Program execution system, data processing device, program execution method, and program

Abstract

This program execution system includes a data holding device, a program provision device, and a data processing device provided with a mechanism for performing secure computation in a secure region. The program provision device transmits an encrypted program obtained by encrypting a program P with a public key PKr1 corresponding to a first role to the data processing device, and the data holding device transmits encrypted data obtained by encrypting data D with a public key PKr2 corresponding to a second role to the data processing device. When the data processing device confirms whether or not the program provision device belongs to the first role and can confirm that the program provision device belongs to the first role, the data processing device generates a re-encrypted program obtained by re-encrypting the encrypted program with a public key PKp1 of the program provision device, and the program provision device transmits a secret key SKp1 encrypted by a shared key Kp1 shared with the data processing device to the data processing device. When the data processing device confirms whether or not the data holding device belongs to the second role and can confirm that the data holding device belongs to the second role, the data processing device generates re-encrypted data obtained by re-encrypting the encrypted data with a public key PKd2 of the data holding device, and the data holding device transmits a secret key SKd2 encrypted by a shared key Kd2 shared with the data processing device to the data processing device. The data processing device computes a result P(D) of executing a program P obtained by decrypting the re-encrypted program with the secret key SKp1 on data D obtained by decrypting the re-encrypted data with the secret key SKd2 in the secure region.

Description

[Technical Field]

[0001] The present invention relates to a secret execution technology in the field of information and communications. [Background technology]

[0002] Conventional technologies for performing calculations while keeping data and programs secret from cloud service providers include, for example, Confidential Computing (Non-Patent Document 1) and Confidential VM (Non-Patent Document 2). These technologies make it possible to isolate and keep confidential highly confidential data, for example, while the data is being processed in the cloud.

[0003] However, these conventional technologies do not take into consideration the risk of data and programs leaking to each other when the data and programs are owned by different users. Furthermore, there is no concept of role-based access control, which means that files uploaded to the cloud cannot be shared between users according to the roles to which they belong. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Microsoft Azure Confidential Computing official page: https: / / docs.microsoft.com / ja-jp / azure / confidential-computing / overview [Non-patent document 2] Google Confidential VM official page https: / / cloud.google.com / compute / confidential-vm / docs?hl=ja Summary of the Invention [Problem to be solved by the invention]

[0005] The present invention has been made in consideration of the above points, and aims to provide a technology that prevents data from being leaked to the program provider and prevents the program from being leaked to the data holder when data of a data holder is processed using a program of a program provider using a data processing device equipped with a secret computation mechanism, and that realizes access control based on roles. [Means for solving the problem]

[0006] According to the disclosed technology, there is provided a program execution system including a data storage device, a program providing device, and a data processing device having a mechanism for performing secure computation in a secure area, the program providing device transmits to the data processing device an encrypted program obtained by encrypting a program P with a public key PKr1 corresponding to a first role; the data holding device encrypts data D with a public key PKr2 corresponding to a second role and transmits the encrypted data to the data processing device; the data processing device confirms whether the program providing device belongs to the first role, and if it is confirmed that the program providing device belongs to the first role, generates a re-encrypted program by re-encrypting the encrypted program with a public key PKp1 of the program providing device; the program providing device transmits to the data processing device a secret key SKp1 encrypted with a shared key Kp1 shared between the program providing device and the data processing device; the data processing device confirms whether the data holding device belongs to the second role, and if it is confirmed that the data holding device belongs to the second role, generates re-encrypted data by re-encrypting the encrypted data with a public key PKd2 of the data holding device; the data holding device transmits to the data processing device a secret key SKd2 encrypted with a shared key Kd2 shared between the data holding device and the data processing device; the data processing device, in the secure area, executes a program P obtained by decrypting the re-encrypted program with the private key SKp1 on data D obtained by decrypting the re-encrypted data with the private key SKd2, and calculates a result P(D); A program execution system is provided. [Effects of the Invention]

[0007] According to the disclosed technology, when a data processing device equipped with a secret computing mechanism processes data of a data holder using a program provided by a program provider, a technology is provided that prevents data from being leaked to the program provider and prevents the program from being leaked to the data holder, and also realizes access control based on roles. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a diagram illustrating an example of a system configuration according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram illustrating an example of a functional configuration of a data processing device. [Figure 3] FIG. 10 is a diagram illustrating an image of processing in a secure area. [Figure 4] FIG. 1 is a sequence diagram (1 / 2) of a process according to the first embodiment. [Figure 5] FIG. 2 is a sequence diagram (2 / 2) of the process in the first embodiment. [Figure 6] FIG. 10 is a sequence diagram (1 / 2) of a process in the second embodiment. [Figure 7] FIG. 10 is a sequence diagram (2 / 2) of the process in the second embodiment. [Figure 8] FIG. 11 is a sequence diagram (1 / 2) of a process according to the third embodiment. [Figure 9] FIG. 11 is a sequence diagram (2 / 2) of the process in the third embodiment. [Figure 10] FIG. 2 illustrates an example of a hardware configuration of the apparatus. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, an embodiment of the present invention (the present embodiment) will be described with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment. In the following description, a program is represented as P, data to be processed by P is represented as D, and the processing result of D by P is represented as P(D).

[0010] (System Configuration) An example of the configuration of a program execution system according to an embodiment of the present invention is shown in Fig. 1. As shown in Fig. 1, the program execution system according to this embodiment includes a data processing device 100, a data holding device 200, and a program providing device 300.

[0011] The data processing device 100, the data holding device 200, and the program providing device 300 may each be a physical machine (computer) or a virtual machine on the cloud. The data holding device 200 and the program providing device 300 may each be a function (e.g., a web browser) that runs on a physical machine or a virtual machine. Furthermore, the data processing device 100 may be a system configured with multiple physical machines (particularly, in the first to third embodiments described below, different containers may be generated on different physical machines).

[0012] In this embodiment, the data processing device 100 is provided with a secure computing mechanism or a secret computing mechanism by applying a function called a Trusted Execution Environment (TEE) function, which executes data processing in isolation from an existing OS. In this embodiment, the TEE function is assumed to be, for example, AMD (registered trademark)'s SEV, but this is just an example, and the present invention can be applied to any TEE function. For example, the present invention can also be applied to Intel (registered trademark)'s SGX or TDX, Arm (registered trademark)'s TrustZone (registered trademark), ARM Confidential Compute Architecture, etc.

[0013] 1, a secure channel 400 is established between a data processing device 100 and a data holding device 200, and between the data processing device 100 and a program providing device 300, allowing data and programs to be transmitted and received securely. This secure channel is established, for example, by a remote attestation protocol called Remote Attestation in SEV. However, this is just an example, and the secure channel may be established by any means.

[0014] In this embodiment, a program P is transmitted from the program providing device 300 to the data processing device 100, data D is transmitted from the data holding device 200 to the data processing device 100, the data processing device 100 processes the data D using the program P, and provides the execution result P(D) to the data holding device 200.

