Monitoring device, monitoring system, information processing device, monitoring method, and program

A monitoring device is configured to monitor a monitoring target device. The monitoring device includes a circuit information distribution program configured to distribute circuit information for programming a physically unclonable function (PUF) circuit to the monitoring target device; a transmission processing program configured to transmit a challenge value to the monitoring target device to which circuit information is distributed; a reception processing program configured to receive a response value corresponding to the challenge value of the PUF circuit programmed in the monitoring target device; and an authentication processing program configured to authenticate the monitoring target device based on input and output correspondence information of the PUF circuit programmed in the monitoring target device and the response value which has been received.

CROSS-REFERENCE TO RELATED APPLICATION

Priority is claimed from Japanese Patent Application No. 2017-254839, filed Dec. 28, 2017, the content of which is incorporated herein by reference.

TECHNICAL FIELD

The present disclosure relates to a monitoring device, a monitoring system, an information processing device, a monitoring method and a program.

BACKGROUND ART

As a method of protecting embedded software, methods of protection by encryption using a trusted platform module (TPM) and removing software by detecting an environmental change have been proposed. In addition, a method in which a physical quantity such as a manufacturing variation and a difference in physical characteristics of a semiconductor chip called a physically unclonable function (PUF) is output as an eigenvalue of the semiconductor chip and is used for a security function of electronic device hardware such as an authenticity determination and authentication process, an encryption process, and the like of a semiconductor chip and devices on which the semiconductor chip is mounted has been proposed (for example, refer Japanese Patent No. 5499358).

SUMMARY

As one aspect of a physically unclonable function (hereinafter also referred to as a “PUF”), an arbiter PUF, a glitch PUF and the like in which a predetermined circuit (hereinafter also referred to as a “PUF circuit”) is formed (programmed) in a field-programmable gate array (FPGA) and a signal delay difference unique to the PUF circuit is used are known.

In order to use an arbiter PUF and a glitch PUF for improving a hardware security function, it is necessary to acquire and record in advance input and output correspondence information (challenge response pair; CRP) unique to the PUF circuit before shipment of a product. In this case, in consideration of a possibility of input and output correspondence information recorded in advance being illegally tampered with, concerns arise for improving a hardware security function using a PUF.

An object of the present invention is to provide a monitoring device, a monitoring system, an information processing device, a monitoring method and a program through which it is possible to improve a hardware security function using a PUF.

According to a first aspect of the present invention, there is provided a monitoring device that is one of a plurality of nodes constituting a distributed ledger system and is configured to monitor a predetermined monitoring target device, the monitoring device including:a circuit information distribution unit configured to distribute circuit information for forming a predetermined PUF circuit to the monitoring target device, which is information registered in advance in the distributed ledger system;a transmission processing unit configured to transmit a predetermined challenge value to the monitoring target device to which the circuit information is distributed,a reception processing unit configured to receive a response value corresponding to the challenge value of the PUF circuit formed in the monitoring target device; andan authentication processing unit configured to authenticate the monitoring target device based on input and output correspondence information of the PUF circuit formed in the monitoring target device, which is information registered in advance in the distributed ledger system, and the received response value.

In addition, according to a second aspect of the present invention, the authentication processing unit is further configured to perform authentication of the monitoring target device based on a result of an agreement building process performed by a plurality of other nodes constituting the distributed ledger system.

In addition, according to a third aspect of the present invention, when a hash value inquiry of the distributed circuit information is received from the monitoring target device, the circuit information distribution unit is configured to transmit a hash value of the circuit information registered in advance in the distributed ledger system.

In addition, according to a fourth aspect of the present invention, the monitoring device further includes an input and output correspondence information registration unit configured to transmit a plurality of types of challenge values to the monitoring target device, receive response values corresponding to the challenge values from the monitoring target device, create input and output correspondence information of the PUF circuit formed in the monitoring target device, and register the created information in the distributed ledger system.

In addition, according to a fifth aspect of the present invention, the monitoring device further includes a mutual authentication unit configured to perform mutual authentication with the monitoring target device based on a common key registered in advance.

In addition, according to a sixth aspect of the present invention, there is provided a monitoring system including a plurality of monitoring devices according to any one of the first to fifth aspects, wherein the plurality of monitoring devices are communicatively connected to each other and constitute the distributed ledger system.

In addition, according to a seventh aspect of the present invention, there is provided an information processing device including a circuit forming unit configured to, when a PUF circuit is not formed, request circuit information to a monitoring device, and form the PUF circuit based on the circuit information received from the monitoring device; anda device authentication request unit configured to, when the PUF circuit is formed, request the monitoring device to perform authentication,wherein the device authentication request unit is configured to input a challenge value received from the monitoring device into the PUF circuit in response to the authentication request, and reply with a response value, which is an output result of the PUF circuit to the monitoring device.

In addition, according to an eighth aspect of the present invention, the information processing device further includes a decrypting processing unit configured to decrypt a control program encrypted in advance when authentication with the monitoring device is successful as a result of the authentication request.

In addition, according to a ninth aspect of the present invention, when authentication with the monitoring device is not successful as a result of the authentication request, the device authentication request unit is configured to remove the control program.

In addition, according to a tenth aspect of the present invention, there is provided a monitoring method in which a predetermined monitoring target device is monitored using a monitoring device that is one of a plurality of nodes constituting a distributed ledger system, the monitoring method including:distributing circuit information for forming a PUF circuit to the monitoring target device, which is information registered in advance in the distributed ledger system;transmitting a predetermined challenge value to the monitoring target device to which the circuit information is distributed;receiving a response value corresponding to the challenge value of the PUF circuit formed in the monitoring target device; andauthenticating the monitoring target device based on input and output correspondence information of the PUF circuit formed in the monitoring target device, which is information registered in advance in the distributed ledger system, and the received response value.

In addition, according to an eleventh aspect of the present invention, there is provided a non-transitory computer readable medium storing a program causing a monitoring device that is one of a plurality of nodes constituting a distributed ledger system and is configured to monitor a predetermined monitoring target device to perform:distributing circuit information for forming a PUF circuit to the monitoring target device, which is information registered in advance in the distributed ledger system;transmitting a predetermined challenge value to the monitoring target device to which the circuit information is distributed;receiving a response value corresponding to the challenge value of the PUF circuit formed in the monitoring target device; andauthenticating the monitoring target device based on input and output correspondence information of the PUF circuit formed in the monitoring target device, which is information registered in advance in the distributed ledger system, and the received response value.

According to the aspects of the invention described above, it is possible to increase the reliability of authenticity determination of a product using a PUF.

