stores the program executed by the CPU 210 and the data used when the program is executed. In other words, the program is read from the auxiliary storage device 220, loaded into memory 215, and executed by the CPU 210.

[0024] Input device 201 is a device that receives input from the operator, such as a keyboard, mouse, or touchscreen. Output device 202 is a device that outputs the program execution results in a format that the operator can recognize, such as a display, printer, or speaker.

[0025] The communication device 203 is a network interface device that controls communication with other devices via the network 100 according to a predetermined protocol. The communication device 203 may also include a serial interface such as USB (Universal Serial Bus).

[0026] Some or all of the program executed by the CPU 210 may be provided to the data holder terminal 200 via the network 100 from a removable media (such as a CD-ROM or flash memory) or an external computer equipped with a non-temporary storage device, and stored in a non-volatile auxiliary storage device 220, which is also a non-temporary storage device. For this reason, the data holder terminal 200 should have an interface for reading data from the removable media. The same applies to the secure server 300 and the data storage server 500.

[0027] Furthermore, each device included in the secure data backup system is provided with a program set containing, for example, one or more programs executed by the CPU of that device. This program set may include a common program executed by some or all of the devices included in the data backup system (for example, the first secure server 300-1 and the second secure server 300-2), or it may include programs for each device (for example, a first program for the first secure server 300-1, a second program for the second secure server 300-2, etc.).

[0028] The data holder terminal 200 is a computer system that is physically located on a single computer or on multiple computers configured logically or physically. It may operate in separate threads on the same computer, or it may operate on a virtual computer built on multiple physical computing resources. The same applies to the secure server 300 and the data storage server 500.

[0029] The CPU 210 includes, for example, a decryption processing unit 211, a key management unit 212, and a data management unit 213, all of which are functional units. The decryption processing unit 211 performs processing for encrypted communication to securely exchange data with the secure server 300. The key management unit 212 manages the keys used by the decryption processing unit 211 for encryption and / or decryption. The data management unit 213 manages the data held by the data holder terminal 200.

[0030] For example, the CPU 210 functions as a decryption processing unit 211 by operating according to the decryption processing program loaded into memory 215, and functions as a key management unit 212 by operating according to the key management program loaded into memory 215. The relationship with the program is similar for other functional units included in the CPU 210. The relationship with the program is also similar for the functional units of the secure server 300 and the data storage server 500, which will be described later.

[0031] Furthermore, some or all of the functions of the functional units of the data holder terminal 200, secure server 300, and data storage server 500 may be implemented by dedicated hardware such as ASIC (Application Specific Integrated Circuit) or FPGA (Field-Programmable Gate Array).

[0032] The auxiliary storage device 220 includes, for example, a data recording unit 230 and a parameter recording unit 240. The data recording unit 230 records various data, including, for example, the data S to be deposited. The parameter recording unit 240 records various parameters, including keys used by the encryption / decryption processing unit 211. Specifically, for example, the parameter recording unit 240 records a secret key H used for the secure storage of keys used for data encryption.

[0033] In this embodiment, the information used by the secure data backup system is independent of the data structure and may be represented in any data structure. For example, a data structure appropriately selected from tables, lists, databases, or queues can store the information.

[0034] Furthermore, in this embodiment, some or all of the information stored in the auxiliary storage device of each device included in the secure data backup system may be stored in the memory of the device, or in an external database connected to the device.

[0035] <Example configuration of Secure Server 300> Figure 3 is a block diagram showing an example configuration of a secure server 300. The secure server 300 is composed of a computer including an input device 301, an output device 302, a communication device 303, a CPU 310, a memory 316, and an auxiliary storage device 320, which are connected to each other by internal communication lines such as a bus.

[0036] The hardware descriptions of the input device 301, output device 302, and communication device 303 are the same as those for the input device 201, output device 202, and communication device 203, respectively, and are therefore omitted. Below, the differences between the CPU 310 and memory 316 and those of the CPU 210 and memory 215 will be explained, and explanations of similar points will be omitted.

