Information processing device, information processing system, and program

Abstract

To continuously update software for a device safely.SOLUTION: An information processing system according to the present invention includes: a meta data generating unit for generating, based on an update request of a firmware from a device, first meta data including identification information of the firmware; a time management unit for managing time; an expiration date determining unit for determining a first expiration date for the first meta data based on the time; a counter for counting up a value at every unit time; an acquiring unit for acquiring a first counter value for the first meta data; a storage unit for storing one or more entries in which second meta data including identification information of the firmware, a second expiration date as an expiration date of the second meta data, and a second counter value acquired for the second meta data are associated with each other, and a determination unit for detecting the second meta data including the same identification information as that of the first meta data, and obtaining the second expiration date and the second counter value from the detected entry including the second metadata to detect any alternation of the first expiration date.SELECTED DRAWING: None

Description

[Technical field]

[0001] An embodiment of the present invention relates to an information processing device, an information processing system, and a program. [Background technology]

[0002] In recent years, various devices are connected to the Internet. Internet-connected devices have various advantages, such as fine-grained control from the cloud and the ability to perform overall optimization that would be difficult for a single device to perform.

[0003] Malicious third parties exploit vulnerabilities in the device's software to launch attacks, and in the long term, attacks against the device are likely to be successful.

[0004] Such devices face the challenge of requiring continuous and secure software updates to patch vulnerabilities. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2018-132874 A [Non-Patent Document 2] The Update Framework Specification Version: 1.0.25, 2021 / 11 / 11 Search, Internet, https: / / theupdateframework.github.io / specification / latest / Summary of the Invention [Problem to be solved by the invention]

[0006] The present embodiment has been made in consideration of the above-mentioned problems, and aims to safely continue updating device software. [Means for solving the problem]

[0007] The information processing device of this embodiment includes a metadata generation unit that generates first metadata including identification information of the firmware based on a firmware update request from a device, a time management unit that manages time, an expiration date determination unit that determines a first expiration date for the first metadata based on the time acquired from the time management unit, a counter that counts up a value per unit time, an acquisition unit that acquires a first counter value that is the value of the counter for the first metadata, a memory unit that stores one or more entries that associate second metadata including identification information of the firmware, a second expiration date that is the expiration date of the second metadata, and a second counter value that is the value of the counter acquired for the second metadata, and a determination unit that detects the second metadata including the same identification information as the first metadata, acquires the second expiration date and the second counter value from the entry including the detected second metadata, and detects tampering with the first expiration date based on the first counter value and the first expiration date, and the second counter value and the second expiration date. [Brief description of the drawings]

[0008] [Figure 1] 1 is a diagram showing the overall configuration of an information processing system according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a diagram showing components of a firmware verification server group according to the embodiment. [Diagram 3] Diagram showing the main components of distributed metadata. [Figure 4] FIG. 2 is a diagram showing components of an expiration date granting server according to the embodiment. [Diagram 5] FIG. 2 is a diagram showing components of a metadata server according to the embodiment. [Figure 6] FIG. 2 illustrates information stored in a metadata source storage unit. [Figure 7] FIG. 4 is a diagram showing information stored in a past metadata storage unit. [Figure 8] 10 is a flowchart showing an example of an update process of the information processing system according to the embodiment. [Figure 9] 10 is a flowchart showing an example of the firmware registration process described in step S1001. [Figure 10] 5 is a flowchart showing an example of a process for updating firmware in the present embodiment. [Figure 11] 11 is a flowchart showing an example of a process for determining whether absolute time has been tampered with; [Figure 12] 11 is a flowchart showing an example of a process for determining whether relative time has been tampered with in a metadata server. [Figure 13] 11 is a flowchart showing the process flow of an assumed count-up value supply unit. [Figure 14] A diagram showing the contradiction that occurs when an attack on a time server causes future absolute time distribution. [Figure 15] 11 is a flowchart showing a firmware update process flow in a device. [Figure 16] FIG. 13 is a diagram showing a configuration example of a modified example of the present embodiment. [Figure 17] FIG. 13 is a diagram showing components of a metadata server according to the present modified example. [Figure 18] 11 is a flowchart showing relative time correction at the time of starting up a metadata server. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. FIG. 1 shows the overall configuration of an information processing system 1000 according to this embodiment. The information processing system 1000 includes a firmware verification server group 1100, a firmware distribution server 1200, and a firmware registration machine 1300. The information processing system 1000 is connected to a plurality of devices 1500 via a network 1400 .

[0010] In the information processing system 1000 according to this embodiment, devices 1500 installed in different locations update firmware using the information processing system 1000, which is a cloud system.

[0011] The network 1400 is made up of a plurality of networks. For example, in this embodiment, the network 1400 is made up of a wide area network 1410, a wired local network 1420, and a wireless local network 1430.

[0012] The wide area network 1410 is connected to the firmware verification server group 1100 and the firmware distribution server 1200. The device 1500 can communicate with the firmware verification server group 1100 and the firmware distribution server 1200 through the wide area network.

[0013] The device 1500 is a device on which firmware, which is software to be updated, runs. In this embodiment, the device 1500 is a PC or an embedded device, but may be any other device on which firmware runs.

[0014] The device 1500 is placed in a field, for example, as in a sensor network operation, and is connected to a wireless local network 1430 through a wireless access point. The device 1500 is installed in a factory, for example, and is connected to a wired local network 1420 such as Ethernet.

[0015] The device 1500 is connected to a wide area network 1410, such as the Internet, via a wired local network 1420 and a wireless local network 1430.

[0016] Fig. 2 shows components of the firmware verification server group 1100 according to this embodiment. Fig. 3 shows main components of the metadata 4000 to be distributed. The firmware verification server group 1100 provides information for verifying the authenticity of firmware. In order to verify the authenticity of the firmware, the firmware verification server group 1100 generates information capable of detecting the authenticity of the firmware, called metadata (first metadata) 4000, in response to a request from the device 1500.

[0017] As shown in FIG. 3, the metadata 4000 includes a firmware name 4001, a firmware version 4002, an integrity verification hash value, and an expiration date 4004.

[0018] The firmware name 4001 and the firmware version 4002 are information for determining the firmware to be updated. The firmware name 4001 and firmware version 4002 function as an identifier that uniquely identifies the firmware when combined. The device 1500 obtains firmware from the firmware distribution server 1200 (described later) by making an update request.

[0019] The device 1500 determines the metadata 4000 to be generated by the firmware verification server group 1100 based on the firmware name and firmware version of the firmware requested to be updated.

