Log management method, program execution system, program execution device, log inspection device, and program

Abstract

This program execution device comprises a hash value calculation unit that: obtains data ~X (where data ~X is data generated using a key ~Kd) makes it possible to identify that processed data is data X, and calculates a hash value H(~X) from the data ~X; obtains data ~P (where data ~P is data generated by a key ~Kp) makes it possible to identify that an executed program is a program P, and calculates a hash value H(~P) from the data ~P; and obtains data ~Y (where data ~Y is data generated by a key ~Kr) makes it possible to identify that the processing result obtained by executing the program is a processing result Y, and calculates a hash value H(~Y) from the data ~Y. The program execution device further comprises an execution log management unit that generates an execution log containing the hash value H(~X), the hash value H(~P), and the hash value H(~Y), as an execution log indicating the execution of the program P that uses the data X as input.

Description

Log management method, program execution system, program execution device, log inspection device, and program

[0001] The present invention relates to a technique for managing a program execution log.

[0002] One technology for executing data processing while keeping data and programs secret is the use of a trusted execution environment (TEE). For example, as described in Non-Patent Document 1, a data provider and a program provider each encrypt the data and program and securely register them on a server equipped with a trusted execution environment. The server then executes data processing while keeping the data and program secret from third parties. The server then encrypts the obtained processing results and provides them to the data user. Note that the data user may be the data provider himself or herself, or may be a person different from the data provider. Furthermore, the keys used to encrypt the data, programs, and processing results must be shared in advance between the data provider, program provider, data user, and server.

[0003] (Reference Non-Patent Document 1: Tetsuya Okuda, Misato Nakabayashi, Kenichi Arai, Ryo Kikuchi, Koji Senda, "Proposal and Security Evaluation of Confidential Program Execution," Information Processing Society of Japan Research Report, Vol. 2021-CSEC-95 No. 17, pp. 1-8, 2021.) Generally, recording program execution logs on a server is important for trail management. However, in the case of data processing such as the example above, it is necessary to record the execution log while maintaining the confidentiality of the data and programs used in the data processing and the processing results. A well-known method for recording information while concealing it is to use a hash function (see Non-Patent Document 1). For example, one possible method is to use a hash function to convert the data, programs, and processing results used in the data processing into hash values, which are irreversible data, and then record them as an execution log.

[0004] Oracle Linux (registered trademark) 6 Security Guide 2.2.1 Shadow Passwords and Hashing Algorithms, [online], [Retrieved August 2, 2024], Internet<URL: https: / / docs.oracle.com / cd / E39368_01 / security / ol_instcssp_sec.html>

[0005] However, this recording method has problems, especially when the data type of the processing result is Boolean, and the processing result has little variation. For example, if the execution log is leaked and misused, there is a risk that the processing result can be reverse-calculated by brute-force attack using the hash value contained in the execution log.

[0006] Therefore, an object of the present invention is to provide an execution log management technique that makes it difficult to mount an attack that attempts to obtain processing results from the execution log.

[0007] One aspect of the present invention is a log management method in a program execution system including a data management device, a program management device, a program execution device, and a data utilization device, in which the program execution device manages an execution log of a program, wherein Kd is a key shared between the data management device and the program execution device, Kp is a key shared between the program management device and the program execution device, Kr is a key shared between the data utilization device and the program execution device, X is the data to be processed, P is a program to be executed with data X as input, Y is a processing result obtained by executing program P with data X as input, ~Kd is a key generated from key Kd for generating an execution log of program P, ~Kp is a key generated from key Kp for generating an execution log of program P, ~Kr is a key generated from key Kr for generating an execution log of program P, and H is a hash function, the program execution device generates an execution log including the hash value H(~X), the hash value H(~P), and the hash value H(~Y) from the data ~Y; and the program execution device generates an execution log including the hash value H(~X), the hash value H(~P), and the hash value H(~Y) as an execution log indicating the execution of the program P using the data X as input.

[0008] According to the present invention, it is possible to manage the execution log in a manner that makes it difficult to mount an attack that attempts to obtain the processing results from the execution log.

[0009] FIG. 1 is a block diagram showing the configuration of a program execution system 10. FIG. 2 is a block diagram showing the configuration of a data management device 100. FIG. 3 is a block diagram showing the configuration of a program management device 200. FIG. 4 is a block diagram showing the configuration of a program execution device 300. FIG. 5 is a block diagram showing the configuration of a data utilization device 400. FIG. 6 is a block diagram showing the configuration of a log inspection device 500. FIG. 7 is a sequence diagram showing the operation of the program execution system 10. FIG. 8 is a sequence diagram showing the operation of the program execution system 10. FIG. 9 is a diagram showing an example of the functional configuration of a computer that realizes each device in an embodiment of the present invention.

[0010] Hereinafter, an embodiment of the present invention will be described in detail. Note that components having the same functions are given the same numbers and redundant explanations will be omitted.

[0011] Before describing each embodiment, the notation used in this specification will be explained.

