JP4595732B2 - Data movement method - Google Patents

Description

  The present invention relates to a data movement method, and more particularly to a data movement method between security devices in which data is securely stored.

  When data is moved between security devices in which data is securely stored, in order to prevent unauthorized duplication, it is necessary to restrict such that it cannot be re-executed (see, for example, Patent Document 1). However, when such a restriction is imposed, there is a possibility that data may be lost due to a failure or power interruption at the time of memory access to the data destination device.

  In order to prevent data duplication, it is conceivable that after the data transfer is successful, the source device is switched to a non-executable state, and the destination device is switched to a valid state. At this time, a command for switching is executed at both the data movement source and the movement destination. However, in the prior art disclosed in Patent Document 1, the issuer of this command cannot be specified. , The other party's status could not be confirmed during command execution. For this reason, when the switch command to the migration destination device is executed without switching the status of the migration source device, there is a risk that data can be copied as a result.

  From the above point of view, when data is moved between security devices, a mechanism is required to prevent the data movement process from being re-executed unnecessarily in order to prevent unauthorized duplication. However, on the other hand, considering the occurrence of a failure during memory access, there is a need for a mechanism that can re-execute write processing to the destination device without losing data.

JP 2002-140664 A

  As described above, when data is moved between security devices, if a restriction that prevents re-execution is imposed, a failure or power failure occurs during memory access to the data movement destination device. There was a possibility of data loss.

  In addition, after the data transfer is successful, the source device is switched to a non-executable state, and the destination device is switched to a valid state. At this time, the issuer of the switching command cannot be specified in both the data movement source and the movement destination, and the other party's status cannot be confirmed when the switching command is executed. For this reason, when the switch command to the migration destination device is executed without switching the status of the migration source device, there is a risk that data can be copied as a result.

  The present invention has been made in view of the above-mentioned problems of the conventional data movement method, and the object of the present invention is to minimize the possibility of data loss when a failure occurs during data movement, The object is to provide a new and improved data movement method capable of eliminating the risk of illegal duplication.

  In order to solve the above problems, according to a first aspect of the present invention, there is provided a data movement method between a movement source device as a data movement source and a movement destination device as a data movement destination. In the data movement method of the present invention, the movement source device and the movement destination device are in a data movement state in which data can be transferred, in a data determination state in which data transfer has been completed but cannot be accessed, Three states can be defined: a post-data movement state that can be accessed after transfer is completed; when both the movement source device and the movement destination device are in a data movement state, the movement source device moves to the movement destination. A step of performing data transfer processing to the device, a step of notifying the transfer destination device of a data transfer completion notification indicating that the data transfer processing has been completed, and data indicating confirmation of the data transfer completion notification A notification of transfer completion confirmation from the destination device to the source device; and The transition to the data determined in state, characterized in that it comprises a step of performing data decision processing, the.

  In the data movement method according to the present invention, data transfer processing and commit processing (confirmation processing) are separated in data movement between security devices. Then, immediately after the migration source device is made non-executable, the data transferred to the migration destination device is switched to a valid status. As a result, the possibility of data loss can be minimized.

  In the above data movement method, various applications are possible. For example, the step of switching the source device notified of the data transfer completion notification to a state where data cannot be retransmitted, and the data retransfer indicating that the source device cannot retransmit data Notifying the migration destination device of the failure notification, and after the migration destination device verifies the validity of the data retransfer impossibility notification from the migration source device, it is transferred to the post-data migration state and transferred. Performing a process of switching the obtained data to a valid state. Add a restriction that the commit command for the destination device cannot be generated without committing to the source device. As a result, the data migration destination cannot be committed while the migration source device can be re-executed.

  Further, the migration destination device can limit the number of trials for verifying the validity of the data retransfer impossible notification from the migration source device to a predetermined number. By limiting the number of commit processing attempts after data transfer, it is possible to limit illegal commits due to exhaustive attacks.

  Further, in the step of notifying the data transfer completion notification from the source device to the destination device, a random number value dynamically generated by the source device is used as a value for ensuring the validity of the data destination device. It is possible to notify. Thereby, it is possible to confirm later that the commit command for the source device has been correctly issued by the destination device.

  Further, in the step of notifying the data transfer completion confirmation notification from the migration destination device to the migration source device, the migration destination device dynamically generates a value for ensuring the validity of the data migration source device. It is possible to notify a random value. As a result, it is possible to confirm that the commit command for the migration destination device is correctly issued later by the migration source device.