[0020] The integrity verification hash value 4003 is information for verifying the integrity of the firmware. The integrity verification hash value 4003 is provided with a digital signature by the firmware registration device 1300, which will be described later. The integrity verification hash value 4003, the firmware name 4001, and the firmware version 4002 are identification information for identifying the firmware.

[0021] The expiration date 4004 is information indicating the expiration date of the metadata 4000, and will be described in detail later. The expiration date 4004 is provided with a digital signature by the expiration date providing server 100, which will be described later, so that any tampering with the expiration date 4004 can be easily detected.

[0022] In the information processing system 1000 according to this embodiment, the firmware and the metadata 4000 for verification are separated, which enables detailed control of the expiration date 4004.

[0023] The frequency of firmware updates is often determined by, for example, the number of vulnerabilities contained in the firmware, the frequency with which they are discovered, etc. This makes it difficult to predict when the next firmware will be released at the time of firmware release.

[0024] If the firmware includes its own expiration date, it must be set to a very long time to prevent the firmware from expiring before the next firmware is released. For example, the firmware must determine the maximum validity period when it is digitally signed, and must be signed with that validity period set.

[0025] If the expiration date 4004 is set to a long period of time, there is a problem in that the old firmware remains valid even though new firmware has been released, which induces downgrading. By separately acquiring the metadata 4000, the information processing system 1000 can flexibly set the expiration date at the timing when the firmware verification server group 1100 creates the metadata 4000.

[0026] The expiration date 4004 may be set to a period ranging from a few minutes to a few days depending on the operational status of the firmware. For example, if the network environment of the device 1500 is good and the metadata 4000 can be acquired on demand, the expiration date is set to a few minutes. When the device 1500 requests metadata for the latest firmware, the metadata 4000 is sent on demand, and the device 1500 can complete the verification within the expiration date 4004 and update to the latest firmware.

[0027] For example, if the network is not connected because a high level of security is required, or the network is congested due to a security incident, and the network is unreachable or unstable, the validity period 4004 is set to several days. When the device 1500 requests metadata for the latest firmware, the developer must obtain the metadata 4000 from the firmware verification server group 1100, transport it to the site, and input the metadata 4000 into the device 1500 using a USB memory stick or the like. Since it takes time for the device 1500 to complete verification of the metadata 4000, the expiration date 4004 needs to be set to a length in the order of several days.

[0028] In such a case, the expiration date 4004 is a few days at most, so the possibility of a downgrade attack using the metadata 4000 is low. For example, the metadata 4000 that has already been transmitted can be reused for a short period of time as long as the time information set in the device 1500 is correct, and a replay attack is unlikely to be successful.

[0029] When the firmware verification server group 1100 is requested to transmit the metadata 4000 of firmware other than the latest firmware, the firmware verification server group 1100 can prevent the distribution of old metadata by refusing to transmit the metadata 4000.

[0030] The firmware verification server group 1100 includes an expiration date granting server (first information processing device) 100, a metadata server (second information processing device) 200, and a time server 300. In this embodiment, the servers constituting the firmware verification server group 1100 are physical servers that are a plurality of information processing devices, but they do not have to be physical servers. For example, they may be virtual servers or container environments.

[0031] From a security standpoint, it is desirable that the servers constituting the firmware verification server group 1100 are not configured to run multiple processes on one OS. For example, it is desirable that one server is not configured to perform the roles of the expiration date granting server 100, the metadata server 200, and the time server 300 without memory separation.

[0032] By isolating the memory of the servers constituting the firmware verification server group 1100, even if they are attacked by a malicious third party, it is possible to prevent any effect on servers other than the attacked server.

[0033] In this embodiment, the expiration date granting server 100, the metadata server 200, and the time server 300 that constitute the firmware verification server group 1100 are operated independently.

[0034] FIG. 4 shows components of the expiration date granting server 100 according to this embodiment. The expiration date assigning server 100 assigns an expiration date 4004 to the metadata 4000 . When the expiration date assigning server 100 is requested by the metadata server 200 to assign an expiration date to the metadata 4000, the expiration date assigning server 100 assigns an expiration date 4004 to the entire metadata 4000 and returns the request. The expiration date 4004 is the current time plus a validity period previously determined for the entire information processing system 1000. A digital signature is added to the expiration date 4004 by the expiration date server 100 to prevent tampering.

[0035] If the expiration date granting server 100 is attacked by a malicious third party, the expiration date 4004 of the metadata 4000 transmitted to the device 1500 may be freely tampered with. For example, a malicious third party may attempt to downgrade the firmware on device 1500 by lengthening the expiration date 4004 . At this time, since the integrity verification hash value 4003 cannot be tampered with by a malicious third party, all that the malicious third party can do is to make the device 1500 mistakenly believe that the old version of the firmware is valid.

[0036] The expiration date granting server 100 includes a first time receiving unit 110, an expiration date calculating unit 120, an expiration date signing unit 130, an expiration date granting request receiving unit 140, an expiration date signing key saving unit 150, and a key pair generating unit 160.

[0037] The first time receiving unit 110, as part of a time management unit that manages time, communicates with a time server 300 to synchronize absolute time. The first time receiving unit 110 obtains the time from the time information of the time server 300. The first time receiving unit 110 synchronizes with an absolute time that indicates a time expression that can uniquely identify a certain time, such as 8:30 or 23:24, regardless of the device or location. Even if there is an error between the absolute time indicated by the time information acquired by the first time receiving unit 110 and the absolute time recognized by the expiration date granting server 100, the first time receiving unit 110 corrects the absolute time to match the received time information.

[0038] The expiration date calculation unit 120 functions as an expiration date determination unit that calculates an expiration date (first expiration date) by adding a validity period defined in advance in the system to the current absolute time. For example, if the validity period is 1 day and the current time is 10:10, the expiration date will be 10:10 the next day, and if the validity period is 10 minutes, the expiration date will be 10:20 that day.

[0039] The expiration date signature unit 130 attaches a digital signature to the combination of the calculated expiration date 4004 and the metadata source, and assigns a tamper-proof expiration date to the entire metadata source. The metadata source is information that becomes the source of the metadata 4000 when the metadata 4000 is generated, which will be described later.

[0040] The expiration date assignment request receiving unit 140 receives a request for assigning an expiration date to a metadata source. The request received by the expiration date assignment request receiving unit 140 is sent to the expiration date calculation unit 120.

[0041] The expiration signature key storage unit 150 stores the keys (private key, public key) generated by the key pair generation unit 160. Since the expiration date signing key storage unit 150 and the key pair generation unit 160 are both inside the expiration date granting server 100, there is no possibility of leakage due to, for example, transfer from outside or cracking of the key generation device.