[0012] ^ (caret) represents a superscript, e.g., x y^z Yes z is a superscript to x, and x y^z Yes z is a subscript to x. Also, _ (underscore) represents a subscript. For example, x y_z Yes z is a superscript to x, and x y_z Yes z is a subscript to x.

[0013] The superscripts "^" and "~" such as ^x and ~x for a certain letter x should be written directly above the "x", but due to restrictions on the notation in the specification, they are written as ^x and ~x.

[0014] <Technical Background> The following methods, for example, can be considered as a countermeasure against the problem of processing results being calculated backward from hash values ​​contained in execution logs.

[0015] (1) A random number called salt is added to each of the data, program, and processing results, and then converted into a hash value.

[0016] (2) The data, program, and processing results are each encrypted using a shared key for encryption and then converted into a hash value.

[0017] However, method (1) requires changing the data format of the execution log to record the salt used in hash value calculation, so it cannot be adopted as a countermeasure when changing the data format of the execution log is difficult. Also, method (2) requires a shared key for encryption to inspect data, programs, and processing results using the execution log, so inspection cannot be performed without disclosing the key, which should not be disclosed. In other words, the execution log does not function as evidence.

[0018] Therefore, in an embodiment of the present invention, the data, program, and processing results are each encrypted using a one-time key generated from a salt and a key shared for encryption, and then converted into a hash value. Alternatively, the one-time key is added to each of the data, program, and processing results, and then converted into a hash value. This increases the variety of hash values ​​included in the execution log, making it more difficult to launch attacks that attempt to obtain processing results from the execution log. Furthermore, since the one-time key only needs to be disclosed to inspect the data, program, and processing results using the execution log, inspection can be performed without disclosing the key shared for encryption.

[0019] First Embodiment A program execution system 10 is a system that executes a program in a reliable execution environment.

[0020] [Configuration of Program Execution System 10] The configuration of the program execution system 10 will be described below with reference to Figs. 1 to 6. Fig. 1 is a block diagram showing the configuration of the program execution system 10. Fig. 2 is a block diagram showing the configuration of the data management device 100. Fig. 3 is a block diagram showing the configuration of the program management device 200. Fig. 4 is a block diagram showing the configuration of the program execution device 300. Fig. 5 is a block diagram showing the configuration of the data utilization device 400. Fig. 6 is a block diagram showing the configuration of the log inspection device 500.

[0021] 1, the program execution system 10 includes a data management device 100, a program management device 200, a program execution device 300, a data utilization device 400, and a log inspection device 500. The data management device 100, the program management device 200, the program execution device 300, the data utilization device 400, and the log inspection device 500 are each connected to a network 900. The network 900 may be any network configured to enable the data management device 100, the program management device 200, the program execution device 300, the data utilization device 400, and the log inspection device 500 to communicate with each other, and may be, for example, the Internet.

[0022] 2, the data management device 100 includes a salt generation unit 110, a key generation unit 115, an encryption unit 120, a transmission data generation unit 130, a transmission / reception unit 180, and a recording unit 190. The transmission / reception unit 180 is a component for transmitting and receiving information necessary for processing by the data management device 100 via a network 900. The recording unit 190 is a component for appropriately recording information necessary for processing by the data management device 100. The recording unit 190 records, for example, data that is input to a program executed by a program execution device 300. The data management device 100 is a terminal for managing data provided by a data provider.

[0023] As illustrated in FIG. 3 , the program management device 200 includes a salt generation unit 210, a key generation unit 215, an encryption unit 220, a transmission data generation unit 230, a transmission / reception unit 280, and a recording unit 290. The transmission / reception unit 280 is a component for transmitting and receiving information necessary for processing by the program management device 200 via a network 900. The recording unit 290 is a component for appropriately recording information necessary for processing by the program management device 200. The recording unit 290 records, for example, programs executed by a program execution device 300. The program management device 200 is a terminal for managing programs provided by program providers. The program management device 200 publishes specifications related to the input and output of programs, such as APIs, allowing data users to select programs.

[0024] 4, the program execution device 300 includes a first key generation unit 310, a first decryption unit 315, a second key generation unit 320, a second decryption unit 325, a program execution unit 330, a salt generation unit 340, a third key generation unit 345, a hash value calculation unit 350, an execution log management unit 360, a usage key management unit 365, a transmission data generation unit 370, a transmission / reception unit 380, and a recording unit 390. The transmission / reception unit 380 is a component for transmitting and receiving information necessary for processing by the program execution device 300 via the network 900. The recording unit 390 is a component for appropriately recording information necessary for processing by the program execution device 300. The program execution device 300 is a server that has a reliable execution environment and executes programs in that environment.

[0025] 5, the data utilization device 400 includes a selection unit 410, a key generation unit 420, a decryption unit 425, a transmission / reception unit 480, and a recording unit 490. The transmission / reception unit 480 is a component for transmitting and receiving information necessary for processing by the data utilization device 400 via a network 900. The recording unit 490 is a component for appropriately recording information necessary for processing by the data utilization device 400. The data utilization device 400 is a terminal that obtains processing results related to the data and program selected by the data user.

