MANAGEMENT APPARATUS, COMPUTER PROGRAM PRODUCT, SYSTEM, DEVICE, METHOD, INFORMATION PROCESSING APPARATUS, AND SERVER

• US 20170180338A1
• Filed: 03/02/2017
• Published: 06/22/2017
• Est. Priority Date: 03/24/2015
• Status: Active Grant

• Current Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Original Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Inventors: HANATANI, Yoshikazu, OBA, Yoshihiro
• Granted Patent: US 10,454,910 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065

Abstract

According to an embodiment, a management apparatus manages pieces of information held by a plurality of devices. The apparatus includes storage, one or more processors, and a transmitter. The storage stores therein the pieces of information held by the devices. The processors generate a list of inspection values indicating the pieces of information stored in the storage. The processors generate determination information for determining, in a state where the list is concealed, whether a provided value is included in the list. The transmitter transmits the determination information to the respective devices.

Claims

1. A management apparatus that manages pieces of information held by a plurality of devices, the management apparatus comprising:

storage configured to store therein the pieces of information held by the devices;

one or more processors; and

a transmitter, wherein

the processors are configured to;

generate a list of inspection values indicating the pieces of information stored in the storage; and

generate determination information for determining, in a state where the list is concealed, whether a provided value is included in the list, and

the transmitter is configured to transmit the determination information to the respective devices.

2. The apparatus according to claim 1, wherein

the processors are further configured to:

acquire, from each of the devices, a determination result obtained by determining whether the inspection value indicating the information held by the device is included in the list based on the determination information; and

check whether the pieces of information stored in the storage are right, based on the determination results acquired from the respective devices.

3. The apparatus according to claim 2, wherein, when the determination results each indicating that the inspection value indicating the information held by the device is included in the list are acquired from a predetermined number or more of devices, the processors determine that the pieces of information stored in the storage are right.

4. The apparatus according to claim 1, wherein the determination information has a determination with a possibility of false positive, but without possibility of false negative, the false positive representing an erroneous determination that information not included in the list is determined as being included in the list, and the false negative representing an erroneous determination that information included in the list is determined as being not included in the list.

5. The apparatus according to claim 4, wherein the processors generate the determination information with the possibility of false positive set within a preset range.

6. The apparatus according to claim 1, wherein

the storage stores therein device information including pieces of information individually held by the respective devices and stores therein group information including information held in common by devices belonging to a group,

the processors:

generate a device list serving as the list of the inspection values indicating the device information stored in the storage;

generate a group list serving as the list of the inspection values indicating the group information stored in the storage;

generate device determination information for determining whether a provided value is included in the device list, in a state where the device list is concealed; and

generate group determination information for determining whether a provided value is included in the group list, in a state where the group list is concealed, and

the transmitter transmits the device determination information and the group determination information to the respective devices.

7. The apparatus according to claim 6, wherein

the device information is information including device keys assigned to the respective devices;

and

the group information is information including group keys held in common by devices belonging to respective groups.

8. The apparatus according to claim 7, wherein

the processors generate the inspection values based on pairs of device identifiers for identifying the devices and the device keys, for each pair of the device and the device key, and generate the device list by listing the generated inspection values, and

the processors generate the inspection values based on sets of group identifiers for identifying the groups, the group keys, and the device identifiers, for each pair of the group and the device, and generate the group list by listing the generated inspection values.

9. The apparatus according to claim 1, wherein the determination information is a bloom filter.

10. The apparatus according to claim 9, wherein the processors generate a plurality of initial values, and input pairs of the initial values and the inspection values included in the list to a predetermined single hash function, to generate a bit string included in the bloom filter.

11. The apparatus according to claim 1, wherein the transmitter adds a signature to the determination information, and transmits the determination information to the respective devices.

12. A computer program product comprising a computer-readable medium containing a non-transitory computer program that causes an information processing apparatus to function as the management apparatus according to claim 1.

13. A system comprising:

a first management apparatus;

a second management apparatus; and

a plurality of devices that are connectable through a network, wherein

the first management apparatus comprises;

storage configured to store therein pieces of information held by the devices; and

one or more first processors configured to encrypt the pieces of information held by the devices and stored in the storage, and transmit the encrypted information to the second management apparatus,

the second management apparatus comprises;

one or more second processors; and

a second transmitter, wherein

the second processors are configured to;

receive and decrypt the encrypted pieces of information held by the devices and stored in the storage from the first management apparatus;

generate a list of inspection values indicating the pieces of information stored in the storage; and

generate determination information for determining whether a provided value is included in the list, in a state where the list is concealed, and

the second transmitter transmits the determination information to the respective devices.

14. The system according to claim 13, wherein

the second processors are further configured to:

acquire, from each of the devices, a determination result obtained by determining, based on the determination information, whether the inspection value indicating the information held by the device is included in the list; and

check whether the pieces of information stored in the storage are right, based on the determination results acquired from the respective devices.

15. The system according to claim 14, wherein the first processors encrypt part of the pieces of information held by the devices and stored in the storage, and transmit the part of the pieces of information to the second management apparatus.

16. The system according to claim 13, wherein the second transmitter multicasts the determination information to the devices connected to the network.

17. The system according to claim 14, wherein the second processors are further configured to cause each device to update the information held by the device, after the second processors check that the information stored in the storage is right.

18. One of the devices included in the system according to claim 13.

19. The system according to claim 13, wherein

the first management apparatus further comprises a first transmitter,

the first processors are further configured to:

generate a list of inspection values indicating the pieces of information stored in the storage; and

generate determination information for determining whether a provided value is included in the list, in a state where the list is concealed, and

the first transmitter is configured to transmit the determination information to the respective devices.

20. The system according to claim 19, wherein each of the devices comprises:

a receiver configured to receive the determination information;

one or more third processors configured to provide the inspection values indicating the held information to the determination information, and cause the determination information to determine whether the inspection values are included in the list; and

a result transmitter configured to transmit a determined result obtained by the third processors, to the second management apparatus.

21. The system according to claim 20, wherein the third processors are further configured to examine the determination information.

22. The system according to claim 20, wherein

the determination information is a bloom filter,

the first management apparatus generates an initial value, and provides the initial value to the first processors and the third processors,

the first processors input the initial value acquired from the first management apparatus and the inspection values included in the list to a hash function, to generate a bit string of the bloom filter, and

the third processors input the initial value acquired from the first management apparatus and the inspection values indicating the held information to the hash function, to detect digit positions in the bit string of the bloom filter.

23. One of the devices included in the system according to claim 19.

24. A method executed in a management apparatus that manages pieces of information held by a plurality of devices, the management apparatus including storage configured to store therein the pieces of information held by the devices, the method comprising:

generating, by the management apparatus, a list of inspection values indicating the pieces of information stored in the storage;

generating, by the management apparatus, determination information for determining, in a state where the list is concealed, whether a provided value is included in the list; and

transmitting, by the management apparatus, the determination information to the respective devices.

25. A server connected to a first management apparatus, a second management apparatus, and a user terminal, the first management apparatus managing pieces of information held by a plurality of devices, the server comprising:

a first receiver configured to receive management information held by the devices from the first management apparatus;

a second receiver configured to receive a transmission request including specification information of the second management apparatus from the user terminal; and

a transmitter configured to transmit the management information to the second management apparatus, after the transmission request is received.