[0042] FIG. 5 shows components of a metadata server 200 according to this embodiment. The metadata server 200 generates metadata in response to a request from a device. The metadata server 200 is connected to the expiration date granting server 100 and the time server 300. The metadata server 200 is connected to the wide area network 1410 and can directly communicate with the device 1500 because it needs to transmit metadata.

[0043] The metadata server 200 determines the metadata to be generated using the firmware name 4001 and firmware version 4002 received from the device 1500 as keys.

[0044] When creating the metadata 4000, the metadata server 200 holds only the firmware name 4001, the firmware version 4002, and the integrity verification hash value 4003. The metadata server 200 can obtain an expiration date 4004 that the metadata server 200 does not hold by requesting the expiration date assignment server 100 to assign an expiration date, and generate metadata 4000.

[0045] If the metadata server 200 is attacked by a malicious third party, the metadata 4000 transmitted to the device 1500 may be freely tampered with. For example, since the firmware registration machine 1300 affixes a digital signature to the integrity verification hash value of the metadata 4000, it is not possible to make the device 1500 recognize any arbitrary hash value. This prevents the introduction of counterfeit firmware.

[0046] For example, the expiration date 4004 of the metadata 4000 is digitally signed by the expiration date assigning server 100. This makes it impossible to tamper with the expiration date 4004, or even if metadata 4000 for old firmware is transmitted, the expiration date can be treated as having expired by the device 1500. In other words, the device 1500 cannot mistakenly recognize the metadata 4000 as valid, and downgrades due to replay attacks are also prevented.

[0047] The metadata server 200 does not hold any confidential information, such as a private key. The metadata 4000 is digitally signed by the firmware registration device 1300 and the expiration date assignment server 100. Even if internal information of the metadata server 200 is leaked due to an attack by a malicious third party, the internal information is only the metadata 4000 that does not contain any confidential information, so even if it is leaked, there is little possibility that the malicious third party will use it in an attack.

[0048] The metadata server 200 includes a second time receiving unit 210, a relative time generating unit 221, an expected count-up value supplying unit 222, a relative time anomaly determination unit 230, an expiration date assignment requesting unit 240, an absolute time anomaly determination unit 250, a metadata generating unit 261, a past metadata storage unit 263, a registration information receiving unit 270, a metadata transmission feasibility determination unit 280, and a device communication unit 290.

[0049] The second time receiving unit 210 communicates with the time server 300 to synchronize the absolute time. The second time receiving unit 210 synchronizes with an absolute time that indicates a time expression that can uniquely identify a certain time, such as 8:30 or 23:24, regardless of the device or location. Even if there is an error between the absolute time indicated by the time information acquired by the second time receiving unit 210 and the absolute time recognized by the metadata server 200, the second time receiving unit 210 corrects the absolute time to match the received time information.

[0050] The second time receiving unit 210 determines the time by synchronizing at times when time is important, such as when creating the metadata 4000, but when checking the time on a regular basis, the time may be determined by calculation using the determined absolute time and the relative time described below.

[0051] The relative time generating unit 221 generates a relative time by generating a counter value (first counter value) that continues to increase from the moment the metadata server 200 is started. The relative time generating unit 221 functions as a counter that counts up a value for each unit time and as an acquisition unit that acquires the counter value. In this embodiment, a time stamp register inside the CPU is used, but other hardware may be used. The counter value incremented by the relative time generating unit 221 is a value that is added by hardware, and the value cannot be tampered with by software attacks such as malware.

[0052] The relative time is a time that does not depend on the external environment and is individually held for each device 1500. In this embodiment, the relative time is a period of time that has elapsed since the device 1500 was started, with the time being set to 0 when the device 1500 was started. Even for a certain absolute time, the relative time differs depending on the device 1500. The relative time does not have to be expressed in seconds, minutes, or hours, and may be expressed by the number of clocks generated by a clock oscillator in the device 1500.

[0053] For example, time stamp registers are now widely installed in CPUs and have a function of increasing a value according to a clock. The rate at which the timestamp value increases is based on the CPU frequency, so devices 1500 with different CPU frequencies will have different relative times at the same absolute time even if they are started at the same time.

[0054] Even if the CPU is the same product with the same model number, there is some error in the frequency, which is a physical phenomenon. The timestamp register installed in the CPU also generates an error based on the frequency error. As a result, even if devices 1500 equipped with the same CPU are installed, it is unlikely that the relative time will be exactly the same, and the relative time can be used to determine the relative time elapsed since startup on the same device.

[0055] Since the relative time must increase at a constant rate based on a constant frequency, it is difficult to use in a CPU whose operating frequency changes dynamically depending on the processing load, as the increment of the value in the timestamp register is not constant. In such a case, a timestamp register is not used, but a register that returns a device-specific count value independent of frequency is used, so that the relative time can be a monotonically increasing value within a single device.

[0056] The expected count-up value supplying unit 222 calculates, for example, how much the relative time will be counted up for each valid period. For example, when the validity period is one day, the expected count-up value supplying unit 222 returns a value that counts up in one day as the expected count-up value (EC) since the number of valid days (D) this time is one day.

[0057] The relative time anomaly determination unit 230 verifies the relative time at the time of generation of the metadata 4000. The relative time anomaly determination unit 230 calculates the difference between the expiration date of the metadata 4000 that was normally transmitted immediately before and the expiration date of the internally generated metadata 4000 using a processing method described later, and determines whether there is an anomaly in the relative time at the time of generation of the metadata 4000.

[0058] The validity period granting request unit 240 requests the validity period granting server 100 to grant the validity period required for generating the metadata 4000 . The absolute time anomaly determination unit 250 verifies the absolute time.

[0059] The metadata generating unit 261 generates metadata 4000 by combining the expiration date received via the expiration date assignment request unit 240 with information from the metadata source storage unit 262 . The firmware information input by the firmware registration device 1300 is stored in the metadata source storage unit 262 via the registration information receiving unit 270 .

[0060] FIG. 6 shows information 6000 stored in the metadata source store 262 . The metadata source storage unit 262 is a storage that permanently stores information required to create the metadata 4000 . The metadata source storage unit 262 stores, for example, a firmware name 4001, a firmware version 4002, and an integrity verification hash value 4003. The metadata source storage unit 262 stores, for example, information other than the validity period given by the validity period giving server 100 .

[0061] An entry is added to the metadata source storage unit 262 every time the firmware registration device 1300 registers firmware. For example, even if the firmware name 4001 is the same, if the firmware version 4002 is different, the metadata source storage unit 262 stores the firmware as a different entry.

[0062] The metadata source storage unit 262 can also register firmware with the completely identical firmware name 4001 and firmware version 4002 as new firmware by formally changing the firmware version 4002. In such a case, multiple entries with the same integrity verification hash value 4003 are registered.