[0037] The CPU 310 holds a unique encryption / decryption key 311 within itself. The unique encryption / decryption key 311 held by the CPU 310 is a key that can only be used by that CPU 310 (the unique encryption / decryption key 311 of the CPU 310 cannot be viewed by other hardware included in the computer containing the CPU 310 or by other computers). The CPU 310 includes, for example, a secure processing unit 312 and a data management unit 313, both of which are functional units. The secure processing unit 312 also includes, for example, an encryption / decryption processing unit 314 and a key management unit 315, both of which are functional units.

[0038] The encryption / decryption key 311 is used to encrypt and decrypt data written to memory 316. By encrypting the data written to memory 316 with the encryption / decryption key 311, it is prevented from being intercepted by a third party through the memory 316 itself or signals flowing through internal communication lines. The secure processing unit 312 performs encryption / decryption using the encryption / decryption key 311, for example, within the CPU 310.

[0039] Furthermore, if there is no risk of the data written to memory 316 being viewed by a third party, the decryption key 311 does not need to be stored inside the CPU 310 (for example, it may be stored in the parameter recording unit 340 of the auxiliary storage device 320).

[0040] Furthermore, the encryption / decryption key 311 possessed by the first secure server 300-1 (unique to the first secure server 300-1) and the encryption / decryption key 311 possessed by the second secure server 300-2 (unique to the second secure server 300-2) are, in principle, different keys. Also, the second secure server 300-2 does not need to possess an encryption / decryption key 311.

[0041] The CPU 310 is, for example, a CPU that supports TEE (Trusted Execution Environment). The secure processing unit 312 of the CPU 310 uses the TEE function to create a hardware memory area, a trusted area (which is also a secure area) that is logically isolated from other areas, in memory 316. When the CPU 310 creates this trusted area in memory 316, it uses, for example, an encryption / decryption key 311. The trusted area may be created when processing is executed, or it may be created before processing starts.

[0042] The secure processing unit 312 (and each functional unit included in the secure processing unit 312) uses the trusted area to perform various processes described later (however, the decryption process using the decryption key 311 is performed inside the CPU 310). When the secure processing unit 312 outputs data used in processing using the trusted area, or data generated by processing using the trusted area, to an external location outside the trusted area (such as the normal area, auxiliary storage device 320, or an external device described later), it is preferable for the decryption processing unit 314 to encrypt the data on the trusted area first, and then output only the encrypted data to the external location.

[0043] Furthermore, when the secure processing unit 312 performs various processing using the encrypted data, the decryption processing unit 314 decrypts the encrypted data in the trusted area, and then performs various processing on the decrypted data.

[0044] The secure processing unit 312 can perform encryption and decryption processing within the CPU 310, or perform processing using a trusted area, thereby concealing data used in processing by the secure processing unit 312 and data generated by the secure processing unit 312 from administrators of the secure data backup system and the secure server 300, and thus achieving secure processing. Furthermore, the secure processing unit 312 can further enhance security by encrypting the data when outputting it outside the trusted area.

[0045] Functional units included in the CPU 310 that are not included in the secure processing unit 312 and are different from those in the secure processing unit 312 will perform processing using a normal area of ​​the memory 316 that is different from the trusted area. Furthermore, if the secure server 300 also has a GPU, the GPU will perform processing using that normal area.

[0046] In the example described above, TEE is used to provide an environment for processing in a secure, isolated area on memory 316, but a different method may be used.

[0047] Note that CPU 310 does not necessarily have to be a TEE-compatible CPU. In this case, CPU 310 does not create a trusted area in memory 316, and various processes that are supposed to be executed using the trusted area are executed using the normal area within memory 316.

[0048] The key management unit 315 manages the keys used for encryption and / or decryption by the encryption / decryption processing unit 314. The data management unit 313 manages the data held by the secure server 300.

