Calculation result protection system and calculation result distribution method

Abstract

A management server (100) includes: a shared key distribution unit (113) that generates a shared key to be shared among a plurality of output destination servers (201), generates, for each output destination server (201), first encrypted data in which the shared key is encrypted using a public key that is paired with a private key held individually by each output destination server (201), and distributes the generated first encryption data to each output destination server (201), thereby allowing each output destination server (201) to decrypt the shared key; and a data output unit (114) that distributes, to each output destination server (201), second encrypted data in which an output value is encrypted using the shared key, thereby allowing each output destination server (201) to decrypt the output value.

Description

[Technical Field]

[0001] The present invention , total The present invention relates to a calculation result protection system and a calculation result distribution method. [Background technology]

[0002] FPGAs (field-programmable gate arrays) are devices that combine the high speed of integrated circuits with the flexibility to rewrite processing content and are used for specific processing. Services that allow FPGAs to be used via the cloud are known as FaaS (FPGA as a Service). In FaaS, for example, the process of calculating output values ​​for input values ​​from an input device is offloaded from a management server such as a cloud server to an FPGA on the cloud. The FPGA calculates the output value for the input value and sends the calculated output value to the management server.

[0003] Since the output values ​​are transmitted over the cloud network, there are security risks such as tampering, and the information content must be protected. Therefore, Non-Patent Document 1 describes an architecture for enhancing security in a FaaS environment, in which the generation of a symmetric key and the verification of a signature are performed by an FPGA.

[0004] FIG. 17 is an explanatory diagram showing the distribution process of the output value D2. First, a third-party CA (Certificate Authority) issues a certificate to both the input device 10z used by the service user and the FPGA 300z used by the service provider, containing the public key of the public key-private key pair generated by them. After receiving the certificate, both parties use their respective certificates and private keys to generate a common key CK to be shared by both parties in advance. Next, the FPGA 300z encrypts the calculated output value D2 using the common key CK, and transmits the encrypted data CK(D2) to the input device 10z via the management server 100z. The input device 10z decrypts the received encrypted data CK(D2) using the common key CK, thereby securely obtaining the output value D2. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] Kim, Han-Yee et al. “SafeDB: Spark Acceleration on FPGA Clouds with Enclaved Data Processing and Bitstream Protection.” 2019 IEEE 12th International Conference on Cloud Computing (CLOUD) (2019): 107-114. Summary of the Invention [Problem to be solved by the invention]

[0006] FIG. 18 is an explanatory diagram when there are multiple destination devices for the output value D2. 18, there are a total of three destination devices for the output value D2: the input device 10z in FIG. 17 and the newly added destination servers 201z and 202z. Therefore, in addition to the common key CK1 shared with the input device 10z, the FPGA 300z needs to individually prepare a common key CK2 shared with the destination server 201z and a common key CK3 shared with the destination server 202z, and verify their signatures.

[0007] The FPGA300z encrypts the calculated output value D2 using the common key CK1, and transmits the encrypted data CK1(D2) to the input device 10z via the management server 100z. Hereinafter, in this specification, the result of encrypting data A to be encrypted with key B used for encrypting that data A will be expressed in parentheses, such as B(A). Similarly, FPGA 300z transmits encrypted data CK2(D2) obtained by encrypting output value D2 with common key CK2 to destination server 201z, and transmits encrypted data CK3(D2) obtained by encrypting output value D2 with common key CK3 to destination server 202z. In this way, the FPGA 300z needs to individually perform processes such as generating the common keys CK1 to CK3, verifying the signatures of the common keys CK1 to CK3, and encrypting with the common keys CK1 to CK3 for each destination device. Because the processing burden falls on the FPGA 300z, even when the calculation process of the output value D2 is offloaded to the FPGA 300z, processing efficiency is reduced.

