Program execution system, data processing device, program execution method, and program

Abstract

In this program execution system including a data holding device, a program providing device, and a data processing device provided with a mechanism for performing secret calculation in a secure area, the data holding device transmits to the data processing device encrypted data obtained by encrypting data D by a public key PKd of the data holding device, the program providing device transmits to the data processing device an encrypted program obtained by encrypting a program P by a public key PKp of the program providing device, the program providing device transmits to the data processing device a secret key SKp encrypted by a first shared key shared with the data processing device, the data processing device generates a first signature by the secret key SKp in place of the program providing device and transmits the generated first signature to the data holding device, the data holding device verifies the first signature using the public key PKp and transmits to the data processing device the secret key SKd encrypted by a second shared key shared with the data processing device, and the data processing device calculates, in the secure area, a result P(D) of executing, with respect to the data D obtained by decrypting the encrypted data by the secret key SKd, the program P obtained by decrypting the encrypted program by the secret key SKp.

Description

[Technical Field]

[0001] The present invention relates to a secret execution technology in the field of information and communications. [Background technology]

[0002] Conventional technologies for performing calculations while keeping data and programs secret from cloud service providers include, for example, Confidential Computing (Non-Patent Document 1) and Confidential VM (Non-Patent Document 2). These technologies make it possible to isolate and keep confidential highly confidential data, for example, while the data is being processed in the cloud.

[0003] However, these conventional techniques do not take into consideration the risk of data and programs being leaked to each other when the data and programs are in the possession of different users. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Microsoft Azure Confidential Computing official page: https: / / docs.microsoft.com / ja-jp / azure / confidential-computing / overview [Non-patent document 2] Google Confidential VM official page https: / / cloud.google.com / compute / confidential-vm / docs?hl=ja Summary of the Invention [Problem to be solved by the invention]

[0005] The present invention has been made in consideration of the above points, and aims to provide a technology that prevents data from being leaked to the program provider and prevents the program from being leaked to the data holder when a data processing device equipped with a secret computing mechanism processes data of a data holder using a program from a program provider. [Means for solving the problem]

[0006] According to the disclosed technology, there is provided a program execution system including a data storage device, a program providing device, and a data processing device having a mechanism for performing secure computation in a secure area, The data holding device encrypts data D with its own public key PKd and transmits the encrypted data to the data processing device; the program provider device encrypts a program P with its own public key PKp and transmits the encrypted program to the data processing device; the program providing device transmits to the data processing device a secret key SKp encrypted with a first shared key shared between the program providing device and the data processing device; the data processing device generates a first signature using the private key SKp on behalf of the program providing device and transmits the generated first signature to the data holding device; the data holding device verifies the first signature using the public key PKp, and transmits to the data processing device a private key SKd encrypted using a second shared key shared between the data holding device and the data processing device; the data processing device, in the secure area, executes a program P obtained by decrypting the encrypted program with the private key SKp on data D obtained by decrypting the encrypted data with the private key SKd, and calculates a result P(D). A program execution system is provided. [Effects of the Invention]

[0007] According to the disclosed technology, when a data processing device equipped with a secret computing mechanism processes data of a data holder using a program from a program provider, a technology is provided that prevents data from being leaked to the program provider and prevents the program from being leaked to the data holder. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a diagram illustrating an example of a system configuration according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram illustrating an example of a functional configuration of a data processing device. [Figure 3] FIG. 10 is a diagram illustrating an image of processing in a secure area. [Figure 4] FIG. 2 is a sequence diagram showing a processing flow in the first embodiment. [Figure 5] FIG. 10 is a sequence diagram showing a processing flow in the second embodiment. [Figure 6] FIG. 2 illustrates an example of a hardware configuration of the apparatus. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, an embodiment of the present invention (the present embodiment) will be described with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment. In the following description, a program is represented as P, data to be processed by P is represented as D, and the processing result of D by P is represented as P(D).

[0010] (System Configuration) An example of the configuration of a program execution system according to an embodiment of the present invention is shown in Fig. 1. As shown in Fig. 1, the program execution system according to this embodiment includes a data processing device 100, a data holding device 200, and a program providing device 300.

[0011] The data processing device 100, the data holding device 200, and the program providing device 300 may each be a physical machine (computer) or a virtual machine on the cloud. The data holding device 200 and the program providing device 300 may each be a function (e.g., a web browser) that runs on a physical machine or a virtual machine. Furthermore, the data processing device 100 may be a system configured with multiple physical machines (particularly, in the second embodiment described later, two containers running two application programs APP_PE and APP_PV may be generated on different physical machines).

[0012] In this embodiment, the data processing device 100 is provided with a secure computing mechanism or a secret computing mechanism by applying a function called a Trusted Execution Environment (TEE) function, which executes data processing in isolation from an existing OS. In this embodiment, the TEE function is assumed to be, for example, AMD (registered trademark)'s SEV, but this is just an example, and the present invention can be applied to any TEE function. For example, the present invention can also be applied to Intel (registered trademark)'s SGX or TDX, Arm (registered trademark)'s TrustZone (registered trademark), ARM Confidential Compute Architecture, etc.