[0063] For example, if the distributed new firmware has a bug and it is necessary to quickly roll back to the old firmware, the old firmware (firmware version 4002) is older than the new firmware (firmware version 4002) and therefore cannot be updated.

[0064] In such a case, in order to update to the old firmware, the firmware version 4002 of the old firmware is changed and registered as a new version. This makes it possible to essentially update the firmware by registering an old version of firmware as a new version.

[0065] FIG. 7 shows information stored in the past metadata storage unit 263. The past metadata storage unit 263 stores information 5000 on the immediately previous metadata 4000 transmitted to the device 1500 .

[0066] Information 5000 is, for example, an entry that associates metadata (second metadata) when successfully sent to device 1500 with the firmware name 4001, firmware version 4002, expiration date (second expiration date), and the relative time (second counter value) when the metadata was generated. The past metadata storage unit 263 functions as a storage unit that stores the entry.

[0067] For example, an entry is stored in which the firmware name 4001 is “aaa”, the firmware version 4002 is “1”, the expiration date 4004 is “2021 / 03 / 02”, and the relative time “1000” when the metadata 4000 was generated.

[0068] For example, an entry is stored in which the firmware name 4001 is "bbb", the firmware version 4002 is "1", the expiration date 4004 is "2021 / 08 / 11", and the relative time "3000" when the metadata 4000 was generated is stored.

[0069] The past metadata storage unit 263 holds only the most recent entry for each combination of firmware name 4001 and firmware version 4002, and when a newer entry (first entry) for the same combination of firmware name 4001 and firmware version 4002 is sent to the device 1500, the information is also overwritten.

[0070] The metadata transmission permission determining unit 280 determines whether or not the generated metadata 4000 can be transmitted, according to the results of the determinations made by the absolute time anomaly determining unit 250 and the relative time anomaly determining unit 230 .

[0071] If metadata 4000 with a long expiration date 4004 is transmitted, a malicious third party may be able to carry out a downgrade attack. To prevent such attacks, the metadata server 200 avoids transmitting metadata 4000 with an abnormal expiration date set whenever possible. The metadata server 200 checks whether the times of the time server 300 and the validity period granting server 100 have been tampered with by checking the absolute time and the relative time.

[0072] The device communication unit 290 transmits the metadata 4000 that has been determined to be transmitted by wirelessly communicating with the device 1500 . The device communication unit 290 includes a circuit for processing a communication protocol, an AD / DA converter, a frequency converter, a bandpass filter, an amplifier, an antenna, etc. Note that a form in which the device communication unit 290 is connected to the device 1500 by wire is also not excluded.

[0073] The time server 300 distributes accurate time. In this embodiment, the time server 300 uses NTP (Network Time Protocol), but other protocols may be used as long as they can distribute accurate time. In a cloud system, time synchronization is essential for, for example, log management, etc. As a result, all servers constituting the cloud system are synchronized with the time distributed by the time server 300.

[0074] The time server 300 is loosely connected to the expiration date granting server 100 and the metadata server 200. The time server 300 may be replaced by a public NTP server because it uses a standard protocol such as NTP. In other words, the time server 300 does not need to be privately operated by the same operating organization as the operating organization of the firmware verification server group 1100.

[0075] For example, when the reliability of the public NTP server is questionable, or when secure operation of the information processing system 1000 including the time server 300 is required, private operation is desirable.

[0076] The time server 300 may be subject to an attack by a malicious third party, for example, to synchronize the firmware verification server group 1100 with a false time and generate metadata with a long expiration date.

[0077] For example, if the information processing system 1000 is operated in such a way that it always generates metadata 4000 that has an expiration date of one day in the future, there is a possibility that an attack by a malicious third party may cause the current time of the firmware verification server group 1100 to be synchronized with the time of one year in the future. In such a case, the metadata 4000 generated by the firmware verification server group 1100 has an apparent expiration date 4004 that is one day in the future, but actually has an expiration date of one year.

[0078] In such a case, a malicious third party cannot tamper with the integrity verification hash value 4003, and can only make the device 1500 mistakenly believe that the old version of the firmware is valid. The metadata server 200 can detect time tampering by a process described later.

[0079] The firmware distribution server 1200 distributes the firmware body to the device 1500 . The device 1500 obtains unique firmware from the firmware distribution server 1200 using the firmware name and version as keys.

[0080] The firmware distribution server 1200 stores firmware in a directory in such a manner that each file is listed in the format of "file name + version", as seen in a typical file server. For example, the device 1500 can obtain a list of firmware in a directory of the firmware distribution server 1200 as necessary and download the main body of the firmware, but other methods may be used as long as the device 1500 can download the firmware.

[0081] The firmware registration machine 1300 initially registers information required for firmware update in the firmware verification server group 1100 and the firmware distribution server 1200 . The firmware registration device 1300 is connected to the firmware verification server group 1100 and the firmware distribution server 1200. The firmware registration device 1300 does not need to be connected to anything else as long as it can communicate with the server group or a server.

[0082] FIG. 8 shows an example of an update process of the information processing system 1000 according to this embodiment. For example, if a vulnerability is discovered in the firmware of the device 1500 or if it becomes necessary to add a new function, the firmware developer creates new firmware as necessary. The created firmware is then tested and a decision is made as to whether it should be distributed.

[0083] As described above, the update process of the information processing system 1000 according to this embodiment is premised on the fact that testing of new firmware developed by a firmware developer has been completed and distribution has been decided.

[0084] A firmware developer inputs new firmware into the firmware registration device 1300. The firmware registration device 1300 transmits the input firmware to the firmware verification server group 1100 and the firmware distribution server 1200, and registers the information (S1001). By this registration, the firmware is stored in the firmware distribution server.

[0085] The firmware distribution server 1200 distributes firmware in response to a request from the device 1500 (S1002). The firmware verification server group 1100 generates the metadata 4000 in response to a request from the device 1500 (S1003).

[0086] The device 1500 verifies the metadata 4000 transmitted from the firmware verification server group 1100 (S1004). If the device 1500 can verify the authenticity of the firmware using the metadata 4000, it updates the firmware (S1005).

[0087] FIG. 9 shows an example of the firmware registration process described in step S1001. First, a key pair is generated between the firmware registration device 1300 and the expiration date granting server 100 (S1101). The firmware registration machine 1300 generates a key pair (private key, public key) of a public key cryptosystem. The generated key pair is used for digitally signing and verifying the integrity verification hash value of the metadata 4000. The public key can be made verifiable in terms of its authenticity by using a PKI mechanism or by being embedded in the device.