[0008] Therefore, a main object of the present invention is to reduce the burden when transmitting the same calculation result to multiple destinations in a reliable manner. [Means for solving the problem]

[0009] In order to solve the above problem, the calculation results of the present invention Protection System has the following characteristics: The present invention provides A computation result protection system having a computation result distribution device and a distribution destination device, The calculation result distribution device Multiple The aforementioned generating a common key to be shared among the destination devices; a common key distribution unit that generates, for each of the destination devices, first encrypted data obtained by encrypting the common key using a public key that is paired with a private key that each of the destination devices has individually, and distributes the generated first encrypted data to each of the destination devices, thereby allowing each of the destination devices to decrypt the common key; a data output unit that distributes second encrypted data, in which the calculation result is encrypted using the common key, to each of the distribution destination devices, thereby causing each of the distribution destination devices to decrypt the calculation result; 、 a first protection area that protects stored data from unauthorized data access; a verification unit that verifies each of the destination devices within the first protection domain, data used in the processing of the common key distribution unit and data used in the processing of the data output unit are stored in the first protection area, At least some of the destination devices have a second protection area that protects stored data from unauthorized data access; The verification unit verifies whether the distribution destination device has the second protected area by referring to device information of the distribution destination device, determines that the distribution destination device having the second protected area has passed verification, and distributes the generated first encrypted data to the distribution destination device that has passed verification. It is characterized by: [Effects of the Invention]

[0010] According to the present invention, it is possible to reduce the burden when transmitting the same calculation result to multiple destinations in a reliable manner. [Brief explanation of the drawings]

[0011] [Figure 1] 1 is a configuration diagram of a calculation result protection system according to an embodiment of the present invention. [Figure 2] FIG. 2 is an explanatory diagram showing the processing of input and output values ​​according to the present embodiment. [Figure 3] FIG. 10 is an explanatory diagram showing a common key distribution process performed by a common key distribution unit according to the present embodiment. [Figure 4] 10 is an explanatory diagram showing a distribution process of an output value by a data output unit according to the embodiment. FIG. [Figure 5] FIG. 10 is a configuration diagram showing a modification of the calculation result protection system according to the present embodiment, in which a protection area is provided in a distribution destination device of the output value. [Figure 6] FIG. 6 is an explanatory diagram showing a common key distribution process in the case of FIG. 5 according to the present embodiment. [Figure 7] FIG. 6 is an explanatory diagram showing the distribution process of the output value in the case of FIG. 5 according to the present embodiment. [Figure 8] FIG. 10 is a sequence diagram showing a process of confirming in advance that a distribution destination device of an output value is a trustworthy party according to the present embodiment. [Figure 9] FIG. 10 is a sequence diagram showing a common key distribution process according to the present embodiment. [Figure 10] FIG. 10 is a sequence diagram showing a distribution process of an output value according to the present embodiment. [Figure 11] 10 is a table showing a list of certificates issued by a CA serving as a third-party organization according to this embodiment. [Figure 12] 10 is a table showing a list of reliable communication partners held by a management server according to this embodiment. [Figure 13] 10 is a table showing a list of communication partners of each device other than the management server, such as an input device, according to this embodiment. [Figure 14] 10 is a table showing a list of distribution destination devices of output values ​​held by a management server according to this embodiment. [Figure 15] 10 is a table showing a list of common keys held by a management server according to the present embodiment. [Figure 16] FIG. 2 is a hardware configuration diagram of each device in the calculation result protection system according to the present embodiment. [Figure 17] FIG. 10 is an explanatory diagram illustrating a distribution process of an output value. [Figure 18] FIG. 10 is an explanatory diagram when there are a plurality of destination devices for the output value. [Figure 19] FIG. 5 is an explanatory diagram showing a modification of FIG. 4 according to the present embodiment, in which an FPGA executes encryption processing instead of a management server. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0013] FIG. 1 is a configuration diagram of a calculation result protection system 1. As shown in FIG. The computation result protection system 1 is configured by connecting an input device 10, a management server (computation result distribution device) 100, an FPGA (offload destination device) 300, an output destination server 201, and an output destination server 202 via a network. The input device 10 requests the management server 100 to perform a process (hereinafter referred to as an offload process) of calculating an output value D2 (calculation result) from an input value D1 as a process to be offloaded to the FPGA 300. That is, the input device 10 transmits the input value D1 to the management server 100.