[0013] 1, a secure channel 400 is established between a data processing device 100 and a data holding device 200, and between the data processing device 100 and a program providing device 300, allowing data and programs to be transmitted and received securely. This secure channel is established, for example, by a remote attestation protocol called Remote Attestation in SEV. However, this is just an example, and the secure channel may be established by any means.

[0014] In this embodiment, a program P is transmitted from the program providing device 300 to the data processing device 100, data D is transmitted from the data holding device 200 to the data processing device 100, the data processing device 100 processes the data D using the program P, and provides the execution result P(D) to the data holding device 200.

[0015] The data processing device 100 uses its secure computing mechanism to prevent the program P and data D from leaking outside the secure area (for example, on the cloud where the data processing device 100 is running). In addition to this, this embodiment realizes a mechanism that prevents the program P from leaking to the data storage device 200 and prevents the data D from leaking to the program providing device 300.

[0016] As a result, in the program execution system of this embodiment, in a use case in which the secure computing mechanism is applied to data distribution, a data holder (data holding device 200) having highly confidential data D and a program author (program providing device 300) having highly confidential program P can combine and execute the data / program while keeping it confidential from each other.

[0017] (Example of configuration of data processing device) Fig. 2 shows an example of the functional configuration of data processing device 100. As shown in Fig. 2, data processing device 100 has secure area 110 which is a protected area where confidentiality is maintained, communication unit 120 which performs data communication with other devices (e.g., data holding device 200, program providing device 300), data storage unit 130 which stores data in storage or the like outside secure area 110, and data processing unit 140 which performs various types of data processing outside secure area 110.

[0018] The contents of the data and programs in the secure area 110 cannot be known from the outside. Outside the secure area 110, normal data storage and data processing (program execution) can be performed by the data storage unit 130 and the data processing unit 140, respectively. Data communication and access control for that communication can also be performed by the communication unit 120.

[0019] Within the secure area 110, data can be stored and data processed (program execution) while maintaining confidentiality. Fig. 2 shows a secure data storage unit 111 and a secure processing unit 112 as functional units that perform these functions within the secure area 110. The secure data storage unit 111 stores various types of data in a memory area within the secure area 110 while maintaining confidentiality. Furthermore, the secure processing unit 112 performs data processing within the secure area 110 (for example, activation and execution of P, generation (calculation) of a common key, encryption, decryption, signature verification, etc.).

[0020] The secure area 110 itself can be realized using existing technology. Any existing technology may be used to realize the secure area 110. For example, the secure area 110 may be realized as a separate chip that is hardware-independent from the main CPU and memory, or the secure area 110 may be realized in software using encryption and authentication technology. The aforementioned SEV is an example of a technology for realizing the secure area 110 in software, and the present embodiment assumes the use of SEV as an example. In this case, the secure area 110 is generated as an encrypted container in the data processing device 100. Note that, for example, if multiple encrypted containers are generated, multiple secure areas 110 will exist, and in this case, they will be referred to as secure area 110-1, secure area 110-2, etc.

[0021] 3 shows an image of data processing in the secure area 110. In this embodiment, "HybEnc" means encryption using a public key-based encryption method, and "Enc" means encryption using a common key-based encryption method. For example, HybEnc(D) is encrypted data.

[0022] As shown in FIG. 3, the data processing device 100 receives HybEnc(D) from the data holding device 200 and receives HybEnc(P) from the program providing device 300.

[0023] In the secure area 110, HybEnc(D) and HybEnc(P) are decrypted to obtain D and P, respectively. Furthermore, in the secure area 110, P(D) is calculated, and then HybEnc(P(D)) is calculated. HybEnc(P(D)) is transmitted to the data holding device 200.

[0024] In this case, in the first embodiment described below, a mechanism is introduced in which the program providing device 300 deposits its own signature key (private key) in the secure area 110, and before calculating P(D), the data processing device 100 signs on behalf of the program providing device 300, and the signature is verified by the data retention device 200. This ensures the authenticity of the program author (program providing device 300), and prevents, for example, a situation in which D is restored from P'(D) due to the execution of an unauthorized program P', resulting in the leakage of D. Furthermore, since a nonce generated by the data processing device 100 is used in the proxy signing, replay attacks can also be prevented.

[0025] Furthermore, in a second embodiment described later, a method called PCC (Proof Carrying Code) is further introduced to introduce a mechanism for verifying that the program P itself is free from fraud. This ensures that specific processing is not executed in the program P, and can prevent, for example, a situation in which processing that is not expected by the data holder (data holding device 200) (e.g., unexpected data transmission or data storage) is executed.

[0026] In this way, a combination of calculations in the secure area 110 and encrypted communication realizes a mechanism that prevents the program P from leaking to the data holding device 200 and prevents the data D from leaking to the program providing device 300.

[0027] Examples 1 and 2 will be described below as examples of the processing flow in this embodiment. In each of the following examples, it is assumed that a remote attestation mechanism is used for generating (sharing) a common key. More specifically, a protocol is used in which a mechanism for mutual authentication between a user (data storage device 200, program providing device 300) and a container is inserted into the Elliptic Curve Diffie-Hellman key exchange protocol (ECDHKE). In this embodiment, this is called ECDHE with mutual authentication.

