JP7234096B2 - Security management system and security management method - Google Patents

Description

The embodiments of the present invention relate to security management technology when transferring software on a storage medium.

Some social infrastructures, various plants, factories, etc. are not connected to an external communication network. When performing software maintenance or remodeling for equipment arranged in such facilities, a storage medium storing necessary software is used. A storage medium storing software is brought into the facility, connected to the target equipment, and necessary processing is performed. Security management is important in transferring software by such storage media.

FIG. 5 shows an example of a conventional security management system in which a storage medium is connected to facilities in a facility, security management is performed, and then software processing is performed. A conventional security management system shown in FIG. and inspection means 43 for inspecting the first storage medium 40 and duplicating stored information to the second storage medium 42 . Then, the second storage medium 42 is connected to the target equipment 44, and necessary software processing is performed (see, for example, Patent Document 1).

Here, in the operation means 41 in the factory, the calculation of the hash value Ht, the virus inspection, and the assignment of the serial number to the software are performed, encrypted, and stored in the first storage medium 40 . The second storage medium 42 is connected to the inspection means 43 in the facility and decrypted, calculation and collation of the hash value Hr of the software, virus inspection, and confirmation of the serial number are performed. Tampering is determined by comparing the two calculated hash values Ht and Hr, and replacement is determined by checking the serial number. Then, if there is no problem, the software and the serial number are copied to the second storage medium 42, and after the second storage medium 42 is connected to the target equipment 44 and the serial number is confirmed again, necessary software processing is performed. will be

Japanese Patent Application Laid-Open No. 2018-133030

By the way, in the above-described conventional system, it is necessary to bring the serial number for verification into the facility in addition to the storage medium. For this reason, there is a risk that the serial number for verification that is brought in may be leaked or falsified. Leakage of serial numbers leads to replacement or leakage of information about software written in a storage medium. Also, falsification of the serial number causes a collation error, which interferes with the work of the software processing. Furthermore, there is also the problem that a human error occurs when writing the software to the storage medium in the factory, and the association with the serial number is erroneous.

The embodiments of the present invention have been made in consideration of such circumstances, and it is an object of the present invention to provide a security management technology that prevents replacement and falsification of software transferred via a storage medium.

In the security management system according to the embodiment, storage means for storing software related to the equipment of the second facility in the first facility, and the same secret information and information provided in each of the first facility and the second facility and the confidential information or information recorded in the first recording means and the software stored in the storage means are combined to calculate a first authentication code. writing means provided at the first facility for writing the first authentication code and the software to a storage medium; and writing means provided at the second facility for writing the first authentication code and the software to the storage medium. reading means for reading said software; and second calculating means for calculating a second authentication code by combining said confidential information or information recorded in said second recording means with said software read by said reading means. and collation means provided in the second facility for collating the first authentication code and the second authentication code , wherein the confidential information or information is identification information of the equipment, attribute information of the software, or A combination of one or more selected from the software itself, history information indicating the maintenance history of the software, software itself for maintenance, inspection, and modification, and an encryption key, or Confidential information and information include identification information of the equipment, attribute information of the software or the software itself, history information indicating the maintenance history of the software, software itself for maintenance, inspection and modification, and cryptographic keys. One selected or a combination of two or more, and the history information includes an item of the number of connections of the storage medium or an item of malware inspection of the software, or the history information at the first facility . The first authentication code and the writing time of the software are also included in the storage medium, and if the reading time of the software at the second facility exceeds a preset time from the writing time, the software It is characterized by refusing to accept the wear .

The embodiments of the present invention provide a security management technology that prevents replacement and falsification of software transferred via a storage medium.