[0014] The offload destination device is not limited to the FPGA 300, and any device such as those exemplified below may be used. ·GPU(Graphics Processing Unit) FPU (Floating Point Unit) ·DSP(Digital Signal Processor)

[0015] The management server 100 offloads the offload processing received from the input device 10 to the FPGA 300. The FPGA 300 returns the output value D2 obtained by executing the received offload processing to the management server 100. The management server 100 distributes the output value D2 obtained from the FPGA 300 to the distribution destination devices. In FIG. 1, the distribution destination devices are a total of three devices: the input device 10, the output destination server 201, and the output destination server 202. The management server 100 also checks the detailed status of the distribution destination devices.

[0016] The offload process is, for example, a process in which information about a device for verifying security is used as an input value D1, and an output value D2 such as a security reliability score is calculated from the input value D1. In other words, since both the input value D1 and the output value D2 are important information that requires reliability, such as that the data content has not been tampered with, it is also necessary to prepare a signature that indicates who performed the calculation. For this reason, a protected area (first protected area) 110 is prepared in the memory within the management server 100.

[0017] The protected area 110 protects stored data from unauthorized data access. In other words, the protected area 110 is an area (enclave) prepared in the memory of the management server 100 where data access authority is protected, and data can be protected by limiting access authority to certain applications. The protected area 110 is provided for the purpose of preventing software with weaker privileges from being infringed when software with stronger privileges is attacked. Software with stronger privileges includes, for example, an operating system (OS), a driver, a basic input / output system (BIOS), and a virtual machine manager (VMM).

[0018] The management server 100 configures a protected area 110 where programs such as signing and encryption can be executed while protecting information. The protected area 110 is a place where integrity can be ensured by adding, for example, programs for signing and signature verification. Furthermore, the protected area 110 is an isolated place with limited access rights, and confidentiality can also be ensured by adding an encryption program. It is desirable that all data inside the protected area 110 is securely protected, but even if it is not completely protected, it can be used if secret information among the data inside (such as a private key in public key cryptography) is securely protected.

[0019] Specifically, the protected area 110 of the management server 100 is configured with a signature verification unit 111, a signature assignment unit 112, a common key distribution unit 113, and a data output unit 114, and the data used for processing by each of these processing units is stored in the protected area 110. The signature verification unit 111, for example, refers to the device information of the other device sent from the other device, and determines that the other device has passed verification if the other device has a protected area (ability to protect data). A distribution destination device that has passed verification becomes a distribution target of the output value D2. This ensures that the information sent from the management server 100 to the other device is stored in a protected area in the other device, making it possible to prevent information leakage from the other device to the distribution destination device before distribution. The device information of other devices is information used for attestation, which is a technology for confirming the capabilities of a protected area, such as address information of the protected area of ​​the other device and information about applications in the protected area.

[0020] The signature verification unit 111 may confirm the reliability of other devices (such as the input device 10) by verifying the signature of the other device that is a communication partner for the management server 100. For this purpose, the signature verification unit 111 verifies the signature attached to at least one of the following pieces of information: A certificate issued by a third-party authority (CA), or the public key of another device included in that certificate. Random number information issued by other devices. Address information of other devices (such as IP addresses). -Device information of other devices linked to the public keys of other devices.

[0021] The signature assigning unit 112 assigns a signature to allow other devices to confirm the reliability of the management server 100 itself. Note that the information to be signed can be determined by replacing each piece of information of other devices verified by the signature verifying unit 111 with each piece of information of the management server 100. The common key distribution unit 113 generates a common key that is used to encrypt the output value (calculation result) of the FPGA 300 and is shared by a plurality of communication partners, and distributes the common key to other devices.

[0022] That is, the common key distribution unit 113 generates a common key CK shared by a plurality of distribution destination devices (such as the input device 10). Then, the common key distribution unit 113 generates first encrypted data for each distribution destination device by encrypting the common key CK using a public key PK that pairs with a private key SK that each distribution destination device has individually. Furthermore, the common key distribution unit 113 distributes the generated first encrypted data to each distribution destination device, thereby allowing each distribution destination device to decrypt the common key CK.

[0023] The data output unit 114 generates second encrypted data by encrypting the output value D2 (calculation result) of the FPGA 300 using the common key CK generated by the common key distribution unit 113 (see FIG. 4 for details).The data output unit 114 then distributes the generated second encrypted data to each distribution destination device, thereby allowing each distribution destination device to decrypt the output value D2. Alternatively, the common key CK generated by the common key distributor 113 may be sent to the FPGA 300, and the second encrypted data may be generated by encrypting the output value D2 on the FPGA 300 (see FIG. 19 for details).