[0026] 6, the log inspection device 500 includes an execution log acquisition unit 510, a usage key acquisition unit 520, a program execution inspection unit 530, a transmission / reception unit 580, and a recording unit 590. The transmission / reception unit 580 is a component for transmitting and receiving information necessary for processing by the log inspection device 500 via the network 900. The recording unit 590 is a component for appropriately recording information necessary for processing by the log inspection device 500. The log inspection device 500 is a terminal that inspects program execution using an execution log as evidence.

[0027] [Operation of Program Execution System 10] Here, the operation of program execution system 10 will be described with reference to Figures 7 to 10. Specifically, the operation of program execution system 10 in two situations will be described: (1) program execution and generation of an execution log, and (2) program execution inspection.

[0028] (1) Program Execution and Generation of Execution Logs The operation of the program execution system 10 in executing a program and generating an execution log will now be described with reference to Figures 7 to 9. Figures 7 to 9 are example sequence diagrams showing the operation of the program execution system 10.

[0029] The data management device 100 and the program execution device 300 share a key Kd in advance. Similarly, the program management device 200 and the program execution device 300 share a key Kp in advance. Furthermore, the data utilization device 400 and the program execution device 300 share a key Kr in advance.

[0030] In S410, the selection unit 410 of the data utilization device 400 generates a first selection result indicating that the data user has selected data X from the data managed by the data management device 100, and the transmission / reception unit 480 of the data utilization device 400 transmits the first selection result to the data management device 100. The transmission / reception unit 180 of the data management device 100 receives the first selection result. The selection unit 410 of the data utilization device 400 generates a second selection result indicating that the data user has selected program P from the programs managed by the program management device 200, and the transmission / reception unit 480 of the data utilization device 400 transmits the second selection result to the program management device 200. The transmission / reception unit 280 of the program management device 200 receives the second selection result.

[0031] In S110, the salt generation unit 110 of the data management device 100 generates and outputs a salt Sd, which is a random number used for key generation.

[0032] In S115, the key generation unit 115 of the data management device 100 generates and outputs a key ~Kd from the key Kd recorded in the recording unit 190 and the salt Sd generated in S110. Here, the key ~Kd is a disposable key generated for generating an execution log of the program P that uses the data X as input. The key generation unit 115 can also generate the key ~Kd using any key generation algorithm. However, it is assumed that the key generation algorithm is shared with the program execution device 300.

[0033] In S120, the encryption unit 120 of the data management device 100 obtains data X using the first selection result received in S410, and generates and outputs encrypted data Cd by encrypting the data X using the key ~Kd generated in S115.

[0034] In S130, the transmission data generation unit 130 of the data management device 100 generates transmission data ~Cd including the salt Sd generated in S110 and the encrypted data Cd generated in S120, and the transmission / reception unit 180 of the data management device 100 transmits the transmission data ~Cd to the program execution device 300. The transmission / reception unit 380 of the program execution device 300 receives the transmission data ~Cd. The transmission data generation unit 130 generates the transmission data ~Cd (=Sd∥Cd), for example, by concatenating the salt Sd and the encrypted data Cd.

[0035] In S210, the salt generation unit 210 of the program management device 200 generates and outputs a salt Sp, which is a random number used for key generation.

[0036] In S215, the key generation unit 215 of the program management device 200 generates and outputs a key ~Kp from the key Kp recorded in the recording unit 290 and the salt Sp generated in S210. Here, the key ~Kp is a disposable key generated for generating an execution log of the program P that uses the data X as input. The key generation unit 215 can also generate the key ~Kp using any key generation algorithm. However, it is assumed that the key generation algorithm is shared with the program execution device 300.

[0037] In S220, the encryption unit 220 of the program management device 200 obtains the program P using the second selection result received in S410, and generates and outputs encrypted data Cp by encrypting the program P using the key ~Kp generated in S215.

[0038] In S230, the transmission data generation unit 230 of the program management device 200 generates transmission data ~Cp including the salt Sp generated in S210 and the encrypted data Cp generated in S220, and the transmission / reception unit 280 of the program management device 200 transmits the transmission data ~Cp to the program execution device 300. The transmission / reception unit 380 of the program execution device 300 receives the transmission data ~Cp. The transmission data generation unit 230 generates the transmission data ~Cp (=Sp∥Cp), for example, by concatenating the salt Sp and the encrypted data Cp.

[0039] In S310, the first key generation unit 310 of the program execution device 300 obtains the salt Sd using the transmission data ~Cd received in S130, and generates and outputs the key ~Kd from the key Kd recorded in the recording unit 390 and the obtained salt Sd. The first key generation unit 310 generates the key ~Kd using a key generation algorithm shared with the data management device 100.