1 is a block diagram of a security management system according to a first embodiment of the present invention; FIG. FIG. 10 is a block diagram of a security management system according to the second embodiment; FIG. (A), (B), (C), and (D) are diagrams showing examples of arrangement of components of the security management system according to the embodiment in the second facility. 4 is a flowchart for explaining a security management method according to the embodiment; Block diagram of a conventional security management system

(First embodiment)
An embodiment of the present invention will be described below with reference to the accompanying drawings. FIG. 1 is a block diagram of a security management system 10A according to the first embodiment of the invention. In this way, the security management system 10A (10) includes storage means 15 in which the software P related to the equipment 30 of the second facility 12 is stored in the first facility 11, and A first recording means 21 and a second recording means 22 in which the same confidential information and information Q (Q ₁ , Q ₂ , Q ₃ , Q ₅ ) are recorded, and the confidential information recorded in the first recording means 21 A first computing means 31 for combining information or information Q with _software P stored in a storage means 15 to compute a first authentication code _K1 ; a writing means 16 for writing the software P to the storage medium 35; a reading means 17 provided in the second facility 12 for reading the first authentication code _K1 and the software P from the storage medium 35; a second computing means 32 for computing a second authentication code _K2 by combining confidential information or information Q read by the reading means 17 with the software P read by the reading means 17; ₁ and a collation means 18 for collating the second authentication code _K2 .

In the security management system 10A(10), confidential information and information Q include identification information Q ₁ of equipment 30, attribute information Q ₂ of software P, history information Q ₃ indicating maintenance history of software P, and confidential information. It is a combination of one or more selected from _Q5 . The common secret information _Q5 , which is updated every predetermined time or every number of times of use, is generated by authentication means (not shown) arranged in each of the first facility 11 and the second facility 12, and the first recording means 21 and second recording means 22 respectively.

Further, the security management system 10A(10) is provided with encryption means 25 in the first facility 11 and decryption means 26 in the second facility 12. As shown in FIG. Even if the encryption means 25 and the decryption means 26 are not provided, it is possible to judge whether or not the software P has been replaced or tampered with by comparing the first authentication code _K1 and the second authentication code _K2 . is.

When the common key encryption method is adopted, the encryption means 25 encrypts the first authentication code K ₁ and the software P before writing the confidential information or the information Q as a common encryption key to the storage medium 35 . The decoding means 26 then decodes the first authentication code _K1 and the software P using the secret information and the information Q as a common encryption key. Alternatively, an encryption key generator may be provided in the encryption means 25 and the decryption means 26, and the encryption key may be changed according to time or the number of times of use. When the storage medium 35 is transported or the like, there is a time difference between the encryption and decryption timings, but the time intervals and times for changing the encryption key can be set in consideration of this time difference.

When the public key encryption method is adopted, the encryption means 25 encrypts the first authentication code _K1 and the software P with a public encryption key before writing them to the storage medium 35. FIG. The decoding means 26 then decodes the first authentication code _K1 and the software P using the secret encryption key. RSA, ElGamal, oval ElGamal, etc. can be applied as a public key cryptosystem. Encryption keys can only be handled by authorized users and are managed by various authentication means. In addition, the encryption keys are protected by physical separation of the storage device, protection of the storage device by a one-way transmission device, and the like.

The facility 30 is a facility (second facility 12) such as a social infrastructure such as electricity, water supply and sewerage, and gas, or a plant or factory for steel, chemical, or the like. A wide variety of electronic devices are used for these facility devices, and there are many of them. The software P related to these facilities 30 is software for performing updates such as version upgrades, maintenance inspections, and modifications. If there is a communication network connecting the first facility 11 and the second facility, updating, maintenance, and modification of these facilities 30 can be easily performed by connecting to the network.

However, such a method using a communication network raises security concerns such as information leakage, falsification, impersonation, and malware infection. Furthermore, due to other circumstances, it may not be possible to connect the first facility 11 and the second facility via a communication network. Therefore, the software P created at the first facility 11 is stored in the storage medium 35 at the first facility 11, the storage medium 35 is transferred to the second facility 12, and the software P of the facility 30 is updated and maintained. or remodel. The software P relates to the facility 30, and includes source codes, executable files, data files, and the like.

