JP2006191491A - Information processing apparatus and method, program, and storage medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an information processing apparatus and a method thereof which detect alteration of the program, and a program and a storage medium,. <P>SOLUTION: The information processing apparatus 10 includes: an encryption data generation part for generating encryption data of a program, which detects alteration of the program; and a file generation part for generating a program file obtained by adding the encryption data to the program. The information processing apparatus 20 includes: an input part for inputting the program file having the encryption data added thereto; and a verification part for verifying whether the program has been altered on the basis of the program and the encryption data. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an information processing apparatus and method using encrypted data of a program, a program, and a storage medium.

  In recent years, information processing apparatuses that digitize and store optical images of subjects have been put into practical use. Image data taken with a digital camera, which is one of them, can be easily taken into a computer, but has a problem that it can be easily falsified (modified) on a computer. For this reason, there has been a problem that image data taken with a digital camera is less reliable than a silver halide photograph and has poor evidence ability. Therefore, in recent years, a falsification detection system having a function of adding a digital signature to image data captured by a digital camera and verifying whether the information has been falsified has been proposed (Patent Document 1 and Patent Document 2). See).

On the other hand, many information processing apparatuses such as digital cameras have functions that can update programs of these information processing apparatuses (for example, firmware update functions, etc.) in order to cope with functions that advance day by day. ing. Update programs are often distributed in the form of electronic files, and users can update to the latest functions without replacing the information processing device by updating the firmware using the electronic files. It has become.
US Pat. No. 5,499,294 Japanese Patent Application Laid-Open No. 9-2000730

However, since the upload program is distributed in the form of an electronic file, there is a problem that it can be falsified relatively easily. In particular, in a falsification detection system that detects whether falsification information has been falsified, the program of the falsification detection system itself should not be falsified in order to ensure the reliability of output information.
On the other hand, Patent Document 1 and Patent Document 2 detect falsification of video data generated by a video input device such as a digital camera, and whether or not the program of the video input device such as a digital camera has been falsified. Could not be detected.

  The present invention has been made in view of the above-described problems, and an object of the present invention is to provide an information processing apparatus and method for detecting falsification of a program, a program, and a storage medium.

A first aspect of the present invention relates to an information processing apparatus, an encrypted data generation unit that generates encrypted data of the program for detecting falsification of the program, and a program in which the encrypted data is added to the program And a file generation unit for generating a file.
A second aspect of the present invention relates to an information processing apparatus, wherein the program is based on an input unit that inputs a program file in which encrypted data of the program is added to the program, and the program and the encrypted data. And a verification unit that verifies whether or not tampering has occurred.
A third aspect of the present invention relates to an information processing method, an encrypted data generation step of generating encrypted data of the program for detecting falsification of the program, and a program in which the encrypted data is added to the program And a file generation step for generating a file.
A fourth aspect of the present invention relates to an information processing method, wherein the program is based on an input step of inputting a program file in which encrypted data of the program is added to the program, and the program and the encrypted data. And a verification step for verifying whether or not tampering has occurred.
According to a fifth aspect of the present invention, there is provided a program, wherein the information processing method is executed.
A sixth aspect of the present invention relates to a storage medium, and stores a program for executing the information processing method.

  An information processing apparatus and method for detecting falsification of a program, a program, and a storage medium can be provided.

[First embodiment]
A first embodiment suitable for the present invention will be described below with reference to the drawings. FIG. 1 is a diagram illustrating a configuration example of a system according to the first embodiment.

  In order to detect falsification of the program, the program generation device 10 adds encrypted data (digital signature) obtained by encrypting the program to the program, and generates a program file with a digital signature. The program generation device 10 may be a computer or an electronic device other than a computer.

  The information processing apparatus 20 verifies whether or not the program has been tampered with using the digital signature added to the program by the program generation apparatus 10. The information processing device 20 may be an imaging device such as a digital camera, a digital video camera, or a scanner, or may be an electronic device having a camera unit. Furthermore, it may be an electronic device such as a facsimile machine having an image reading unit and a copying machine.

  FIG. 2 is a block diagram illustrating the main functional configuration of the program generation apparatus 10 according to the preferred embodiment of the present invention.

  The program generation unit 201 generates a program for controlling the information processing apparatus 20. For example, the program generation unit 201 translates the source program into a program that can be decoded by the information processing apparatus 20.