[0040] In S315, the first decryption unit 315 of the program execution device 300 obtains encrypted data Cd using the transmission data ~Cd received in S130, and obtains and outputs data X by decrypting the encrypted data Cd using the key ~Kd generated in S310.

[0041] In S320, the second key generation unit 320 of the program execution device 300 acquires the salt Sp using the transmission data ~Cp received in S230, and generates and outputs the key ~Kp from the acquired salt Sp and the key Kp recorded in the recording unit 390. The second key generation unit 320 generates the key ~Kp using a key generation algorithm shared with the program management device 200.

[0042] In S325, the second decryption unit 325 of the program execution device 300 obtains encrypted data Cp using the transmission data ~Cp received in S230, and obtains and outputs the program P by decrypting the encrypted data Cp using the key ~Kp generated in S320.

[0043] In S330, the program execution unit 330 of the program execution device 300 uses the data X acquired in S315 and the program P acquired in S325 to execute the program P with the data X as input, thereby obtaining and outputting the processing result Y.

[0044] In S340, the salt generation unit 340 of the program execution device 300 generates and outputs a salt Sr, which is a random number used for key generation.

[0045] In S345, the key generation unit 345 of the program execution device 300 generates and outputs a key ~Kr from the key Kr recorded in the recording unit 390 and the salt Sr generated in S340. Here, the key ~Kr is a disposable key generated for generating an execution log of the program P that uses the data X as input. The key generation unit 345 can also generate the key ~Kr using any key generation algorithm. However, it is assumed that the key generation algorithm is shared with the data utilization device 400.

[0046] In S350, the hash value calculation unit 350 of the program execution device 300 generates encrypted data Cd by encrypting the data X acquired in S315 using the key ~Kd generated in S310, and calculates and outputs a hash value H(Cd) from the encrypted data Cd using a hash function H. The hash value calculation unit 350 of the program execution device 300 generates encrypted data Cp by encrypting the program P acquired in S325 using the key ~Kp generated in S320, and calculates and outputs a hash value H(Cp) from the encrypted data Cp using the hash function H. The hash value calculation unit 350 of the program execution device 300 generates encrypted data Cr by encrypting the processing result Y acquired in S330 using the key ~Kr generated in S345, and calculates and outputs a hash value H(Cr) from the encrypted data Cr. The hash function H may be any hash function.

[0047] In S360-1, the execution log management unit 360 of the program execution device 300 generates an execution log including the hash values ​​H(Cd), H(Cp), and H(Cr) from the hash values ​​H(Cd), H(Cp), and H(Cr) calculated in S350 as an execution log indicating the execution of the program P using the data X as input, and registers the execution log in the recording unit 390. Note that in addition to the hash values ​​H(Cd), H(Cp), and H(Cr), the execution log also includes, for example, an identifier for identifying the execution log and the time the execution log was generated. The execution log management unit 360 may also register the execution log in a dedicated recording unit external to the program execution device 300.

[0048] In S365-1, the key usage management unit 365 of the program execution device 300 registers an identifier for identifying the execution log generated in S360-1, the key ~Kd generated in S310, the key ~Kp generated in S320, and the key ~Kr generated in S345, in a dedicated recording unit external to the program execution device 300. A key management system (KMS), for example, can be used as this dedicated recording unit.

[0049] In S370, the transmission data generation unit 370 of the program execution device 300 generates transmission data ~Cr including the salt Sr generated in S340 and the encrypted data Cr generated in S350, and the transmission / reception unit 380 of the program execution device 300 transmits the transmission data ~Cr to the data utilization device 400. The transmission / reception unit 480 of the data utilization device 400 receives the transmission data ~Cr. The transmission data generation unit 370 generates the transmission data ~Cr (=Sr||Cr) by, for example, concatenating the salt Sr and the encrypted data Cr.

[0050] In S420, the key generation unit 420 of the data utilization device 400 acquires the salt Sr using the transmission data ~Cr received in S370, and generates and outputs the key ~Kr from the acquired salt Sr and the key Kr recorded in the recording unit 490. The key generation unit 420 generates the key ~Kr using a key generation algorithm shared with the program execution device 300.

[0051] In S425, the decryption unit 425 of the data utilization device 400 obtains encrypted data Cr using the transmission data ~Cr received in S370, and obtains and outputs the processing result Y by decrypting the encrypted data Cr using the key ~Kr generated in S420.

[0052] The processing in steps S310 to S370 is executed in the reliable execution environment of the program execution device 300.

[0053] (2) Checking Program Execution The operation of the program execution system 10 in checking program execution will now be described with reference to Fig. 10. Fig. 10 is an example of a sequence diagram showing the operation of the program execution system 10.

[0054] Here, the log inspection device 500 inspects program execution using, as evidence, an execution log indicating the execution of a program P that receives data X as input. To this end, the log inspection device 500 acquires in advance data X from the data management device 100, program P from the program management device 200, and processing result Y from the data utilization device 400. Note that the log inspection device 500 and the program execution device 300 share a hash function H in advance.

