JP2005301530A - Program, computer and data processing method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a program that enables a computer to identify a communication destination and communicate with the communication destination without monitoring a user operation using the computer for a long period of time.
A client device 12_1 transmits hash data of agent data indicating a user attribute to a server device 10. The server device 10 identifies the client device 12_1 based on the hash data. The agent data is updated under a predetermined condition according to the operation of the user of the client device 12_1, and the hash data is also updated accordingly.
[Selection] Figure 1

Description

  The present invention relates to a program executed by a computer that communicates with a communication destination, the computer, and a data processing method.

For example, there is a communication system in which a plurality of computers communicate via a network.
In such a communication system, each computer normally identifies the communication destination computer based on identification data uniquely and fixedly assigned to the communication destination computer.

  However, in the conventional communication system described above, since each computer is identified on the network using identification data fixedly assigned to each computer, the behavior (process) of each computer according to the user's operation is processed. ) May be monitored over a long period of time, and there is a problem that information related to the user's privacy such as information on the access destination of each computer may be used illegally.

The present invention has been made in view of the above-described prior art, and enables a computer to be identified as a communication destination and communicate with the communication destination without monitoring a user's operation using the computer for a long period of time. An object is to provide a program, a computer, and a data processing method.
Another object of the present invention is to provide a program, a computer, and a data processing method that enable communication by identifying the communication destination without monitoring the operation of the user of the communication destination over the long term. And

  In order to solve the above-described problems of the prior art and achieve the above-described object, a program according to a first invention is a program executed by a computer that communicates with a communication destination, and is used for communication with the computer. A first procedure for generating hash data of communication data used at a communication destination and updated under a predetermined condition, and the communication destination by adding the hash data generated in the first procedure to the communication data And a third procedure for communicating with the communication destination using the hash data generated in the first procedure as identification data of the computer after the second procedure, Is executed by the computer.

The operation of the program of the first invention is as follows.
A computer executes the program of the first invention.
Then, according to the first procedure of the program, the computer generates hash data of communication data that is used at the communication destination for communication with the computer and is updated under a predetermined condition.
Next, according to the second procedure of the program, the computer adds the hash data generated in the first procedure to the communication data and transmits it to the communication destination.
Next, in accordance with the third procedure of the program, the computer communicates with the communication destination using the hash data generated in the first procedure as the identification data of the computer after the second procedure. I do.

  The program of the second invention is a program executed by a computer that communicates with a communication destination, and associates communication data updated under a predetermined condition with hash data of the communication data from the communication destination. Identifying the communication destination based on the first procedure to be received and the hash data received in the first procedure, and communicating with the communication destination based on the communication data received in the first procedure And causing the computer to execute a second procedure to be performed.

A computer executes the program of the second invention.
Then, according to the first procedure of the program, the computer associates the communication data updated under a predetermined condition with the hash data of the communication data and receives the data from the communication destination.
Next, according to the second procedure of the program, the computer identifies the communication destination based on the hash data received in the first procedure, and the communication data received in the first procedure is Based on the communication destination, communication is performed.

  A computer according to a third aspect of the present invention is a computer having a memory in which an application program is stored, an execution circuit for executing the application program read from the memory, and an interface for exchanging data with a communication destination. The circuit generates hash data of communication data used for communication with the computer at the communication destination and updated under a predetermined condition according to the application program, and adds the generated hash data to the communication data The data is transmitted to the communication destination via the interface, and the hash data is used as identification data for the computer to communicate with the communication destination.

The operation of the computer of the third invention is as follows.
First, an execution circuit generates hash data of communication data used for communication with the computer at the communication destination and updated under a predetermined condition according to the application program.
Next, the execution circuit adds the generated hash data to the communication data and transmits the hash data to the communication destination via the interface, and uses the hash data as identification data of the computer. Communicate with.

  A computer according to a fourth aspect of the present invention is a computer that communicates with a communication destination, and associates a memory for storing a program, communication data updated under a predetermined condition, and hash data of the communication data. An interface received from a communication destination and the program read from the memory are executed, the communication destination is identified based on the hash data received by the interface according to the program, and the communication data received by the interface And an execution circuit for communicating with the communication destination based on the communication destination.

The operation of the computer of the fourth invention is as follows.
The execution circuit reads the program from the memory and executes it.
Then, according to the program, the execution circuit identifies the communication destination based on the hash data received by the interface, and communicates with the communication destination based on the communication data received by the interface.

  A data processing method according to a fifth aspect of the present invention is a data processing method executed by a computer that communicates with a communication destination, and is used for communication data used at the communication destination for communication with the computer and updated under predetermined conditions. A first step of generating hash data, a second step of adding the hash data generated in the first step to the communication data and transmitting it to the communication destination, and after the second step And a third step of communicating with the communication destination using the hash data generated in the first step as identification data of the computer.

  A data processing method according to a sixth aspect of the present invention is a data processing method executed by a computer that communicates with a communication destination, wherein communication data updated under a predetermined condition is associated with hash data of the communication data. The first step of receiving from the communication destination and the communication destination based on the communication data received in the first step by identifying the communication destination based on the hash data received in the first step A second step of communicating with the destination.

According to the first, third, and fifth inventions, it is possible to identify a computer as a communication destination and communicate with the communication destination without monitoring a user's operation using the computer for a long period of time. A program, a computer, and a data processing method can be provided.
According to the second, fourth, and sixth inventions, a program, a computer, and data that make it possible to identify and communicate with a communication destination without monitoring the operation of the communication destination user over a long period of time A processing method can be provided.

Hereinafter, a communication system according to an embodiment of the present invention will be described.
FIG. 1 is an overall configuration diagram of a communication system 1 according to an embodiment of the present invention.
As illustrated in FIG. 1, the communication system 1 includes, for example, a server device 10 and client devices 12_1 and 12_2.
The server device 10, the client device 12_1, and the client device 12_1 communicate with each other via the network 9.
In this embodiment, a case where communication is performed by a large number of server apparatuses 10 and two client apparatuses 12_1 and 12_3 is illustrated, but the present invention may use a plurality of server apparatuses, or a single or three or more. The client device may be used.