[0088] A key pair of the public key cryptosystem is also generated in the expiration date granting server 100. The generated key pair is used to digitally sign and verify the expiration date of the metadata 4000. The public key is made in such a state that the authenticity can be confirmed by the device 1500.

[0089] The firmware developer inputs new firmware together with the firmware name 4001 and firmware version 4002 into the firmware registration device 1300 (S1102). The firmware name 4001 and the firmware version 4002 do not have to be manually input. For example, if the firmware name 4001 and the firmware version 4002 are embedded in the firmware, the firmware registration device 1300 may automatically read them, or the firmware name 4001 at the time of registration may be automatically recognized.

[0090] The firmware registration device 1300 calculates the firmware integrity verification hash value 4003 and digitally signs it with a private key (S1103).

[0091] The firmware registration device 1300 registers the firmware in the firmware distribution server 1200 (S1104). The firmware registration device 1300 assigns information of a firmware name 4001 and a firmware version 4002 at the time of registration. By providing the firmware name 4001 and firmware version 4002, the device 1500 can obtain a unique firmware body from the firmware distribution server using the firmware name 4001 and firmware version 4002 as keys.

[0092] The firmware registration device 1300 transmits the firmware name 4001, the firmware version 4002, and the digitally signed integrity verification hash value 4003 to the metadata server 200 (S1105). The information transmitted by the firmware registration device 1300 is stored in the metadata source storage unit 262 via the registration information receiving unit 270 .

[0093] FIG. 10 shows an example of a process for updating firmware in this embodiment. First, the device 1500 requests firmware (S1201).

[0094] The device 1500 periodically recognizes the need for a firmware update in any manner. In any method, for example, the device 1500 accesses the firmware distribution server 1200 to confirm that the latest firmware has been released. For example, the device 1500 receives a push notification from another server and recognizes the need to download the latest firmware.

[0095] When the device 1500 recognizes the need for a firmware update through this recognition, it requests the firmware from the firmware distribution server 1200 .

[0096] The firmware distribution server 1200 checks the firmware name 4001 and the firmware version 4002 to uniquely identify the firmware to be updated, and transmits it to the device 1500 (S1202).

[0097] The device 1500 requests the metadata 4000 from the metadata server 200 to verify the authenticity of the firmware (S1203). In order to determine the requested metadata 4000, the device 1500 transmits the firmware name 4001 and the firmware version 4002 as keys so that the corresponding firmware can be uniquely determined.

[0098] The metadata server 200 receives a request from the device 1500 and starts generating the metadata 4000 . The second time receiving unit 210 communicates with the time server 300 to synchronize the absolute time (S1204).

[0099] The expiration date assignment request unit 240 requests the metadata 4000 to assign an expiration date 4004 (S1205). The expiration date assignment request unit 240 searches the metadata source storage unit 262 for an entry that matches the combination of the firmware name 4001 and the firmware version 4002 as keys. The expiration date assignment request unit 240 extracts the matching entry as the original information of the metadata 4000, that is, as a metadata source, and then requests the expiration date assignment server 100 to assign an expiration date to the entire metadata source.

[0100] The validity period granting server 100 synchronizes the absolute time with the time server 300 in order to respond to the request for granting a validity period accepted by the validity period granting request accepting unit 140 (S1206).

[0101] The expiration date granting server 100 calculates the expiration date using the expiration date calculation unit 120, and transmits the calculated expiration date to the metadata server after applying a digital signature to the expiration date using the expiration date signature unit 130 (S1207).

[0102] The metadata server 200, through the metadata generating unit 261, links the acquired expiration date 4004 with the metadata source to generate metadata 4000 (S1208).

[0103] The metadata transmission permission determination unit 280 verifies the metadata 4000, and if normal, transmits the metadata 4000 to the device 1500 (S1209). If there is an abnormality in the metadata 4000, the metadata transmission permission determination unit 280 stops transmission to the device 1500.

[0104] The device 1500 updates the firmware based on the transmitted result (S1210).

[0105] FIG. 11 shows an example of a process for determining whether absolute time has been tampered with. When a malicious third party attempts a downgrade attack on the device 1500, there is a high possibility that the malicious third party will intrude into the expiration date granting server 100 or the time server 300.

[0106] For example, in the case where the expiration date granting server 100 is hacked, there is a high possibility that the private key for the electronic signature of the expiration date granting server 100 has been stolen by the third party. A malicious third party can use a stolen private key to send an abnormally long expiration date 4004 to the metadata server 200 along with a correct digital signature.

[0107] If a malicious third party is unable to steal the private key, for example, if the key itself is securely protected by a hardware security module or the like and cannot be stolen, the malicious third party can reset the absolute time recognized by expiration date granting server 100 to the future. This allows the third party to use the stolen private key to set an abnormally long expiration date 4004 accompanied by a correct digital signature.

[0108] For example, if the time server 300 is compromised, the absolute times of the expiration date granting server 100 and the metadata server 200 will be simultaneously tampered with to become absolute times in the future. Even if the absolute times are simultaneously tampered with, the firmware verification server group 1100 as a whole, including the expiration date granting server 100 and the metadata server 200, operates normally. This causes metadata 4000 with a long expiration date 4004 to be transmitted to the network 1400 .

[0109] To prevent such attacks, the metadata server 200 performs anomaly detection using a combination of absolute time and relative time.

[0110] In the following explanation, it is assumed that the number of valid days (D) of the metadata 4000 in the information processing system 1000 is set to one day. That is, the validity period D, i.e., one day, is added to the current day for the expiration date 4004. The minimum unit is the day, and the fractional parts such as minutes and hours are rounded down, but in this embodiment, the information processing system 1000 is not limited to the validity period in one day units.

[0111] First, the metadata server 200 determines the expiration date of the metadata 4000 (S1301). The metadata server 200 synchronizes and acquires absolute time using the second time receiving unit 210 (S1302).

[0112] The absolute time anomaly determination unit 250 compares the current absolute time with the validity period 4004, and verifies that the time is equal to or less than the validity period (D) (S1303). If the current absolute time is equal to or less than the number of valid days (D), the process proceeds to step A, which is a relative time tampering determination process. If the current absolute time is greater than the number of valid days (D), the process proceeds to step S1304.

[0113] The absolute time anomaly determination unit 250 determines that the absolute time is abnormal, and detects a time anomaly (S1304). If a time anomaly is detected, the transmission process of the metadata 4000 is stopped.

[0114] In this process, when the absolute time of the expiration date granting server 100 is shifted into the future, it is assumed that the difference in absolute time with the metadata server 200, which holds the correct absolute time, will be greater than the number of valid days (D). This makes it possible to detect time anomalies and take measures against time tampering on the expiration date granting server 100.