  In addition, a command for the movement source device to notify the movement destination device of a data retransfer impossibility notification may be generated by the movement source device. As a result, after confirming that the data migration source is in a state where it cannot be re-executed, the data transferred to the migration destination device can be changed to a valid status.

  The data transferred from the migration source device to the migration destination device is, for example, data related to a file structure. The present invention can be used for a situation in which the file structure of the source device is moved to the destination device as it is and the source device is discarded, for example, an IC card update or a mobile phone model change.

In order to solve the above-described problem, according to a second aspect of the present invention, a source device that is a source of data, a destination device that is a destination of data, the source device, and the destination device A method of moving data between a controller that controls data movement is provided. In the data movement method of the present invention, the movement source device and the movement destination device are in a data movement state in which data can be transferred, in a data determination state in which data transfer has been completed but cannot be accessed, Three states can be defined: a post-data movement state that can be accessed after the transfer is completed; when both the movement source device and the movement destination device are in a data movement state, the controller is moved from the movement source device to the controller. Performing a data transfer process to the migration destination device via the process, notifying the migration destination device of a data transfer completion notification that the data transfer process has been completed from the migration source device via the controller, A data transfer completion confirmation notification indicating that the data transfer completion notification has been confirmed is sent from the destination device to the controller. A step of notifying the mobile source device via chromatography La, the destination device transits to the data determined in the state, and performing data confirmation processing,
It is characterized by including.

  In the data movement method according to the present invention, data transfer processing and commit processing (confirmation processing) are separated in data movement between security devices. Then, immediately after the migration source device is made non-executable, the data transferred to the migration destination device is switched to a valid status. As a result, the possibility of data loss can be minimized.

  Various applications are possible in the data movement method. For example, the step of performing the data transfer process includes a first step of transferring a part of data to be transferred from the source device to the controller, and a part of the data from the controller to the destination device. A second step of transferring, and the first step and the second step may be repeated until all data is transferred.

  Alternatively, the step of performing the data transfer process includes a step of transferring all data to be transferred from the movement source device to the controller, and a step of transferring all the data from the controller to the movement destination device. And a step of performing.

  And a step of switching the source device notified of the data transfer completion notification to a state where data cannot be retransmitted, and a data retransfer indicating that the source device cannot retransmit data. Notifying the migration destination device of the failure notification, and after the migration destination device verifies the validity of the data retransfer impossibility notification from the migration source device, it is transferred to the post-data migration state and transferred. Performing a process of switching the obtained data to a valid state. Add a restriction that the commit command for the destination device cannot be generated without committing to the source device. As a result, the data migration destination cannot be committed while the migration source device can be re-executed.

  Further, the migration destination device can limit the number of trials for verifying the validity of the data retransfer impossible notification from the migration source device to a predetermined number. By limiting the number of commit processing attempts after data transfer, it is possible to limit illegal commits due to exhaustive attacks.

  Further, in the step of notifying the data transfer completion notification from the source device to the destination device, the random number value dynamically generated by the source device is notified as a value for ensuring the validity of the destination device. Is possible. Thereby, it is possible to confirm later that the commit command for the source device has been correctly issued by the destination device.

  In addition, in the step of notifying the data transfer completion confirmation notification from the movement destination device to the movement source device, a disturbance generated dynamically by the movement destination device as a value for ensuring the validity of the movement source device. A numerical value can be notified. Thereby, it is possible to confirm later that the commit command for the migration destination device has been correctly issued by the migration source device.

  In addition, a command for the movement source device to notify the movement destination device of a data retransfer impossibility notification may be generated by the movement source device. As a result, after confirming that the data migration source is in a state where it cannot be re-executed, the data transferred to the migration destination device can be changed to a valid status.

  The data transferred from the migration source device to the migration destination device is, for example, data related to a file structure. The present invention can be used for a situation in which the file structure of the source device is moved to the destination device as it is and the source device is discarded, for example, an IC card update or a mobile phone model change.

  According to another aspect of the present invention, there is provided a program for causing a computer (including a mobile phone, an IC card, etc.) to implement the data movement method, and a computer-readable recording medium on which the program is recorded. Provided. Here, the program may be described in any programming language. In addition, as a recording medium, for example, a recording medium that is currently used as a recording medium capable of recording a program, such as a CD-ROM, a DVD-ROM, or a flexible disk, or any recording medium that is used in the future should be adopted. Can do.

  As described above, according to the present invention, the data transfer process and the commit process (confirmation process) are separated so that the data transfer itself can be switched between valid / invalid while ensuring the success of the data transfer itself. became. This minimizes the possibility of data loss when a failure occurs during data transfer. In the commit process after data transfer, the data source device and destination device request each other to issue a commit command (confirm command) to each other, and then confirm each other after confirming the validity and status of each other. By using this method, it is possible to prevent illegal duplication of data.