[0024] The FPGA 300 includes a signature verification unit 301 and a signature assignment unit 302 . The signature verification unit 301 verifies the management server 100, which is the offload source, by verifying the signature added by the signature addition unit 112 of the management server 100. The signature adding unit 302 adds a signature to the output value of the FPGA 300 so that other devices can confirm the reliability of the FPGA 300 itself.

[0025] FIG. 2 is an explanatory diagram showing the processing of the input value D1 and the output value D2. The input device 10 generates a signature s10(D1) for the prepared input value D1 using its own key s10. The input device 10 sends the input value D1 and the signature s10(D1) to the protection area 110 of the management server 100. The signature verification unit 111 in the protected area 110 verifies the signature s10(D1). The signature assignment unit 112 replaces the signature s10(D1) that has passed the verification by the signature verification unit 111 with a signature s100(D1) that uses its own key s100. The signature assignment unit 112 requests the FPGA 300 to offload the input value D1 together with the signature s100(D1).

[0026] The signature verification unit 301 of the FPGA 300 verifies the signature s100 (D1) of the requested offload processing. The FPGA 300 calculates the offload processing based on the input value D1 of the signature s100 (D1) that has passed the verification by the signature verification unit 301, and obtains an output value D2. The signature assigner 302 creates a signature s300(D2) for the calculated output value D2 using its own key s300. The FPGA 300 sends the output value D2 and its signature s300(D2) to the protected area 110 of the management server 100. The signature verification unit 111 verifies the received output value D2 and the signature s300(D2). The signature assignment unit 112 replaces the signature s300(D2) that passes verification with a signature SK100(D2). The data output unit 114 distributes the output value D2 and the signature SK100(D2) to the input device 10, the output destination server 201, and the output destination server 202, which are the distribution destination devices.

[0027] FIG. 3 is an explanatory diagram showing the process of distributing the common key CK by the common key distributor 113. As shown in FIG. The common key distributor 113 distributes a common key CK shared by a plurality of distribution destination devices in the following manner in order to perform encryption associated with the distribution process of the output value D2 shown in FIG. (Step 1) The common key distribution unit 113 obtains in advance from the CA, the distribution destination device, etc., the public key PK10 of the input device 10, the public key PK201 of the output destination server 201, and the public key PK202 of the output destination server 202 as verified public keys PK for each distribution destination device. (Step 2) The common key distributor 113 generates one common key CK to be shared by a plurality of destination devices. (Step 3) The common key distributor 113 generates multiple encrypted data by encrypting the common key CK with the public key PK for each destination device. For example, encrypted data PK10(CK) for the input device 10 is generated by encrypting the common key CK with the public key PK10 of the input device 10.

[0028] (Step 4) The common key distributor 113 distributes the generated encrypted data to each of the destination devices. For example, encrypted data PK10(CK) is distributed to the input device 10, encrypted data PK201(CK) is distributed to the destination server 201, and encrypted data PK202(CK) is distributed to the destination server 202. (Step 5) Each destination device obtains the common key CK of step 2 by decrypting the distributed encrypted data using its own private key SK, which is paired with the public key PK of step 1. For example, the input device 10 obtains the common key CK of step 2 by decrypting the distributed encrypted data PK10(CK) using its own private key SK10. Through the above procedure, one common key CK generated by the management server 100 is securely distributed to each distribution destination device from the protected area 110. The management server 100 only needs to generate one common key CK regardless of the number of distribution destination devices, thereby reducing the load on the management server 100.