  The hash function calculation unit 202 uses the hash function H to generate a hash value (digest data) of the program. The hash function H may be any one of MD-2MD-5, SHA-1, RIPEMD-128, and RIPEMD-160, or may be another hash function.

  The memory 203 stores a unique ID 205 (information such as a manufacturing number and a serial number that can uniquely identify the program generation device 10 or the information processing device 20) that is information unique to the program generation device 10 or the information processing device 20. To do. The memory 203 stores a secret key Ks for generating a digital signature of the program generated by the program generation device 10.

  The signature generation unit 204 performs arithmetic processing on the digest data generated by the hash function calculation unit 202 using the secret key Ks stored in the memory 203, and generates a digital signature as encrypted data of the program.

  The file generation unit 206 adds the digital signature generated by the signature generation unit 204 to the program generated by the program generation apparatus 10 to generate a program file with a digital signature. For example, the digital signature may be added to the header portion or footer portion of the program, or may be embedded in the program so as not to affect the operation of the program.

  FIG. 3 is a block diagram illustrating the main functional configuration of the information processing apparatus 20 according to the preferred embodiment of the present invention.

  The media control unit 301 functions as an input unit that reads a program file with a digital signature stored in the removable medium 310 and inputs the program file with a digital signature to the information processing apparatus 20.

  The storage unit 302 stores the program file with the digital signature read from the removable medium 310 and the table T1. The table T1 is a management table that manages one or a plurality of unique IDs and the public key Kp corresponding to each unique ID.

  The hash function calculation unit 303 uses the hash function H to generate a hash value (digest data) of the program included in the program file with a digital signature.

  The arithmetic processing unit 305 performs arithmetic processing on the digital signature included in the program file with the digital signature using the public key Kp, and generates digest data.

  The verification unit 306 verifies whether the program has been tampered with based on the digital signature included in the program file with a digital signature.

  The program update unit 307 updates the program included in the program file with the digital signature based on the program update program provided via the interface unit 309 or the removable medium 310. The program update program is preferably a digital signature-added program with a digital signature, like the digital signature-added program file. Accordingly, when the program is updated a plurality of times, the verification unit 306 verifies whether the updated program is falsified a plurality of times based on the digital signature included in the provided program update program. can do.

  The control unit 308 executes a program stored in the memory 302 and controls the operation of each component of the information processing apparatus 20.

  The interface unit 309 functions as an input unit that receives the digitally signed program transmitted to the information processing apparatus 20 through the line 311 and inputs the digitally signed program file to the information processing apparatus 20.

  The output unit 312 outputs the execution result of the program executed by the control unit 308.

  FIG. 4 is a diagram for explaining the processing procedure of the system in the first embodiment.

  In step S <b> 401, the program generation unit 201 of the program generation device 10 generates a program, and supplies the generated program to the hash function calculation unit 202 and the program file generation unit 206.

  In step S <b> 402, the hash function calculation unit 202 generates a hash value of the program generated by the program generation unit 201 using the hash function H, and supplies the generated hash value to the signature generation unit 204.

  In step S403, the signature generation unit 204 calculates the hash value (digest data) generated by the hash function calculation unit 202 using the secret key Ks, and generates a digital signature of the program. The signature generation unit 204 supplies the generated digital signature to the program file generation unit 206.

  In step S404, the program file generation unit 206 includes a digital signature generated by the signature generation unit 204, a unique ID 205 stored in the memory 203, and a program generated by the program generation unit 201. Generate a file.

  In step S405, the program file with the digital signature generated in step S404 is input to the information processing apparatus 20 via the removable medium 310 or the interface unit 309. When a program file with a digital signature is input to the information processing apparatus 20 via the removable medium 310, the media control unit 301 reads the program file with a digital signature from the removable medium 310, and stores the read program file with a digital signature in the storage unit 302. To store. On the other hand, when a program file with a digital signature is input to the information processing apparatus 20 via the interface unit 309, the interface unit 309 receives the program file with a digital signature transmitted to the information processing apparatus 20 through the line 311 and receives it. The program file is stored in the storage unit 302.

  In step S406, the arithmetic processing unit 305 refers to the table T1 in the memory 302 and acquires the public key Kp corresponding to the unique ID. An example of the table T1 is shown in FIG. For example, when the unique ID is “001”, the public key Kp corresponding to the unique ID is “0x3333”. In this way, the information processing apparatus 20 obtains the public key Kp from the unique ID.

  In step S407, the arithmetic processing unit 305 performs arithmetic processing on the digital signature included in the program file with the digital signature using the public key Kp to restore the digest data.