[0049] The auxiliary storage device 320 includes, for example, a data recording unit 330 and a parameter recording unit 340. The data recording unit 330 records various data, including, for example, encrypted data of the data S to be deposited. The parameter recording unit 340 records various parameters, including keys used by the encryption / decryption processing unit 314.

[0050] <Example configuration of data storage server 500> Figure 4 is a block diagram showing an example configuration of the data storage server 500. The data storage server 500 is composed of a computer including an input device 501, an output device 502, a communication device 503, a CPU 510, a memory 515, and an auxiliary storage device 520, which are connected to each other by internal communication lines such as a bus.

[0051] The hardware descriptions of the input device 501, output device 502, communication device 503, CPU 510, memory 515, and auxiliary storage device 520 are the same as those for the input device 201, output device 202, communication device 203, CPU 210, memory 215, and auxiliary storage device 220, respectively, and are therefore omitted.

[0052] The CPU 510 includes, for example, a functional unit, a data management unit 511. The data management unit 511 manages the data held by the secure server 300.

[0053] The auxiliary storage device 520 includes, for example, a data recording unit 530 and a parameter recording unit 540. The data recording unit 530 records various data, including, for example, encrypted copies of the data S to be deposited. The parameter recording unit 540 records various parameters.

[0054] <Data deposit for Secure Server 300-1 (1st Secure Server)> Figure 5 is a sequence diagram showing an example of data deposit processing to the first secure server 300-1. In data deposit processing, the data holder terminal 200 deposits the data S held in the data recording unit 230 to the first secure server 300-1 without it being seen by a third party.

[0055] First, in steps S501 and S502, the key management unit 212 of the data holder terminal 200 and the key management unit 315 of the first secure server 300-1 share the decryption key TA for decrypting the data S held by the data holder terminal 200, for example, using the Diffie-Hellman key sharing method. Note that the decryption key TA may have already been shared between the key management unit 212 of the data holder terminal 200 and the key management unit 315 of the first secure server 300-1, in which case the processing in steps S501 and S502 is omitted.

[0056] In step S503, the decryption processing unit 211 of the data holder terminal 200 encrypts the data S stored in the data recording unit 230 with the decryption key TA to create a ciphertext E TA (S) is created. The encryption / decryption processing unit 211 performs encryption in step S503 using an algorithm such as a known symmetric-key cryptographic scheme.

[0057] In step S504, the data management unit 213 of the data holder terminal 200 processes the ciphertext E TA (S) is sent to the first secure server 300-1. In step S505, the decryption processing unit 314 of the first secure server 300-1 processes the ciphertext E received in step S504. TA Data S is retrieved by decrypting (S) using the decryption key TA, and the data deposit process is completed.

[0058] Furthermore, the decryption key TA may be deleted from the data holder terminal 200 after the processing in step S503 is completed. Also, the decryption key TA may be deleted from the first secure server 300-1 after the processing in step S505 is completed.

[0059] <Depositing the private key to the second secure server 300-2> Figure 6 is a sequence diagram showing an example of the private key deposit process to the second secure server 300-2. In the private key deposit process, the data holder terminal 200 sends the private key H held in the parameter recording unit 240 to the second secure server 300-2.

[0060] First, in steps S601 and S602, the key management unit 212 of the data holder terminal 200 and the key management unit 315 of the second secure server 300-2 share the decryption key TB for decrypting the secret key H held by the data holder terminal 200, for example, using the Diffie-Hellman key sharing method. Note that the decryption key TB may have already been shared between the key management unit 212 of the data holder terminal 200 and the key management unit 315 of the second secure server 300-2, in which case the processing in steps S601 and S602 is omitted.

[0061] In step S603, the decryption processing unit 211 of the data holder terminal 200 encrypts the secret key H recorded in the parameter recording unit 240 with the decryption key TB to create the ciphertext E TB (H) is created. The decryption processing unit 211 performs encryption in step S603 using an algorithm such as a known symmetric-key cryptography scheme.