First, an outline of the communication system 1 shown in FIG. 1 will be described.
Based on the user operation history data, the client device 12_1 generates public agent data AGENT_DP1 indicating attributes such as the user's preference.
The public agent data AGENT_DP1 includes agent data AGENT_D1 indicating attributes such as user preferences of the client device 12_1 and hash data HASH_D1 of the agent data AGENT_D1.
Then, the client device 12_1 transmits the public agent data AGENT_DP1 to the server device 10.
Thereafter, the client device 12_1 communicates with the server device 10 using the hash data HASH_D1 included in the public agent data AGENT_DP1 as its own identification data.
The server device 10 uses the hash data HASH_D1 included in the public agent data AGENT_DP1 received from the client device 12_1 as identification data for identifying the client device 12_1.
Further, the server device 10 identifies the hash data HASH_D1 through the interface 21 with various service data, for example, content data, adapted to characteristics such as user preferences of the client device 12_1 based on the public agent data AGENT_DP1. It is used as data and transmitted to the client device 12_1.
Note that the agent data AGENT_D1 is updated under a predetermined condition, and the hash data HASH_D1 is also updated accordingly. That is, the identification data of the client device 12_1 is updated.

In the communication system 1, the client device 12_1 communicates with the server device 10 using the hash data HASH_D1 updated under a predetermined condition as its identification data.
Therefore, even if the operation (behavior) of the user of the client device 12_1 is monitored on the network 9 based on the hash data HASH_D1, the monitoring cannot be continued after the hash data HASH_D1 is updated. Therefore, it is possible to prevent the user's operation of the client device 12_1 from being continuously monitored over a long period of time and to protect the user's privacy.

Hereinafter, the present embodiment will be described with reference to FIGS.
First, the correspondence between each component of the present embodiment and the component of the present invention will be described.
The application program AP_S shown in FIG. 2 corresponds to the programs of the second and fourth inventions.
The boot program B_PRG shown in FIG. 5 and the like corresponds to the boot program of the third invention.
Also, the agent program AGENT_P1 and the like shown in FIG. 5 and the like correspond to the program of the first invention and the application program of the third invention.
The client device 12_1 shown in FIG. 1 corresponds to the computers of the first and third inventions, and the server device 10 and the client device 12_2 shown in FIG. 1 correspond to the communication destinations of the first and third inventions. .
The server device 10 shown in FIG. 1 corresponds to the computers of the second and fourth inventions, and the client device 12_1 shown in FIG. 1 corresponds to the communication destination of the second and fourth inventions.
Further, agent data AGENT_D1 and AGENT_D2 in the public agent data AGENT_DP1 correspond to the communication data of the present invention, and the hash data HASH_D1 and HASH_D2 correspond to the hash data of the present invention.
Further, the certification data AP_CER corresponds to the certification data of the present invention.

Step ST37 shown in FIG. 8 corresponds to the first procedure of the first invention, step ST38 shown in FIG. 8 and step ST54 shown in FIG. 9 correspond to the second procedure of the first invention, and step ST55 This corresponds to the third procedure of the second invention.
Also, step ST7 shown in FIG. 3 corresponds to the first procedure of the second invention, and steps ST9 and ST10 correspond to the second procedure of the second invention.

[Server device 10]
FIG. 2 is a configuration diagram of the server apparatus 10 shown in FIG.
As shown in FIG. 2, the server device 10 includes, for example, an interface 21, a memory 22, and a CPU 23, which are connected via a data line 20.
Here, the interface 21 corresponds to the interface of the fourth invention, the memory 22 corresponds to the memory of the fourth invention, and the CPU 23 corresponds to the execution circuit of the fourth invention.

The interface 21 transmits and receives data to and from the client devices 12_1 and 12_2 via the network 9.
The memory 22 stores the application program AP_S.
As will be described later, the application program AP_S registers the hash data HASH_D1 included in the public agent data AGENT_DP1 received from the client device 12_1, and then transmits the hash data HASH_D1 to the client device 12_1 through communication with the client device 12_1. It is specified to be used as identification data.
Further, as will be described later, the application program AP_S performs various services adapted to characteristics such as user preferences of the client apparatuses 12_1 and 12_2 based on the public agent data AGENT_DP1 and AGENT_DP2 received from the client apparatuses 12_1 and 12_2. Is provided to the client devices 12_1 and 12_2.

The memory 22 stores the secret key data SK_S, public key data PK_S, public key certification data PKC_S, and identification data ID_S of the server device 10.
The memory 22 stores public agent data AGENT_DP1 received from the client device 12_1.
The memory 22 stores the public key data PK_C1 and the public key certification data PKC_C1 of the client device 12_1 through communication with the client device 12_1. The memory 22 stores public agent data AGENT_DP2 received from the client device 12_2.
Further, the memory 22 stores the public key data PK_C2 and the public key certification data PKC_C2 of the client device 12_2 through communication with the client device 12_2 or the like.

The CPU 23 executes the application program AP_S and comprehensively controls the operation of the server device 10.
The processing performed by the CPU 23 will be described in association with an operation example of the server device 10.

Hereinafter, an operation example when the server apparatus 10 illustrated in FIG. 2 communicates with the client apparatus 12_1 will be described.
FIG. 3 is a flowchart for explaining an operation example when the server apparatus 10 shown in FIG. 2 communicates with the client apparatus 12_1.
Each step shown below is defined by the application program AP_S.
Step ST1:
The CPU 23 of the server device 10 reads the application program AP_S designated by the user from the memory 22 and executes it.
The application program AP_S is, for example, a program that provides a client device with content data such as a search engine or video and audio, and is a program that transmits and receives content data only with a program having identification data AP_ID corresponding thereto. The content data relates to copyright, for example.

