Program execution system, program execution method, and program

Abstract

To provide a system, method and program which guarantee the authenticity of a program including safety requirements such as confidentiality of data input / output to / from the program that operates in a secret calculation mechanism in VM or container unit.SOLUTION: In a program execution system including a data holding device which holds data D, a program providing device which provides a program P, and a data processing device which generates a secure region realized by a secret calculation mechanism, an APP_PE container generates certification information PROOF(P) for verifying the authenticity of the program P on the first secure region generated by the data processing device or the program providing device, an APP_PV container verifies the certification information PROOF(P) on the second secure region generated by the data processing device, and the APP_PE container calculates a result P(D) of executing the program P to the data D on the first secure region when the authenticity of the program P is verified.SELECTED DRAWING: Figure 5

Description

[Technical Field]

[0001] The present disclosure relates to confidential execution technology in the field of information and communications. [Background technology]

[0002] A known technology for securely executing programs is a secure computing mechanism that applies a Trusted Execution Environment (TEE), in which a Central Processing Unit (CPU) provides an isolated execution environment. While a TEE can execute programs securely, it does not guarantee the authenticity of the program, including safety requirements such as confidentiality of data input and output to the program. In contrast, a technology that implements a Proof-Carrying Code (PCC) mechanism in a process-based server-side TEE (Intel (registered trademark) SGX (second generation or later)) is known as a technology for guaranteeing the authenticity of programs running on a TEE (Non-Patent Document 1). [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Liu et al. "Practical and Efficient in-Enclave Verification of Privacy Compliance", DSN2021 Summary of the Invention [Problem to be solved by the invention]

[0004] However, the above-mentioned conventional technologies have safety requirement definitions specific to Intel SGX, and cannot be applied to TEEs on a VM (Virtual Machine) / container basis.

[0005] The present disclosure has been made in consideration of the above points, and provides a technology that guarantees the authenticity of a program, including security requirements such as confidentiality of data input and output to a program running on a secure computing mechanism on a VM or container basis. [Means for solving the problem]

[0006] A program execution system according to one aspect of the present disclosure is a program execution system including a data storage device that stores data D, a program providing device that provides a program P, and a data processing device that generates a secure area realized by a secret computation mechanism, and includes: a proof processing unit configured to generate proof information PROOF(P) for verifying the authenticity of the program P on a first secure area generated by the data processing device in response to a request from the program providing device, or on the program providing device; a proof verification processing unit configured to verify the proof information PROOF(P) on a second secure area generated by the data processing device in response to a request from the data storage device; and a calculation unit configured to calculate a result P(D) of executing the program P on the data D on the first secure area when the authenticity of the program P is verified by the proof information PROOF(P). [Effects of the Invention]

[0007] The disclosed technology provides a technology that guarantees the authenticity of a program, including safety requirements such as confidentiality of data input and output to a program that runs on a secure computing mechanism in a VM or container unit. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a diagram illustrating an example of a system configuration according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram illustrating an example of a functional configuration of a data processing device. [Figure 3] FIG. 10 is a diagram illustrating an image of processing in a secure area. [Figure 4]FIG. 1 is a sequence diagram (1 / 2) showing a processing flow in the first embodiment. [Figure 5] FIG. 2 is a sequence diagram (2 / 2) showing the flow of processing in the first embodiment. [Figure 6] FIG. 2 illustrates an example of a functional configuration of a certification processing unit. [Figure 7] FIG. 2 illustrates an example of a functional configuration of a proof verification processing unit. [Figure 8] FIG. 10 is a sequence diagram showing a processing flow in the second embodiment. [Figure 9] FIG. 10 is a diagram illustrating an example of a functional configuration of a secret information data flow proof processing unit. [Figure 10] FIG. 11 is a sequence diagram showing a processing flow in the third embodiment. [Figure 11] FIG. 2 illustrates an example of a hardware configuration of the apparatus. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, an embodiment of the present invention (the present embodiment) will be described with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0010] In the following, we will assume that data and a program are owned by different users, and that the execution result of the program on the data is calculated using a secure computation mechanism per VM or container on a cloud provided by an untrusted cloud provider, and we will explain how to guarantee the authenticity of the program. As a result, not only are the data and the program not leaked to the cloud provider, but the program is not leaked to the user who owns the data, and the data is not leaked to the user who owns the program, and the authenticity of the program is guaranteed. In the following explanation, the program is denoted as P, the data to be processed by P is denoted as D, and the execution result of P on D is denoted as P(D).

[0011] (System configuration example) An example of the configuration of a program execution system according to an embodiment of the present invention is shown in Fig. 1. As shown in Fig. 1, the program execution system according to this embodiment includes a data processing device 100, a data holding device 200, and a program providing device 300.

[0012] It is assumed that the data processing device 100 is a physical machine (computer), but the data holding device 200 and the program providing device 300 may each be a physical machine or a virtual machine on the cloud. The data holding device 200 and the program providing device 300 may each be a function (e.g., a web browser) that runs on a physical machine or a virtual machine. Furthermore, the data processing device 100 may be a system made up of multiple physical machines (in particular, two VMs / containers running two application programs APP_PE and APP_PV, which will be described later, may be generated on different physical machines).