[0062] In step S604, the data management unit 213 of the data holder terminal 200 processes the ciphertext E TB (H) is sent to the second secure server 300-2. In step S605, the decryption processing unit 314 of the second secure server 300-2 processes the ciphertext E received in step S504. TB By decrypting (H) using the decryption key TB, the private key H is retrieved, and the private key deposit is completed.

[0063] Furthermore, the decryption key TB may be deleted from the data holder terminal 200 after the processing in step S603 is completed. Also, the decryption key TA may be deleted from the second secure server 300-2 after the processing in step S605 is completed.

[0064] <Encryption key sharing process between secure servers 300 and encrypted storage process of data S> Figure 7 is a sequence diagram showing an example of data encryption and storage processing. In data encryption and storage processing, the first secure server 300-1 and the second secure server 300-2 share a key for encrypting data S, and each of the first secure server 300-1 and the second secure server 300-2 encrypts and stores the key.

[0065] First, in steps S701 and S702, the key management unit 315 of the first secure server 300-1 and the key management unit 315 of the second secure server 300-2 share a decryption key k (an example of a first shared key) for decrypting the data encryption key R, which will be described later, using, for example, the Diffie-Hellman key sharing method.

[0066] In step S703, the key management unit 315 of the first secure server 300-1 generates a data encryption key R, for example, randomly. Note that the data encryption key R may already be stored in memory 316; in this case, the process in step S703 is omitted.

[0067] In step S704, the decryption processing unit 314 of the first secure server 300-1 encrypts the data encryption key R within the CPU 310 of the first secure server 300-1 using a decryption key 311 unique to the first secure server 300-1 (its CPU 310), and the data management unit 313 of the first secure server 300-1 stores the encrypted data encryption key R in the parameter recording unit 340 of the first secure server 300-1.

[0068] In step S705, the decryption processing unit 314 of the first secure server 300-1 encrypts the data encryption key R to be deposited with the second secure server 300-2 with the decryption key k, thereby obtaining the ciphertext E k (R) Create an example of the first ciphertext.

[0069] In step S706, the data management unit 313 of the first secure server 300-1 transmits the ciphertext E k (R) to the second secure server 300-2. In step S707, the encryption / decryption processing unit 314 of the second secure server 300-2 receives the ciphertext E in step S706 k (R) is decrypted using the encryption / decryption key k to extract the data encryption key R.

[0070] In step S708, the encryption / decryption processing unit 314 of the first secure server 300-1 encrypts the data S extracted in step S505 with the data encryption key R to obtain a ciphertext E R (S) (an example of a second ciphertext), and the data management unit 313 of the first secure server 300-1 stores the ciphertext E R (S) in the data recording unit 330 of the first secure server 300-1. Note that, after the processing of step S708 is completed, the unencrypted data S and the unencrypted data encryption key R are erased from the first secure server 300-1.

[0071] In step S709, the encryption / decryption processing unit 314 of the second secure server 300-2 encrypts the data encryption key R using the secret key H extracted in step S605 to obtain a ciphertext E H (R) (an example of a third ciphertext), and the data management unit 313 of the second secure server 300-2 stores the ciphertext E H (R) in the parameter recording unit 340 of the second secure server 300-2. Note that, after the processing of step S709 is completed, the unencrypted data encryption key R is erased from the second secure server 300-2.

[0072] In step S710, the data management unit 313 of the first secure server 300-1 transmits the ciphertext E R (S) to the data storage server 500. The data management unit 511 of the data storage server 500 stores the ciphertext E received in step S710 R (S) in the data recording unit 530.

[0073] In step S711, the key management unit 315 of the second secure server 300-2 deletes the private key H from the second secure server 300-2, and the data encryption and storage process ends. Because the private key H is deleted from the second secure server 300-2, the second secure server 300-2 cannot decrypt the data encryption key R unless it receives the private key H again from the data holder terminal 200, and therefore the ciphertext E R Even if (S) is obtained, data S cannot be recovered. Therefore, the risk of data S being leaked can be reduced.