[0028] In authenticating a container, a third-party verification organization (e.g., AMD Verification Service) is involved, but the process of generating a shared key through the intervention of a third-party verification organization is an existing technology known as Remote Attestation. Therefore, in the explanation of Examples 1 and 2, only an overview of the process related to Remote Attestation is provided, and the parts related to the present invention are explained in detail.

[0029] In the following explanation, APP, APP_PE, and APP_PV are application programs that run on containers and are released as OSS. Program P runs on APP or APP_PE. APP_PE includes a PCC calculation program, and APP_PV includes a PCC verification program. The PCC calculation program is a program that creates proof information PROOF(P) that indicates that program P meets certain requirements (e.g., requirements that program P does not execute a certain process), and the PCC verification program is a program that verifies whether PROOF(P) is correct. For details about PCC, please refer to, for example, References 1 to 3.

[0030] Furthermore, PKp and SKp are the public key and private key, respectively, of the program providing device 300. PKd and SKd are the public key and private key, respectively, of the data holding device 200. Furthermore, HybEnc(A,B) means information obtained by encrypting A with B (public key), and Enc(A,B) means information obtained by encrypting A with B (common key). H(A) means the hash value of A. Sig(A,B) means a signature for A using B (private key). MAC(A,B) means a message authentication code for A using B (common key).

[0031] In the following explanation, it is assumed that the programs running on the container are not replaced after the container is started. This ensures that there is no fraud, such as returning the execution results of program B while showing the execution evidence of program A.

[0032] Example 1 First, a first embodiment will be described with reference to Fig. 4. As a premise of the processing flow in Fig. 4, the data holding device 200 holds D, PKd, and SKd, and the program providing device 300 holds APP, P, PKp, and SKp.

[0033] In S101, the data holding device 200 transmits HybEnc(D,PKd) to the data processing device 100. This HybEnc(D,PKd) is stored by the data storage unit 130 in a public storage area such as the storage of the data processing device 100.

[0034] In S102, the program providing device 300 transmits the APP and HybEnc(P, PKp) to the data processing device 100. The APP and HybEnc(P, PKp) are stored in a public storage area such as the storage of the data processing device 100 by the data storage unit 130. The APP and HybEnc(P, PKp) are also registered with a third-party verification organization by the program providing device 300 and made public.

[0035] In S103, the program providing apparatus 300 transmits to the data processing apparatus 100 a container activation request for running the APP.

[0036] In S104, the data processing device 100 generates and starts a container for running the APP, and encrypts this container. As a result, an encrypted container (secure area 110) in which the APP runs is generated. Hereinafter, the container generated here will be referred to as an "APP container" for convenience.

[0037] In S105, the APP container of the data processing device 100 and the program providing device 300 each generate (calculate) a common key Kp using ECDHE with mutual authentication. At this time, the APP container of the data processing device 100 authenticates the user (program providing device 300) by verifying the signature by SKp using PKp, and the program providing device 300 authenticates the APP container by verifying the hash value H(APP+HybEnc(P,PKp)) from the APP container of the data processing device 100 via a third-party verification organization. Note that H(APP+HybEnc(P,PKp)) represents the hash value of data combining APP and HybEnc(P,PKp), and is, for example, the hash value of data concatenating the bit strings of APP and HybEnc(P,PKp).

[0038] In S106, the APP container of the data processing device 100 and the data storage device 200 each generate (calculate) a shared key Kd using ECDHE with mutual authentication. At this time, the APP container of the data processing device 100 authenticates the user (data storage device 200) by verifying the signature based on SKd using PKd, and the data storage device 200 authenticates the APP container by verifying the hash value H(APP+HybEnc(P,PKp)) from the APP container of the data processing device 100 via a third-party verification organization.

[0039] In S107, the program providing device 300 transmits Enc(SKp,Kp) and Sig(H(Enc(SKp,Kp)),SKp) to the APP container of the data processing device 100. At this time, the program providing device 300 may further transmit Enc(PKd-list,Kp) and Sig(Enc(PKd-list,Kp),SKp) to the APP container of the data processing device 100. Here, PKd-list is a list of public keys of data holders (data holding devices 200) that the program providing device 300 permits to execute the program P.

[0040] However, the PKd-list may be passed to the APP container in an earlier process, for example, in S105 above.

[0041] In S108, the APP container of the data processing device 100 verifies Sig(H(Enc(SKp,Kp)),SKp) using PKp, and if the verification is successful, decrypts Enc(SKp,Kp) using Kp to extract SKp. This means that the private key (signature key) SKp of the program providing device 300 is deposited in the APP container. The APP container of the data processing device 100 also decrypts HybEnc(P,PKp) using SKp to extract P, and starts P on the APP container. SKp is stored in a secure memory area by the secure data storage unit 111. P is also started by the secure processing unit 112.

[0042] In S109, the data holding device 200 transmits Sig(Nonce, SKd) to the APP container of the data processing device 100. Note that Nonce means a nonce value.

[0043] In S110, the APP container of the data processing device 100 verifies Sig(Nonce, SKd) with the public key PKd included in the PKd-list decrypted from Enc(PKd-list, Kp) by Kp, and if the verification is successful, transmits Sig(Nonce, SKp) to the data holding device 200. This Sig(Nonce, SKp) means that the APP container of the data processing device 100 is signing on behalf of the program author (program providing device 300).