  In step S408, the hash function calculation unit 303 calculates the program included in the program file with the digital signature using the hash function H, and generates digest data of the program.

  In step S409, the verification unit 306 compares the digest data restored by the calculation processing unit 305 with the digest data generated by the hash function calculation unit 303 to verify whether the program has been tampered with. If the digest data restored by the arithmetic processing unit 305 and the digest data generated by the hash function arithmetic unit 303 do not match, the verification unit 306 determines that the program has been tampered with, and the arithmetic processing unit 305 restores the digest data. If the digest data matches the digest data generated by the hash function calculation unit 303, it is determined that the program has not been tampered with. When the verification unit 306 determines that the digitally signed program file has been tampered with, the verification result determined to be “tampered” is stored in the storage unit 302. When the verification unit 306 determines that the program file with the digital signature has not been tampered with, the verification result determined as “no tampering” is stored in the storage unit 302.

  In step S410, the program update unit 307 updates the program based on the verification result stored in the storage unit 302. For example, the program update unit 307 updates the program when the verification result determined as “no tampering” is stored in the storage unit 302, and the verification result determined as “tampered” in the storage unit 302. Can be controlled by the control unit 308 so that the program is not updated. As described above, when the program has been tampered with, it is possible to restrict the use of the information processing apparatus 20 by using an unauthorized program by prohibiting the update of the program.

  As described above, according to the system in the first embodiment, it is possible to verify whether or not the program generated by the program generation device 10 has been tampered with by the information processing device 20, and update the program. Whether or not can be switched.

  In this embodiment, the method of not updating the program is illustrated when the verification unit 306 determines that “tampered”, but for example, when the verification unit 306 determines “tampered” Alternatively, the program may be updated so that the function of the program is limited. As described above, when a program has been tampered with, it is possible to restrict functions that are not desired to be used illegally by limiting the functions of the programs that can be used.

  If the program has been tampered with, the information output by the output unit 312 may be added with information “with tampering” or may be embedded. In this way, if the program has been tampered with, use of an unauthorized program can be performed by adding or embedding information indicating that the program has been tampered with to the information output from the output unit of the information processing apparatus. It can be left as evidence in the output information.

  When generating a digital signature of a program, a digital signature of the entire program may be generated, or a digital signature of a part of the program may be generated. When generating a digital signature of a part of the program, it is preferable to digitally sign the main part of the program. Thus, for example, in the same manner as in the above-described embodiment, it is verified whether or not the main part of the program has been falsified. If the main part of the program has been falsified, the program is not updated or the program is not updated. If the main part of the program has not been tampered with, the program can be updated.

  In this embodiment, digital signature data is used as verification data. However, the present invention is not limited to this. For example, MAC data may be used as verification data.

  In this case, in the program generation device, MAC data is generated by performing an operation using the program and the secret key Ks generated from the secret information A and the secret information B, and a program with verification data is generated using this data. You can create a file. As such an operation, an arithmetic process using an encryption algorithm may be considered for the digest data of the program. In this case, the secret key Ks can be used as key data.

  On the other hand, the information processing apparatus extracts MAC data from the program file with verification data, compares this data with the MAC data generated by performing the same operation as the program generation apparatus on the program, and detects falsification. . When the two MAC data match, the verification unit determines that the program file with verification data has not been tampered with. When the two MAC data match, the verification file with the verification data It can be determined that tampering has occurred. When the MAC data is used as verification data, the program generation device and the information processing device share the secret key Ks in secret.

[Second Embodiment]
Hereinafter, a preferred second embodiment of the present invention will be described with reference to the drawings. FIG. 3 is a block diagram illustrating the main functional configuration of the information processing apparatus 20 according to the preferred embodiment of the present invention.

  The media control unit 701 functions as an input unit that reads a program file with a digital signature stored in the removable medium 310 and inputs the program file with a digital signature to the information processing apparatus 20.

  The storage unit 702 stores a program file with a digital signature read from the removable medium 310.

  The hash function calculation unit 703 uses the hash function H to generate a hash value (digest data) of the program included in the program file with a digital signature.

  The signature generation unit 705 performs an arithmetic process on the digest data generated by the hash function calculation unit 703 with the secret key Ks, and generates a digital signature of the program included in the program file with a digital signature.

  The verification unit 706 verifies whether the program has been tampered with based on the digital signature included in the program file with the digital signature.