[0074] In step S704, the first secure server 300-1 shares the secret key H with the data holder terminal 200 in a manner similar to that shown in Figure 6, and encrypts the data encryption key R with the secret key H in a manner similar to that shown in step S709, thereby creating the ciphertext E R (S) is generated, and the generated ciphertext E R (S) may be stored in the parameter recording unit 340 of the first secure server 300-1. In this case, after the first secure server 300-1 encrypts the data encryption key R with the secret key H, it deletes the secret key H from the first secure server 300-1.

[0075] Furthermore, the decryption key k may be deleted from the first secure server 300-1 after the processing in step S705 is completed. Also, the decryption key k may be deleted from the second secure server 300-2 after the processing in step S707 is completed.

[0076] In step S704, the decryption processing unit 211 of the first secure server 300-1 may encrypt the data encryption key R using a key that can only be regenerated within the first secure server 300-1, which is generated by adding the decryption key 311, which is the unique key of the first secure server 300-1, and auxiliary information that can only be generated within the first secure server 300-1. In this case, when decrypting the data encryption key R in the deposit data utilization processing described later, the regenerated key will be used.

[0077] <Use of deposited data> An example of the process by which the data holder terminal 200 uses the deposited data S when the first secure server 300-1 is operating normally will be described. The data management unit 213 of the data holder terminal 200 generates a request to use the data S in accordance with, for example, the user's input to the input device 201, and sends the request to the first secure server 300-1.

[0078] When the encryption / decryption processing unit 314 of the first secure server 300-1 receives the request, it retrieves the data encryption key R that was encrypted in step S704 and stored in the parameter recording unit 340, and retrieves the data encryption key R by decrypting it internally in the CPU 310 using the encryption / decryption key 311, which is the unique key of the CPU 310 of the first secure server 300-1.

[0079] The decryption processing unit 314 of the first secure server 300-1 receives the ciphertext E from the data recording unit 330 of the first secure server 300-1. R (S) is extracted, and the ciphertext E R By decrypting (S) with the acquired data encryption key R, the data S is extracted.

[0080] The key management unit 315 of the first secure server 300-1 and the key management unit 212 of the data holder terminal 200 share a key in the same manner as in steps S501 and S502, for example. The decryption processing unit 314 of the first secure server 300-1 encrypts the data S with the shared key (an example of the third shared key), and the data management unit 313 of the first secure server 300-1 transmits the data S encrypted with the shared key (an example of the sixth encrypted data) to the data holder terminal 200. After the data S is encrypted with the shared key, the decrypted data S is deleted from the first secure server 300-1.

[0081] The decryption processing unit 211 of the data holder terminal 200 receives the data S encrypted with the shared key from the first secure server 300-1, and retrieves the data S by decrypting the data S encrypted with the shared key using the same shared key.

[0082] <Data Recovery> Figure 8 is a sequence diagram showing an example of data recovery processing when the first secure server 300-1 becomes unavailable due to a failure or other issue. In the data recovery process shown in Figure 8, the second secure server 400, upon receiving a request from the data holder terminal 200, recovers the data that was deposited with the data storage server 500.

[0083] First, in step S801, the data management unit 213 of the data holder terminal 200 generates a data recovery request for data S in accordance with, for example, the user's input to the input device 201, and sends the recovery request to the second secure server 300-2.

[0084] In step S802, when the data management unit 313 of the second secure server 300-2 receives a request to restore data S, it sends the encrypted text E of data S to the data storage server 500. R Requesting the transmission of (S), the data storage server 500 sends the encrypted message E R (S) is received.

[0085] In steps S803 and S804, the key management unit 212 of the data holder terminal 200 and the key management unit 315 of the second secure server 300-2 share the decryption key TB' (an example of a second shared key) using, for example, the Diffie-Hellman key sharing method. Note that the decryption key TB' may have already been shared between the key management unit 212 of the data holder terminal 200 and the key management unit 315 of the second secure server 300-2, in which case the processing in steps S803 and S804 is omitted.