Step ST2:
For example, the CPU 23 performs mutual authentication with the client device 12_1 via the interface 21 based on the secret key data SK_S, the public key data PK_C1, and the public key certification data PKC_C1 read from the memory 22, for example.
As the mutual authentication, for example, ISO / IEC 9798-3 method or the like is used.
When the mutual authenticity is confirmed by the mutual authentication, the CPU 23 shares the session key data used for the subsequent communication with the client device 12_1 with the client device 12_1, and based on the session key data in the subsequent communication. Encrypt the data.
In the present embodiment, for example, the CPU 23 may not verify the hash data of the boot program B_PRG of the client device 12_1.
Step ST3:
The CPU 23 proceeds to step ST4 when mutual validity is confirmed by the mutual authentication performed in step ST2, and ends the process or performs error processing if not.

Step ST4:
The CPU 23 receives the certification data AP_CER attached with the signature data SIG from the client device 12_1 via the interface 21.
For example, as will be described later, the certification data AP_CER includes identification data AP_ID, manufacturing identification data MF_ID, version VER, and hash data HASH of the application program AP_C1 that has been activated by the client device 12_1 and has been validated. They are shown in association with each other.
In the present embodiment, an agent program AGENT_P1 is used as one of the application programs AP_C1.

Step ST5:
The CPU 23 verifies the validity of the certification data AP_CER received in step ST4.
At this time, for example, the CPU 23 generates hash data of the certification data AP_CER based on the hash function. Then, the CPU 23 determines whether or not the generated hash data matches the signature data SIG added to the certification data AP_CER shown in FIG. 4, and if they match, the certification data AP_CER1 is falsified. Judge that it is not legitimate.
Here, the hash function is a function that generates fixed-length data from a given original text, and the original text cannot be reproduced from the hash value, and it is extremely difficult to generate different data having the same hash value. It has the characteristic.
If the CPU 23 determines that the proof data AP_CER is valid, the CPU 23 proceeds to step ST6. If not, the CPU 23 ends the process or performs error processing.
When the client device 12_1 generates the signature data SIG by encrypting the hash data with the secret key SK_C1 of the client device 12_1, the CPU 23 decrypts the signature data SIG with the public key PK_C1 of the client device 12_1 and decrypts it. The obtained data is compared with the hash data. At this time, since the data is encrypted with the session key on the network 9, a desired object can be achieved without using a digital signature technique that takes a long processing time. That is, the hash data itself is encrypted with the session key, and almost the same function as the digital signature can be realized.
In addition, in order to prevent the data exchanged in the past from being illegally reused, usually random number data is added to the data (in this example, the certification data AP_CER shown in FIG. 4), and all data including random numbers is added. Hash data is calculated and used as signature data SIG. Further, when encrypting with the secret key SK_C1, encryption is performed on the hash data for the data including the random number data.

Step ST6:
The CPU 23 determines whether or not the identification data AP_ID of the designated application program AP_C1 (in this embodiment, the agent program AGENT_P1) is included in the certification data AP_CER received in step ST4, and the identification data AP_ID is included. If it is determined that the validity of the agent program AGENT_P1 has been confirmed and activated in the client device 12_1, the process proceeds to step ST7, and if not, the process ends.
Here, the agent program AGENT_P1 is a program that generates the public agent data AGENT_DP1 of the user of the client device 12_1, for example, as described above.
Note that the CPU 23 may verify whether the manufacturing identification data MF_ID and the version data VER are desired in addition to the identification data AP_ID in the verification in the step.

Step ST7:
The interface 21 receives the public agent data AGENT_DP1 from the client device 12_1.
Step ST8:
The CPU 23 verifies the validity of the signature data SIGD attached to the public agent data AGENT_DP1 shown in FIG. 6 received in step ST7, and proceeds to step ST9 if it is determined to be valid. Exit or perform error handling.

Step ST9:
The CPU 23 registers (specifies) the hash data HASH_D1 in the public agent data AGENT_DP shown in FIG. 6 received in step ST7 as identification data of the client device 12_1.
Step ST10:
The CPU 23 communicates with the client device 12_1 using the hash data HASH_D1 registered in step ST9 as identification data of the client device 12_1.
At this time, the CPU 23 analyzes the agent data AGENT_D1 in the public agent data AGENT_DP1, and sends various service data, for example, content data, adapted to characteristics such as user preferences of the client device 12_1 to the client via the interface 21. It transmits to the device 12_1.
For example, when the application program AP_S is a search engine, the CPU 23 relates to the search keyword determined based on the user's preference in addition to the predetermined search keyword input by the user of the client device 12_1. The keyword is further used to search for data and display the search result.
For example, when the user inputs “package tour” as a search keyword, and the public agent data AGENT_DP1 indicates that the user's preference is “car”, the CPU 23 displays package tour data. Among them, a plan to go to the site using a car or data on a rental car plan is preferentially selected and transmitted to the client device 12_1.

As described above, the server device 10 identifies the client device 12_1 using the hash data HASH_D1 in the public agent data AGENT_DP1 received from the client device 12_1 as identification data.
Here, since the hash data HASH_D1 is updated under a predetermined condition as will be described later, the server device 10 does not operate the user of the client device 12_1 based on the hash data HASH_D1 until the hash data HASH_D1 is updated. Although it can be monitored, after the hash data HASH_D1 is updated, it is not possible to monitor the user operation of the client device 12_1 based on the hash data HASH_D1 before the update.
Here, since the public key certificate usually includes ID information that can identify the client device 12_1, the secret key SK_C1, the public key PK_C1, and the public key are shorter than the update timing of the hash data HASH_D1. It is necessary to update the key certificate PKC_C1. The reason for not only updating the public key certificate PCK_C1 but also updating the public key pair is to prevent the public key PK_C1 from being used as identification data. Note that the public key PK_C1 and the public key certificate PCK_C1 of the client device 12_1 are unnecessary if only SSL (Secure Socket Layer) is used to conceal the communication path without using public key authentication. Such processing is also unnecessary.
As described above, it is possible to prevent the operation of the client device 12_1 from being monitored for a long time.
Further, the server device 10 can realize an agent function based on the public agent data AGENT_DP1 received from the client device 12_1 without accumulating user operation history data of the client device 12_1.

