Data processing device, data processing system, data processing method, and data processing program

Abstract

Data processing devices 10A–10C are each a device that processes data in an isolated environment within a node 1–3 and each comprise an encryption proxy unit 11A–11C that uses a common key to encrypt processed data that is processed in the isolated environment and transmits the encrypted data to the other data processing devices and uses the common key to decrypt encrypted data received from the other data processing devices and outputs the decrypted data into the isolated environment and a network setting unit 12A–12C that establishes network settings such that the processed data and the encrypted data transit the proxy unit 11A–11C.

Description

Data processing device, data processing system, data processing method, and data processing program

[0001] The present disclosure relates to a data processing device, a data processing system, a data processing method, and a data processing program.

[0002] Initiatives in which multiple companies collaborate to solve social issues, such as realizing a resource-circulating society, are becoming more active. Data distribution between companies that supports these initiatives is also beginning to take place, but there are concerns that data held by each company may be leaked after it is provided.

[0003] To address this issue, a technology called a data sandbox is known (see Non-Patent Document 1). A data sandbox is an isolated environment created within a node (a virtual machine and / or physical machine that constitutes a cluster), and is a technology that allows important data such as know-how and trade secrets owned by one company X and processing logic filled with know-how owned by another company Y to be combined and mutually used without disclosing the data to each other.

[0004] By using this data sandbox, data can be circulated not only between companies, but also between organizations and users without concerns about the leakage of important data or unexpected use of processing logic.

[0005] Inoue, et al., "Trusted Data Space Technology for Data Governance in the IOWN Era," NTT Technical Journal, February 2023, pp. 41-44

[0006] If it is desired to expand the data size that can be processed in a data sandbox, there is a physical limit to the data size that can be processed on a single node, so a method of placing the data sandbox on multiple nodes is being considered.

[0007] However, in a data sandbox, communication with the outside world is restricted to prevent data theft, so it is not possible to execute processing logic that performs distributed processing across data sandboxes, such as those that run on multiple nodes.

[0008] The present disclosure has been made in consideration of the above circumstances, and an object of the present disclosure is to provide a technology that can realize safe processing cooperation between multiple isolated environments.

[0009] A data processing device of one embodiment of the present disclosure is a data processing device that processes data in an isolated environment within a node, and includes a proxy unit that encrypts processed data to be processed in the isolated environment using a common key and transmits it to other data processing devices, and decrypts encrypted data received from other data processing devices using the common key and outputs it to the isolated environment, and a setting unit that configures a network so that the processed data and the encrypted data pass through the proxy unit.

[0010] A data processing system of one embodiment of the present disclosure comprises a plurality of data processing devices that process data in an isolated environment within a node, and a shared key generation device that generates a shared key, wherein the shared key generation device comprises a generation unit that generates a shared key and a placement unit that places the shared key in the plurality of data processing devices, and each of the plurality of data processing devices comprises a proxy unit that encrypts processed data to be processed in the isolated environment using the shared key and transmits it to other data processing devices, decrypts encrypted data received from the other data processing devices using the shared key and outputs it to the isolated environment, and a setting unit that configures the network so that the processed data and the encrypted data pass through the proxy unit.

[0011] A data processing method of one embodiment of the present disclosure is a data processing method performed by a data processing device having a setting unit and a proxy unit, in which the setting unit configures a network so that processed data processed in an isolated environment of the data processing device and encrypted data received from other data processing devices pass through the proxy unit, and the proxy unit encrypts the processed data with a common key and transmits it to the other data processing devices, and decrypts the encrypted data with the common key and outputs it to the isolated environment.

[0012] A data processing program according to one aspect of the present disclosure causes a computer to function as the data processing device.

[0013] According to the present disclosure, it is possible to provide a technology that can realize safe processing cooperation between multiple isolated environments.

[0014] Fig. 1 is a diagram showing an example of the configuration of a data processing system. Fig. 2 is a diagram showing an example of the operation of the data processing system. Fig. 3 is a diagram showing an example of the hardware configuration of a data processing device. Fig. 4 is a diagram showing an image of a data sandbox.

[0015] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the description of the drawings, the same parts are designated by the same reference numerals and the description thereof will be omitted.

[0016] [Data Sandbox] Fig. 4 is a diagram showing an image of a data sandbox. A data sandbox is an isolated environment prepared as a special execution environment for software, in which access to the outside is strictly restricted.