[0115] FIG. 12 shows an example of a process for determining whether the relative time has been tampered with in the metadata server 200. In FIG. This determination process is based on the premise that the process of determining whether the absolute time has been tampered with has already been performed and there has been no tampering with the absolute time. The metadata server 200 acquires the expiration date (Expired Day now: ED_now) from the metadata 4000 (S1401).

[0116] The metadata server 200 acquires the expiration date (Expired Day old: ED_old) and the relative time (Time Stamp Clock Old: TSC_old) from the past metadata storage unit 263 (S1402).

[0117] In this explanation, the number of valid days (D) is set to one day, and the minimum unit is rounded to one day, so the validity period of the past metadata storage unit 263 is also set to one day. When the number of valid days (D) is controlled in detail in units of valid hours or valid minutes, the validity period in the past metadata storage unit 263 is also stored at that granularity.

[0118] When the metadata server 200 receives a request for the metadata 4000 from the device 1500, the metadata server 200 receives the firmware name 4001 and the firmware version 4002. This makes it possible to acquire appropriate content from the past metadata storage unit 263 using this information as a key.

[0119] The metadata server 200 acquires the relative time (Time Stamp Clock Now: TSC_now) through the relative time generating unit 221 (S1403). The metadata server 200 acquires an expected count-up value (Expect Count: EC) from the expected count-up value supply unit 222 (S1404).

[0120] The relative time anomaly determination unit 230 calculates the number of elapsed days (N) (S1405). The relative time anomaly determination unit 230 can calculate the number of elapsed days (N) from ED_now - ED_old. The number of days elapsed (N) is the difference between the expiration date of the metadata 4000 that was successfully transmitted immediately before and the expiration date of the internally generated metadata 4000. In this embodiment, the validity period is one day, so it is the number of days elapsed, but the validity period may be any other period of time depending on the validity period.

[0121] The relative time anomaly determination unit 230 calculates the elapsed count (C) (S1406). The relative time anomaly determination unit 230 can calculate the elapsed count (C) from TSC_now - TSC_old. The elapsed count (C) is the difference between the relative time (ED_old) at the time of creation of the metadata that was transmitted correctly immediately before and the current relative time, i.e., the value counted up by the relative time generation unit 221 during the number of elapsed days (N).

[0122] The metadata server 200 determines whether the time server 300 has been tampered with (S1407). This makes it possible to determine whether the time server 300 has been tampered with and is distributing future time. The metadata server 200 determines whether the value (third counter value) of the number of elapsed days (N)×the expected count-up value (EC) for one day is equal to or less than the elapsed count, that is, equal to or less than the threshold value. If the value is equal to or less than the elapsed count, it is determined that the future time is not being distributed and the process transitions to S1408, and if the value is greater than the elapsed count, it is determined that the future time is being distributed and the process transitions to S1410.

[0123] Next, the metadata server 200 stores the expiration date 4004 and the relative time of generation in the past metadata storage unit 263 (S1408). If the time from generation of the metadata 4000 to the determination of whether or not to transmit the metadata 4000 is very short, the metadata server 200 may store the relative time at which the metadata 4000 was transmitted as an approximation of the metadata generation time.

[0124] If it is expected that the time from generation of the metadata 4000 to the decision on whether or not to transmit the metadata 4000 will be long, the metadata generation unit 261 may temporarily embed the generation time in the metadata 4000, and refer to that time when storing the metadata in the past metadata storage unit 263.

[0125] Next, the metadata server 200 transmits the metadata 4000 to the device 1500 (S1409).

[0126] If the metadata server 200 determines that a future time is being distributed, it discards the metadata 4000 as abnormal data, and stops the transmission process to the device 1500 (S1410).

[0127] This process utilizes the feature that the relative times of the servers constituting the firmware verification server group 1100 monotonically increase independently of the absolute time, even if the time server 300 distributes a false absolute time. For example, when the time server 300 distributes a future absolute time, the value of the number of elapsed days (N) becomes large, and therefore the determination can be made based on the value calculated in step S1407. This makes it possible to take measures against time tampering by the time server 300.

[0128] FIG. 13 shows a process flow of the assumed count-up value supplying unit 222. In this description, since the number of valid days (D) of the metadata 4000 in the information processing system 1000 is set to one day, the process will be described as determining a value that counts up the relative time by one day.

[0129] The expected count-up value supplying unit 222 determines whether or not the expected count-up value has already been defined (S1501). If the expected count-up value is defined, the process proceeds to S1509, and if the expected count-up value is not defined, the process proceeds to S1502.

[0130] Next, the expected count-up value supplying unit 222 responds that the expected count-up value is undefined (S1502). For example, when the information processing system 1000 is in full operation, the possibility of receiving such a response is low, so it is desirable for the administrator to perform an alert process or the like.

[0131] The assumed count-up value supplying unit 222 acquires the current relative time (T1) from the relative time generating unit 221 (S1503).

[0132] Next, the assumed count-up value supplying unit 222 waits for a certain period of time (TMP) to count up the relative time (S1504). The certain waiting time (TMP) may be any time as long as it is sufficiently small compared to the number of valid days (D) and is a time that allows waiting for operation. For example, if the number of valid days (D) is one day, it may be about one minute.

[0133] The assumed count-up value supplying unit 222 again acquires the current relative time (T2) (S1505). The assumed count-up value supplying unit 222 uses the relative time (T2) and the relative time (T1) to calculate the relative time difference (T), which is the value of T2-T1 (S1506).

[0134] The expected count-up value supplying section 222 calculates the magnification factor (n) (S1507). The magnification (n) is the ratio between the elapsed period and the unit time by which the relative time generating section 221 counts up. The expected count-up value supply unit 222 calculates the magnification (n) by calculating the number of valid days (D) divided by TMP. For example, if the fixed time (TMP) is 1 minute and the number of valid days (D) is 1 day, the number of valid days (D) is 1440 minutes (24 hours x 60 minutes), so the magnification (n) is 1440.

[0135] Next, the expected count-up value supplying section 222 calculates an expected count-up value (S1508). The assumed count-up value supplying unit 222 counts up by the relative time difference (T) during a fixed period of time (TMP). For example, if the relative time difference (T) is 1000 clocks, the relative time advances by 1440 x 1000 clocks per day, based on the magnification (n) x the relative time difference (T). The expected count-up value supplying unit 222 stores the magnification factor (n)×the relative time difference (T) therein as a defined expected count-up value.

[0136] The expected count-up value supplying unit 222 transmits it as a defined value (S1509).