[0015] The data processing device 100 uses its secure computing mechanism to prevent the program P and the data D from leaking outside the secure area (for example, to a cloud where the data processing device 100 is running). In addition, in this embodiment, a mechanism is realized in which the program P is not leaked to the data storage device 200 and the data D is not leaked to the program providing device 300. In addition, in this embodiment, the program P and the data D are encrypted on a role-by-role basis when transmitted (uploaded) to the data processing device 10, and re-encrypted (more specifically, TEE-based proxy re-encryption) on a user (data holder, program author) basis when the program P processes the data D, thereby realizing role-based access control. Here, the term "role" is a term used in role-based access control and refers to information such as an authority label. Examples of roles include a team manager, a channel manager, and a channel participant. Furthermore, a data holder is a holder of data D, such as a user or administrator of the data storage device 200. On the other hand, a program author is a provider of the program P, such as a user or administrator of the program providing device 300. On the other hand, the administrator or owner of the data processing device 100 will be referred to as a platform operator (hereinafter referred to as a PF operator).

[0016] As a result, in the program execution system of this embodiment, in a use case in which the secure computing mechanism is applied to data distribution, a data holder (data holding device 200) having highly confidential data D and a program author (program providing device 300) having highly confidential program P can combine and execute the data / program while keeping them confidential from each other. In addition to this, access control is also performed according to the role to which each user (data holder, program author) belongs, so it is possible to realize access control such as permitting (or not permitting) processing by program P depending on the role to which the program author belongs and the role to which the data holder belongs.

[0017] (Example of configuration of data processing device) Fig. 2 shows an example of the functional configuration of data processing device 100. As shown in Fig. 2, data processing device 100 has secure area 110 which is a protected area where confidentiality is maintained, communication unit 120 which performs data communication with other devices (e.g., data holding device 200, program providing device 300), data storage unit 130 which stores data in storage or the like outside secure area 110, and data processing unit 140 which performs various types of data processing outside secure area 110.

[0018] The contents of the data and programs in the secure area 110 cannot be known from the outside. Outside the secure area 110, normal data storage and data processing (program execution) can be performed by the data storage unit 130 and the data processing unit 140, respectively. Data communication and access control for that communication can also be performed by the communication unit 120.

[0019] Within the secure area 110, data can be stored and data processed (program execution) while maintaining confidentiality. Fig. 2 shows a secure data storage unit 111 and a secure processing unit 112 as functional units that perform these functions within the secure area 110. The secure data storage unit 111 stores various types of data in a memory area within the secure area 110 while maintaining confidentiality. Furthermore, the secure processing unit 112 performs data processing within the secure area 110 (for example, activation and execution of P, generation (calculation) of a shared key (common key), encryption, decryption, signature verification, re-encryption, role-based access control, etc.).

[0020] The secure area 110 itself can be realized by existing technology. Any existing technology may be used to realize the secure area 110. For example, the secure area 110 may be realized as a separate chip that is hardware-independent from the main CPU and memory, or the secure area 110 may be realized in software by utilizing encryption and authentication technologies. One example of technology for realizing the secure area 110 in software is the aforementioned SEV, and this embodiment assumes the use of SEV as an example. In this case, the secure area 110 is generated as an encrypted container (or may be a virtual machine (VM)) in the data processing device 100. Note that, for example, if multiple encrypted containers are generated, multiple secure areas 110 will exist.

[0021] 3 shows an image of data processing in the secure area 110. In this embodiment, "HybEnc" means encryption using a public key-based encryption method, and "Enc" means encryption using a shared key-based encryption method. For example, HybEnc(D) is data encrypted using a public key-based encryption method.

[0022] As shown in FIG. 3, the data processing device 100 receives HybEnc(D) from the data holding device 200 and receives HybEnc(P) from the program providing device 300.

[0023] In the secure area 110, HybEnc(D) and HybEnc(P) are decrypted to obtain D and P, respectively. Furthermore, in the secure area 110, P(D) is calculated, and then HybEnc(P(D)) is calculated. HybEnc(P(D)) is transmitted to the data holding device 200.

[0024] This prevents the program P and data D from being leaked to the PF operator (data processing device 100), and also prevents the data holder's (data holding device 200) data from being leaked to the program author (program providing device 300), and makes it possible to provide the program P (D) to the data holder without the program author's program P being leaked to the data holder (data holding device 200). Hereinafter, this is also referred to as "program confidential execution."

[0025] In addition, in the first embodiment described later, when the program P or data D is transmitted (uploaded) to the data processing device 100, encryption is performed on a role-by-role basis, and when P(D) is calculated and provided, re-encryption (TEE-based proxy re-encryption) is performed on a user-by-user basis using a public key list of users included in the roles permitted to perform the calculation and provision. This realizes role-based access control while also achieving concealed program execution.

[0026] In addition, in a second embodiment described later, the first embodiment is improved to eliminate the asymmetry between the program author and the data holder in access control. Furthermore, in a third embodiment described later, a part of the second embodiment is modified so that the PF operator (data processing device 100) also manages part of the confidential execution of the program.

[0027] In this way, by combining calculations in the secure area 110 and encrypted communication, a mechanism is realized in which the program P and data D are not leaked to the data processing device 100, the program P is not leaked to the data storage device 200, and the data D is not leaked to the program providing device 300 (confidential program execution).

[0028] Below, examples 1 to 3 will be described as examples of the processing flow in this embodiment. In each of the following examples, it is assumed that a remote attestation mechanism is used for generating (sharing) a shared key. More specifically, a protocol is used in which a mechanism for mutual authentication between a user (data holding device 200, program providing device 300) and a container is inserted into the Elliptic Curve Diffie-Hellman key exchange protocol (ECDHKE). In this embodiment, this is called ECDHE with mutual authentication.

[0029] In authenticating a container, a third-party verification organization (e.g., AMD Verification Service) is involved, but the process of generating a shared key through the intervention of a third-party verification organization is an existing technology known as Remote Attestation. Therefore, in the explanation of Examples 1 to 3, only an overview of the process related to Remote Attestation is provided, and the parts related to the present invention are explained in detail.

[0030] In the following explanation, APP is an application program that runs on a container and is released as OSS. Program P runs on APP.

[0031] Furthermore, PKp1 and SKp1 are the public key and private key, respectively, of the program providing device 300. PKd2 and SKd2 are the public key and private key, respectively, of the data holding device 200. Furthermore, HybEnc(A,B) means information obtained by encrypting A with B (public key), and Enc(A,B) means information obtained by encrypting A with B (shared key). H(A) means the hash value of A. Sig(A,B) means a signature for A using B (private key). MAC(A,B) means a message authentication code for A using B (shared key).

[0032] Also, VMr1 and VMr2 are containers (encrypted containers) for the role administrators of roles r1 and r2, respectively, and are assumed to have been activated in advance prior to the processing described below. Furthermore, PKr1 and SKr1 are the public key and private key of the role administrator of role r1, respectively. PKr2 and SKr2 are the public key and private key of the role administrator of role r2, respectively.

[0033] It is assumed that each public key has been distributed in advance to the entities that require that key.

[0034] In the following explanation, it is assumed that the programs running on the container are not replaced after the container is started. This ensures that there is no fraud, such as returning the execution results of program B while showing the execution evidence of program A.