[0044] In S111, the data holding device 200 verifies Sig(Nonce, SKp) with the public key PKp included in the PKp-list held by itself, and if the verification is successful, sends Enc(SKd, Kd) and Sig(H(Enc(SKd, Kd)), SKd) to the APP container of the data processing device 100. Here, the PKp-list is a list of public keys of program authors (program providing device 300) that the data holding device 200 permits to execute the program P.

[0045] In S112, the APP container of the data processing device 100 verifies Sig(H(Enc(SKd,Kd)),SKd) using PKd, and if the verification is successful, decrypts Enc(SKd,Kd) using Kd to extract SKd.The APP container of the data processing device 100 then decrypts HybEnc(D,PKd) using SKd to extract D and calculates P(D).

[0046] In S113, the APP container of the data processing device 100 transmits HybEnc(P(D), PKd) to the data holding device 200. As a result, the data holding device 200 can decrypt HybEnc(P(D), PKd) using SKd and extract P(D).

[0047] In S114, the data processing device 100 deletes the APP container, and at this time, the data processing device 100 notifies the data holding device 200 that the APP container has been deleted.

[0048] In the above processing flow, the communication unit 120 of the data processing device 100 may block communications other than communications via the secure area 110 related to P or D. In particular, download communications to devices other than the data holding device 200 may be blocked.

[0049] According to the first embodiment, mainly from the viewpoint of the program author (program providing device 300), while P and D are kept secret from the data processing device 100 and P is kept secret from the data holder (data holding device 200), the execution result of P(D) can be provided to the data holder (data holding device 200) without the program author (program providing device 300) knowing D and P(D). Furthermore, it is guaranteed to the data holder (data holding device 200) that the program author is the expected program author.

[0050] Example 2 Next, a second embodiment will be described with reference to Fig. 5. As a premise of the processing flow in Fig. 5, the data holding device 200 holds APP_PV, D, PKd, and SKd, and the program providing device 300 holds APP_PE, P, PKp, and SKp.

[0051] In S201, the data holding device 200 transmits HybEnc(D,PKd) to the data processing device 100. This HybEnc(D,PKd) is stored by the data storage unit 130 in a public storage area such as the storage of the data processing device 100.

[0052] In S202, the program providing device 300 transmits APP_PE and HybEnc(P, PKp) to the data processing device 100. These APP_PE and HybEnc(P, PKp) are stored in a public storage area such as the storage of the data processing device 100 by the data storage unit 130. Note that APP_PE and HybEnc(P, PKp) are also registered with a third-party verification organization by the program providing device 300 and made public.

[0053] In S203, the program providing apparatus 300 transmits to the data processing apparatus 100 a container activation request for running the APP_PE.

[0054] In S204, the data processing device 100 generates and starts a container for running the APP_PE, and encrypts this container. As a result, an encrypted container (secure area 110-1) in which the APP_PE runs is generated. Hereinafter, the container generated here will be referred to as an "APP_PE container" for convenience.

[0055] In S205, the data holding device 200 transmits the APP_PV to the data processing device 100. The data storage unit 130 stores this APP_PV in a public storage area such as the storage of the data processing device 100.

[0056] In S206, the data holding device 200 transmits a container activation request to the data processing device 100 to run the APP_PV.

[0057] In S207, the data processing device 100 generates and starts a container for running APP_PV, and encrypts this container. As a result, an encrypted container (secure area 110-2) in which APP_PV runs is generated. Hereinafter, the container generated here will be referred to as an "APP_PV container" for convenience.

[0058] In S208, the APP_PE container of the data processing device 100 and the program providing device 300 each generate (calculate) a common key Kp2p using ECDHE with mutual authentication. At this time, the APP_PE container of the data processing device 100 authenticates the user (program providing device 300) by verifying the signature by SKp using PKp, and the program providing device 300 authenticates the APP_PE container by verifying the hash value H(APP_PE+HybEnc(P,PKp)) from the APP_PE container of the data processing device 100 via a third-party verification organization.

[0059] In S209, the APP_PE container of the data processing device 100 and the data holding device 200 each generate (calculate) a shared key Kd2p using ECDHE with mutual authentication. At this time, the APP_PE container of the data processing device 100 authenticates the user (data holding device 200) by verifying the signature by SKd using PKd, and the data holding device 200 authenticates the APP_PE container by verifying the hash value H(APP_PE+HybEnc(P,PKp)) from the APP_PE container of the data processing device 100 via a third-party verification organization.

[0060] In S210, the APP_PV container of the data processing device 100 and the data holding device 200 each generate (calculate) a shared key Kd2d using ECDHE with mutual authentication. At this time, the APP_PV container of the data processing device 100 authenticates the user (data holding device 200) by verifying the signature based on SKd using PKd, and the data holding device 200 authenticates the APP_PV container by verifying the hash value H(APP_PV) from the APP_PV container of the data processing device 100 via a third-party verification organization.