[0137] FIG. 14 shows a state of inconsistency that occurs when an attack on the time server 300 causes future absolute time distribution. Absolute time is based on the time distributed by the time server. For example, if the time server 300 is attacked, a future time is distributed. For example, as shown in FIG. 14, the metadata server 200 that is synchronized with the time server 300 recognizes the true time as 3 / 5 as being synchronized false time, 3 / 9.

[0138] For example, when the metadata server 200 creates the metadata 4000, the past metadata storage unit 263 stores the information. The information focuses on metadata 4000 for firmware with a firmware name 4001 and a firmware version 4002, and the values ​​are overwritten over time. At this time, it is assumed that the expected count-up value (EC) is 1000.

[0139] For example, in FIG. 14, when the metadata server 200 generates metadata with a validity period 4004 of 3 / 4 on 3 / 3, the relative time at that time is 3000. The metadata 4000 can recognize that the number of days elapsed (N) is 1 by referencing the immediately preceding ED_old. Furthermore, the metadata 4000 can recognize that the elapsed count (C) is 1000 by referencing the immediately preceding TSC_old, and is therefore recognized as correct.

[0140] For example, in FIG. 14, when the metadata server 200 generates metadata 4000 on the actual time of 3 / 5, a malicious third party may have synchronized the false time, leading the user to mistakenly believe that metadata 4000 was generated on 3 / 9. At this time, the metadata server 200 has a validity period 4004 of 3 / 10, but the early leaving time is not affected by the time server 300 and is therefore 5000.

[0141] The metadata server 200 references the immediately preceding ED_old of the metadata 4000 and recognizes that the number of days elapsed (N) is 5 days. It also references the immediately preceding TSC_old and recognizes that the elapsed count (C) is 1000. The metadata server 200 assumes that if five days have actually passed, the relative time should also be counted up by 5000 accordingly. The metadata server 200 verifies the relative time based on this assumption, but finds that only 1000 has passed, and recognizes it as invalid.

[0142] FIG. 15 shows a flow of a firmware update process in a device 1500. The device 1500 acquires new firmware (S1601). Next, the device 1500 acquires metadata 4000 of the new firmware (S1602). The device 1500 acquires the running firmware version (S1603).

[0143] The device 1500 compares the firmware versions (S1604). If the version of the new firmware is newer than the version of the currently running firmware, the process transitions to S1605, and if the versions are older or the same, the process transitions to S1608. This makes it possible to prevent downgrades.

[0144] The device 1500 calculates an integrity verification hash value of the new firmware and compares it with the integrity verification hash value 4003 of the metadata 4000 (S1605). This enables the device 1500 to verify that the new firmware has not been tampered with and is not fake firmware that was not intended by the firmware developer.

[0145] The device 1500 also verifies that the metadata integrity verification hash value 4003 has not been tampered with, using the digital signature attached to the integrity verification hash value. If the integrity verification hash value is correct, the process proceeds to S1606, and if it is not correct, the process proceeds to S1608.

[0146] The device 1500 verifies the expiration date of the metadata 4000 (S1606). The device 1500 compares the expiration date 4004 with the absolute time of the device 1500 . If the validity period has not expired, the process transitions to S1607, and if not, the process transitions to S1608.

[0147] When making this comparison, the device 1500 also verifies that the entire metadata 4000, including the expiration date 4004, has not been tampered with, using the digital signature attached to the expiration date 4004. This makes it possible to verify that the metadata itself is not counterfeit.

[0148] The device 1500 updates the firmware to the new firmware (S1607).

[0149] The device 1500 detects that an illegal process has been performed or that the metadata 4000 is illegal, and stops the update process (S1608).

[0150] As described above, according to this embodiment, the expiration date granting server 100, the metadata server 200, and the time server 300 each perform only simple processing, but when they operate in combination as the firmware verification server group 1100, they exhibit effects suitable for firmware updates. As a result, even if any of the servers constituting the firmware verification server group 1100 is attacked by a malicious third party, damage to the firmware verification server group 1100 can be minimized according to the security authority separation model.

[0151] (Variation 1) FIG. 16 shows a configuration example of a modified example of this embodiment. The information processing system 1000 is operated in a redundant manner to cope with cases in which the constituent servers are abnormally stopped due to an unexpected event. For example, by configuring the metadata server 200 to include a plurality of servers in this embodiment, even if one metadata server 200 stops, the firmware verification server group 2100, that is, the information processing system 1000, can continue to operate.

[0152] The firmware verification server group 2100 includes two metadata servers 200_1 and 200_2. The firmware verification server group 2100 is connected to the metadata servers 200_1 and 200_2 and a past metadata sharing section 264 that stores metadata 4000 that was correctly sent in the past. Both of the metadata servers 200_1 and 200_2 can refer to the data in the past metadata sharing section 264.

[0153] FIG. 17 shows components of the metadata server 200_1 according to this modification. The metadata server 200_2 has a similar configuration to that of the metadata server 200_1, and therefore will not be described. The metadata server 200_1 includes a relative time correction unit 223 and a past metadata remote storage unit 265.

[0154] In an operation in which the metadata servers 200_1 and 200_2 transparently refer to the past metadata sharing section 264, the past metadata sharing section 264 has synchronization of relative times in the metadata servers 200_1 and 200_2. Since the relative time starts to increase monotonically from the start of the metadata servers 200_1 and 200_2, when one of the computers is restarted, a discrepancy occurs, resulting in an inconsistency in operation.

[0155] The past metadata remote storage unit 265 is a communication unit for storing, in the past metadata sharing unit 264, information on the past metadata 4000 that has been stored locally on the metadata servers 200_1 and 200_2. By storing the past metadata remotely, it is possible to make the past metadata shareable from either of the metadata servers 200_1 and 200_2.

[0156] The relative time correction unit 223 functions as a counter correction unit which corrects the early leaving time of the metadata server 200_1 by synchronizing the relative time of the metadata server 200_2 with the relative time on the local system. The synchronization of the relative time is a process that is performed only once when the metadata server 200_1 is started up. Since the relative time is 0 at the time of startup, the relative time of the metadata server 200_2 is obtained at the time of startup of the metadata server 200_2 itself. The metadata server 200_1 recognizes the relative time obtained by adding the relative time of the other metadata server to its own relative time as the relative time.

[0157] FIG. 18 shows the relative time correction at the time of starting up the metadata server 200_1. The metadata server 200_1 is started up, and a start-up process is executed (S1701). The metadata server 200_1 judges whether the metadata server 200_2 has been started (S1702). If the metadata server 200_2 has been started, the process proceeds to S1703, and if the metadata server 200_2 has not been started, the metadata server 200_1 judges that it is not necessary to synchronize the relative times since the metadata server 200_1 is the metadata server 200 that has been started first, and ends the process.