[0035] Example 1 First, a first embodiment will be described with reference to Figures 4 and 5. As a premise of the processing flow in Figures 4 and 5, it is assumed that the data holding device 200 holds D, PKd2, SKd2, and PKr2, and the program providing device 300 holds APP, P, PKp1, SKp1, and PKr1. It is also assumed that the program author belongs to role r1, and the data holder belongs to role r2.

[0036] In S101, the data holding device 200 transmits HybEnc(D, PKr2) to the data processing device 100. This HybEnc(D, PKr2) is stored by the data storage unit 130 in a public storage area such as the storage of the data processing device 100.

[0037] In S102, the program providing device 300 transmits the APP and HybEnc(P, PKr1) to the data processing device 100. The APP and HybEnc(P, PKr1) are stored in a public storage area such as the storage of the data processing device 100 by the data storage unit 130. The APP and HybEnc(P, PKr1) are also registered with a third-party verification organization by the program providing device 300 and made public.

[0038] In S103, the program providing apparatus 300 transmits to the data processing apparatus 100 a container activation request for running the APP.

[0039] In S104, the data processing device 100 generates and starts a container for running the APP, and encrypts this container. As a result, an encrypted container (secure area 110) in which the APP runs is generated. Hereinafter, the owner of the generated container is assumed to be the program author (program providing device 300), and will be referred to as "VMp1."

[0040] In S105, using ECDHE with mutual authentication, VMp1 of the data processing device 100 and the program providing device 300 each generate (calculate) a shared key Kp1. At this time, VMp1 of the data processing device 100 authenticates the user (program providing device 300) by verifying the signature based on SKp1 using PKp1, and the program providing device 300 authenticates VMp1 by verifying the hash value H(APP+HybEnc(P,PKr1)) from VMp1 of the data processing device 100 via a third-party verification organization. Note that H(APP+HybEnc(P,PKr1)) represents the hash value of data combining APP and HybEnc(P,PKr1), and is, for example, the hash value of data concatenating the bit strings of APP and HybEnc(P,PKr1).

[0041] In S106, using ECDHE with mutual authentication, VMp1 of the data processing device 100 and the data holding device 200 each generate (calculate) a shared key Kd2. At this time, VMp1 of the data processing device 100 authenticates the user (data holding device 200) by verifying the signature by SKd2 using PKd2, and the data holding device 200 authenticates VMp1 by verifying the hash value H(APP+HybEnc(P,PKp1)) from VMp1 of the data processing device 100 via a third-party verification organization.

[0042] In S107, the data processing device 100 notifies the program providing device 300 that it has received a policy proposal from the policy proposer. The policy proposer is not limited to a specific person and may be any person, such as the PF operator itself, a data holder, a program author, or a third party other than those mentioned above. Here, the policy proposal is proposed in a format such as {name, role, request authority}. The "name" is the name of a pre-registered public key; here, the name of public key PKd2 is specified. The "role" is the role to which the user who holds the public key belongs; here, the role r1 corresponding to PKp1 is specified. The "request authority" is the authority to request settings from the user who holds the public key; here, the authority required for confidential program execution is specified. In this case, the data processing device 100 may transmit {name, role, request authority} or an encrypted and signed version of the {name, role, request authority} to the program providing device 300.

[0043] In the above description, the policy proposal is assumed to be received by the PF provider, but this is not limiting. For example, a container (or VM) owned by the policy proposer may exist, and VMp1 may receive the policy proposal through inter-container communication. In this case, VMp1 may send Enc({name, role, requested authority}, Kp1) to the program providing device 300 to notify receipt of the policy proposal, or VMp1 may send Enc({name, role, requested authority}, Kp1) to VMr1 through inter-container communication, and then VMr1 may send Enc({name, role, requested authority}, Kp1), Sig(Enc({name, role, requested authority}, Kp1), SKr1) to the program providing device 300 to notify receipt of the policy proposal.

[0044] Upon receiving the notification of receipt of the policy proposal, the program providing device 300 displays to the user corresponding to PKp1 a screen including display components such as buttons for selecting whether or not to grant the requested authority to the user corresponding to public key PKd2. When a button indicating "grant" is pressed on this screen, the program providing device 300 adds public key PKd2 to its own authorized public key list. As a result, the program providing device 300 manages PKp1 as the authorization subject and PKd2 as the authorization target. Here, the authorized public key list is a list of public keys authorized for the policy proposal.

[0045] In S108, the program providing device 300 transmits Enc(PKd2, Kp1) and Sig(H(Enc(PKd2, Kp1)), SKp1) to VMp1 of the data processing device 100. Upon receiving Enc(PKd2, Kp1) and Sig(H(Enc(PKd2, Kp1)), SKp1), VMp1 of the data processing device 100 verifies Sig(H(Enc(PKd2, Kp1)), SKp1), and if the verification is successful, manages PKp1 as the authorized subject and PKd2 as the authorized object. This is achieved by adding the public key PKd2 to an authorized public key list that lists PKp1 as the authorized subject.

[0046] In S109, the program providing device 300 transmits HybEnc(PKd2, PKr1) and Sig(H(HybEnc(PKd2, PKr1)), SKp1) to VMr1 of the data processing device 100. Upon receiving HybEnc(PKd2, PKr1) and Sig(H(HybEnc(PKd2, PKr1)), SKp1), VMr1 of the data processing device 100 verifies Sig(H(HybEnc(PKd2, PKr1)), SKp1), and if the verification is successful, manages PKp1 as the authorized subject and PKd2 as the authorized object. Note that this is achieved by adding the public key PKd2 to an authorized public key list that lists PKp1 as the authorized subject.

[0047] In S110, the VMr1 of the data processing device 100 confirms whether the program author (program providing device 300) belongs to role r1. If the VMr1 of the data processing device 100 confirms that the program author belongs to role r1, it retrieves HybEnc(P,PKr1) from the public storage area, decrypts it with SKr1, and then encrypts it with PKp1 to generate HybEnc(P,PKp1). This means that the VMr1 of the data processing device 100 decrypts HybEnc(P,PKr1) on behalf of the program author and re-encrypts it with the program author's public key PKp1. Note that because HybEnc(P,PKr1) is decrypted and re-encrypted within the role administrator container VMr1, there is no risk of the program P being leaked.

[0048] If it cannot be confirmed that the program author belongs to role r1, proxy decryption and re-encryption of HybEnc(P,PKr1) are not performed.

[0049] In S111, the VMr1 of the data processing device 100 transmits HybEnc(P, PKp1) to the VMp1 by inter-container communication.

[0050] In S112, the program providing device 300 transmits Enc(SKp1, Kp1) and Sig(H(Enc(SKp1, Kp1)), SKp1) to VMp1 of the data processing device 100. Upon receiving Enc(SKp1, Kp1) and Sig(H(Enc(SKp1, Kp1)), SKp1), VMp1 of the data processing device 100 verifies Sig(H(Enc(SKp1, Kp1)), SKp1), and if the verification is successful, decrypts Enc(SKp1, Kp1) using Kp1 to extract SKp1. This means that the private key SKp1 of the program providing device 300 has been entrusted to VMp1. SKp1 is stored in a secure storage area by the secure data storage unit 111.