[0029] FIG. 4 is an explanatory diagram showing the distribution process of the output value D2 by the data output unit 114. The data output unit 114 can ensure the security of the output value D2 by encrypting the output value D2 using the common key CK shown in FIG. 3 according to the following procedure before distributing it. (Step 1) The data output unit 114 receives the output value D2 and its signature s300(D2) from the offload destination FPGA 300. Hereinafter, the entire data combining the received output value D2 and its signature s300(D2) will be indicated by the symbol "||", such as "D2||s300(D2)". (Step 2) The data output unit 114 encrypts the data D2∥s300(D2) using the common key CK to obtain encrypted data CK(D2∥s300(D2)). (Step 3) The data output unit 114 distributes the encrypted data CK(D2∥s300(D2)) to each distribution destination device. (Step 4) Each destination device, such as the input device 10, decrypts the encrypted data CK(D2∥s300(D2)) to obtain the data D2∥s300(D2) using the common key CK. Each destination device also verifies the output value D2 and its signature s300(D2). In this way, even if there are multiple destination devices, the data output unit 114 only needs to perform encryption once using the distributed common key CK. Therefore, even if the number of destination devices increases, the amount of work required for encryption does not increase.

[0030] Fig. 19 is an explanatory diagram of a modification of Fig. 4, in which the FPGA 300 performs encryption instead of the management server 100. (Step 1) and (Step 2) in Fig. 4 are replaced with the following (Step 1B) and (Step 2B). After (Step 2B), (Step 3) and (Step 4) are executed, similar to Fig. 4. (Step 1B) The FPGA 300 encrypts the data D2∥s300(D2) using the common key CK received from the management server 100, thereby obtaining encrypted data CK(D2∥s300(D2)). (Step 2B) The data output unit 114 receives the encrypted data CK(D2∥s300(D2)) from the FPGA 300 that is the offload destination.

[0031] FIG. 5 is a configuration diagram of a modified example of the calculation result protection system 1, in which a protection area (second protection area) is provided in the distribution destination device of the output value D2. Compared with the calculation result protection system 1 of FIG. 1, each device (input device 10, output destination server 201, and output destination server 202) that is the distribution destination device of output value D2 has its own protection area 10p, 201p, and 202p, respectively. Fig. 6 is an explanatory diagram showing the distribution process of the common key CK in the case of Fig. 5. In Fig. 5, the process of decrypting the common key CK in (step 5) of Fig. 3 is changed so that it is performed within the protected area of ​​each device. Fig. 7 is an explanatory diagram showing the distribution process of the output value D2 in the case of Fig. 5. In Fig. 5, the process of decrypting the encrypted data CK(D2||s300(D2)) in (step 4) of Fig. 4 is changed so that it is performed within the protected area of ​​each device. As described above, the configurations of Figures 5 to 7 prevent unauthorized access to the output value D2 from outside, improving security strength. Details of the processing of Figures 2 to 4 will be described below with reference to Figures 8 to 16.

[0032] FIG. 8 is a sequence diagram showing a process for confirming in advance that the distribution destination device of the output value D2 is a trustworthy party. In this sequence diagram, each device in the computation result protection system 1 verifies other devices by challenge and response authentication without directly exchanging secret information such as passwords.

[0033] First, the management server 100 confirms the public key PK10 of the input device 10 in steps S101 to S104. Specifically, the management server 100 sends a random number R1 to the input device 10 (S101). The input device 10 uses its own private key SK10 on the random number R1 to generate a signature SK10(R1) (S102). The input device 10 sends its own public key PK10 and signature SK10(R1) to the management server 100 (S103). The signature verification unit 111 of the management server 100 verifies the sent public key PK10 with the signature SK10(R1) (S104). If the verification in S104 is successful, the process proceeds to the next step S111. On the other hand, if the verification in S104 fails, an error message is returned to the communication partner's input device 10. In each of the subsequent processes, if the signature verification fails, an error message is returned to the communication partner.

[0034] FIG. 11 is a table showing a list of certificates issued by a CA acting as a third-party organization. This table associates a certificate ID, a public key included in the certificate, a private key paired with the public key, a subject managing the private key, an issuer that is a CA that issues the certificate, and an expiration date of the certificate. Each device (e.g., management server 100) in the computation result protection system 1 can obtain from the CA a public key (e.g., public key PK10 of the input device 10) whose reliability is guaranteed within the expiration date by the certificate. Certificates are used in an environment known as a Public Key Infrastructure (PKI), which uses various encryption technologies such as RSA encryption and elliptic curve cryptography to authenticate and attest communication partners based on the assurance of the certificate issuer by a third-party authority (CA). Each device obtains its own certificate and the private key / public key pair that accompanies the certificate from the CA in advance. Alternatively, each device can create a public key / private key pair and obtain a certificate using that public key from the CA in advance. On the other hand, the public keys of other devices are not obtained from the CA, but are sent by the other devices.