[0013] In this embodiment, the data processing device 100 is provided with a confidential computing mechanism (which may also be called a secure computing mechanism) by applying a function called a TEE, which provides an environment in which data processing is executed in isolation from an existing OS (Operating System). In this embodiment, AMD (registered trademark) SEV is assumed as the TEE. However, this is just one example, and this embodiment can be applied to any TEE. For example, this embodiment can also be applied to Intel's SGX or TDX, Arm (registered trademark) TrustZone (registered trademark), ARM Confidential Compute Architecture, etc.

[0014] 1, a secure channel 400 is established between a data processing device 100 and a data holding device 200, and between the data processing device 100 and a program providing device 300, allowing data and programs to be transmitted and received securely. This secure channel 400 is established, for example, by a remote attestation protocol called Remote Attestation in SEV. However, this is just one example, and the secure channel 400 may be established by any means.

[0015] In this embodiment, a program P is transmitted from the program providing device 300 to the data processing device 100, data D is transmitted from the data holding device 200 to the data processing device 100, the data processing device 100 processes the data D using the program P, and provides the execution result P(D) to the data holding device 200.

[0016] The data processing device 100 uses its secure computation mechanism to prevent the program P and data D from leaking outside the secure area (for example, to a cloud where the data processing device 100 is running). In addition, in this embodiment, a mechanism is realized that prevents the program P from leaking to the data storage device 200 and the data D from leaking to the program providing device 300, and the authenticity of the program P is also realized. Hereinafter, the authenticity of the program P is defined as "the program P operates correctly and safely," and its security is defined as "unencrypted information is not output outside the program P." This authenticity is then proven and verified using the PCC mechanism. However, these definitions are merely examples, and other definitions are also possible. For example, security may be defined as "the PCC mechanism can verify that 'unencrypted information is not output outside the program P,'" "information not encrypted with the intended key ID is not output outside," "information that has not been anonymized using anonymization, differential privacy, or the like is not output outside," etc. Other definitions of authenticity and security requirements may also be used.

[0017] As a result, in the program execution system of this embodiment, in a use case in which the secure computing mechanism is applied to data distribution, a data holder (data holding device 200) having highly confidential data D and a program author (program providing device 300) having highly confidential program P can combine and execute the data / program while keeping them confidential from each other. Furthermore, the data holder can execute the program P on the data D after verifying the authenticity of the program P.

[0018] (Example of configuration of data processing device) Fig. 2 shows an example of the functional configuration of data processing device 100. As shown in Fig. 2, data processing device 100 has secure area 110 which is a protected area where confidentiality is maintained, communication unit 120 which performs data communication with other devices (e.g., data holding device 200, program providing device 300), data storage unit 130 which stores data in storage or the like outside secure area 110, and data processing unit 140 which performs various types of data processing outside secure area 110.

[0019] The contents of the data and programs in the secure area 110 cannot be known from the outside. Outside the secure area 110, normal data storage and data processing (program execution) can be performed by the data storage unit 130 and the data processing unit 140, respectively. Data communication and access control for that communication can also be performed by the communication unit 120.

[0020] Within the secure area 110, data can be stored and data processed (program execution) while maintaining confidentiality. Fig. 2 shows a secure data storage unit 111 and a secure processing unit 112 as functional units that perform these functions within the secure area 110. The secure data storage unit 111 stores various types of data in a memory area within the secure area 110 while maintaining confidentiality. Furthermore, the secure processing unit 112 performs data processing within the secure area 110 (for example, activation and execution of P, generation (calculation) of a shared key (common key), encryption, decryption, signature verification, etc.).

[0021] The secure area 110 itself can be realized using existing technology. Any existing technology may be used to realize the secure area 110. For example, the secure area 110 may be realized as a separate chip that is hardware-independent from the main CPU and memory, or the secure area 110 may be realized in software using encryption and authentication technologies. The aforementioned SEV is an example of a technology for realizing the secure area 110 in software, and this embodiment assumes the use of SEV as an example. In this case, the secure area 110 is generated as an encrypted VM or container in the data processing device 100. Hereinafter, the secure area 110 will be described as being generated as an encrypted container, but this embodiment can also be applied in the same way when the secure area 110 is generated as an encrypted VM. Note that, for example, if multiple encrypted containers are generated, multiple secure areas 110 will exist, and in this case, they will be referred to as secure area 110-1, secure area 110-2, etc.

[0022] 3 shows an image of data processing in the secure area 110. In this embodiment, "HybEnc" means encryption using a public key-based encryption method, and "Enc" means encryption using a shared key-based encryption method. For example, HybEnc(D) is encrypted data.

[0023] As shown in FIG. 3, the data processing device 100 receives HybEnc(D) from the data holding device 200 and also receives HybEnc(P) from the program providing device 300.