[0051] In S113, the VMp1 of the data processing device 100 decrypts HybEnc(P, PKp1) using SKp1 to extract P, and starts up P on the VMp1. Note that P is started up by the secure processing unit 112.

[0052] In S114, the data processing device 100 notifies the data holding device 200 that it has received a policy proposal from the policy proposer. Here, the policy proposal is proposed in a format such as {name, role, requested authority}, where "name" specifies the name of the public key PKp1, "role" specifies the role r2 corresponding to PKd2, and "requested authority" specifies the authority required for confidential program execution. In this case, the data processing device 100 may transmit {name, role, requested authority}, or an encrypted and signed version of it, to the data holding device 200.

[0053] In the above description, the policy proposal is assumed to be received by the PF operator, but this is not limiting. For example, a container (or VM) owned by the policy proposer may exist, and VMp1 may receive the policy proposal through inter-container communication. In this case, VMp1 may transmit Enc({name, role, requested authority}, Kd2) to the data retention device 200 to notify receipt of the policy proposal, or VMp1 may transmit Enc({name, role, requested authority}, Kd2) to VMr2 through inter-container communication, and then VMr2 may transmit Enc({name, role, requested authority}, Kd2), Sig(Enc({name, role, requested authority}, Kd2), SKr2) to the data retention device 200 to notify receipt of the policy proposal.

[0054] Upon receiving the notification of receipt of the policy proposal, the data holding device 200 displays to the user corresponding to PKd2 a screen including display components such as buttons for selecting whether or not to grant the requested authority to the user corresponding to public key PKp1. When the "Allow" button on this screen is pressed, the data holding device 200 adds the public key PKp1 to its own list of authorized public keys. As a result, the data holding device 200 manages PKd2 as the authorization subject and PKp1 as the authorization target.

[0055] In S115, the data holding device 200 transmits HybEnc(PKp1, PKr2) and Sig(H(HybEnc(PKp1, PKr2)), SKd2) to VMr2 of the data processing device 100. Upon receiving HybEnc(PKp1, PKr2) and Sig(H(HybEnc(PKp1, PKr2)), SKd2), VMr2 of the data processing device 100 verifies Sig(H(HybEnc(PKp1, PKr2)), SKd2), and if the verification is successful, manages PKd2 as the authorized subject and PKp1 as the authorized target. Note that this is achieved by adding the public key PKp1 to an authorized public key list with PKd2 as the authorized subject.

[0056] In S116, VMr2 of the data processing device 100 confirms whether the data holder (data holding device 200) belongs to role r2. If VMr2 of the data processing device 100 confirms that the data holder belongs to role r2, it retrieves HybEnc(D,PKr2) from the public storage area, decrypts it with SKr2, and then encrypts it with PKd2 to generate HybEnc(D,PKd2). This means that VMr2 of the data processing device 100 decrypts HybEnc(D,PKr2) on behalf of the data holder and re-encrypts it with the data holder's public key PKd2. Note that because HybEnc(D,PKr2) is decrypted and encrypted within the role administrator container VMr2, there is no risk of data D being leaked.

[0057] If it cannot be confirmed that the data holder belongs to role r2, proxy decryption and re-encryption of HybEnc(D,PKr2) are not performed.

[0058] In S117, the VMr2 of the data processing device 100 transmits HybEnc(D, PKd2) to the VMp1 by inter-container communication.

[0059] In S118, VMp1 of the data processing device 100 transmits Np1 and Sig(Np1, SKp1) to the data holding device 200. Note that this means that VMp1 is signing on behalf of the program author (TEE proxy signature). Here, Np1 is a nonce value. Upon receiving Np1 and Sig(Np1, SKp1), the data holding device 200 verifies Sig(Np1, SKp1) (including verifying that Np1 matches), and if the verification is successful, generates Sig(Np1, SKd2).

[0060] In S119, the data holding device 200 transmits Np1, Sig(Np1, SKd2), Nd2, and Sig(Nd2, SKd2) to the VMp1 of the data processing device 100. Here, Nd2 is a nonce value. Upon receiving Np1, Sig(Np1, SKd2), Nd2, and Sig(Nd2, SKd2), the VMp1 of the data processing device 100 verifies Sig(Np1, SKd2) and Sig(Nd2, SKd2) (including verifying that Np1 and Nd2 match), and if the verification is successful, generates Sig(Nd2, SKp1). Note that this means that the VMp1 is signing on behalf of the program author (TEE proxy signature).

[0061] In S120, VMp1 of the data processing device 100 transmits Nd2 and Sig(Nd2, SKp1) to the data holding device 200. Upon receiving Nd2 and Sig(Nd2, SKp1), the data holding device 200 verifies Sig(Nd2, SKp1) (including verifying that Nd2 matches), and if the verification is successful, generates Enc(SKd2, Kd2) and Sig(H(Enc(SKd2, Kd2)), SKd2).

[0062] In this way, by transmitting a nonce value between VMp1 and data holding device 200, replay attacks are prevented.

[0063] In S121, the data holding device 200 transmits Enc(SKd2, Kd2) and Sig(H(Enc(SKd2, Kd2)), SKd2) to the VMp1 of the data processing device 100. The VMp1 of the data processing device 100 verifies Sig(H(Enc(SKd2, Kd2)), SKd2), and if the verification is successful, decrypts Enc(SKd2, Kd2) using Kd2 to extract SKd2. This means that the private key SKd2 of the data holding device 200 has been entrusted to the VMp1. SKd2 is stored in a secure storage area by the secure data storage unit 111.

[0064] In S122, the VMp1 of the data processing device 100 decrypts HybEnc(D, PKd2) using SKd2 to extract D and calculates P(D).

[0065] In S123, VMp1 of the data processing device 100 transmits HybEnc(P(D), PKd2) to the data holding device 200. This enables the data holding device 200 to decrypt HybEnc(P(D), PKd2) using SKd2 and extract P(D).

[0066] In S124, the data processing apparatus 100 deletes VMp1.

[0067] In S125, the data processing device 100 notifies the data holding device 200 that VMp1 has been deleted.

[0068] In the above processing flow, the communication unit 120 of the data processing device 100 may block communications other than communications via the secure area 110 related to P or D. In particular, download communications to devices other than the data holding device 200 may be blocked.

[0069] According to the first embodiment, in addition to preventing the program P and data D from being leaked to the data processing device 100, a mechanism is realized in which the program P is not leaked to the data holding device 200 and the data D is not leaked to the program providing device 300, and access control based on roles is realized.

[0070] Note that in S110 above, HybEnc(P,PKr1) is decrypted in VMr1, and in S116 above, HybEnc(D,PKr2) is decrypted in VMr2, but because VMr1 and VMr2 are both containers for role administrators, there is no risk of the program P and data D being leaked. Furthermore, when the program P is sent to the encrypted container / VM (VMp1 in the first embodiment, VMs1 in the second and third embodiments described below) where P(D) is calculated, it is encrypted as HybEnc(P,PKp1), and similarly, when the data D is sent, it is encrypted as HybEnc(D,PKd2), so there is also no risk of the program P and data D being leaked. Thereafter, after the program author and the data holder agree on a policy, P(D) is calculated, and when the calculation result is sent, it is encrypted as HybEnc(P(D),PKd2), so there is also no risk of the calculation result being leaked.