[0055] In S510, the execution log acquisition unit 510 of the log inspection device 500 generates a request to acquire an execution log indicating the execution of program P with data X as input, and the transmission / reception unit 580 of the log inspection device 500 transmits the acquisition request to the program execution device 300. The transmission / reception unit 380 of the program execution device 300 receives the acquisition request.

[0056] In S360-2, the execution log management unit 360 of the program execution device 300 acquires an execution log indicating the execution of program P using data X as input using the acquisition request received in S510, and the transmission / reception unit 380 of the program execution device 300 transmits the execution log to the log inspection device 500. The transmission / reception unit 580 of the log inspection device 500 receives the execution log. The execution log indicating the execution of program P using data X as input includes an identifier for identifying the execution log, a hash value H(Cd), a hash value H(Cp), and a hash value H(Cr).

[0057] In S520, the key usage acquisition unit 520 of the log inspection device 500 generates a request to acquire the key used to execute the program P that takes the data X as input, the request including an identifier for identifying the execution log contained in the execution log received in S360-2, and the transmission / reception unit 580 of the log inspection device 500 transmits the acquisition request to the program execution device 300. The transmission / reception unit 380 of the program execution device 300 receives the acquisition request.

[0058] In S365-2, the key usage management unit 365 of the program execution device 300 acquires a key usage list including an identifier for identifying the execution log included in the acquisition request received in S520, and the transmitter / receiver unit 380 of the program execution device 300 transmits the key usage list to the log checking device 500. The transmitter / receiver unit 580 of the log checking device 500 receives the key usage list. The key usage list includes key ~Kd, key ~Kp, and key ~Kr.

[0059] In S530, the program execution inspection unit 530 of the log inspection device 500 generates encrypted data Cd by encrypting previously acquired data X using key ~Kd included in the key-in-use list received in S365-2, and calculates a hash value H(Cd) from the encrypted data Cd using a hash function H. The program execution inspection unit 530 of the log inspection device 500 generates encrypted data Cp by encrypting previously acquired program P using key ~Kp included in the key-in-use list received in S365-2, and calculates a hash value H(Cp) from the encrypted data Cp using the hash function H. The program execution inspection unit 530 of the log inspection device 500 generates encrypted data Cr by encrypting previously acquired acquisition result Y using key ~Kr included in the key-in-use list received in S365-2, and calculates a hash value H(Cr) from the encrypted data Cr using the hash function H. The program execution inspection unit 530 of the log inspection device 500 compares the hash value contained in the execution log received in S360-2 with the calculated hash value H(Cd), hash value H(Cp), and hash value H(Cr), and if all the hash values ​​match, it determines that there is no problem with the program execution, that is, that the data, program, and processing results match those used to record the execution log generated when the program was executed, but otherwise it determines that there is a problem with the program execution, that is, that the data, program, and processing results do not match those used to record the execution log generated when the program was executed.

[0060] As can be seen from the above, even if an attacker obtains an execution log, they cannot obtain the processing results by comparing the processing results obtained by analogy with the processing results obtained from the execution log unless they also obtain a separate one-time key. Furthermore, if a data provider obtains the execution log, they can compare the hash values ​​of the data using their own one-time key, but they cannot compare the hash values ​​of the program or processing results. Similarly, a program provider cannot compare the hash values ​​of the data or processing results, and a data user cannot compare the hash values ​​of the data or program. Therefore, when examining program execution using the execution log as evidence, it is only possible to compare the information that needs to be compared among the data, program, and processing results.

[0061] According to an embodiment of the present invention, it is possible to manage an execution log in a manner that makes it difficult to launch an attack that attempts to obtain processing results from the execution log. Furthermore, management of the execution log does not require modification of the data format of the execution log. Furthermore, by disclosing a one-time key, program execution can be inspected using the execution log as evidence.

[0062] <Modification 1> In the description of the first embodiment, the program execution device 300 shares keys in advance individually with the data management device 100, the program management device 200, and the data utilization device 400, but it is also possible for the program execution device 300, the data management device 100, the program management device 200, and the data utilization device 400 to share a single key in advance. In this case, the program execution device 300, the data management device 100, the program management device 200, and the data utilization device 400 may share a single salt, for example, by sharing a salt generated by either the data management device 100 or the program management device 200.

[0063] <Variation 2> In the description of the first embodiment, the program execution device 300 is assumed to register the usage key list in a dedicated recording unit, but it is also possible to configure the program execution device 300 not to register the usage key list. In this case, the processing of S365-1 in Fig. 9 and the processing of S520 and S365-2 in Fig. 10 are unnecessary. Instead, the log inspection device 500 needs to previously obtain the key ~Kd along with the data X from the data management device 100, the key ~Kp along with the program P from the program management device 200, and the key ~Kr along with the processing result Y from the data utilization device 400.