[Client device 12_1]
FIG. 5 is a configuration diagram of the client apparatus 12_1 illustrated in FIG.
As illustrated in FIG. 5, the client device 12_1 includes, for example, an interface 31, a memory 32, a CPU 33, an operation unit 37, and a security module circuit SM, which are connected via a data line 30.
Here, the interface 31 corresponds to the interface of the third invention, the memory 32 corresponds to the memory of the third invention, the security module circuit SM corresponds to the circuit module of the third invention, and the CPU 33 corresponds to the third module. This corresponds to the execution circuit of the invention.
In the present embodiment, the client device 12_1 is, for example, a computer, a PDA (Personal Digital Assistants), a mobile phone, or the like.

The interface 31 performs communication between the server device 10 and the client device 12_2 via the network 9.
The memory 32 stores the application program AP_C1.
The memory 32 stores an agent program AGENT_P1 as one of the application programs AP_C1.
The memory 32 is a semiconductor memory or a hard disk drive.
The security module circuit SM includes, for example, a memory 35 and an arithmetic circuit 36.
The security module circuit SM is a tamper-resistant circuit and has a function of preventing tampering and monitoring of data stored in the memory 35 and monitoring of processing of the arithmetic circuit 36.
A tamper-resistant circuit causes malfunction or leakage of internal data when an attack against the circuit from the outside (an attack that illegally reads internal data or sets the input frequency or input voltage outside of the specified range) is applied. The circuit is configured so as not to exist. Specifically, in order to prevent the reading of internal data, the circuit configuration has a multilayer structure, the memory is arranged at the lowest layer, and dummy layers (for example, aluminum layers) are incorporated in the upper and lower layers, so that the memory can be input from the outside. It is difficult to access the output I / F. In addition, a circuit frequency detection circuit and a voltage detection circuit are provided, and are configured not to operate when the frequency and voltage are not within a predetermined range.

The memory 35 stores secret key data SK_C1, public key data PK_C1, public key certification data PKC_C1, and identification data ID_C1 of the client device 12_1.
In addition, the memory 22 stores the public key data PK_S and the public key certification data PKC_S of the server device 10 through communication with the server device 10 or the like.
The memory 35 stores the public key data PK_C2 and the public key certification data PKC_C2 of the client device 12_2 through communication with the client device 12_2 or the like. The memory 35 stores public agent data AGENT_DP2 received from the client device 12_2.

  The operation unit 37 is an operation unit such as a keyboard, a mouse, or a touch panel, and outputs an operation signal corresponding to a user operation to the CPU 33.

  The CPU 33 performs various processes based on the boot program B_PRG, the application program AP_C1, and operation signals from the operation unit 37.

Further, the CPU 33 reads the boot program B_PRG in a secure state from the memory 35 in the security module circuit SM via the data line 30, and executes it.
The CPU 33 generates certification data AP_CER shown in FIG. 4 according to the boot program B_PRG, and transmits this to the server device 10 and the client device 12_2.
In order to realize reading in the secure state, the CPU 33 and the security module circuit SM share common encryption key data, encrypt the data on the data line 30, and the CPU 33 and the security module circuit SM. The data on the data line 30 is encrypted with the session key data shared with each other, the CPU 33 and the security module circuit SM are molded into one package, and the data on the data line 30 is transferred from the outside. For example, a method of preventing access is used.
In addition, in order to prevent the security module circuit SM from being incorporated into another client device, the client device 12_1 distributes and holds memory data (data such as IDs, random numbers, and keys) unique to the device, thereby providing security at startup. The module circuit SM may verify the memory data. Further, the boot mechanism of the CPU 33 is complicated by making the input / output operation to the interface 31 complicated, and only the licensed manufacturer knows the mechanism so that the boot program B_PRG can be read. The activation reliability may be further increased.

Further, the CPU 33 reads the application program AP_C1 from the memory 32 and executes it.
In the present embodiment, the CPU 33 reads the agent program AGENT_P1 from the memory 32 and executes it.
The CPU 33 generates public agent data AGENT_DP1 shown in FIG. 6 according to the agent program AGENT_P1, and transmits it to the server device 10 and the client device 12_2.
As shown in FIG. 6, the public agent data AGENT_DP1 is related to, for example, the identification data ID (Agent Software ID), manufacturing identification data (Agent Software Manufacture ID), version data, and the like of the agent program AGENT_P1. Information, agent data AGENT_D1, hash data HASH_D1 of agent data AGENT_D1, version of security module SM, and signature data SIGD of agent program AGENT_P1.
In accordance with the application program AP_C1, the CPU 33 generates hash data HASH_D1 of the agent data AGENT_D1, and generates public agent data AGENT_DP1 including the hash data HASH_D1.
The CPU 33 communicates with the server device 10 and the client device 12_2 using the hash data HASH_D1 as its own identification data.
Here, the agent data AGENT_D1 is data that is sequentially updated based on attribute data such as user preferences obtained by analyzing the user operation history of the client device 12_1, as will be described later.
Since the agent data AGENT_D1 is updated under a predetermined condition, the hash data HASH_D1 is also updated under a predetermined condition, so that it is possible to avoid long-term monitoring of the user operation of the client device 12_1.
Further, the hash data HASH_D1 has a very low probability that exactly the same data is generated as the agent data AGENT_D1, and therefore, the hash data HASH_D1 becomes a value unique to the client device 12_1 with a very high probability. Therefore, the hash data HASH_D1 can sufficiently function as identification data of the client device 12_1 in communication with the server device 10 and the client device 12_2.
The CPU 33 may determine whether or not to include identification data that can specify a device of the client device 12_1, for example, the security module circuit SM, in the public agent data AGENT_DP1, in accordance with an instruction from the user. .

The CPU 33 comprehensively controls the operation of the client device 12_1.
The processing performed by the CPU 33 will be described in association with an operation example of the client device 12_1.