[0071] Example 2 In the first embodiment, the owner of the container in which program P is executed is the program author, so the relationship between the program author and the data holder in access control is asymmetrically stronger for the program author. Therefore, in the second embodiment, the owner of the container in which program P is executed is set to someone other than the program author, thereby eliminating this asymmetry.

[0072] A second embodiment will be described with reference to Figures 6 and 7. In the second embodiment, differences from the first embodiment will be mainly described, and descriptions of components similar to those in the first embodiment will be omitted or simplified.

[0073] S201 to S203 are similar to S101 to S103 in the first embodiment, respectively, and therefore the description thereof will be omitted.

[0074] In S204, the data processing device 100 generates and starts a container for running the APP, and encrypts this container. As a result, an encrypted container (secure area 110) in which the APP runs is generated. Hereinafter, the owner of the generated container is assumed to be someone other than the program author, and will be referred to as "VMs1." The owner of VMs1 may be anyone other than the program author (and data holder), and examples include a program confidential execution administrator, a policy proposer, and a PF operator. It is assumed that the program author and data holder trust the owner of VMs1.

[0075] Here, it is preferable that VMs1 have limited functionality, such as a sandbox. Such VMs1 can be realized, for example, by a Docker image with limited functionality distributed as OSS. In the following, it is assumed that VMs1 is realized by this Docker image, and that this Docker image is also registered and made public by its owner with a third-party verification organization.

[0076] In S205, the VMs1 of the data processing device 100 and the program providing device 300 each generate (calculate) a shared key Kp1 using ECDHE with mutual authentication. At this time, the VMs1 of the data processing device 100 authenticates the user (the program providing device 300) by verifying the signature by SKp1 using PKp1, and the program providing device 300 authenticates the VMs1 by verifying the hash value H (the Docker image that realizes VMs1) from the VMs1 of the data processing device 100 via a third-party verification organization.

[0077] In S206, the VMs1 of the data processing device 100 and the data storage device 200 each generate (calculate) a shared key Kd2 using ECDHE with mutual authentication. At this time, the VMs1 of the data processing device 100 authenticates the user (data storage device 200) by verifying the signature by SKd2 using PKd2, and the data storage device 200 authenticates the VMs1 by verifying the hash value H (Docker image that realizes VMs1) from the VMs1 of the data processing device 100 via a third-party verification organization.

[0078] In S207, the VMs1 of the data processing device 100 notifies the program providing device 300 that it has received a policy proposal from the policy proposer. The policy proposer is not limited to a specific person and may be any person, such as a PF operator, a data holder, a program author, or a third party other than those mentioned above. Here, the policy proposal is proposed in a format such as {name, role, requested authority}. Here, it is assumed that the name of the public key PKd2 is specified in "name," the role r1 corresponding to PKp1 is specified in "role," and the authority required for confidential program execution is specified in "request authority." In this case, the VMs1 of the data processing device 100 may notify the program providing device 300 of the receipt of the policy proposal by transmitting Enc({name, role, requested authority}, Kp1) and MAC(Enc({name, role, requested authority}, Kp1), Kp1) to the program providing device 300.

[0079] Upon receiving the notification of receipt of the policy proposal, the program providing device 300 verifies MAC(Enc({name, role, requested authority}, Kp1), Kp1), and if the verification is successful, displays a screen containing display components such as buttons for selecting whether or not to grant the requested authority to the user corresponding to public key PKd2 to the user corresponding to PKp1. When a button indicating "Allow" is pressed on this screen, the program providing device 300 adds public key PKd2 to its own list of authorized public keys. As a result, the program providing device 300 manages PKp1 as the authorizing entity and PKd2 as the authorization target.

[0080] In S208, the program providing device 300 transmits Enc(PKd2, Kp1) and Sig(H(Enc(PKd2, Kp1)), SKp1) to the VMs1 of the data processing device 100. Upon receiving Enc(PKd2, Kp1) and Sig(H(Enc(PKd2, Kp1)), SKp1), the VMs1 of the data processing device 100 verifies Sig(H(Enc(PKd2, Kp1)), SKp1), and if the verification is successful, manages PKp1 as the authorized subject and PKd2 as the authorized target.

[0081] S209 to S210 are similar to S109 to S110 in the first embodiment, respectively, and therefore a description thereof will be omitted.

[0082] In S211, the VMr1 of the data processing device 100 transmits HybEnc(P, PKp1) to the VMs1 through inter-container communication.

[0083] In S212, the program providing device 300 transmits Enc(SKp1, Kp1) and Sig(H(Enc(SKp1, Kp1)), SKp1) to VMs1 of the data processing device 100. Upon receiving Enc(SKp1, Kp1) and Sig(H(Enc(SKp1, Kp1)), SKp1), VMs1 of the data processing device 100 verifies Sig(H(Enc(SKp1, Kp1)), SKp1), and if the verification is successful, decrypts Enc(SKp1, Kp1) using Kp1 to extract SKp1. This means that the private key SKp1 of the program providing device 300 is entrusted to VMs1.

[0084] In S213, the VMs1 of the data processing device 100 decrypts HybEnc(P, PKp1) using SKp1 to extract P, and starts up P on the VMs1.

[0085] In S214, the VMs1 of the data processing device 100 notifies the data holding device 200 that it has received the policy proposal from the policy proposer. Here, the policy proposal is proposed in a format such as {name, role, requested authority}, for example. Here, it is assumed that the name of the public key PKp1 is specified in "name," the role r2 corresponding to PKd2 is specified in "role," and the authority required for confidential program execution is specified in "requested authority." In this case, the VMs1 of the data processing device 100 may transmit Enc({name, role, requested authority}, Kd2) and MAC(Enc({name, role, requested authority}, Kd2), Kd2) to the data holding device 200 to notify it of the receipt of the policy proposal.

[0086] Upon receiving the notification of receipt of the policy proposal, the data holding device 200 verifies MAC(Enc({name, role, requested authority}, Kd2), Kd2), and if the verification is successful, displays a screen containing display components such as buttons for selecting whether or not to grant the requested authority to the user corresponding to public key PKp1 to the user corresponding to PKd2. When a button indicating "Allow" is pressed on this screen, the data holding device 200 adds the public key PKp1 to its own list of authorized public keys. As a result, the data holding device 200 manages PKd2 as the authorizing subject and PKp1 as the authorization target.

[0087] S215 to S216 are similar to S115 to S116 in the first embodiment, respectively, and therefore a description thereof will be omitted.

[0088] In S217, the VMr2 of the data processing device 100 transmits HybEnc(D, PKd2) to the VMs1 through inter-container communication.