[0024] In the secure area 110, HybEnc(D) and HybEnc(P) are decrypted to obtain D and P, respectively. Furthermore, in the secure area 110, after P(D) is calculated, HybEnc(P(D)) is calculated. HybEnc(P(D)) is transmitted to the data holding device 200.

[0025] At this time, in each embodiment described later, a mechanism called PCC is introduced to verify that the program P operates correctly and safely. This ensures the safety of the program P (i.e., the safety that "unencrypted information is not output outside the program P"), making it possible to prevent, for example, a situation in which an unauthorized program is executed and data D is leaked.

[0026] In this way, by combining calculations and encrypted communication in the secure area 110 and the PCC, a mechanism is realized that not only prevents the program P and data D from leaking to the data processing device 100, but also prevents the program P from leaking to the data storage device 200 and the data D from leaking to the program providing device 300, and further guarantees the authenticity of the program P.

[0027] Below, examples 1 to 3 will be described as examples of the processing flow in this embodiment. In each of the following examples, it is assumed that a remote attestation mechanism is used for generating (sharing) a shared key. More specifically, a protocol is used in which a mechanism for mutual authentication between a user (data holding device 200, program providing device 300) and a container is inserted into the Elliptic Curve Diffie-Hellman key exchange protocol (ECDHKE). In this embodiment, this is called ECDHE with mutual authentication.

[0028] A third-party verification organization (e.g., AMD Verification Service) is involved in the authentication of a container. However, the process of generating a shared key through the intervention of a third-party verification organization is an existing technology known as Remote Attestation. Therefore, in the explanation of Examples 1 to 3, only an overview of the process related to Remote Attestation is provided, and detailed explanations are omitted.

[0029] In the following description, APP_PE and APP_PV are application programs that run on a container and are released as OSS (Open Source Software). Program P is executed on APP_PE. In addition, in Examples 1 and 3, it is assumed that a PCC certification program is included in APP_PE, and in Example 2, it is assumed that the PCC certification program is installed in the program providing device 300. On the other hand, it is assumed that a PCC verification program is included in APP_PV. The PCC certification program is a program that creates proof information PROOF(P) that indicates that program P satisfies the security requirement that "unencrypted information is not output outside program P," and the PCC verification program is a program that verifies whether PROOF(P) is correct. For details about PCC, please refer to, for example, References 1 to 3.

[0030] In addition, in the third embodiment, it is assumed that a secret information data flow attestation program is included in APP_PE. The secret information data flow attestation program is a program that creates proof information indicating that secret information (data D) is encrypted with a specific key inside program D. As a result, in the third embodiment, the data holder can verify from the proof information that the secret information (data D) is protected inside program D.

[0031] Furthermore, PKp and SKp are the public key and private key of the program providing device 300, respectively. PKd and SKd are the public key and private key of the data holding device 200, respectively. Furthermore, HybEnc(A,B) means information obtained by encrypting A with B (public key), and Enc(A,B) means information obtained by encrypting A with B (shared key). H(A) means the hash value of A. Sig(A,B) means a signature for A using B (private key). MAC(A,B) means a message authentication code for A using B (shared key).

[0032] In the following explanation, it is assumed that the programs running on the container are not replaced after the container is started. This ensures that there is no fraud, such as showing the execution evidence of a certain program while returning the execution results of another program.

[0033] Example 1 Hereinafter, a first embodiment will be described with reference to Figures 4 and 5. As a premise of the processing flow in Figures 4 and 5, the data holding device 200 holds APP_PV, D, PKd, and SKd, and the program providing device 300 holds APP_PE, P, PKp, and SKp.

[0034] In S101, the data holding device 200 transmits HybEnc(D,PKd) to the data processing device 100. This HybEnc(D,PKd) is stored by the data storage unit 130 in a public storage area such as the storage of the data processing device 100.

[0035] In S102, the program providing device 300 transmits APP_PE and HybEnc(P, PKp) to the data processing device 100. These APP_PE and HybEnc(P, PKp) are stored in a public storage area such as the storage of the data processing device 100 by the data storage unit 130. Note that APP_PE and HybEnc(P, PKp) are also registered with a third-party verification organization by the program providing device 300 and made public.

[0036] In S103, the program providing apparatus 300 transmits to the data processing apparatus 100 a container activation request for running the APP_PE.

[0037] In S104, the data processing device 100 generates and starts a container for running APP_PE, and encrypts this container. As a result, an encrypted container (secure area 110-1) in which APP_PE runs is generated. Hereinafter, for convenience, the container generated here will be referred to as "APP_PE container 110-1."

[0038] Here, the APP_PE container 110-1 has a proof processing unit 500 realized by a PCC proof program included in the APP_PE. A configuration example of the proof processing unit 500 is shown in FIG. 6. As shown in FIG. 6, the proof processing unit 500 includes a verification logical formula generation processing unit 510 that receives a program P and outputs a verification logical formula, and an automatic proof processing unit 520 that receives the verification logical formula and outputs PROOF(P). The verification logical formula generation processing unit 510 also receives a security requirement that indicates security, namely, "unencrypted information is not output outside the program P." However, since no other security requirements are considered in this embodiment, the input of the security requirement is omitted. Note that the security requirement that indicates security, "unencrypted information is not output outside the program P," is an extension of a known security requirement called the P0 requirement (see, for example, Non-Patent Document 1), and may therefore be referred to as an "extended P0 requirement," or the like.