[0061] In S211, the APP_PV container of the data processing device 100 and the program providing device 300 each generate (calculate) a shared key Kp2d using ECDHE with mutual authentication. At this time, the APP_PV container of the data processing device 100 authenticates the user (program providing device 300) by verifying the signature by SKp using PKp, and the program providing device 300 authenticates the APP_PV container by verifying the hash value H(APP_PV) from the APP_PV container of the data processing device 100 via a third-party verification organization.

[0062] In S212, the program providing device 300 transmits Enc(SKp, Kp2p) and Sig(H(Enc(SKp, Kp2p)), SKp) to the APP_PE container of the data processing device 100. At this time, the program providing device 300 may further transmit Enc(PKd-list, Kp2p) and Sig(Enc(PKd-list, Kp2p), SKp) to the APP_PE container of the data processing device 100. Here, PKd-list is a list of public keys of data holders (data holding devices 200) that the program providing device 300 permits to execute the program P.

[0063] However, the PKd-list may be passed to the APP_PE container in an earlier process, for example, in S208 above.

[0064] In S213, the data holding device 200 transmits Enc(SKd, Kd2d) and Sig(H(Enc(SKd, Kd2d)), SKd) to the APP_PV container of the data processing device 100. At this time, the data holding device 200 may further transmit Enc(PKp-list, Kd2d) and Sig(Enc(PKp-list, Kd2d), SKd) to the APP_PV container of the data processing device 100. Here, PKp-list is a list of public keys of program authors (program providing device 300) that the data holding device 200 permits to execute the program P.

[0065] However, the PKp-list may be passed to the APP_PV container in an earlier process, for example, in S210 above.

[0066] In S214, the APP_PE container of the data processing device 100 verifies Sig(H(Enc(SKp, Kp2p)), SKp) using PKp, and if the verification is successful, decrypts Enc(SKp, Kp2p) using Kp2p to extract SKp. This means that the private key (signature key) SKp of the program providing device 300 is deposited in the APP_PE container. The APP_PE container of the data processing device 100 also decrypts HybEnc(P, PKp) using SKp to extract P, and starts P on the APP_PE container. SKp is stored in a secure storage area by the secure data storage unit 111. P is also started by the secure processing unit 112.

[0067] In S215, the APP_PV container of the data processing device 100 verifies Sig(H(Enc(SKd, Kd2d)), SKd) using PKd, and if the verification is successful, decrypts Enc(SKd, Kd2d) using Kd2d to extract SKd. The APP_PV container of the data processing device 100 then decrypts HybEnc(D, PKd) using SKd to extract D.

[0068] In S216, the APP_PE container and the APP_PV container of the data processing device 100 each generate (calculate) a shared key Kta2ta using ECDHE with mutual authentication. At this time, the APP_PE container signs using SKp on behalf of the program author (program providing device 300) and transmits this to the APP_PV container together with the hash value H(APP_PE+HybEnc(P,PKp)). The APP_PV container then verifies the signature using the public key PKp included in the PKp-list, and verifies the hash value H(APP_PE+HybEnc(P,PKp)) via a third-party verification organization, thereby authenticating the program author (program providing device 300) and the APP_PE container. Meanwhile, the APP_PV container signs using SKd on behalf of the data holder (data holding device 200) and transmits this to the APP_PE container together with the hash value H(APP_PV). The APP_PE container then verifies the signature using the public key PKd included in the PKd-list, and authenticates the data holder (data holding device 200) and the APP_PV container by verifying the hash value H(APP_PV) via a third-party verification organization.

[0069] In this way, the APP_PE container and the APP_PV container authenticate each other, and also authenticate each other by proxy as the program author and data holder.

[0070] In S217, the APP_PE container of the data processing device 100 calculates PROOF(P) and sends this PROOF(P) and P to the APP_PV container. Meanwhile, the APP_PV container verifies whether PROOF(P) is correct based on PROOF(P) and P. This verification result is called the "PROOF verification result." Note that the APP_PE container may calculate PROOF(P) in advance.

[0071] In S219, the APP_PV container of the data processing device 100 transmits MAC(PROOF verification result, Kd2d) to the data holding device 200. This allows the data holder (data holding device 200) to know whether the PROOF verification result indicates that PROOF(P) is correct.

[0072] In S219, if the PROOF verification result indicates that PROOF(P) is correct, the APP_PV container of the data processing device 100 sends Enc(D, Kta2ta) to the APP_PE container. Then, the APP_PE container decrypts Enc(D, Kta2ta) using Kta2ta to extract D, and then calculates P(D).

[0073] In S220, the APP_PE container of the data processing device 100 transmits Enc(P(D), Kta2ta) to the APP_PV container. Then, the APP_PV container decrypts Enc(P(D), Kta2ta) using Kta2ta to extract P(D), and then transmits Enc(P(D), Kd2d) to the data holding device 200. This enables the data holding device 200 to decrypt Enc(P(D), Kd2d) using Kd2d to extract P(D).

[0074] In S221, the data processing device 100 deletes the APP_PE container and the APP_PV container. At this time, the data processing device 100 notifies the program providing device 300 that the APP_PE container has been deleted, and notifies the data holding device 200 that the APP_PV container has been deleted.