[0089] In S218, the VMs1 of the data processing device 100 transmits Np1 and Sig(Np1, SKp1) to the data holding device 200. This means that the VMs1 is signing on behalf of the program author (TEE proxy signature). Upon receiving Np1 and Sig(Np1, SKp1), the data holding device 200 verifies Sig(Np1, SKp1) (including verifying that Np1 matches), and if the verification is successful, generates Sig(Np1, SKd2).

[0090] In S219, the data holding device 200 transmits Np1, Sig(Np1, SKd2), Nd2, and Sig(Nd2, SKd2) to the VMs1 of the data processing device 100. Upon receiving Np1, Sig(Np1, SKd2), Nd2, and Sig(Nd2, SKd2), the VMs1 of the data processing device 100 verifies Sig(Np1, SKd2) and Sig(Nd2, SKd2) (including verifying that Np1 matches and that Nd2 matches), and if the verification is successful, generates Sig(Nd2, SKp1). Note that this means that the VMs1 is signing on behalf of the program author (TEE proxy signature).

[0091] In S220, the VMs1 of the data processing device 100 transmits Nd2 and Sig(Nd2, SKp1) to the data holding device 200. Upon receiving Nd2 and Sig(Nd2, SKp1), the data holding device 200 verifies Sig(Nd2, SKp1) (including verifying that Nd2 matches), and if the verification is successful, generates Enc(SKd2, Kd2) and Sig(H(Enc(SKd2, Kd2)), SKd2).

[0092] In S221, the data holding device 200 transmits Enc(SKd2, Kd2) and Sig(H(Enc(SKd2, Kd2)), SKd2) to the VMs1 of the data processing device 100. The VMs1 of the data processing device 100 verifies Sig(H(Enc(SKd2, Kd2)), SKd2), and if the verification is successful, decrypts Enc(SKd2, Kd2) with Kd2 to extract SKd2. This means that the private key SKd2 of the data holding device 200 is entrusted to the VMs1.

[0093] In S222, the VMs1 of the data processing device 100 decrypts HybEnc(D, PKd2) using SKd2 to extract D and calculates P(D).

[0094] In S223, the VMs1 of the data processing device 100 transmits HybEnc(P(D),PKd2) to the data holding device 200.

[0095] In S224, the data processing apparatus 100 deletes VMs1.

[0096] In S225, the data processing device 100 notifies the data holding device 200 that VMs1 has been deleted.

[0097] In the above processing flow, the communication unit 120 of the data processing device 100 may block communications other than communications via the secure area 110 related to P or D. In particular, download communications to devices other than the data holding device 200 may be blocked.

[0098] According to the second embodiment, the owner of the container in which the program P is executed in the first embodiment is a person other than the program author and the data holder, so that the asymmetry in the relationship between the program author and the data holder can be resolved.

[0099] Example 3 In the third embodiment, the notification of receipt of the policy proposal is issued by the PF operator in the second embodiment, and it is assumed that the PF operator will not attack the access control policy, so Enc and MAC are not required when issuing the notification of receipt of the policy proposal. Furthermore, under this assumption, the PF operator manages part of the confidential execution of the program.

[0100] A third embodiment will be described with reference to Figures 8 and 9. In the third embodiment, differences from the second embodiment will be mainly described, and descriptions of components similar to those in the second embodiment will be omitted or simplified.

[0101] S301 to S306 are similar to S201 to S206 in the second embodiment, respectively, and therefore their explanation will be omitted.

[0102] In S307, the data processing device 100 notifies the program providing device 300 that it has received a policy proposal from the policy proposer. The policy proposer is not limited to a specific person and may be any person, such as the PF operator itself, a data holder, a program author, or a third party other than those mentioned above. Here, the policy proposal is proposed in a format such as {name, role, requested authority}. Here, the name of the public key PKd2 is specified in "name," the role r1 corresponding to PKp1 is specified in "role," and the authority required for confidential program execution is specified in "request authority." In this case, the data processing device 100 may transmit {name, role, requested authority} to the program providing device 300 to notify it of the receipt of the policy proposal.

[0103] Upon receiving the notification of receipt of the policy proposal, the program providing device 300 displays to the user corresponding to PKp1 a screen including display components such as buttons for selecting whether or not to grant the requested authority to the user corresponding to public key PKd2. When the "Allow" button on this screen is pressed, the program providing device 300 adds public key PKd2 to its own list of authorized public keys. As a result, the program providing device 300 manages PKp1 as the authorization subject and PKd2 as the authorization target.

[0104] In S308, the program providing apparatus 300 transmits the authorization subject PKp1 and the authorization target PKd2 to the data processing apparatus 100.

[0105] In S309, the data processing device 100 transmits the authorization subject PKp1 and the authorization target PKd2 to the VMs 1. As a result, in the VMs 1 of the data processing device 100, PKp1 is managed as the authorization subject and PKd2 is managed as the authorization target.

[0106] In S310, the data processing device 100 transmits the authorization subject PKp1 and the authorization target PKd2 to VMr1. As a result, VMr1 of the data processing device 100 manages PKp1 as the authorization subject and PKd2 as the authorization target.

[0107] S311 to S314 are similar to S210 to S213 in the second embodiment, respectively, and therefore their explanation will be omitted.

[0108] In S315, the data processing device 100 notifies the data holding device 200 that it has received a policy proposal from the policy proposer. Here, the policy proposal is proposed in a format such as {name, role, requested authority}, where "name" specifies the name of the public key PKp1, "role" specifies the role r2 corresponding to PKd2, and "requested authority" specifies the authority required for confidential program execution. In this case, the data processing device 100 simply transmits {name, role, requested authority} to the data holding device 200 to notify it of the receipt of the policy proposal.

[0109] Upon receiving the notification of receipt of the policy proposal, the data holding device 200 displays to the user corresponding to PKd2 a screen including display components such as buttons for selecting whether or not to grant the requested authority to the user corresponding to public key PKp1. When the "Allow" button on this screen is pressed, the data holding device 200 adds the public key PKp1 to its own list of authorized public keys. As a result, the program providing device 300 manages PKd2 as the authorization subject and PKp1 as the authorization target.

[0110] In S316, the data holding device 200 transmits the authorization subject PKd2 and the authorization target PKp1 to the data processing device 100.

[0111] In S317, the data processing device 100 transmits the authorization subject PKd2 and the authorization target PKp1 to VMr2. As a result, in VMr1 of the data processing device 100, PKd2 is managed as the authorization subject and PKp1 is managed as the authorization target.

[0112] S318 to S327 are similar to S216 to S225 in the second embodiment, respectively, and therefore their explanation will be omitted.

[0113] In the above processing flow, the communication unit 120 of the data processing device 100 may block communications other than communications via the secure area 110 related to P or D. In particular, download communications to devices other than the data holding device 200 may be blocked.

[0114] According to the third embodiment, it is possible to eliminate the need for Enc and MAC when notifying the receipt of a policy proposal in the second embodiment.

[0115] (Supplementary information for Examples 1 to 3) Program P may be, for example, an artificial intelligence (AI) program that includes a deep neural network (DNN). In this case, by code signing the AI ​​using each user's private key, it is possible to clearly identify which user has the authority to use the AI.

[0116] The above AI can be read as Digital Twin.