Hereinafter, an operation in which the client device 12_1 illustrated in FIG. 5 generates the certification data AP_CER according to the boot program B_PRG will be described.
FIG. 7 is a flowchart for explaining an operation in which the client device 12_1 shown in FIG. 5 generates the certification data AP_CER.
Each step shown below is defined by the boot program B_PRG.
Step ST11:
When the client device 12_1 is activated, the arithmetic circuit 36 of the security module circuit SM reads the boot program B_PRG from the memory 35 and verifies the validity of the boot program B_PRG.
At this time, for example, the arithmetic circuit 36 generates hash data of the boot program B_PRG based on the hash function, and compares the generated hash data with the hash data of the boot program B_PRG prepared in advance. If they match, it is determined that the boot program B_PRG stored in the memory 35 is valid (not tampered).
Step ST12:
If it is determined in step ST11 that the boot program B_PRG is valid, the client device 12_1 proceeds to step ST13, and if not, performs error processing.

Step ST13:
The CPU 33 of the client device 12_1 reads the boot program B_PRG from the memory 35 through the data line 30 in a secure state.
Step ST14:
The CPU 33 executes the boot program B_PRG read in step ST13.
Step ST15:
In accordance with the boot program B_PRG, the CPU 33 selects an unselected application program AP_C1 among the plurality of application programs AP_C1 designated by the user. In the present embodiment, the agent program AGENT_P1 is designated as the application program AP_C1.

Step ST16:
The CPU 33 reads the application program AP_C1 selected in step ST15 from the memory 32 and verifies its validity.
At this time, for example, the CPU 33 generates hash data of the application program AP_C1 based on the hash function, compares the generated hash data with the hash data of the application program AP_C1 prepared in advance, and if they match, The application program AP_C1 stored in the memory 32 is determined to be valid.
Further, the CPU 33 may verify predetermined signature data associated with the application program AP_C1 based on public key data. The signature data may be added to the application program AP_C1, or may be stored in the memory 32 separately from the application program AP_C1.

Step ST17:
If the CPU 33 determines in step ST16 that the application program AP_C1 is valid, the process proceeds to step ST18, and if not, the process proceeds to step ST20. Step ST18:
The CPU 33 adds the identification data AP_ID, manufacturing identification data MF_ID, version data VER, and hash data HASH (hereinafter also simply referred to as identification data AP_ID) of the application program AP_C1 determined to be valid in step ST16 to the certification data AP_CER. To do.
Step ST19:
The CPU 33 activates the application program AP_C1 determined to be valid in step ST16.
In the present embodiment, the case where the application program AP_C1 is started is exemplified on the condition that the application program AP_C1 is determined to be valid in step ST16. However, in the case where the application program AP_C1 is not determined to be valid. Alternatively, the user may be notified of this, and the application program AP_C1 may be activated with the user's consent. However, in this case, the CPU 33 does not add the identification data AP_ID of the application program AP_C1 to the certification data AP_CER.
Step ST20:
The CPU 33 determines whether or not all application programs AP_C1 designated by the user have been selected in step ST15. If it is determined that the application program AP_C1 has been selected, the process ends. If not, the process returns to step ST15.
In this embodiment, if the agent program AGENT_P1 is valid, the CPU 33 activates the agent program AGENT_P1, and the identification data AP_ID is added to the certification data AP_CER.

Hereinafter, an operation example when the client apparatus 12_1 illustrated in FIG. 5 updates (generates) the public agent data AGENT_DP1 according to the agent program AGENT_P1 will be described.
FIG. 8 is a flowchart for explaining an operation example when the client device 12_1 shown in FIG. 5 updates (generates) the public agent data AGENT_DP1.
Each step shown in FIG. 8 is executed by the CPU 33 in accordance with the agent program AGENT_P1.
The following operation is executed in parallel with the operation of another application program AP_C1 such as a search engine, for example.

Step ST31:
The CPU 33 reads the agent data AGENT_D1 from the memory 32.
Step ST32:
The CPU 33 updates the operation history data of the user of the client device 12_1 based on the operation signal from the operation unit 37.
Then, the CPU 33 analyzes the updated operation history data and generates attribute data indicating attributes such as the user's preference.
The CPU 33 updates the current agent data AGENT_D1 based on the generated attribute data.

Step ST33:
Based on the counter value of a time counter (not shown), the CPU 33 determines whether or not a predetermined time has elapsed. If it is determined that the predetermined time has elapsed, the CPU 33 proceeds to step ST36, otherwise proceeds to step ST34.
In the present embodiment, the predetermined time is, for example, one week, one month, or three months.
Step ST34:
The CPU 33 determines whether the value indicated by the counter value of the update count counter (update count of step ST32), the degree of update of the attribute data (update amount), and whether the update frequency has exceeded a predetermined threshold value. If it is determined that the value has been exceeded, the process proceeds to step ST36.
Step ST35:
Based on the operation signal from the operation unit 37, the CPU 33 determines whether or not an update instruction for the public agent data AGENT_DP1 has been received from the user. If it is determined that the update instruction has been received, the process proceeds to step ST36. Returns to step ST32.

Step ST36:
The CPU 33 reads the public agent data AGENT_DP1 shown in FIG. 6 from the memory 32, and updates the agent data AGENT_D1 with the agent data AGENT_D1 updated in step ST32.
Step ST37:
The CPU 33 generates hash data HASH_D1 of the updated agent data AGENT_D1, and also generates hash data HASH_D1 of the updated agent data AGENT_D1.
Step ST38:
The CPU 33 updates the hash data HASH_D1 of the public agent data AGENT_DP1 with the hash data HASH_D1 generated in step ST37.

Step ST39:
The CPU 33 generates the signature data SIGD of the public agent data AGENT_DP1 updated in step ST38, and adds this to the public agent data AGENT_DP1 shown in FIG.
Step ST40:
The CPU 33 resets the counter values of the time counter and the update count counter.