The first recording means 21 is installed in a factory (first facility 11) handling the software P, and is composed of a general-purpose electronic device such as a microcontroller, personal computer, supercomputer, or a dedicated electronic device. A recording device. This recording device is a semiconductor memory, RAM, various storages, and the like. In each embodiment, confidential information and information Q exemplified by identification information Q ₁ , attribute information Q ₂ , history information Q ₃ , and confidential information Q ₅ are recorded in the first recording means 21 . These confidential information and information Q (Q ₁ , Q ₂ , Q ₃ , Q ₅ ) may be recorded in one recording device as hardware, or may be recorded separately in different hardware recording devices. sometimes

The identification information _Q1 of the facility 30 is not particularly limited, and the IP address or MAC address of the facility 30, the management number or name of the facility 30, the encryption key, the random number, or the like can be applied. This identification information _Q1 is stored in the first recording means 21 and can be handled only by authorized users. Authorized users are managed using passwords, biometric authentication, physical keys, or a combination of these authentication means. In order to protect confidential information and information Q (Q ₁ , Q ₂ , Q ₃ , Q ₅ ), encryption, physical separation of storage devices, protection of storage devices by one-way transmission devices, etc. are performed.

The second recording means 22 of the second facility 12 has the same configuration as the first recording means 21 of the first facility 11, and can be directly connected to the facility 30 when necessary. Alternatively, this second recording means 22 can be incorporated into the equipment 30 . Since the second recording means 22 of the second facility 12 is shipped from the factory (first facility 11) that handles the software P ₀ related to the software P in the first place, The recorded confidential information and information Q can be easily and safely copied and recorded in the second recording means 22 . Like the confidential information and information Q recorded in the first recording means 21, the confidential information and information Q recorded in the second recording means 22 can be handled only by authorized users, and are managed by various authentication means. For protection of confidential information, encryption, physical separation of the storage device, protection of the storage device by a one-way transmission device, and the like are performed.

The attribute information _Q2 includes, for example, the name, type, purpose, serial number, manufacturer, _date of manufacture, place of manufacture, version information, unique number of the software _P0 , or the source code and execution code of the software P0. A file, a data file itself. The attribute information _Q2 recorded in the first recording means 21 and the second recording means ₂₂ can be handled only by authorized users, and is managed by various authentication means. , physical disconnection of the storage device, protection of the storage device by a one-way transmission device, and the like.

The history information _Q3 is, for example, version information reflecting the maintenance history of the software _P0 applied to each of the facilities 30, name, manufacturing number, unique number, date of manufacture, or after maintenance or modification. source code, executable file, and data file of the software _P0 . The history information _Q3 recorded in the first recording means 21 and the second recording means 22 can be handled only by authorized users, and is managed by various authentication means. are physically separated from each other, and the storage device is protected by a one-way transmission device.

The storage means 15 is constructed with a database such as a relational database or a NonSQL database because it is necessary to store data such as the software P and the program main body as the software _P0 , attribute information, and history information. The storage means 15 can be operated only by authorized users, is managed by various authentication means, is physically separated, and is protected by a one-way transmission device.

The first computing means 31 combines confidential information or information Q recorded in the first recording means 21 and software P stored in the storing means 15 to compute a first authentication code _K1 . The second computing means 32 combines confidential information or information Q recorded in the second recording means 22 and the software P read out by the reading means 17 to compute a second authentication code _K2 . Confidential information and information Q adopted by the computing means 31 and 32 include identification information Q ₁ of the equipment 30, attribute information Q ₂ of the software P ₀ , history information Q ₃ indicating the maintenance history of the software P ₀ , It can be one selected from information _Q5 or a combination of two or more.

Confidential information, information Q, and software P are represented by binary values. For the attribute information _Q2 , an arbitrary number of names, types, uses, manufacturing numbers, manufacturers, manufacturing dates, etc. are selected and converted into binary values, and concatenation and arithmetic operations are performed in an arbitrary order. go and ask The history information _Q3 is also generated in the same procedure as the attribute information _Q2 .

The combination of confidential information, information Q (Q ₁ , Q ₂ , Q ₃ , Q ₅ ) and software P is performed by calculations combining four arithmetic operations (AND, OR, XOR) and four arithmetic operations. Then, a one-way function, an authenticated block cipher algorithm, or the like is applied to the calculated combined value to obtain the first authentication code _K1 and the second authentication code _K2 . Hash functions such as MD2, MD4, MD5, SHA-1, SHA-2, SHA-3, RIPEMD-128, and RIPEMD-160 can be applied to the one-way function. Also, CBC-MAC, CMAC, CCM, GCM/GMAC, etc. can be applied to the authenticated block cipher algorithm. For such functions and authenticated block cipher algorithms, it is very difficult to find the input value from the output value, and it is very difficult to find another input value that will be the output value when the output value is given. , it is very difficult to find different input values that give the same output value.