[0039] Verification logical formula generation processing unit 510 includes lexical analysis unit 511 that performs lexical analysis of program P, syntactic analysis unit 512 that performs syntactic analysis of the result of the lexical analysis, and verification logical formula generation unit 513 that generates a verification logical formula from the result of the syntactic analysis. Since lexical analysis unit 511, syntactic analysis unit 512, and automatic proof processing unit 520 are similar to existing technologies, the following describes details of verification logical formula generation unit 513.

[0040] Program syntax As a result of the syntax analysis by the syntax analysis unit 512, the program P is assumed to be expressed by the following syntax.

[0041]

number

[0042] Furthermore, the expression e is expressed as follows:

[0043]

number

[0044] Logical system A type called encrypted variables is defined below.

[0045]

number

[0046] The logical formula is defined below.

[0047]

number

[0048] An example of a logical expression is shown below.

[0049]

number

[0050] Further examples of logical expressions are shown below.

[0051]

number

[0052] Next, the inference rules are defined below.

[0053]

number

[0054] Verification formula generation algorithm Based on the above program syntax and logic system, the verification logical formula generation unit 513 receives a program P expressed in program syntax as input, and generates and outputs a verification logical formula using the following algorithm.

[0055]

number

[0056]

number

[0057] Regarding the verification logical formula generated and output by the algorithm shown in the above formula 8, if the verification logical formula can be derived using inference rules, then the input program P satisfies the extended P0 requirement. Note that the sequence of inference rules used in this derivation is the proof information PROOF(P) of the verification logical formula, which is calculated and output by the automatic proof processing unit 520.

[0058] An example of a program P that satisfies the extended P0 requirements is a program P expressed in the program syntax "x:=1;y:=encr(x);write(y);skip". When this program P is input into the algorithm shown in Equation 8 above, the following verification logical formula is generated:

[0059]

number

[0060] On the other hand, an example of a program P that does not satisfy the extended P0 requirement is a program P expressed in the program syntax "x:=1;write(x);skip". When this program P is input into the algorithm shown in Equation 8 above, the following verification logic is generated:

[0061]

number

[0062] 4 and 5. In S105, the data holding device 200 transmits the APP_PV to the data processing device 100. The data storage unit 130 stores the APP_PV in a public storage area such as the storage of the data processing device 100.

[0063] In S106, the data holding device 200 transmits to the data processing device 100 a container activation request for running the APP_PV.

[0064] In S107, the data processing device 100 generates and starts a container for running APP_PV, and encrypts this container. As a result, an encrypted container (secure area 110-2) in which APP_PV runs is generated. Hereinafter, for convenience, the container generated here will be referred to as the "APP_PV container 110-2."

[0065] Here, the APP_PV container 110-2 has a proof verification processing unit 600 that is realized by a PCC verification program included in the APP_PV. An example configuration of the proof verification processing unit 600 is shown in FIG. 7. As shown in FIG. 7, the proof verification processing unit 600 inputs a program P and its proof information PROOF(P) and outputs a PROOF verification result. The PROOF verification result is information indicating whether the proof information PROOF(P) is correct or not, and takes, for example, TRUE if PROOF(P) is correct, and FALSE if not. Note that the proof verification processing unit 600 is similar to existing technology, so a detailed description thereof will be omitted.

[0066] Returning to the explanation of the processing flow in Figures 4 and 5, in S108, the APP_PE container 110-1 and the program providing device 300 each generate (calculate) a shared key Kp2p using ECDHE with mutual authentication. At this time, the APP_PE container 110-1 authenticates the user (program providing device 300) by verifying the signature by SKp using PKp, and the program providing device 300 authenticates the APP_PE container 110-1 by verifying the hash value H(APP_PE+HybEnc(P,PKp)) from the APP_PE container 110-1 via a third-party verification organization. Note that "+" represents an operation to create data combining two pieces of data, such as an operation of concatenating bit strings.

[0067] In S109, the APP_PE container 110-1 and the data holding device 200 each generate (calculate) a shared key Kd2p using ECDHE with mutual authentication. At this time, the APP_PE container 110-1 authenticates the user (data holding device 200) by verifying the signature by SKd using PKd, and the data holding device 200 authenticates the APP_PE container 110-1 by verifying the hash value H(APP_PE+HybEnc(P,PKp)) from the APP_PE container 110-1 via a third-party verification organization.

[0068] In S110, the APP_PV container 110-2 and the data storage device 200 each generate (calculate) a shared key Kd2d using ECDHE with mutual authentication. At this time, the APP_PV container 110-2 authenticates the user (data storage device 200) by verifying the signature based on SKd using PKd, and the data storage device 200 authenticates the APP_PV container 110-2 by verifying the hash value H(APP_PV) from the APP_PV container 110-2 via a third-party verification organization.