[0117] (Example of hardware configuration) The data processing device 100, the data storage device 200, and the program providing device 300 can all be realized, for example, by causing a computer to execute a program. This computer may be a physical computer or a virtual machine on the cloud. The data processing device 100, the data storage device 200, and the program providing device 300 are collectively referred to as "devices."

[0118] That is, the device can be realized by executing a program corresponding to the processing performed by the device using hardware resources such as a CPU and memory built into a computer. The program can be recorded on a computer-readable recording medium (such as a portable memory) and stored or distributed. The program can also be provided via a network such as the Internet or email.

[0119] Fig. 10 is a diagram showing an example of the hardware configuration of the computer. The computer in Fig. 10 has a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, and the like, all of which are connected to one another via a bus B. Note that some of these devices may not be included. For example, if no display is required, the display device 1006 may not be included.

[0120] The program for realizing processing on the computer is provided by a recording medium 1001 such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

[0121] The memory device 1003 reads and stores a program from the auxiliary storage device 1002 when an instruction to start the program is received. The CPU 1004 realizes the functions of the device in accordance with the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network, and functions as a transmitter and receiver. The display device 1006 displays a GUI (Graphical User Interface) or the like according to a program. The input device 1007 is composed of a keyboard, mouse, buttons, a touch panel, or the like, and is used to input various operation instructions. The output device 1008 outputs the results of calculations.

[0122] (Examples of application areas) The technology described in this embodiment can be applied to various use cases, examples of which are listed below.

[0123] Traffic flow simulator (http: / / www.jste.or.jp / sim / models / index.html) People flow simulator (https: / / info.hitachi-ics.co.jp / product / h_flow / ) Heart Simulator (https: / / blog.global.fujitsu.com / jp / 2018-05-10 / 01 / ) Brain Simulator (https: / / bicr.atr.jp / cbi / research-ja / %E8%84%B3%E6%B4%BB%E5%8B%95%E8%A8%88%E6%B8%AC%E3%83%87%E3%83%BC%E3%82%BF%E3%82%B7%E3%83%9F%E3%83%A5%E3%83%AC%E3%83%BC%E3%82%BF / ) Material property simulator (https: / / www.jsol-cae.com / product / material / jocta / ) Robot simulator (http: / / www.idec-fs.com / robodk / ) FPGA simulator (https: / / www.intel.co.jp / content / www / jp / ja / software / programmable / quartus-prime / model-sim.html) Space Simulator (http: / / www.astro.phys.s.chiba-u.ac.jp / netlab / astro / index2.html) Virtual Pets (https: / / www.discoverychannel.jp / 0000007144 / ) Speech synthesis (https: / / cloud.google.com / text-to-speech?hl=ja) (Effects of the embodiment) As described above, the technology according to the present embodiment provides a technology that, when a data processing device equipped with a secure computation mechanism processes data of a data holder using a program of a program provider, prevents the program and data from being leaked to the PF operator, prevents the data from being leaked to the program provider, and prevents the program from being leaked to the data holder, and enables access control based on roles.

[0124] (Summary of the embodiment) This specification discloses at least the following program execution system, data processing device, program execution method, and program. (Section 1) A program execution system including a data storage device, a program providing device, and a data processing device having a mechanism for performing secure computation in a secure area, the program providing device transmits to the data processing device an encrypted program obtained by encrypting a program P with a public key PKr1 corresponding to a first role; the data holding device encrypts data D with a public key PKr2 corresponding to a second role and transmits the encrypted data to the data processing device; the data processing device confirms whether the program providing device belongs to the first role, and if it is confirmed that the program providing device belongs to the first role, generates a re-encrypted program by re-encrypting the encrypted program with a public key PKp1 of the program providing device; the program providing device transmits to the data processing device a secret key SKp1 encrypted with a shared key Kp1 shared between the program providing device and the data processing device; the data processing device confirms whether the data holding device belongs to the second role, and if it is confirmed that the data holding device belongs to the second role, generates re-encrypted data by re-encrypting the encrypted data with a public key PKd2 of the data holding device; the data holding device transmits to the data processing device a secret key SKd2 encrypted with a shared key Kd2 shared between the data holding device and the data processing device; the data processing device, in the secure area, executes a program P obtained by decrypting the re-encrypted program with the private key SKp1 on data D obtained by decrypting the re-encrypted data with the private key SKd2, and calculates a result P(D); Program execution system. (Section 2) The data processing device includes: The program execution system described in claim 1, wherein a first encrypted container owned by a user of the program providing device is used as the secure area, and in the secure area, a program P obtained by decrypting the re-encrypted program with the private key SKp1 is executed on data D obtained by decrypting the re-encrypted data with the private key SKd2, and the result P(D) is calculated. (Section 3) The data processing device includes: The program execution system described in claim 1, wherein a second encrypted container owned by a user who is in a trust relationship with the user of the program providing device and the user of the data storage device is used as the secure area, and in the secure area, a program P obtained by decrypting the re-encrypted program with the private key SKp1 is executed on data D obtained by decrypting the re-encrypted data with the private key SKd2, and the result P(D) is calculated. (Section 4) The data processing device includes: transmitting to the program providing device and the data holding device a notification that a policy proposal for realizing access control for the second encrypted container has been received; 4. The program execution system according to claim 3, wherein, when permission for the policy is returned from the program providing device and the data holding device, access control is performed in the second encrypted container according to the policy. (Section 5) The data processing device includes: whether or not the program providing device belongs to the first role is confirmed on an encrypted container corresponding to the first role, and if it is confirmed that the program providing device belongs to the first role, a re-encrypted program is generated by re-encrypting the encrypted program with a public key PKp1 of the program providing device; A program execution system described in any one of paragraphs 1 to 4, which checks on an encrypted container corresponding to the second role whether the data storage device belongs to the second role, and if it is confirmed that the data storage device belongs to the second role, generates re-encrypted data by re-encrypting the encrypted data with the public key PKd2 of the data storage device. (Section 6) 1. A data processing device in a program execution system including a data storage device, a program providing device, and a data processing device having a mechanism for performing secure computation in a secure area, receiving an encrypted program obtained by encrypting a program P with a public key PKr1 corresponding to a first role from the program providing device; receiving, from the data holding device, encrypted data obtained by encrypting data D with a public key PKr2 corresponding to a second role; confirming whether the program providing device belongs to the first role, and if it is confirmed that the program providing device belongs to the first role, generating a re-encrypted program by re-encrypting the encrypted program with a public key PKp1 of the program providing device; receiving from the program provider device a secret key SKp1 encrypted with a shared key Kp1 shared between the program provider device and the data processing device; confirming whether the data holding device belongs to the second role, and if it is confirmed that the data holding device belongs to the second role, generating re-encrypted data by re-encrypting the encrypted data with a public key PKd2 of the data holding device; receiving, from the data holding device, a secret key SKd2 encrypted with a shared key Kd2 shared with the data processing device; In the secure area, a program P obtained by decrypting the re-encrypted program with the private key SKp1 is executed on data D obtained by decrypting the re-encrypted data with the private key SKd2, thereby calculating a result P(D). Data processing device. (Section 7) A program execution method in a program execution system including a data storage device, a program providing device, and a data processing device having a mechanism for performing secure computation in a secure area, comprising: the program providing device transmits to the data processing device an encrypted program obtained by encrypting a program P with a public key PKr1 corresponding to a first role; the data holding device encrypts data D with a public key PKr2 corresponding to a second role and transmits the encrypted data to the data processing device; the data processing device confirms whether the program providing device belongs to the first role, and if it is confirmed that the program providing device belongs to the first role, generates a re-encrypted program by re-encrypting the encrypted program with a public key PKp1 of the program providing device; the program providing device transmits to the data processing device a secret key SKp1 encrypted with a shared key Kp1 shared between the program providing device and the data processing device; the data processing device confirms whether the data holding device belongs to the second role, and if it is confirmed that the data holding device belongs to the second role, generates re-encrypted data by re-encrypting the encrypted data with a public key PKd2 of the data holding device; the data holding device transmits to the data processing device a secret key SKd2 encrypted with a shared key Kd2 shared between the data holding device and the data processing device; the data processing device, in the secure area, executes a program P obtained by decrypting the re-encrypted program with the private key SKp1 on data D obtained by decrypting the re-encrypted data with the private key SKd2, and calculates a result P(D); How to run the program. (Section 8) A program for causing a computer to function as the data processing device described in item 6.