The encryption means 25 encrypts the first authentication code _K1 and the software P. Confidential information or information Q recorded in the first recording means 21 can be substituted for the encryption key. As the cipher, block cipher can be applied, or stream cipher can be applied when a hash function is applied in the first computing means 31 . AES, 3DES, etc. can be applied to the block cipher. Encryption keys can only be handled by authorized users and are managed by various authentication means. In addition, the encryption keys are protected by physical separation of the storage device, protection of the storage device by a one-way transmission device, and the like.

The storage medium 35 can be media such as USB flash memory, SD/SDHC/SDXC card, external HDD or FDD, recordable CD/DVD, and Blue-ray. Select the media according to the storage capacity. In addition, a plurality of storage media 35 storing the same content can be used in anticipation of a failure of the storage media 35, a problem during input/output, and falsification.

The writing means 16 is various connectors and drives that output the software P to which the first authentication code K ₁ is assigned to the storage medium 35 . Examples of the writing means 16 include a USB connector, a wired LAN connector, an FDD drive, and a card slot. Then, the writing means 16 encrypts the software P to which the first authentication code _K1 is assigned and, if necessary, the writing time as well. It should be noted that encryption is not necessarily required.

The reading means 17 has the same structure as the writing means 16, connects the storage medium 35, and reads out the software P assigned the first authentication code _K1 or the encrypted data thereof. Then, the reading means 17 can also give the reading time to the software P to which the first authentication code _K1 is given or the encrypted data thereof.

The decoding means 26 decodes the first authentication code _K1 and the software P from the encrypted data. It is easy to use the decryption key to be the same as the encryption key of the encryption means 25 . Since the decryption means 26 is shipped from the first facility 11 to the second facility 12, the encryption key of the encryption means 25 can be easily and safely copied at the time of shipment and shared with the decryption means 26 as the decryption key. Like the encryption key of the encryption means 25, the decryption key of the decryption means 26 can only be handled by authorized users and is managed by various authentication means. Storage devices are protected by transmission devices. Confidential information or information Q recorded in the second recording means 22 can be substituted for the decryption key. It is also possible to provide the same key generation means for the encryption means 25 and the decryption means 26 and change the encryption key and the decryption key depending on the time and the number of times of use.

The second computing means 32 performs completely the same computation as the first computing means 31 of the first facility 11 . The second computing means 32 extracts confidential information and information Q from the second recording means 22, combines them with the software P via the reading means 17, and computes the second authentication code _K2 . At this time, the combination of the secret information or the information Q with the second authentication code _K2 and the software P is unique due to the properties of the hash function and the authenticated block cipher algorithm.

The collating means 18 compares the writing time in the writing means 16 with the reading time in the reading means 17 (or at the time of collation), and refuses to receive the software P when the elapsed time is equal to or longer than a preset time. . If the elapsed time is within the preset time, the first authentication code K1 calculated by the first calculation means ₃₁ and the second authentication code K calculated by the second calculation means 32 are applied by applying the message authentication method. Match with ₂ . When the first authentication code _K1 and the second authentication code _K2 match, the confidential information and information Q ( _Q1 , _Q2 , _Q3 , _Q5 ) and software P are transferred between the first facility 11 and the second facility 11. It can be confirmed that it is the same before and after delivery to the facility 12 . Here, if the first authentication code _K1 and the second authentication code _K2 do not match, at least one of the secret information, the information Q ( _Q1 , _Q2 , _Q3 , _Q5 ) and the software P is not the same. It represents that. In this case, it is suspected that the software P will be replaced or tampered with when it is transferred between the first facility 11 and the second facility 12 .