  Hereinafter, preferred embodiments of a data movement method according to the present invention will be described in detail with reference to the accompanying drawings. In the present specification and drawings, components having substantially the same functional configuration are denoted by the same reference numerals, and redundant description is omitted.

  With reference to FIG. 1 to FIG. 8, a processing procedure when data is moved between two security devices will be described. Here, the security device refers to a device that holds data that is securely protected, and includes a concept including, for example, an IC card, a portable terminal (such as a mobile phone), and the like. Hereinafter, the security device is also simply referred to as a device. Further, a security device that is a data movement source is referred to as a “movement source device”, and a security device that is a data movement destination is referred to as a “movement destination device”.

  First, an outline of the data movement method according to the present embodiment will be described with reference to FIG.

  As shown in FIG. 1, the present embodiment is a data movement method between a movement source device 10 that is a data movement source and a movement destination device 20 that is a data movement destination. Data handled in the present embodiment is data related to the file structure. The data migration method according to the present embodiment assumes a situation in which the file structure of the migration source device is transferred to the migration destination device as it is and the migration source device is discarded. As such a situation, for example, there is an IC card update, a mobile phone model change, and the like.

  As shown in FIG. 1, the movement source device 10 and the movement destination device 20 have a “data moving state” in which data can be transferred and a “data finalizing state” in which data transfer has been completed but cannot be accessed. , And “state after data movement” that can be accessed after data transfer is completed can be defined.

  As shown in FIG. 1, when data is moved from the source device 10 to the destination device 20, first, mutual authentication between the two devices is performed in order to confirm that each other is a valid communication partner. Is performed (step S10). Next, when both the migration source device 10 and the migration destination device 20 are in a data migration state, data transfer processing is performed from the migration source device 10 to the migration destination device 20 (step S20). Then, a data transfer completion notification indicating that the data transfer process has been completed is sent from the movement source device 10 to the movement destination device 20 (step S30).

  The migration destination device 20 that has been notified of the data transfer completion notification notifies the migration source device 10 of the data transfer completion confirmation notification that the data transfer completion notification has been confirmed (step S40), and transitions to a data finalizing state. , Data confirmation processing is performed. On the other hand, the migration source device 10 notified of the data transfer completion confirmation notification switches to a state in which data retransfer is not possible, and sends a data retransfer non-notification notification to the effect that data retransfer is impossible. (Step S50). The migration destination device 20 verifies the validity of the data retransfer impossibility notification from the migration source device 10, and then transitions to a post-data migration state and performs a process of switching the transferred data to a valid state.

  The outline of the data movement method according to the present embodiment has been described above. Below, each step of step S10-S50 is demonstrated in detail. In the following description, an example in which data movement is performed via the controller 30 that controls data movement of the movement source device 10 and the movement destination device 20 will be described.

<Mutual authentication stage (step S10)>
Details of the mutual authentication stage (step S10) will be described with reference to FIG.
First, when data is moved, the controller 30 grasps the presence of two security devices by transmitting a polling command or the like (steps S102 and S104). Next, in order to authenticate whether the two existing security devices should be subject to data movement processing, mutual authentication is performed via the controller 30 to confirm that they are valid communication partners. (Step S106).

<Data Transfer Stage (Step S20)>
Details of the data transfer stage (step S20) will be described with reference to FIG.
If the mutual authentication is successful, information can be exchanged between the source device 10 and the destination device 20 in a secret manner using, for example, an encryption key generated and shared by the mutual authentication. Here, an encryption key that can be known only by the source device 10 and the destination device 20 (this encryption key is also referred to as a PKG generation key (package generation key)) is shared (step S202). Thereafter, both the movement source device 10 and the movement destination device 20 are in a data movement state.

  The controller 30 issues a command for reading data to be moved (hereinafter referred to as a File Data Upload command) to the movement source device 10 (step S204). The source device 10 encrypts the data to be moved with the encryption key and returns it to the controller 30. Next, the controller 30 issues a command for writing the data received from the source device 10 (hereinafter referred to as a File Data Download command) to the destination device 20 (step S206).

  The migration destination device 20 decrypts the data of the migration source device 10 passed as a parameter of this command using the held encryption key, and writes the decrypted text in the memory (step S208). The decryption process using the encryption key in the migration destination device 20 that has received the File Data Download command may be performed any time as long as the migration destination device 20 holds the encryption key.