[0069] In S111, the APP_PV container 110-2 and the program providing device 300 each generate (calculate) a shared key Kp2d using ECDHE with mutual authentication. At this time, the APP_PV container 110-2 authenticates the user (program providing device 300) by verifying the signature by SKp using PKp, and the program providing device 300 authenticates the APP_PV container 110-2 by verifying the hash value H(APP_PV) from the APP_PV container 110-2 via a third-party verification organization.

[0070] In S112, the program providing device 300 transmits Enc(SKp, Kp2p) and Sig(H(Enc(SKp, Kp2p)), SKp) to the APP_PE container 110-1. At this time, the program providing device 300 may further transmit Enc(PKd-list, Kp2p) and Sig(Enc(PKd-list, Kp2p), SKp) to the APP_PE container 110-1. Here, PKd-list is a list of public keys of data holders (data holding devices 200) that the program providing device 300 permits to execute the program P.

[0071] However, the PKd-list may be passed to the APP_PE container 110-1 in an earlier process, for example, in S108 above.

[0072] In S113, the data holding device 200 transmits Enc(SKd, Kd2d) and Sig(H(Enc(SKd, Kd2d)), SKd) to the APP_PV container 110-2. At this time, the data holding device 200 may also transmit Enc(PKp-list, Kd2d) and Sig(Enc(PKp-list, Kd2d), SKd) to the APP_PV container 110-2. Here, PKp-list is a list of public keys of program authors (program providing device 300) that the data holding device 200 permits to execute the program P.

[0073] However, the PKp-list may be passed to the APP_PV container 110-2 in an earlier process, for example, in S110 above.

[0074] In S114, the APP_PE container 110-1 verifies Sig(H(Enc(SKp, Kp2p)), SKp) using PKp, and if the verification is successful, decrypts Enc(SKp, Kp2p) using Kp2p to extract SKp. This means that the private key (signature key) SKp of the program providing device 300 is deposited in the APP_PE container 110-1. Note that SKp is stored in a secure storage area by the secure data storage unit 111 of the APP_PE container 110-1.

[0075] In S115, the APP_PV container 110-2 verifies Sig(H(Enc(SKd, Kd2d)), SKd) using PKd, and if the verification is successful, decrypts Enc(SKd, Kd2d) using Kd2d to extract SKd. This means that the private key (signature key) SKd of the data storage device 200 is deposited in the APP_PV container 110-2. Note that SKd is stored in a secure storage area by the secure data storage unit 111 of the APP_PV container 110-2.

[0076] In S116, the APP_PE container 110-1 decrypts HybEnc(P, PKp) using SKp to extract the program P, and starts the program P on the APP_PE container 110-1. The program P is started by the secure processing unit 112 of the APP_PE container 110-1.

[0077] In S117, the APP_PV container 110-2 decrypts HybEnc(D, PKd) using SKd to extract D.

[0078] In S118, the APP_PE container 110-1 and the APP_PV container 110-2 each generate (calculate) a shared key Kta2ta using ECDHE with mutual authentication. At this time, the APP_PE container 110-1 signs using SKp on behalf of the program author (program providing device 300) and transmits this to the APP_PV container 110-2 together with the hash value H(APP_PE+HybEnc(P,PKp)). The APP_PV container 110-2 then verifies the signature using the public key PKp included in the PKp-list, and verifies the hash value H(APP_PE+HybEnc(P,PKp)) via a third-party verification organization, thereby authenticating the program author (program providing device 300) and the APP_PE container 110-1. Meanwhile, the APP_PV container 110-2 signs using SKd on behalf of the data holder (data holding device 200) and transmits the signature together with the hash value H(APP_PV) to the APP_PE container 110-1. The APP_PE container 110-1 then verifies the signature using the public key PKd included in the PKd-list, and verifies the hash value H(APP_PV) via a third-party verification organization, thereby authenticating the data holder (data holding device 200) and the APP_PV container 110-2.

[0079] In this way, the APP_PE container 110-1 and the APP_PV container 110-2 authenticate each other, and also authenticate each other by proxy as the program author and data holder.

[0080] In S119, the APP_PE container 110-1 generates proof information PROOF(P) from the program P using the proof processing unit 500. That is, the APP_PE container 110-1 inputs the program P to the verification logical formula generation processing unit 510, performs lexical analysis by the lexical analysis unit 511 and syntactic analysis by the syntactic analysis unit 512, and then inputs the program P expressed in the program syntax after this syntactic analysis to the verification logical formula generation unit 513 to generate a verification logical formula. Then, the APP_PE container 110-1 inputs this verification logical formula to the automatic proof processing unit 520, thereby generating and outputting the proof information PROOF(P). Note that the APP_PE container 110-1 may calculate PROOF(P) in advance.

[0081] In S120, the APP_PE container 110-1 transmits PROOF(P) and P to the APP_PV container 110-2.