DESCRIPTION OF EMBODIMENTS

First Embodiment

A monitoring system and a monitoring target device according to a first embodiment will be described below with reference toFIG. 1toFIG. 11B.

(Overall structure of monitoring system)

FIG. 1is a diagram showing an overall structure of a monitoring system according to the first embodiment.

A monitoring system1shown inFIG. 1is a system for monitoring various embedded systems2. Specifically, the monitoring system1is communicatively connected to the embedded system2and authenticates (verifies validity) products (such as a logic solver and various IO devices to be described below) constituting the embedded system2.

As shown inFIG. 1, a plurality of monitoring devices10are provided.

The plurality of monitoring devices10are communicatively connected to each other via a wide area network (for example, an Internet line, etc.). The plurality of monitoring devices10perform, for example, peer to peer (P2P) communication.

The monitoring system1constitutes a distributed ledger system, and the plurality of monitoring devices10function as nodes of the distributed ledger system. In the configuration of the distributed ledger system, the monitoring devices10as nodes independently maintain information groups stored in the monitoring system1and thus the information groups can be managed in a distributed manner. Specifically, the monitoring devices10store an information group of which registration is requested from the outside, and registers (records) the information group as a new block in the distributed ledger system through a predetermined agreement building algorithm. When a new block is registered by one node (the monitoring device10), it is registered by all of the other nodes (the monitoring devices10) in the same manner. The newly registered block includes information (hash value) uniquely identified according to content of a block registered previously. Therefore, it is possible to increase a resistance to tampering with respect to the registered information group.

The embedded system2is a monitoring target of the monitoring system1.

The embedded system2according to the present embodiment is, for example, an embedded system that controls a gas turbine, a steam turbine, a boiler and the like installed in a power plant or the like as targets.

The embedded system2is constructed by a combination of a plurality of products (for example, a logic solver, an IO device, etc.). Products constructing the embedded system2are sequentially added and updated according to an operation form of a control target (such as a gas turbine). If a newly added or updated product is a fraudulent article (imitation), the entire embedded system2is threatened. Therefore, the monitoring system1performs authentication (verification of validity) of a newly added or updated product in each embedded system2.

Here, the embedded system2to which the monitoring system1is applied is not limited to a system that controls a gas turbine, a steam turbine, and a boiler as control targets, but may be a system that controls, for example, intelligent transport systems (ITS), a cold heat system (a large refrigerator and an air conditioner), or a vehicle (a railway vehicle, an automobile, a construction machine, etc.) as a target.

(Configuration of monitoring system and embedded system)

FIG. 2is a diagram showing a configuration of a monitoring system and an embedded system according to the first embodiment.

As shown inFIG. 2, the monitoring system1and the embedded system2are communicatively connected to each other via a network adapter (NA), which is a network relay device.

An embedded system2ashown inFIG. 2is one of a plurality of embedded systems2that are monitored by the monitoring system1. The embedded system2ais, for example, an embedded system that controls a gas turbine as a target.

A monitoring device10a,which is one node within the monitoring system1, is directly communicatively connected to the embedded system2aand sets it as a monitoring target. In addition, another monitoring device10bdifferent from the monitoring device10adoes not directly set the embedded system2aas a monitoring target, but is directly communicatively connected to another embedded system2(not shown) and sets it as a monitoring target.

As shown inFIG. 2, the embedded system2includes an operator station (OPS)20, an engineering maintenance station (EMS)21, a logic solver (LS)22, and an IO device (IO)23.

The OPS20is a device allowing an operator to ascertain a state of a control target device (gas turbine) and perform control (opening and closing control of a valve and the like).

The EMS21is a device for creating a control program and installing it in a control operation device (the logic solver22to be described below). The logic solver22is a core device that performs a control operation of a gas turbine. The logic solver22controls a valve, an input and output of a sensor or the like, and a state according to the control program. As shown inFIG. 2, a plurality of LSs22are connected in parallel in a redundant manner.

The IO device23is an IO device (various sensors, actuators, etc.) attached to a gas turbine. The plurality of IO devices23are connected to the logic solver22through an IO scanner, an IO network, and an IO adapter. Here, the IO scanner is a communication relay device for connecting the IO network and the logic solver22, and the IO adapter is a communication relay device of the IO network.

The logic solver22and the IO device23according to the present embodiment are one form of an information processing device that operates according to a predetermined control program.

A flow of processes when a logic solver22ais newly added to the embedded system2awill be described below. Here, the newly added logic solver22awill be referred to as a monitoring target device22ain the following description.

(Functional configuration of monitoring device)

FIG. 3is a diagram showing a functional configuration of a monitoring device according to the first embodiment.

Here, the configuration of the monitoring device10ashown inFIG. 3is the same as in another monitoring device10bconstituting the monitoring system1.

As shown inFIG. 3, the monitoring device10aincludes a CPU100, a ROM101, a RAM102, a communication interface103, and a recording medium104.

The CPU100is a processor that controls all operations of the monitoring device10a.The CPU100operates according to a program prepared in advance and exhibits various functions to be described below. The ROM101is a non-rewritable nonvolatile memory. In the ROM101according to the present embodiment, a common key SK for realizing a common key encryption method is recorded in advance.

The RAM102is a rewritable volatile memory. The RAM102is also referred to as a main storage device, and a program allowing the CPU100to perform various functions and operate is loaded thereinto.

The communication interface103is an interface for communication with another monitoring device10aand a monitoring target embedded system2via a wide area network. In the present embodiment, a communication form (wired or wireless communication, a global network, a local network, etc.) of the communication interface103is not particularly limited.

The recording medium104is a mass storage device (nonvolatile memory) incorporated in the monitoring device10aand is, for example, a hard disk drive (HDD), a solid state drive (SSD), or the like. The recording medium104is also referred to as an auxiliary storage device, and a database (hereinafter referred to as a “distributed ledger”) of a distributed ledger system constituted by the monitoring system1is recorded therein.

When the CPU100operates according to a predetermined program, it exhibits functions as a mutual authentication reception unit1000, a circuit information distribution unit1001, and a device authentication unit1002.

The mutual authentication reception unit1000receives a mutual authentication process from the monitoring target device22athat is newly added to the embedded system2. The “mutual authentication process” will be described below.

The circuit information distribution unit1001distributes circuit information to the monitoring target device22athat is newly added to the embedded system2. “Circuit information” is information for forming (programming) a predetermined physically unclonable function (PUF) circuit and a predetermined encryption key generation circuit in an FPGA (to be described below) of the monitoring target device22a.Circuit information (and its hash value) is registered in advance in a distributed ledger of the distributed ledger system constituted by the monitoring system1.