  The program update unit 707 updates a program included in the digitally signed program file based on a program update program provided via the interface unit 709 or the removable medium 710. The program update program is preferably a digital signature-added program with a digital signature, like the digital signature-added program file. Accordingly, when the program is updated a plurality of times, the verification unit 706 verifies whether the updated program is falsified a plurality of times based on the digital signature included in the provided program update program. can do.

  The control unit 708 executes a program stored in the memory 702 and controls the operation of each component of the information processing apparatus 20.

  The interface unit 709 functions as an input unit that receives the digitally signed program transmitted to the information processing apparatus 20 through the line 710 and inputs the digitally signed program file to the information processing apparatus 20.

  The output unit 711 outputs the execution result of the program executed by the control unit 706.

  FIG. 8 is a diagram for explaining the processing procedure of the system according to the second embodiment.

  In step S801, the program generation unit 201 of the program generation apparatus 10 illustrated in FIG. 2 generates a program, and supplies the generated program to the hash function calculation unit 202 and the program file generation unit 206.

  In step S <b> 802, the hash function calculation unit 202 generates a hash value of the program generated by the program generation unit 201 using the hash function H, and supplies the generated hash value to the signature generation unit 204.

  In step S803, the signature generation unit 204 calculates the hash value (digest data) generated by the hash function calculation unit 202 using the secret key Ks, and generates a digital signature of the program. The signature generation unit 204 supplies the generated digital signature to the program file generation unit 206.

  In step S804, the program file generation unit 206 generates a digital signature-added program file including the digital signature generated by the signature generation unit 204 and the program generated by the program generation unit 201.

  In step S805, the program file with the digital signature generated in step S804 is input to the information processing apparatus 20 via the removable medium 310 or the interface unit 709. When a program file with a digital signature is input to the information processing apparatus 20 via the removable medium 310, the media control unit 701 reads the program file with a digital signature from the removable medium 310, and stores the read program file with a digital signature in the storage unit 702. To store. On the other hand, when a program file with a digital signature is input to the information processing device 20 via the interface unit 709, the interface unit 709 receives the program file with a digital signature transmitted to the information processing device 20 through the line 710 and receives it. The program file is stored in the storage unit 702. Further, the digital signature added to the program file is supplied to the verification unit 706.

  In step S806, the hash function computing unit 703 computes the program included in the program file with the digital signature using the hash function H, generates a hash value (digest data) of the program, and generates the generated hash value ( (Digest data) is supplied to the signature generation unit 705.

  In step S807, the signature generation unit 705 performs an arithmetic process on the digest data generated by the hash function calculation unit 703 using the secret key Ks, and generates a digital signature of the program. The signature generation unit 204 supplies the generated digital signature to the verification unit 706.

  In step S808, the verification unit 706 compares the digital signature generated by the signature generation unit 705 with the digital signature added to the program file to verify whether the program has been tampered with. The verification unit 706 determines that the program has been tampered with if the digital signature generated by the signature generation unit 705 and the digital signature added to the program file do not match, and the digital signature generated by the signature generation unit 705 And the digital signature added to the program file match, it is determined that the program has not been tampered with. When the verification unit 706 determines that the program file with the digital signature has been tampered with, the verification result determined to be “tampered” is stored in the storage unit 702. If the verification unit 706 determines that the program file with a digital signature has not been tampered with, the verification result determined as “no tampering” is stored in the storage unit 702.

  In step S809, the program update unit 707 updates the program based on the verification result stored in the storage unit 702. For example, the program update unit 707 updates the program when the verification result determined as “no tampering” is stored in the storage unit 702, and the verification result determined as “tampered” in the storage unit 702. Can be controlled by the control unit 708 so that the program is not updated.

  As described above, according to the system in the second embodiment, the processes in steps S801 to S803 and the processes in steps S806 to S808 are substantially the same. Is applied to the function of generating a digital signature of the program when the information processing apparatus 20 verifies the program for falsification, so that the falsification of the program can be detected without adding a special function. .

[Other Embodiments]
Note that the present invention can be applied to a system including a plurality of devices (for example, a host computer, an interface device, a reader, an imaging device, an electronic device, etc.), and a device (for example, a digital camera, a digital device, etc.) The present invention may be applied to an imaging apparatus such as a video camera and a scanner, an electronic apparatus such as a facsimile apparatus and a copying machine).