[0075] According to the second embodiment, mainly from the viewpoint of the program author (program providing device 300), while P and D are kept secret from the data processing device 100 and P is kept secret from the data holder (data holding device 200), the execution result of P(D) can be provided to the data holder (data holding device 200) without the program author (program providing device 300) knowing D and P(D). Furthermore, in addition to being the expected program author, the "legitimacy" of the programs P and P to be executed is guaranteed to the data holder (data holding device 200).

[0076] (Supplementary to Examples 1 and 2) As described above, each container (APP container, APP_PE container, APP_PV container) signs on behalf of the user (data holder or program author, or both) using the user's signature key.

[0077] Program P may be, for example, an artificial intelligence (AI) program that includes a deep neural network (DNN). In this case, by code signing the AI ​​using each user's signature key, it is possible to clearly identify which user has the authority to use the AI.

[0078] The above AI may be read as Digital Twin. In this case, the above first and second embodiments can be said to be a mechanism for mutual authentication and access control between Digital Twins.

[0079] The correspondence between the decryption key for the program P and data D and the signature key of each user can be arbitrary. For example, the key that can decrypt the program P may be used as the signature key, and a signature may be made using that signature key.

[0080] (Example of hardware configuration) The data processing device 100, the data storage device 200, and the program providing device 300 can all be realized, for example, by causing a computer to execute a program. This computer may be a physical computer or a virtual machine on the cloud. The data processing device 100, the data storage device 200, and the program providing device 300 are collectively referred to as "devices."

[0081] That is, the device can be realized by executing a program corresponding to the processing performed by the device using hardware resources such as a CPU and memory built into a computer. The program can be recorded on a computer-readable recording medium (such as a portable memory) and stored or distributed. The program can also be provided via a network such as the Internet or email.

[0082] Fig. 6 is a diagram showing an example of the hardware configuration of the computer. The computer in Fig. 6 has a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, and the like, all of which are interconnected via a bus B. Note that some of these devices may not be included. For example, if no display is required, the display device 1006 may not be included.

[0083] The program for realizing processing on the computer is provided by a recording medium 1001 such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

[0084] The memory device 1003 reads and stores a program from the auxiliary storage device 1002 when an instruction to start the program is received. The CPU 1004 realizes the functions of the device in accordance with the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network, and functions as a transmitter and receiver. The display device 1006 displays a GUI (Graphical User Interface) or the like according to a program. The input device 1007 is composed of a keyboard, mouse, buttons, a touch panel, or the like, and is used to input various operation instructions. The output device 1008 outputs the results of calculations.

[0085] (Examples of application areas) The technology described in this embodiment can be applied to various use cases, examples of which are listed below.

[0086] Traffic flow simulator (http: / / www.jste.or.jp / sim / models / index.html) People flow simulator (https: / / info.hitachi-ics.co.jp / product / h_flow / ) Heart Simulator (https: / / blog.global.fujitsu.com / jp / 2018-05-10 / 01 / ) Brain Simulator (https: / / bicr.atr.jp / cbi / research-ja / %E8%84%B3%E6%B4%BB%E5%8B%95%E8%A8%88%E6%B8%AC%E3%83%87%E3%83%BC%E3%82%BF%E3%82%B7%E3%83%9F%E3%83%A5%E3%83%AC%E3%83%BC%E3%82%BF / ) Material property simulator (https: / / www.jsol-cae.com / product / material / jocta / ) Robot simulator (http: / / www.idec-fs.com / robodk / ) FPGA simulator (https: / / www.intel.co.jp / content / www / jp / ja / software / programmable / quartus-prime / model-sim.html) Space Simulator (http: / / www.astro.phys.s.chiba-u.ac.jp / netlab / astro / index2.html) Virtual Pets (https: / / www.discoverychannel.jp / 0000007144 / ) Speech synthesis (https: / / cloud.google.com / text-to-speech?hl=ja) (Effects of the embodiment) As described above, the technology according to this embodiment provides a technology that prevents data from being leaked to the program provider and prevents the program from being leaked to the data holder when a data processing device equipped with a secret computation mechanism processes data of a data holder using a program of a program provider.