[0017] For example, a data sandbox executes processing in a secure computing area (TEE: Trusted Execution Environment) provided in a CPU within a node, and is constructed using virtual machine (VM) protection technology.

[0018] Specifically, for example, it is constructed using AMD's SEV-SNP (Secure Encrypted Virtualization-Secure Nested Paging) technology. AMD's SEV-SNP is a technology that turns the entire VM into a TEE, so the VM is equal to the TEE. However, it can also be constructed using other technologies, and the VM does not have to be equal to the TEE.

[0019] The data sandbox can also verify its operation using an attestation report, which is configuration information of the TEE signed by the hardware module that serves as the root of trust.

[0020] In the case of the SEV-SNP attestation report, information such as the type of Linux kernel running within the TEE is included with a signature, and by verifying this, it is possible to confirm that it is running in a secure environment.

[0021] In the data sandbox, the attestation report includes a hash value of the information required for the execution of the data sandbox in the attestation report or in the information linked to the attestation report, and the user can verify the security of the data sandbox by using the hash value. Note that verifying security using this attestation report is called remote attestation.

[0022] In addition, the data sandbox implements several measures as shown in Figure 4.

[0023] Countermeasure 1 is to prevent unintended execution of processing logic by having users agree on the important data and processing logic to be used and processing the important data and processing logic based on the agreed-upon policy.

[0024] Countermeasure 2 is to prevent data from being taken outside using processing logic by using a container that restricts external communication.

[0025] As a third measure, the processing result data is encrypted and output from the container so that only users permitted by the policy can decrypt it.

[0026] As a fourth measure, important data and processing logic to be input into the container should also be encrypted so that they can only be decrypted within the container.

[0027] Thanks to the above-mentioned isolated environment and multiple measures, in the data sandbox, the important data owned by user X and the processing logic owned by user Y can be processed using user Y's processing logic, and the processing result data can be output to user Z, who is authorized to receive the processing result data, without disclosing the important data owned by user X and the processing logic owned by user Y to each other's counterparts.

[0028] [Configuration of Data Processing System] FIG. 1 is a diagram showing an example of the configuration of a data processing system 1 according to this embodiment.

[0029] In this embodiment, a data sandbox is placed in each of three nodes 1 to 3, and an encryption proxy unit 11 is placed in all of nodes 1 to 3. The encryption proxy unit 11 encrypts all data to be sent to the other party and decrypts all data received from the other party using a common key given in advance, regardless of who the other party is.

[0030] The transmitted data and received data are, for example, Ethernet frames, IP packets, TCP packets, UDP packets, and files. The transmitted data and received data also include important data, processing logic (data processing algorithms), various data for multiple processing logics to cooperate with each other, and processing result data. Note that the important data and the processing logic may have the same owner, but it is assumed that they are different.

[0031] In this embodiment, a network setting unit 12 is arranged in each of the nodes 1 to 3. The network setting unit 12 operates before the execution of the processing logic, and performs settings so that the processing data of the processing logic is always sent via the encryption proxy unit 11.

[0032] In this embodiment, a shared key generation unit 21 and a shared key allocation unit 22 are arranged in node 4. The shared key generation unit 21 generates a shared key. The shared key allocation unit 22 verifies that data sandboxes are correctly set in all nodes 1 to 3, and after the verification, allocates the shared key to each of nodes 1 to 3.

[0033] To summarize the above, the data processing system 1 includes three nodes 1 to 3 in which data sandboxes are arranged, and a node 4 that generates a common key.

[0034] Nodes 1 to 3 are data processing devices 10A to 10C, respectively, that process data in a data sandbox within the node. That is, each of the data processing devices 10A to 10C executes a process that combines important data with processing logic in an isolated environment called a data sandbox, and outputs the processing result data.

[0035] The data processing devices 10A to 10C include encryption proxy units 11A to 11C and network setting units 12A to 12C, respectively.

[0036] Each of the encryption proxy units 11A to 11C has the function of using a pre-assigned common key to encrypt all transmission data output from a container in an isolated environment and sent to other data processing devices, and to decrypt all reception data received from other data processing devices and input to the container.

[0037] In other words, each of the encryption proxy units 11A to 11C has the function of encrypting processing data to be processed in an isolated environment with a common key and transmitting it to other data processing devices, and decrypting encrypted data received from other data processing devices with the common key and outputting it to the isolated environment.

[0038] The network setting units 12A to 12C each operate before the execution of the processing logic stored in the container, and have the function of making network settings so that the processing data of the processing logic always passes through the encryption proxy units 11A to 11C.