[0125] Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and changes are possible within the scope of the gist of the present invention described in the claims. [Explanation of symbols]

[0126] 100 Data processing device 110 Secure Area 111 Secure Data Storage 112 Secure Processing Unit 120 Communications Department 130 Data storage unit 140 Data Processing Unit 200 Data retention device 300 Program providing device 400 Secure Channel 1000 Drive Device 1001 Recording media 1002 Auxiliary storage device 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input Device 1008 Output Device B Bus

Claims

1. A program execution system including a data storage device, a program providing device, and a data processing device having a mechanism for performing secure computation in a secure area, the program providing device transmits to the data processing device an encrypted program obtained by encrypting a program P with a public key PKr1 corresponding to a first role; the data holding device encrypts data D with a public key PKr2 corresponding to a second role and transmits the encrypted data to the data processing device; the data processing device confirms whether the program providing device belongs to the first role, and if it is confirmed that the program providing device belongs to the first role, generates a re-encrypted program by re-encrypting the encrypted program with a public key PKp1 of the program providing device; the program providing device transmits to the data processing device a secret key SKp1 encrypted with a shared key Kp1 shared between the program providing device and the data processing device; the data processing device confirms whether the data holding device belongs to the second role, and if it is confirmed that the data holding device belongs to the second role, generates re-encrypted data by re-encrypting the encrypted data with a public key PKd2 of the data holding device; The data holding device transmits to the data processing device a secret key SKd2 encrypted with a shared key Kd2 shared between the data holding device and the data processing device; the data processing device, in the secure area, executes a program P obtained by decrypting the re-encrypted program with the private key SKp1 on data D obtained by decrypting the re-encrypted data with the private key SKd2, and calculates a result P(D); Program execution system.

2. The data processing device includes: The program execution system of claim 1, wherein a first encrypted container owned by a user of the program providing device is used as the secure area, and in the secure area, a program P decrypted by the private key SKp1 is executed on data D decrypted by the re-encrypted data decrypted by the private key SKd2, thereby calculating the result P(D).

3. The data processing device includes:

2. The program execution system of claim 1, wherein the secure area is a second encrypted container owned by a user who is in a trust relationship with the user of the program providing device and the user of the data holding device, and in the secure area, the result P(D) is calculated by executing a program P obtained by decrypting the re-encrypted program with the private key SKp1 on data D obtained by decrypting the re-encrypted data with the private key SKd2.

4. The data processing device includes: transmitting to the program providing device and the data holding device a notification that a policy proposal for realizing access control for the second encrypted container has been received; 4. The program execution system according to claim 3, wherein when permission for the policy is returned from the program providing device and the data holding device, access control is performed in the second encrypted container according to the policy.

5. The data processing device includes: whether the program providing device belongs to the first role is confirmed on an encrypted container corresponding to the first role, and if it is confirmed that the program providing device belongs to the first role, a re-encrypted program is generated by re-encrypting the encrypted program with a public key PKp1 of the program providing device; A program execution system as described in any one of claims 1 to 4, which checks on an encrypted container corresponding to the second role whether the data holding device belongs to the second role, and if it is confirmed that the data holding device belongs to the second role, generates re-encrypted data by re-encrypting the encrypted data with the public key PKd2 of the data holding device.

6. 1. A data processing device in a program execution system including a data storage device, a program providing device, and a data processing device having a mechanism for performing secure computation in a secure area, receiving an encrypted program obtained by encrypting a program P with a public key PKr1 corresponding to a first role from the program providing device; receiving, from the data holding device, encrypted data obtained by encrypting data D with a public key PKr2 corresponding to a second role; confirming whether the program providing device belongs to the first role, and if it is confirmed that the program providing device belongs to the first role, generating a re-encrypted program by re-encrypting the encrypted program with a public key PKp1 of the program providing device; receiving, from the program providing device, a secret key SKp1 encrypted using a shared key Kp1 shared between the program providing device and the data processing device; confirming whether the data holding device belongs to the second role, and if it is confirmed that the data holding device belongs to the second role, generating re-encrypted data by re-encrypting the encrypted data with a public key PKd2 of the data holding device; receiving, from the data holding device, a secret key SKd2 encrypted with a shared key Kd2 shared with the data processing device; In the secure area, a program P obtained by decrypting the re-encrypted program with the private key SKp1 is executed on the data D obtained by decrypting the re-encrypted data with the private key SKd2, and a result P(D) is calculated. Data processing device.

7. A program execution method in a program execution system including a data storage device, a program providing device, and a data processing device having a mechanism for performing secure computation in a secure area, comprising: the program providing device transmits to the data processing device an encrypted program obtained by encrypting a program P with a public key PKr1 corresponding to a first role; the data holding device encrypts data D with a public key PKr2 corresponding to a second role and transmits the encrypted data to the data processing device; the data processing device confirms whether the program providing device belongs to the first role, and if it is confirmed that the program providing device belongs to the first role, generates a re-encrypted program by re-encrypting the encrypted program with a public key PKp1 of the program providing device; the program providing device transmits to the data processing device a secret key SKp1 encrypted with a shared key Kp1 shared between the program providing device and the data processing device; the data processing device confirms whether the data holding device belongs to the second role, and if it is confirmed that the data holding device belongs to the second role, generates re-encrypted data by re-encrypting the encrypted data with a public key PKd2 of the data holding device; The data holding device transmits to the data processing device a secret key SKd2 encrypted with a shared key Kd2 shared between the data holding device and the data processing device; the data processing device, in the secure area, executes a program P obtained by decrypting the re-encrypted program with the private key SKp1 on data D obtained by decrypting the re-encrypted data with the private key SKd2, and calculates a result P(D); How to run the program.

8. A program for causing a computer to function as the data processing device according to claim 6.

Images