[0035] FIG. 12 is a table showing a list of reliable communication partners that the management server 100 has. 11 (certificate ID, public key, subject, issuer, and expiration date), this table associates the IP address of the subject's device as device information linked to the public key. In other words, by using the subject column of other devices as a search key, device information of other devices, addresses of protected areas of other devices (not shown), information on applications in the protected areas (not shown), and the like can be confirmed in the process of S114 or the process of S134 described below. This table also includes entries for the output destination servers 201 and 202 notified in S120 (described later) in addition to entries for the input device 10 confirmed in S101-S104. The state of the table in Fig. 12 is the state after the output destination servers 201 and 202 have been confirmed in S131-S134 (described below).

[0036] Returning to FIG. 8, the input device 10 confirms the public key PK100 of the management server 100 in steps S111 to S114. Specifically, the input device 10 sends the random number R2 to the management server 100 (S111). The signature assigning unit 112 of the management server 100 generates a signature SK100(R2) by using its own private key SK100 on the random number R2 (S112). The management server 100 sends its own public key PK100 and signature SK100(R2) to the input device 10 (S113). The input device 10 verifies the sent public key PK100 with the signature SK100(R2) (S114). The input device 10 sends information about the destination servers 201 and 202 that need to be checked to the management server 100 (S120).

[0037] Fig. 13 is a table showing a list of communication partners of each device other than the management server 100, such as the input device 10. This table has the same data format as Fig. 12. As in Fig. 12, an entry for the management server 100, which is a reliable partner for the input device 10, is registered in the table of Fig. 13 as a result of S111-S114.

[0038] 8, in steps S131-S134, the management server 100 confirms the public key PK201 of the destination server 201. Although not shown, the management server 100 also confirms the public key PK202 of the destination server 202 in the same manner. The management server 100 sends the random number R3 to the destination server 201 (S131). The destination server 201 uses its own private key SK201 on the random number R3 to generate a signature SK201(R3) (S132). The destination server 201 sends its own public key PK201 and signature SK201(R3) to the management server 100 (S133). The signature verification unit 111 of the management server 100 verifies the sent public key PK201 with the signature SK201(R3) (S134).

[0039] Fig. 14 is a table showing a list of destination devices of output value D2 stored in the management server 100. This table associates a request ID issued for each destination device of the same output value D2, a destination indicating the destination device of the same output value D2, the information in Fig. 11 issued to the destination (certificate ID and the destination's public key), and the IP address in Fig. 12. For example, three devices (input device 10, output destination server 201, output destination server 202) with the same request ID "R01" are a set of destination devices for the same output value D2. The management server 100 sequentially adds the devices confirmed in the process of FIG. 8 to the table of FIG. 14.

[0040] 15 is a table showing a list of common keys CK held by the management server 100. In this table, common keys CK issued for each request ID in FIG. If it is desired to distribute the output value D3 to two devices (the input device 10 and the output destination server 201) in addition to the distribution destination device of the output value D2, the management server 100 can add a combination of a new request ID "R02", the distribution destination device, and the new common key CK2 issued for R02 to the table of Figure 14 and the table of Figure 15.

[0041] FIG. 9 is a sequence diagram showing the distribution process of the common key CK. The management server 100 creates a common key CK to be shared by multiple distribution destination devices (S201). The management server 100 encrypts the common key CK using the public key PK10 of the input device 10 confirmed in Fig. 8 to create encrypted data PK10(CK) (S202). The management server 100 sends the encrypted data PK10(CK) to the input device 10 (S203). The input device 10 decrypts the encrypted data PK10(CK) with its own private key SK10 to obtain the common key CK (S204).

[0042] The above is the process when the input device 10 is the destination device, but S202-S204 are executed for each destination device of the output value D2. As will be described below, the other destination devices also execute the process of FIG. [When the destination device in S203 is the destination server 201] The public key PK10 used to create the encrypted data in S202 is replaced with the public key PK201 of the destination server 201 confirmed in Fig. 8. The private key SK10 used to decrypt the encrypted data in S204 is replaced with the private key SK201 of the destination server 201. [When the destination device in S203 is the destination server 202] The public key PK10 used to create the encrypted data in S202 is replaced with the public key PK202 of the destination server 202 confirmed in Fig. 8. The private key SK10 used to decrypt the encrypted data in S204 is replaced with the private key SK202 of the destination server 202.