[0086] In step S805, the decryption processing unit 211 of the data holder terminal 200 encrypts the secret key H stored in the parameter recording unit 240 using the decryption key TB', thereby creating the ciphertext E TB’ (H) (An example of the fourth ciphertext) is generated, and the data management unit 213 generates the ciphertext E TB’Send (H) to the second secure server 300-2.

[0087] In step S806, the decryption processing unit 314 of the second secure server 300-2 processes the received ciphertext E TB’ The private key H is obtained by decrypting (H) using the shared encryption / decryption key TB'. In step S807, the encryption / decryption processing unit 314 of the second secure server 300-2 processes the ciphertext E H The data encryption key R is extracted by decrypting (R) using the secret key H.

[0088] In step S808, the decryption processing unit 314 of the second secure server 300-2 processes the ciphertext E received in step S802. R Data S is extracted by decrypting (S) using R. The decrypted data encryption key R is deleted from the second secure server 300-2 after the completion of the process in step S808.

[0089] In step S809, the second secure server 300-2 encrypts the data S using the encryption / decryption key TB' shared in step S804, thereby obtaining the ciphertext E TB’ (S) (An example of the fifth ciphertext) is created, and ciphertext E TB’ (S) is sent to the data holder terminal 200. The decrypted data S is deleted from the second secure server 300-2 after the completion of the process in step S809.

[0090] In step S810, the decryption processing unit 211 of the data holder terminal 200 processes the ciphertext E received in step S809. TB’ Data S is retrieved by decrypting (S) using the shared encryption key TB'. In step S811, the key management unit 315 of the second secure server 300-2 deletes the secret key H from the second secure server 300-2, and the data recovery process ends.

[0091] This embodiment provides an example of a data recovery method in the event that a failure occurs in the first secure server 300-1 and the data S deposited by the data holder terminal 200 cannot be retrieved from the first secure server 300-1. The first secure server 300-1, the second secure server 300-2, and the data storage server 500 may be installed in the same data center, or some or all of them may be installed separately in different data centers.

[0092] However, if the location where the first secure server 300-1 is installed is damaged due to a disaster or other reason, making it difficult to use, the possibility of data recovery and availability will increase if the second secure server 300-2 and the data storage server 500 are installed in locations that were not damaged. Therefore, it is desirable that the second secure server 300-2 and the data storage server 500 be installed in locations different from the first secure server 300-1.

[0093] Furthermore, the secure data backup system does not necessarily have to include the data storage server 500. In this case, in step S710, the ciphertext E R (S) is sent to the second secure server 300-2, and the second secure server 300-2 receives the ciphertext E R (S) is stored, and the processing in step S802 is omitted.

[0094] Furthermore, at least a portion of the encryption and decryption processing by the first secure server 300-1, and at least a portion of the encryption and decryption processing by the second secure server 300-2, are performed by the secure processing unit 312 (some encryption and decryption processing may be performed outside the secure processing unit 312). However, since the security level may be significantly reduced if the secret key H, data S, or data encryption key R are leaked, it is desirable that the processing in which this information appears in plain text be performed by the secure processing unit 312.

[0095] In the secure data backup system of this embodiment, the first secure server 300-1 encrypts the data S to be deposited with a data encryption key R, and stores the data encryption key R after encrypting it with a decryption key 311, which is the unique key of the CPU 310 of the first secure server 300-1. The first secure server 300-1 also stores a copy of the encrypted data S in the data storage server 500. The second secure server 300-2 encrypts and stores the data encryption key R using the private key H of the data holder terminal 200, and stores the private key H within the second secure server 300-2. The data storage server 500 (and the first secure server 300-1) does not hold the private key H, nor does it hold any information regarding the data encryption key R.