[0039] The network setting units 12A to 12C also have a function of setting up a network so that encrypted data received from other data processing devices always passes through the encryption proxy units 11A to 11C, respectively.

[0040] That is, the network setting units 12A to 12C respectively perform settings such that processing logics can communicate freely with each other using TCP or the like, but communication cannot be performed unless it goes through the encryption proxy units 11A to 11C.

[0041] The node 4 is a shared key generation device 20. The shared key generation device 20 includes a shared key generation unit 21 that generates a shared key, and a shared key allocation unit 22 that allocates the shared key to each of the data processing devices 10A to 10C.

[0042] All of the nodes 1 to 4 are connected to each other so as to be able to communicate with each other via a communication network 30. There may be two or more nodes. In other words, there may be two or four or more data processing devices 10.

[0043] [Operation of Data Processing System] FIG. 2 is a diagram showing an example of the operation of the data processing system 1. As shown in FIG.

[0044] Assume that the data processing device 10 is made up of two data processing devices, 10A and 10B. Also, assume that the encryption proxy units 11A and 11B of the data processing devices 10A and 10B respectively include TCP payload encryption units 111A and 111B that encrypt TCP payloads and TCP payload decryption units 112A and 112B that decrypt TCP payloads. Furthermore, assume that the data processing devices 10A and 10B each include a shared key management unit 13A and 13B that manages a shared key.

[0045] Step S1: Before the processing logic execution unit 14A executes processing logic Y in the data sandbox, the network setting unit 12A of the data processing device 10A sets the IP table of the data processing device 10A so that all processing data of processing logic Y passes through the TCP payload encryption unit 111A and all encrypted data from the data processing device 10B (processing data of processing logic M) passes through the TCP payload decryption unit 112A. The data processing device 10B also performs similar settings.

[0046] Step S2: The user or user application verifies, for example, the SEV-SNP attestation report and information linked to the attestation report, to verify that each data sandbox of the data processing devices 10A and 10B is secure, i.e., that the authorized data and processing logic can be combined in a secure environment.

[0047] Steps S3 to S5: The symmetric key generation unit 21 of the symmetric key generation device 20 generates a symmetric key (S3). The symmetric key allocation unit 22 of the symmetric key generation device 20 allocates the symmetric key to the TCP payload encryption unit 111A and the TCP payload decryption unit 112A via the symmetric key management unit 13A of the data processing device 10A (S4, S5). A symmetric key is similarly allocated to the data processing device 10B. A method for securely allocating the symmetric key will be described later.

[0048] Step S6: When the processing logic execution unit 14A of the data processing device 10A starts processing logic Y and the processing logic Y communicates with processing logic M of the data processing device 10B, the TCP payload encryption unit 111A of the data processing device 10A encrypts the TCP payload of the processing data of the processing logic Y using a common key and transmits it to the data processing device 10B.

[0049] The processing data of the processing logic Y is, for example, data for the processing logic Y of the data processing device 10A to cooperate with the processing logic M of the data processing device 10B.

[0050] Examples of times when processing logic Y interacts with processing logic M include when processing logic Y needs processing logic M while processing important data X, when processing logic Y needs the processing result data of important data N by processing logic M to process important data X, and when the processing result data of important data X is judged by the judgment process of processing logic M.

[0051] Step S7: The TCP payload decryption unit 112B of the data processing device 10B receives the encrypted data from the data processing device 10A, decrypts the encrypted data using the common key, and outputs it to the processing logic execution unit 14B in the data sandbox.

[0052] [Effect] In this way, the data processing devices 10A and 10B encrypt the data processed in the data sandboxes in their respective nodes with a common key and transmit and receive the encrypted data, enabling secure communication between the data sandboxes and enabling the execution of processing logic that performs distributed processing across data sandboxes that operates on multiple nodes. In other words, secure processing collaboration between data sandboxes can be realized.

[0053] Data sandboxes have the unique advantage of enabling important data and processing logic held by different companies and organizations to be shared while protecting each other in various fields such as smart cities and smart factories.

[0054] Specifically, in the field of smart cities, by combining surveillance camera footage, traffic data, building management data, people flow and gradient data in a data sandbox with health analysis processing logic cultivated through experience and proven results, and sophisticated and highly accurate video detection processing logic, it will be possible to safely develop resident services such as health promotion using personal data, and to accurately detect and predict accidents by analyzing a variety of cameras and sensors.