[0082] In S121, the APP_PV container 110-2 verifies whether PROOF(P) is correct or not based on PROOF(P) and P using the proof verification processing unit 600. That is, the APP_PV container 110-2 inputs PROOF(P) and P to the proof verification processing unit 600, and outputs the PROOF verification result.

[0083] In S122, the APP_PV container 110-2 transmits MAC(PROOF verification result, Kd2d) to the data holding device 200. This allows the data holder (data holding device 200) to know whether the PROOF verification result indicates that PROOF(P) is correct.

[0084] In S123, if the PROOF verification result indicates that PROOF(P) is correct, the APP_PV container 110-2 transmits Enc(D, Kta2ta) to the APP_PE container 110-1.

[0085] In S124, the APP_PE container 110-1 decrypts Enc(D, Kta2ta) using Kta2ta to extract D.

[0086] In S125, the APP_PE container 110-1 calculates P(D). Note that P(D) is calculated by the secure processing unit 112 of the APP_PE container 110-1.

[0087] In S126, the APP_PE container 110-1 transmits Enc(P(D), Kta2ta) to the APP_PV container 110-2.

[0088] In S127, the APP_PV container 110-2 decrypts Enc(P(D), Kta2ta) using Kta2ta to extract P(D), and then transmits Enc(P(D), Kd2d) to the data holding device 200. This enables the data holding device 200 to decrypt Enc(P(D), Kd2d) using Kd2d to extract P(D).

[0089] In S128, the APP_PE container 110-1 deletes D and P(D).

[0090] In S129, the APP_PE container 110-1 notifies the program providing device 300 that D and P(D) have been deleted.

[0091] In S130, the APP_PV container 110-2 deletes P and PROOF(P).

[0092] In S131, the APP_PV container 110-2 notifies the data holding device 200 that P and PROOF(P) have been deleted.

[0093] According to the first embodiment, mainly from the viewpoint of the program author (program providing device 300), while P and D are kept secret from the data processing device 100 and P is kept secret from the data holder (data holding device 200), the execution result of P(D) can be provided to the data holder (data holding device 200) without the program author (program providing device 300) knowing D and P(D). Furthermore, the authenticity of the program P (i.e., that the program P operates correctly and safely) is guaranteed to the data holder (data holding device 200).

[0094] Example 2 A second embodiment will be described below with reference to Fig. 8. The second embodiment differs from the first embodiment in that a PCC certification program is installed in the program providing device 300, and the program providing device 300 has a certification processing unit 500. As a premise of the processing flow in Fig. 8, the data holding device 200 holds APP_PV, D, PKd, and SKd, and the program providing device 300 holds APP_PE, P, PKp, and SKp.

[0095] 4 are executed, in S201, the program providing device 300 generates proof information PROOF(P) from the program P using the proof processing unit 500. That is, the program providing device 300 inputs the program P to the verification logical formula generation processing unit 510, performs lexical analysis using the lexical analysis unit 511 and syntactic analysis using the syntactic analysis unit 512, and then inputs the program P expressed in the program syntax after this syntactic analysis to the verification logical formula generation unit 513 to generate a verification logical formula. The program providing device 300 then inputs this verification logical formula to the automatic proof processing unit 520, thereby generating and outputting the proof information PROOF(P). Note that the program providing device 300 may calculate PROOF(P) in advance.

[0096] In S202, the program providing device 300 transmits PROOF(P) to the APP_PE container 110-1.

[0097] The subsequent steps S203 to S214 are similar to steps S120 to S131 in FIG. 5, respectively, and therefore will not be described again.

[0098] According to the second embodiment, similarly to the first embodiment, mainly from the viewpoint of the program author, while P and D are kept secret from the data processing device 100 and P is kept secret from the data holder, the execution result of P(D) can be provided to the data holder without the program author knowing D and P(D). Furthermore, the authenticity of the program P is guaranteed to the data holder. In addition, proof information for proving the authenticity of the program P can be calculated by the program providing device 300.

[0099] Example 3 In the first and second embodiments, under the security requirement that "unencrypted information is not output outside the program P," we considered whether the variable in which the confidential information (data D) is stored is encrypted or not, but there are cases where we want to verify not just whether it is encrypted or not, but whether it is encrypted with a specific key or not. This is because if we can verify that it is encrypted with a specific key, we can guarantee that, for example, only a specific user or a specific user group can decrypt it.

[0100] Therefore, in the third embodiment, it is assumed that a key annotation is attached to a variable in the source code of a program P that stores confidential information (data D), and a mechanism is introduced that makes it possible to verify that "confidential information is encrypted with a specific key inside the program P." Here, the key annotation is information that indicates the key ID that encrypts the value of the variable to which it is attached. Note that the key ID is assumed to be the key ID of a private key, but is not limited to this and may be a public key corresponding to the private key.