[0064] Note that since the data management device 100 holds the data X, the key Kd, and the salt Sd, the data management device 100 can inspect the execution of a program that uses data X as input. Note that the data management device 100 does not need to acquire the keys ~Kp and ~Kr in advance. Similarly, the program management device 200 can inspect the execution of a program P that uses data to be processed as input. Note that the program management device 200 does not need to acquire the keys ~Kd and ~Kr in advance. Furthermore, the data utilization device 400 can inspect the processing results obtained by executing the program P that uses data X as input. Note that the data utilization device 400 does not need to acquire the keys ~Kd and ~Kp in advance.

[0065] <Modification 3> In the description of the first embodiment, the hash value calculation unit 350 of the program execution device 300 generates three pieces of encrypted data Cd, Cp, and Cr, but since the encrypted data Cd and Cp are respectively included in the transmission data ~Cd received from the data management device 100 and the transmission data ~Cp received from the program management device 200, it is also possible to use the encrypted data included in these transmission data. In this case, the processing at S350 is as follows.

[0066] In S350, the hash value calculation unit 350 of the program execution device 300 obtains encrypted data Cd using the transmission data ~Cd received in S130, calculates a hash value H(Cd) from the encrypted data Cd using a hash function H, and outputs the hash value. The hash value calculation unit 350 of the program execution device 300 obtains encrypted data Cp using the transmission data ~Cp received in S230, calculates a hash value H(Cp) from the encrypted data Cp using the hash function H, and outputs the hash value. The hash value calculation unit 350 of the program execution device 300 generates encrypted data Cr by encrypting the processing result Y obtained in S330 using the key ~Kr generated in S345, and calculates a hash value H(Cr) from the encrypted data Cr using the hash function H and outputs the hash value.

[0067] <Modification 4> In the description of the first embodiment, the hash value calculation unit 350 of the program execution device 300 calculates the hash value of encrypted data Cd, Cp, and Cr, but it may also calculate the hash values ​​of concatenated data SdCd including encrypted data Cd, concatenated data SpCp including encrypted data Cp, and concatenated data SrCr including encrypted data Cr. In this case, the processing at S350 is as follows.

[0068] In S350, the hash value calculation unit 350 of the program execution device 300 generates encrypted data Cd by encrypting the data X acquired in S315 using the key ~Kd generated in S310, generates concatenated data Sd||Cd by concatenating the salt Sd acquired in S310 and the generated encrypted data Cd, calculates and outputs a hash value H(Sd||Cd) from the concatenated data Sd||Cd using a hash function H. The hash value calculation unit 350 of the program execution device 300 generates encrypted data Cp by encrypting the program P acquired in S325 using the key ~Kp generated in S320, generates concatenated data Sp||Cp by concatenating the salt Sp acquired in S320 and the generated encrypted data Cp, and calculates and outputs a hash value H(Sp||Cp) from the concatenated data Sp||Cp using the hash function H. The hash value calculation unit 350 of the program execution device 300 generates encrypted data Cr by encrypting the processing result Y obtained in S330 using the key ~Kr generated in S345, generates concatenated data Sr||Cr by concatenating the salt Sr generated in S340 and the encrypted data Cr generated, and calculates and outputs a hash value H(Sr||Cr) from the concatenated data Sr||Cr using a hash function H.

[0069] <Variation 5> In the description of Variation 4, the hash value calculation unit 350 of the program execution device 300 generates three pieces of concatenated data Sd||Cd, Sp||Cp, and Sr||Cr, but since the concatenated data Sd||Cd and Sp||Cp are respectively the transmission data ~Cd received from the data management device 100 and the transmission data ~Cp received from the program management device 200, these transmission data may also be used. In this case, the processing at S350 is as follows.

[0070] In S350, the hash value calculation unit 350 of the program execution device 300 calculates and outputs a hash value H(Sd∥Cd) from concatenated data Sd∥Cd, which is the transmission data ~Cd received in S130, using a hash function H. The hash value calculation unit 350 of the program execution device 300 calculates and outputs a hash value H(Sp∥Cp) from concatenated data Sp∥Cp, which is the transmission data ~Cp received in S230, using the hash function H. The hash value calculation unit 350 of the program execution device 300 generates encrypted data Cr by encrypting the processing result Y obtained in S330 using the key ~Kr generated in S345, generates concatenated data Sr∥Cr by concatenating the salt Sr generated in S340 and the generated encrypted data Cr, and calculates and outputs a hash value H(Sr∥Cr) from the concatenated data Sr∥Cr using the hash function H.

[0071] <Modification 6> In the description of the first embodiment, the hash value calculation unit 350 of the program execution device 300 calculates hash values ​​after encrypting each of the data X, the program P, and the processing result Y, but it may also calculate hash values ​​after linking a one-time key to each of the data X, the program P, and the processing result Y. In this case, the processing in S350 is as follows.