[0158] The metadata server 200_1 acquires the relative time from the metadata server 200_2 (S1703). The metadata server 200_1 stores the obtained relative time therein as a relative time correction value S1704).

[0159] The relative time correction unit 223 corrects the relative time from the relative time generation unit 221 by adding the relative time correction value (S1705).

[0160] The present invention is not limited to the above-described embodiment, and the components can be modified and embodied in the implementation stage without departing from the gist of the invention. In addition, various inventions can be formed by appropriately combining the multiple components disclosed in the above-described embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, components from different embodiments may be appropriately combined. [Explanation of symbols]

[0161] 1000 Information Processing Systems 1100 Firmware Verification Servers 1200 Firmware Distribution Server 1300 Firmware Registration Machine 1400 Network 1410 Wide Area Network 1420 Wired local network 1430 Wireless Local Network 1500 devices 100 Expiration date server 110 First time receiving unit 120 Expiration Date Calculation Section 130 Expiration Date Signature Part 140 Expiration Date Request Reception Department 150 Expiration Date Signature Key Storage Unit 160 Key Pair Generation Unit 200 Metadata Server 210 Second time receiving unit 221 Relative time generation unit 222 Expected count-up value supply unit 223 Relative time correction unit 230 Relative time anomaly determination unit 240 Expiration Date Request Department 250 Absolute time anomaly determination unit 261 Metadata Generation Unit 262 Metadata Source Storage Unit 263 Past Metadata Storage Section 264 Past Metadata Sharing Section 265 Remote Storage of Past Metadata 270 Registration Information Receiving Department 280 Metadata transmission availability determination unit 290 Device Communication Section 300 Time Server 4000 Metadata 4001 Firmware Name 4002 Firmware version 4003 Integrity Verification Hash Value 4004 Expiration Date 5000, 6000 information

Claims

1. a metadata generating unit that generates first metadata including identification information of the firmware based on a firmware update request from a device; a time management unit that manages time; an expiration date determination unit that determines a first expiration date for the first metadata based on the time acquired from the time management unit; A counter that counts up a value for each unit time; an acquisition unit that acquires a first counter value, which is a value of the counter, for the first metadata; a storage unit that stores one or more entries that associate second metadata including identification information of firmware, a second expiration date that is an expiration date of the second metadata, and a second counter value that is a value of the counter acquired for the second metadata; a determination unit that detects the second metadata including the same identification information as the first metadata, acquires the second expiration date and the second counter value from the entry including the detected second metadata, and detects tampering of the first expiration date based on the first counter value and the first expiration date, and the second counter value and the second expiration date; An information processing device comprising:

2. The determination unit calculates an elapsed period that is the difference between the first expiration date and the second expiration date, and an elapsed count that is the difference between the first counter value and the second counter value, calculates a value that is counted up at a time corresponding to the elapsed period based on a value that is counted up per unit time of the counter, and detects the tampering by comparing the calculated value with the elapsed count. The information processing device according to claim 1 .

3. The determination unit does not detect the tampering when a difference between the calculated value and the elapsed count is equal to or less than a threshold value. The information processing device according to claim 2 .

4. A time receiving unit receives time information distributed by a time server, The time management unit corrects the time based on the time information. The information processing device according to any one of claims 1 to 3.

5. a metadata transmission permission determination unit that determines whether or not the first metadata is to be transmitted based on a result of the detection of tampering with the first expiration date determined by the determination unit; a device communication unit that transmits the first metadata to the device when it is determined that the transmission of the first metadata is possible; 5. The information processing device according to claim 1, further comprising:

6. a metadata source storage unit that stores identification information of the firmware; The metadata generating unit generates the first metadata from the identification information stored in the metadata source storage unit. The information processing device according to any one of claims 1 to 5.

7. The identification information includes an identifier that uniquely identifies the firmware and an integrity verification hash value that verifies the integrity of the firmware. The information processing device according to any one of claims 1 to 6.

8. The identifier includes a firmware name and a firmware version of the firmware. The information processing device according to claim 7.

9. The counter counts up using a CPU register. The information processing device according to any one of claims 1 to 8.

10. At least two of the counters; a counter correction unit that corrects the first counter value based on the counter by the first counter value based on a different counter; The information processing device according to any one of claims 1 to 9.

11. When the determination unit does not detect tampering with the first expiration date, a first entry including the first metadata, the first expiration date, and the first counter value is stored in the storage unit. The information processing device according to any one of claims 1 to 10.

12. When the entry, which includes in the second metadata the same identification information as the identification information included in the first metadata, exists in the storage unit, the storage unit overwrites the entry based on the first entry. The information processing device according to claim 11.

13. The first expiration date is tampered with by a third party attacking the time management unit to change the time. The information processing device according to any one of claims 1 to 12.

14. The falsification of the first expiration date is caused by a third party attacking the time server and changing the distributed time information. The information processing device according to claim 4.

15. A first information processing device and a second information processing device are provided, the first information processing device has a time management unit that manages time, and an expiration date determination unit that determines a first expiration date for first metadata including identification information of the firmware based on the time acquired from the time management unit and a firmware update request from a device; The second information processing device has a metadata generation unit that generates the first metadata, a counter that counts up a value per unit time, an acquisition unit that acquires a first counter value that is the value of the counter for the first metadata, a storage unit that stores one or more entries that associate second metadata including firmware identification information, a second expiration date that is the expiration date of the second metadata, and a second counter value that is the value of the counter acquired for the second metadata, and a determination unit that detects the second metadata including the same identification information as the first metadata, acquires the second expiration date and the second counter value from the entry including the detected second metadata, and detects tampering with the first expiration date based on the first counter value and the first expiration date, and the second counter value and the second expiration date. Information processing system.

16. a metadata generating step of generating first metadata including identification information of the firmware based on a firmware update request from a device; a time management step for managing time; an expiration date determination step of determining a first expiration date for the first metadata based on the time acquired in the time management step; A counter that counts up a value for each unit time; an acquisition step of acquiring a first counter value, which is a value of the counter, for the first metadata; a storage step of storing one or more entries associating second metadata including identification information of firmware, a second expiration date that is an expiration date of the second metadata, and a second counter value that is a value of the counter acquired for the second metadata; a determination step of detecting the second metadata including the same identification information as the first metadata, acquiring the second expiration date and the second counter value from the entry including the detected second metadata, and detecting tampering of at least one of the second expiration date and the first expiration date based on the first counter value and the first expiration date, and the second counter value and the second expiration date; A computer program for causing a computer to execute the program.

Images