The device authentication unit1002performs an authentication (verification of validity) process on the monitoring target device22ato which the circuit information distribution unit1001has distributed circuit information. The authentication process is performed based on functions as a transmission processing unit1002A, a reception processing unit1002B, and an authentication processing unit1002C of the device authentication unit1002.

The transmission processing unit1002A transmits a predetermined challenge value to the monitoring target device22ato which the circuit information distribution unit1001distributes circuit information via a wide area network. A “challenge value” is an input value for obtaining a corresponding output value (response value) from the PUF circuit and is mainly a random number.

The reception processing unit1002B receives a response value corresponding to a challenge value from the monitoring target device22athat has transmitted the challenge value via a wide area network. The “response value” is an output value that is uniquely output from a PUF circuit in response to a challenge value when a predetermined challenge value is input to the PUF circuit formed in the monitoring target device22a.

The authentication processing unit1002C authenticates the monitoring target device22abased on input and output correspondence information (referred to as a challenge response pair (CRP)) of the PUF circuit formed in the monitoring target device22aand the response value received from the monitoring target device22a.The “CRP” is information indicating a correspondence relationship between an input value (challenge value) and an output value (response value) of the PUF circuit, and is an information table in which a plurality of pairs of a challenge value and a response value are recorded for each product (the monitoring target device22a) and for each PUF circuit. Since a response value output to correspond to a challenge value is determined depending on individual physical differences such as a difference in signal delay occurring in the PUF circuit, even if the logical circuit configuration of the PUF circuit is the same, when the product (the monitoring target device22a) is different, it is not possible to output the same response value in response to the same challenge value. Therefore, when the response value acquired in advance as a CRP is the same as the response value received via a wide area network, the authentication processing unit1002C can determine that a destination device which a challenge value is transmitted is authentic (the monitoring target device22ato be newly added to the embedded system2).

Here, a CRP for the PUF circuit of the monitoring target device22ais measured in advance before shipment of the monitoring target device22aand is registered in a distributed ledger of the distributed ledger system constituted by the monitoring system1.

(Functional configuration of monitoring target device)

FIG. 4is a diagram showing a functional configuration of a monitoring target device according to the first embodiment.

Here, the configuration of the monitoring target device22ashown inFIG. 4is the same as that of other monitoring target devices (the LS22, the IO device23, etc.) constituting another embedded system2.

As shown inFIG. 4, the monitoring target device22aincludes a CPU220, a ROM221, an FPGA222, a RAM223, a flash ROM224, and a communication interface225.

The CPU220is a processor that controls all operations of the monitoring target device22a.The CPU220operates according to a program prepared in advance and exhibits various functions to be described below. In addition, after authentication is performed by the monitoring device10a,the CPU220operates according to a predetermined control program, and is thus formally operated as one constituent device of the embedded system2that controls a gas turbine or the like.

The ROM221is a non-rewritable nonvolatile memory. In the ROM221according to the present embodiment, a common key SK for realizing a common key encryption method is recorded in advance. The common key SK is the same as one recorded in the ROM101of the monitoring device10a.In addition, although not shown inFIG. 4, in the ROM221, a boot program for performing authentication with the monitoring device10aduring initial activation or the like is recorded.

The FPGA222is an integrated circuit that can form a desired logic circuit after manufacture. In the FPGA222, a PUF circuit C_PUF and an encryption key generation circuit C_ENC based on circuit information received from the monitoring device10a(the circuit information distribution unit1001) are formed. Here, at the beginning of shipment of the monitoring target device22a,a PUF circuit C_PUF and an encryption key generation circuit C_ENC are not formed in the FPGA222.

The RAM223is a rewritable volatile memory. A program allowing the CPU220to exhibit various functions and operate is loaded into the RAM223.

The flash ROM224is a rewritable nonvolatile memory. In the flash ROM224, an encrypted control program (encrypted control program E_PRG) and a predetermined challenge value CH are recorded. Here, at the beginning of shipment of the monitoring target device22a,no information is recorded in the flash ROM224.

The communication interface225is an interface for communication with the monitoring device10aand the like via a wide area network.

The CPU220operates according to a boot program recorded in the ROM221, and thus exhibits functions as a mutual authentication unit2200, a circuit forming unit2201, a device authentication request unit2202, an encryption processing unit2203, and a decrypting processing unit2204.

The mutual authentication unit2200performs a mutual authentication process with the monitoring device10aduring initial activation. In the mutual authentication process, authentication is performed using a mutual common key SK.

The circuit forming unit2201forms a PUF circuit C_PUF and an encryption key generation circuit C_ENC in the FPGA222based on circuit information received from the monitoring device10a.Here, the encryption key generation circuit C_ENC may be a circuit based on a generally well-known common key encryption algorithm (for example, advanced encryption standard; AES).

After the circuit forming unit2201forms a PUF circuit C_PUF in the FPGA222, the device authentication request unit2202requests the monitoring device10ato perform formal authentication using the PUF circuit C_PUF.

After formal authentication by the monitoring device10ais completed, the encryption processing unit2203encrypts a control program for formally operating as one constituent device of the embedded system2, and records the encrypted control program E_PRG in the flash ROM224of the monitoring target device.

The decrypting processing unit2204decrypts the encrypted control program E_PRG recorded in the flash ROM224of the monitoring target device and loads it into the RAM223. Thereby, the CPU100operates formally as a constituent device of the embedded system2.

(Processing flow of mutual authentication phase)

FIG. 5is a diagram showing a processing flow of a mutual authentication phase executed between the monitoring device and the monitoring target device according to the first embodiment.

The processing flow of a mutual authentication phase shown inFIG. 5starts from a stage in which the monitoring target device22aconnected to a network of the embedded system2is first activated. As an assumption, the monitoring target device22astarts the mutual authentication phase shown inFIG. 5triggered by the fact that a PUF circuit C_PUF and an encryption key generation circuit C_ENC are not installed (formed) in the FPGA222of the monitoring target device.

First, the activated monitoring target device22arequests the monitoring device10ato perform mutual authentication. Specifically, the mutual authentication unit2200of the monitoring target device22acreates a random number for mutual authentication which is a random number. Then, the mutual authentication unit2200transmits a mutual authentication request command and the random number for mutual authentication to a predefined connection destination address (the monitoring device10a) (step S00).