Next, effects of the first embodiment will be described. In the security management system 10A, the storage medium 35 is used to transfer the software P with the first authentication code _K1 to the second facility 12 in which the facility 30 is installed. By comparing the second authentication code K2 calculated at the second facility 12 with this first authentication code _K1 , it is possible to determine whether the software P matches or disagrees before being written to the storage medium ₃₅ and after being read. can be confirmed. As a result, it is confirmed that the software P has been sent from an authorized user and that it has not been tampered with or replaced during transfer. As a result, security enhancement is realized when the software P ₀ is updated, maintained, inspected, or modified for the facility 30 by the software P. FIG. Note that P ₀ and Q ₂ are updated to the latest state after updating, maintenance, inspection, or modification of the software P ₀ for the equipment 30 . Also, its update history is added to _Q3 .

Furthermore, in the security management system 10A of the first embodiment, the software P and the first authentication code _K1 transferred from the first facility 11 to the second facility 12 on the storage medium 35 are encrypted. As a result, information leakage regarding the software P transferred on the storage medium 35 can be prevented.

Further, in the security management system 10A of the first embodiment, the software P transferred from the first facility 11 is given the writing time to the storage medium 35. FIG. As a result, the elapsed time required for transferring the software P can be obtained from the reading time when the software P was delivered at the second facility 12 . As a result, when the elapsed time is equal to or longer than the preset time, it is possible to assume the possibility that the software P has been stolen, replaced, or tampered with.

(Second embodiment)
Next, a second embodiment of the present invention will be described with reference to FIG. FIG. 2 is a block diagram of a security management system 10B according to the second embodiment. In FIG. 2, parts having configurations or functions common to those in FIG. 1 are denoted by the same reference numerals, and overlapping descriptions are omitted. As described above, in the security management system 10B (10) of the second embodiment, as in the first embodiment, the storage means 15 of the software P and the confidential information and the information Q are recorded in the first facility 11. A first recording means 21, a first computing means 31 for computing the first authentication code _K1 , and a writing means 16 for writing to a storage medium 35 are provided. A second recording means 22 for recording the information Q, a second computing means 32 for computing the second authentication code _K2 , a reading means 17 for reading from the storage medium 35, the first authentication code _K1 and the second A verification means 18 for verifying the authentication code _K2 is provided.

In addition to the identification information Q ₁ , attribute information Q ₂ , history information Q ₃ , and secret information Q ₅ in the first embodiment, the secret information and information Q of the security management system 10B of the second embodiment include the storage medium 35 It also contains storage medium specific information Q ₄ that distinguishes between . Furthermore, an item of malware inspection of the software P is added to the history information _Q3 . Malware inspection items are, for example, version information, name, manufacturing number, unique number, date of manufacture, or inspection software itself of the inspection software to be applied. The inspection software can only be operated by authorized users, and is managed by various authentication means.In addition, the physical separation of the storage device and the protection of the storage device by a one-way transmission device are performed to protect the inspection software. .

The content of the malware inspection performed at the first facility 11 (including whether or not the inspection was performed) is added to the history information Q ₃ recorded in both the first recording means 21 and the second recording means 22 . This addition of malware inspection content can only be operated by authorized users and is managed by various authentication means. For example, the storage device is protected by the device. Malware inspection can also be performed at the second facility 12, and the details of the inspection are recorded in both the first recording means 21 and the second recording means 22 in the same manner as in the first facility 11. Added to history information _Q3 .

The unique information _Q4 of the storage medium 35 includes, for example, name, type, manufacturing number, manufacturer, manufacturing date, and unique number. The unique information _Q4 of the storage medium 35 can only be handled by authorized users and is managed by various authentication means. The storage device is protected by a directional transmission device. Also, the unique information Q ₄ of the storage medium 35 can be additionally stored together with a different storage medium 35 as required.

Further, in the security management system 10B of the second embodiment, an item of the number of connections of the storage medium 35 may be added to the history information _Q2 . In this case, the number of times of connection of the storage medium 35 to the writing means 16 is managed. The management numbers are not limited to consecutive numbers, but may be numbers whose order is determined in advance. The numbers may include numbers other than numbers, or may be composed of numbers other than numbers. The number of connections to the writing means 16 can only be handled by authorized users, and is managed by various authentication means. For example, disconnection and protection of the storage device by a one-way transmission device are performed.