Hereinafter, an operation example when the client device 12_1 illustrated in FIG. 5 communicates with the server device 10 will be described.
FIG. 9 is a flowchart for explaining an operation example when the client device 12_1 shown in FIG. 5 communicates with the server device 10.
Steps ST51 to ST54 shown below are defined by the boot program B_PRG.

Step ST51:
The CPU 33 of the client device 12_1 performs mutual authentication with the server device 10 via the interface 31 based on the secret key data SK_C1, the public key data PK_S, and the public key certification data PKC_S read from the memory 35 of the security module circuit SM. I do.
When the mutual authenticity is confirmed by the mutual authentication, the CPU 33 shares the session key data used for the subsequent communication with the server device 10 with the server device 10, and based on the session key data in the subsequent communication. Encrypt the data.
In the mutual authentication, the CPU 33 may authenticate the validity of the server device 10 based on an AC (Attribute Certificate) or URL (Uniform Resource Locator) of the server device 10. Here, AC is electronic data in which a predetermined certification authority (AC issuing authority) is linked to the identification data ID of the public key certification data to prove the functions and attributes of the issuer. This indicates that the server distributes data.
Step ST52:
CPU33 will progress to step ST53, if mutual validity is confirmed by the mutual authentication performed by step ST51, and if that is not right, it will complete | finish a process.

Step ST53:
The CPU 33 generates hash data of the certification data AP_CER generated through the processing described based on FIG. 7, and adds this to the certification data AP_CER as signature data SIG.
Step ST54:
The CPU 33 transmits the signed certificate data AP_CER and the public agent data AGENT_DP1 generated in step ST53 to the server device 10 via the interface 31.
Step ST55:
The CPU 33 communicates with the server device 10 using the hash data HASH_D1 in the public agent data AGENT_DP1 transmitted in step ST53 as its own identification data.
The CPU 33 uses data received from the server device 10 via the interface 31, for example, content data, in accordance with a predetermined application program AP_C1 or agent program AGENT_P1.
At this time, data transmission from the server device 10 to the client device 12_1 is performed based on the public agent data AGENT_DP1 transmitted from the client device 12_1 to the server device 10 as described above. It reflects attributes such as user preferences.

Note that the application program AP_C1 has, for example, a copyright protection function, and the copyright of the content data is protected by this function.
In the above-described embodiment, the case where the CPU 33 performs the authentication process and the generation process of the signature data SIG based on the boot program B_PRG read from the security module circuit SM is illustrated. The arithmetic circuit 36 may perform the processing.
In this case, the client device 12_1 provides data necessary for authentication among the data received from the server device 10 to the security module circuit SM. Then, the arithmetic circuit 36 of the security module circuit SM performs arithmetic processing based on the data, and transmits the result to the server device 10 via the interface 31. Further, the arithmetic circuit 36 of the security module circuit SM generates the signature data SIG of the certification data AP_CER, and transmits the certification data AP_CER added with the signature data SIG to the server 10 via the interface 31.

Hereinafter, an operation example when the client apparatus 12_1 illustrated in FIG. 5 performs communication with the client apparatus 12_2 illustrated in FIG. 1 will be described.
FIG. 10 is a flowchart for explaining an operation example when the client apparatus 12_1 illustrated in FIG. 5 performs communication with the client apparatus 12_2 illustrated in FIG.
Steps ST61 to ST67 shown in FIG. 10 are executed according to the boot program B_PRG, and steps ST68 to ST71 are executed according to the agent program AGENT_P1.
Step ST61:
The CPU 33 of the client device 12_1 performs mutual authentication with the client device 12_2 via the interface 31 based on the secret key data SK_C1, the public key data PK_C2, and the public key certification data PKC_C2 read from the memory 35 of the security module circuit SM. I do.
When the mutual authenticity is confirmed by the mutual authentication, the CPU 33 shares the session key data used for the subsequent communication with the client device 12_2 with the client device 12_2, and based on the session key data in the subsequent communication. Encrypt the data.
In the present embodiment, the public key data PK_2 and the public key certification data PKC_2 are stored in the memory 35, but may be received from the client device 12_2 prior to authentication.
Step ST62:
CPU33 will progress to step ST63, if mutual validity is confirmed by the mutual authentication performed by step ST61, and when that is not right, it will complete | finish a process or will perform an error process.

Step ST63:
The CPU 33 generates hash data of the certification data AP_CER generated through the processing described with reference to FIG. 7, and adds this to the certification data AP_CER1 as signature data SIG.
Step ST64:
The CPU 33 transmits the signed certification data AP_CER1 generated in step ST63 to the client device 12_2 via the interface 31.
Step ST65:
The CPU 33 receives the certification data AP_CER2 with the signature data SIG generated by the client apparatus 12_2 performing the same process as described with reference to FIG. 7 from the client apparatus 12_2 via the interface 31.
As described above, the certification data AP_CER2 is activated by the client device 12_2, and the identification data AP_ID, manufacturing identification data MF_ID, version VER, and hash data HASH of the application program AP_C2 whose validity has been confirmed as shown in FIG. Are shown in association with each other.

Step ST66:
The CPU 33 verifies the validity of the certification data AP_CER2 received in step ST64.
At this time, for example, the CPU 33 generates hash data of the certification data AP_CER2 based on the hash function. Then, the CPU 33 determines whether or not the generated hash data matches the signature data SIG. If they match, the CPU 33 determines that the certification data AP_CER2 is a legitimate one that has not been tampered with.
If the CPU 33 determines that the certification data AP_CER2 is valid, the process proceeds to step ST67. If not, the CPU 33 ends the process or performs error processing.

Step ST67:
The CPU 33 determines whether or not the identification data AP_ID of the application program AP_C2 designated by the user is included in the certification data AP_CER2 received in step ST65, and the identification data AP_ID is included (in the client device 12_2) If it is determined that the validity of the application program AP_C2 is confirmed and activated), the process proceeds to step ST68. If not, the process is terminated or an error process is performed.
In this step, the CPU 33 may determine whether the manufacturing identification data MF_ID and the version data VER are desired in addition to the identification data AP_ID.