When the mutual authentication request command and the random number for mutual authentication are received from the outside (the monitoring target device22a), the mutual authentication reception unit1000of the monitoring device10aencrypts the received random number for mutual authentication with a common key SK recorded in the ROM101of the monitoring device (step S01). Then, the mutual authentication reception unit1000replies with the random number for mutual authentication encrypted with the common key SK (encrypted random number for mutual authentication) to a transmission source (the monitoring target device22a) (step S02).

The mutual authentication unit2200of the monitoring target device22adecrypts the encrypted random number for mutual authentication received from the monitoring device10awith the common key SK recorded in the ROM221of the monitoring target device. In addition, the mutual authentication unit2200determines whether the random number for mutual authentication decrypted with the common key SK and the random number for mutual authentication created in step S00match (step S03). When a result of determination of matching is that the two match, the monitoring target device22adetermines that the authentic monitoring device10ais a communication target and advances to a circuit information distribution phase.

Here, all exchanges of information between devices performed in subsequent phases (a circuit information distribution phase (FIG. 6) and a device authentication phase (FIG. 7)) are performed by a common key encryption method using a common key SK.

When a result of determination of matching is that the two do not match, the monitoring target device22adetermines that the authentic monitoring device10ais not a communication target and stops the subsequent process.

(Processing flow of circuit information distribution phase)

FIG. 6is a diagram showing a processing flow of a circuit information distribution phase executed between the monitoring device and the monitoring target device according to the first embodiment.

The processing flow of a circuit information distribution phase shown inFIG. 6starts from a stage in which mutual authentication is performed via a mutual authentication phase (steps S00to S03inFIG. 5).

First, the monitoring target device22arequests the monitoring device10ato distribute circuit information. Specifically, the circuit forming unit2201of the monitoring target device22atransmits a circuit information request command to the monitoring device10a(step S10). In the circuit information request command, a device ID (for example, a serial number, etc.) that can individually identify a product (the monitoring target device22aitself) is included.

When the circuit information request command is received from the monitoring target device22a,the circuit information distribution unit1001of the monitoring device10arequests another monitoring device10bconstituting the monitoring system1to approve transaction establishment (step S11). Specifically, the circuit information distribution unit1001transmits a transaction establishment approval request command and a circuit information request command from the monitoring target device22ato all of the other monitoring devices10b.

When the transaction establishment approval request command and the circuit information request command from the monitoring target device22aare received from the monitoring device10a,the other monitoring devices10bperform an agreement building process for determining whether to distribute circuit information in response to the circuit information request command (step S12). Specifically, the other monitoring devices10bdetermine whether a device ID (identification information of the monitoring target device22a) included in the circuit information request command is registered in a distributed ledger (the recording medium104) of the distributed ledger system in advance. Here, a device ID of the monitoring target device22aadded to the embedded system2is registered in the distributed ledger in advance (refer toFIG. 8andFIG. 9).

In addition, the other monitoring devices10bverify whether there is a trace of tampering in the circuit information request command from the monitoring target device22a.

Here, in the agreement building process performed by the monitoring device10aand the other monitoring devices10bin step S12, a generally known agreement building algorithm (for example, practical byzantine fault tolerance; PBFT, etc.) may be used.

As a result of the above determination and verification, when no problem is found in the content of the circuit information request command from the monitoring target device22a,the other monitoring device10breplies with a transaction approval command to the monitoring device10abased on an agreement form of “circuit information may be distributed” (step S13).

When the transaction approval command is received from the other monitoring device10b,the circuit information distribution unit1001of the monitoring device10adistributes circuit information registered in the distributed ledger (the recording medium104) in advance to the monitoring target device22a(step S14). Here, in the circuit information, circuit information for forming a PUF circuit C_PUF in the FPGA222of the monitoring target device22aand circuit information for forming an encryption key generation circuit C_ENC are included.

When the circuit information is received from the monitoring device10a,the circuit forming unit2201of the monitoring target device22averifies validity of the circuit information. Specifically, the circuit forming unit2201transmits a hash value inquiry command of the circuit information received in step S14to the monitoring device10aand the other monitoring device10b(step S15).

When the hash value inquiry command of the circuit information is received from the monitoring target device22a,the monitoring device10aand the other monitoring device10brefer to the recording medium104and search for a hash value of the circuit information distributed to the monitoring target device22a(step816).

Here, the circuit information distributed in step S14and a hash value of the circuit information are registered in advance in the distributed ledger (the recording medium104) of the distributed ledger system (refer toFIG. 10).

The monitoring device10aand the other monitoring device10breply with the found result of the hash value of the circuit information recorded in the respective distributed ledger (the recording medium104) to the monitoring target device22a(step S17).

When the hash value of the circuit information is received from the monitoring device10aand the other monitoring device10b,the circuit forming unit2201of the monitoring target device22averifies the circuit information received from the monitoring device10a(step S18). Specifically, the circuit forming unit2201itself calculates the hash value of the circuit information received from the monitoring device10ain step S14and determines whether the calculation result matches the hash value received in step S17.

When the calculation result of the hash value of the circuit information received in step S14matches the hash value received in step S17, it can be determined that the circuit information received in step S14is authentic. In this case, the circuit forming unit2201forms (installs) a PUF circuit C_PUF and an encryption key generation circuit C_ENC in the FPGA222of the monitoring target device based on the circuit information received in step S14(step S19).

After a PUF circuit C_PUF and an encryption key generation circuit C_ENC are formed in the FPGA222of the monitoring target device, the monitoring target device22aadvances to the device authentication phase using the formed PUF circuit C_PUF.

On the other hand, when the calculation result of the hash value of the circuit information received in step S14does not match the hash value received in step S17, the circuit forming unit2201determines that authentic circuit information is not received, and does not form a PUF circuit C_PUF and an encryption key generation circuit C_ENC in the FPGA222of the monitoring target device.

(Processing flow of device authentication phase)

FIG. 7is a diagram showing a processing flow of a device authentication phase executed between the monitoring device and the monitoring target device according to the first embodiment.

The processing flow of a device authentication phase shown inFIG. 7starts from a stage in which a PUF circuit C_PUF is formed in the FPGA222of the monitoring target device22avia a circuit information distribution phase (steps S10to S19inFIG. 6).

First, the device authentication request unit2202of the monitoring target device22atransmits a device authentication request command to the monitoring device10aso that it receives formal authentication as one constituent device of the embedded system2(step S20).

When the device authentication request command is received from the monitoring target device22a,the device authentication unit1002of the monitoring device10a(the transmission processing unit1002A) selects one challenge value from CRP information registered in the distributed ledger (the recording medium104) (refer toFIG. 8andFIG. 9), and transmits the selected challenge value to the monitoring target device22aand all of the monitoring devices10b(step S21).