Effects of the second embodiment will be described. In the security management system 10B, the software P is inspected for malware at least at the first facility 11, and the contents of this inspection are reflected in the history information _Q3 to be shared between the first facility 11 and the second facility 12. FIG. Furthermore, the identity of the storage medium 35 to be used is confirmed based on its unique information _Q4 and the number of times of connection. As a result, the equipment 30 can be prevented from being infected with malware, and information leakage, falsification, and substitution can be completely prevented.

FIGS. 3A, 3B, 3C, and 3D are diagrams showing examples of arrangement of components of the security management system 10 according to each embodiment within the second facility 12. FIG. As shown in FIGS. 1 and 2, the components in the second facility 12 of the security management system 10 are reading means 17, decoding means 26, second computing means 32, matching means 18, second recording means 22, equipment is 30. Of these, the components excluding the equipment 30 are arbitrarily combined to form units 36, 36a, and 36b. These units 36, 36a, 36b are either connected to the facility 30 via cables 37 or arranged independently.

A security management method according to the embodiment will be described with reference to the flowchart of FIG. 4 (see FIG. 1 as appropriate). When the equipment 30 needs to be updated, maintained, inspected, or modified, necessary software P is selected from the software P stored in the storage means 15 (S11). In addition, if necessary, the software P is checked for malware to confirm its soundness. In parallel with this, the identification information Q ₁ of the equipment 30, the attribute information Q ₂ about the software P ₀ , the history information Q ₃ about the update, maintenance inspection and modification about the software P ₀ and the software P, and the unique information of the storage medium 35 Confidential information and information Q in which information Q ₄ , confidential information Q ₅ and the like are recorded are extracted from the first recording means 21 (S12). Note that when the malware inspection is performed, the history information _Q3 is updated so as to include the contents of the inspection results. If the number of times the storage medium 35 is connected to the writing means 16 is also considered, the history information _Q3 is updated so as to include that information.

The first computing means 31 of the first facility 11 stores confidential information and information Q (Q ₁ , Q ₂ , Q ₃ , Q ₄ , Q ₅ ) extracted from the first recording means 21 and extracted from the storage means 15 . After combining the software P (S13), the first authentication code _K1 is calculated (S14). After that, the first authentication code _K1 is given to the software P (abbreviated as P|| _K1 ) (S15), and encrypted in the encryption means 25 using the identification information _Q1 as an encryption key (S16). Here, the identification information Q ₁ is confidential information or information Q that is shared only by both the first facility 11 and the second facility 12 . The encrypted P||K ₁ is stored or written to the storage medium 35 by the writing means 16 (S17). A plurality of storage media 35 storing the same content can be prepared assuming a failure of the storage media 35, a problem during input/output, and tampering.

The storage medium 35 is transferred from the first facility 11 to the second facility 12 (S18), connected to the reading means 17, and P||K ₁ is read (S19). Since P||K ₁ is encrypted in this process, the information will not be leaked even if the storage medium 35 is stolen. Also, when a plurality of storage media 35 are used, by comparing and confirming that all the storage contents are the same when connecting to the reading means 17, defects, problems during input/output, and tampering can be found.

The encrypted P||K ₁ read from the storage medium 35 is decrypted by the decryption means 26 using the identification information Q ₁ extracted from the second recording means 22 as a decryption key (S20), and the software P , the first authentication code K ₁ and the writing time are retrieved. Malware inspection may be performed on the extracted software P. FIG. The second computing means 32 of the second facility 12 extracts confidential information and information Q (Q ₁ , Q ₂ , Q ₃ , Q ₄ , Q ₅ ) extracted from the second recording means 22 and P||K ₁ After combining with the software P (S21), the second authentication code _K2 is calculated (S22).