[0096] As a result, unless the second secure server 300-2 receives the secret key H from the data holder terminal 200, it cannot recover the data S even if it cooperates with the data storage server 500 (i.e., it cannot recover the data S without the user's permission on the data holder terminal 200), and only the first secure server 300-1 can recover the data S. Furthermore, in order for the first secure server 300-1 to recover the data S, it is necessary to use the decryption key 311, which is the unique key of the CPU 310 of the first secure server 300-1, thus ensuring that the data S is kept extremely secure.

[0097] On the other hand, if the first secure server 300-1 becomes unavailable, the data holder terminal 200 can share the secret key H with the second secure server 300-2 again, and the second secure server 300-2 can cooperate with the data storage server 500 to restore the data S.

[0098] Thus, the secure data backup system of this embodiment robustly protects data S using TEE, etc., and in the event of a failure or other issue with the first secure server 300-1, the second secure server 300-2 can restore data S in cooperation with the data storage server 500, subject to permission or approval (data restoration request) from the user of the data holder terminal 200, i.e., the person with the authority to restore or view the data. This reduces the risk of data loss while utilizing a secure execution environment such as TEE, and allows users to use TEE, etc. in the cloud with greater peace of mind.

[0099] It should be noted that the present invention is not limited to the embodiments described above, and various modifications are included. For example, the embodiments described above are described in detail to make the present invention easier to understand, and are not necessarily limited to those having all the configurations described. It is also possible to replace parts of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add configurations from other embodiments to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace parts of the configuration of each embodiment with other configurations.

[0100] Furthermore, each of the above configurations, functions, processing units, and processing means may be implemented in hardware, either partially or entirely, by designing them as integrated circuits, for example. Alternatively, each of the above configurations and functions may be implemented in software by having the processor interpret and execute programs that implement each function. Information such as programs, tables, and files that implement each function can be stored in memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD.

[0101] Furthermore, the control lines and information lines shown are those deemed necessary for explanatory purposes, and not all control lines and information lines are necessarily shown in the actual product. In reality, it is safe to assume that almost all components are interconnected. [Explanation of symbols]

[0102] 200 Data holder terminal 200, 300-1 First secure server, 300-2 Second secure server, 303 Communication device, 310 CPU, 311 Decryption key, 312 Secure processing unit, 313 Data management unit, 314 Decryption processing unit, 315 Key management unit, 316 Memory, 320 Auxiliary storage device, 500 Data storage server

Claims

1. An information processing system, It comprises a first secure server and a second secure server, The first secure server holds the deposited data, a data encryption key, a first shared key, and a unique key specific to the first secure server. The second secure server holds the private key and the first shared key, The first secure server is, The data encryption key is encrypted with the unique key and stored in the first secure server. A first ciphertext is generated by encrypting the data encryption key with the first shared key and sent to the second secure server. A second ciphertext is generated by encrypting the deposited data with the data encryption key and stored in the first secure server. Output the duplicate data of the second ciphertext, The aforementioned second secure server is The first ciphertext received from the first secure server is decrypted with the first shared key to extract the data encryption key. A third ciphertext is generated by encrypting the extracted data encryption key with the secret key and storing it in the second secure server. An information processing system that deletes the aforementioned private key from the second secure server.

2. The information processing system according to claim 1, The aforementioned second secure server is Hold the second shared key, Obtain the aforementioned duplicated data, The data holder terminal that holds the second shared key receives the request to restore the deposited data and the fourth ciphertext in which the secret key is encrypted with the second shared key, The fourth ciphertext received from the data holder terminal is decrypted with the second shared key to extract the secret key. The third ciphertext is decrypted with the extracted secret key to obtain the data encryption key. The acquired duplicate data is decrypted using the extracted data encryption key to retrieve the deposited data. The extracted deposit data is encrypted with the second shared key to generate a fifth ciphertext, which is then transmitted to the data holder's terminal. An information processing system that deletes the extracted private key from the second secure server.

3. The information processing system according to claim 2, The data holder terminal is further provided, The aforementioned data holder terminal is The aforementioned private key is held, The private key is encrypted with the second shared key to generate the fourth ciphertext. The recovery request and the generated fourth ciphertext are sent to the second secure server. An information processing system that decrypts the fifth ciphertext received from the second secure server using the second shared key and retrieves the deposited data.