When the challenge value is received from the monitoring device10a,the device authentication request unit2202inputs the challenge value to a PUF circuit C_PUF of the FPGA222. Then, the device authentication request unit2202acquires an output value output from the PUF circuit C_PUF corresponding to the input as a response value of the PUF circuit C_PUF (step S22).

The device authentication request unit2202transmits the response value acquired in step S22to the monitoring device10a(step S23). The device authentication unit1002of the monitoring device10a(the reception processing unit1002B) receives the response value of the PUF circuit C_PUF from the monitoring target device22a.

Next, the device authentication unit1002of the monitoring device10a(the authentication processing unit1002C) searches a response value corresponding to the challenge value transmitted in step S21from CRP information registered in the distributed ledger (refer toFIG. 8andFIG. 9). Then, the device authentication unit1002determines whether the found response value (response value recorded in the CRP) matches the response value received in step S23(step S24).

When a result of determination of matching in step S24is that the two match, the device authentication unit1002requests the other monitoring device10bconstituting the monitoring system1to approve transaction establishment (step S25). Specifically, the device authentication unit1002transmits the transaction establishment approval request command and the response value from the monitoring target device22areceived in step S23to all of the other monitoring devices10b.

When the transaction establishment approval request command and the response value from the monitoring target device22aare received from the monitoring device10a,the other monitoring device10bperforms an agreement building process for determining whether the monitoring target device22athat has transmitted the response value is formally authenticated as one constituent device of the embedded system2(step S26). Specifically, the other monitoring devices10bsearch a response value corresponding to the challenge value received in step S21from the CRP registered in the distributed ledger (the recording medium104). Then, the device authentication unit1002determines whether the found response value (the response value recorded in the CRP) matches the response value received in step S23.

Here, in the agreement building process performed by the monitoring device10aand the other monitoring device10bin step S26, a generally known agreement building algorithm (for example, PBFT, etc.) may be used.

In addition, the monitoring device10aand the monitoring device10bnewly register the challenge value (used challenge value) transmitted to the monitoring target device22ain step S21, the result of the agreement building process, and information such as the year, month, day, hour, minute, and the like when the agreement building process is performed in the distributed ledger (step S26).

As a result of the above determination of matching, when the response value from the monitoring target device22amatches the response value recorded in each CRP, the other monitoring device10breplies with a transaction approval command to the monitoring device10abased on an agreement form of “it may be formally authenticated as one constituent device of the embedded system2” (step S27).

When the transaction approval command is received from the other monitoring device10b,the device authentication unit1002of the monitoring device10adistributes an authentication command to the monitoring target device22ain response to the device authentication request command in step S20(step S28). When the authentication command is distributed from the monitoring device10a,for example, the EMS21(FIG. 2) of the embedded system2transmits a control program for operating as one constituent device of the embedded system2(logic solver) to the monitoring target device22aas triggered by the reception of the authentication command from the monitoring device10a.

The encryption processing unit2203of the monitoring target device22aencrypts the control program received from the EMS21and records it in the flash ROM224of the monitoring target device22a(step S29). The process of step S29performed by the encryption processing unit2203will be described below in detail.

(Data structure of first distributed ledger)

FIG. 8is a diagram showing a data structure of a first distributed ledger recorded in a monitoring device according to the first embodiment.

In addition,FIG. 9is a diagram showing a data structure of input and output correspondence information (CRP) recorded in the monitoring device according to the first embodiment.

FIG. 8shows a data structure of a first distributed ledger recorded in the recording medium104of the monitoring device10a.

As shown inFIG. 8, blocks B1constituting the first distributed ledger include a block header B10and CRP information B11.

The block header B10includes a hash value of all data (CRP information B11) included in each of the blocks B1and a hash value of a previous block header (the block header B10of the block B1registered previously).

In the CRP information B11, a CRP obtained by measurement in advance is recorded for each product (the monitoring target device22a) and for each PUF circuit.

Here, the CRP information will be described in detail with reference toFIG. 9.

As shown inFIG. 9, the CRP information shows a device ID that can identify the monitoring target device22a,a PUF circuit ID that can identify a type (logical configuration) of a PUF circuit, and a correspondence relationship between a challenge value and a response value of a PUF circuit C_PUF identified by a device ID and a PUF circuit ID.

In this manner, the challenge value and the response value are shown as a value of a predetermined number of bits (for example, 128 bits). CRP information is measured for each type of devices and PUF circuits in a stage before shipment of the monitoring target device22aand registered in the distributed ledger.

The device authentication unit1002of the monitoring device10aselects one challenge value from CRP information shown inFIG. 9and transmits it to the monitoring target device22ain the process of step S21inFIG. 7.

In addition, the device authentication unit1002searches a response value corresponding to the challenge value transmitted in step S21from CRP information shown inFIG. 9in the process of step S24inFIG. 7. Then, the device authentication unit1002determines whether the found response value (the response value recorded in the CRP) matches the response value received in step S23.

(Data structure of second distributed ledger)

FIG. 10shows a data structure of a second distributed ledger recorded in the recording medium104. As shown inFIG. 10, blocks B2constituting the second distributed ledger include a block header B20, and circuit information and a hash value of a PUF circuit (hereinafter referred to as a PUF circuit information group B21), and circuit information and a hash value of an encryption key generation circuit (hereinafter referred to as an encryption key generation circuit information group B22).

The block header B20includes a hash value of all data (the PUF circuit information group B21and the encryption key generation circuit information group B22) included in each of the blocks B2and a hash value of a previous block header (the block header B20of the block B2registered previously).

In the process of step S14inFIG. 6, the circuit information distribution unit1001of the monitoring device10aidentifies circuit information of the PUF circuit information group B21and circuit information of the encryption key generation circuit information group B22, for circuits that will be installed in the monitoring target device22a,from the second distributed ledger shown inFIG. 10and transmits it to the monitoring target device22a.

In addition, in the process of step S16inFIG. 6, when the hash value inquiry command of the circuit information is received from the monitoring target device22a, the monitoring device10aand the other monitoring device10bsearch for a hash value of each circuit information recorded in the second distributed ledger shown inFIG. 10.

FIG. 11AandFIG. 11Bare diagrams showing a processing flow of the monitoring target device according to the first embodiment.

First, a process performed by the monitoring target device22aimmediately after authentication is performed by the monitoring device10awill be described with reference toFIG. 11A(process of step S29inFIG. 7).