The collating means 18 compares the writing time at the first facility 11 with the reading time at the second facility 12 (S23). If the elapsed time, which is the difference, is equal to or longer than the preset time (S24 No), it is assumed that there is a possibility of leakage, replacement, or falsification, and acceptance of the software P is rejected (S25 END). Then, if the elapsed time is within the preset time (S24 Yes), the first authentication code _K1 and the second authentication code _K2 are collated (S26). If the two match (Yes in S26), the data stored in the storage means 15 of the first facility 11 and the data delivered to the second facility 12 are determined from the properties of the hash function and authenticated block cipher algorithm. are judged to be the same as the software P and accepted (S27 END). If the first authentication code K ₁ ≠ the second authentication code K ₂ (S26 No), the software P is rejected (S25 END).

Since the identification information _Q1 and the secret information _Q5 match, it is guaranteed that the source of the software P is an authorized user, and since the software P matches, there is no replacement or falsification. is determined. Further, since the attribute information _Q2 matches, it is guaranteed that the software is used in the target facility 30, and since the history information _Q3 matches, the software currently applied It can be determined that the version and specifications of P are correct. Then, this software P is applied to the equipment 30 for updating, maintenance inspection and modification.

According to the security management system of at least one embodiment described above, the same secret information held in both of the two facilities is given to the software and the authentication code is calculated, thereby enabling the security between the facilities via the storage medium. It is possible to more effectively prevent substitution and tampering of software that is delivered in the .

While several embodiments of the invention have been described, these embodiments have been presented by way of example and are not intended to limit the scope of the invention. These embodiments can be implemented in various other forms, and various omissions, replacements, changes, and combinations can be made without departing from the gist of the invention. These embodiments and their modifications are included in the scope and spirit of the invention as well as the scope of the invention described in the claims and equivalents thereof.

10 (10A, 10B)... Security management system 11... First facility 12... Second facility 15... Storage means 16... Writing means 17... Reading means 18... Verification means 21... First recording means , 22... second recording means, 25... encryption means, 26... decryption means, 30... equipment, 31... first calculation means, 32... second calculation means, 35... storage medium, 36 (36a, 36b)... unit, 37... Cable, P... Software, Q... Secret information, _Q1 ... Identification information, _Q2 ... Attribute information, _Q3 ... History information, _Q4 ... Storage medium specific information, _Q5 ... Secret information, _K1 ... Third 1 authentication code, K ₂ . . . second authentication code.

Claims (10)