  Since there is a limit to the data capacity that can be transferred with one command, these processes are repeated until all the data to be moved can be transferred (in this embodiment, it is repeated n times).

  In the example shown in FIG. 3, the data transfer from the source device 10 to the controller 30 and the data transfer from the controller 30 to the destination device 20 are alternately performed, but the present invention is not limited to this. FIG. 4 is an explanatory diagram showing another example of the data transfer stage (S10). As shown in FIG. 4, after all data is transferred from the source device 10 to the controller 30, all data may be transferred from the controller 30 to the destination device 20. In the case of FIG. 4, after the controller 30 acquires and holds all the transfer data from the source device 10 continuously by repeating the File Data Upload command, the File Data Download command is continuously executed. Repeatedly writes to the destination device 20 at once.

<Data Transfer Completion Notification Stage (Step S30)>
The data transfer completion notification stage (step S30) will be described in detail with reference to FIG.
After all data transfer is completed, the controller 30 inquires of the source device 10 about a value uniquely determined by the order and value of the transferred data. In this embodiment, a checksum (hereinafter referred to as CheckSUM) of the entire transfer data is inquired by a command (hereinafter referred to as Get Check Sum command) for inquiring a checksum (step S302).

  The source device 10 calculates the value of CheckSUM, generates a certain random value (hereinafter referred to as RndA), and holds it (step S304). CheckSUM is a value that can guarantee the order of transferred packets and the entire data value. Also, RndA is used to verify whether or not it is correctly issued to itself when a Request Commit Packet command issued as a commit command to the source device 10 is received later.

  Next, the source device 10 encrypts RndA together with CheckSUM with the encryption key as a return packet of the Get Check Sum command and returns it to the controller 30 (step S306). The controller 30 transmits this value to the movement destination device 20 using a parameter of a command for verifying the checksum (hereinafter referred to as a Verify Check Sum command) (step S308). The migration destination device 20 can accept the Verify Check Sum command only when the data migration is in progress.

<Data transfer completion confirmation stage (step S40)>
The data transfer completion notification stage (step S40) will be described in detail with reference to FIG.
The destination device 20 that received the Verify Check Sum command decrypts it using the encryption key, and among the values (RndA and CheckSUM) that are the decrypted text, CheckSUM is equal to the checksum calculated from the transferred data. Confirmation (step S402). As a result of the verification, if it is determined to be valid, the data transfer process is terminated, and the destination device 20 transitions from the data moving state to the data confirmed state, and proceeds to the confirm process described below (step) S408).

  First, the movement destination device 20 newly generates and holds a random value (hereinafter referred to as RndB) (step S404). This RndB is used for verifying whether or not the Commit command is correctly issued to itself when a commit command (hereinafter referred to as a Commit command) for the migration destination device 20 is received later. Further, a fixed value (hereinafter referred to as END_STATE) indicating the transfer end state is generated (step S406).

  At this point, successful data transfer is guaranteed. As a result of the above verification, if it is determined that the data is valid, the data transfer process is terminated, and the destination device 20 transitions from the data moving state to the data confirmed state, and then proceeds to the confirmed process described below. (Step S408).

Verify
As a return packet of the Check Sum command, END_STATE and RndB are encrypted with RndA, and the obtained decrypted text is further encrypted with an encryption key (step S410). The controller 30 is a command for requesting the movement source device 10 to issue a commit command to the movement destination device 20 (hereinafter referred to as a Request Commit Packet command), based on the parameter received by the return packet of the Verify Check Sum command. As a parameter (step S412).

<Not-for-data re-transfer impossible notification (step S50)>
The data retransfer impossibility notification (step S50) will be described in detail with reference to FIG.
The source device 10 that has received the Request Commit Packet command decrypts the parameter with the encryption key, further decrypts the obtained decrypted text with RndA, and confirms that END_STATE can be extracted as the decrypted text (step S502). If this fixed value can be extracted, it can be confirmed that the other party (the movement destination device 20) whose encryption key has been exchanged has finished the data transfer and has shifted to the data finalizing state. To a post-data-migration state where data transfer processing cannot be performed again (step S504).

  Next, the source device 10 generates a commit packet for the destination device 20 (step S506) and returns it as a return value of the Request Commit Packet (step S508). The commit packet is obtained by encrypting a fixed value (hereinafter referred to as COMMIT_CMD) indicating a commit command with RndB, and further encrypting the obtained ciphertext with an encryption key.

  The controller 30 adds the received commit packet as a parameter of the Commit command and transmits it to the movement destination device 20 (step S510). The migration destination device 20 can accept the Commit command only when the verification by the above-described Verify Check Sum command is successful (only when the data is being determined).