[0087] (Summary of the embodiment) This specification discloses at least the following program execution system, data processing device, program execution method, and program. (Section 1) A program execution system comprising a data storage device, a program providing device, and a data processing device having a mechanism for performing secure computation in a secure area, The data holding device encrypts data D with its own public key PKd and transmits the encrypted data to the data processing device; the program provider device encrypts a program P with its own public key PKp and transmits the encrypted program to the data processing device; the program providing device transmits to the data processing device a secret key SKp encrypted with a first shared key shared between the program providing device and the data processing device; the data processing device generates a first signature using the private key SKp on behalf of the program providing device and transmits the generated first signature to the data holding device; the data holding device verifies the first signature using the public key PKp, and transmits to the data processing device a private key SKd encrypted using a second shared key shared between the data holding device and the data processing device; the data processing device, in the secure area, executes a program P obtained by decrypting the encrypted program with the private key SKp on data D obtained by decrypting the encrypted data with the private key SKd, and calculates a result P(D). Program execution system. (Section 2) the data holding device transmits a second signature for the nonce value using the private key SKd to the data processing device; The program execution system described in claim 1, wherein the data processing device verifies the second signature using the public key PKd, and if the verification of the second signature is successful, generates the first signature on behalf of the program providing device and transmits the generated first signature to the data holding device. (Section 3) A program execution system comprising: a data storage device; a program providing device; and a data processing device having a mechanism for performing secure computation in a first secure area corresponding to the program providing device and a second secure area corresponding to the data storage device, The data holding device encrypts data D with its own public key PKd and transmits the encrypted data to the data processing device; the program provider device encrypts a program P with its own public key PKp and transmits the encrypted program to the data processing device; the program providing device transmits to the first secure area a secret key SKp encrypted with a first shared key shared with the first secure area; the data holding device transmits to the second secure area a secret key SKd encrypted with a second shared key shared with the second secure area; the data processing device mutually verifies a first signature made with the private key SKp and a second signature made with the private key SKd between the first secure area and the second secure area; the data processing device, in the first secure area, executes a program P obtained by decrypting the encrypted program with the private key SKp on data D obtained by decrypting the encrypted data with the private key SKd, and calculates a result P(D). Program execution system. (Section 4) If the verification is successful, the data processing device calculates PROOF(P) using a PCC (Proof-Carrying Code) for a program P obtained by decrypting the encrypted program with the private key SKp in the first secure area; the data processing device verifies the PROOF(P) in the second secure area; 4. The program execution system according to claim 3, wherein the data processing device calculates P(D) in the first secure area if the verification of PROOF(P) is successful. (Section 5) 1. A data processing device in a program execution system comprising: a data holding device; a program providing device; and a data processing device having a mechanism for performing secure computation in a secure area, receiving, from the data holding device, encrypted data obtained by encrypting data D with the public key PKd of the data holding device; receiving, from the program provider device, an encrypted program obtained by encrypting a program P with a public key PKp of the program provider device; receiving, from the program provider device, a secret key SKp encrypted with a first shared key shared with the program provider device; generating a first signature using said secret key SKp on behalf of said program providing device, and transmitting said generated first signature to said data holding device; receiving, from the data holding device that has verified the first signature using the public key PKp, a private key SKd encrypted with a second shared key shared between the data holding device and the data processing device; In the secure area, a program P is executed by decrypting the encrypted program with the private key SKp on data D obtained by decrypting the encrypted data with the private key SKd, and a result P(D) is calculated. Data processing device. (Section 6) A data processing device in a program execution system including a data storage device, a program providing device, and a data processing device having a mechanism for performing secure computation in a first secure area corresponding to the program providing device and a second secure area corresponding to the data storage device, receiving, from the data holding device, encrypted data obtained by encrypting data D with the public key PKd of the data holding device; receiving, from the program provider device, an encrypted program obtained by encrypting a program P with a public key PKp of the program provider device; receiving, from the program providing device, a secret key SKp encrypted with a first shared key shared between the program providing device and the first secure area; receiving, from the data holding device, a secret key SKd encrypted with a second shared key shared between the data holding device and the second secure area; mutually verifying a first signature made using the private key SKp and a second signature made using the private key SKd between the first secure area and the second secure area; In the first secure area, a program P obtained by decrypting the encrypted program with the private key SKp is executed on data D obtained by decrypting the encrypted data with the private key SKd, thereby calculating a result P(D). Data processing device. (Section 7) A program execution method in a program execution system including a data storage device, a program providing device, and a data processing device including a mechanism for performing secure computation in a secure area, comprising: The data holding device encrypts data D with its own public key PKd and transmits the encrypted data to the data processing device; the program provider device encrypts a program P with its own public key PKp and transmits the encrypted program to the data processing device; the program providing device transmits to the data processing device a secret key SKp encrypted with a first shared key shared between the program providing device and the data processing device; the data processing device generates a first signature using the private key SKp on behalf of the program providing device and transmits the generated first signature to the data holding device; the data holding device verifies the first signature using the public key PKp, and transmits to the data processing device a private key SKd encrypted using a second shared key shared between the data holding device and the data processing device; the data processing device, in the secure area, executes a program P obtained by decrypting the encrypted program with the private key SKp on data D obtained by decrypting the encrypted data with the private key SKd, and calculates a result P(D). How to run the program. (Section 8) A program for causing a computer to function as the data processing device according to paragraph 5 or 6.

[0088] Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and changes are possible within the scope of the gist of the present invention described in the claims.

[0089] [References] Reference 1: NeculaG. C. "Proof-Carrying Code", 1997. Reference 2: George C. Necula and Peter Lee. "Safe, Untrusted Agents using Proof-Carrying Code", 1998. Reference 3: Yasuaki Tsukada. "Proof Secrecy in Interactive Proven Program Distribution and Its Applications," 2005. [Explanation of symbols]

[0090] 100 Data processing device 200 Data retention device 300 Program providing device 110 Secure Area 111 Secure Data Storage 112 Secure Processing Unit 120 Communications Department 130 Data storage unit 140 Data Processing Unit 1000 Drive Device 1001 Recording media 1002 Auxiliary storage device 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input Device 1008 Output Device

Claims

1. A program execution system comprising: a data storage device; a program providing device; and a data processing device having a mechanism for performing secure computation in a secure area, The data holding device encrypts data D with its own public key PKd and transmits the encrypted data to the data processing device; the program provider device encrypts a program P with its own public key PKp and transmits the encrypted program to the data processor; the program providing device transmits to the data processing device a secret key SKp encrypted with a first shared key shared between the program providing device and the data processing device; the data processing device generates a first signature using the private key SKp on behalf of the program providing device and transmits the generated first signature to the data holding device; the data holding device verifies the first signature using the public key PKp, and transmits to the data processing device a secret key SKd encrypted using a second shared key shared between the data holding device and the data processing device; the data processing device, in the secure area, executes a program P obtained by decrypting the encrypted program with the private key SKp on data D obtained by decrypting the encrypted data with the private key SKd, and calculates a result P(D); Program execution system.