Storage means for storing software related to equipment of the second facility in the first facility;
a first recording unit and a second recording unit provided in each of the first facility and the second facility and recording the same confidential information and information;
a first calculation means for calculating a first authentication code by combining the confidential information or information recorded in the first recording means and the software stored in the storage means;
writing means provided in the first facility for writing the first authentication code and the software to a storage medium;
reading means provided in the second facility for reading the first authentication code and the software from the storage medium;
a second computing means for computing a second authentication code by combining the confidential information or information recorded in the second recording means with the software read by the reading means;
A matching means provided in the second facility for matching the first authentication code and the second authentication code ,
The confidential information and information include the identification information of the equipment, the attribute information of the software or the software itself, the history information indicating the maintenance history of the software, the software itself for maintenance, inspection, and modification, and the encryption key. is a combination of one or more selected from
A security management system in which the confidential information includes unique information for distinguishing the storage medium . Storage means for storing software related to equipment of the second facility in the first facility;
a first recording unit and a second recording unit provided in each of the first facility and the second facility and recording the same confidential information and information;
a first calculation means for calculating a first authentication code by combining the confidential information or information recorded in the first recording means and the software stored in the storage means;
writing means provided in the first facility for writing the first authentication code and the software to a storage medium;
reading means provided in the second facility for reading the first authentication code and the software from the storage medium;
a second computing means for computing a second authentication code by combining the confidential information or information recorded in the second recording means with the software read by the reading means;
A matching means provided in the second facility for matching the first authentication code and the second authentication code,
The confidential information and information include the identification information of the equipment, the attribute information of the software or the software itself, the history information indicating the maintenance history of the software, the software itself for maintenance, inspection, and modification, and the encryption key. is a combination of one or more selected from
A security management system in which an item of the number of connections of the storage medium or an item of malware inspection of the software is added to the history information . Storage means for storing software related to equipment of the second facility in the first facility;
a first recording unit and a second recording unit provided in each of the first facility and the second facility and recording the same confidential information and information;
a first calculation means for calculating a first authentication code by combining the confidential information or information recorded in the first recording means and the software stored in the storage means;
writing means provided in the first facility for writing the first authentication code and the software to a storage medium;
reading means provided in the second facility for reading the first authentication code and the software from the storage medium;
a second computing means for computing a second authentication code by combining the confidential information or information recorded in the second recording means with the software read by the reading means;
A matching means provided in the second facility for matching the first authentication code and the second authentication code,
Including the writing time of the first authentication code and the software in the first facility in the storage medium,
A security management system that refuses to receive the software if the read time of the software at the second facility exceeds a preset time from the write time. In the security management system of claim 3 ,
encryption means provided in the first facility for encrypting the first authentication code and the software using the confidential information as a common encryption key before writing to the storage medium;
A security management system provided in the second facility, comprising decryption means for decrypting the first authentication code and the software using the confidential information as a common encryption key. In the security management system of claim 3 ,
encryption means provided at the first facility for encrypting the first authentication code and the software with a public encryption key before writing to the storage medium;
A security management system provided in the second facility, comprising decryption means for decrypting the first authentication code and the software using a private encryption key. In the security management system according to any one of claims 3 to 5 ,
The confidential information and information include the identification information of the equipment, the attribute information of the software or the software itself, the history information indicating the maintenance history of the software, the software itself for maintenance, inspection, and modification, and the encryption key. A security management system that is one or a combination of two or more selected from: In the security management system of claim 3 ,
A security management system in which the confidential information recorded in the first recording means and the second recording means is updated every predetermined time or every number of times of use. at the first facility, storing software related to the equipment of the second facility in a storage means;
a step of recording the same confidential information or information in first recording means and second recording means provided in each of the first facility and the second facility;
a step of combining the confidential information or information recorded in the first recording means and the software stored in the storage means to calculate a first authentication code;
writing the first authentication code and the software to a storage medium by means of writing means provided at the first facility;
a step of reading the first authentication code and the software from the storage medium by means of reading means provided at the second facility;
combining the confidential information or information recorded in the second recording means with the software read out by the reading means to calculate a second authentication code;
verifying the first authentication code and the second authentication code at the second facility ;
The confidential information and information include the identification information of the equipment, the attribute information of the software or the software itself, the history information indicating the maintenance history of the software, the software itself for maintenance, inspection, and modification, and the encryption key. is a combination of one or more selected from
A security management method , wherein the confidential information includes unique information for distinguishing the storage medium . at the first facility, storing software related to the equipment of the second facility in a storage means;
a step of recording the same confidential information or information in first recording means and second recording means provided in each of the first facility and the second facility;
a step of combining the confidential information or information recorded in the first recording means and the software stored in the storage means to calculate a first authentication code;
writing the first authentication code and the software to a storage medium by means of writing means provided at the first facility;
a step of reading the first authentication code and the software from the storage medium by means of reading means provided at the second facility;
combining the confidential information or information recorded in the second recording means with the software read out by the reading means to calculate a second authentication code;
verifying the first authentication code and the second authentication code at the second facility ;
The confidential information and information include the identification information of the equipment, the attribute information of the software or the software itself, the history information indicating the maintenance history of the software, the software itself for maintenance, inspection, and modification, and the encryption key. is a combination of one or more selected from
A security management method , wherein an item of the number of connections of the storage medium or an item of malware inspection of the software is added to the history information . at the first facility, storing software related to the equipment of the second facility in a storage means;
a step of recording the same confidential information or information in first recording means and second recording means provided in each of the first facility and the second facility;
a step of combining the confidential information or information recorded in the first recording means and the software stored in the storage means to calculate a first authentication code;
writing the first authentication code and the software to a storage medium by means of writing means provided at the first facility;
a step of reading the first authentication code and the software from the storage medium by means of reading means provided at the second facility;
combining the confidential information or information recorded in the second recording means with the software read out by the reading means to calculate a second authentication code;
verifying the first authentication code and the second authentication code at the second facility ;
Including the writing time of the first authentication code and the software in the first facility in the storage medium,
A security management method for refusing to receive the software if the read time of the software at the second facility exceeds a preset time from the write time.

Images