Step ST68:
For example, the CPU 33 transmits the public agent data AGENT_DP1 generated by the procedure shown in FIG. 8 to the client device 12_2 via the interface 31 in accordance with the already started agent program AGENT_P1.
The interface 31 receives the public agent data AGENT_DP2 generated by the client device 12_1 from the client device 12_2.

Step ST69:
The CPU 33 verifies the validity of the signature data SIGD attached to the public agent data AGENT_DP2 received in step ST68.
If the CPU 33 determines that the signature data SIGD is valid, the process proceeds to step ST70. If not, the process is terminated or an error process is performed.
Step ST70:
The CPU 33 registers the hash data HASH_D2 included in the public agent data AGENT_DP2 received in step ST68 as identification data of the client device 12_2.
The hash data HASH_D2 is generated by the client device 12_2 in the same manner as the client device 12_1 described above generates the hash data HASH_D1.

Step ST71:
The CPU 33 communicates with the client device 12_2 using the hash data HASH_D1 as identification data of the client device 12_1 and using the hash data HASH_D2 registered in step ST70 as identification data of the client device 12_1.
For example, the CPU 33 encrypts data such as predetermined content data in accordance with the agent program AGENT_P1, and transmits the encrypted data to the client device 12_2 via the interface 31.
At this time, based on the public agent data AGENT_DP2 received in step ST68, the CPU 33 transmits data suitable for characteristics such as user preferences of the client device 12_1 to the client device 12_2.
For example, the CPU 33 determines whether the user of the client device 12_2 uses mail, chat, voice mail, or a telephone call based on the public agent data AGENT_DP2, and uses a medium with high use frequency. May communicate with the user.
The CPU 33 uses data such as content data received from the client device 12_2 via the interface 31.

  The client device 12_2 has the same configuration as the client device 12_1 described above.

Hereinafter, an example of the overall operation of the communication system 1 shown in FIG. 1 will be described.
The client apparatuses 12_1 and 12_2 perform the process shown in FIG. 7 and write the certification data AP_CER and AP_CER2 in the memory 35 in the security module circuit SM shown in FIG. 5 of the client apparatuses 12_1 and 12_2, respectively.
Each of the client devices 12_1 and 12_2 generates public agent data AGENT_DP1 and AGENT_DP2 indicating attributes such as user preferences by performing the processing shown in FIG.
Then, the client devices 12_1 and 12_2 transmit the public agent data AGENT_DP1 and AGENT_DP2 to the server device 10.
The server device 10 identifies the client device 12_1 based on the hash data HASH_D1 in the public agent data AGENT_DP1, and various services adapted to characteristics such as user preferences of the client device 12_1 based on the agent data AGENT_D1. Data, for example, content data is transmitted to the client device 12_1 via the interface 21.
In addition, the server device 10 identifies the client device 12_2 based on the hash data HASH_D2 in the public agent data AGENT_DP2, and various service data, for example, content data, adapted to characteristics such as user preferences of the client device 12_2 Is transmitted to the client apparatus 12_2 through the interface 21.
On the other hand, when communicating with the client device 12_2, the client device 12_1 transmits the public agent data AGENT_DP1 to the client device 12_2 and receives the public agent data AGENT_DP2 from the client device 12_2.
Then, the client device 12_1 makes the client device 12_2 identify itself based on the hash data HASH_D1, and identifies the client device 12_2 based on the hash data HASH_D2, and communicates with the client device 12_2.
In addition, the client device 12_1 transmits data to the client device 12_2 in a form adapted to the data such as the user preference of the client device 12_2 or a suitable form based on the public agent data AGENT_DP2.

As described above, in the communication system 1, the client devices 12_1 and 12_2 communicate with the server device 10 using the hash data HASH_D1 and HASH_D2 updated under a predetermined condition as their own identification data.
Therefore, even if the user operation (behavior) of the client devices 12_1 and 12_2 is monitored on the network 9 based on the hash data HASH_D1 and HASH_D2, the monitoring may be continued after the hash data HASH_D1 and HASH_D2 are updated. Can not. Therefore, it is possible to prevent the user's operation of the client devices 12_1 and 12_2 from being continuously monitored for a long time, and to protect the user's privacy.

Moreover, according to the communication system 1, the server apparatus 10 can implement | achieve an agent function with little burden, without hold | maintaining operation history data of each user.
Further, according to the communication system 1, it is possible to perform smooth communication using the agent function between the client apparatuses 12_1 and 12_2 with a small burden from the viewpoint of storage capacity and processing.
For example, when data is exchanged with the client apparatuses 12_1 and 12_2, data suitable for the preference of the other party can be transmitted.

Further, according to the communication system 1, each of the client devices 12_1 and 12_2 verifies the validity of the application programs AP_C1 and AP_C2 that it starts, and transmits certification data AP_CER1 and AP_CER2 indicating the results to the server device 10.
Therefore, the server device 10 does not need to hold all the hash data of the application programs executed by the client devices 12_1 and 12_2, and does not need to perform verification processing of the validity. Therefore, it is possible to reduce the load on the server apparatus 10 due to the determination of the validity of the application program activated on the client apparatuses 12_1 and 12_2.

Further, according to the communication system 1, in the client devices 12_1 and 12_2, as shown in FIG. 5, the boot program B_PRG for generating the above-described certification data AP_CER is stored in the certification data AP_CER1 and AP_CER2, and Is read out to the CPU 33 in a secure state via the data line 30, so that the reliability of the certification data AP_CER can be improved.
Further, according to the communication system 1, the server apparatus 10 performs mutual authentication with the client apparatuses 12_1 and 12_2, receives the proof data AP_CER with the signature, and verifies the signature data SIG. Therefore, it is possible to determine the legitimacy of the application program activated on the client devices 12_1 and 12_2 with high reliability.

  Further, according to the communication system 1, not only between the server device 10 and the client devices 12_1 and 12_2 but also when content data is transmitted and received between the client devices 12_1 and 12_2, one of the client devices 12_1 and 12_2. Can determine the legitimacy of the application program activated on the other side with a small load.