[0043] FIG. 10 is a sequence diagram showing the distribution process of the output value D2. The management server 100 acquires the output value D2, its signature s300(D2), and its verification public key PKs from the offload destination FPGA 300 (S301). Therefore, the FPGA 300 is provided in advance with a private key SKs for generating the signature s300(D2) and a public key PKs for verifying it. The management server 100 encrypts the data D2∥s300(D2) using the common key CK to generate encrypted data CK(D2∥s300(D2)) (S302). The management server 100 sends the encrypted data CK(D2∥s300(D2)) and the public key PKs to the input device 10 (S303).

[0044] The input device 10 decrypts and obtains data D2∥s300(D2) from the encrypted data CK(D2∥s300(D2)) using the common key CK (S304). The input device 10 decrypts the signature s300(D2) using the public key PKs and verifies whether the signature for the output value D2 is valid (S305). If the signature verification in S305 is successful, it can be confirmed that the data has not been tampered with. The above is the process when the input device 10 is the distribution destination device, but S303 and S304 are executed for each distribution destination device of the output value D2 (output destination server 201, output destination server 202).

[0045] FIG. 16 is a hardware configuration diagram of each device in the calculation result protection system 1. Each device of the calculation result protection system 1 is configured as a computer 900 having a CPU 901, a RAM 902, a ROM 903, a HDD 904, a communication I / F 905, an input / output I / F 906, a media I / F 907, and a TPM (Trusted Platform Module) 908. The communication I / F 905 is connected to an external communication device 915. The input / output I / F 906 is connected to an input / output device 916. The media I / F 907 reads and writes data from a recording medium 917. Furthermore, the CPU 901 controls each unit by executing a program (also called an application or an app for short) loaded into the RAM 902. This program can also be distributed via a communication line or recorded on a recording medium 917 such as a CD-ROM and distributed. Additionally, the TPM 908 is used to create a protected area within the RAM 902, etc.

[0046] [effect] The management server 100 of the present invention generates a common key CK shared by a plurality of distribution destination devices (such as the input device 10), a common key distribution unit 113 that generates encrypted data PK10(CK) for each distribution destination device by encrypting a common key CK using a public key PK that pairs with a private key SK that each distribution destination device has individually, and distributes the generated encrypted data PK10(CK) to each distribution destination device, thereby allowing each distribution destination device to decrypt the common key CK; The encryption device is characterized by having a data output unit 114 that distributes encrypted data CK(D2), in which the output value D2 is encrypted using a common key CK, to each destination device, thereby allowing each destination device to decrypt the output value D2.

[0047] As a result, the same common key CK is used when sending data to multiple distribution destination devices, so the management server 100 does not need to generate and store multiple common keys CK. Therefore, the integrated management of the common key CK can reduce the management costs of security resources. In addition, the processing load on the FPGA 300 that calculates the output value D2 can be reduced. Furthermore, encryption and decryption processes using the common key CK are less burdensome than those using the private key SK and public key PK, so encryption and decryption processes for the frequently used output value D2 can be performed with low load. This reduces the burden when sending the same calculation result to multiple destinations using a reliable method.

[0048] In the present invention, the management server 100 has a protection area 110 that protects stored data from unauthorized data access, The data used in the processing of the common key distribution unit 113 and the data used in the processing of the data output unit 114 are stored in the protected area 110.

[0049] This allows encryption keys such as the common key CK to be safely stored in the protected area 110 within the management server 100.

[0050] The present invention provides a computation result protection system 1 having the management server 100 and a distribution destination device, At least some of the distribution destination devices have a protection area 10p that protects stored data from unauthorized data access, The management server 100 further includes a signature verification unit 111 that verifies each distribution destination device within the protected area 110, The signature verification unit 111 verifies whether the destination device has the protected area 10p by referring to the device information of the destination device, determines that the destination device has the protected area 10p, and distributes the generated encrypted data PK10(CK) to the destination device that has passed the verification.