4. The information processing system according to claim 3, Furthermore, equipped with data storage servers, The first secure server transmits the replicated data to the data storage server. The data storage server stores the replicated data received from the first secure server within the data storage server. When the second secure server receives the restoration request, it requests the data storage server to send the replicated data. An information processing system in which the data storage server transmits the replicated data to the second secure server in response to a request from the second secure server for the transmission of the replicated data, and the second secure server acquires the replicated data.

5. The information processing system according to claim 2, The data holder terminal holds the third shared key, The first secure server is, The third shared key is held, The request for use of the deposited data is received from the data holder's terminal. The data encryption key encrypted with the aforementioned unique key is decrypted with the aforementioned unique key to extract the data encryption key. The second ciphertext is decrypted with the extracted data encryption key to retrieve the deposited data. An information processing system that encrypts the extracted deposited data with the third shared key to generate a sixth ciphertext and transmits it to the data holder's terminal.

6. The information processing system according to claim 5, The data holder terminal is further provided, The aforementioned data holder terminal is The aforementioned request for use is sent to the first secure server, An information processing system that decrypts the sixth ciphertext received from the first secure server using the third shared key and retrieves the deposited data.

7. The information processing system according to claim 1, The first secure server comprises a first processor and a first memory, The second secure server has a second processor and a second memory, The first processor is A first trust area that is secure and logically isolated is set in the first memory, At least a portion of the encryption and decryption processes performed by the first secure server is executed using the first trusted area. The second processor is, A second trust area that is secure and logically isolated is set in the second memory, An information processing system that performs at least a portion of the encryption and decryption processes by the second secure server using the second trusted area.

8. The information processing system according to claim 1, The first secure server comprises a first processor and a first memory, The unique key is held inside the first processor, An information processing system in which encryption and decryption processes using the aforementioned unique key are performed internally by the first processor.

9. An information processing method using an information processing system, The aforementioned information processing system includes a first secure server and a second secure server. The first secure server holds the deposited data, a data encryption key, a first shared key, and a unique key specific to the first secure server. The second secure server holds the private key and the first shared key, The aforementioned information processing method is The first secure server encrypts the data encryption key with the unique key and stores it within the first secure server. The first secure server generates a first ciphertext by encrypting the data encryption key with the first shared key and sends it to the second secure server. The first secure server generates a second ciphertext by encrypting the deposited data with the data encryption key and stores it within the first secure server. The first secure server outputs a copy of the second ciphertext data, The second secure server decrypts the first ciphertext received from the first secure server using the first shared key to obtain the data encryption key. The second secure server generates a third ciphertext by encrypting the extracted data encryption key with the secret key and stores it within the second secure server. An information processing method wherein the second secure server deletes the private key from the second secure server.

10. A program set comprising one or more programs executable on the first secure server and the second secure server, The first secure server holds the deposited data, a data encryption key, a first shared key, and a unique key specific to the first secure server. The second secure server holds the private key and the first shared key, The first secure server that executed the aforementioned program set, The data encryption key is encrypted with the unique key and stored in the first secure server. A first ciphertext is generated by encrypting the data encryption key with the first shared key and sent to the second secure server. A second ciphertext is generated by encrypting the deposited data with the data encryption key and stored in the first secure server. Output the duplicate data of the second ciphertext, The second secure server that executed the aforementioned program set, The first ciphertext received from the first secure server is decrypted with the first shared key to extract the data encryption key. A third ciphertext is generated by encrypting the extracted data encryption key with the secret key and storing it in the second secure server. A program set for deleting the aforementioned private key from the second secure server.

11. A program set according to claim 10, The program included in the aforementioned program set, This includes a common program executed on the first secure server and the second secure server, or A program set comprising a first program for the first secure server and a second program for the second secure server.

Images