[0101] Here, the APP_PE container 110-1 has a secret information data flow proof processing unit 700 that is realized by a secret information data flow proof program. An example configuration of the secret information data flow proof processing unit 700 is shown in Fig. 9. As shown in Fig. 9, the secret information data flow proof processing unit 700 receives a program P and a key ID as input, and outputs a secret information data flow proof (P) that represents proof information that secret information (data D) has been encrypted with the key ID within the program P. By verifying this secret information data flow proof (P), the data holder can verify that the secret information (data D) is protected with the key ID within the program P.

[0102] To achieve this, for example, n key IDs can be named "key k1", "key k2", ..., "key k n ", the encryption variable defined in Example 1 can be expressed as "t::=Pl|key k1|key k2|···|key k n ", and then the secret information data flow proof processing unit 700 generates and outputs the secret information data flow proof (P) using the PCC algorithm extended accordingly.

[0103] The processing flow of the third embodiment will be described below with reference to Fig. 10. As a premise of the processing flow of Fig. 10, the data holding device 200 holds APP_PV, D, PKd, and SKd, and the program providing device 300 holds APP_PE, P, PKp, and SKp.

[0104] After S101 to S118 in Fig. 4 are executed, S301 to S304 are executed. S301 to S304 are similar to S119 to S122 in Fig. 5, respectively, and therefore a description thereof will be omitted.

[0105] In S305, if the PROOF verification result indicates that PROOF(P) is correct, the APP_PV container 110-2 transmits Enc(D, Kta2ta) and the key ID to the APP_PE container 110-1.

[0106] In S306, the APP_PE container 110-1 generates (calculates) the secret information data flow proof (P) from the program P and the key ID using the secret information data flow proof processing unit 700.

[0107] In S307, the APP_PE container 110-1 decrypts Enc(D, Kta2ta) using Kta2ta to extract D.

[0108] In S308, the APP_PE container 110-1 calculates P(D). Note that P(D) is calculated by the secure processing unit 112 of the APP_PE container 110-1.

[0109] In S309, the APP_PE container 110-1 transmits Enc(P(D)+private information data flow proof (P), Kta2ta) to the APP_PV container 110-2.

[0110] In S310, the APP_PV container 110-2 decrypts Enc(P(D)+secret information data flow proof (P), Kta2ta) using Kta2ta to extract P(D) and the secret information data flow proof (P), and then transmits Enc(P(D)+secret information data flow proof (P), Kd2d) to the data storage device 200. As a result, the data storage device 200 can decrypt Enc(P(D)+secret information data flow proof (P), Kd2d) using Kd2d to extract P(D) and the secret information data flow proof (P). Therefore, the data holder can verify this secret information data flow proof (P) and confirm that the secret information (data D) has been encrypted with a specific key within the program P. Note that the secret information data flow proof (P) can be verified using a method similar to that for verifying the proof information of a PCC. For example, in S305, only the key ID may be sent first, and after receiving and verifying the confidential information data flow proof (P) from the APP_PE container 110-1, Enc(D, Kta2ta) may be sent to the APP_PE container 110-1.

[0111] The subsequent steps S311 to S314 are similar to steps S128 to S131 in FIG. 5, respectively, and therefore will not be described again.

[0112] According to the third embodiment, in addition to the first embodiment, it is guaranteed to the data holder that the confidential information (data D) inside the program P is encrypted with a specific key.

[0113] (Modification of Example 3) In the third embodiment, it is assumed that a key annotation is added to a certain variable in the source code of a program P, and it is possible to verify that the secret information inside the program P is encrypted with a specific key. However, for example, it is also possible to verify that "the secret information inside the program P satisfies k-anonymity" or "the secret information inside the program P satisfies (ε, δ)-differential privacy." may be verifiable.

[0114] To achieve this, in the third embodiment, for example, if satisfying k-anonymization is defined as "k-Anonymized" and satisfying (ε,δ)-differential privacy is defined as "(ε,δ)-Anonymized", the encrypted variable defined in the first embodiment is extended to "t::=Pl|k-Anonymized|(ε,δ)-Anonymized", and then the secret information data flow proof processing unit 700 generates and outputs the secret information data flow proof (P) using the corresponding extended PCC algorithm.

[0115] (Example of hardware configuration) The data processing device 100, the data storage device 200, and the program providing device 300 can all be realized, for example, by causing a computer to execute a program. This computer may be a physical computer or a virtual machine on the cloud. The data processing device 100, the data storage device 200, and the program providing device 300 are collectively referred to as "devices."

[0116] That is, the device can be realized by executing a program corresponding to the processing performed by the device using hardware resources such as a CPU and memory built into a computer. The program can be recorded on a computer-readable recording medium (such as a portable memory) and stored or distributed. The program can also be provided via a network such as the Internet or email.

[0117] Fig. 11 is a diagram showing an example of the hardware configuration of the computer. The computer in Fig. 11 has a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, and the like, all of which are interconnected via a bus B. Note that some of these devices may not be included. For example, if no display is required, the display device 1006 may not be included.