As shown inFIG. 11A, the encryption processing unit2203of the monitoring target device22agenerates an arbitrary challenge value CH (random number) (step S30). Here, the generated challenge value CH may be an arbitrary random number regardless of the challenge value (challenge value recorded in CRP information) used in the device authentication phase (FIG. 7).

Next, the encryption processing unit2203inputs the challenge value CH generated in step S30to the PUF circuit C_PUF of the FPGA222(step S31).

Next, as a result of step S31, the encryption processing unit2203acquires the response value output from the PUF circuit C_PUF. Then, the encryption processing unit2203inputs the acquired response value to the encryption key generation circuit C_ENC of the FPGA222and generates an encryption key (step S32).

Next, the encryption processing unit2203encrypts the control program acquired in step S28with the encryption key generated in step S32(step S33).

Next, the encryption processing unit2203writes the control program E_PRG encrypted in step S33in the flash ROM224(step S34).

At the same time, the encryption processing unit2203writes the challenge value CH generated in step S30in the flash ROM224(step S35).

Next, a process (general activation process) when the monitoring target device22ais activated for the second time and thereafter will be described with reference toFIG. 11B.

As a result of the process shown inFIG. 11A, in the monitoring target device22a,the encrypted control program E_PRG is written in the flash ROM224. When activated for the second time and thereafter, the monitoring target device22adecrypts the encrypted control program E_PRG and performs an operation as one constituent device of the embedded system2.

Specifically, the decrypting processing unit2204of the monitoring target device22areads and acquires the challenge value CH recorded in the flash ROM224(step S40).

Next, the decrypting processing unit2204inputs the challenge value CH acquired in step S40to the PUF circuit C_PUF of the FPGA222(step S41).

Next, as a result of step S41, the decrypting processing unit2204acquires the response value output from the PUF circuit C_PUF. Then, the decrypting processing unit2204inputs the acquired response value to the encryption key generation circuit C_ENC of the FPGA222and generates an encryption key (step S42).

Next, the decrypting processing unit2204decrypts the encrypted control program E_PRG recorded in the flash ROM224with the encryption key generated in step S42(step S43).

Next, the decrypting processing unit2204loads the control program decrypted in step S43into the RAM223(step S44).

As a result, the CPU220of the monitoring target device22aoperates according to a control program that is loaded into the RAM223.

As described above, the monitoring device10aaccording to the first embodiment is one of a plurality of nodes constituting the distributed ledger system and monitors an information processing device (for example, a logic solver, an IO device, etc.) constituting the embedded system2as the monitoring target device22a.

The monitoring device10aincludes the circuit information distribution unit1001(refer to step S14inFIG. 6) configured to distribute circuit information for forming a PUF circuit C_PUF to the monitoring target device22a,the transmission processing unit1002A (refer to step S21inFIG. 7) configured to transmit a predetermined challenge value to the monitoring target device22ato which circuit information is distributed, the reception processing unit1002B (refer to step S23inFIG. 7) configured to receive a response value of the PUF circuit C_PUF formed in the monitoring target device22a, and the authentication processing unit1002C (refer to step S24inFIG. 7) configured to authenticate the monitoring target device22abased on input and output correspondence information (CRP) of the PUF circuit C_PUF formed in the monitoring target device22aand the received response value.

In addition, the above CRP and circuit information are registered in advance in the distributed ledger system constituted by the monitoring system1.

In addition, as described above, the monitoring target device22a(information processing device) according to the first embodiment includes the circuit forming unit2201configured to request (refer to step S10inFIG. 6) circuit information from the monitoring device10awhen no PUF circuit C_PUF is not formed in the monitoring target device and form a PUF circuit C_PUF based on the circuit information received from the monitoring device10a,and the device authentication request unit2202configured to request (refer to step S20inFIG. 7) the monitoring device10ato perform authentication when a PUF circuit C_PUF is formed. Then, the device authentication request unit2202inputs the challenge value received from the monitoring device in response to the authentication request to the PUF circuit (refer to step S23inFIG. 7), and replies with a response value, which is its output result to the monitoring device10a(refer to step S24inFIG. 7).

According to the above configuration, the monitoring target device22ais authenticated based on the CRP registered in advance in the distributed ledger system constituted by the monitoring system1(refer to steps S20to S28inFIG. 7). Therefore, since a resistance to tampering of the CRP is strengthened, it is possible to increase the reliability of validity verification of the product using a PUF.

In addition, according to the above configuration, before the device authentication phase, a process of forming a PUF circuit is performed based on circuit information distributed from the outside for the monitoring target device22a(refer to steps S10to S19inFIG. 6). Thereby, since the monitoring target device22ain which no PUF circuit C_PUF is formed is shipped, it is possible to suppress the occurrence of information leakage of the PUF circuit C_PUF.

In addition, the monitoring device10a(the authentication processing unit1002C) according to the first embodiment additionally authenticates a monitoring target device based on a result of an agreement building process performed by a plurality of other nodes constituting the distributed ledger system (refer to steps S25to S27inFIG. 7).

Accordingly, since acceptance or rejection of authentication is determined based on the CRP in each of the plurality of nodes, it is possible to increase the reliability of acceptance or rejection of the authentication.

In addition, when a hash value inquiry of circuit information distributed by the monitoring device10ais received from the monitoring target device22a,the monitoring device10a(the circuit information distribution unit1001) according to the first embodiment transmits a hash value of the circuit information registered in advance in the distributed ledger system. Accordingly, the monitoring target device22acan verify the validity of the received circuit information based on the hash value transmitted from all nodes (the monitoring device10). That is, the monitoring target device22acan obtain confirmation that the distributed circuit information is authentic (recorded in the distributed ledger system).

(Modified examples of first embodiment)

While the monitoring system1and the monitoring device10according to the first embodiment have been described above in detail, specific forms of the monitoring system1and the monitoring device10are not limited to the above forms, and various design modifications and the like without departing from the spirit and scope of the invention can be made.

For example, a case in which the monitoring device10aand the other monitoring devices10baccording to the first embodiment perform an agreement building process for determining whether to authenticate the monitoring target device22aand register the challenge value (used challenge value) and the like transmitted to the monitoring target device22ain a new distributed ledger (the recording medium104) in step S26inFIG. 7has been described.

Here, furthermore, when a device authentication process is performed again on the monitoring target device22a,in step S21inFIG. 7, the monitoring device10amay refer to the distributed ledger, and select and transmit only a challenge value that is not registered as a used challenge value (that is, a challenge value that has never been transmitted to the monitoring target device22a).