[0072] In S350, the hash value calculation unit 350 of the program execution device 300 generates concatenated data X∥∼Kd by concatenating the data X acquired in S315 with the key ∼Kd generated in S310, and calculates and outputs a hash value H(X∥∼Kd) from the concatenated data X∥∼Kd using a hash function H. The hash value calculation unit 350 of the program execution device 300 generates concatenated data P∥∼Kp by concatenating the program P acquired in S325 with the key ∼Kp generated in S320, and calculates and outputs a hash value H(P∥∼Kp) from the concatenated data P∥∼Kp using the hash function H. The hash value calculation unit 350 of the program execution device 300 generates concatenated data Y||~Kr by concatenating the processing result Y acquired in S330 and the key ~Kr generated in S345, and calculates and outputs a hash value H(Y||~Kr) from the concatenated data Y||~Kr using a hash function H.

[0073] As can be seen from the first embodiment and its variants 3 to 6, the hash value calculation unit 350 is a component that obtains data ~X (where data ~X is data generated using key ~Kd) that can identify that the data to be processed is data X, calculates a hash value H(~X) from the data ~X, obtains data ~P (where data ~P is data generated using key ~Kp) that can identify that the executed program is program P, calculates a hash value H(~P) from the data ~P, obtains data ~Y (where data ~Y is data generated using key ~Kr) that can identify that the processing result obtained by executing the program is processing result Y, and calculates a hash value H(~Y) from the data ~Y.

[0074] <Additional Notes> The functions performed by the components described in this specification may be implemented in circuitry or processing circuitry, including general-purpose processors, application-specific processors, integrated circuits, ASICs (Application Specific Integrated Circuits), CPUs (Central Processing Units), conventional circuits, and / or combinations thereof, programmed to perform the described functions. A processor includes transistors and other circuits and is considered to be circuitry or processing circuitry. A processor may be a programmed processor that executes programs stored in memory. A CPU may also provide the functionality of a trusted execution environment.

[0075] In this specification, a circuitry, unit, or means is hardware that is programmed to realize or performs the described functions, which may be any hardware disclosed herein or any hardware known to be programmed to realize or perform the described functions.

[0076] If the hardware is a processor considered to be a type of circuitry, the circuitry, means, or unit is a combination of the hardware and software used to configure the hardware and / or processor.

[0077] The various processes described above can be implemented by loading a program that executes each step of the above method into the recording unit 2020 of the computer 2000 shown in Figure 11 and operating the control unit 2010, input unit 2030, output unit 2040, display unit 2050, etc.

[0078] The program describing the processing contents can be recorded on a computer-readable recording medium, which may be, for example, a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, or any other suitable recording medium.

[0079] The program may be distributed by, for example, selling, transferring, lending, etc. portable recording media such as DVDs and CD-ROMs on which the program is recorded. Furthermore, the program may be stored in a storage device of a server computer, and then transferred from the server computer to other computers via a network, thereby distributing the program.

[0080] A computer that executes such a program may first temporarily store the program recorded on a portable recording medium or transferred from a server computer in its own storage device. Then, when executing a process, the computer reads the program stored in its storage device and executes the process in accordance with the read program. Alternatively, the computer may read the program directly from a portable recording medium and execute the process in accordance with the program. Furthermore, the computer may execute the process in accordance with the program each time a program is transferred from a server computer to the computer. Alternatively, the server computer may not transfer the program to the computer, but may instead execute the process through a so-called ASP (Application Service Provider) service, which realizes the processing function by issuing an execution instruction and obtaining the results. Furthermore, the server computer may execute the process at the terminal using a so-called SaaS (Software as a Service) service, which allows users to use part of the server computer along with the program. In this embodiment, the program includes information used for processing by an electronic computer that is equivalent to a program (such as data that is not a direct instruction to a computer but has properties that dictate computer processing).

[0081] Furthermore, in this embodiment, the device is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

[0082] The present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the spirit of the present invention. Furthermore, the processes described in the above embodiments may not only be executed in chronological order according to the order described, but may also be executed in parallel or individually depending on the processing capacity of the device that executes the processes or as needed.

Claims

1. A log management method in a program execution system including a data management device, a program management device, a program execution device, and a data utilization device, in which the program execution device manages a program execution log, wherein Kd is a key shared between the data management device and the program execution device, Kp is a key shared between the program management device and the program execution device, Kr is a key shared between the data utilization device and the program execution device, X is the data to be processed, P is a program to be executed with data X as input, Y is the processing result obtained by executing program P with data X as input, ~Kd is a key generated from key Kd for generating an execution log of program P, ~Kp is a key generated from key Kp for generating an execution log of program P, ~Kr is a key generated from key Kr for generating an execution log of program P, and H is a hash function, a hash value calculation step in which the program execution device obtains data ~X (where data ~X is data generated using key ~Kd) that can identify that the data to be processed is data X, calculates a hash value H(~X) from the data ~X, obtains data ~P (where data ~P is data generated using key ~Kp) that can identify that the executed program is program P, calculates a hash value H(~P) from the data ~P, obtains data ~Y (where data ~Y is data generated using key ~Kr) that can identify that the processing result obtained by executing the program is processing result Y, and calculates a hash value H(~Y) from the data ~Y; and an execution log management step in which the program execution device generates an execution log including the hash value H(~X), the hash value H(~P), and the hash value H(~Y) as an execution log that indicates the execution of program P using data X as input.