[0055] In the field of smart factories, by combining surveillance camera footage, 3D blueprints, line operation data, and order data in a data sandbox with processing time prediction processing logic packed with many years of corporate know-how and authorized carbon emission calculation processing logic, it becomes possible to safely formulate optimized production plans based on highly accurate processing time predictions, accurately calculate total CO2 emissions across the supply chain, and globally trace scarce resources throughout their lifecycles.

[0056] By combining this embodiment with a data sandbox that has such unique effects, the processable data size is greatly expanded and distributed processing becomes possible across multiple nodes, thereby enhancing the unique effects of the data sandbox and achieving the further effect of reducing processing time.

[0057] [Supplementary Information] A method for securely allocating a shared key is, for example, a method using an attestation report of SEV-SNP. In the TEE, the shared key management unit (13A, 13B) generates a key pair of a public key and a private key, includes the public key in the attestation report or information linked to the attestation report, and passes it to the shared key allocation unit 22.

[0058] After verifying the attestation report, the shared key allocation unit 22 encrypts the shared key generated by the shared key generation unit 21 with the public key and passes it to the shared key management unit, which then decrypts the received encrypted shared key with the private key to obtain the shared key.

[0059] This allows the shared key to be safely passed from the shared key allocation unit to the shared key management unit. For details, see the "VM Launch & Attestation" section in Reference 1.

[0060] Reference 1: “AMD SEV-SNP: Strengthening VM Isolation with Integrity Protection and More”, January 2020.

[0061] [Others] The present disclosure is not limited to the above-described embodiments, and various modifications are possible within the scope of the gist of the present disclosure.

[0062] The data processing device 10 of the present embodiment described above can be realized, for example, by using a general-purpose computer system including a CPU 901, a memory 902, a storage 903, a communication device 904, an input device 905, and an output device 906, as shown in Fig. 3. The memory 902 and the storage 903 are storage devices. In this computer system, the CPU 901 executes a predetermined program loaded onto the memory 902, thereby realizing each function of the data processing device 10.

[0063] The data processing device 10 may be implemented by one computer, or by multiple computers, or may be a virtual machine implemented in a computer.

[0064] The program for the data processing device 10 can be stored in a computer-readable recording medium such as a HDD, SSD, USB memory, CD, or DVD. The computer-readable recording medium is, for example, a non-transitory recording medium. The program for the data processing device 10 can also be distributed via a communication network.

[0065] REFERENCE SIGNS LIST 1 Data processing system 10 Data processing device 11 Encryption proxy unit 111 TCP payload encryption unit 112 TCP payload decryption unit 12 Network setting unit 13 Shared key management unit 14 Processing logic execution unit 20 Shared key generation device 21 Shared key generation unit 22 Shared key allocation unit 30 Communication network 901 CPU 902 Memory 903 Storage 904 Communication device 905 Input device 906 Output device

Claims

1. A data processing device that processes data in an isolated environment within a node, comprising: a proxy unit that encrypts processing data to be processed in the isolated environment using a common key and transmits it to other data processing devices, and decrypts encrypted data received from other data processing devices using the common key and outputs it to the isolated environment; and a setting unit that performs network settings so that the processing data and the encrypted data pass through the proxy unit.

2. The data processing device according to claim 1, wherein the processing data is processing data for enabling the processing logic of the data processing device to cooperate with the processing logic of another data processing device.

3. A data processing system comprising a plurality of data processing devices that process data in an isolated environment within a node, and a shared key generation device that generates a shared key, wherein the shared key generation device comprises: a generation unit that generates a shared key; and a placement unit that places the shared key among the plurality of data processing devices, and each of the plurality of data processing devices comprises: a proxy unit that encrypts processing data to be processed in the isolated environment with the shared key and transmits it to other data processing devices, and decrypts encrypted data received from other data processing devices with the shared key and outputs it to the isolated environment, and a setting unit that performs network settings so that the processing data and the encrypted data pass through the proxy unit.

4. A data processing method performed by a data processing device having a setting unit and a proxy unit, wherein the setting unit performs network settings so that processing data to be processed in the isolated environment of the data processing device and encrypted data received from other data processing devices pass through the proxy unit, and the proxy unit encrypts the processing data with a common key and transmits it to the other data processing devices, and decrypts the encrypted data with the common key and outputs it to the isolated environment.

5. A data processing program that causes a computer to function as the data processing device according to claim 1 or 2.

Images