[0051] This ensures that when highly confidential information is sent from the management server 100 to another device, the highly confidential information is stored in a protected area in the other device. This makes it possible to prevent information leakage from other devices to the distribution destination device before distribution.

[0052] In the present invention, the calculation result protection system 1 further includes an FPGA 300 that calculates the output value D2, The FPGA 300 sends the calculated output value D2 and its own signature to the management server 100, The data output unit 114 distributes the encrypted data CK(D2) and the signature of the FPGA 300 to each destination device, The distribution destination device verifies the output value D2 obtained by decrypting the encrypted data CK(D2) and the signature of the FPGA 300 within the protection area 10p.

[0053] This makes it possible to ensure that the output value D2 is the calculation result of the FPGA 300, and even if the output value D2 is tampered with, the tampering can be detected appropriately. [Explanation of symbols]

[0054] 1. Computation result protection system 10 Input device (distribution destination device) 10p protection area (second protection area) 100 Management server (computation result distribution device) 110 Protected area (1st protected area) 111 Signature Verification Unit (Verification Unit) 112 Signature adding section 113 Common Key Distribution Unit 114 Data output section 201 Destination server (distribution device) 201p protection area (second protection area) 202 destination server (distribution device) 202p protection area (second protection area) 300 FPGA (offload destination device) 301 Signature Verification Unit 302 Signature adding section

Claims

1. A computation result protection system having a computation result distribution device and a distribution destination device, The calculation result distribution device generating a common key shared by the plurality of destination devices; a common key distribution unit that generates first encrypted data for each of the destination devices by encrypting the common key using a public key that is paired with a private key that each of the destination devices has individually, and distributes the generated first encrypted data to each of the destination devices, thereby allowing each of the destination devices to decrypt the common key; a data output unit that distributes second encrypted data, in which the calculation result is encrypted using the common key, to each of the distribution destination devices, thereby causing each of the distribution destination devices to decrypt the calculation result; a first protection area that protects stored data from unauthorized data access; a verification unit that verifies each of the destination devices within the first protection domain, data used in the processing of the common key distribution unit and data used in the processing of the data output unit are stored in the first protection area, At least some of the destination devices have a second protection area that protects stored data from unauthorized data access; The verification unit verifies whether the distribution destination device has the second protected area by referring to device information of the distribution destination device, determines that the distribution destination device having the second protected area has passed verification, and distributes the generated first encrypted data to the distribution destination device that has passed verification. Computation result protection system.

2. The computation result protection system further includes an offload destination device that computes the computation result, the offload destination device sends the calculated calculation result and its own signature to the calculation result distribution device; the data output unit distributes the second encrypted data and the signature of the offload destination device to each of the distribution destination devices; The distribution destination device verifies the calculation result obtained by decrypting the second encrypted data and the signature of the offload destination device in the second protected area. The computation result protection system according to claim 1 .

3. A computation result distribution method executed by a computation result protection system having a computation result distribution device and a distribution destination device, comprising: the calculation result distribution device includes a common key distribution unit, a data output unit, a first protection area, and a verification unit; The common key distribution unit generating a common key shared by the plurality of destination devices; generating, for each of the destination devices, first encrypted data obtained by encrypting the common key using a public key that is paired with a private key that each of the destination devices has individually, and distributing the generated first encrypted data to each of the destination devices, thereby causing each of the destination devices to decrypt the common key; the data output unit executes a step of distributing second encrypted data, in which the calculation result is encrypted using the common key, to each of the distribution destination devices, thereby causing each of the distribution destination devices to decrypt the calculation result; the first protection area is an area that protects stored data from unauthorized data access; the verification unit performs a step of verifying each of the destination devices within the first protection domain; data used in the processing of the common key distribution unit and data used in the processing of the data output unit are stored in the first protection area, At least some of the destination devices have a second protection area that protects stored data from unauthorized data access; In the step of verifying each of the distribution destination devices within the first protection area, the verification unit verifies whether the distribution destination device has the second protection area by referring to device information of the distribution destination device, determines that the distribution destination device having the second protection area has passed verification, and distributes the generated first encrypted data to the distribution destination device that has passed verification. Method of distributing calculation results.

Images