2. A program execution system including a data management device, a program management device, a program execution device, and a data utilization device, wherein the program execution device manages a program execution log, wherein Kd is a key shared between the data management device and the program execution device, Kp is a key shared between the program management device and the program execution device, and Kr is a key shared between the data utilization device and the program execution device, X is the data to be processed, P is a program to be executed with data X as input, and Y is a processing result obtained by executing program P with data X as input, ~Kd is a key generated from key Kd for generating an execution log of program P, ~Kp is a key generated from key Kp for generating an execution log of program P, ~Kr is a key generated from key Kr for generating an execution log of program P, and H is a hash function, and the program execution device: a hash value calculation unit that obtains data ~X (where data ~X is data generated using key ~Kd) that can identify that the data to be processed is data X, calculates a hash value H(~X) from the data ~X, obtains data ~P (where data ~P is data generated using key ~Kp) that can identify that the executed program is program P, calculates a hash value H(~P) from the data ~P, obtains data ~Y (where data ~Y is data generated using key ~Kr) that can identify that the processing result obtained by executing the program is processing result Y, and calculates a hash value H(~Y) from the data ~Y; and an execution log management unit that generates an execution log including the hash value H(~X), the hash value H(~P), and the hash value H(~Y) as an execution log that indicates the execution of program P using data X as input.

3. A program execution device that manages a program execution log in a program execution system including a data management device, a program management device, a program execution device, and a data utilization device, wherein Kd is a key shared by the data management device and the program execution device, Kp is a key shared by the program management device and the program execution device, and Kr is a key shared by the data utilization device and the program execution device; X is the data to be processed, P is a program that is executed with data X as input, and Y is the processing result obtained by executing program P with data X as input; ~Kd is a key generated from key Kd for generating an execution log of program P, ~Kp is a key generated from key Kp for generating an execution log of program P, ~Kr is a key generated from key Kr for generating an execution log of program P, and H is a hash function; a hash value calculation unit that obtains data ~X (where data ~X is data generated using a key ~Kd) that can identify that the data to be processed is data X, calculates a hash value H(~X) from the data ~X, obtains data ~P (where data ~P is data generated using a key ~Kp) that can identify that the executed program is program P, calculates a hash value H(~P) from the data ~P, obtains data ~Y (where data ~Y is data generated using a key ~Kr) that can identify that the processing result obtained by executing the program is processing result Y, and calculates a hash value H(~Y) from the data ~Y; and an execution log management unit that generates an execution log that includes the hash value H(~X), the hash value H(~P), and the hash value H(~Y) as an execution log that indicates the execution of program P using data X as input.

4. A program execution device according to claim 3, further comprising: a first key generation unit that generates a key ~Kd from a key Kd and a salt Sd obtained by a predetermined method; a second key generation unit that generates a key ~Kp from a key Kp and a salt Sp obtained by a predetermined method; and a third key generation unit that generates a key ~Kr from a key Kr and a salt Sr obtained by a predetermined method.

5. A log inspection device in a program execution system including a data management device, a program management device, a program execution device, a data utilization device, and a log inspection device that inspects program execution using a program execution log as evidence, wherein Kd is a key shared by the data management device and the program execution device, Kp is a key shared by the program management device and the program execution device, Kr is a key shared by the data utilization device and the program execution device, X is the data to be processed, P is a program executed with data X as input, Y is the processing result obtained by executing program P with data X as input, ~Kd is a key generated from key Kd for generating an execution log of program P, ~Kp is a key generated from key Kp for generating an execution log of program P, ~Kr is a key generated from key Kr for generating an execution log of program P, and H is a hash function, and a program execution inspection unit that obtains, from data X, data ~X (where data ~X is data generated using key ~Kd) that can identify that the data that was the subject of data processing is data X, and calculates a hash value H(~X) from the data ~X; obtains, from program P, data ~P (where data ~P is data generated using key ~Kp) that can identify that the executed program is program P, and calculates a hash value H(~P) from the data ~P; obtains, from processing result Y, data ~Y (where data ~Y is data generated using key ~Kr) that can identify that the processing result obtained by executing the program is processing result Y, and calculates a hash value H(~Y) from the data ~Y; and compares hash values ​​included in an execution log that indicates the execution of program P using data X as input, obtained from the program execution device, with the calculated hash values ​​H(~X), H(~P), and H(~Y), and if all hash values ​​match, determines that the data, program, and processing result match those used to record the execution log that was generated when the program was executed.

6. A program for causing a computer to function as the program execution device according to claim 3.

7. A program for causing a computer to function as the log inspection device according to claim 5.

Images