Accordingly, since challenge value transmitted by the monitoring device10ato the monitoring target device22ain the device authentication phase is always transmitted for the first time, it is possible to reduce a risk of the challenge value being learned by a third party through eavesdropping.

In addition, a case in which the circuit information distribution unit1001according to the first embodiment distributes both circuit information for forming a PUF circuit C_PUF and circuit information for forming an encryption key generation circuit C_ENC (refer to step S14inFIG. 6) has been described. In addition, a case in which the encryption processing unit2203inputs a response value of the PUF circuit C_PUF to the encryption key generation circuit C_ENC and generates an encryption key, and also encrypts a control program using the encryption key (refer to steps S32to S33inFIG. 11A) has been described. However, other embodiments are not limited to the above form.

That is, the circuit information distribution unit1001according to another embodiment may distribute only circuit information for forming a PUF circuit C_PUF, and also, the encryption processing unit2203of the monitoring target device22adirectly encrypts a control program using a response value of a PUF circuit C_PUF. Here, in this case, the decrypting processing unit2204of the monitoring target device22amay directly decrypt an encrypted control program E_PRG using the response value of the PUF circuit C_PUF.

In addition, a case in which the monitoring system1and the other monitoring devices10according to the first embodiment are installed outside the embedded system2(refer toFIG. 1andFIG. 2) has been described. However, other embodiments are not limited to the above form.

That is, functions (FIG. 3) of the monitoring device10amay be incorporated in the OPS20, the EMS21, and the like installed as constituent devices of the embedded system2.

In addition, a form in which a plurality of monitoring devices10are virtually installed in one hardware item (housing) may be used.

Second Embodiment

Next, a monitoring system and a monitoring target device according to a second embodiment will be described with reference toFIG. 12.

(Processing flow of monitoring target device)

FIG. 12is a diagram showing a processing flow of a monitoring target device according to the second embodiment.

A process (general activation process) when the monitoring target device22aaccording to the second embodiment is activated for the second time and thereafter will be described with reference toFIG. 12.

When activated for the second time and thereafter, the monitoring target device22aaccording to the second embodiment executes again a device authentication phase. That is, when activated for the second time and thereafter, the monitoring target device22arequests again the monitoring device10ato authenticate a device (step S20inFIG. 7). Then, after the authentication process (steps S21to S27) has been performed by the monitoring device10aor the like, authentication is received again from the monitoring device10a(step S28inFIG. 7).

The monitoring target device22adetermines whether the monitoring target device is successfully authenticated by the monitoring device10ain the device authentication phase (steps S20to S28) (step S50).

When the monitoring target device is successfully authenticated (YES in step S50) in the device authentication phase (steps S20to S28), the monitoring target device22aperforms a control activation process (steps S40to S44inFIG. 11B) and performs an operation according to the control program.

On the other hand, when the monitoring target device is not successfully authenticated (NO in step S50) in the device authentication phase (steps S20to S28), the monitoring target device22aends the process without performing the control activation process (steps S40to S44inFIG. 11B).

As described above, when the encrypted control program E_PRG is recorded in the flash ROM224and is then again activated, the monitoring target device22aaccording to the second embodiment executes the device authentication phase (steps S20to S28inFIG. 7) again, and obtains authentication, and then decrypts and executes the encrypted control program E_PRG (steps S40to S44inFIG. 11B).

That is, according to the monitoring target device22aaccording to the second embodiment, when authentication is received from the monitoring device10a(YES in step S50) as a result of the authentication request (step S20inFIG. 7), the decrypting processing unit2204decrypts the encrypted control program E_PRG in advance.

Here, according to the monitoring target device22aof the first embodiment, when the monitoring target device22aitself is stolen, the control program is decrypted and executed (steps S40to S44inFIG. 11B) automatically by simply activating the monitoring target device22ain a destination of the stolen device. Then, the control program decrypted by a third party is investigated and know-how can be leaked.

However, according to the monitoring target device22aof the second embodiment, when the monitoring target device22ais activated standalone in a destination of the stolen device, since authentication by the monitoring device10ais not obtained (NO in step S50), the control program is not decrypted and executed (steps S40to S44inFIG. 11B). Thus, even if the monitoring target device22aitself is stolen, it is possible to prevent know-how leakage of the control program.

Third Embodiment

Next, a monitoring system and a monitoring target device according to a third embodiment will be described with reference toFIG. 13.

(Processing flow of monitoring target device)

FIG. 13is a diagram showing a processing flow of a monitoring target device according to the third embodiment.

A process (general activation process) when the monitoring target device22aaccording to the third embodiment is activated for the second time and thereafter will be described with reference toFIG. 13.

When activated for the second time and thereafter, the monitoring target device22aaccording to the third embodiment executes again the device authentication phase. That is, when activated for the second time and thereafter, the monitoring target device22aagain requests the monitoring device10ato authenticate a device (step S20inFIG. 7). Then, after the authentication process (steps S21to S27) has been performed by the monitoring device10aor the like, authentication is received again from the monitoring device10a(step S28inFIG. 7).

The monitoring target device22adetermines whether the device is successfully authenticated by the monitoring device10ain the device authentication phase (steps S20to S28) (step S60).

When a device is successfully authenticated (YES in step S60) in the device authentication phase (steps S20to S28), the monitoring target device22aperforms the control activation process (steps S40to S44inFIG. 11B) and performs an operation according to the control program.

On the other hand, when the device is not successfully authenticated (NO in step S60) in the device authentication phase (steps S20to S28), the monitoring target device22aremoves all of information (encrypted control program E_PRG, challenge value CH) recorded in advance in the flash ROM224and the circuit (PUF circuit C_PUF, encryption key generation circuit C_ENC) formed in the FPGA222(step S61).

As described above, according to the monitoring target device22aof the third embodiment, when authentication is not received from the monitoring device10aas a result of the authentication request (step S20inFIG. 7), the device authentication request unit2202removes the encrypted control program E_PRG and the like.

According to such a form, when the monitoring target device22ais activated standalone in a destination of the stolen device, not only simply the decryption and execution of the control program (steps S40to S44inFIG. 11B) are avoided, but also all of information recorded in the flash ROM224and circuits formed in the FPGA222are removed. Therefore, when the monitoring target device22aitself is stolen, it is possible to more reliably suppress the occurrence of information leakage.

Fourth Embodiment

Next, a monitoring system and a monitoring target device according to a fourth embodiment will be described with reference toFIG. 14.

(Data structure of input and output correspondence information)

FIG. 14is a diagram showing a data structure of input and output correspondence information recorded in a monitoring device according to the fourth embodiment.