2. the data holding device transmits a second signature for the nonce value using the private key SKd to the data processing device; The program execution system described in claim 1, wherein the data processing device verifies the second signature using the public key PKd, and if the verification of the second signature is successful, generates the first signature on behalf of the program providing device and transmits the generated first signature to the data holding device.

3. A program execution system comprising: a data storage device; a program providing device; and a data processing device having a mechanism for performing secure computation in a first secure area corresponding to the program providing device and a second secure area corresponding to the data storage device, The data holding device encrypts data D with its own public key PKd and transmits the encrypted data to the data processing device; the program provider device encrypts a program P with its own public key PKp and transmits the encrypted program to the data processor; the program providing device transmits to the first secure area a secret key SKp encrypted with a first shared key shared with the first secure area; the data holding device transmits to the second secure area a secret key SKd encrypted with a second shared key shared with the second secure area; the data processing device mutually verifies a first signature made using the private key SKp and a second signature made using the private key SKd between the first secure area and the second secure area; the data processing device, in the first secure area, executes a program P obtained by decrypting the encrypted program with the private key SKp on data D obtained by decrypting the encrypted data with the private key SKd, and calculates a result P(D). Program execution system.

4. If the verification is successful, the data processing device calculates PROOF(P) using a PCC (Proof-Carrying Code) for a program P obtained by decrypting the encrypted program with the private key SKp in the first secure area; the data processing device verifies the PROOF(P) in the second secure domain; 4. The program execution system according to claim 3, wherein said data processing device calculates said P(D) in said first secure area if said PROOF(P) is successfully verified.

5. 1. A data processing device in a program execution system comprising: a data holding device; a program providing device; and a data processing device having a mechanism for performing secure computation in a secure area, receiving, from the data holding device, encrypted data obtained by encrypting data D with the public key PKd of the data holding device; receiving, from the program provider device, an encrypted program obtained by encrypting a program P with the public key PKp of the program provider device; receiving, from the program providing device, a secret key SKp encrypted with a first shared key shared with the program providing device; generating a first signature using the private key SKp on behalf of the program providing device and transmitting the generated first signature to the data holding device; receiving, from the data holding device that has verified the first signature using the public key PKp, a secret key SKd encrypted with a second shared key shared between the data holding device and the data processing device; In the secure area, a program P is executed by decrypting the encrypted program with the private key SKp on data D obtained by decrypting the encrypted data with the private key SKd, and a result P(D) is calculated. Data processing device.

6. 1. A data processing device in a program execution system comprising: a data storage device; a program providing device; and a data processing device having a mechanism for performing secure computation in a first secure area corresponding to the program providing device and a second secure area corresponding to the data storage device, receiving, from the data holding device, encrypted data obtained by encrypting data D with the public key PKd of the data holding device; receiving, from the program provider device, an encrypted program obtained by encrypting a program P with the public key PKp of the program provider device; receiving, from the program providing device, a secret key SKp encrypted by a first shared key shared between the program providing device and the first secure area; receiving, from the data holding device, a secret key SKd encrypted with a second shared key shared between the data holding device and the second secure area; mutually verifying a first signature made using the private key SKp and a second signature made using the private key SKd between the first secure area and the second secure area; In the first secure area, a program P obtained by decrypting the encrypted program with the private key SKp is executed on data D obtained by decrypting the encrypted data with the private key SKd, and a result P(D) is calculated. Data processing device.

7. A program execution method in a program execution system including a data storage device, a program providing device, and a data processing device having a mechanism for performing secure computation in a secure area, comprising: The data holding device encrypts data D with its own public key PKd and transmits the encrypted data to the data processing device; the program provider device encrypts a program P with its own public key PKp and transmits the encrypted program to the data processor; the program providing device transmits to the data processing device a secret key SKp encrypted with a first shared key shared between the program providing device and the data processing device; the data processing device generates a first signature using the private key SKp on behalf of the program providing device and transmits the generated first signature to the data holding device; the data holding device verifies the first signature using the public key PKp, and transmits to the data processing device a secret key SKd encrypted using a second shared key shared between the data holding device and the data processing device; the data processing device, in the secure area, executes a program P obtained by decrypting the encrypted program with the private key SKp on data D obtained by decrypting the encrypted data with the private key SKd, and calculates a result P(D); How to run the program.

8. A program for causing a computer to function as the data processing device according to claim 5.

9. A program for causing a computer to function as the data processing device described in claim 6.

Images