[0118] The program for realizing processing on the computer is provided by a recording medium 1001 such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

[0119] The memory device 1003 reads and stores a program from the auxiliary storage device 1002 when an instruction to start the program is received. The CPU 1004 realizes the functions of the device in accordance with the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network, and functions as a transmitter and receiver. The display device 1006 displays a GUI (Graphical User Interface) or the like according to a program. The input device 1007 is composed of a keyboard, mouse, buttons, a touch panel, or the like, and is used to input various operation instructions. The output device 1008 outputs the results of calculations.

[0120] (Effects of the embodiment) As explained above, according to the technology of this embodiment, when a data processing device equipped with a secure computation mechanism on a VM or container basis processes data of a data holder using a program provided by a program provider, the data and program are not leaked to the data processing device, the data is not leaked to the program provider, and the program is not leaked to the data holder, and in addition, a technology is provided that can guarantee the authenticity of the program to the data holder.

[0121] Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and changes are possible within the scope of the gist of the present invention described in the claims.

[0122] [References] Reference 1: NeculaG. C. "Proof-Carrying Code", 1997. Reference 2: George C. Necula and Peter Lee. "Safe, Untrusted Agents using Proof-Carrying Code", 1998. Reference 3: Yasuaki Tsukada. "Proof Secrecy in Interactive Proven Program Distribution and Its Applications," 2005. [Explanation of symbols]

[0123] 100 Data processing device 200 Data retention device 300 Program providing device 400 Secure Channel 110 Secure Area 111 Secure Data Storage 112 Secure Processing Unit 120 Communications Department 130 Data storage unit 140 Data Processing Unit 500 Certification Processing Unit 510 Verification logical formula generation processing unit 511 Lexical analysis section 512 Parser 513 Verification formula generation unit 520 Automatic Certification Processing Unit 600 Proof Verification Processing Unit 700 Confidential information data flow proof processing unit 1000 Drive Device 1001 Recording media 1002 Auxiliary storage device 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input Device 1008 Output Device B Bus

Claims

1. A program execution system including a data holding device that holds data D, a program providing device that provides a program P, and a data processing device that generates a secure area realized by a secret computing mechanism, a proof processing unit configured to generate, in a first secure area generated by the data processing device in response to a request from the program providing device, or in the program providing device, proof information PROOF(P) indicating that the program P satisfies security, which is one of the requirements included in the authenticity of the program P; a proof verification processing unit configured to verify whether the proof information PROOF(P) is correct in a second secure area generated by the data processing device in response to a request from the data holding device; a calculation unit configured to calculate a result P(D) of executing the program P on the data D in the first secure area when the proof information PROOF(P) is verified to be correct; and The security means that "unencrypted information is not output outside the program P." This is a program execution system.

2. The certification processing unit:

2. The program execution system according to claim 1, further configured to generate a first verification logical formula for verifying the security using an encryption variable type that indicates whether data is encrypted, and to generate a proof for the first verification logical formula as the proof information PROOF(P).

3. 3. The program execution system according to claim 1, further comprising a secret information data flow processing unit configured to generate a second verification logical formula for verifying the requirement that "data D is encrypted with a specific key within program P" using a type that indicates whether data is encrypted with a specific key, and to generate a proof for the second verification logical formula.

4. 3. The program execution system according to claim 1, further comprising a confidential information data flow processing unit configured to generate a third verification logical formula for verifying that "data D satisfies k-anonymization or (ε, δ)-differential privacy within program P" using a type that indicates whether the data satisfies k-anonymization or (ε, δ)-differential privacy, and to generate a proof for the third verification logical formula.

5. The program execution system according to claim 1 , wherein the secure area is a virtual machine or a container generated by the secure computing mechanism including a TEE.

6. A program execution system including a data holding device that holds data D, a program providing device that provides a program P, and a data processing device that generates a secure area realized by a secure computing mechanism, a certification processing procedure for generating, in a first secure area generated by the data processing device in response to a request from the program providing device, certification information PROOF(P) indicating that the program P satisfies security, which is one of the requirements for authenticity of the program P, on the program providing device or on the first secure area generated by the data processing device in response to a request from the program providing device; a proof verification process step of verifying whether the proof information PROOF(P) is correct in a second secure area generated by the data processing device in response to a request from the data holding device; a calculation unit step of calculating a result P(D) of executing the program P on the data D in the first secure area when the proof information PROOF(P) is verified to be correct; Run The security means that "unencrypted information is not output outside the program P." This is a program execution method.

7. A program execution system including a data holding device that holds data D, a program providing device that provides a program P, and a data processing device that generates a secure area realized by a secure computing mechanism, a certification processing procedure for generating, in a first secure area generated by the data processing device in response to a request from the program providing device, certification information PROOF(P) indicating that the program P satisfies security, which is one of the requirements for authenticity of the program P, on the program providing device or on the first secure area generated by the data processing device in response to a request from the program providing device; a proof verification process step of verifying whether the proof information PROOF(P) is correct in a second secure area generated by the data processing device in response to a request from the data holding device; a calculation unit step of calculating a result P(D) of executing the program P on the data D in the first secure area when the proof information PROOF(P) is verified to be correct; Execute The security of the program indicates that "unencrypted information is not output outside the program P."

Images