  The mutual authentication described above is not limited to public key authentication, and any authentication method may be used as long as it is a method or system capable of mutual authentication.

  The present invention is applicable to a system that performs communication between computers.

FIG. 1 is an overall configuration diagram of a communication system according to an embodiment of the present invention. FIG. 2 is a configuration diagram of the server apparatus shown in FIG. FIG. 3 is a flowchart for explaining an operation example when the server apparatus shown in FIG. 2 communicates with the client apparatus. FIG. 4 is a diagram for explaining proof data according to the embodiment of the present invention. FIG. 5 is a block diagram of the client device shown in FIG. FIG. 6 is a diagram for explaining public agent data AGENT_DP in the embodiment of the present invention. FIG. 7 is a flowchart for explaining an operation in which the client device shown in FIG. 5 generates the certification data AP_CER. FIG. 8 is a flowchart for explaining an operation example in which the client device shown in FIG. 5 generates public agent data AGENT_DP. FIG. 9 is a flowchart for explaining an operation example when the client device shown in FIG. 5 communicates with the server device. FIG. 10 is a flowchart for explaining an operation example when the client apparatus 12_1 shown in FIG. 5 communicates with the client apparatus 12_2 shown in FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Communication system, 10 ... Server apparatus, 12_1, 12_2 ... Client apparatus, 20 ... Data line, 21 ... Interface, 22 ... Memory, 23 ... CPU, 30 ... Data line, 31 ... Interface, 32 ... Memory, 33 ... CPU , SM ... security module circuit, 35 ... memory, 36 ... arithmetic circuit, AP_S, AP_C1 ... application program, B_PRG ... boot program, AP_CER ... certification data, AGENT_DP1 ... public agent data, AGENT_D ... agent data, AGENT_P1 ... Agent program, HASH_D1, HASH_D2 ... Hash data

Claims (14)

A program executed by a computer that communicates with a communication destination,
A first procedure for generating hash data of communication data used in communication with the computer and updated under a predetermined condition;
A second procedure of adding the hash data generated in the first procedure to the communication data and transmitting it to the communication destination;
A program that causes the computer to execute a third procedure for communicating with the communication destination using the hash data generated in the first procedure as identification data of the computer after the second procedure. A fourth procedure for updating the communication data under the predetermined condition;
The first procedure generates a hash data of the communication data after the update according to the fourth procedure,
The program according to claim 1, wherein the third procedure communicates with the communication destination by using the hash data of the updated communication data as identification data of the computer. The program according to claim 1, further comprising: a fifth procedure for generating the communication data. The program according to claim 3, wherein the fifth procedure generates the communication data indicating an attribute of the user based on an operation history of the computer by the user. The program according to claim 4, wherein the first procedure generates the communication data indicating the attribute serving as an index for determining the user's preference based on the operation history. A program executed by a computer that communicates with a communication destination,
A first procedure in which communication data updated under a predetermined condition and hash data of the communication data are associated with each other and received from the communication destination;
A second procedure for identifying the communication destination based on the hash data received in the first procedure and communicating with the communication destination based on the communication data received in the first procedure; A program to be executed by a computer. The first procedure receives the communication data indicating the attribute of the user obtained based on the operation history of the user of the communication destination,
7. The second procedure transmits data to the communication destination in a data conforming to the user attribute or in a conformed form based on the communication data received in the first procedure. Program. A third procedure for authenticating the authenticity of the communication destination;
On the condition that it is authenticated as valid in the third procedure, certification data indicating identification data of an application program that is judged valid by the communication destination and started at the communication destination is received from the communication destination. A fourth procedure;
A fifth procedure for determining whether desired identification data is included in the proof data received in the fourth procedure;
The program according to claim 6, further comprising: a sixth procedure that causes the second procedure to be executed on the condition that it is determined that the desired identification data is included in the fifth procedure. A memory storing application programs;
An execution circuit for executing the application program read from the memory;
A computer having a communication destination and an interface for exchanging data,
The execution circuit generates hash data of communication data used for communication with the computer at the communication destination and updated under a predetermined condition in accordance with the application program, and the generated hash data is used as the communication data. A computer that transmits to the communication destination via the interface and communicates with the communication destination using the hash data as identification data of the computer. A function module for preventing falsification and monitoring of stored data, and a circuit module for storing a boot program;
The execution circuit further executes the boot program read in a secure state from the circuit module, verifies the validity of the application program according to the boot program, and determines that the application is valid. 10. The computer according to claim 9, wherein proof data indicating program identification data is stored in the circuit module, and the proof data read from the circuit module is transmitted to the communication destination via the interface. A computer that communicates with a communication destination,
A memory for storing the program;
An interface that receives communication data updated under a predetermined condition and hash data of the communication data in association with the communication destination;
Executes the program read from the memory, identifies the communication destination based on the hash data received by the interface according to the program, and communicates with the communication destination based on the communication data received by the interface And a computer having an execution circuit. The interface receives certification data indicating identification data of an application program that is activated at the communication destination and validated by the other content data from the communication destination,
The execution circuit determines whether or not desired identification data is included in the certification data received via the interface on the condition that the communication destination is authenticated according to the program. The computer according to claim 11, wherein communication is performed with the communication destination via the interface on condition that it is determined that desired identification data is included. A data processing method executed by a computer that communicates with a communication destination,
A first step of generating hash data of communication data used at the communication destination for communication with the computer and updated under a predetermined condition;
A second step of adding the hash data generated in the first step to the communication data and transmitting it to the communication destination;
A data processing method comprising: a third step of communicating with the communication destination using the hash data generated in the first step as identification data of the computer after the second step. A data processing method executed by a computer that communicates with a communication destination,
A first step of receiving communication data updated under a predetermined condition and hash data of the communication data in association with the communication destination;
A second step of identifying the communication destination based on the hash data received in the first step and communicating with the communication destination based on the communication data received in the first step. Data processing method.

Images