  Another object of the present invention is to supply a storage medium storing software program codes for implementing the functions of the above-described embodiments to a system or apparatus, and the computer (or CPU or MPU) of the system or apparatus stores the storage medium. Needless to say, this can also be achieved by reading and executing the program code stored in the.

  In this case, the program code itself read from the storage medium realizes the functions of the above-described embodiments, and the storage medium storing the program code constitutes the present invention.

  As a storage medium for supplying the program code, for example, a floppy (registered trademark) disk, hard disk, optical disk, magneto-optical disk, CD-ROM, CD-R, magnetic tape, nonvolatile memory card, ROM, or the like is used. be able to.

  Further, by executing the program code read by the computer, not only the functions of the above-described embodiments are realized, but also an OS (operating system) operating on the computer based on the instruction of the program code. It goes without saying that a case where the function of the above-described embodiment is realized by performing part or all of the actual processing and the processing is included.

  Further, after the program code read from the storage medium is written into a memory provided in a function expansion board inserted into the computer or a function expansion unit connected to the computer, the function expansion is performed based on the instruction of the program code. It goes without saying that the CPU or the like provided in the board or the function expansion unit performs part or all of the actual processing, and the functions of the above-described embodiments are realized by the processing.

  As described above, according to the system in the embodiment of the present invention, in an information processing apparatus having a program falsification detection function, whether or not a program has been falsified using the falsification detection function at the time of program update is verified. Thus, it is possible to switch whether or not to execute the program update.

It is a figure which shows one structural example of the system which concerns on suitable embodiment of this invention. It is a figure which shows the main functional structural examples of the program production | generation apparatus which concerns on suitable embodiment of this invention. It is a figure which shows the main function structural examples of the information processing apparatus which concerns on suitable 1st Embodiment of this invention. It is a figure which shows the process sequence of the system which concerns on suitable 1st Embodiment of this invention. It is a figure which shows an example of the table which concerns on suitable 1st Embodiment of this invention. It is a figure which shows the main functional structural examples of the information processing apparatus which concerns on suitable 2nd Embodiment of this invention. It is a figure which shows the process sequence of the system which concerns on suitable 2nd Embodiment of this invention.

Claims (12)

An encrypted data generation unit for generating encrypted data of the program for detecting falsification of the program;
A file generation unit for generating a program file in which the encrypted data is added to the program;
An information processing apparatus comprising: An input unit for inputting a program file in which encrypted data of the program is added to the program;
A verification unit that verifies whether the program has been tampered with based on the program and the encrypted data;
An information processing apparatus comprising: A program update unit for updating the program;
The program update unit updates the program when the verification unit determines that the program has not been tampered with, and the program update unit determines that the program has been tampered with by the verification unit. The information processing apparatus according to claim 2, wherein the information processing apparatus is not updated. A program update unit for updating the program;
The program update unit updates the program when the verification unit determines that the program has not been tampered with, and the program update unit determines that the program has been tampered with by the verification unit. The information processing apparatus according to claim 2, wherein the program is updated so that the functions of the information processing apparatus are restricted. A storage unit for storing a verification result by the verification unit;
An output unit for outputting an execution result of the program;
Further comprising
The information processing apparatus according to claim 2, wherein the output unit adds the verification result stored in the storage unit to the execution result and outputs the result. An encrypted data generation step for generating encrypted data of the program for detecting falsification of the program;
A file generation step of generating a program file in which the encrypted data is added to the program;
An information processing method comprising: An input step of inputting a program file in which encrypted data of the program is added to the program;
A verification step of verifying whether the program has been tampered with based on the program and the encrypted data;
An information processing method comprising: A program update step for updating the program after the verification step;
In the program update step, the program is updated when it is determined in the verification step that the program has not been tampered with, and when it is determined in the verification step that the program has been tampered with, the program The information processing method according to claim 7, wherein the information is not updated. A program update step for updating the program after the verification step;
In the program update step, the program is updated when it is determined in the verification step that the program has not been tampered with, and when it is determined in the verification step that the program has been tampered with, the program The information processing method according to claim 7, wherein the program is updated so as to limit a function of the information processing method. A storage step for storing a verification result in the verification step;
An output step for outputting an execution result of the program;
Further including
The information processing method according to any one of claims 7 to 9, wherein, in the output step, the verification result stored in the storage step is added to the execution result and output. A program for executing the information processing method according to any one of claims 6 to 10. A storage medium storing a program for executing the information processing method according to any one of claims 6 to 10.

Images