  The destination device 20 first decrypts the parameter of the Commit command with the encryption key, further decrypts the obtained decrypted text using RndB, and confirms that COMMIT_CMD can be extracted as the decrypted text (step S512). If COMMIT_CMD can be extracted, it can be confirmed that the migration source device 10 has transitioned to a state where data migration cannot be performed again, and that the commit command requested by itself has been received, so that the migration destination device 20 has been transferred. The data is validated (step S514), and a transition is made from the data finalized state to the post-data movement state (step S516).

  In addition, since the acceptance of the Commit command and the COMMIT_CMD verification process are particularly important in the overall flow, the number of trials is limited.

  FIG. 8 is an explanatory diagram of state transitions and executable commands in the data movement method described above. The steps shown in FIG. 8 (S106, etc.) correspond to the steps shown in FIGS. Further, the general usage state is a normal usage state when data movement is not performed.

  The data movement method according to this embodiment has been described above. Such a data movement method can be realized in a computer by incorporating a computer program for realizing the data movement method into a computer (including a mobile phone, an IC card, etc.). Such a computer program can be distributed in the market in a form recorded on a predetermined recording medium (for example, a CD-ROM) or downloaded via an electronic network.

(Effect of this embodiment)
According to the present embodiment, when the process fails due to some kind of failure (such as power interruption) between the mutual authentication stage (step S10) and the data transfer completion confirmation stage (step S40), both the movement source and the movement destination , It can be re-executed from the Polling command, and unauthorized duplication and data loss do not occur.

  In addition, after the source device 10 transitions to the post-data movement state and before the destination device 20 transitions to the post-data movement state (between the reference signs X shown in FIG. 7), the processing is in some trouble (power Data loss may occur, but the probability of occurrence is very small when viewed from the overall flow. In this case, unauthorized duplication does not occur.

  The preferred embodiments of the data movement method according to the present invention have been described above with reference to the accompanying drawings, but the present invention is not limited to such examples. It will be obvious to those skilled in the art that various changes or modifications can be conceived within the scope of the technical idea described in the claims, and these are naturally within the technical scope of the present invention. It is understood that it belongs.

  The present invention can be used for a data movement method, and in particular, can be used for a data movement method between security devices in which data is securely stored.

It is explanatory drawing which shows the outline of the data movement method concerning one Embodiment of this invention. It is explanatory drawing which shows the detail of a mutual authentication step (S10). It is explanatory drawing which shows the detail of a data transfer step (S20). It is explanatory drawing which shows another example of a data transfer step (S10). It is explanatory drawing which shows the detail of a data transfer completion notification step (S30). It is explanatory drawing which shows the detail of a data transfer completion confirmation step (S40). It is explanatory drawing which shows the detail of a data re-transfer impossible notification (S50). It is explanatory drawing which shows the state transition and executable command of a device.

Explanation of symbols

10 Source device 20 Target device 30 Controller

Claims (2)

A data movement method between a movement source device as a data movement source and a movement destination device as a data movement destination,
Performing data transfer processing from the source device to the destination device when both the source device and the destination device are capable of data transfer;
Notifying the transfer destination device of a data transfer completion notification to the effect that the data transfer process has been completed;
Notifying the transfer source device of a data transfer completion confirmation notification that the data transfer completion notification has been confirmed;
Holding the transferred data in an inaccessible state by the destination device;
The movement source device notified of the data transfer completion confirmation notification, making the data re-transfer impossible;
Notifying the destination device of a data re-transfer impossible notification that the source device cannot re-transmit data; and
The destination device, the steps of the transition to the state after the data movement, and can execute the transferred data,
Only including,
The data transfer completion notification includes a first value dynamically generated by the source device,
The data transfer completion confirmation notification includes a second value dynamically generated by the destination device and encrypted using the first value,
The data retransfer impossible notification includes data generated by the source device and encrypted using the second value,
The source device that is notified of the data transfer completion confirmation notification uses the first value for the data included in the data transfer completion confirmation notification before the step of disabling the data transfer. Verifying the legitimacy of the destination device by decrypting,
The destination device that has been notified of the data re-transfer disable notification uses the second value for the data included in the data re-transfer disable notification before the step of enabling the transferred data. Verifying the legitimacy of the source device by decrypting,
A data movement method characterized by that. 2. The device according to claim 1, wherein the migration destination device limits the number of trials for accepting the data retransfer impossible notification from the source device and verifying the validity of the data retransfer impossible notification to a predetermined number of times. Data movement method.