Unlike the first embodiment (FIG. 9), in CRP information recorded in the monitoring device according to the fourth embodiment, a pair of a challenge value and a response value for each of two types of PUF circuit (PUF circuit ID: α1and α2) are recorded for one monitoring target device22a(device ID: X1).

In the present embodiment, for example, before shipment of the monitoring target device22a(device ID: X1), the producer (manufacturer) of the monitoring target device22afirst installs a PUF circuit C_PUF identified by PUF circuit ID: α1and measures a pair of a challenge value and a response value of the PUF circuit C_PUF (PUF circuit ID: α1). Next, the PUF circuit C_PUF identified by PUF circuit ID: α2is installed and a pair of a challenge value and a response value of the PUF circuit C_PUF (PUF circuit ID: α2) are measured.

Then, the producer of the monitoring target device22aregisters CRP information shown inFIG. 14in the distributed ledger.

According to the above aspects, when all challenge values of the PUF circuit C_PUF (PUF circuit ID: α1) formed in the monitoring target device22a(device ID: X1) are used, another PUF circuit C_PUF (PUF circuit ID: α2) is newly installed, and thus the monitoring target device22a(device ID: X1) can be continuously used. In this case, immediately before challenge values are depleted, the monitoring target device22amay request circuit information (step S10inFIG. 6) for requesting circuit information regarding a new PUF circuit C_PUF (PUF circuit ID: α2).

In addition, in another embodiment, immediately before challenge values of the PUF circuit C_PUF (PUF circuit ID: α1) are depleted, the producer of the monitoring target device22amay temporarily collect the monitoring target device22a.Then, the producer of the monitoring target device22amay install a new PUF circuit C_PUF identified by PUF circuit ID: α2for the collected monitoring target device22a,and may register a pair of a challenge value and a response value of the PUF circuit C_PUF (PUF circuit ID: α2) in the distributed ledger.

Fifth Embodiment

Next, a monitoring system and a monitoring target device according to a fifth embodiment will be described with reference toFIG. 15andFIG. 16.

(Functional configuration of monitoring device)

FIG. 15is a diagram showing a functional configuration of a monitoring device according to the fifth embodiment.

As shown inFIG. 15, the CPU100of the monitoring device10aaccording to the fifth embodiment further exhibits a function as an input and output correspondence information registration unit1003in addition to the first to fourth embodiments. The input and output correspondence information registration unit1003first generates challenge values of a plurality of types (random numbers) in a new CRP registration phase to be described below, and transmits them to the monitoring target device22a. Next, the input and output correspondence information registration unit1003receives response values corresponding to the challenge values from the monitoring target device22a.Then, the input and output correspondence information registration unit1003creates input and output correspondence information of the PUF circuit C_PUF formed in the monitoring target device22aand registers it in the distributed ledger system constituted by the monitoring system1.

A processing flow performed by the input and output correspondence information registration unit1003in a new CRP registration phase will be described below in detail.

(Processing flow of new CRP registration phase)

FIG. 16is a diagram showing a processing flow of a new CRP registration phase executed between the monitoring device and the monitoring target device according to the fifth embodiment.

The processing flow of the new CRP registration phase shown inFIG. 16is performed in, for example, a stage in which challenge values for one PUF circuit C_PUF (for example, PUF circuit ID: α1) formed in the monitoring target device22aare depleted.

When challenge values for one PUF circuit C_PUF (PUF circuit ID: α1) are depleted, a circuit distribution phase (steps S10to S19inFIG. 6) is executed, and a new PUF circuit C_PUF (for example, PUF circuit ID: α2) is installed in the monitoring target device22a.

Here, CRP information regarding the PUF circuit C_PUF (PUF circuit ID: α2) newly installed in the monitoring target device22ais not registered in the distributed ledger in advance before shipment or the like.

In this case, the input and output correspondence information registration unit1003of the monitoring device10afirst generates a plurality of types of challenge values (random numbers) and transmits them to the monitoring target device22a(step S70).

Next, the monitoring target device22ainputs the plurality of types of challenge values which is generated to the newly installed PUF circuit C_PUF (PUF circuit ID: α2) and acquires response values (step S71).

Next, the monitoring target device22areplies with a plurality of types of response values corresponding to the plurality of types of challenge values to the monitoring device10a(step S72).

The monitoring device10acreates CRP information (that is, CRP information regarding the newly installed PUF circuit C_PUF (PUF circuit ID: α2)) including pairs of challenge values and response values based on the plurality of challenge values transmitted in step S70and the plurality of response values received from the monitoring target device22ain step S72, and registers the CRP information in the distributed ledger (step S73).

According to the above aspects, even after the monitoring target device22ais installed in the embedded system2, CRP information regarding the newly installed PUF circuit C_PUF can be created remotely. Therefore, for example, it is possible to save time and effort for creating CRP information regarding a plurality of types of PUF circuits C_PUF in advance before shipment as in the fourth embodiment.

Here, in the above embodiments, various processing procedures of the monitoring device10described above are stored in a computer readable recording medium in the form of a program, and when the program is read and executed by a computer, the various processes are performed. In addition, the computer readable recording medium is a magnetic disk, a magneto-optical disc, a CD-ROM, a DVD-ROM, a semiconductor memory, or the like. In addition, the computer program may be distributed to a computer through a communication line and the computer that has received the distributed program may execute the program.

The program may be a program for implementing a part of the above-described functionality and also be a so-called discrete file (a differential program) in which the above-described functionality is implemented in combination with a program that has already been recorded in the computer system.

In addition, in other embodiments, a form in which another computer connected via a network has some of functions of the monitoring device10described in the first to fifth embodiments (and modified examples thereof) may be used.

As described above, while some embodiments according to the present invention have been described, all of these embodiments are shown as examples, and are not intended to limit the scope of the invention. These embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit and scope of the invention. These embodiments and modifications thereof are included in the scope and spirit of the invention and included in the inventions described in the scope of the claims and scopes of equivalents thereof.

INDUSTRIAL APPLICABILITY

According to the aspects of the invention described above, it is possible to increase the reliability of authenticity determination of a product using a PUF.

REFERENCE SIGNS LIST

1000Mutual authentication reception unit

1001Circuit information distribution unit

1002Device authentication unit

1002A Transmission processing unit

1002B Reception processing unit

1002C Authentication processing unit

2200Mutual authentication unit

2201Circuit forming unit

2202Device authentication request unit

2203Encryption processing unit

2204Decrypting processing unit

SK Common key

C_ENC Encryption key generation circuit

E_PRG Encrypted control program

CH Challenge value